@aegis-scan/skills 0.5.0 → 0.5.1

package/ATTRIBUTION.md

@@ -88,6 +88,99 @@ skill catalog with content that either duplicates AEGIS' programmatic
 checks or duplicates `snailsploit-fork/` coverage. The five selected fill
 documented gaps that no other AEGIS surface covers today.
 
+## Offensive skills — pikpikcu/airecon (full skill-pack fork)
+
+All skills under `skills/offensive/airecon-fork/` are forked from
+[pikpikcu/airecon](https://github.com/pikpikcu/airecon) under MIT License.
+Upstream is an autonomous AI-driven pentesting agent; AEGIS pulls only the
+methodology skill-pack (.md files under `airecon/proxy/skills/`), not the
+Python runtime, Docker orchestration, JSON data files, or proxy/MCP scaffolding.
+
+- **Upstream author:** pikpikcu — https://github.com/pikpikcu
+- **Upstream repo:** https://github.com/pikpikcu/airecon
+- **SPDX:** MIT (`Copyright (c) 2026 pikpikcu`)
+- **Fork-SHA:** `9a21453459d87eefb012ea355c79b593d0d3c0cc`
+- **Fork date:** 2026-05-04
+- **Skill count at fork:** 141 (full upstream skills/ tree as of fork SHA)
+- **Categories pulled:** ctf, frameworks, payloads, postexploit, protocols, reconnaissance, technologies, tools, vulnerabilities (9 of 9)
+
+### Slug-naming convention
+
+Upstream layout is `airecon/proxy/skills/<category>/<...>/<file>.md`.
+AEGIS-side layout is flat `skills/offensive/airecon-fork/<slug>/SKILL.md`
+where `<slug>` = upstream relative-path with `/` and `_` mapped to `-`,
+lowercased. Examples:
+
+- `airecon/proxy/skills/postexploit/linux_privesc.md` -> `postexploit-linux-privesc`
+- `airecon/proxy/skills/ctf/crypto/modern-ciphers.md` -> `ctf-crypto-modern-ciphers`
+- `airecon/proxy/skills/vulnerabilities/idor.md` -> `vulnerabilities-idor`
+
+This flattens the 2-level upstream tree into AEGIS' 1-level
+`<source>/<name>/SKILL.md` loader convention while preserving full
+upstream provenance via the path-derived slug.
+
+### Overlap with existing forks
+
+Four upstream skills overlap by topic with `matty-fork/`:
+- `postexploit-container-escape` (vs matty `container-escape`)
+- `technologies-cicd-attacks` (vs matty `cicd-redteam`)
+- `technologies-cloud-security` (vs matty `cloud-security`)
+- `vulnerabilities-subdomain-takeover` (vs matty `subdomain-takeover`)
+
+Both forks ship — slug-prefixing under `airecon-fork/` keeps them
+independent. Operators select which to load via the skill-loader; no
+content is merged across upstream sources (do-not-remove rule applies).
+
+### Skill-pack scope (what is + what is NOT shipped)
+
+**Shipped (.md only):** 141 SKILL.md files preserving upstream content
+byte-identically, with the AEGIS aegis-local header on line 1.
+
+**Not shipped:** Python runtime under `airecon/`, Docker/Kali/Caido
+orchestration under `airecon/containers/`, JSON data files under
+`airecon/proxy/data/` (separately extractable to scanner-data dirs in a
+future cycle), phase prompts under `airecon/proxy/prompts/` (agent-runtime-
+specific), shell installers under `scripts/`. The skill-loader contract
+is `.md`-only by CI invariant (`packages/skills/skills/` markdown-only),
+so these are excluded by design.
+
+### Companion repo `airecon-dataset`
+
+pikpikcu also maintains a companion `airecon-dataset` repo (~1.09M training
+records). License of that repo is **not yet verified**; no content from it
+is integrated into AEGIS. If a future cycle wants to pull dataset-derived
+patterns into scanner data, that repo's license must be checked first.
+
+## Defensive skills — permoon/multi-model-redteam (architecture red-team)
+
+Skills under `skills/defensive/permoon-fork/` are forked from
+[permoon/multi-model-redteam](https://github.com/permoon/multi-model-redteam),
+a multi-model architecture-design-review framework.
+
+- **Upstream author:** Hector (https://github.com/permoon)
+- **SPDX:** MIT (LICENSE) + CC0 (`prompts/` directory, per upstream README)
+- **Fork-SHA:** `17b7f4dc40e9ec086efe2cbcc27954549fd53f2d`
+- **Fork date:** 2026-05-14
+- **Skill count at fork:** 3 prompts adopted as standalone SKILL.md files
+  (`multi-model-system-prompt`, `multi-model-consolidation`,
+  `multi-model-severity`)
+
+The prompts walk a single model — or three models orchestrated in
+parallel by the upstream framework — through architecture-design
+review against five failure dimensions (hidden assumptions, dependency
+failures, boundary inputs, misuse paths, rollback / blast radius)
+with structured TRIGGER / IMPACT / DETECTABILITY scenarios per
+dimension. Defensive methodology; no active probing. The AEGIS
+adoption surfaces each prompt as a standalone skill that any
+AEGIS-compatible agent can invoke regardless of how many models the
+operator actually runs.
+
+The upstream framework also ships `redteam.sh` (bash orchestrator
+across Claude / Codex / Gemini CLIs) which AEGIS does NOT adopt --
+that part of the upstream is operator-deploy tooling rather than a
+skill-pack-shape asset, and replicating it would duplicate existing
+AEGIS multi-agent orchestration patterns.
+
 ## Defensive skills — AEGIS-native
 
 All skills under `skills/defensive/aegis-native/` are AEGIS-original

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aegis-scan/skills",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "description": "AEGIS Skills — opt-in skill library for Claude Code and compatible AI agents. Offensive red-team methodology from curated sources, attribution preserved per-file. Multi-source-ready architecture with placeholder directories for future defensive (AEGIS-native) and MITRE-mapped extensions. Third sibling in the AEGIS full-repertoire toolkit alongside @aegis-scan/cli and @aegis-wizard/cli.",
   "license": "MIT",
   "author": "RideMatch1 <230386010+RideMatch1@users.noreply.github.com>",

package/sbom.cdx.json

@@ -0,0 +1 @@
+{"bomFormat":"CycloneDX","specVersion":"1.6","serialNumber":"urn:uuid:c5ddd6fa-6966-4fc7-8d54-527af50a71ca","version":1,"metadata":{"timestamp":"2026-05-16T08:07:16Z","tools":{"components":[{"group":"@cyclonedx","name":"cdxgen","version":"12.1.5","purl":"pkg:npm/%40cyclonedx/cdxgen@12.1.5","type":"application","bom-ref":"pkg:npm/@cyclonedx/cdxgen@12.1.5","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}]},"authors":[{"name":"OWASP Foundation"}],"lifecycles":[{"phase":"build"}],"component":{"name":"skills","group":"@aegis-scan","version":"0.5.1","description":"AEGIS Skills — opt-in skill library for Claude Code and compatible AI agents. Offensive red-team methodology from curated sources, attribution preserved per-file. Multi-source-ready architecture with placeholder directories for future defensive (AEGIS-native) and MITRE-mapped extensions. Third sibling in the AEGIS full-repertoire toolkit alongside @aegis-scan/cli and @aegis-wizard/cli.","purl":"pkg:npm/%40aegis-scan/skills@0.5.1","bom-ref":"pkg:npm/@aegis-scan/skills@0.5.1","author":"RideMatch1 <230386010+RideMatch1@users.noreply.github.com>","type":"application","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"externalReferences":[{"type":"vcs","url":"https://github.com/RideMatch1/a.e.g.i.s#readme"},{"type":"vcs","url":"git+https://github.com/RideMatch1/a.e.g.i.s.git"}]},"properties":[{"name":"cdx:bom:componentTypes","value":"npm"},{"name":"cdx:bom:componentNamespaces","value":"@types"},{"name":"cdx:bom:componentSrcFiles","value":"packages/skills/node_modules/@types/node/package.json\\npackages/skills/node_modules/typescript/package.json\\npackages/skills/node_modules/vitest/package.json"}]},"components":[{"authors":[{"name":"Anthony Fu <anthonyfu117@hotmail.com>"}],"group":"","name":"vitest","version":"3.2.4","description":"Next generation testing framework powered by Vite","scope":"optional","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/vitest@3.2.4","externalReferences":[{"type":"vcs","url":"https://github.com/vitest-dev/vitest#readme"},{"type":"vcs","url":"git+https://github.com/vitest-dev/vitest.git"}],"type":"framework","bom-ref":"pkg:npm/vitest@3.2.4","properties":[{"name":"SrcFile","value":"packages/skills/node_modules/vitest/package.json"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/skills/node_modules/vitest/package.json"}],"concludedValue":"packages/skills/node_modules/vitest/package.json"}]},"tags":["framework"]},{"authors":[{"name":"Microsoft Corp."}],"group":"","name":"typescript","version":"5.9.3","description":"TypeScript is a language for application scale JavaScript development","scope":"optional","licenses":[{"license":{"id":"Apache-2.0","url":"https://opensource.org/licenses/Apache-2.0"}}],"purl":"pkg:npm/typescript@5.9.3","externalReferences":[{"type":"website","url":"https://www.typescriptlang.org/"},{"type":"vcs","url":"https://github.com/microsoft/TypeScript.git"}],"type":"library","bom-ref":"pkg:npm/typescript@5.9.3","properties":[{"name":"SrcFile","value":"packages/skills/node_modules/typescript/package.json"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/skills/node_modules/typescript/package.json"}],"concludedValue":"packages/skills/node_modules/typescript/package.json"}]}},{"group":"@types","name":"node","version":"22.19.17","description":"TypeScript definitions for node","scope":"optional","licenses":[{"license":{"id":"MIT","url":"https://opensource.org/licenses/MIT"}}],"purl":"pkg:npm/%40types/node@22.19.17","externalReferences":[{"type":"vcs","url":"https://github.com/DefinitelyTyped/DefinitelyTyped/tree/master/types/node"},{"type":"vcs","url":"https://github.com/DefinitelyTyped/DefinitelyTyped.git"}],"type":"library","bom-ref":"pkg:npm/@types/node@22.19.17","properties":[{"name":"SrcFile","value":"packages/skills/node_modules/@types/node/package.json"}],"evidence":{"identity":[{"field":"purl","confidence":0.7,"methods":[{"technique":"manifest-analysis","confidence":0.7,"value":"packages/skills/node_modules/@types/node/package.json"}],"concludedValue":"packages/skills/node_modules/@types/node/package.json"}]}}],"dependencies":[],"annotations":[{"bom-ref":"metadata-annotations","subjects":["pkg:npm/@aegis-scan/skills@0.5.1"],"annotator":{"component":{"group":"@cyclonedx","name":"cdxgen","version":"12.1.5","purl":"pkg:npm/%40cyclonedx/cdxgen@12.1.5","type":"application","bom-ref":"pkg:npm/@cyclonedx/cdxgen@12.1.5","publisher":"OWASP Foundation","authors":[{"name":"OWASP Foundation"}]}},"timestamp":"2026-05-16T08:07:16Z","text":"This Software Bill-of-Materials (SBOM) document was created on Saturday, May 16, 2026 with cdxgen. The data was captured during the build lifecycle phase. The document describes an application named 'skills' with version '0.5.1'. The package type in this SBOM is npm with a single purl namespace '@types' described under components. The components were identified from 3 source files."}]}

package/skills/compliance/aegis-native/brutaler-anwalt/.claude-plugin/plugin.json

@@ -0,0 +1,108 @@
+{
+  "_schema_note": "Kein offizielles Plugin-JSON-Schema von Anthropic veroeffentlicht (Stand 2026-05). Hook-Matcher-Syntax basiert auf empirischer Pruefung der Claude-Code-Docs. Bei Schema-Veroeffentlichung: $schema-Feld nachziehen.",
+  "name": "brutaler-anwalt",
+  "version": "4.3.0",
+  "description": "Adversarial DE/EU Compliance-Auditor mit 5-Persona-Self-Verification (Hunter / Challenger / Synthesizer / Devil's-Advocate / Live-Probe) fuer DSGVO/UWG/AGB/Impressum/Cookies/AVV/NIS2/AI-Act/Branchen-/Straf-/Steuerrecht. Sachlich-praezise Schadens-Diagnose mit %-Wahrscheinlichkeit + EUR-Range + Abmahn-Simulation. Universalskill — branchenagnostisch fuer SaaS/Webseiten/Apps/Vertraege. KEINE Rechtsberatung i.S.d. RDG.",
+  "author": {
+    "name": "AEGIS / brutaler-anwalt maintainers",
+    "url": "https://github.com/RideMatch1/a.e.g.i.s"
+  },
+  "homepage": "https://github.com/RideMatch1/a.e.g.i.s",
+  "repository": "https://github.com/RideMatch1/a.e.g.i.s",
+  "license": "MIT",
+  "keywords": [
+    "dsgvo",
+    "gdpr",
+    "compliance",
+    "audit",
+    "datenschutz",
+    "uwg",
+    "abmahnung",
+    "agb",
+    "impressum",
+    "cookie",
+    "consent",
+    "ai-act",
+    "nis2",
+    "dsa",
+    "tdddg",
+    "ddg",
+    "germany",
+    "eu",
+    "legal-audit",
+    "vibecoded"
+  ],
+  "category": "Compliance",
+  "interface": {
+    "displayName": "brutaler-anwalt",
+    "shortDescription": "Adversarial DE/EU Compliance-Auditor (DSGVO/UWG/AI-Act/Branchenrecht).",
+    "longDescription": "Brutaler-anwalt fuehrt einen 5-Persona-Multi-Verification-Audit gegen DSGVO/UWG/AI-Act/NIS2/Branchen-/Straf-/Steuerrecht. Output: %-Wahrscheinlichkeit + EUR-Schadens-Range + Abmahn-Simulation. v4.3.0 fuegt Hook-basierte On-Demand-KB-Routing + WebFetch-Tier-1-Allowlist + PostWrite-Quality-Gates hinzu. KEINE Rechtsberatung i.S.d. RDG §2 (BGH I ZR 113/20 Smartlaw).",
+    "developerName": "AEGIS",
+    "category": "Compliance",
+    "capabilities": ["Interactive", "Audit", "Read"],
+    "websiteURL": "https://github.com/RideMatch1/a.e.g.i.s",
+    "defaultPrompt": [
+      "Audit diese DSGVO-Datenschutzerklaerung gegen Art. 13 / 14 / 15 DSGVO + Drittland-Pflichten.",
+      "Pruefe Cookie-Banner gegen § 25 TDDDG + EuGH Planet49 (C-673/17).",
+      "Check Impressum nach § 5 DDG fuer Vollstaendigkeit + Anbieterkennzeichnung.",
+      "Bewerte Abmahn-Risiko fuer fehlenden BFSG-Compliance-Stand (Stichtag 28.06.2025).",
+      "Auditiere AVV gegen Art. 28 DSGVO + Schrems-II-Drittland-Risiko.",
+      "Simuliere Abmahn-Schadenshoehe fuer Google-Fonts-Embed ohne Consent (BGH-Folge-Az.)."
+    ],
+    "brandColor": "#1F2937"
+  },
+  "hooks": {
+    "SessionStart": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/session_start.py"
+          }
+        ]
+      }
+    ],
+    "UserPromptSubmit": [
+      {
+        "matcher": "*",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/prompt_submit.py"
+          }
+        ]
+      }
+    ],
+    "PostToolUse": [
+      {
+        "matcher": "Write|Edit|MultiEdit",
+        "hooks": [
+          {
+            "type": "command",
+            "command": "python3 ${CLAUDE_PLUGIN_ROOT}/hooks/post_write.py"
+          }
+        ]
+      }
+    ]
+  },
+  "commands": [
+    {
+      "name": "anwalt:cold-start",
+      "description": "Einmaliges Practice-Profile-Interview (Branche / Stack / B2B-B2C / EU-Land). Schreibt .brutaler-anwalt/profile.md. Jeder folgende Audit liest dieses Profil zuerst. Spart 10 Min Re-Discovery pro Audit."
+    },
+    {
+      "name": "anwalt:audit",
+      "description": "Vollstaendiger 5-Persona-Compliance-Audit der aktuellen Codebase. Output: BRUTALER-AUDIT.md mit Findings (%-Wahrscheinlichkeit + EUR-Range + Az.-Beleg)."
+    },
+    {
+      "name": "anwalt:simulate",
+      "description": "Abmahn-Simulation auf vorhandene Findings. Generiert Streitwert-Range + modifizierte Unterlassungserklaerung."
+    },
+    {
+      "name": "anwalt:health",
+      "description": "Skill-Health-Check (References vollstaendig, Az.-Provenance OK, Hooks executable, Plugin-Manifest valid)."
+    }
+  ],
+  "disclaimer": "Diese Analyse ist keine Rechtsberatung im Sinne von § 2 RDG (BGH I ZR 113/20 Smartlaw, 09.09.2021) und ersetzt keinen zugelassenen Rechtsanwalt fuer IT-/Datenschutzrecht. Die Skill-Outputs sind technisch-indikative Hinweise auf Compliance-Risiken zur internen Vorpruefung — nicht zur Beratung Dritter."
+}