BrunoMartino/Michelangelo-Dev-Toolkit
Agent Claude Code
Specialist for identifying real-world security vulnerabilities in backend codebases (APIs, services, integrations). Use proactively on any code touching user input, authentication, databases, external requests, or configuration. Focuses on exploitable issues, not theoretical ones.
BrunoMartino/Michelangelo-Dev-Toolkit
Agent Claude Code
TDD test engineering specialist. Spawn ONLY when the user explicitly requests a Red phase (write failing tests), a Green phase (minimal implementation to pass existing Red tests), or — rarely — both in the same request. Never use proactively or automatically after code edits.
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Ensures privileged and restricted-data operations emit stdout single-line JSON audit logs with canonical fields, event naming, UTC timestamps, log-injection protection, and no secrets/PII in log values. Use when adding admin flows, RBAC changes, privileged APIs, restricted data access, compliance logging, or eventid /…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Graphify companion that renders a truthful interactive HTML mirror of the workspace: file-level nodes plus visible complex excerpts (handlers, hubs, branches), including orphans and dead code. Asks via AskQuestion whether more symbol-level depth is needed. Reads graphify-out first, always censuses the filesystem. Use…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Documents complex functions and business rules with consistent block comments (JSDoc/TSDoc-style when applicable) after implementation. Use when the user asks for comments on non-trivial logic, post-refactor docs, or documentation readable by humans and agents; omit for trivial or obvious code where naming suffices.
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Audit REST, GraphQL, and RPC APIs against the OWASP API Security Top 10 (2023). Use when the user mentions 'API security,' 'API audit,' 'BOLA,' 'broken object level authorization,' 'BFLA,' 'function-level authorization,' 'mass assignment,' 'API rate limiting,' 'GraphQL security,' 'REST security,' 'API authentication,'…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Audit container images, Dockerfiles, and Kubernetes manifests for misconfigurations, excessive privileges, exposed secrets, and runtime risks. Use when the user mentions 'container security,' 'Docker security,' 'Dockerfile audit,' 'Kubernetes security,' 'K8s security,' 'pod security,' 'container hardening,' 'kubectl…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Triage a single security finding — from a scanner, audit, advisory, or report — to a defensible disposition with a mitigation plan, false-positive justification, or accepted-risk writeup. Use when the user mentions 'triage this finding,' 'is this a real vulnerability,' 'mitigation plan,' 'false positive,' 'accept this…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Guide rapid triage and initial response to security incidents following NIST SP 800-61 methodology. Use when the user mentions 'incident response,' 'security incident,' 'triage,' 'we've been hacked,' 'breach,' 'compromised,' 'malware detected,' 'suspicious activity,' 'IOC,' 'indicators of compromise,' or needs help…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Gather and correlate open source intelligence from public sources for authorized investigations, threat intelligence, and attack surface assessment. Use when the user mentions 'OSINT,' 'open source intelligence,' 'digital footprint,' 'public records,' 'threat intelligence,' 'investigate a domain,' or needs to research…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Perform structured reconnaissance and attack surface enumeration for authorized penetration tests, CTF challenges, and bug bounty programs. Use when the user mentions 'recon,' 'reconnaissance,' 'enumerate,' 'attack surface,' 'subdomain enumeration,' 'port scan,' 'fingerprint,' 'asset discovery,' or needs to map a…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Plan, scope, and execute an authorized red-team engagement — distinct from a penetration test. Covers engagement methodology, assumed-breach scenarios, ATT&CK emulation plans, rules of engagement, deconfliction with the blue team, post-engagement debriefs, and the program-level work that makes red teams actually…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Perform black-box / grey-box web application penetration testing on an authorized target — auth bypass, IDOR, session handling, business-logic flaws, parameter tampering, Burp Suite / OWASP ZAP workflows. Use when the user mentions 'web pentest,' 'web application penetration test,' 'pentesting,' 'bug bounty,' 'Burp…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Audit application source code against the OWASP Top 10 (2021) vulnerability categories — broken access control, cryptographic failures, injection, insecure design, security misconfiguration, vulnerable components, authentication failures, data integrity, logging failures, SSRF. Use when the user mentions 'OWASP,'…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Translate technical security work into the language of non-security audiences — board, executives, engineering, customer success, customers, legal, procurement, sales. Covers incident communication, post-mortem narrative, audit-findings-for-stakeholders, risk justification, security spend justification, and…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Analyzes coupling between modules using the three-dimensional model (strength, distance, volatility) from "Balancing Coupling in Software Design". Use when asking "are these modules too coupled?", "show me dependencies", "analyze integration quality", "which modules should I decouple?", "coupling report", or…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Generates a MinIO installation (Dockerfile + docker-compose.yml) and an install.md with step-by-step Coolify deployment instructions, including access methods (API/Console), bucket creation via mc or Console, and the credentials/env vars applications need. Use when the user asks to install MinIO, set up S3-compatible…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Applies encryption at rest and in transit, key and secrets management, data classification tiers, secure credential/token handling, and injection-safe data access for classified data in code and infrastructure. Use when designing APIs, databases, storage, secrets, cryptography, TLS, PII/PCI/PHI, logging masking…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Installs the MCP-explorer-for-Postgress MCP server from github.com/BrunoMartino/MCP-explorer-for-Postgress: reads the repository, follows its install instructions, asks the user for the database connection string and exposed query port, and registers the server in the project-scope .mcp.json. Use when the user asks to…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Enforces npm dependency security: vulnerability scans (Trivy/npm audit), supply-chain checks (typosquatting, install scripts, maintenance signals), lockfile integrity, and license verification with open-source-licenses.txt updates. Use when adding or changing npm dependencies, updating package.json, handling…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Creates Technical Design Documents (TDD) with mandatory and optional sections through interactive discovery. Use when user asks to "write a design doc", "create a TDD", "technical spec", "architecture document", "RFC", "design proposal", or needs to document a technical decision before implementation. Do NOT use for…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Enforces GoF design patterns exactly as documented by the developer (docs-mcp source gof-design-patterns; fallback GitHub repo). Use when writing or refactoring code with design patterns, during green-phase implementations (fase{n}.md / fase{n}Task.md), or when the user mentions GoF, design patterns, Strategy, Facade…
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Creates a Django installation with the API served by FastAPI (mounted alongside Django), with pytest for automated tests, Pydantic for object typing, SQLAlchemy as ORM, and optionally pandas + numpy for data manipulation (asks the user). Use when the user asks for a Django + FastAPI hybrid project.
BrunoMartino/Michelangelo-Dev-Toolkit
Skill Claude CodeCodex
Creates a Django installation either as an API (Django REST Framework) or as a monolith with a Vue frontend (asks the user), with pytest for automated tests, Pydantic for object typing, SQLAlchemy as ORM, and optionally pandas + numpy for data manipulation (asks the user). Use when the user asks to create or bootstrap…