feat: sync all plugins, skills, agents updates

New plugins: core-tools New skills: auto-expense, ticket-triage, design, security-check, aiktop-tasks, daily-digest, imap-triage, index-update, mindmap, notebooklm, proc-creator, tasks-overview, validate-component, perfex-module, report, calendar-manager New agents: design-critic, design-generator, design-lead, design-prompt-architect, design-researcher, compliance-auditor, metabase-analyst, gitea-integration-specialist Updated: all plugin configs, knowledge datasets, existing skills Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 17:16:15 +00:00
parent f2b5171ea2
commit 9404af7ac9
184 changed files with 20865 additions and 1993 deletions
--- a/dev-tools/skills/chrome/SKILL.md
+++ b/dev-tools/skills/chrome/SKILL.md
@@ -2,7 +2,7 @@
 name: chrome
 description: Chrome browser integration for Claude Code. Navigate pages, fill forms, debug console, extract data, test web apps, automate tasks. Use when user mentions "chrome", "browser", "navegar site", "abrir pagina", "testar site", "preencher formulario", "extrair dados", "screenshot site", "google docs", "authenticated site", "gravar gif", "console errors".
 author: Descomplicar® Crescimento Digital
-version: 1.0.0
+version: 2.0.0
 quality_score: 80
 user_invocable: true
 allowed-tools: Bash, Read, Write, Glob
@@ -10,9 +10,13 @@ allowed-tools: Bash, Read, Write, Glob

 # /chrome - Chrome Browser Integration

-Integra Claude Code com o Chrome para automacao browser, testes, debug e extraccao de dados.
+Integra Claude Code com o Chrome para automacao browser, testes, debug, performance e extraccao de dados. Suporta dois backends: **Claude in Chrome** (extensao) e **Chrome DevTools MCP** (npm).

-## Pre-Requisitos
+## Backends Disponiveis
+
+### Backend A: Claude in Chrome (Extensao)
+
+Extensao oficial Anthropic. Requer instalacao manual no browser.

 | Requisito | Minimo | Verificar |
 |-----------|--------|-----------|
@@ -24,29 +28,59 @@ Integra Claude Code com o Chrome para automacao browser, testes, debug e extracc

 **Limitacoes:** Apenas Google Chrome (nao Brave/Arc). Nao suportado em WSL.

-## Activacao
-
-### Por sessao
+**Activacao:**
 ```bash
+# Por sessao
 claude --chrome
-```

-### Por defeito (aliases .bashrc)
-```bash
+# Por defeito (alias .bashrc)
 alias cc="claude --permission-mode bypassPermissions --chrome"
-```

-### Dentro de sessao activa
-```
-/chrome
-# Seleccionar "Enabled by default"
-```
+# Dentro de sessao activa
+/chrome -> "Enabled by default"

-### Ver ferramentas disponiveis
-```
+# Ver ferramentas
 /mcp -> seleccionar claude-in-chrome
 ```

+### Backend B: Chrome DevTools MCP (npm)
+
+Pacote oficial Google (`chrome-devtools-mcp`). Controla Chrome via DevTools Protocol. Nao requer extensao.
+
+| Requisito | Minimo | Verificar |
+|-----------|--------|-----------|
+| Google Chrome | Instalado | `google-chrome --version` |
+| Node.js | v18+ | `node --version` |
+| chrome-devtools-mcp | latest | `claude mcp list` |
+
+**Instalacao:**
+```bash
+claude mcp add chrome-devtools --scope user -- npx -y chrome-devtools-mcp@latest
+```
+
+**Activacao:**
+```bash
+# Lancar Chrome com remote debugging
+google-chrome --remote-debugging-port=9222
+
+# Reiniciar sessao Claude Code para carregar ferramentas
+```
+
+**Ferramentas disponibilizadas:**
+- `page_navigate`, `page_go_back`, `page_go_forward` - Navegacao
+- `page_screenshot` - Captura de ecra
+- `page_click`, `page_type`, `page_select_option` - Interaccao
+- `page_execute_javascript` - Executar JS no contexto da pagina
+- `page_wait_for_selector` - Esperar por elementos
+- `console_get_logs` - Ler consola (logs, errors, warnings)
+- `network_get_requests`, `network_get_response_body` - Inspeccionar rede
+- `dom_get_element`, `dom_query_selector` - Inspeccionar DOM
+- `css_get_computed_styles`, `css_get_matched_styles` - Inspeccionar CSS
+- `performance_start_trace`, `performance_stop_trace` - Gravar traces
+- `performance_analyze_insight` - Metricas automaticas (LCP, TBT, CLS)
+- `accessibility_get_tree` - Arvore de acessibilidade
+- `storage_get_cookies`, `storage_get_local_storage` - Inspecionar storage
+
 ## Capacidades

 ### 1. Navegacao e Interaccao
@@ -58,32 +92,47 @@ alias cc="claude --permission-mode bypassPermissions --chrome"

 ### 2. Debug e Diagnostico
 - Ler console logs, errors, warnings
- Inspeccionar DOM state
- Verificar network requests
+- Inspeccionar DOM state e CSS computado
+- Verificar network requests e response bodies
 - Ler JavaScript errors em tempo real
+- Inspeccionar cookies, localStorage, sessionStorage

-### 3. Extraccao de Dados
+### 3. Performance (DevTools MCP)
+- Gravar performance traces completos
+- Metricas automaticas: LCP, TBT, CLS, FCP, TTFB
+- Identificar JavaScript nao utilizado
+- Analise de recursos (tamanho, tempo de carga)
+- Equivalente a Lighthouse audit on-demand
+
+### 4. Acessibilidade (DevTools MCP)
+- Arvore de acessibilidade completa
+- Verificar roles ARIA, labels, estados
+- Identificar elementos sem texto alternativo
+
+### 5. Extraccao de Dados
 - Extrair texto estruturado de paginas
 - Scraping de tabelas, listas, precos
 - Guardar dados como CSV/JSON local
- Ler conteudo de paginas autenticadas
+- Ler conteudo de paginas autenticadas (Chrome extensao)
+- Query DOM com selectores CSS/XPath

-### 4. Testes Web
+### 6. Testes Web
 - Testar forms com dados invalidos
 - Verificar UI contra mocks
 - Validar user flows completos
 - Testar responsividade
+- Monitorizar network requests durante testes

-### 5. Sites Autenticados
+### 7. Sites Autenticados (Chrome extensao)
 - Google Docs, Gmail, Sheets
 - Notion, Slack web
 - CRMs, dashboards
 - Qualquer site com sessao activa no Chrome

-### 6. Automacao
+### 8. Automacao
 - Data entry repetitivo
 - Multi-site workflows
- Gravar demos como GIF
+- Gravar demos como GIF (Chrome extensao)
 - Preencher CRMs a partir de CSV

 ## Workflows Comuns
@@ -124,35 +173,77 @@ Verifica o meu calendario para reunioes amanha, depois para cada
 reuniao com participante externo, pesquisa o site da empresa.
 ```

-### Gravar demo GIF
+### Gravar demo GIF (Chrome extensao)
 ```
 Grava um GIF mostrando o fluxo de checkout, desde adicionar item
 ao carrinho ate a pagina de confirmacao.
 ```

-## Chrome vs Puppeteer vs WebFetch
+### Performance audit (DevTools MCP)
+```
+Abre a pagina example.com, grava um performance trace durante 5 segundos
+e analisa LCP, TBT e CLS. Sugere melhorias.
+```

-| Feature | Chrome (`--chrome`) | Puppeteer MCP | WebFetch |
-|---------|-------------------|---------------|----------|
-| Sessoes autenticadas | Sim | Nao | Nao |
-| Janela visivel | Sim | Opcional | N/A |
-| Sites privados | Sim (se logado) | Nao | Nao |
-| Headless | Nao | Sim | Sim |
-| Interaccao UI | Completa | Completa | Nao |
-| Screenshots | Sim | Sim | Nao |
-| Gravar GIF | Sim | Nao | Nao |
-| Console logs | Sim | Sim | Nao |
-| Sem Chrome | N/A | Funciona | Funciona |
-| Context usage | Alto (tools loaded) | Medio | Baixo |
+### Debug network (DevTools MCP)
+```
+Abre a pagina do dashboard, monitoriza os requests de API
+e identifica quais estao a falhar ou demorar mais de 2 segundos.
+```
+
+### Inspeccionar acessibilidade (DevTools MCP)
+```
+Abre a pagina de contacto e verifica a arvore de acessibilidade.
+Identifica elementos sem labels ou roles ARIA incorrectos.
+```
+
+### Debug CSS (DevTools MCP)
+```
+Abre a landing page e inspecciona os estilos computados do hero section.
+Verifica se o layout esta correcto em diferentes larguras.
+```
+
+## Comparacao de Backends
+
+| Feature | Chrome Extensao | DevTools MCP | Puppeteer MCP | WebFetch |
+|---------|----------------|--------------|---------------|----------|
+| Sessoes autenticadas | Sim | Sim (se Chrome aberto) | Nao | Nao |
+| Janela visivel | Sim | Sim | Opcional | N/A |
+| Sites privados | Sim (se logado) | Sim (se logado) | Nao | Nao |
+| Headless | Nao | Opcional | Sim | Sim |
+| Interaccao UI | Completa | Completa | Completa | Nao |
+| Screenshots | Sim | Sim | Sim | Nao |
+| Gravar GIF | Sim | Nao | Nao | Nao |
+| Console logs | Sim | Sim (filtrados) | Sim | Nao |
+| Network requests | Nao | Sim (detalhado) | Limitado | Nao |
+| Performance traces | Nao | Sim (LCP/TBT/CLS) | Nao | Nao |
+| Acessibilidade | Nao | Sim (a11y tree) | Nao | Nao |
+| DOM/CSS inspection | Basico | Completo | Basico | Nao |
+| Storage inspection | Nao | Sim (cookies/LS) | Nao | Nao |
+| Requer extensao | Sim | Nao | Nao | Nao |
+| Requer Chrome aberto | Sim | Sim (porta 9222) | Nao | Nao |
+| Context usage | Alto | Medio | Medio | Baixo |

 **Regra de decisao:**
- Precisa de login/sessao? -> **Chrome**
- Automacao headless? -> **Puppeteer MCP**
+- Precisa de login/sessao + GIF? -> **Chrome Extensao**
+- Debug/performance/network? -> **DevTools MCP**
+- Automacao headless CI/CD? -> **Puppeteer MCP**
 - Apenas ler conteudo publico? -> **WebFetch**

 ## Troubleshooting

-### Extensao nao detectada
+### DevTools MCP nao conecta
+1. Verificar Chrome lancado com `--remote-debugging-port=9222`
+2. Testar: `curl http://localhost:9222/json/version`
+3. Verificar MCP registado: `claude mcp list`
+4. Reiniciar sessao Claude Code
+
+### DevTools MCP sem ferramentas
+1. Verificar: `claude mcp list | grep chrome-devtools`
+2. Se nao aparece: `claude mcp add chrome-devtools --scope user -- npx -y chrome-devtools-mcp@latest`
+3. Reiniciar sessao Claude Code
+
+### Extensao nao detectada (Chrome extensao)
 1. Verificar extensao em `chrome://extensions`
 2. Verificar versao Claude Code: `claude --version` (>= 2.0.73)
 3. Confirmar Chrome aberto
@@ -183,12 +274,20 @@ ao carrinho ate a pagina de confirmacao.
 # Chrome instalado?
 google-chrome --version

-# Native host configurado?
-cat ~/.config/google-chrome/NativeMessagingHosts/com.anthropic.claude_code_browser_extension.json
-
 # Claude Code compativel?
 claude --version

+# --- DevTools MCP ---
+# MCP registado?
+claude mcp list | grep chrome-devtools
+
+# Chrome com debugging activo?
+curl -s http://localhost:9222/json/version | head -5
+
+# --- Chrome Extensao ---
+# Native host configurado?
+cat ~/.config/google-chrome/NativeMessagingHosts/com.anthropic.claude_code_browser_extension.json
+
 # Host script existe?
 ls -la ~/.claude/chrome/chrome-native-host
 ```
--- a/dev-tools/skills/db-design/SKILL.md
+++ b/dev-tools/skills/db-design/SKILL.md
@@ -196,7 +196,7 @@ Em caso de dúvidas ou para aprofundar conhecimento, consultar os seguintes data

 ```javascript
 // Pesquisar optimização MySQL
-mcp__dify-kb__dify_kb_retrieve_segments({
+mcp__notebooklm__notebook_query, mcp__dify-kb__dify_kb_retrieve_segments({
  dataset_id: "7f63ec0c-6321-488c-b107-980140199850",
  query: "mysql index optimization slow query"
 })
--- a/dev-tools/skills/nextjs/SKILL.md
+++ b/dev-tools/skills/nextjs/SKILL.md
@@ -14,6 +14,25 @@ allowed-tools: Glob

 Desenvolvimento Next.js moderno (13+) com App Router e Server Components.

+## Regra #48 - Dev Container (OBRIGATORIO)
+
+**TODOS os projectos Next.js devem ser desenvolvidos no container dev.**
+
+```
+SSH:  server="dev"  (mcp__ssh-unified__ssh_execute)
+Path: /root/Dev/<projecto>
+Sync: auto -> /media/ealmeida/Dados/Dev/<projecto> (Syncthing)
+```
+
+**Workflow:**
+1. `mcp__ssh-unified__ssh_execute server:"dev" command:"mkdir -p /root/Dev/<projecto>"`
+2. Desenvolver e testar no container
+3. `npm run build` no container antes de deploy
+4. Deploy via EasyPanel a partir do container
+5. Syncthing propaga automaticamente para PC local e colegas
+
+**NUNCA:** `npx create-next-app` directamente no PC local para projectos colaborativos.
+
 ## Quando Usar

 - Criar aplicações Next.js
--- a/dev-tools/skills/php-dev/SKILL.md
+++ b/dev-tools/skills/php-dev/SKILL.md
@@ -9,7 +9,7 @@ version: 1.2.0
 user_invocable: true
 tags: [php, laravel, symfony, api, backend, jwt, oauth, rest]
 desk_task: 1477
-allowed-tools: Read, Write, Edit, Bash, mcp__memory-supabase__search_memories, mcp__context7__get-library-docs, mcp__dify-kb__dify_kb_retrieve_segments
+allowed-tools: Read, Write, Edit, Bash, mcp__memory-supabase__search_memories, mcp__context7__get-library-docs, mcp__notebooklm__notebook_query, mcp__dify-kb__dify_kb_retrieve_segments
 category: dev
 quality_score: 80
 updated: "2026-02-04T18:00:00Z"
@@ -19,6 +19,8 @@ updated: "2026-02-04T18:00:00Z"

 Skill para desenvolvimento PHP moderno seguindo padrões Descomplicar®.

+> **Regra #48:** Projectos PHP/Laravel/Symfony devem ser desenvolvidos no **container dev** (`server:"dev"`, path `/root/Dev/<projecto>`). Sincroniza automaticamente com o PC local via Syncthing.
+
 ## Quando Usar

 - Criar APIs RESTful
@@ -339,6 +341,14 @@ Em caso de dúvidas ou para aprofundar conhecimento, consultar os seguintes data
 ### Como Consultar

 ```javascript
+# PRIMARIO: NotebookLM (Gemini 2.5 RAG)
+# mcp__notebooklm__notebook_query({notebook_id: "2876d1fe-5cea-4d98-8140-b0e1a81c6bc4", query: "<tema>"})  // Claude Code
+# mcp__notebooklm__notebook_query({notebook_id: "73102308-70ef-403e-9be9-eae0cfc62d55", query: "<tema>"})  // Desenvolvimento de MCPs
+# mcp__notebooklm__notebook_query({notebook_id: "57d9c6c9-48ba-4d83-8f71-cc890f348a53", query: "<tema>"})  // AI Code Editors
+# mcp__notebooklm__notebook_query({notebook_id: "24947ffa-0019-448a-a340-2f4a275d2eb1", query: "<tema>"})  // Programacao
+# mcp__notebooklm__notebook_query({notebook_id: "ebee9fe1-78fd-4f85-8938-f19f3ea32131", query: "<tema>"})  // Obsidian + Claude
+# FALLBACK: Dify KB (se NotebookLM insuficiente)
+
 // Pesquisar padrões Laravel
 mcp__dify-kb__dify_kb_retrieve_segments({
  dataset_id: "e7c7decc-0ded-4351-ab14-b110b3c38ec9",
--- a/dev-tools/skills/react-patterns/SKILL.md
+++ b/dev-tools/skills/react-patterns/SKILL.md
@@ -14,6 +14,8 @@ desk_task: 1478

 Skill para desenvolvimento React seguindo padrões modernos (React 18+/19).

+> **Regra #48:** Projectos React (incluindo Next.js) devem ser desenvolvidos no **container dev** (`server:"dev"`, path `/root/Dev/<projecto>`). Sincroniza automaticamente com o PC local via Syncthing.
+
 ## Quando Usar

 - Desenvolver componentes React
@@ -492,7 +494,7 @@ Em caso de dúvidas ou para aprofundar conhecimento, consultar os seguintes data

 ```javascript
 // Pesquisar padrões React
-mcp__dify-kb__dify_kb_retrieve_segments({
+mcp__notebooklm__notebook_query, mcp__dify-kb__dify_kb_retrieve_segments({
  dataset_id: "e7c7decc-0ded-4351-ab14-b110b3c38ec9",
  query: "react hooks state management"
 })
--- a/dev-tools/skills/security-check/SKILL.md
+++ b/dev-tools/skills/security-check/SKILL.md
@@ -0,0 +1,448 @@
+---
+name: security-check
+description: Comprehensive security audit for Node.js/PHP projects - dependency vulnerabilities, outdated packages, environment safety, type checking. Use before git commits.
+domain: Dev
+model: sonnet
+priority: high
+tags:
+  - security
+  - audit
+  - vulnerabilities
+  - npm
+  - composer
+  - mandatory
+---
+
+# /security-check - Security Audit Pre-Commit
+
+Auditoria de segurança completa para projectos Node.js e PHP. **Obrigatória antes de commits** (Regra CLAUDE.md #47).
+
+---
+
+## Quando Usar
+
+### OBRIGATÓRIO:
+- Antes de `git commit`
+- Antes de `git push`
+- Antes de criar Pull Request
+- Antes de deploy para produção
+
+### RECOMENDADO:
+- Após `pnpm add <package>` (especialmente AI SDKs)
+- Semanalmente em projectos activos
+- Após actualizar dependências major
+
+---
+
+## Workflow Completo
+
+### 1. Detectar Tipo de Projecto
+
+```bash
+# Verificar package managers
+if [ -f "package.json" ]; then
+  # Node.js detected
+  MANAGER="pnpm"  # ou npm/yarn
+elif [ -f "composer.json" ]; then
+  # PHP detected
+  MANAGER="composer"
+fi
+```
+
+### 2. Dependency Security Audit
+
+**Node.js:**
+```bash
+pnpm audit --json > ~/.claude-work/security-audit.json
+```
+
+**PHP:**
+```bash
+composer audit --format=json > ~/.claude-work/security-audit.json
+```
+
+**Parse resultados:**
+- Contar: critical, high, moderate, low
+- Identificar se são directas ou transitivas
+- Listar pacotes afectados
+
+### 3. Outdated Dependencies
+
+**Node.js:**
+```bash
+pnpm outdated --json > ~/.claude-work/security-outdated.json
+```
+
+**Priorizar:**
+- AI SDKs: langchain, together-ai, @tavily/core, @langchain/core
+- Security packages: @auth/*, axios, form-data
+- Framework core: next, react, prisma
+
+### 4. Environment Safety Check
+
+**Verificar ficheiros:**
+```bash
+# Lista de ficheiros a verificar
+FILES=(.env .env.local .env.production .env.development)
+
+for file in "${FILES[@]}"; do
+  if [ -f "$file" ]; then
+    # Verificar se tem placeholders ou keys reais
+    grep -E "(API_KEY|SECRET|TOKEN|PASSWORD)" "$file"
+  fi
+done
+```
+
+**Validação:**
+- ✅ `API_KEY=placeholder` (safe)
+- ❌ `API_KEY=sk-proj-abc123...` (UNSAFE - real key)
+
+### 5. Type Safety (se TypeScript)
+
+```bash
+# Verificar se é TypeScript
+if [ -f "tsconfig.json" ]; then
+  pnpm type  # ou tsc --noEmit
+fi
+```
+
+### 6. Análise de Risco AI SDKs
+
+**Padrões conhecidos:**
+
+| Pacote | Risco | Acção |
+|--------|-------|-------|
+| `langchain` | Alto | Verificar @langchain/core |
+| `together-ai` | Alto | form-data transitiva |
+| `@tavily/core` | Alto | axios transitiva |
+| `@platejs/ai` | Médio | lodash transitiva |
+
+**Workflow AI SDKs:**
+```bash
+# 1. Verificar se @langchain/core está desactualizado
+pnpm list @langchain/core
+
+# 2. Se versão < 0.3.80 (vulnerável)
+pnpm add @langchain/core@latest
+
+# 3. Re-audit
+pnpm audit
+```
+
+### 7. Gerar Relatório
+
+**Formato output:**
+
+```markdown
+## Security Audit Report
+
+**Status:** [✅ SAFE | ⚠️ ISSUES FOUND | ❌ CRITICAL]
+**Data:** YYYY-MM-DD HH:MM
+
+| Category | Status |
+|----------|--------|
+| Vulnerabilities | [N critical, M high, P moderate, Q low] |
+| Outdated Packages | N total (M major updates) |
+| Environment Safety | ✅ Placeholders only / ❌ Real keys found |
+| Type Safety | ✅ 0 errors / ❌ N errors |
+
+### Vulnerabilities Detail
+
+#### Critical (N)
+- package@version (via path) - description
+  - **Patched:** >=safe-version
+  - **Action:** [Override | Update | Replace]
+
+#### High (M)
+[...]
+
+### Outdated Packages (Priority)
+
+**AI SDKs:**
+- langchain: current → latest
+- @langchain/core: current → latest (SECURITY UPDATE)
+
+**Framework:**
+- next: current → latest
+
+### Action Required
+
+**Priority 1 (Critical):**
+1. [Acção específica]
+
+**Priority 2 (High):**
+1. [Acção específica]
+
+**Priority 3 (Maintenance):**
+1. [Acção específica]
+
+### Safe to Commit?
+
+[✅ YES | ⚠️ YES (with documentation) | ❌ NO (fix critical first)]
+
+**If YES with documentation:**
+```
+git commit -m "feat: feature X
+
+Known vulnerabilities (will be resolved):
+- package@version (severity) - waiting for upstream update
+
+Mitigation: [explanation]
+"
+```
+
+**If NO:**
+Fix critical/high vulnerabilities first. See PROC-DEV-SEC-001 for guidance.
+```
+
+### 8. Criar Flag
+
+```bash
+touch ~/.claude-work/.last-security-audit
+```
+
+**Propósito:** Hook pre-git-commit verifica esta flag. Se existe e < 1h, permite commit.
+
+---
+
+## Recomendações Específicas
+
+### Para Vulnerabilidades Transitivas
+
+**Exemplo: form-data via together-ai**
+
+```json
+// package.json
+{
+  "pnpm": {
+    "overrides": {
+      "form-data": ">=4.0.4"
+    }
+  }
+}
+```
+
+Depois:
+```bash
+pnpm install
+pnpm audit  # Verificar se resolveu
+```
+
+### Para Dependências Incompatíveis
+
+**Exemplo: @langchain/core desactualizado**
+
+```bash
+# langchain pina versão antiga
+# Solução: instalar como dependência explícita
+pnpm add @langchain/core@latest
+```
+
+### Para Vulnerabilidades Críticas
+
+**Workflow:**
+1. Verificar se há fix disponível
+2. Se sim: actualizar
+3. Se não: avaliar alternativas ao package
+4. Se nenhuma: escalar para Security Compliance Specialist
+
+---
+
+## Output Examples
+
+### Exemplo 1: Clean (0 vulnerabilities)
+
+```
+## Security Audit Report
+
+**Status:** ✅ SAFE
+**Data:** 2026-02-14 03:00
+
+| Category | Status |
+|----------|--------|
+| Vulnerabilities | 0 (all categories) ✅ |
+| Outdated Packages | 3 (1 major) |
+| Environment Safety | ✅ Placeholders only |
+| Type Safety | ✅ 0 errors |
+
+### Outdated Packages
+
+**Framework:**
+- next: 16.1.6 → 16.2.0 (minor)
+
+**Action Required:** Optional - update at convenience
+
+### Safe to Commit?
+
+✅ **YES** - No security issues found
+
+Created flag: ~/.claude-work/.last-security-audit
+```
+
+### Exemplo 2: Transitivas (precisa overrides)
+
+```
+## Security Audit Report
+
+**Status:** ⚠️ ISSUES FOUND (transitivas)
+**Data:** 2026-02-14 03:00
+
+| Category | Status |
+|----------|--------|
+| Vulnerabilities | 0 critical, 0 high, 2 moderate, 1 low |
+| Outdated Packages | 5 (2 major) |
+| Environment Safety | ✅ Placeholders only |
+| Type Safety | ✅ 0 errors |
+
+### Vulnerabilities Detail
+
+#### Moderate (2)
+- lodash@4.17.21 (via @platejs/ai)
+  - **Issue:** Prototype pollution
+  - **Patched:** >=4.17.23
+  - **Action:** Override
+
+- undici@6.22.0 (via @platejs/juice → cheerio)
+  - **Issue:** Resource exhaustion
+  - **Patched:** >=6.23.0
+  - **Action:** Override
+
+#### Low (1)
+- cookie@0.6.0 (via @auth/core)
+  - **Issue:** Out of bounds characters
+  - **Patched:** >=0.7.0
+  - **Action:** Override
+
+### Recommended Fix
+
+Add to package.json:
+```json
+{
+  "pnpm": {
+    "overrides": {
+      "lodash": ">=4.17.23",
+      "undici": ">=6.23.0",
+      "cookie": ">=0.7.0"
+    }
+  }
+}
+```
+
+Then run: `pnpm install && pnpm audit`
+
+### Safe to Commit?
+
+⚠️ **YES (with documentation)**
+
+Document in commit message:
+- 3 moderate/low vulnerabilities (all transitivas)
+- Fixed with pnpm.overrides
+```
+
+### Exemplo 3: Critical (bloquear commit)
+
+```
+## Security Audit Report
+
+**Status:** ❌ CRITICAL
+**Data:** 2026-02-14 03:00
+
+| Category | Status |
+|----------|--------|
+| Vulnerabilities | 1 critical, 0 high, 0 moderate, 0 low |
+| Outdated Packages | 8 (3 major) |
+| Environment Safety | ✅ Placeholders only |
+| Type Safety | ✅ 0 errors |
+
+### Vulnerabilities Detail
+
+#### Critical (1)
+- form-data@4.0.3 (via together-ai → @types/node-fetch)
+  - **Issue:** Unsafe random function in boundary selection
+  - **Patched:** >=4.0.4
+  - **Action:** Override OR replace together-ai
+
+### Immediate Action Required
+
+**Option 1: Override (quick fix)**
+```json
+{
+  "pnpm": {
+    "overrides": {
+      "form-data": ">=4.0.4"
+    }
+  }
+}
+```
+
+**Option 2: Evaluate alternatives**
+- Check if together-ai is essential
+- Evaluate alternative AI SDKs
+- Contact Security Compliance Specialist
+
+### Safe to Commit?
+
+❌ **NO** - Fix critical vulnerability first
+
+DO NOT create flag. DO NOT commit.
+```
+
+---
+
+## Integration
+
+### Com Hook pre-git-commit
+
+Hook verifica:
+```bash
+~/.claude-work/.last-security-audit
+```
+
+Se ficheiro existe e < 1h → permite commit
+Se não existe ou > 1h → **BLOQUEIA** commit
+
+### Com /time
+
+```bash
+# Workflow típico
+/time start 1446  # Tarefa Desk
+# ... fazer alterações ...
+/security-check   # Antes de commit
+git commit
+/time stop
+```
+
+### Com /worklog
+
+```bash
+# No worklog, mencionar se audit foi executado
+/worklog
+# → Incluirá "Security audit: ✅ 0 vulnerabilities"
+```
+
+---
+
+## Escalação
+
+| Situação | Escalar Para |
+|----------|--------------|
+| Vulnerabilidades críticas não corrigíveis | Security Compliance Specialist |
+| Dúvidas sobre overrides | Development Lead |
+| Múltiplas vulnerabilidades altas | /security-check + manual review |
+| Alternativas a packages | Research Analyst |
+
+---
+
+## Referências
+
+- [CLAUDE.md Regra #47](/home/ealmeida/.claude/CLAUDE.md)
+- [PROC-DEV-SEC-001](/media/ealmeida/Dados/Hub/06-Operacoes/Procedimentos/D7-Tecnologia/Seguranca/PROC-DEV-SEC-001-Security-Audit.md)
+- [Agent dev-helper v2.1](/home/ealmeida/.claude/plugins/marketplaces/descomplicar-plugins/dev-tools/agents/dev-helper.md)
+- [NPM Audit](https://docs.npmjs.com/cli/v10/commands/npm-audit)
+- [PNPM Audit](https://pnpm.io/cli/audit)
+- [Composer Audit](https://getcomposer.org/doc/03-cli.md#audit)
+
+---
+
+**Skill v1.0** | 2026-02-14 | Descomplicar®
+**Security First** - Zero vulnerabilities ou documentadas