@cubis/foundry 0.3.31 → 0.3.33

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/vulnerability-scanner/SKILL.md

@@ -1,276 +1,21 @@
 ---
 name: vulnerability-scanner
-description: Advanced vulnerability analysis principles. OWASP 2025, Supply Chain Security, attack surface mapping, risk prioritization.
-allowed-tools: Read, Glob, Grep, Bash
+description: "Compatibility alias skill. Deprecated: use security-reviewer."
+metadata:
+  deprecated: true
+  replaced_by: security-reviewer
+  removal_target: v0.6.0
 ---
 
 # Vulnerability Scanner
 
-> Think like an attacker, defend like an expert. 2025 threat landscape awareness.
+## Compatibility Alias
 
-## 🔧 Runtime Scripts
+This skill is deprecated and kept for backward compatibility.
 
-**Execute for automated validation:**
+Use `security-reviewer` as the canonical skill.
 
-| Script | Purpose | Usage |
-|--------|---------|-------|
-| `scripts/security_scan.py` | Validate security principles applied | `python scripts/security_scan.py <project_path>` |
+## Migration
 
-## 📋 Reference Files
-
-| File | Purpose |
-|------|---------|
-| [checklists.md](checklists.md) | OWASP Top 10, Auth, API, Data protection checklists |
-
----
-
-## 1. Security Expert Mindset
-
-### Core Principles
-
-| Principle | Application |
-|-----------|-------------|
-| **Assume Breach** | Design as if attacker already inside |
-| **Zero Trust** | Never trust, always verify |
-| **Defense in Depth** | Multiple layers, no single point |
-| **Least Privilege** | Minimum required access only |
-| **Fail Secure** | On error, deny access |
-
-### Threat Modeling Questions
-
-Before scanning, ask:
-1. What are we protecting? (Assets)
-2. Who would attack? (Threat actors)
-3. How would they attack? (Attack vectors)
-4. What's the impact? (Business risk)
-
----
-
-## 2. OWASP Top 10:2025
-
-### Risk Categories
-
-| Rank | Category | Think About |
-|------|----------|-------------|
-| **A01** | Broken Access Control | Who can access what? IDOR, SSRF |
-| **A02** | Security Misconfiguration | Defaults, headers, exposed services |
-| **A03** | Software Supply Chain 🆕 | Dependencies, CI/CD, build integrity |
-| **A04** | Cryptographic Failures | Weak crypto, exposed secrets |
-| **A05** | Injection | User input → system commands |
-| **A06** | Insecure Design | Flawed architecture |
-| **A07** | Authentication Failures | Session, credential management |
-| **A08** | Integrity Failures | Unsigned updates, tampered data |
-| **A09** | Logging & Alerting | Blind spots, no monitoring |
-| **A10** | Exceptional Conditions 🆕 | Error handling, fail-open states |
-
-### 2025 Key Changes
-
-```
-2021 → 2025 Shifts:
-├── SSRF merged into A01 (Access Control)
-├── A02 elevated (Cloud/Container configs)
-├── A03 NEW: Supply Chain (major focus)
-├── A10 NEW: Exceptional Conditions
-└── Focus shift: Root causes > Symptoms
-```
-
----
-
-## 3. Supply Chain Security (A03)
-
-### Attack Surface
-
-| Vector | Risk | Question to Ask |
-|--------|------|-----------------|
-| **Dependencies** | Malicious packages | Do we audit new deps? |
-| **Lock files** | Integrity attacks | Are they committed? |
-| **Build pipeline** | CI/CD compromise | Who can modify? |
-| **Registry** | Typosquatting | Verified sources? |
-
-### Defense Principles
-
-- Verify package integrity (checksums)
-- Pin versions, audit updates
-- Use private registries for critical deps
-- Sign and verify artifacts
-
----
-
-## 4. Attack Surface Mapping
-
-### What to Map
-
-| Category | Elements |
-|----------|----------|
-| **Entry Points** | APIs, forms, file uploads |
-| **Data Flows** | Input → Process → Output |
-| **Trust Boundaries** | Where auth/authz checked |
-| **Assets** | Secrets, PII, business data |
-
-### Prioritization Matrix
-
-```
-Risk = Likelihood × Impact
-
-High Impact + High Likelihood → CRITICAL
-High Impact + Low Likelihood  → HIGH
-Low Impact + High Likelihood  → MEDIUM
-Low Impact + Low Likelihood   → LOW
-```
-
----
-
-## 5. Risk Prioritization
-
-### CVSS + Context
-
-| Factor | Weight | Question |
-|--------|--------|----------|
-| **CVSS Score** | Base severity | How severe is the vuln? |
-| **EPSS Score** | Exploit likelihood | Is it being exploited? |
-| **Asset Value** | Business context | What's at risk? |
-| **Exposure** | Attack surface | Internet-facing? |
-
-### Prioritization Decision Tree
-
-```
-Is it actively exploited (EPSS >0.5)?
-├── YES → CRITICAL: Immediate action
-└── NO → Check CVSS
-         ├── CVSS ≥9.0 → HIGH
-         ├── CVSS 7.0-8.9 → Consider asset value
-         └── CVSS <7.0 → Schedule for later
-```
-
----
-
-## 6. Exceptional Conditions (A10 - New)
-
-### Fail-Open vs Fail-Closed
-
-| Scenario | Fail-Open (BAD) | Fail-Closed (GOOD) |
-|----------|-----------------|---------------------|
-| Auth error | Allow access | Deny access |
-| Parsing fails | Accept input | Reject input |
-| Timeout | Retry forever | Limit + abort |
-
-### What to Check
-
-- Exception handlers that catch-all and ignore
-- Missing error handling on security operations
-- Race conditions in auth/authz
-- Resource exhaustion scenarios
-
----
-
-## 7. Scanning Methodology
-
-### Phase-Based Approach
-
-```
-1. RECONNAISSANCE
-   └── Understand the target
-       ├── Technology stack
-       ├── Entry points
-       └── Data flows
-
-2. DISCOVERY
-   └── Identify potential issues
-       ├── Configuration review
-       ├── Dependency analysis
-       └── Code pattern search
-
-3. ANALYSIS
-   └── Validate and prioritize
-       ├── False positive elimination
-       ├── Risk scoring
-       └── Attack chain mapping
-
-4. REPORTING
-   └── Actionable findings
-       ├── Clear reproduction steps
-       ├── Business impact
-       └── Remediation guidance
-```
-
----
-
-## 8. Code Pattern Analysis
-
-### High-Risk Patterns
-
-| Pattern | Risk | Look For |
-|---------|------|----------|
-| **String concat in queries** | Injection | `"SELECT * FROM " + user_input` |
-| **Dynamic code execution** | RCE | `eval()`, `exec()`, `Function()` |
-| **Unsafe deserialization** | RCE | `pickle.loads()`, `unserialize()` |
-| **Path manipulation** | Traversal | User input in file paths |
-| **Disabled security** | Various | `verify=False`, `--insecure` |
-
-### Secret Patterns
-
-| Type | Indicators |
-|------|-----------|
-| API Keys | `api_key`, `apikey`, high entropy |
-| Tokens | `token`, `bearer`, `jwt` |
-| Credentials | `password`, `secret`, `key` |
-| Cloud | `AWS_`, `AZURE_`, `GCP_` prefixes |
-
----
-
-## 9. Cloud Security Considerations
-
-### Shared Responsibility
-
-| Layer | You Own | Provider Owns |
-|-------|---------|---------------|
-| Data | ✅ | ❌ |
-| Application | ✅ | ❌ |
-| OS/Runtime | Depends | Depends |
-| Infrastructure | ❌ | ✅ |
-
-### Cloud-Specific Checks
-
-- IAM: Least privilege applied?
-- Storage: Public buckets?
-- Network: Security groups tightened?
-- Secrets: Using secrets manager?
-
----
-
-## 10. Anti-Patterns
-
-| ❌ Don't | ✅ Do |
-|----------|-------|
-| Scan without understanding | Map attack surface first |
-| Alert on every CVE | Prioritize by exploitability + asset |
-| Ignore false positives | Maintain verified baseline |
-| Fix symptoms only | Address root causes |
-| Scan once before deploy | Continuous scanning |
-| Trust third-party deps blindly | Verify integrity, audit code |
-
----
-
-## 11. Reporting Principles
-
-### Finding Structure
-
-Each finding should answer:
-1. **What?** - Clear vulnerability description
-2. **Where?** - Exact location (file, line, endpoint)
-3. **Why?** - Root cause explanation
-4. **Impact?** - Business consequence
-5. **How to fix?** - Specific remediation
-
-### Severity Classification
-
-| Severity | Criteria |
-|----------|----------|
-| **Critical** | RCE, auth bypass, mass data exposure |
-| **High** | Data exposure, privilege escalation |
-| **Medium** | Limited scope, requires conditions |
-| **Low** | Informational, best practice |
-
----
-
-> **Remember:** Vulnerability scanning finds issues. Expert thinking prioritizes what matters. Always ask: "What would an attacker do with this?"
+1. Replace direct references to `vulnerability-scanner` with `security-reviewer`.
+2. Apply the full workflow from `security-reviewer` for new work.

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/backend.md

@@ -5,6 +5,7 @@ triggers: ["backend", "api", "service", "database", "performance"]
 ---
 # Backend Workflow
 
+## When to use
 Use this when backend architecture or service logic is primary.
 
 ## Routing
@@ -12,13 +13,26 @@ Use this when backend architecture or service logic is primary.
 - Add `@database-architect` for schema/query changes.
 - Add `@security-auditor` when auth, secrets, or sensitive data are involved.
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `nodejs-best-practices`, `api-designer`
+- Supporting skills (optional): `api-patterns`, `database-skills`, `secure-code-guardian`
+
+## Workflow steps
 1. Ask specialist(s) for design and risk assessment.
 2. Validate contracts, data model, and failure handling.
 3. Implement backend changes with observability.
 4. Always update API docs: OpenAPI spec, Swagger UI route, and Stoplight Elements route/component.
 5. Run targeted tests and summarize rollout notes.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - API/contract changes
 - OpenAPI spec path

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/brainstorm.md

@@ -5,14 +5,28 @@ triggers: ["idea", "brainstorm", "options", "tradeoff", "approach"]
 ---
 # Brainstorm Workflow
 
+## When to use
 Use this when requirements are still fluid and architecture choices are open.
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `brainstorming`, `feature-forge`
+- Supporting skills (optional): `plan-writing`
+
+## Workflow steps
 1. Restate problem, constraints, and success metrics.
 2. Produce 2-4 options with architecture shape.
 3. Compare complexity, risk, and implementation speed.
 4. Recommend one option and justify rejection of others.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Option table (pros/cons)
 - Recommended option

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/create.md

@@ -5,14 +5,28 @@ triggers: ["create", "build", "implement", "feature", "develop"]
 ---
 # Create Workflow
 
+## When to use
 Use this for net-new implementation after design is stable.
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `feature-forge`, `architecture-designer`
+- Supporting skills (optional): `lint-and-validate`, `test-master`
+
+## Workflow steps
 1. Confirm target files and contracts.
 2. Implement smallest coherent increment.
 3. Validate behavior with focused tests.
 4. Capture remaining gaps and follow-ups.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Changed components/files
 - Behavioral impact

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/database.md

@@ -5,6 +5,7 @@ triggers: ["database", "sql", "schema", "migration", "index"]
 ---
 # Database Workflow
 
+## When to use
 Use this when data modeling, query quality, migration safety, or database performance is core to the task.
 
 ## Routing
@@ -17,7 +18,15 @@ Use this when data modeling, query quality, migration safety, or database perfor
 - Power bridge: `workflows/powers/database-skills`
 - Engine wrappers: `postgres`, `mysql`, `vitess`, `neki`, `mongodb`, `sqlite`, `supabase`, `redis`
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `database-skills`, `database-design`
+- Supporting skills (optional): `database-optimizer`
+
+## Workflow steps
 1. Confirm data shape, access patterns, and workload size.
 2. Choose track: `database-design` (schema/migrations), `database-optimizer` (tuning), or `database-skills` (engine wrappers).
 3. Choose engine wrapper and define index strategy.
@@ -25,6 +34,11 @@ Use this when data modeling, query quality, migration safety, or database perfor
 5. Plan migration and rollback.
 6. Validate with query-plan evidence and production-risk notes.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Schema/query changes
 - Indexing plan

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/debug.md

@@ -5,14 +5,28 @@ triggers: ["debug", "bug", "error", "incident", "stack trace"]
 ---
 # Debug Workflow
 
+## When to use
 Use this when behavior is failing or inconsistent.
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `systematic-debugging`, `find-bugs`
+- Supporting skills (optional): `monitoring-expert`, `error-ux-observability`
+
+## Workflow steps
 1. Reproduce issue and collect evidence.
 2. Narrow fault domain and identify root cause.
 3. Apply focused fix with low regression risk.
 4. Verify resolution and monitor for recurrence.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Reproduction notes
 - Root cause summary

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/devops.md

@@ -5,6 +5,7 @@ triggers: ["devops", "deploy", "ci", "cd", "rollback", "infra"]
 ---
 # DevOps Workflow
 
+## When to use
 Use this when deployment pipeline, infrastructure, or release execution is the main scope.
 
 ## Routing
@@ -12,12 +13,25 @@ Use this when deployment pipeline, infrastructure, or release execution is the m
 - Security checks: `@security-auditor`
 - Verification support: `@test-engineer`
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `devops-engineer`, `sre-engineer`
+- Supporting skills (optional): `monitoring-expert`, `terraform-engineer`, `wrangler`
+
+## Workflow steps
 1. Confirm target environment and risk level.
 2. Define rollout and rollback strategy.
 3. Apply CI/CD or infra changes.
 4. Validate monitors/alerts and recovery path.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Deployment plan
 - Rollback conditions

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/implement-track.md

@@ -5,15 +5,29 @@ triggers: ["track", "milestone", "delivery", "progress", "execution"]
 ---
 # Implement Track Workflow
 
+## When to use
 Use this for medium/large efforts where progress visibility is required.
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `plan-writing`, `feature-forge`
+- Supporting skills (optional): `lint-and-validate`, `test-master`
+
+## Workflow steps
 1. Split into milestone-sized deliverables.
 2. Define done criteria per milestone.
 3. Execute one milestone at a time.
 4. Validate before moving forward.
 5. Publish progress and remaining risks.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Milestone board (done/in-progress/next)
 - Gate status

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/incident.md

@@ -5,6 +5,7 @@ triggers: ["incident", "outage", "sev", "degraded", "hotfix"]
 ---
 # Incident Workflow
 
+## When to use
 Use this for active or recent production incidents.
 
 ## Routing
@@ -14,13 +15,26 @@ Use this for active or recent production incidents.
 - Recovery validation: `@test-engineer`
 - Deployment rollback execution: `@devops-engineer`
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `systematic-debugging`, `sre-engineer`
+- Supporting skills (optional): `monitoring-expert`, `security-reviewer`
+
+## Workflow steps
 1. Establish impact, severity, and current status.
 2. Mitigate first, then stabilize.
 3. Identify probable root cause and confirm.
 4. Implement and verify durable fix.
 5. Document post-incident follow-up actions.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Incident timeline
 - Mitigation actions

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/mobile.md

@@ -5,6 +5,7 @@ triggers: ["mobile", "flutter", "ios", "android", "navigation"]
 ---
 # Mobile Workflow
 
+## When to use
 Use this when mobile app architecture, UX behavior, or platform constraints are the focus.
 
 ## Routing
@@ -12,12 +13,25 @@ Use this when mobile app architecture, UX behavior, or platform constraints are
 - UI support: `@frontend-specialist`
 - Verification support: `@test-engineer`
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `mobile-design`, `flutter-expert`
+- Supporting skills (optional): `riverpod-3`, `drift-flutter`, `flutter-test-master`
+
+## Workflow steps
 1. Confirm platform and UX constraints.
 2. Plan navigation/state/offline behavior.
 3. Implement or refactor mobile flows.
 4. Validate behavior across critical paths.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Mobile flow changes
 - Platform constraints handled

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/orchestrate.md

@@ -5,6 +5,7 @@ triggers: ["orchestrate", "coordinate", "multi-area", "cross-team", "handoff"]
 ---
 # Orchestrate Workflow
 
+## When to use
 Use this when a task spans backend, frontend, data, testing, and release concerns.
 
 ## Routing
@@ -16,13 +17,26 @@ Use this when a task spans backend, frontend, data, testing, and release concern
 - Verification strategy: `@test-engineer`
 - Rollout plan: `@devops-engineer`
 
-## Protocol
+## Workflow steps
 1. Break the request into workstreams with owners.
 2. Request one primary specialist output per workstream.
 3. Merge outputs into a single implementation plan.
 4. Resolve conflicts before implementation.
 5. End with a release-risk summary.
 
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `parallel-agents`, `architecture-designer`
+- Supporting skills (optional): `plan-writing`, `feature-forge`
+
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Scope and assumptions
 - Workstreams with owner + deliverable

package/workflows/workflows/agent-environment-setup/platforms/copilot/workflows/plan.md

@@ -5,15 +5,29 @@ triggers: ["plan", "spec", "design", "roadmap", "acceptance"]
 ---
 # Plan Workflow
 
+## When to use
 Use this when execution needs a stable specification.
 
-## Steps
+## Context notes
+- This workflow file, active platform rules, and selected agents/skills guide execution.
+- Attach logs, screenshots, failing output, and relevant paths when context is incomplete.
+
+## Skill Routing
+- Primary skills: `plan-writing`, `architecture-designer`
+- Supporting skills (optional): `feature-forge`, `api-designer`
+
+## Workflow steps
 1. Lock scope and non-goals.
 2. Define architecture, boundaries, and data flow.
 3. Specify interfaces and validation rules.
 4. Document failure modes and mitigations.
 5. Define tests and release acceptance criteria.
 
+## Verification
+- Run focused checks/tests for the changed scope.
+- Confirm no regressions in adjacent behavior.
+- Note any gaps that were not validated.
+
 ## Output Contract
 - Implementation phases
 - API/data/interface details