Evandro Fonseca Junior
722c544b72
Four SKILL.md-based workflows for agent-driven development: frontend/UI, backend/API, architecture, and security code review. Each workflow defines phases with verification steps, acceptance criteria and hard rules so agents deliver work that can be checked instead of asserted. The security review consults live sources (OSV.dev, GitHub Advisory, NVD) because model CVE knowledge is frozen at training cutoff. Includes a QA harness (qa/) that scores workflows on 30+ criteria, a non-regression gate, and meta-tests that corrupt the harness to prove it detects regressions.
4.7 KiB
4.7 KiB
Skills usadas e de onde vieram
Este é o inventário do que os workflows carregam. Cada skill é um diretório
com um SKILL.md; para o Hermes Agent, vão em ~/.hermes/skills/.
Pilar de segurança (wf-security-review)
| Skill | Origem | O que faz |
|---|---|---|
safedeps |
Jeneidi/safedeps | Consulta OSV.dev em tempo real; CVE por package@version com severidade e versão de fix. Inclui o script check_deps.py |
sca-audit |
OWASP/secure-agent-playbook | SCA de dependências com análise de alcance (reachability), mapeamento CWE |
code-review-security |
OWASP/secure-agent-playbook | Code review de segurança sistemático mapeado a OWASP Top 10 + ASVS |
secrets-scan |
OWASP/secure-agent-playbook | Detecta credenciais/API keys no código e no git history |
api-security-review |
OWASP/secure-agent-playbook | Revisão de API contra OWASP API Security Top 10 |
web-security-review |
OWASP/secure-agent-playbook | Web app contra OWASP Top 10 (2021) |
cve-triage |
UnitOneAI/SecuritySkills | Prioriza CVE por CVSS 4.0 / EPSS / CISA KEV |
patch-prioritization |
UnitOneAI/SecuritySkills | Decide a ordem de remediação |
dependency-scanning |
UnitOneAI/SecuritySkills | Varredura de dependências |
Frontend / UI / design (wf-frontend)
| Skill | Origem | O que faz |
|---|---|---|
frontend-design |
anthropics/skills | Direção visual, tipografia, fugir do genérico |
web-design |
KAOPU-XiaoPu/web-design | Estética web coesa |
vercel-react-best-practices |
vercel-labs/agent-skills | 40+ regras de perf React/Next |
vercel-composition-patterns |
vercel-labs/agent-skills | Compound components, composição |
animate |
emilkowalski/skill | Motion com propósito |
anti-ai-slop |
local | Detecta padrão visual "gerado por IA" |
avoid-ai-writing |
conorbronsdon/avoid-ai-writing | Remove AI-isms de texto/microcopy |
Backend / API (wf-backend)
| Skill | Origem | O que faz |
|---|---|---|
secure-coding |
v6x/secure-coding-skill | Padrões de codificação segura em 15 stacks |
bola-detector |
apisec-inc/apisec-skills | Detecta object-level authorization (OWASP API1) |
auth-rbac-scaffold |
apisec-inc/apisec-skills | Auth/RBAC (OWASP API2/API5) |
injection-checker |
apisec-inc/apisec-skills | Injection SQL/ORM/shell (OWASP API8) |
openapi-hardener |
apisec-inc/apisec-skills | Saneia schemas OpenAPI/Zod (OWASP API3) |
api-security-review |
apisec-inc/apisec-skills | Review completo OWASP API Top 10 |
security-test-generator |
apisec-inc/apisec-skills | Gera testes de segurança |
Arquitetura (wf-architecture)
| Skill | Origem | O que faz |
|---|---|---|
system-design |
Kotivskyi/architecture-governance-skills | Framework HelloInterview de system design |
c4-architecture |
Kotivskyi/architecture-governance-skills | Diagramas C4 (Mermaid/Structurizr) |
isaqb-architecture-governance |
Kotivskyi/architecture-governance-skills | arc42 + ADR |
secure-architecture-governance |
Kotivskyi/architecture-governance-skills | Threat model STRIDE+CIA, S-ADR |
Caça de bugs (todas)
| Skill | Origem | O que faz |
|---|---|---|
hermaguard |
Sahil-SS9/hermaguard | Review adversarial: pre-scan + 3 agentes (edge cases, ataque, blast radius) |
Como instalar as skills de origem
A maioria instala via npx skills (formato agentskills.io):
npx skills add anthropics/skills --skill frontend-design
npx skills add vercel-labs/agent-skills --skill vercel-react-best-practices
npx skills add conorbronsdon/avoid-ai-writing
As de segurança do OWASP e UnitOne instalam clonando e copiando o diretório da skill:
git clone --depth 1 https://github.com/OWASP/secure-agent-playbook.git
cp -r secure-agent-playbook/plugins/code-security-skills/skills/{sca-audit,secrets-scan} ~/.hermes/skills/
git clone --depth 1 https://github.com/UnitOneAI/SecuritySkills.git
cp -r SecuritySkills/skills/vuln-management/{cve-triage,patch-prioritization} ~/.hermes/skills/
O safedeps precisa do script junto da skill:
git clone --depth 1 https://github.com/Jeneidi/safedeps.git
cp -r safedeps/skills/safedeps ~/.hermes/skills/safedeps
cp safedeps/check_deps.py ~/.hermes/skills/safedeps/