@cubis/foundry 0.3.64 → 0.3.66

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/secure-code-guardian/references/owasp-prevention.md

@@ -0,0 +1,135 @@
+# OWASP Top 10 Prevention
+
+## OWASP Top 10 Quick Reference
+
+| # | Vulnerability | Prevention |
+|---|---------------|------------|
+| 1 | Injection | Parameterized queries, ORMs |
+| 2 | Broken Auth | Strong passwords, MFA, secure sessions |
+| 3 | Sensitive Data | Encryption at rest/transit |
+| 4 | XXE | Disable DTDs, use JSON |
+| 5 | Broken Access | Deny by default, server-side validation |
+| 6 | Misconfig | Security headers, disable defaults |
+| 7 | XSS | Output encoding, CSP |
+| 8 | Insecure Deserialization | Schema validation, allowlists |
+| 9 | Known Vulnerabilities | Dependency scanning |
+| 10 | Insufficient Logging | Log security events |
+
+## A01: Injection Prevention
+
+```typescript
+// SQL Injection - Use parameterized queries
+// ❌ Bad
+const bad = `SELECT * FROM users WHERE id = ${userId}`;
+
+// ✅ Good
+const good = await db.query('SELECT * FROM users WHERE id = $1', [userId]);
+
+// ✅ Good - Use ORM
+const user = await prisma.user.findUnique({ where: { id: userId } });
+
+// Command Injection - Avoid shell execution
+// ❌ Bad
+exec(`ls ${userInput}`);
+
+// ✅ Good - Use library functions
+const files = fs.readdirSync(safeDirectory);
+```
+
+## A02: Broken Authentication
+
+```typescript
+// Use bcrypt for passwords
+const hash = await bcrypt.hash(password, 12);
+const isValid = await bcrypt.compare(password, hash);
+
+// Implement account lockout
+if (failedAttempts >= 5) {
+  await lockAccount(userId, 15 * 60 * 1000); // 15 min
+}
+
+// Use secure session configuration
+app.use(session({
+  secret: process.env.SESSION_SECRET,
+  cookie: {
+    httpOnly: true,
+    secure: true,
+    sameSite: 'strict',
+    maxAge: 15 * 60 * 1000, // 15 minutes
+  },
+}));
+```
+
+## A03: Sensitive Data Exposure
+
+```typescript
+// Encrypt sensitive data at rest
+import crypto from 'crypto';
+
+function encrypt(text: string, key: Buffer): string {
+  const iv = crypto.randomBytes(16);
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+  // ... encryption logic
+}
+
+// Use HTTPS only
+app.use((req, res, next) => {
+  if (!req.secure) {
+    return res.redirect(`https://${req.hostname}${req.url}`);
+  }
+  next();
+});
+```
+
+## A05: Broken Access Control
+
+```typescript
+// Always validate on server side
+async function getResource(userId: string, resourceId: string) {
+  const resource = await db.resource.findUnique({ where: { id: resourceId } });
+
+  // Verify ownership
+  if (resource.ownerId !== userId) {
+    throw new ForbiddenError('Access denied');
+  }
+
+  return resource;
+}
+
+// Use role-based access
+function requireRole(...roles: string[]) {
+  return (req: Request, res: Response, next: NextFunction) => {
+    if (!roles.includes(req.user.role)) {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+    next();
+  };
+}
+```
+
+## A07: XSS Prevention
+
+```typescript
+// Use Content Security Policy
+app.use(helmet.contentSecurityPolicy({
+  directives: {
+    defaultSrc: ["'self'"],
+    scriptSrc: ["'self'"],
+    styleSrc: ["'self'", "'unsafe-inline'"],
+  },
+}));
+
+// Sanitize user input for HTML
+import DOMPurify from 'dompurify';
+const clean = DOMPurify.sanitize(userInput);
+```
+
+## Quick Reference
+
+| Attack | Defense |
+|--------|---------|
+| SQL Injection | Parameterized queries |
+| XSS | Output encoding, CSP |
+| CSRF | CSRF tokens |
+| IDOR | Authorization checks |
+| Command Injection | Avoid exec(), validate input |

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/secure-code-guardian/references/security-headers.md

@@ -0,0 +1,133 @@
+# Security Headers
+
+## Helmet (Express)
+
+```typescript
+import helmet from 'helmet';
+
+app.use(helmet()); // Enable all defaults
+
+// Or configure individually
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'"],
+      styleSrc: ["'self'", "'unsafe-inline'"],
+    },
+  },
+  hsts: {
+    maxAge: 31536000,
+    includeSubDomains: true,
+    preload: true,
+  },
+}));
+```
+
+## Manual Headers
+
+```typescript
+app.use((req, res, next) => {
+  // Prevent clickjacking
+  res.setHeader('X-Frame-Options', 'DENY');
+
+  // Prevent MIME sniffing
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+
+  // HSTS (HTTPS only)
+  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+
+  // Referrer policy
+  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+
+  // Permissions policy
+  res.setHeader('Permissions-Policy', 'geolocation=(), microphone=(), camera=()');
+
+  next();
+});
+```
+
+## Rate Limiting
+
+```typescript
+import rateLimit from 'express-rate-limit';
+
+// General API rate limit
+const apiLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 100,
+  message: { error: 'Too many requests' },
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
+app.use('/api/', apiLimiter);
+
+// Strict limit for auth endpoints
+const authLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 5,
+  message: { error: 'Too many login attempts' },
+  skipSuccessfulRequests: true,
+});
+
+app.post('/api/login', authLimiter, loginHandler);
+app.post('/api/register', authLimiter, registerHandler);
+```
+
+## CORS Configuration
+
+```typescript
+import cors from 'cors';
+
+// Strict CORS
+app.use(cors({
+  origin: ['https://example.com', 'https://app.example.com'],
+  methods: ['GET', 'POST', 'PUT', 'DELETE'],
+  allowedHeaders: ['Content-Type', 'Authorization'],
+  credentials: true,
+  maxAge: 86400, // Cache preflight for 24 hours
+}));
+
+// Dynamic origin validation
+app.use(cors({
+  origin: (origin, callback) => {
+    const allowedOrigins = ['https://example.com'];
+    if (!origin || allowedOrigins.includes(origin)) {
+      callback(null, true);
+    } else {
+      callback(new Error('Not allowed by CORS'));
+    }
+  },
+}));
+```
+
+## Cookie Security
+
+```typescript
+res.cookie('session', token, {
+  httpOnly: true,      // No JavaScript access
+  secure: true,        // HTTPS only
+  sameSite: 'strict',  // CSRF protection
+  maxAge: 900000,      // 15 minutes
+  path: '/',
+  domain: '.example.com',
+});
+```
+
+## Quick Reference
+
+| Header | Value | Purpose |
+|--------|-------|---------|
+| X-Frame-Options | DENY | Clickjacking |
+| X-Content-Type-Options | nosniff | MIME sniffing |
+| Strict-Transport-Security | max-age=31536000 | Force HTTPS |
+| Content-Security-Policy | default-src 'self' | XSS |
+| Referrer-Policy | strict-origin-when-cross-origin | Privacy |
+
+| Cookie Flag | Purpose |
+|-------------|---------|
+| httpOnly | No JS access |
+| secure | HTTPS only |
+| sameSite=strict | CSRF protection |
+| maxAge | Expiration |

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/secure-code-guardian/references/xss-csrf.md

@@ -0,0 +1,157 @@
+# XSS & CSRF Prevention
+
+## XSS Prevention
+
+### Output Encoding
+
+```typescript
+// React automatically escapes by default
+function SafeComponent({ userInput }: { userInput: string }) {
+  return <div>{userInput}</div>; // Safe - auto-escaped
+}
+
+// If you must render HTML, sanitize first
+import DOMPurify from 'dompurify';
+
+function HtmlContent({ html }: { html: string }) {
+  return (
+    <div
+      dangerouslySetInnerHTML={{
+        __html: DOMPurify.sanitize(html)
+      }}
+    />
+  );
+}
+```
+
+### Content Security Policy
+
+```typescript
+import helmet from 'helmet';
+
+app.use(helmet.contentSecurityPolicy({
+  directives: {
+    defaultSrc: ["'self'"],
+    scriptSrc: ["'self'"],
+    styleSrc: ["'self'", "'unsafe-inline'"],
+    imgSrc: ["'self'", "data:", "https:"],
+    connectSrc: ["'self'", "https://api.example.com"],
+    fontSrc: ["'self'"],
+    objectSrc: ["'none'"],
+    frameSrc: ["'none'"],
+    upgradeInsecureRequests: [],
+  },
+}));
+```
+
+### Input Sanitization
+
+```typescript
+import DOMPurify from 'dompurify';
+
+// Sanitize HTML
+const clean = DOMPurify.sanitize(dirty);
+
+// Sanitize with config
+const cleanStrict = DOMPurify.sanitize(dirty, {
+  ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a'],
+  ALLOWED_ATTR: ['href'],
+});
+
+// Strip all HTML
+const textOnly = DOMPurify.sanitize(dirty, { ALLOWED_TAGS: [] });
+```
+
+## CSRF Prevention
+
+### Synchronizer Token Pattern
+
+```typescript
+import csrf from 'csurf';
+
+const csrfProtection = csrf({ cookie: true });
+
+// Add to forms
+app.get('/form', csrfProtection, (req, res) => {
+  res.render('form', { csrfToken: req.csrfToken() });
+});
+
+// Validate on submission
+app.post('/submit', csrfProtection, (req, res) => {
+  // Token validated automatically
+});
+```
+
+### Double Submit Cookie
+
+```typescript
+// Set CSRF cookie
+res.cookie('csrf', token, {
+  httpOnly: false, // Must be readable by JS
+  secure: true,
+  sameSite: 'strict',
+});
+
+// Client sends in header
+fetch('/api/action', {
+  method: 'POST',
+  headers: {
+    'X-CSRF-Token': getCookie('csrf'),
+  },
+});
+
+// Server validates
+if (req.cookies.csrf !== req.headers['x-csrf-token']) {
+  return res.status(403).json({ error: 'CSRF validation failed' });
+}
+```
+
+### SameSite Cookies
+
+```typescript
+// Modern CSRF protection
+app.use(session({
+  cookie: {
+    httpOnly: true,
+    secure: true,
+    sameSite: 'strict', // Or 'lax' for GET requests
+  },
+}));
+```
+
+## HTTP Headers
+
+```typescript
+// Security headers
+app.use((req, res, next) => {
+  // Prevent clickjacking
+  res.setHeader('X-Frame-Options', 'DENY');
+
+  // Prevent MIME sniffing
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+
+  // XSS filter (legacy)
+  res.setHeader('X-XSS-Protection', '1; mode=block');
+
+  // Referrer policy
+  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+
+  next();
+});
+```
+
+## Quick Reference
+
+| Attack | Prevention |
+|--------|------------|
+| Reflected XSS | Output encoding |
+| Stored XSS | Input sanitization + encoding |
+| DOM XSS | Avoid innerHTML, use textContent |
+| CSRF | Tokens + SameSite cookies |
+
+| Header | Purpose |
+|--------|---------|
+| CSP | Script/resource restrictions |
+| X-Frame-Options | Clickjacking |
+| X-Content-Type-Options | MIME sniffing |
+| SameSite | CSRF protection |

package/workflows/workflows/agent-environment-setup/platforms/claude/skills/security-reviewer/SKILL.md

@@ -0,0 +1,75 @@
+---
+name: "security-reviewer"
+description: "Use when conducting security audits, reviewing code for vulnerabilities, or analyzing infrastructure security. Invoke for SAST scans, penetration testing, DevSecOps practices, cloud security reviews."
+---
+
+
+# Security Reviewer
+
+## Overview
+
+Security analyst specializing in code review, vulnerability identification, penetration testing, and infrastructure security.
+
+## Role Definition
+
+You are a senior security analyst with 10+ years of application security experience. You specialize in identifying vulnerabilities through code review, SAST tools, active penetration testing, and infrastructure hardening. You produce actionable reports with severity ratings and remediation guidance.
+
+## When to Use This Skill
+
+Code review, SAST, vulnerability scanning, dependency audits, secrets scanning, penetration testing, reconnaissance, infrastructure/cloud security audits, DevSecOps pipelines, compliance automation.
+
+## Core Workflow
+
+1. **Scope** - Attack surface and critical paths
+2. **Automated scan** - SAST and dependency tools
+3. **Manual review** - Auth, input handling, crypto
+4. **Active testing** - Validation and exploitation (authorized only)
+5. **Categorize** - Rate severity (Critical/High/Medium/Low)
+6. **Report** - Document findings with remediation
+
+## Available Steering Files
+
+Load detailed guidance on-demand:
+
+| Topic                   | Reference                             | Load When                                    |
+| ----------------------- | ------------------------------------- | -------------------------------------------- |
+| SAST Tools              | `references/sast-tools.md`              | Running automated scans                      |
+| Vulnerability Patterns  | `references/vulnerability-patterns.md`  | SQL injection, XSS, manual review            |
+| Secret Scanning         | `references/secret-scanning.md`         | Gitleaks, finding hardcoded secrets          |
+| Penetration Testing     | `references/penetration-testing.md`     | Active testing, reconnaissance, exploitation |
+| Infrastructure Security | `references/infrastructure-security.md` | DevSecOps, cloud security, compliance        |
+| Report Template         | `references/report-template.md`         | Writing security report                      |
+
+## Constraints
+
+### MUST DO
+
+- Check authentication/authorization first
+- Run automated tools before manual review
+- Provide specific file/line locations
+- Include remediation for each finding
+- Rate severity consistently
+- Check for secrets in code
+- Verify scope and authorization before active testing
+- Document all testing activities
+- Follow rules of engagement
+- Report critical findings immediately
+
+### MUST NOT DO
+
+- Skip manual review (tools miss things)
+- Test on production systems without authorization
+- Ignore "low" severity issues
+- Assume frameworks handle everything
+- Share detailed exploits publicly
+- Exploit beyond proof of concept
+- Cause service disruption or data loss
+- Test outside defined scope
+
+## Output Templates
+
+Provide: (1) Executive summary with risk, (2) Findings table with severity counts, (3) Detailed findings with location/impact/remediation, (4) Prioritized recommendations.
+
+## Knowledge Reference
+
+OWASP Top 10, CWE, Semgrep, Bandit, ESLint Security, gosec, npm audit, gitleaks, trufflehog, CVSS scoring, nmap, Burp Suite, sqlmap, Trivy, Checkov, HashiCorp Vault, AWS Security Hub, CIS benchmarks, SOC2, ISO27001