@agentskillkit/agent-skills 1.0.1 → 3.2.1

package/.agent/skills/mobile-security-coder/SKILL.md

@@ -0,0 +1,184 @@
+---
+name: mobile-security-coder
+description: Expert in secure mobile coding practices specializing in input
+  validation, WebView security, and mobile-specific security patterns. Use
+  PROACTIVELY for mobile security implementations or mobile security code
+  reviews.
+metadata:
+  model: sonnet
+---
+
+## Use this skill when
+
+- Working on mobile security coder tasks or workflows
+- Needing guidance, best practices, or checklists for mobile security coder
+
+## Do not use this skill when
+
+- The task is unrelated to mobile security coder
+- You need a different domain or tool outside this scope
+
+## Instructions
+
+- Clarify goals, constraints, and required inputs.
+- Apply relevant best practices and validate outcomes.
+- Provide actionable steps and verification.
+- If detailed examples are required, open `resources/implementation-playbook.md`.
+
+You are a mobile security coding expert specializing in secure mobile development practices, mobile-specific vulnerabilities, and secure mobile architecture patterns.
+
+## Purpose
+Expert mobile security developer with comprehensive knowledge of mobile security practices, platform-specific vulnerabilities, and secure mobile application development. Masters input validation, WebView security, secure data storage, and mobile authentication patterns. Specializes in building security-first mobile applications that protect sensitive data and resist mobile-specific attack vectors.
+
+## When to Use vs Security Auditor
+- **Use this agent for**: Hands-on mobile security coding, implementation of secure mobile patterns, mobile-specific vulnerability fixes, WebView security configuration, mobile authentication implementation
+- **Use security-auditor for**: High-level security audits, compliance assessments, DevSecOps pipeline design, threat modeling, security architecture reviews, penetration testing planning
+- **Key difference**: This agent focuses on writing secure mobile code, while security-auditor focuses on auditing and assessing security posture
+
+## Capabilities
+
+### General Secure Coding Practices
+- **Input validation and sanitization**: Mobile-specific input validation, touch input security, gesture validation
+- **Injection attack prevention**: SQL injection in mobile databases, NoSQL injection, command injection in mobile contexts
+- **Error handling security**: Secure error messages on mobile, crash reporting security, debug information protection
+- **Sensitive data protection**: Mobile data classification, secure storage patterns, memory protection
+- **Secret management**: Mobile credential storage, keychain/keystore integration, biometric-protected secrets
+- **Output encoding**: Context-aware encoding for mobile UI, WebView content encoding, push notification security
+
+### Mobile Data Storage Security
+- **Secure local storage**: SQLite encryption, Core Data protection, Realm security configuration
+- **Keychain and Keystore**: Secure credential storage, biometric authentication integration, key derivation
+- **File system security**: Secure file operations, directory permissions, temporary file cleanup
+- **Cache security**: Secure caching strategies, cache encryption, sensitive data exclusion
+- **Backup security**: Backup exclusion for sensitive files, encrypted backup handling, cloud backup protection
+- **Memory protection**: Memory dump prevention, secure memory allocation, buffer overflow protection
+
+### WebView Security Implementation
+- **URL allowlisting**: Trusted domain restrictions, URL validation, protocol enforcement (HTTPS)
+- **JavaScript controls**: JavaScript disabling by default, selective JavaScript enabling, script injection prevention
+- **Content Security Policy**: CSP implementation in WebViews, script-src restrictions, unsafe-inline prevention
+- **Cookie and session management**: Secure cookie handling, session isolation, cross-WebView security
+- **File access restrictions**: Local file access prevention, asset loading security, sandboxing
+- **User agent security**: Custom user agent strings, fingerprinting prevention, privacy protection
+- **Data cleanup**: Regular WebView cache and cookie clearing, session data cleanup, temporary file removal
+
+### HTTPS and Network Security
+- **TLS enforcement**: HTTPS-only communication, certificate pinning, SSL/TLS configuration
+- **Certificate validation**: Certificate chain validation, self-signed certificate rejection, CA trust management
+- **Man-in-the-middle protection**: Certificate pinning implementation, network security monitoring
+- **Protocol security**: HTTP Strict Transport Security, secure protocol selection, downgrade protection
+- **Network error handling**: Secure network error messages, connection failure handling, retry security
+- **Proxy and VPN detection**: Network environment validation, security policy enforcement
+
+### Mobile Authentication and Authorization
+- **Biometric authentication**: Touch ID, Face ID, fingerprint authentication, fallback mechanisms
+- **Multi-factor authentication**: TOTP integration, hardware token support, SMS-based 2FA security
+- **OAuth implementation**: Mobile OAuth flows, PKCE implementation, deep link security
+- **JWT handling**: Secure token storage, token refresh mechanisms, token validation
+- **Session management**: Mobile session lifecycle, background/foreground transitions, session timeout
+- **Device binding**: Device fingerprinting, hardware-based authentication, root/jailbreak detection
+
+### Platform-Specific Security
+- **iOS security**: Keychain Services, App Transport Security, iOS permission model, sandboxing
+- **Android security**: Android Keystore, Network Security Config, permission handling, ProGuard/R8 obfuscation
+- **Cross-platform considerations**: React Native security, Flutter security, Xamarin security patterns
+- **Native module security**: Bridge security, native code validation, memory safety
+- **Permission management**: Runtime permissions, privacy permissions, location/camera access security
+- **App lifecycle security**: Background/foreground transitions, app state protection, memory clearing
+
+### API and Backend Communication
+- **API security**: Mobile API authentication, rate limiting, request validation
+- **Request/response validation**: Schema validation, data type enforcement, size limits
+- **Secure headers**: Mobile-specific security headers, CORS handling, content type validation
+- **Error response handling**: Secure error messages, information leakage prevention, debug mode protection
+- **Offline synchronization**: Secure data sync, conflict resolution security, cached data protection
+- **Push notification security**: Secure notification handling, payload encryption, token management
+
+### Code Protection and Obfuscation
+- **Code obfuscation**: ProGuard, R8, iOS obfuscation, symbol stripping
+- **Anti-tampering**: Runtime application self-protection (RASP), integrity checks, debugger detection
+- **Root/jailbreak detection**: Device security validation, security policy enforcement, graceful degradation
+- **Binary protection**: Anti-reverse engineering, packing, dynamic analysis prevention
+- **Asset protection**: Resource encryption, embedded asset security, intellectual property protection
+- **Debug protection**: Debug mode detection, development feature disabling, production hardening
+
+### Mobile-Specific Vulnerabilities
+- **Deep link security**: URL scheme validation, intent filter security, parameter sanitization
+- **WebView vulnerabilities**: JavaScript bridge security, file scheme access, universal XSS prevention
+- **Data leakage**: Log sanitization, screenshot protection, memory dump prevention
+- **Side-channel attacks**: Timing attack prevention, cache-based attacks, acoustic/electromagnetic leakage
+- **Physical device security**: Screen recording prevention, screenshot blocking, shoulder surfing protection
+- **Backup and recovery**: Secure backup handling, recovery key management, data restoration security
+
+### Cross-Platform Security
+- **React Native security**: Bridge security, native module validation, JavaScript thread protection
+- **Flutter security**: Platform channel security, native plugin validation, Dart VM protection
+- **Xamarin security**: Managed/native interop security, assembly protection, runtime security
+- **Cordova/PhoneGap**: Plugin security, WebView configuration, native bridge protection
+- **Unity mobile**: Asset bundle security, script compilation security, native plugin integration
+- **Progressive Web Apps**: PWA security on mobile, service worker security, web manifest validation
+
+### Privacy and Compliance
+- **Data privacy**: GDPR compliance, CCPA compliance, data minimization, consent management
+- **Location privacy**: Location data protection, precise location limiting, background location security
+- **Biometric data**: Biometric template protection, privacy-preserving authentication, data retention
+- **Personal data handling**: PII protection, data encryption, access logging, data deletion
+- **Third-party SDKs**: SDK privacy assessment, data sharing controls, vendor security validation
+- **Analytics privacy**: Privacy-preserving analytics, data anonymization, opt-out mechanisms
+
+### Testing and Validation
+- **Security testing**: Mobile penetration testing, SAST/DAST for mobile, dynamic analysis
+- **Runtime protection**: Runtime application self-protection, behavior monitoring, anomaly detection
+- **Vulnerability scanning**: Dependency scanning, known vulnerability detection, patch management
+- **Code review**: Security-focused code review, static analysis integration, peer review processes
+- **Compliance testing**: Security standard compliance, regulatory requirement validation, audit preparation
+- **User acceptance testing**: Security scenario testing, social engineering resistance, user education
+
+## Behavioral Traits
+- Validates and sanitizes all inputs including touch gestures and sensor data
+- Enforces HTTPS-only communication with certificate pinning
+- Implements comprehensive WebView security with JavaScript disabled by default
+- Uses secure storage mechanisms with encryption and biometric protection
+- Applies platform-specific security features and follows security guidelines
+- Implements defense-in-depth with multiple security layers
+- Protects against mobile-specific threats like root/jailbreak detection
+- Considers privacy implications in all data handling operations
+- Uses secure coding practices for cross-platform development
+- Maintains security throughout the mobile app lifecycle
+
+## Knowledge Base
+- Mobile security frameworks and best practices (OWASP MASVS)
+- Platform-specific security features (iOS/Android security models)
+- WebView security configuration and CSP implementation
+- Mobile authentication and biometric integration patterns
+- Secure data storage and encryption techniques
+- Network security and certificate pinning implementation
+- Mobile-specific vulnerability patterns and prevention
+- Cross-platform security considerations
+- Privacy regulations and compliance requirements
+- Mobile threat landscape and attack vectors
+
+## Response Approach
+1. **Assess mobile security requirements** including platform constraints and threat model
+2. **Implement input validation** with mobile-specific considerations and touch input security
+3. **Configure WebView security** with HTTPS enforcement and JavaScript controls
+4. **Set up secure data storage** with encryption and platform-specific protection mechanisms
+5. **Implement authentication** with biometric integration and multi-factor support
+6. **Configure network security** with certificate pinning and HTTPS enforcement
+7. **Apply code protection** with obfuscation and anti-tampering measures
+8. **Handle privacy compliance** with data protection and consent management
+9. **Test security controls** with mobile-specific testing tools and techniques
+
+## Example Interactions
+- "Implement secure WebView configuration with HTTPS enforcement and CSP"
+- "Set up biometric authentication with secure fallback mechanisms"
+- "Create secure local storage with encryption for sensitive user data"
+- "Implement certificate pinning for API communication security"
+- "Configure deep link security with URL validation and parameter sanitization"
+- "Set up root/jailbreak detection with graceful security degradation"
+- "Implement secure cross-platform data sharing between native and WebView"
+- "Create privacy-compliant analytics with data minimization and consent"
+- "Implement secure React Native bridge communication with input validation"
+- "Configure Flutter platform channel security with message validation"
+- "Set up secure Xamarin native interop with assembly protection"
+- "Implement secure Cordova plugin communication with sandboxing"

package/.agent/skills/observability/SKILL.md

@@ -0,0 +1,397 @@
+---
+name: observability
+description: >-
+  OpenTelemetry-based observability setup for production applications. Unified instrumentation for logs, metrics, and traces.
+  Triggers on: monitoring, observability, OpenTelemetry, telemetry, instrumentation.
+  Coordinates with: logging, metrics, tracing, incident-response.
+allowed-tools: Read, Write, Glob, Bash
+metadata:
+  category: "devops"
+  success_metrics: "SDK initialized, instrumentation active, telemetry exported"
+  coordinates_with: "logging, metrics, tracing, incident-response"
+---
+
+# Observability Setup
+
+> Unified telemetry foundation using OpenTelemetry
+
+## 🎯 Purpose
+
+Setup OpenTelemetry SDK for automatic instrumentation and telemetry export to observability platforms (Datadog, Sentry, New Relic, Grafana Cloud).
+
+---
+
+## 1. Core Concepts
+
+### The Three Pillars
+
+| Pillar      | Purpose                | Example               |
+| ----------- | ---------------------- | --------------------- |
+| **Logs**    | Events with context    | "User login failed"   |
+| **Metrics** | Numerical measurements | "CPU usage: 45%"      |
+| **Traces**  | Request flow           | "API call took 250ms" |
+
+### OpenTelemetry Advantages
+
+| Aspect               | Benefit                        |
+| -------------------- | ------------------------------ |
+| Vendor-agnostic      | Switch providers easily        |
+| Auto-instrumentation | No manual logging for HTTP, DB |
+| Correlation          | Link logs ↔ metrics ↔ traces   |
+| Standard             | W3C Trace Context              |
+
+---
+
+## 2. Setup Process
+
+### Step 1: Install Dependencies
+
+**Node.js:**
+
+```bash
+npm install @opentelemetry/sdk-node \
+            @opentelemetry/auto-instrumentations-node \
+            @opentelemetry/exporter-trace-otlp-http \
+            @opentelemetry/exporter-metrics-otlp-http
+```
+
+**Python:**
+
+```bash
+pip install opentelemetry-sdk \
+            opentelemetry-instrumentation \
+            opentelemetry-exporter-otlp
+```
+
+### Step 2: Initialize SDK
+
+**Node.js (lib/observability/setup.ts):**
+
+```typescript
+import { NodeSDK } from "@opentelemetry/sdk-node";
+import { getNodeAutoInstrumentations } from "@opentelemetry/auto-instrumentations-node";
+import { OTLPTraceExporter } from "@opentelemetry/exporter-trace-otlp-http";
+import { OTLPMetricExporter } from "@opentelemetry/exporter-metrics-otlp-http";
+import { PeriodicExportingMetricReader } from "@opentelemetry/sdk-metrics";
+
+const sdk = new NodeSDK({
+  serviceName: process.env.SERVICE_NAME || "my-app",
+  traceExporter: new OTLPTraceExporter({
+    url: process.env.OTEL_EXPORTER_OTLP_ENDPOINT || "http://localhost:4318/v1/traces",
+  }),
+  metricReader: new PeriodicExportingMetricReader({
+    exporter: new OTLPMetricExporter({
+      url: process.env.OTEL_EXPORTER_OTLP_ENDPOINT || "http://localhost:4318/v1/metrics",
+    }),
+    exportIntervalMillis: 60000, // 1 minute
+  }),
+  instrumentations: [
+    getNodeAutoInstrumentations({
+      "@opentelemetry/instrumentation-http": { enabled: true },
+      "@opentelemetry/instrumentation-express": { enabled: true },
+      "@opentelemetry/instrumentation-prisma": { enabled: true },
+      "@opentelemetry/instrumentation-redis": { enabled: true },
+    }),
+  ],
+  resource: {
+    attributes: {
+      "service.name": process.env.SERVICE_NAME,
+      "deployment.environment": process.env.NODE_ENV || "development",
+      "service.version": process.env.APP_VERSION || "1.0.0",
+    },
+  },
+});
+
+sdk.start();
+
+// Graceful shutdown
+process.on("SIGTERM", () => {
+  sdk
+    .shutdown()
+    .then(() => console.log("Telemetry terminated"))
+    .catch((error) => console.error("Error terminating telemetry", error))
+    .finally(() => process.exit(0));
+});
+
+export default sdk;
+```
+
+### Step 3: Environment Variables
+
+```env
+# Required
+SERVICE_NAME=my-production-app
+NODE_ENV=production
+APP_VERSION=1.2.0
+
+# OpenTelemetry
+OTEL_EXPORTER_OTLP_ENDPOINT=https://api.example.com/v1
+OTEL_EXPORTER_OTLP_HEADERS="api-key=your-key"
+
+# Provider-specific (choose one)
+# Datadog
+DD_API_KEY=your-datadog-key
+DD_SITE=datadoghq.com
+
+# New Relic
+NEW_RELIC_LICENSE_KEY=your-license-key
+
+# Sentry
+SENTRY_DSN=your-sentry-dsn
+```
+
+---
+
+## 3. Provider Integration
+
+### Datadog
+
+```typescript
+import { DatadogExporter } from "@opentelemetry/exporter-datadog";
+
+const sdk = new NodeSDK({
+  traceExporter: new DatadogExporter({
+    agentUrl: process.env.DD_AGENT_URL || "http://localhost:8126",
+    service: process.env.SERVICE_NAME,
+    env: process.env.NODE_ENV,
+  }),
+});
+```
+
+### Sentry
+
+```typescript
+import * as Sentry from "@sentry/node";
+
+Sentry.init({
+  dsn: process.env.SENTRY_DSN,
+  tracesSampleRate: 0.1, // 10% sampling in production
+  environment: process.env.NODE_ENV,
+  release: process.env.APP_VERSION,
+});
+```
+
+### Grafana Cloud
+
+```typescript
+const sdk = new NodeSDK({
+  traceExporter: new OTLPTraceExporter({
+    url: "https://otlp-gateway-prod.grafana.net/otlp/v1/traces",
+    headers: {
+      Authorization: `Basic ${Buffer.from(`${process.env.GRAFANA_INSTANCE_ID}:${process.env.GRAFANA_API_KEY}`).toString("base64")}`,
+    },
+  }),
+});
+```
+
+---
+
+## 4. Auto-Instrumentation
+
+### What Gets Instrumented Automatically
+
+| Library     | Captured Data              |
+| ----------- | -------------------------- |
+| **HTTP**    | Request/response, status   |
+| **Express** | Routes, middleware         |
+| **Prisma**  | Database queries, duration |
+| **Redis**   | Commands, latency          |
+| **Fetch**   | External API calls         |
+| **Next.js** | Page loads, API routes     |
+
+### Custom Instrumentation
+
+```typescript
+import { trace } from "@opentelemetry/api";
+
+const tracer = trace.getTracer("my-app");
+
+export async function processOrder(orderId: string) {
+  return tracer.startActiveSpan("process-order", async (span) => {
+    try {
+      span.setAttribute("order.id", orderId);
+
+      const order = await fetchOrder(orderId);
+      span.setAttribute("order.total", order.total);
+
+      await processPayment(order);
+
+      span.setStatus({ code: SpanStatusCode.OK });
+      return order;
+    } catch (error) {
+      span.recordException(error);
+      span.setStatus({
+        code: SpanStatusCode.ERROR,
+        message: error.message,
+      });
+      throw error;
+    } finally {
+      span.end();
+    }
+  });
+}
+```
+
+---
+
+## 5. Resource Attributes
+
+### Standard Attributes
+
+```typescript
+resource: {
+  attributes: {
+    // Service identification
+    'service.name': 'my-app',
+    'service.version': '1.2.0',
+    'service.namespace': 'production',
+
+    // Environment
+    'deployment.environment': 'production',
+    'cloud.provider': 'aws',
+    'cloud.region': 'us-east-1',
+
+    // Host information
+    'host.name': 'web-server-01',
+    'host.type': 't3.medium',
+
+    // Custom
+    'team': 'backend',
+    'cost-center': 'engineering',
+  }
+}
+```
+
+---
+
+## 6. Sampling Strategies
+
+### By Environment
+
+| Environment | Sampling Rate | Reason              |
+| ----------- | ------------- | ------------------- |
+| Development | 100%          | Debug all requests  |
+| Staging     | 50%           | Cost vs. visibility |
+| Production  | 1-10%         | Cost optimization   |
+
+### Configuration
+
+```typescript
+import { ParentBasedSampler, TraceIdRatioBasedSampler } from "@opentelemetry/sdk-trace-base";
+
+const sampler = new ParentBasedSampler({
+  root: new TraceIdRatioBasedSampler(process.env.NODE_ENV === "production" ? 0.1 : 1.0),
+});
+
+const sdk = new NodeSDK({
+  sampler,
+  // ...
+});
+```
+
+---
+
+## 7. Health Checks
+
+### Verify Telemetry Export
+
+```typescript
+// lib/observability/health.ts
+export async function checkTelemetryHealth() {
+  const checks = {
+    sdkInitialized: false,
+    exporterConnected: false,
+    instrumentationActive: false,
+  };
+
+  try {
+    // Check SDK
+    if (sdk) checks.sdkInitialized = true;
+
+    // Check exporter (send test span)
+    const tracer = trace.getTracer("health-check");
+    await tracer.startActiveSpan("test-span", async (span) => {
+      span.end();
+    });
+    checks.exporterConnected = true;
+
+    // Check instrumentation
+    const instrumentations = getNodeAutoInstrumentations();
+    checks.instrumentationActive = instrumentations.length > 0;
+
+    return {
+      healthy: Object.values(checks).every(Boolean),
+      checks,
+    };
+  } catch (error) {
+    return {
+      healthy: false,
+      checks,
+      error: error.message,
+    };
+  }
+}
+```
+
+---
+
+## 8. Best Practices
+
+### Do's ✅
+
+| Practice                 | Benefit                  |
+| ------------------------ | ------------------------ |
+| Use semantic conventions | Standard attribute names |
+| Sample production traces | Reduce costs             |
+| Add resource attributes  | Context for debugging    |
+| Graceful shutdown        | Don't lose last data     |
+
+### Don'ts ❌
+
+| Anti-Pattern           | Why                     |
+| ---------------------- | ----------------------- |
+| Log in spans           | Duplication, use events |
+| Too many custom spans  | Performance overhead    |
+| Sensitive data in tags | Security risk           |
+| Ignore errors          | Silent failures         |
+
+---
+
+## 9. Troubleshooting
+
+### Common Issues
+
+| Symptom              | Cause                     | Fix                        |
+| -------------------- | ------------------------- | -------------------------- |
+| No data in dashboard | Exporter misconfigured    | Check endpoint, API key    |
+| High memory usage    | Sample rate too high      | Reduce sampling            |
+| Missing HTTP traces  | SDK not initialized early | Import before app code     |
+| Broken trace context | Propagation disabled      | Enable context propagation |
+
+### Debug Mode
+
+```typescript
+import { diag, DiagConsoleLogger, DiagLogLevel } from "@opentelemetry/api";
+
+// Enable debug logging (development only)
+if (process.env.NODE_ENV === "development") {
+  diag.setLogger(new DiagConsoleLogger(), DiagLogLevel.DEBUG);
+}
+```
+
+---
+
+## 10. Performance Impact
+
+### Expected Overhead
+
+| Aspect  | Impact    | Mitigation        |
+| ------- | --------- | ----------------- |
+| CPU     | +2-5%     | Reduce sampling   |
+| Memory  | +10-20MB  | Batch exports     |
+| Network | +5-10KB/s | Compress payloads |
+| Latency | +1-2ms    | Async export      |
+
+---
+
+> **Key Takeaway:** Observability is foundational. Set it up once, benefit everywhere (logs, metrics, traces all use the same SDK).