@cubis/foundry 0.3.34 → 0.3.36

package/mcp/powers/postman/flutter-security-reviewer/SKILL.md

@@ -1,180 +0,0 @@
----
-name: "flutter-security-reviewer"
-description: "Review Flutter/Dart code for security vulnerabilities: secure storage, network hardening, log redaction, and data protection"
----
-
-
-# Flutter/Dart Security Reviewer
-
-## Overview
-
-This power helps you identify and fix security vulnerabilities in mobile and web applications, focusing on secure storage, network hardening, log redaction, and sensitive data handling.
-
-## When to Use
-
-- Reviewing code that handles authentication tokens
-- Implementing secure storage for sensitive data
-- Adding logging/analytics that might expose PII
-- Reviewing network requests for security issues
-- Implementing biometric authentication
-- Handling user passwords or credentials
-- Processing payment information
-- Storing user preferences that contain sensitive data
-- Implementing session management
-- Any code that touches user data
-
-## Review Output Format
-
-When reviewing, output exactly:
-
-1. **Threat summary** (what could go wrong; 3-6 bullets)
-2. **Findings** grouped by severity (CRITICAL/HIGH/MED/LOW)
-3. **Concrete mitigations** (specific code-level steps)
-4. **Security regression tests/checks** (what to verify)
-5. **Logging & privacy audit** (PII, tokens, crash reports)
-
-## Severity Definitions
-
-- **CRITICAL**: Token/session compromise, auth bypass, remote code/data exposure, storing secrets insecurely, PII leakage
-- **HIGH**: Weak access control, insecure defaults, sensitive data in logs, missing TLS assumptions
-- **MED**: Hardening gaps (timeouts, retry abuse, overly broad permissions)
-- **LOW**: Best-practice improvements
-
-
-## 1) Authentication & Session Security
-
-### Tokens
-
-**CRITICAL:**
-- Tokens in logs, analytics events, crash reports
-- Tokens stored in plain SharedPreferences without justification
-
-**Recommendations:**
-- Prefer secure storage for tokens (platform-backed) where possible
-- If SharedPreferences must be used, ensure:
-  - Short-lived access tokens + refresh tokens handled carefully
-  - Minimal token surface; never log
-
-### Route Guards
-- Ensure router guards cannot be bypassed by deep links
-- Guard decisions must use authoritative session provider state
-- Avoid redirect loops (secure + usability)
-
-
-## 2) Network Security
-
-### Checklist
-- [ ] Use HTTPS in UAT/Prod baseUrl
-- [ ] Reasonable timeouts (connect/receive)
-- [ ] Avoid disabling cert validation
-- [ ] Do not accept all certs in production
-- [ ] Interceptors must not log sensitive headers or body fields
-
-### Retry Policy
-- Avoid retrying non-idempotent requests unless safe
-- Backoff + max attempts
-
-### Device ↔ Gateway Security
-- Prefer server-side validation and proper auth
-- Never "security-by-obscurity" headers
-
-
-## 3) Local Data Protection
-
-**CRITICAL:**
-- Storing PII or tokens unencrypted without threat model
-
-**Guidance:**
-- Store only what's needed offline
-- Encrypt sensitive cached blobs if possible, or avoid caching them
-- Apply TTL to cached session/profile data
-- Clear data on logout
-
-
-## 4) Input Validation & Injection Safety
-
-- [ ] Validate all user inputs before sending to API
-- [ ] Avoid string interpolation for SQL queries: use parameters
-- [ ] Avoid trusting client-only checks (roles, orgId); server must enforce
-
-
-## 5) Privacy, Logging, Analytics
-
-**CRITICAL:**
-- PII in logs (`name`, `phone`, `location`, identifiers)
-- Tokens/headers in logs
-- Crashlytics sending PII
-
-**Guidance:**
-- Redact: Authorization headers, cookies, IDs if sensitive
-- Provide `toSafeLog()` helpers
-- Ensure debug logging is disabled/limited in release builds
-
-
-## 6) Dependency & Supply Chain Hygiene
-
-- [ ] Check new packages are reputable and maintained
-- [ ] Avoid adding packages that request broad permissions without need
-- [ ] Pin versions as appropriate; review changelogs for security fixes
-
-
-## 7) Security Review Checklist for PRs
-
-### Always Search For
-- `print(`, `debugPrint(`, logging interceptors
-- `Authorization`, `token`, `refresh`, `secret`, `apiKey`
-- `badCertificateCallback`, `HttpClient` overrides
-- Persistent storage of user/session data
-
-### Enforce
-- [ ] No secrets in repo
-- [ ] No insecure network overrides in production
-- [ ] Logout clears sensitive local data
-- [ ] Access control enforced server-side (don't trust client role/org headers alone)
-
-
-## Quick Reference
-
-### Secure Storage (DO)
-
-```dart
-// ✅ Use flutter_secure_storage for tokens
-final storage = FlutterSecureStorage();
-await storage.write(key: 'auth_token', value: token);
-```
-
-### Secure Storage (DON'T)
-
-```dart
-// ❌ Never store tokens in SharedPreferences
-final prefs = await SharedPreferences.getInstance();
-prefs.setString('auth_token', token); // INSECURE!
-
-// ❌ Never hardcode secrets
-const apiKey = 'sk_live_abc123'; // NEVER DO THIS
-```
-
-### Log Redaction
-
-```dart
-// ❌ Bad - logs sensitive data
-logger.info('User login: ${user.email}, password: ${password}');
-
-// ✅ Good - no sensitive data in logs
-logger.info('User login successful: userId=${user.id}');
-```
-
-
-## Steering Files
-
-| File                        | Load When                              |
-| --------------------------- | -------------------------------------- |
-| `secure_storage_policy.md`  | What to store where                    |
-| `network_hardening.md`      | Network security best practices        |
-| `log_redaction.md`          | How to redact sensitive data from logs |
-| `vulnerability-patterns.md` | SQL injection, XSS, IDOR patterns      |
-| `secret-scanning.md`        | Finding hardcoded secrets              |
-
-## Templates
-
-- `security_review_response.md` - Security review report template

package/mcp/powers/postman/flutter-security-reviewer/steering/log_redaction.md

@@ -1,17 +0,0 @@
-# Logging redaction policy
-
-## Never log
-- Authorization headers
-- Cookies
-- refresh/access tokens
-- passwords/OTP codes
-- full request/response bodies containing PII
-
-## Recommended
-- Log request method + path + status code
-- Log timing and correlation ids
-- Redact sensitive fields:
-
-Example (pseudo):
-- headers: replace Authorization with "***"
-- body: replace keys like token/password with "***"

package/mcp/powers/postman/flutter-security-reviewer/steering/network_hardening.md

@@ -1,13 +0,0 @@
-# Network hardening (Dio)
-
-Checklist:
-- HTTPS only for UAT/Prod
-- Timeouts configured
-- Interceptors do not leak sensitive info
-- No `badCertificateCallback` in release
-- Use request IDs/transaction hashes for tracing (non-secret)
-
-Retry policy:
-- idempotent requests only (GET)
-- exponential backoff
-- cap attempts

package/mcp/powers/postman/flutter-security-reviewer/steering/secret-scanning.md

@@ -1,123 +0,0 @@
-# Secret Scanning
-
-> Reference for: Security Reviewer
-> Load when: Scanning for hardcoded secrets
-
-## Manual Grep Patterns
-
-```bash
-# Common secret patterns
-grep -rn "api_key\|apikey\|api-key" --include="*.dart" .
-grep -rn "secret\|password\|passwd" --include="*.dart" .
-grep -rn "private_key\|privatekey" --include="*.dart" .
-grep -rn "access_token\|accesstoken" --include="*.dart" .
-
-# Firebase/Google
-grep -rn "AIza[0-9A-Za-z_-]{35}" .
-grep -rn "firebase" --include="*.dart" .
-
-# AWS credentials
-grep -rn "AKIA[0-9A-Z]{16}" .
-grep -rn "aws_secret_access_key" .
-
-# Base64 encoded (potential secrets)
-grep -rn "[A-Za-z0-9+/]{40,}=" .
-
-# JWT tokens
-grep -rn "eyJ[A-Za-z0-9_-]*\.eyJ[A-Za-z0-9_-]*\." .
-```
-
-## Common Secret Patterns
-
-| Type              | Pattern                          | Example                    |
-| ----------------- | -------------------------------- | -------------------------- |
-| AWS Access Key    | `AKIA[0-9A-Z]{16}`               | AKIAIOSFODNN7EXAMPLE       |
-| AWS Secret Key    | 40 char base64                   | wJalrXUtnFEMI/K7MDENG...   |
-| Firebase API Key  | `AIza[0-9A-Za-z_-]{35}`          | AIzaSyC...                 |
-| GitHub Token      | `ghp_[A-Za-z0-9]{36}`            | ghp_xxxxxxxxxxxx           |
-| Slack Token       | `xox[baprs]-`                    | xoxb-xxx-xxx               |
-| Stripe Key        | `sk_live_[A-Za-z0-9]{24}`        | sk_live_xxxx               |
-| Private Key       | `-----BEGIN.*PRIVATE KEY-----`  | RSA/EC keys                |
-| JWT               | `eyJ[A-Za-z0-9_-]*\.eyJ`         | Encoded tokens             |
-
-## Flutter-Specific Locations to Check
-
-```bash
-# Check these files for hardcoded secrets
-lib/core/config/
-lib/firebase_options.dart
-android/app/google-services.json
-ios/Runner/GoogleService-Info.plist
-.env files
-pubspec.yaml (sometimes contains keys)
-```
-
-## What to Look For
-
-### Hardcoded API Keys
-```dart
-// BAD - Hardcoded
-const apiKey = 'sk_live_abc123xyz';
-const firebaseKey = 'AIzaSyC...';
-
-// GOOD - Environment variable or secure storage
-final apiKey = const String.fromEnvironment('API_KEY');
-final apiKey = await secureStorage.read(key: 'api_key');
-```
-
-### Hardcoded URLs with Credentials
-```dart
-// BAD
-const dbUrl = 'postgres://user:password@host:5432/db';
-
-// GOOD
-final dbUrl = const String.fromEnvironment('DATABASE_URL');
-```
-
-### Debug/Test Credentials
-```dart
-// BAD - Test credentials in production code
-const testUser = 'admin';
-const testPassword = 'admin123';
-
-// GOOD - Only in test files, never committed
-// Use environment variables or test fixtures
-```
-
-## Remediation Steps
-
-1. **Rotate immediately** - Consider secret compromised
-2. **Remove from code** - Replace with environment variable
-3. **Remove from git history** - Use BFG or git filter-branch
-4. **Add to .gitignore** - Prevent future commits
-5. **Use secure storage** - flutter_secure_storage for runtime secrets
-6. **Use --dart-define** - For build-time configuration
-
-```bash
-# Build with environment variables
-flutter build apk --dart-define=API_KEY=$API_KEY
-
-# Access in code
-const apiKey = String.fromEnvironment('API_KEY');
-```
-
-## Pre-commit Prevention
-
-```yaml
-# .pre-commit-config.yaml
-repos:
-  - repo: https://github.com/gitleaks/gitleaks
-    rev: v8.18.0
-    hooks:
-      - id: gitleaks
-```
-
-## Quick Reference
-
-| Location                    | Risk Level | Action                      |
-| --------------------------- | ---------- | --------------------------- |
-| Source code (.dart)         | Critical   | Remove, use env vars        |
-| Config files                | High       | Move to .gitignore          |
-| Git history                 | Critical   | Rewrite history             |
-| Build artifacts             | Medium     | Ensure not committed        |
-| Comments/TODOs              | Medium     | Remove sensitive info       |

package/mcp/powers/postman/flutter-security-reviewer/steering/secure_storage_policy.md

@@ -1,16 +0,0 @@
-# Secure storage policy (mobile)
-
-## Token storage
-Preferred:
-- Platform-backed secure storage for auth tokens
-
-If you must use SharedPreferences:
-- access tokens should be short-lived
-- never store refresh token unless encrypted/secured
-- clear all tokens on logout
-- guard against backup/restore exposures where relevant
-
-## Cached user/profile data
-- Apply TTL
-- Avoid caching sensitive PII unless required for offline
-- Clear per-organization/user on logout or org switch

package/mcp/powers/postman/flutter-security-reviewer/steering/vulnerability-patterns.md

@@ -1,189 +0,0 @@
-# Vulnerability Patterns
-
-> Reference for: Security Reviewer
-> Load when: Manual security code review
-
-## SQL/NoSQL Injection
-
-```dart
-// VULNERABLE - String interpolation
-final query = "SELECT * FROM users WHERE id = $userId";
-
-// SECURE - Parameterized queries (Sqflite)
-final result = await db.query(
-  'users',
-  where: 'id = ?',
-  whereArgs: [userId],
-);
-
-// SECURE - ORM (Isar)
-final user = await isar.users.filter().idEqualTo(userId).findFirst();
-```
-
-## Path Traversal
-
-```dart
-// VULNERABLE
-final file = File('$uploadDir/${request.filename}');
-
-// SECURE - Validate and normalize
-final filename = path.basename(request.filename);
-final file = File(path.join(uploadDir, filename));
-
-// Verify path is within allowed directory
-if (!file.path.startsWith(path.canonicalize(uploadDir))) {
-  throw SecurityException('Invalid path');
-}
-```
-
-## Insecure Direct Object Reference (IDOR)
-
-```dart
-// VULNERABLE - No authorization check
-Future<Document> getDocument(String docId) async {
-  return await documentRepository.findById(docId);
-}
-
-// SECURE - Verify ownership
-Future<Document> getDocument(String docId, String userId) async {
-  final doc = await documentRepository.findById(docId);
-  if (doc.ownerId != userId) {
-    throw UnauthorizedException('Access denied');
-  }
-  return doc;
-}
-```
-
-## Sensitive Data Exposure
-
-```dart
-// VULNERABLE - Logging sensitive data
-logger.info('User login: email=$email, password=$password');
-logger.debug('Token: $authToken');
-
-// SECURE - Redact sensitive fields
-logger.info('User login: email=$email');
-logger.debug('Token: [REDACTED]');
-
-// VULNERABLE - Error response exposes internals
-return Response.error(exception.stackTrace.toString());
-
-// SECURE - Generic error
-return Response.error('An error occurred');
-```
-
-## Insecure Storage
-
-```dart
-// VULNERABLE - Plain SharedPreferences for tokens
-final prefs = await SharedPreferences.getInstance();
-await prefs.setString('auth_token', token);
-
-// SECURE - Use flutter_secure_storage
-final storage = FlutterSecureStorage();
-await storage.write(key: 'auth_token', value: token);
-
-// VULNERABLE - Unencrypted Isar for sensitive data
-final isar = await Isar.open([UserSchema]);
-
-// SECURE - Encrypted Isar
-final isar = await Isar.open(
-  [UserSchema],
-  encryptionKey: encryptionKey,
-);
-```
-
-## Authentication Bypass
-
-```dart
-// VULNERABLE - Client-side only check
-if (user.role == 'admin') {
-  showAdminPanel();
-}
-
-// SECURE - Server validates, client just displays
-// Server: verify role in JWT/session before returning admin data
-// Client: display based on server response
-
-// VULNERABLE - Trusting client headers
-final orgId = request.headers['X-Org-Id'];
-
-// SECURE - Derive from authenticated session
-final orgId = authenticatedUser.organizationId;
-```
-
-## Session Management Issues
-
-```dart
-// VULNERABLE - No session timeout
-// Token never expires
-
-// SECURE - Short-lived access tokens + refresh
-final accessToken = jwt.sign(
-  payload,
-  secret,
-  expiresIn: Duration(minutes: 15),
-);
-
-// VULNERABLE - Session not cleared on logout
-Future<void> logout() async {
-  // Just navigate away
-  context.go('/login');
-}
-
-// SECURE - Clear all sensitive data
-Future<void> logout() async {
-  await secureStorage.deleteAll();
-  await isar.writeTxn(() => isar.clear());
-  ref.invalidate(sessionProvider);
-  context.go('/login');
-}
-```
-
-## Deep Link Security
-
-```dart
-// VULNERABLE - No auth check on deep link
-GoRoute(
-  path: '/document/:id',
-  builder: (context, state) => DocumentView(id: state.params['id']!),
-)
-
-// SECURE - Guard protects deep links
-GoRoute(
-  path: '/document/:id',
-  redirect: (context, state) {
-    if (!isAuthenticated) return '/login?redirect=${state.uri}';
-    return null;
-  },
-  builder: (context, state) => DocumentView(id: state.params['id']!),
-)
-```
-
-## Quick Reference
-
-| Vulnerability     | Input Vector    | Prevention                    |
-| ----------------- | --------------- | ----------------------------- |
-| SQL Injection     | Query params    | Parameterized queries         |
-| Path Traversal    | File paths      | path.basename + validation    |
-| IDOR              | Resource IDs    | Authorization checks          |
-| Data Exposure     | Logs, errors    | Redaction, generic errors     |
-| Insecure Storage  | Local storage   | flutter_secure_storage        |
-| Auth Bypass       | Client checks   | Server-side validation        |
-| Session Issues    | Token handling  | Short TTL, proper logout      |
-| Deep Link Bypass  | URL schemes     | Route guards                  |
-
-## OWASP Mobile Top 10 Mapping
-
-| OWASP Mobile              | Vulnerabilities                    |
-| ------------------------- | ---------------------------------- |
-| M1 Improper Platform Use  | Insecure storage, deep link bypass |
-| M2 Insecure Data Storage  | SharedPreferences for tokens       |
-| M3 Insecure Communication | HTTP, no cert pinning              |
-| M4 Insecure Authentication| Weak session, no timeout           |
-| M5 Insufficient Crypto    | Weak encryption, hardcoded keys    |
-| M6 Insecure Authorization | IDOR, client-side checks           |
-| M7 Client Code Quality    | Injection, path traversal          |
-| M8 Code Tampering         | No integrity checks                |
-| M9 Reverse Engineering    | Hardcoded secrets                  |
-| M10 Extraneous Functionality | Debug endpoints, test data      |

package/mcp/powers/postman/flutter-security-reviewer/templates/security_review_response.md

@@ -1,31 +0,0 @@
-# Security Review (OneUp HR)
-
-## Threat summary
-- ...
-
-## Findings
-
-### CRITICAL
-- **...**
-  - Risk:
-  - Evidence:
-  - Fix:
-
-### HIGH
-- ...
-
-### MED
-- ...
-
-### LOW
-- ...
-
-## Concrete mitigations
-1) ...
-2) ...
-
-## Security regression checks
-- [ ] ...
-
-## Logging & privacy audit
-- ...