@cubis/foundry 0.3.66 → 0.3.68

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/variant-analysis/resources/codeql/python.ql

@@ -1,80 +0,0 @@
-/**
- * @name [VARIANT_NAME]
- * @description Find variants of [ORIGINAL_BUG_ID]
- * @kind path-problem
- * @problem.severity error
- * @precision high
- * @tags security
- *       variant-analysis
- */
-
-import python
-import semmle.python.dataflow.new.DataFlow
-import semmle.python.dataflow.new.TaintTracking
-import semmle.python.ApiGraphs
-
-module VariantConfig implements DataFlow::ConfigSig {
-  // Sources: where untrusted data originates
-  predicate isSource(DataFlow::Node source) {
-    // Flask request parameters
-    source = API::moduleImport("flask").getMember("request")
-             .getMember(["args", "form", "json", "data"])
-             .getAUse()
-    or
-    // Environment variables
-    exists(Call c |
-      c.getFunc().(Attribute).getObject().(Name).getId() = "os" and
-      c.getFunc().(Attribute).getName() in ["getenv", "environ"] and
-      source.asExpr() = c
-    )
-  }
-
-  // Sinks: where tainted data becomes dangerous
-  predicate isSink(DataFlow::Node sink) {
-    // os.system()
-    exists(Call c |
-      c.getFunc().(Attribute).getObject().(Name).getId() = "os" and
-      c.getFunc().(Attribute).getName() = "system" and
-      sink.asExpr() = c.getArg(0)
-    )
-    or
-    // subprocess with shell=True
-    exists(Call c |
-      c.getFunc().(Attribute).getName() in ["call", "run", "Popen"] and
-      c.getArgByName("shell").(NameConstant).getValue() = true and
-      sink.asExpr() = c.getArg(0)
-    )
-  }
-
-  // Barriers: sanitization functions
-  predicate isBarrier(DataFlow::Node node) {
-    exists(Call c |
-      c.getFunc().(Attribute).getObject().(Name).getId() = "shlex" and
-      c.getFunc().(Attribute).getName() = "quote" and
-      node.asExpr() = c
-    )
-    or
-    exists(Call c |
-      c.getFunc().(Name).getId() in ["sanitize", "escape", "validate"] and
-      node.asExpr() = c
-    )
-  }
-
-  // Custom flow steps (optional)
-  predicate isAdditionalFlowStep(DataFlow::Node pred, DataFlow::Node succ) {
-    exists(Call c |
-      c.getFunc().(Attribute).getName() = "format" and
-      pred.asExpr() = c.getFunc().(Attribute).getObject() and
-      succ.asExpr() = c
-    )
-  }
-}
-
-module VariantFlow = TaintTracking::Global<VariantConfig>;
-import VariantFlow::PathGraph
-
-from VariantFlow::PathNode source, VariantFlow::PathNode sink
-where VariantFlow::flowPath(source, sink)
-select sink.getNode(), source, sink,
-  "Potential variant: tainted data from $@ flows to dangerous sink.",
-  source.getNode(), "user-controlled input"

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/variant-analysis/resources/semgrep/cpp.yaml

@@ -1,98 +0,0 @@
-rules:
-  - id: variant-taint-cpp
-    message: "Potential variant: user input flows to dangerous sink"
-    severity: ERROR
-    languages: [c, cpp]
-    mode: taint
-
-    pattern-sources:
-      # Command line
-      - pattern: argv[$IDX]
-      # Standard input
-      - pattern: gets(...)
-      - pattern: fgets($BUF, $SIZE, stdin)
-      - pattern: scanf(...)
-      - pattern: fscanf(...)
-      - pattern: getenv(...)
-      # Network
-      - pattern: recv($SOCK, $BUF, ...)
-      - pattern: recvfrom(...)
-      - pattern: read($FD, $BUF, ...)
-
-    pattern-sinks:
-      # Command injection
-      - pattern: system($SINK)
-      - pattern: popen($SINK, ...)
-      - pattern: execl($SINK, ...)
-      - pattern: execlp($SINK, ...)
-      - pattern: execv($SINK, ...)
-      - pattern: execvp($SINK, ...)
-      # Buffer overflow
-      - pattern: strcpy($DST, $SINK)
-      - pattern: strcat($DST, $SINK)
-      - pattern: sprintf($DST, $FMT, ..., $SINK, ...)
-      - pattern: gets($SINK)
-      # Format string
-      - pattern: printf($SINK)
-      - pattern: fprintf($FILE, $SINK)
-      - pattern: sprintf($BUF, $SINK)
-      - pattern: syslog($PRI, $SINK)
-      # Memory
-      - pattern: malloc($SINK)
-      - pattern: calloc($SINK, ...)
-      - pattern: realloc($PTR, $SINK)
-      - pattern: alloca($SINK)
-      # File operations
-      - pattern: fopen($SINK, ...)
-      - pattern: open($SINK, ...)
-
-    pattern-sanitizers:
-      - pattern: strncpy($DST, $SRC, $N)
-      - pattern: strncat($DST, $SRC, $N)
-      - pattern: snprintf($BUF, $SIZE, ...)
-      - pattern: strlcpy(...)
-      - pattern: strlcat(...)
-
-    paths:
-      exclude:
-        - "**/test/**"
-        - "**/*_test.c"
-        - "**/*_test.cpp"
-
-  - id: unsafe-functions-cpp
-    message: "Use of unsafe function - consider bounded alternative"
-    severity: WARNING
-    languages: [c, cpp]
-    pattern-either:
-      - pattern: gets(...)
-      - pattern: strcpy(...)
-      - pattern: strcat(...)
-      - pattern: sprintf(...)
-      - pattern: vsprintf(...)
-
-  - id: format-string-cpp
-    message: "Potential format string vulnerability"
-    severity: ERROR
-    languages: [c, cpp]
-    patterns:
-      - pattern-either:
-          - pattern: printf($VAR)
-          - pattern: fprintf($F, $VAR)
-          - pattern: sprintf($B, $VAR)
-          - pattern: snprintf($B, $S, $VAR)
-      - pattern-not: printf("...")
-      - pattern-not: fprintf($F, "...")
-      - pattern-not: sprintf($B, "...")
-      - pattern-not: snprintf($B, $S, "...")
-
-  - id: integer-overflow-cpp
-    message: "Potential integer overflow before memory allocation"
-    severity: WARNING
-    languages: [c, cpp]
-    patterns:
-      - pattern: |
-          $SIZE = $X * $Y;
-          ...
-          malloc($SIZE)
-      - pattern: malloc($X * $Y)
-      - pattern: calloc($X * $Y, ...)

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/variant-analysis/resources/semgrep/go.yaml

@@ -1,63 +0,0 @@
-rules:
-  - id: variant-taint-go
-    message: "Potential variant: user input flows to dangerous sink"
-    severity: ERROR
-    languages: [go]
-    mode: taint
-
-    pattern-sources:
-      # net/http
-      - pattern: $REQ.URL.Query().Get(...)
-      - pattern: $REQ.FormValue(...)
-      - pattern: $REQ.PostFormValue(...)
-      - pattern: $REQ.Header.Get(...)
-      # Gin
-      - pattern: $CTX.Query(...)
-      - pattern: $CTX.Param(...)
-      - pattern: $CTX.PostForm(...)
-      - pattern: $CTX.GetHeader(...)
-      # Echo
-      - pattern: $CTX.QueryParam(...)
-      - pattern: $CTX.FormValue(...)
-      # os.Args
-      - pattern: os.Args[$IDX]
-      - pattern: os.Getenv(...)
-
-    pattern-sinks:
-      # Command injection
-      - pattern: exec.Command($SINK, ...)
-      - pattern: exec.CommandContext($CTX, $SINK, ...)
-      # SQL injection
-      - pattern: $DB.Query($SINK, ...)
-      - pattern: $DB.QueryRow($SINK, ...)
-      - pattern: $DB.Exec($SINK, ...)
-      # Path traversal
-      - pattern: os.Open($SINK)
-      - pattern: os.OpenFile($SINK, ...)
-      - pattern: os.ReadFile($SINK)
-      - pattern: ioutil.ReadFile($SINK)
-      # Template injection
-      - pattern: template.HTML($SINK)
-
-    pattern-sanitizers:
-      - pattern: strconv.Atoi($X)
-      - pattern: strconv.ParseInt($X, ...)
-      - pattern: filepath.Clean($X)
-      - pattern: filepath.Base($X)
-      - pattern: html.EscapeString($X)
-
-    paths:
-      exclude:
-        - "**/*_test.go"
-        - "**/test/**"
-        - "**/vendor/**"
-
-  - id: variant-pattern-go
-    message: "Suspicious pattern matching known vulnerability"
-    severity: WARNING
-    languages: [go]
-    patterns:
-      - pattern-either:
-          - pattern: exec.Command(...)
-          - pattern: $DB.Query($Q, ...)
-      - pattern-not: exec.Command("...")

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/variant-analysis/resources/semgrep/java.yaml

@@ -1,61 +0,0 @@
-rules:
-  - id: variant-taint-java
-    message: "Potential variant: user input flows to dangerous sink"
-    severity: ERROR
-    languages: [java]
-    mode: taint
-
-    pattern-sources:
-      # Servlet
-      - pattern: (HttpServletRequest $REQ).getParameter(...)
-      - pattern: (HttpServletRequest $REQ).getHeader(...)
-      - pattern: (HttpServletRequest $REQ).getCookies()
-      - pattern: (HttpServletRequest $REQ).getQueryString()
-      - pattern: (HttpServletRequest $REQ).getInputStream()
-      # Spring
-      - pattern: "@RequestParam $TYPE $VAR"
-      - pattern: "@PathVariable $TYPE $VAR"
-      - pattern: "@RequestBody $TYPE $VAR"
-
-    pattern-sinks:
-      # Command injection
-      - pattern: Runtime.getRuntime().exec($SINK, ...)
-      - pattern: new ProcessBuilder($SINK, ...)
-      # SQL injection
-      - pattern: (Statement $S).executeQuery($SINK)
-      - pattern: (Statement $S).executeUpdate($SINK)
-      - pattern: (Statement $S).execute($SINK)
-      - pattern: (Connection $C).prepareStatement($SINK)
-      # Path traversal
-      - pattern: new File($SINK)
-      - pattern: new FileInputStream($SINK)
-      - pattern: new FileOutputStream($SINK)
-      - pattern: Paths.get($SINK, ...)
-      # XXE
-      - pattern: (DocumentBuilder $DB).parse($SINK)
-      # Deserialization
-      - pattern: (ObjectInputStream $OIS).readObject()
-
-    pattern-sanitizers:
-      - pattern: Integer.parseInt($X)
-      - pattern: Integer.valueOf($X)
-      - pattern: StringEscapeUtils.escapeHtml4($X)
-      - pattern: ESAPI.encoder().encodeForSQL(...)
-
-    paths:
-      exclude:
-        - "**/test/**"
-        - "**/*Test.java"
-
-  - id: variant-pattern-java
-    message: "Suspicious pattern matching known vulnerability"
-    severity: WARNING
-    languages: [java]
-    patterns:
-      - pattern-either:
-          - pattern: Runtime.getRuntime().exec(...)
-          - pattern: new ProcessBuilder(...)
-      - pattern-inside: |
-          $RET $METHOD(..., HttpServletRequest $REQ, ...) {
-            ...
-          }

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/variant-analysis/resources/semgrep/javascript.yaml

@@ -1,60 +0,0 @@
-rules:
-  - id: variant-taint-js
-    message: "Potential variant: user input flows to dangerous sink"
-    severity: ERROR
-    languages: [javascript, typescript]
-    mode: taint
-
-    pattern-sources:
-      # Express
-      - pattern: req.query.$PARAM
-      - pattern: req.body.$PARAM
-      - pattern: req.params.$PARAM
-      - pattern: req.cookies.$PARAM
-      # URL/Location
-      - pattern: window.location.$PROP
-      - pattern: document.location.$PROP
-      - pattern: location.search
-      - pattern: location.hash
-
-    pattern-sinks:
-      # Command injection
-      - pattern: child_process.exec($SINK, ...)
-      - pattern: child_process.execSync($SINK, ...)
-      - pattern: child_process.spawn($SINK, ...)
-      # Code execution
-      - pattern: eval($SINK)
-      - pattern: Function($SINK)
-      - pattern: setTimeout($SINK, ...)
-      - pattern: setInterval($SINK, ...)
-      # SQL
-      - pattern: $DB.query($SINK, ...)
-      - pattern: $DB.raw($SINK)
-      # XSS
-      - pattern: $EL.innerHTML = $SINK
-      - pattern: document.write($SINK)
-
-    pattern-sanitizers:
-      - pattern: parseInt($X, ...)
-      - pattern: encodeURIComponent($X)
-      - pattern: escape($X)
-      - pattern: $DB.escape($X)
-
-    paths:
-      exclude:
-        - "**/*.test.js"
-        - "**/*.spec.js"
-        - "**/test/**"
-        - "**/node_modules/**"
-
-  - id: variant-pattern-js
-    message: "Suspicious pattern matching known vulnerability"
-    severity: WARNING
-    languages: [javascript, typescript]
-    patterns:
-      - pattern-either:
-          - pattern: eval(...)
-          - pattern: Function(...)
-          - pattern: child_process.exec(...)
-      - pattern-not: eval("...")
-      - pattern-not: Function("...")

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/variant-analysis/resources/semgrep/python.yaml

@@ -1,72 +0,0 @@
-rules:
-  - id: variant-taint-analysis
-    message: >-
-      Potential variant: user-controlled data flows to dangerous sink.
-      Original bug: [DESCRIBE_ORIGINAL_BUG]
-    severity: ERROR
-    languages: [python]
-    mode: taint
-
-    pattern-sources:
-      # Flask
-      - pattern: request.args.get(...)
-      - pattern: request.args[...]
-      - pattern: request.form.get(...)
-      - pattern: request.form[...]
-      - pattern: request.json
-      - pattern: request.data
-      # Django (uncomment if needed)
-      # - pattern: request.GET.get(...)
-      # - pattern: request.POST.get(...)
-      # General
-      - pattern: os.environ.get(...)
-      - pattern: input(...)
-
-    pattern-sinks:
-      # Command injection
-      - pattern: os.system($SINK)
-      - pattern: os.popen($SINK)
-      - pattern: subprocess.call($SINK, ...)
-      - pattern: subprocess.run($SINK, ...)
-      - pattern: subprocess.Popen($SINK, ...)
-      # Code execution
-      - pattern: eval($SINK)
-      - pattern: exec($SINK)
-      # SQL (uncomment if needed)
-      # - pattern: $CURSOR.execute($SINK)
-      # Path traversal (uncomment if needed)
-      # - pattern: open($SINK, ...)
-
-    pattern-sanitizers:
-      - pattern: shlex.quote(...)
-      - pattern: os.path.basename(...)
-      - pattern: int(...)
-      - pattern: sanitize(...)
-      - pattern: escape(...)
-      - pattern: validate(...)
-
-    paths:
-      exclude:
-        - "*_test.py"
-        - "test_*.py"
-        - "tests/"
-        - "**/test/**"
-
-    metadata:
-      category: security
-      confidence: HIGH
-
-  # Simple pattern matching variant (non-taint)
-  - id: variant-pattern-match
-    message: "Suspicious pattern matching known vulnerability signature"
-    severity: WARNING
-    languages: [python]
-    patterns:
-      - pattern-either:
-          - pattern: dangerous_func($USER_DATA)
-          - pattern: risky_operation(..., $USER_DATA, ...)
-      - pattern-not: dangerous_func("...")
-    paths:
-      exclude:
-        - "tests/"
-        - "*_test.py"

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/variant-analysis/resources/variant-report-template.md

@@ -1,75 +0,0 @@
-# Variant Analysis Report
-
-## Summary
-
-| Field | Value |
-|-------|-------|
-| **Original Bug** | [BUG_ID / CVE] |
-| **Analysis Date** | [DATE] |
-| **Codebase** | [REPO/PROJECT] |
-| **Variants Found** | [COUNT] |
-
-## Original Vulnerability
-
-**Root Cause:** [e.g., "User input reaches SQL query without parameterization"]
-
-**Location:** `[path/to/file.py:LINE]` in `function_name()`
-
-```python
-# Vulnerable code
-```
-
-## Search Methodology
-
-| Version | Pattern | Tool | Matches | TP | FP |
-|---------|---------|------|---------|----|----|
-| v1 | [exact] | ripgrep | 1 | 1 | 0 |
-| v2 | [abstract] | semgrep | N | N | N |
-
-**Final Pattern:**
-```yaml
-# Pattern used
-```
-
-## Findings
-
-### Variant #1: [BRIEF_TITLE]
-
-| Severity | Confidence | Status |
-|----------|------------|--------|
-| High | High | Confirmed |
-
-**Location:** `[path/to/file.py:LINE]`
-
-```python
-# Vulnerable code
-```
-
-**Analysis:** [Why this is a true/false positive]
-
-**Exploitability:**
-- [ ] Reachable from external input
-- [ ] User-controlled data
-- [ ] No sanitization
-
----
-
-<!-- Copy variant template above for additional findings -->
-
-## False Positive Patterns
-
-| Pattern | Count | Reason |
-|---------|-------|--------|
-| [pattern] | N | [why safe] |
-
-## Recommendations
-
-### Immediate
-1. Fix variant in [location]
-
-### Preventive
-1. Add Semgrep rule to CI
-
-```yaml
-# CI-ready rule
-```

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/vercel-ai/SKILL.md

@@ -1,39 +0,0 @@
----
-name: vercel-ai
-description: "Canonical Vercel AI skill covering AI Gateway and AI SDK integration, routing, resilience, and observability."
-metadata:
-  deprecated: false
-  replaced_by: null
-  removal_target: null
----
-# Vercel AI
-
-## Purpose
-
-Implement Vercel AI workloads with a single operating model across AI Gateway and AI SDK: provider routing, fallback resilience, secure key handling, streaming UX, and usage observability.
-
-## Use This For
-
-- AI Gateway provider routing and fallback chains
-- BYOK/auth strategy and OpenAI-compatible endpoints
-- AI SDK integration for chat/completions/streaming
-- AI request telemetry and cost/usage controls
-
-## Decision Flow
-
-1. Select provider topology and fallback policy.
-2. Define auth and secret boundaries.
-3. Implement SDK streaming/UI contract.
-4. Validate latency/cost/error behavior with telemetry.
-
-## Verification
-
-- Gateway routes and fallback logic are deterministic.
-- SDK streaming path is stable under provider failure.
-- Token usage and error rates are observable per route/model.
-
-## Related Skills
-
-- `vercel-platform`
-- `prompt-engineer`
-- `vercel-observability`

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/vercel-ai-gateway/SKILL.md

@@ -1,20 +0,0 @@
----
-name: vercel-ai-gateway
-description: "Compatibility alias skill. Deprecated: use vercel-ai."
-metadata:
-  deprecated: true
-  replaced_by: vercel-ai
-  removal_target: v0.6.0
----
-# Vercel Ai Gateway
-
-## Compatibility Alias
-
-This skill is deprecated and kept for backward compatibility.
-
-Use `vercel-ai` as the canonical skill.
-
-## Migration
-
-1. Replace direct references to `vercel-ai-gateway` with `vercel-ai`.
-2. Apply the full workflow from `vercel-ai` for new work.

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/vercel-ai-sdk/SKILL.md

@@ -1,20 +0,0 @@
----
-name: vercel-ai-sdk
-description: "Compatibility alias skill. Deprecated: use vercel-ai."
-metadata:
-  deprecated: true
-  replaced_by: vercel-ai
-  removal_target: v0.6.0
----
-# Vercel Ai Sdk
-
-## Compatibility Alias
-
-This skill is deprecated and kept for backward compatibility.
-
-Use `vercel-ai` as the canonical skill.
-
-## Migration
-
-1. Replace direct references to `vercel-ai-sdk` with `vercel-ai`.
-2. Apply the full workflow from `vercel-ai` for new work.

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/vercel-caching/SKILL.md

@@ -1,20 +0,0 @@
----
-name: vercel-caching
-description: "Compatibility alias skill. Deprecated: use vercel-runtime."
-metadata:
-  deprecated: true
-  replaced_by: vercel-runtime
-  removal_target: v0.6.0
----
-# Vercel Caching
-
-## Compatibility Alias
-
-This skill is deprecated and kept for backward compatibility.
-
-Use `vercel-runtime` as the canonical skill.
-
-## Migration
-
-1. Replace direct references to `vercel-caching` with `vercel-runtime`.
-2. Apply the full workflow from `vercel-runtime` for new work.

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/vercel-cli/SKILL.md

@@ -1,20 +0,0 @@
----
-name: vercel-cli
-description: "Compatibility alias skill. Deprecated: use vercel-delivery."
-metadata:
-  deprecated: true
-  replaced_by: vercel-delivery
-  removal_target: v0.6.0
----
-# Vercel Cli
-
-## Compatibility Alias
-
-This skill is deprecated and kept for backward compatibility.
-
-Use `vercel-delivery` as the canonical skill.
-
-## Migration
-
-1. Replace direct references to `vercel-cli` with `vercel-delivery`.
-2. Apply the full workflow from `vercel-delivery` for new work.

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/vercel-delivery/SKILL.md

@@ -1,41 +0,0 @@
----
-name: vercel-delivery
-description: "Canonical Vercel delivery skill covering deployments, domains, flags, and CLI-driven release operations."
-metadata:
-  deprecated: false
-  replaced_by: null
-  removal_target: null
----
-# Vercel Delivery
-
-## Purpose
-
-Run reliable Vercel release operations end-to-end: build/deploy lifecycle, environment promotion, domain management, feature-flag rollout, and CLI automation.
-
-## Use This For
-
-- Deployment pipelines and promotion policy
-- Preview/production environment controls
-- Custom domains, DNS/SSL readiness
-- Controlled rollouts with feature flags
-- Vercel CLI operational workflows
-
-## Decision Flow
-
-1. Lock release target and rollback checkpoint.
-2. Choose rollout strategy (direct, staged, flag-gated).
-3. Verify domain/certificate/environment integrity.
-4. Execute release with post-deploy checks.
-
-## Verification
-
-- Deployment health is green in target environment.
-- Domain resolution and TLS are valid.
-- Rollback command/path is tested and documented.
-
-## Related Skills
-
-- `vercel-platform`
-- `vercel-runtime`
-- `vercel-security`
-- `devops-engineer`

package/workflows/workflows/agent-environment-setup/platforms/copilot/skills/vercel-deployments/SKILL.md

@@ -1,20 +0,0 @@
----
-name: vercel-deployments
-description: "Compatibility alias skill. Deprecated: use vercel-delivery."
-metadata:
-  deprecated: true
-  replaced_by: vercel-delivery
-  removal_target: v0.6.0
----
-# Vercel Deployments
-
-## Compatibility Alias
-
-This skill is deprecated and kept for backward compatibility.
-
-Use `vercel-delivery` as the canonical skill.
-
-## Migration
-
-1. Replace direct references to `vercel-deployments` with `vercel-delivery`.
-2. Apply the full workflow from `vercel-delivery` for new work.