@cubis/foundry 0.3.64 → 0.3.65

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/static-analysis/SKILL.md

@@ -0,0 +1,113 @@
+---
+name: static-analysis
+description: Runs CodeQL-based static security analysis (database build, query pack selection, and SARIF results) for vulnerability discovery and audits. Not for custom QL authoring or CI/CD setup.
+allowed-tools:
+  - Bash
+  - Read
+  - Write
+  - Glob
+  - Grep
+  - AskUserQuestion
+  - Task
+  - TaskCreate
+  - TaskList
+  - TaskUpdate
+---
+
+# CodeQL Analysis
+
+Supported languages: Python, JavaScript/TypeScript, Go, Java/Kotlin, C/C++, C#, Ruby, Swift.
+
+**Skill resources:** Reference files and templates are located at `{baseDir}/references/` and `{baseDir}/workflows/`. Use `{baseDir}` to resolve paths to these files at runtime.
+
+## Quick Start
+
+For the common case ("scan this codebase for vulnerabilities"):
+
+```bash
+# 1. Verify CodeQL is installed
+command -v codeql >/dev/null 2>&1 && codeql --version || echo "NOT INSTALLED"
+
+# 2. Check for existing database
+ls -dt codeql_*.db 2>/dev/null | head -1
+```
+
+Then execute the full pipeline: **build database → create data extensions → run analysis** using the workflows below.
+
+## When to Use
+
+- Scanning a codebase for security vulnerabilities with deep data flow analysis
+- Building a CodeQL database from source code (with build capability for compiled languages)
+- Finding complex vulnerabilities that require interprocedural taint tracking or AST/CFG analysis
+- Performing comprehensive security audits with multiple query packs
+
+## When NOT to Use
+
+- **Writing custom queries** - Use a dedicated query development skill
+- **CI/CD integration** - Use GitHub Actions documentation directly
+- **Quick pattern searches** - Use Semgrep or grep for speed
+- **No build capability** for compiled languages - Consider Semgrep instead
+- **Single-file or lightweight analysis** - Semgrep is faster for simple pattern matching
+
+## Rationalizations to Reject
+
+These shortcuts lead to missed findings. Do not accept them:
+
+- **"security-extended is enough"** - It is the baseline. Always check if Trail of Bits packs and Community Packs are available for the language. They catch categories `security-extended` misses entirely.
+- **"The database built, so it's good"** - A database that builds does not mean it extracted well. Always run Step 4 (quality assessment) and check file counts against expected source files. A cached build produces zero useful extraction.
+- **"Data extensions aren't needed for standard frameworks"** - Even Django/Spring apps have custom wrappers around ORM calls, request parsing, or shell execution that CodeQL does not model. Skipping the extensions workflow means missing vulnerabilities in project-specific code.
+- **"build-mode=none is fine for compiled languages"** - It produces severely incomplete analysis. No interprocedural data flow through compiled code is traced. Only use as an absolute last resort and clearly flag the limitation.
+- **"No findings means the code is secure"** - Zero findings can indicate poor database quality, missing models, or wrong query packs. Investigate before reporting clean results.
+- **"I'll just run the default suite"** - The default suite varies by how CodeQL is invoked. Always explicitly specify the suite (e.g., `security-extended`) so results are reproducible.
+
+---
+
+## Workflow Selection
+
+This skill has three workflows:
+
+| Workflow | Purpose |
+|----------|---------|
+| [build-database](workflows/build-database.md) | Create CodeQL database using 3 build methods in sequence |
+| [create-data-extensions](workflows/create-data-extensions.md) | Detect or generate data extension models for project APIs |
+| [run-analysis](workflows/run-analysis.md) | Select rulesets, execute queries, process results |
+
+
+### Auto-Detection Logic
+
+**If user explicitly specifies** what to do (e.g., "build a database", "run analysis"), execute that workflow.
+
+**Default pipeline for "test", "scan", "analyze", or similar:** Execute all three workflows sequentially: build → extensions → analysis. The create-data-extensions step is critical for finding vulnerabilities in projects with custom frameworks or annotations that CodeQL doesn't model by default.
+
+```bash
+# Check if database exists
+DB=$(ls -dt codeql_*.db 2>/dev/null | head -1)
+if [ -n "$DB" ] && codeql resolve database -- "$DB" >/dev/null 2>&1; then
+  echo "DATABASE EXISTS ($DB) - can run analysis"
+else
+  echo "NO DATABASE - need to build first"
+fi
+```
+
+| Condition | Action |
+|-----------|--------|
+| No database exists | Execute build → extensions → analysis (full pipeline) |
+| Database exists, no extensions | Execute extensions → analysis |
+| Database exists, extensions exist | Ask user: run analysis on existing DB, or rebuild? |
+| User says "just run analysis" or "skip extensions" | Run analysis only |
+
+
+### Decision Prompt
+
+If unclear, ask user:
+
+```
+I can help with CodeQL analysis. What would you like to do?
+
+1. **Full scan (Recommended)** - Build database, create extensions, then run analysis
+2. **Build database** - Create a new CodeQL database from this codebase
+3. **Create data extensions** - Generate custom source/sink models for project APIs
+4. **Run analysis** - Run security queries on existing database
+
+[If database exists: "I found an existing database at <DB_NAME>"]
+```

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/static-analysis/references/diagnostic-query-templates.md

@@ -0,0 +1,339 @@
+# Diagnostic Query Templates
+
+Language-specific QL queries for enumerating sources and sinks recognized by CodeQL. Used by the [create-data-extensions workflow](../workflows/create-data-extensions.md).
+
+## Source Enumeration Query
+
+All languages use the class `RemoteFlowSource`. The import differs per language.
+
+### Import Reference
+
+| Language | Imports | Class |
+|----------|---------|-------|
+| Python | `import python` + `import semmle.python.dataflow.new.RemoteFlowSources` | `RemoteFlowSource` |
+| JavaScript | `import javascript` | `RemoteFlowSource` |
+| Java | `import java` + `import semmle.code.java.dataflow.FlowSources` | `RemoteFlowSource` |
+| Go | `import go` | `RemoteFlowSource` |
+| C/C++ | `import cpp` + `import semmle.code.cpp.security.FlowSources` | `RemoteFlowSource` |
+| C# | `import csharp` + `import semmle.code.csharp.security.dataflow.flowsources.Remote` | `RemoteFlowSource` |
+| Ruby | `import ruby` + `import codeql.ruby.dataflow.RemoteFlowSources` | `RemoteFlowSource` |
+
+### Template (Python — swap imports per table above)
+
+```ql
+/**
+ * @name List recognized dataflow sources
+ * @description Enumerates all locations CodeQL recognizes as dataflow sources
+ * @kind problem
+ * @id custom/list-sources
+ */
+import python
+import semmle.python.dataflow.new.RemoteFlowSources
+
+from RemoteFlowSource src
+select src,
+  src.getSourceType()
+    + " | " + src.getLocation().getFile().getRelativePath()
+    + ":" + src.getLocation().getStartLine().toString()
+```
+
+**Note:** `getSourceType()` is available on Python, Java, and C#. For Go, JavaScript, Ruby, and C++ replace the select with:
+```ql
+select src,
+  src.getLocation().getFile().getRelativePath()
+    + ":" + src.getLocation().getStartLine().toString()
+```
+
+---
+
+## Sink Enumeration Queries
+
+The Concepts API differs significantly across languages. Use the correct template.
+
+### Concept Class Reference
+
+| Concept | Python | JavaScript | Go | Ruby |
+|---------|--------|------------|-----|------|
+| SQL | `SqlExecution.getSql()` | `DatabaseAccess.getAQueryArgument()` | `SQL::QueryString` (is-a Node) | `SqlExecution.getSql()` |
+| Command exec | `SystemCommandExecution.getCommand()` | `SystemCommandExecution.getACommandArgument()` | `SystemCommandExecution.getCommandName()` | `SystemCommandExecution.getAnArgument()` |
+| File access | `FileSystemAccess.getAPathArgument()` | `FileSystemAccess.getAPathArgument()` | `FileSystemAccess.getAPathArgument()` | `FileSystemAccess.getAPathArgument()` |
+| HTTP client | `Http::Client::Request.getAUrlPart()` | — | — | — |
+| Decoding | `Decoding.getAnInput()` | — | — | — |
+| XML parsing | — | — | — | `XmlParserCall.getAnInput()` |
+
+### Python
+
+```ql
+/**
+ * @name List recognized dataflow sinks
+ * @description Enumerates security-relevant sinks CodeQL recognizes
+ * @kind problem
+ * @id custom/list-sinks
+ */
+import python
+import semmle.python.Concepts
+
+from DataFlow::Node sink, string kind
+where
+  exists(SqlExecution e | sink = e.getSql() and kind = "sql-execution")
+  or
+  exists(SystemCommandExecution e |
+    sink = e.getCommand() and kind = "command-execution"
+  )
+  or
+  exists(FileSystemAccess e |
+    sink = e.getAPathArgument() and kind = "file-access"
+  )
+  or
+  exists(Http::Client::Request r |
+    sink = r.getAUrlPart() and kind = "http-request"
+  )
+  or
+  exists(Decoding d | sink = d.getAnInput() and kind = "decoding")
+  or
+  exists(CodeExecution e | sink = e.getCode() and kind = "code-execution")
+select sink,
+  kind
+    + " | " + sink.getLocation().getFile().getRelativePath()
+    + ":" + sink.getLocation().getStartLine().toString()
+```
+
+### JavaScript / TypeScript
+
+```ql
+/**
+ * @name List recognized dataflow sinks
+ * @description Enumerates security-relevant sinks CodeQL recognizes
+ * @kind problem
+ * @id custom/list-sinks-js
+ */
+import javascript
+
+from DataFlow::Node sink, string kind
+where
+  exists(DatabaseAccess e |
+    sink = e.getAQueryArgument() and kind = "database-access"
+  )
+  or
+  exists(SystemCommandExecution e |
+    sink = e.getACommandArgument() and kind = "command-execution"
+  )
+  or
+  exists(FileSystemAccess e |
+    sink = e.getAPathArgument() and kind = "file-access"
+  )
+select sink,
+  kind
+    + " | " + sink.getLocation().getFile().getRelativePath()
+    + ":" + sink.getLocation().getStartLine().toString()
+```
+
+### Go
+
+```ql
+/**
+ * @name List recognized dataflow sinks
+ * @description Enumerates security-relevant sinks CodeQL recognizes
+ * @kind problem
+ * @id custom/list-sinks-go
+ */
+import go
+import semmle.go.frameworks.SQL
+
+from DataFlow::Node sink, string kind
+where
+  sink instanceof SQL::QueryString and kind = "sql-query"
+  or
+  exists(SystemCommandExecution e |
+    sink = e.getCommandName() and kind = "command-execution"
+  )
+  or
+  exists(FileSystemAccess e |
+    sink = e.getAPathArgument() and kind = "file-access"
+  )
+select sink,
+  kind
+    + " | " + sink.getLocation().getFile().getRelativePath()
+    + ":" + sink.getLocation().getStartLine().toString()
+```
+
+### Ruby
+
+```ql
+/**
+ * @name List recognized dataflow sinks
+ * @description Enumerates security-relevant sinks CodeQL recognizes
+ * @kind problem
+ * @id custom/list-sinks-ruby
+ */
+import ruby
+import codeql.ruby.Concepts
+
+from DataFlow::Node sink, string kind
+where
+  exists(SqlExecution e | sink = e.getSql() and kind = "sql-execution")
+  or
+  exists(SystemCommandExecution e |
+    sink = e.getAnArgument() and kind = "command-execution"
+  )
+  or
+  exists(FileSystemAccess e |
+    sink = e.getAPathArgument() and kind = "file-access"
+  )
+  or
+  exists(CodeExecution e | sink = e.getCode() and kind = "code-execution")
+select sink,
+  kind
+    + " | " + sink.getLocation().getFile().getRelativePath()
+    + ":" + sink.getLocation().getStartLine().toString()
+```
+
+### Java
+
+Java lacks a unified Concepts module. Use language-specific sink classes. The diagnostics query needs its own `qlpack.yml` with a `codeql/java-all` dependency — create it alongside the `.ql` files:
+
+```yaml
+# $DIAG_DIR/qlpack.yml
+name: custom/diagnostics
+version: 0.0.1
+dependencies:
+  codeql/java-all: "*"
+```
+
+Then run `codeql pack install` in the diagnostics directory before executing queries.
+
+```ql
+/**
+ * @name List recognized dataflow sinks
+ * @description Enumerates security-relevant sinks CodeQL recognizes
+ * @kind problem
+ * @id custom/list-sinks
+ */
+import java
+import semmle.code.java.dataflow.DataFlow
+import semmle.code.java.security.QueryInjection
+import semmle.code.java.security.CommandLineQuery
+import semmle.code.java.security.TaintedPathQuery
+import semmle.code.java.security.XSS
+import semmle.code.java.security.RequestForgery
+import semmle.code.java.security.Xxe
+
+from DataFlow::Node sink, string kind
+where
+  sink instanceof QueryInjectionSink and kind = "sql-injection"
+  or
+  sink instanceof CommandInjectionSink and kind = "command-injection"
+  or
+  sink instanceof TaintedPathSink and kind = "path-injection"
+  or
+  sink instanceof XssSink and kind = "xss"
+  or
+  sink instanceof RequestForgerySink and kind = "ssrf"
+  or
+  sink instanceof XxeSink and kind = "xxe"
+select sink,
+  kind
+    + " | " + sink.getLocation().getFile().getRelativePath()
+    + ":" + sink.getLocation().getStartLine().toString()
+```
+
+### C / C++
+
+C++ uses a similar per-vulnerability-class pattern. Requires a `qlpack.yml` with `codeql/cpp-all` dependency (same approach as Java):
+
+```yaml
+# $DIAG_DIR/qlpack.yml
+name: custom/diagnostics
+version: 0.0.1
+dependencies:
+  codeql/cpp-all: "*"
+```
+
+Then run `codeql pack install` in the diagnostics directory before executing queries.
+
+```ql
+/**
+ * @name List recognized dataflow sinks
+ * @description Enumerates security-relevant sinks CodeQL recognizes
+ * @kind problem
+ * @id custom/list-sinks-cpp
+ */
+import cpp
+import semmle.code.cpp.dataflow.DataFlow
+import semmle.code.cpp.security.CommandExecution
+import semmle.code.cpp.security.FileAccess
+import semmle.code.cpp.security.BufferWrite
+
+from DataFlow::Node sink, string kind
+where
+  exists(FunctionCall call |
+    sink.asExpr() = call.getAnArgument() and
+    call.getTarget().hasGlobalOrStdName("system") and
+    kind = "command-injection"
+  )
+  or
+  exists(FunctionCall call |
+    sink.asExpr() = call.getAnArgument() and
+    call.getTarget().hasGlobalOrStdName(["fopen", "open", "freopen"]) and
+    kind = "file-access"
+  )
+  or
+  exists(FunctionCall call |
+    sink.asExpr() = call.getAnArgument() and
+    call.getTarget().hasGlobalOrStdName(["sprintf", "strcpy", "strcat", "gets"]) and
+    kind = "buffer-write"
+  )
+  or
+  exists(FunctionCall call |
+    sink.asExpr() = call.getAnArgument() and
+    call.getTarget().hasGlobalOrStdName(["execl", "execle", "execlp", "execv", "execvp", "execvpe", "popen"]) and
+    kind = "command-execution"
+  )
+select sink,
+  kind
+    + " | " + sink.getLocation().getFile().getRelativePath()
+    + ":" + sink.getLocation().getStartLine().toString()
+```
+
+### C\#
+
+C# uses per-vulnerability sink classes. Requires a `qlpack.yml` with `codeql/csharp-all` dependency:
+
+```yaml
+# $DIAG_DIR/qlpack.yml
+name: custom/diagnostics
+version: 0.0.1
+dependencies:
+  codeql/csharp-all: "*"
+```
+
+Then run `codeql pack install` in the diagnostics directory before executing queries.
+
+```ql
+/**
+ * @name List recognized dataflow sinks
+ * @description Enumerates security-relevant sinks CodeQL recognizes
+ * @kind problem
+ * @id custom/list-sinks-csharp
+ */
+import csharp
+import semmle.code.csharp.dataflow.DataFlow
+import semmle.code.csharp.security.dataflow.SqlInjectionQuery
+import semmle.code.csharp.security.dataflow.CommandInjectionQuery
+import semmle.code.csharp.security.dataflow.TaintedPathQuery
+import semmle.code.csharp.security.dataflow.XSSQuery
+
+from DataFlow::Node sink, string kind
+where
+  sink instanceof SqlInjection::Sink and kind = "sql-injection"
+  or
+  sink instanceof CommandInjection::Sink and kind = "command-injection"
+  or
+  sink instanceof TaintedPath::Sink and kind = "path-injection"
+  or
+  sink instanceof XSS::Sink and kind = "xss"
+select sink,
+  kind
+    + " | " + sink.getLocation().getFile().getRelativePath()
+    + ":" + sink.getLocation().getStartLine().toString()
+```

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/static-analysis/references/language-details.md

@@ -0,0 +1,207 @@
+# Language-Specific Guidance
+
+## No Build Required
+
+### Python
+
+```bash
+codeql database create codeql.db --language=python --source-root=.
+```
+
+**Framework Support:**
+- Django, Flask, FastAPI: Built-in models
+- Tornado, Pyramid: Partial support
+- Custom frameworks: May need data extensions
+
+**Common Issues:**
+| Issue | Fix |
+|-------|-----|
+| Missing Django models | Ensure `settings.py` is at expected location |
+| Virtual env included | Use `paths-ignore` in config |
+| Type stubs missing | Install `types-*` packages before extraction |
+
+### JavaScript/TypeScript
+
+```bash
+codeql database create codeql.db --language=javascript --source-root=.
+```
+
+**Framework Support:**
+- React, Vue, Angular: Built-in models
+- Express, Koa, Fastify: HTTP source/sink models
+- Next.js, Nuxt: Partial SSR support
+
+**Common Issues:**
+| Issue | Fix |
+|-------|-----|
+| node_modules bloat | Already excluded by default |
+| TypeScript not parsed | Ensure `tsconfig.json` is valid |
+| Monorepo issues | Use `--source-root` for specific package |
+
+### Go
+
+```bash
+codeql database create codeql.db --language=go --source-root=.
+```
+
+**Framework Support:**
+- net/http, Gin, Echo, Chi: Built-in models
+- gRPC: Partial support
+- Custom routers: May need data extensions
+
+**Common Issues:**
+| Issue | Fix |
+|-------|-----|
+| Missing dependencies | Run `go mod download` first |
+| Vendor directory | CodeQL handles automatically |
+| CGO code | Requires `--command='go build'` with CGO enabled |
+
+### Ruby
+
+```bash
+codeql database create codeql.db --language=ruby --source-root=.
+```
+
+**Framework Support:**
+- Rails: Full support (controllers, models, views)
+- Sinatra: Built-in support
+- Hanami: Partial support
+
+**Common Issues:**
+| Issue | Fix |
+|-------|-----|
+| Bundler issues | Run `bundle install` first |
+| Rails engines | May need multiple database passes |
+
+## Build Required
+
+### C/C++
+
+```bash
+# Make
+codeql database create codeql.db --language=cpp --command='make -j8'
+
+# CMake
+codeql database create codeql.db --language=cpp \
+  --source-root=/path/to/src \
+  --command='cmake --build build'
+
+# Ninja
+codeql database create codeql.db --language=cpp \
+  --command='ninja -C build'
+```
+
+**Build System Tips:**
+| Build System | Command |
+|--------------|---------|
+| Make | `make clean && make -j$(nproc)` |
+| CMake | `cmake -B build && cmake --build build` |
+| Meson | `meson setup build && ninja -C build` |
+| Bazel | `bazel build //...` |
+
+**Common Issues:**
+| Issue | Fix |
+|-------|-----|
+| Partial extraction | Ensure `make clean` before CodeQL build |
+| Header-only libraries | Use `--extractor-option cpp_trap_headers=true` |
+| Cross-compilation | Set `CODEQL_EXTRACTOR_CPP_TARGET_ARCH` |
+
+### Java/Kotlin
+
+```bash
+# Gradle
+codeql database create codeql.db --language=java --command='./gradlew build -x test'
+
+# Maven
+codeql database create codeql.db --language=java --command='mvn compile -DskipTests'
+```
+
+**Framework Support:**
+- Spring Boot: Full support
+- Jakarta EE: Built-in models
+- Android: Requires Android SDK
+
+**Common Issues:**
+| Issue | Fix |
+|-------|-----|
+| Missing dependencies | Run `./gradlew dependencies` first |
+| Kotlin mixed projects | Use `--language=java` (covers both) |
+| Annotation processors | Ensure they run during CodeQL build |
+
+### Rust
+
+```bash
+codeql database create codeql.db --language=rust --command='cargo build'
+```
+
+**Common Issues:**
+| Issue | Fix |
+|-------|-----|
+| Proc macros | May require special handling |
+| Workspace projects | Use `--source-root` for specific crate |
+| Build script failures | Ensure native dependencies are available |
+
+### C#
+
+```bash
+# .NET Core
+codeql database create codeql.db --language=csharp --command='dotnet build'
+
+# MSBuild
+codeql database create codeql.db --language=csharp --command='msbuild /t:rebuild'
+```
+
+**Framework Support:**
+- ASP.NET Core: Full support
+- Entity Framework: Database query models
+- Blazor: Partial support
+
+**Common Issues:**
+| Issue | Fix |
+|-------|-----|
+| NuGet restore | Run `dotnet restore` first |
+| Multiple solutions | Specify solution file in command |
+
+### Swift
+
+```bash
+# Xcode project
+codeql database create codeql.db --language=swift \
+  --command='xcodebuild -project MyApp.xcodeproj -scheme MyApp build'
+
+# Swift Package Manager
+codeql database create codeql.db --language=swift --command='swift build'
+```
+
+**Requirements:**
+- macOS only
+- Xcode Command Line Tools
+
+**Common Issues:**
+| Issue | Fix |
+|-------|-----|
+| Code signing | Add `CODE_SIGN_IDENTITY=- CODE_SIGNING_REQUIRED=NO` |
+| Simulator target | Add `-sdk iphonesimulator` |
+
+## Extractor Options
+
+Set via environment variables: `CODEQL_EXTRACTOR_<LANG>_OPTION_<NAME>=<VALUE>`
+
+### C/C++ Options
+
+| Option | Description |
+|--------|-------------|
+| `trap_headers=true` | Include header file analysis |
+| `target_arch=x86_64` | Target architecture |
+
+### Java Options
+
+| Option | Description |
+|--------|-------------|
+| `jdk_version=17` | JDK version for analysis |
+
+### Python Options
+
+| Option | Description |
+|--------|-------------|
+| `python_executable=/path/to/python` | Specific Python interpreter |