_base

Pentest de backend NestJS — OWASP API Security Top 10 (2023). Cobre BOLA/IDOR, autenticação quebrada, mass assignment, SSRF, prototype pollution, injeção SQL/NoSQL, RCE via upload, race conditions (TOCTOU), JWT alg confusion, rate-limit, CORS, helmet, lógica de negócio e autorização por recurso. TRIGGERS: pentest backend, pentest nestjs, pentest api, api security, owasp api, bola, idor, mass assignment, ssrf, prototype pollution, jwt alg none, rate limit, cors misconfig, nestjs guards, nestjs security

Pentest de mobile React Native — OWASP MASVS L1/L2 + Mobile Top 10 (2024). Cobre insecure storage, SSL pinning, root/jailbreak, deeplink hijack, WebView injection, Hermes bytecode, OTA updates (Expo/CodePush), Frida hooks, anti-tamper e app signing. TRIGGERS: pentest mobile, pentest react native, react native security, masvs, mobile top 10, ssl pinning, deeplink, jailbreak detection, hermes, expo updates, mobile storage, android manifest, ios plist

Pentest de supply chain, CI/CD e infraestrutura — SCA/CVE, typosquatting, malicious postinstall, GitHub Actions (pinning por SHA, permissões, script injection, pwn-request), Docker (imagem base, rootless, secrets em layer), lockfile poisoning, SBOM, gestão de secrets e GitOps. TRIGGERS: supply chain, sca, cve, github actions security, docker security, sbom, dependabot, codeql, typosquat, postinstall malicious, lockfile, pin dependencies, renovate, secret management

Pentest de frontend Angular (Web) — OWASP Top 10 2025, DOM security, XSS, CSRF, CSP, template injection, sanitização, storage de tokens, open redirect, clickjacking, cache poisoning. TRIGGERS: pentest web, pentest angular, angular security, xss angular, csp angular, frontend security, dom xss, bypass security trust, angular storage, cookie httponly

Architecture Review - Avalia decisões arquiteturais geradas por IA: tradeoffs, confiabilidade (testes de falha) e contingências (disaster recovery). TRIGGERS: architecture review, revisar arquitetura, tradeoffs, confiabilidade, failure test, teste de falha, resilience, chaos engineering, contingência, disaster recovery, fallback, circuit breaker, banco fora, validar arquitetura, relatório completo, arquiteto sênior

Performance Audit - Detecta problemas de performance gerados por IA em código Angular/NestJS: N+1 queries, race conditions e memory leaks. TRIGGERS: audit performance, performance review, detectar N+1, race condition, memory leak, vazamento de memoria, relatório completo, validar performance, performance report, concurrency issue, subscription leak, queries redundantes

Security & Pentest Audit - Valida segurança de código gerado por IA: security lint, secret scan, scan de vulnerabilidades em dependências e pinagem de versões. TRIGGERS: pentest, security review, audit security, security scan, scan de segurança, secret scan, vazamento de credenciais, exploit lib, vulnerabilidade, SAST, pinar dependências, lockfile, validar segurança, relatório completo, github actions security

Deep Architecture Health Check - Comprehensive audit using all 19 architecture knowledge base documents. Validates clean architecture layers, DDD compliance, type safety, reactive patterns, error handling, and more. TRIGGERS: arch doctor, architecture health, deep audit, architecture check, full audit, health check, architecture score

Architecture Validation - Validates Nx workspace architecture, lib boundaries, and dependency rules. TRIGGERS: validate architecture, check dependencies, module boundaries, lib structure, verify tags, architecture compliance, dependency matrix

Code Review - Reviews code for standards compliance, patterns, and best practices. TRIGGERS: review code, code review, check standards, review PR, review changes, check patterns, standards compliance

Code Generation - Writes and refactors code following established patterns and architecture rules. TRIGGERS: implement feature, write code, create component, create service, create facade, refactor code, fix code, implement

Full Domain Structure Generator - Creates complete vertical slices: domain + data-access + data-source + feature. Generates all boilerplate with correct tags, paths, barrel exports, and test stubs. TRIGGERS: scaffold domain, create domain, new entity, new domain, scaffold, criar dominio, nova entidade, vertical slice

Import Organization Enforcer - Detects and auto-fixes import order violations and barrel imports. Enforces Angular > third-party > PrimeNG > shared > local grouping and direct imports over barrels. TRIGGERS: fix imports, import order, organize imports, barrel imports, import groups, corrigir imports

Legacy Pattern Migrator - Migrates Angular/TypeScript code from legacy patterns to modern ones. Handles NgModules to standalone, *ngIf to @if, decorators to functions, BehaviorSubject to signals, PrimeNG directives to components. TRIGGERS: migrate, migration, modernize, upgrade pattern, legacy to modern, convert ngIf, convert to signals, migrate standalone, modernizar

Design Pattern Recommender - Suggests applicable design patterns from the 27 cataloged patterns based on context. Provides code skeletons using project conventions and anti-patterns to avoid. TRIGGERS: suggest pattern, which pattern, design pattern, pattern advice, recommend pattern, qual padrao, sugerir padrao

Type Safety Scanner - Scans codebase for weak typing patterns: any usage, missing generics, implicit any, unsafe casting. Recommends type-safe alternatives based on architecture knowledge base patterns. TRIGGERS: type audit, type safety, find any, type check, weak types, type scan, audit types, verificar tipos

Issue Investigation - Investigates bugs, errors, and unexpected behavior in the codebase. TRIGGERS: debug, investigate bug, fix error, why is failing, investigate error, root cause, stack trace, test failing

Documentation Writer - Creates and maintains documentation for code, APIs, and features. TRIGGERS: write docs, create readme, document api, add jsdoc, documentation, create documentation

Browser E2E Testing - Tests functionality end-to-end in a real browser using Chrome DevTools MCP. TRIGGERS: e2e test, browser test, test in browser, test login flow, test form, visual test, responsive test, test user flow

Codebase Exploration - Explores and understands codebase structure, patterns, and implementations. TRIGGERS: explore code, find pattern, understand flow, how does it work, where is implemented, find implementation, codebase structure

Git Operations - Manages git operations: analyzes changes, creates commits following conventions. TRIGGERS: git commit, create commit, commit changes, git status, analyze changes, conventional commit, git branch

Nx Workspace Operations - Manages Nx workspace: generators, affected analysis, project graph. TRIGGERS: nx generate, create lib, create library, nx graph, affected projects, nx workspace, generate component

Quality Assurance Runner - Executes lint, test, and build validation pipeline. TRIGGERS: run tests, run lint, run build, validate code, qa check, pre-commit validation, affected projects, nx affected, check quality

Unit Test Writer - Creates unit tests following Jest patterns with proper mocking. TRIGGERS: write tests, create tests, unit tests, test facade, test component, test service, add tests, jest tests