Menu
Security audit via the `agf` CLI — OWASP / STRIDE / secrets. Run when a change touches authn/authz, external I/O, or secrets, as a gate parallel to harness, or before deploying sensitive features.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Based on SOC occupation classification
Accessibility compliance audit using WCAG 2.2 AA standards, ARIA validation, screen reader testing, keyboard navigation, color contrast analysis, and i18n readiness
Execute the ANALYZE phase of the lifecycle via the `agf` CLI — PRD creation, requirements, Definition of Ready (7 checks), cross-project learning
API governance and design audit using OpenAPI/Swagger spec generation, REST maturity model, contract validation, and breaking change detection
Architecture governance using C4 Model, ADR lifecycle, Architecture Fitness Functions, layer boundary enforcement, and drift detection
Human-in-the-loop PLANNING skill — investigates the project (graph + git + harness/gaps) and runs the whole ANALYZE→DESIGN→PLAN chain in one faceted loop to produce a COMPLETE PRD injected as graph backlog (epics, tasks, testable AC) for a separate agent to implement. Applies the project's planning methodologies — Impact Mapping + OKR per epic, JTBD, MoSCoW, WSJF/Cost-of-Delay, User Story Mapping, Example Mapping (Rules/Examples → Given-When-Then AC), SPIDR splitting, INVEST, Definition of Ready, Risk Matrix; the full catalogue lives in the skill body. Stops for the human after each complete PRD and iterates the next cycle from the project's own findings (dogfood). Does NOT implement. Triggers — graph-backlog-generation, gerar backlog, criar PRD, planejar feature, detalhar épico, novo ciclo, "plan the next thing", "what should we build next".
Automated bug discovery through static analysis, LSP diagnostics, pattern detection, regression hotspot analysis, and error catalog mining
| name | graph-security |
| description | Security audit via the `agf` CLI — OWASP / STRIDE / secrets. Run when a change touches authn/authz, external I/O, or secrets, as a gate parallel to harness, or before deploying sensitive features. |
| triggers | ["graph-security"] |
| version | 2.0.0 |
| author | auto-generated |
| date | "2026-06-16T00:00:00.000Z" |
| category | REVIEW |
| phase | REVIEW |
| tokens | ~578 |
| phases | ["REVIEW","DEPLOY"] |
Security audit (OWASP / STRIDE / secrets). Drive via the agf CLI — zero MCP. Load context with agf context <id> first.
agf check <id> → agf scan-repos → agf node add --type risk
REVIEW-phase agf commands:
| Command | What it does |
|---|---|
agf check <id> | Includes the per-task security gate |
agf harness | Agent-readiness (parallel to security) |
agf node add --type risk | Track security findings as a risk node |
agf scan-repos | Scan neighbor repos for known vulns |
agf check <id> (per-task security gate)agf scan-repos (npm audit, secrets grep, Zod boundaries)agf node add --type riskPhase: SECURITY (REVIEW parallel)
Findings: N risks (K critical, M high, J medium)
Secrets: scan result
Vulns: npm audit result
STRIDE: categories covered
Gate: security pass/fail
Status: Security gate passed
Parallel to REVIEW → DEPLOY. After tasks, agf savings / agf metrics --economy-report → agf learning → calibrate next turn.
agf skill show graph-reviewagf skill show graph-deployAGENTS.md and use apply_patch for manual edits.Economia de tokens. Os levers compartilhados por todas as skills —
--select,agf retrieve-command,agf exec chain, reuso antes de criação — vivem em_shared.md→ Token Economy. Fonte única: um parágrafo repetido em trinta arquivos é o trigésimo primeiro que envelhece sozinho.