CommunityProdutividade e Colaboraçãogithub.com

addyosmani/segurança-e-endurecimento

Endurece o código contra vulnerabilidades. Use ao lidar com entrada do usuário, autenticação, armazenamento de dados ou integrações externas. Use ao construir qualquer recurso que aceite dados não confiáveis, gerencie sessões de usuário ou interaja com serviços de terceiros.

O que é segurança-e-endurecimento?

Este perito de segurança reforça a proteção do seu código contra vulnerabilidades comuns. Ele é essencial ao lidar com entrada de dados do usuário, processos de autenticação, armazenamento seguro de dados e integrações com serviços externos. A habilidade inspeciona proativamente o código em busca de falhas como injeção SQL, cross-site scripting (XSS) e exposição de dados sensíveis, aplicando automaticamente correções e boas práticas de segurança. Funciona de forma transparente com assistentes de codificação como Claude Code, Cursor e Codex, analisando o contexto do código em tempo real e sugerindo modificações seguras. Ao adotar este perito, os desenvolvedores podem construir funcionalidades com confiança, sabendo que as defesas de segurança estão sendo implementadas corretamente desde o início, reduzindo significativamente o risco de exploração por atacantes.

Funciona com~Claude Code~Codex CLI~Cursor
Part ofAgent Workflows
npx skills add https://github.com/addyosmani/agent-skills/tree/main/skills/security-and-hardening

Installed? Explore more Produtividade e Colaboração skills: steipete/gemini, steipete/gh-issues, steipete/skill-creator · View all 6 →

Ver original→Navegar por todas as habilidades

Perguntar na sua IA favorita

Abre um novo chat com esta habilidade de agente já pré-carregada.

OpenAIChatGPTClaudeClaudeGeminiGeminiGrokGrokPerplexityPerplexityDeepSeekDeepSeek

Documentação

O que segurança-e-endurecimento faz?

Endurece o código contra vulnerabilidades. Use ao lidar com entrada do usuário, autenticação, armazenamento de dados ou integrações externas. Use ao construir qualquer recurso que aceite dados não confiáveis, gerencie sessões de usuário ou interaja com serviços de terceiros.

Descrição

Este perito de segurança reforça a proteção do seu código contra vulnerabilidades comuns. Ele é essencial ao lidar com entrada de dados do usuário, processos de autenticação, armazenamento seguro de dados e integrações com serviços externos.

Funcionalidades

  • Validação de Entrada: Detecta e mitiga riscos de injeção (SQL, XSS, etc.) sanitizando automaticamente a entrada do usuário.
  • Autenticação Segura: Reforça práticas seguras de gerenciamento de sessão, armazenamento de senhas e tokens.
  • Proteção de Dados: Garante que dados sensíveis sejam criptografados e armazenados de forma segura.
  • Integrações Externas: Audita chamadas a APIs de terceiros para evitar vazamento de informações e falhas de segurança.
  • Correção Automática: Aplica patches e boas práticas de segurança no código sem intervenção manual.

Como Usar

  1. Ative o perito addyosmani/segurança-e-endurecimento no seu assistente de codificação (Claude Code, Cursor, Codex, etc.).
  2. Quando escrever ou revisar código que lida com entrada do usuário, autenticação, armazenamento de dados ou integrações externas, o perito analisará automaticamente o contexto.
  3. Siga as sugestões e correções fornecidas para endurecer a segurança do seu código.

Exemplo

# Código vulnerável
user_input = request.GET.get('query')
db.execute("SELECT * FROM dados WHERE nome = '" + user_input + "'")

# Após endurecimento (sugestão do perito)
user_input = sanitize_input(request.GET.get('query'))
db.execute("SELECT * FROM dados WHERE nome = ?", (user_input,))

Compatibilidade

  • Plataformas: Claude Code, Cursor, Codex e outros assistentes de codificação compatíveis com skills.
  • Linguagens: Suporta JavaScript, Python, TypeScript, Java, Go e outras linguagens comuns.

Suporte

Para reportar problemas ou sugerir melhorias, visite o repositório oficial.

Use este perito para construir software mais seguro desde o início.

Individual skills in this repo

This repo contains 20 individual skills — each has its own dedicated page.

addyosmani/agent-skills

Builds production-quality, accessible, responsive user-facing UIs. Use when building or modifying interfaces and pages, creating components, implementing layouts, meeting WCAG accessibility requirements, managing state, or when the output needs to look and feel production-quality rather than AI-generated.

addyosmani/agent-skills

Prepares production launches. Use when preparing to deploy to production, or when asking what needs to be in place before shipping. Use when you need a pre-launch checklist, when setting up monitoring, when planning a staged rollout, or when you need a rollback strategy.

addyosmani/agent-skills

Guides stable API and interface design. Use when designing APIs, module boundaries, or any public interface. Use when creating REST or GraphQL endpoints, defining type contracts between modules, or establishing boundaries between frontend and backend.

addyosmani/browser-testing-with-devtools

Tests in real browsers via Chrome DevTools MCP. Use when building or debugging anything that runs in a browser. Use when you need to inspect the DOM, capture console errors, analyze network requests, profile performance, or verify visual output with real runtime data. Requires the chrome-devtools MCP server to be configured.

addyosmani/ci-cd-and-automation

Automates CI/CD pipeline setup. Use when setting up or modifying build and deployment pipelines. Use when you need to automate quality gates, configure test runners in CI, or establish deployment strategies.

addyosmani/code-review-and-quality

Conducts multi-axis code review. Use before merging any change. Use when reviewing code written by yourself, another agent, or a human. Use when you need to assess code quality across multiple dimensions before it enters the main branch.

addyosmani/code-simplification

Simplifies code for clarity. Use when refactoring code for clarity without changing behavior. Use when code works but is harder to read, maintain, or extend than it should be. Use when reviewing code that has accumulated unnecessary complexity.

addyosmani/constraint-driven-development

Establishes a project's quality bar as a written contract and stops agents quietly lowering it. Interviews the user on which dimensions matter, supplies sane default thresholds when they have no number in mind, records everything in CONSTRAINTS.md, and watches the diff for a weakened bar — new @ts-ignore or eslint-disable suppressions, skipped or deleted tests, assertions stripped out, unimplemented stubs, thresholds edited down. Use when no quality bar is written down, when the user says "set up constraints" or "define our standards", when the user wants dimensions they care about — accessibility, web performance, coverage — set up as enforced constraints, when an agent keeps silencing checks or skipping tests to get to green, when you need a coverage or performance threshold and don't know what number to pick, or when an agent writes more code than anyone will read.

addyosmani/debugging-and-error-recovery

Guides systematic root-cause debugging. Use when tests fail, builds break, behavior doesn't match expectations, or you encounter any unexpected error. Use when you need a systematic approach to finding and fixing the root cause rather than guessing.

addyosmani/deprecation-and-migration

Manages deprecation and migration. Use when removing old systems, APIs, or features. Use when migrating users from one implementation to another. Use when deciding whether to maintain or sunset existing code.

addyosmani/documentation-and-adrs

Records decisions and documentation. Use when making architectural decisions, changing public APIs, shipping features, or when you need to record context that future engineers and agents will need to understand the codebase.

addyosmani/doubt-driven-development

Subjects every non-trivial decision to a fresh-context adversarial review before it stands. Use when correctness matters more than speed, when working in unfamiliar code, when stakes are high (production, security-sensitive logic, irreversible operations), or any time a confident output would be cheaper to verify now than to debug later.

addyosmani/git-workflow-and-versioning

Structures git workflow practices. Use when making any code change. Use when committing, branching, resolving conflicts, or when you need to organize work across multiple parallel streams.

addyosmani/idea-refine

Refines raw ideas into sharp, actionable concepts through structured divergent and convergent thinking. Use when an idea is still vague, when you need to stress-test assumptions before committing to a plan, or when you want to expand options before converging on one. Triggers on "ideate", "refine this idea", or "stress-test my plan".

addyosmani/incremental-implementation

Delivers changes incrementally. Use when implementing any feature or change that touches more than one file. Use when you're about to write a large amount of code at once, or when a task feels too big to land in one step.

addyosmani/interview-me

Extracts what the user actually wants instead of what they think they should want. Achieves this through one-question-at-a-time interview until ~95% confidence about the underlying intent. Use when an ask is underspecified ("build me X" without "for whom" or "why now"), when the user explicitly invokes ("interview me", "grill me", "are we sure?", "stress-test my thinking"), or when you catch yourself silently filling in ambiguous requirements before any plan, spec, or code exists.

addyosmani/observability-and-instrumentation

Instruments code so production behavior is visible and diagnosable. Use when adding logging, metrics, tracing, or alerting. Use when shipping any feature that runs in production and you need evidence it works. Use when production issues are reported but you can't tell what happened from the available data.

addyosmani/performance-optimization

Optimizes application performance. Use when performance requirements exist, when you suspect performance regressions, or when Core Web Vitals or load times need improvement. Use when profiling reveals bottlenecks that need fixing.

addyosmani/planning-and-task-breakdown

Breaks work into ordered tasks. Use when you have a spec or clear requirements and need to break work into implementable tasks. Use when a task feels too large to start, when you need to estimate scope, or when parallel work is possible.

addyosmani/source-driven-development

Grounds every implementation decision in official documentation. Use when you want authoritative, source-cited code free from outdated patterns. Use when building with any framework or library where correctness matters.

Habilidades Relacionadas

steipete/gemini

Gemini CLI one-shot prompts, summaries, generation, skills, hooks, MCP, or Gemma routing.

community

steipete/gh-issues

Fetch GitHub issues, select candidates, spawn background fix agents, open PRs, and optionally process PR review comments.

community

steipete/skill-creator

Create, edit, audit, tidy, validate, or restructure AgentSkills and SKILL.md files.

community

steipete/clawhub

Search, install, update, sync, or publish agent skills with the ClawHub CLI and registry.

community

steipete/coding-agent

Delegate coding work to Codex, Claude Code, or OpenCode as background workers; not simple edits or read-only code lookup.

community

steipete/mcporter

List, configure, authenticate, call, and inspect MCP servers/tools with mcporter over HTTP or stdio.

community
← More Produtividade e Colaboração skills