@cregis-dev/cckit 0.4.0 → 0.5.0

package/templates/ecc/skills/security-review/cloud-infrastructure-security.md

@@ -1,361 +0,0 @@
-| name | description |
-|------|-------------|
-| cloud-infrastructure-security | Use this skill when deploying to cloud platforms, configuring infrastructure, managing IAM policies, setting up logging/monitoring, or implementing CI/CD pipelines. Provides cloud security checklist aligned with best practices. |
-
-# Cloud & Infrastructure Security Skill
-
-This skill ensures cloud infrastructure, CI/CD pipelines, and deployment configurations follow security best practices and comply with industry standards.
-
-## When to Activate
-
-- Deploying applications to cloud platforms (AWS, Vercel, Railway, Cloudflare)
-- Configuring IAM roles and permissions
-- Setting up CI/CD pipelines
-- Implementing infrastructure as code (Terraform, CloudFormation)
-- Configuring logging and monitoring
-- Managing secrets in cloud environments
-- Setting up CDN and edge security
-- Implementing disaster recovery and backup strategies
-
-## Cloud Security Checklist
-
-### 1. IAM & Access Control
-
-#### Principle of Least Privilege
-
-```yaml
-# ✅ CORRECT: Minimal permissions
-iam_role:
-  permissions:
-    - s3:GetObject  # Only read access
-    - s3:ListBucket
-  resources:
-    - arn:aws:s3:::my-bucket/*  # Specific bucket only
-
-# ❌ WRONG: Overly broad permissions
-iam_role:
-  permissions:
-    - s3:*  # All S3 actions
-  resources:
-    - "*"  # All resources
-```
-
-#### Multi-Factor Authentication (MFA)
-
-```bash
-# ALWAYS enable MFA for root/admin accounts
-aws iam enable-mfa-device \
-  --user-name admin \
-  --serial-number arn:aws:iam::123456789:mfa/admin \
-  --authentication-code1 123456 \
-  --authentication-code2 789012
-```
-
-#### Verification Steps
-
-- [ ] No root account usage in production
-- [ ] MFA enabled for all privileged accounts
-- [ ] Service accounts use roles, not long-lived credentials
-- [ ] IAM policies follow least privilege
-- [ ] Regular access reviews conducted
-- [ ] Unused credentials rotated or removed
-
-### 2. Secrets Management
-
-#### Cloud Secrets Managers
-
-```typescript
-// ✅ CORRECT: Use cloud secrets manager
-import { SecretsManager } from '@aws-sdk/client-secrets-manager';
-
-const client = new SecretsManager({ region: 'us-east-1' });
-const secret = await client.getSecretValue({ SecretId: 'prod/api-key' });
-const apiKey = JSON.parse(secret.SecretString).key;
-
-// ❌ WRONG: Hardcoded or in environment variables only
-const apiKey = process.env.API_KEY; // Not rotated, not audited
-```
-
-#### Secrets Rotation
-
-```bash
-# Set up automatic rotation for database credentials
-aws secretsmanager rotate-secret \
-  --secret-id prod/db-password \
-  --rotation-lambda-arn arn:aws:lambda:region:account:function:rotate \
-  --rotation-rules AutomaticallyAfterDays=30
-```
-
-#### Verification Steps
-
-- [ ] All secrets stored in cloud secrets manager (AWS Secrets Manager, Vercel Secrets)
-- [ ] Automatic rotation enabled for database credentials
-- [ ] API keys rotated at least quarterly
-- [ ] No secrets in code, logs, or error messages
-- [ ] Audit logging enabled for secret access
-
-### 3. Network Security
-
-#### VPC and Firewall Configuration
-
-```terraform
-# ✅ CORRECT: Restricted security group
-resource "aws_security_group" "app" {
-  name = "app-sg"
-  
-  ingress {
-    from_port   = 443
-    to_port     = 443
-    protocol    = "tcp"
-    cidr_blocks = ["10.0.0.0/16"]  # Internal VPC only
-  }
-  
-  egress {
-    from_port   = 443
-    to_port     = 443
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]  # Only HTTPS outbound
-  }
-}
-
-# ❌ WRONG: Open to the internet
-resource "aws_security_group" "bad" {
-  ingress {
-    from_port   = 0
-    to_port     = 65535
-    protocol    = "tcp"
-    cidr_blocks = ["0.0.0.0/0"]  # All ports, all IPs!
-  }
-}
-```
-
-#### Verification Steps
-
-- [ ] Database not publicly accessible
-- [ ] SSH/RDP ports restricted to VPN/bastion only
-- [ ] Security groups follow least privilege
-- [ ] Network ACLs configured
-- [ ] VPC flow logs enabled
-
-### 4. Logging & Monitoring
-
-#### CloudWatch/Logging Configuration
-
-```typescript
-// ✅ CORRECT: Comprehensive logging
-import { CloudWatchLogsClient, CreateLogStreamCommand } from '@aws-sdk/client-cloudwatch-logs';
-
-const logSecurityEvent = async (event: SecurityEvent) => {
-  await cloudwatch.putLogEvents({
-    logGroupName: '/aws/security/events',
-    logStreamName: 'authentication',
-    logEvents: [{
-      timestamp: Date.now(),
-      message: JSON.stringify({
-        type: event.type,
-        userId: event.userId,
-        ip: event.ip,
-        result: event.result,
-        // Never log sensitive data
-      })
-    }]
-  });
-};
-```
-
-#### Verification Steps
-
-- [ ] CloudWatch/logging enabled for all services
-- [ ] Failed authentication attempts logged
-- [ ] Admin actions audited
-- [ ] Log retention configured (90+ days for compliance)
-- [ ] Alerts configured for suspicious activity
-- [ ] Logs centralized and tamper-proof
-
-### 5. CI/CD Pipeline Security
-
-#### Secure Pipeline Configuration
-
-```yaml
-# ✅ CORRECT: Secure GitHub Actions workflow
-name: Deploy
-
-on:
-  push:
-    branches: [main]
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    permissions:
-      contents: read  # Minimal permissions
-      
-    steps:
-      - uses: actions/checkout@v4
-      
-      # Scan for secrets
-      - name: Secret scanning
-        uses: trufflesecurity/trufflehog@main
-        
-      # Dependency audit
-      - name: Audit dependencies
-        run: npm audit --audit-level=high
-        
-      # Use OIDC, not long-lived tokens
-      - name: Configure AWS credentials
-        uses: aws-actions/configure-aws-credentials@v4
-        with:
-          role-to-assume: arn:aws:iam::123456789:role/GitHubActionsRole
-          aws-region: us-east-1
-```
-
-#### Supply Chain Security
-
-```json
-// package.json - Use lock files and integrity checks
-{
-  "scripts": {
-    "install": "npm ci",  // Use ci for reproducible builds
-    "audit": "npm audit --audit-level=moderate",
-    "check": "npm outdated"
-  }
-}
-```
-
-#### Verification Steps
-
-- [ ] OIDC used instead of long-lived credentials
-- [ ] Secrets scanning in pipeline
-- [ ] Dependency vulnerability scanning
-- [ ] Container image scanning (if applicable)
-- [ ] Branch protection rules enforced
-- [ ] Code review required before merge
-- [ ] Signed commits enforced
-
-### 6. Cloudflare & CDN Security
-
-#### Cloudflare Security Configuration
-
-```typescript
-// ✅ CORRECT: Cloudflare Workers with security headers
-export default {
-  async fetch(request: Request): Promise<Response> {
-    const response = await fetch(request);
-    
-    // Add security headers
-    const headers = new Headers(response.headers);
-    headers.set('X-Frame-Options', 'DENY');
-    headers.set('X-Content-Type-Options', 'nosniff');
-    headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
-    headers.set('Permissions-Policy', 'geolocation=(), microphone=()');
-    
-    return new Response(response.body, {
-      status: response.status,
-      headers
-    });
-  }
-};
-```
-
-#### WAF Rules
-
-```bash
-# Enable Cloudflare WAF managed rules
-# - OWASP Core Ruleset
-# - Cloudflare Managed Ruleset
-# - Rate limiting rules
-# - Bot protection
-```
-
-#### Verification Steps
-
-- [ ] WAF enabled with OWASP rules
-- [ ] Rate limiting configured
-- [ ] Bot protection active
-- [ ] DDoS protection enabled
-- [ ] Security headers configured
-- [ ] SSL/TLS strict mode enabled
-
-### 7. Backup & Disaster Recovery
-
-#### Automated Backups
-
-```terraform
-# ✅ CORRECT: Automated RDS backups
-resource "aws_db_instance" "main" {
-  allocated_storage     = 20
-  engine               = "postgres"
-  
-  backup_retention_period = 30  # 30 days retention
-  backup_window          = "03:00-04:00"
-  maintenance_window     = "mon:04:00-mon:05:00"
-  
-  enabled_cloudwatch_logs_exports = ["postgresql"]
-  
-  deletion_protection = true  # Prevent accidental deletion
-}
-```
-
-#### Verification Steps
-
-- [ ] Automated daily backups configured
-- [ ] Backup retention meets compliance requirements
-- [ ] Point-in-time recovery enabled
-- [ ] Backup testing performed quarterly
-- [ ] Disaster recovery plan documented
-- [ ] RPO and RTO defined and tested
-
-## Pre-Deployment Cloud Security Checklist
-
-Before ANY production cloud deployment:
-
-- [ ] **IAM**: Root account not used, MFA enabled, least privilege policies
-- [ ] **Secrets**: All secrets in cloud secrets manager with rotation
-- [ ] **Network**: Security groups restricted, no public databases
-- [ ] **Logging**: CloudWatch/logging enabled with retention
-- [ ] **Monitoring**: Alerts configured for anomalies
-- [ ] **CI/CD**: OIDC auth, secrets scanning, dependency audits
-- [ ] **CDN/WAF**: Cloudflare WAF enabled with OWASP rules
-- [ ] **Encryption**: Data encrypted at rest and in transit
-- [ ] **Backups**: Automated backups with tested recovery
-- [ ] **Compliance**: GDPR/HIPAA requirements met (if applicable)
-- [ ] **Documentation**: Infrastructure documented, runbooks created
-- [ ] **Incident Response**: Security incident plan in place
-
-## Common Cloud Security Misconfigurations
-
-### S3 Bucket Exposure
-
-```bash
-# ❌ WRONG: Public bucket
-aws s3api put-bucket-acl --bucket my-bucket --acl public-read
-
-# ✅ CORRECT: Private bucket with specific access
-aws s3api put-bucket-acl --bucket my-bucket --acl private
-aws s3api put-bucket-policy --bucket my-bucket --policy file://policy.json
-```
-
-### RDS Public Access
-
-```terraform
-# ❌ WRONG
-resource "aws_db_instance" "bad" {
-  publicly_accessible = true  # NEVER do this!
-}
-
-# ✅ CORRECT
-resource "aws_db_instance" "good" {
-  publicly_accessible = false
-  vpc_security_group_ids = [aws_security_group.db.id]
-}
-```
-
-## Resources
-
-- [AWS Security Best Practices](https://aws.amazon.com/security/best-practices/)
-- [CIS AWS Foundations Benchmark](https://www.cisecurity.org/benchmark/amazon_web_services)
-- [Cloudflare Security Documentation](https://developers.cloudflare.com/security/)
-- [OWASP Cloud Security](https://owasp.org/www-project-cloud-security/)
-- [Terraform Security Best Practices](https://www.terraform.io/docs/cloud/guides/recommended-practices/)
-
-**Remember**: Cloud misconfigurations are the leading cause of data breaches. A single exposed S3 bucket or overly permissive IAM policy can compromise your entire infrastructure. Always follow the principle of least privilege and defense in depth.

package/templates/ecc/skills/security-scan/SKILL.md

@@ -1,165 +0,0 @@
----
-name: security-scan
-description: Scan your Claude Code configuration (.claude/ directory) for security vulnerabilities, misconfigurations, and injection risks using AgentShield. Checks CLAUDE.md, settings.json, MCP servers, hooks, and agent definitions.
-origin: ECC
----
-
-# Security Scan Skill
-
-Audit your Claude Code configuration for security issues using [AgentShield](https://github.com/affaan-m/agentshield).
-
-## When to Activate
-
-- Setting up a new Claude Code project
-- After modifying `.claude/settings.json`, `CLAUDE.md`, or MCP configs
-- Before committing configuration changes
-- When onboarding to a new repository with existing Claude Code configs
-- Periodic security hygiene checks
-
-## What It Scans
-
-| File | Checks |
-|------|--------|
-| `CLAUDE.md` | Hardcoded secrets, auto-run instructions, prompt injection patterns |
-| `settings.json` | Overly permissive allow lists, missing deny lists, dangerous bypass flags |
-| `mcp.json` | Risky MCP servers, hardcoded env secrets, npx supply chain risks |
-| `hooks/` | Command injection via interpolation, data exfiltration, silent error suppression |
-| `agents/*.md` | Unrestricted tool access, prompt injection surface, missing model specs |
-
-## Prerequisites
-
-AgentShield must be installed. Check and install if needed:
-
-```bash
-# Check if installed
-npx ecc-agentshield --version
-
-# Install globally (recommended)
-npm install -g ecc-agentshield
-
-# Or run directly via npx (no install needed)
-npx ecc-agentshield scan .
-```
-
-## Usage
-
-### Basic Scan
-
-Run against the current project's `.claude/` directory:
-
-```bash
-# Scan current project
-npx ecc-agentshield scan
-
-# Scan a specific path
-npx ecc-agentshield scan --path /path/to/.claude
-
-# Scan with minimum severity filter
-npx ecc-agentshield scan --min-severity medium
-```
-
-### Output Formats
-
-```bash
-# Terminal output (default) — colored report with grade
-npx ecc-agentshield scan
-
-# JSON — for CI/CD integration
-npx ecc-agentshield scan --format json
-
-# Markdown — for documentation
-npx ecc-agentshield scan --format markdown
-
-# HTML — self-contained dark-theme report
-npx ecc-agentshield scan --format html > security-report.html
-```
-
-### Auto-Fix
-
-Apply safe fixes automatically (only fixes marked as auto-fixable):
-
-```bash
-npx ecc-agentshield scan --fix
-```
-
-This will:
-- Replace hardcoded secrets with environment variable references
-- Tighten wildcard permissions to scoped alternatives
-- Never modify manual-only suggestions
-
-### Opus 4.6 Deep Analysis
-
-Run the adversarial three-agent pipeline for deeper analysis:
-
-```bash
-# Requires ANTHROPIC_API_KEY
-export ANTHROPIC_API_KEY=your-key
-npx ecc-agentshield scan --opus --stream
-```
-
-This runs:
-1. **Attacker (Red Team)** — finds attack vectors
-2. **Defender (Blue Team)** — recommends hardening
-3. **Auditor (Final Verdict)** — synthesizes both perspectives
-
-### Initialize Secure Config
-
-Scaffold a new secure `.claude/` configuration from scratch:
-
-```bash
-npx ecc-agentshield init
-```
-
-Creates:
-- `settings.json` with scoped permissions and deny list
-- `CLAUDE.md` with security best practices
-- `mcp.json` placeholder
-
-### GitHub Action
-
-Add to your CI pipeline:
-
-```yaml
-- uses: affaan-m/agentshield@v1
-  with:
-    path: '.'
-    min-severity: 'medium'
-    fail-on-findings: true
-```
-
-## Severity Levels
-
-| Grade | Score | Meaning |
-|-------|-------|---------|
-| A | 90-100 | Secure configuration |
-| B | 75-89 | Minor issues |
-| C | 60-74 | Needs attention |
-| D | 40-59 | Significant risks |
-| F | 0-39 | Critical vulnerabilities |
-
-## Interpreting Results
-
-### Critical Findings (fix immediately)
-- Hardcoded API keys or tokens in config files
-- `Bash(*)` in the allow list (unrestricted shell access)
-- Command injection in hooks via `${file}` interpolation
-- Shell-running MCP servers
-
-### High Findings (fix before production)
-- Auto-run instructions in CLAUDE.md (prompt injection vector)
-- Missing deny lists in permissions
-- Agents with unnecessary Bash access
-
-### Medium Findings (recommended)
-- Silent error suppression in hooks (`2>/dev/null`, `|| true`)
-- Missing PreToolUse security hooks
-- `npx -y` auto-install in MCP server configs
-
-### Info Findings (awareness)
-- Missing descriptions on MCP servers
-- Prohibitive instructions correctly flagged as good practice
-
-## Links
-
-- **GitHub**: [github.com/affaan-m/agentshield](https://github.com/affaan-m/agentshield)
-- **npm**: [npmjs.com/package/ecc-agentshield](https://www.npmjs.com/package/ecc-agentshield)

package/templates/ecc/skills/skill-stocktake/SKILL.md

@@ -1,176 +0,0 @@
----
-description: "Use when auditing Claude skills and commands for quality. Supports Quick Scan (changed skills only) and Full Stocktake modes with sequential subagent batch evaluation."
-origin: ECC
----
-
-# skill-stocktake
-
-Slash command (`/skill-stocktake`) that audits all Claude skills and commands using a quality checklist + AI holistic judgment. Supports two modes: Quick Scan for recently changed skills, and Full Stocktake for a complete review.
-
-## Scope
-
-The command targets the following paths **relative to the directory where it is invoked**:
-
-| Path | Description |
-|------|-------------|
-| `~/.claude/skills/` | Global skills (all projects) |
-| `{cwd}/.claude/skills/` | Project-level skills (if the directory exists) |
-
-**At the start of Phase 1, the command explicitly lists which paths were found and scanned.**
-
-### Targeting a specific project
-
-To include project-level skills, run from that project's root directory:
-
-```bash
-cd ~/path/to/my-project
-/skill-stocktake
-```
-
-If the project has no `.claude/skills/` directory, only global skills and commands are evaluated.
-
-## Modes
-
-| Mode | Trigger | Duration |
-|------|---------|---------|
-| Quick Scan | `results.json` exists (default) | 5–10 min |
-| Full Stocktake | `results.json` absent, or `/skill-stocktake full` | 20–30 min |
-
-**Results cache:** `~/.claude/skills/skill-stocktake/results.json`
-
-## Quick Scan Flow
-
-Re-evaluate only skills that have changed since the last run (5–10 min).
-
-1. Read `~/.claude/skills/skill-stocktake/results.json`
-2. Run: `bash ~/.claude/skills/skill-stocktake/scripts/quick-diff.sh \
-         ~/.claude/skills/skill-stocktake/results.json`
-   (Project dir is auto-detected from `$PWD/.claude/skills`; pass it explicitly only if needed)
-3. If output is `[]`: report "No changes since last run." and stop
-4. Re-evaluate only those changed files using the same Phase 2 criteria
-5. Carry forward unchanged skills from previous results
-6. Output only the diff
-7. Run: `bash ~/.claude/skills/skill-stocktake/scripts/save-results.sh \
-         ~/.claude/skills/skill-stocktake/results.json <<< "$EVAL_RESULTS"`
-
-## Full Stocktake Flow
-
-### Phase 1 — Inventory
-
-Run: `bash ~/.claude/skills/skill-stocktake/scripts/scan.sh`
-
-The script enumerates skill files, extracts frontmatter, and collects UTC mtimes.
-Project dir is auto-detected from `$PWD/.claude/skills`; pass it explicitly only if needed.
-Present the scan summary and inventory table from the script output:
-
-```
-Scanning:
-  ✓ ~/.claude/skills/         (17 files)
-  ✗ {cwd}/.claude/skills/    (not found — global skills only)
-```
-
-| Skill | 7d use | 30d use | Description |
-|-------|--------|---------|-------------|
-
-### Phase 2 — Quality Evaluation
-
-Launch a Task tool subagent (**Explore agent, model: opus**) with the full inventory and checklist.
-The subagent reads each skill, applies the checklist, and returns per-skill JSON:
-
-`{ "verdict": "Keep"|"Improve"|"Update"|"Retire"|"Merge into [X]", "reason": "..." }`
-
-**Chunk guidance:** Process ~20 skills per subagent invocation to keep context manageable. Save intermediate results to `results.json` (`status: "in_progress"`) after each chunk.
-
-After all skills are evaluated: set `status: "completed"`, proceed to Phase 3.
-
-**Resume detection:** If `status: "in_progress"` is found on startup, resume from the first unevaluated skill.
-
-Each skill is evaluated against this checklist:
-
-```
-- [ ] Content overlap with other skills checked
-- [ ] Overlap with MEMORY.md / CLAUDE.md checked
-- [ ] Freshness of technical references verified (use WebSearch if tool names / CLI flags / APIs are present)
-- [ ] Usage frequency considered
-```
-
-Verdict criteria:
-
-| Verdict | Meaning |
-|---------|---------|
-| Keep | Useful and current |
-| Improve | Worth keeping, but specific improvements needed |
-| Update | Referenced technology is outdated (verify with WebSearch) |
-| Retire | Low quality, stale, or cost-asymmetric |
-| Merge into [X] | Substantial overlap with another skill; name the merge target |
-
-Evaluation is **holistic AI judgment** — not a numeric rubric. Guiding dimensions:
-- **Actionability**: code examples, commands, or steps that let you act immediately
-- **Scope fit**: name, trigger, and content are aligned; not too broad or narrow
-- **Uniqueness**: value not replaceable by MEMORY.md / CLAUDE.md / another skill
-- **Currency**: technical references work in the current environment
-
-**Reason quality requirements** — the `reason` field must be self-contained and decision-enabling:
-- Do NOT write "unchanged" alone — always restate the core evidence
-- For **Retire**: state (1) what specific defect was found, (2) what covers the same need instead
-  - Bad: `"Superseded"`
-  - Good: `"disable-model-invocation: true already set; superseded by continuous-learning-v2 which covers all the same patterns plus confidence scoring. No unique content remains."`
-- For **Merge**: name the target and describe what content to integrate
-  - Bad: `"Overlaps with X"`
-  - Good: `"42-line thin content; Step 4 of chatlog-to-article already covers the same workflow. Integrate the 'article angle' tip as a note in that skill."`
-- For **Improve**: describe the specific change needed (what section, what action, target size if relevant)
-  - Bad: `"Too long"`
-  - Good: `"276 lines; Section 'Framework Comparison' (L80–140) duplicates ai-era-architecture-principles; delete it to reach ~150 lines."`
-- For **Keep** (mtime-only change in Quick Scan): restate the original verdict rationale, do not write "unchanged"
-  - Bad: `"Unchanged"`
-  - Good: `"mtime updated but content unchanged. Unique Python reference explicitly imported by rules/python/; no overlap found."`
-
-### Phase 3 — Summary Table
-
-| Skill | 7d use | Verdict | Reason |
-|-------|--------|---------|--------|
-
-### Phase 4 — Consolidation
-
-1. **Retire / Merge**: present detailed justification per file before confirming with user:
-   - What specific problem was found (overlap, staleness, broken references, etc.)
-   - What alternative covers the same functionality (for Retire: which existing skill/rule; for Merge: the target file and what content to integrate)
-   - Impact of removal (any dependent skills, MEMORY.md references, or workflows affected)
-2. **Improve**: present specific improvement suggestions with rationale:
-   - What to change and why (e.g., "trim 430→200 lines because sections X/Y duplicate python-patterns")
-   - User decides whether to act
-3. **Update**: present updated content with sources checked
-4. Check MEMORY.md line count; propose compression if >100 lines
-
-## Results File Schema
-
-`~/.claude/skills/skill-stocktake/results.json`:
-
-**`evaluated_at`**: Must be set to the actual UTC time of evaluation completion.
-Obtain via Bash: `date -u +%Y-%m-%dT%H:%M:%SZ`. Never use a date-only approximation like `T00:00:00Z`.
-
-```json
-{
-  "evaluated_at": "2026-02-21T10:00:00Z",
-  "mode": "full",
-  "batch_progress": {
-    "total": 80,
-    "evaluated": 80,
-    "status": "completed"
-  },
-  "skills": {
-    "skill-name": {
-      "path": "~/.claude/skills/skill-name/SKILL.md",
-      "verdict": "Keep",
-      "reason": "Concrete, actionable, unique value for X workflow",
-      "mtime": "2026-01-15T08:30:00Z"
-    }
-  }
-}
-```
-
-## Notes
-
-- Evaluation is blind: the same checklist applies to all skills regardless of origin (ECC, self-authored, auto-extracted)
-- Archive / delete operations always require explicit user confirmation
-- No verdict branching by skill origin