@devo-bmad-custom/agent-orchestration 1.0.0

package/src/.agents/skills/security-review/references/xss.md

@@ -0,0 +1,336 @@
+# Cross-Site Scripting (XSS) Prevention Reference
+
+## Overview
+
+XSS occurs when applications include untrusted data in web pages without proper validation or escaping. Attackers can execute scripts in victims' browsers to hijack sessions, deface websites, or redirect users to malicious sites.
+
+## XSS Types
+
+| Type | Description | Example |
+|------|-------------|---------|
+| **Reflected** | Malicious script from current HTTP request | URL parameter rendered in response |
+| **Stored** | Malicious script stored in target server | Comment field saved and displayed |
+| **DOM-based** | Vulnerability in client-side code | JavaScript reads URL and writes to DOM |
+
+## Output Encoding by Context
+
+### HTML Body Context
+
+```javascript
+// VULNERABLE: innerHTML with user data
+element.innerHTML = userInput;
+
+// SAFE: Use textContent
+element.textContent = userInput;
+
+// SAFE: Use createTextNode
+document.createTextNode(userInput);
+```
+
+**HTML Entity Encoding**
+| Character | Encoding |
+|-----------|----------|
+| `<` | `&lt;` |
+| `>` | `&gt;` |
+| `&` | `&amp;` |
+| `"` | `&quot;` |
+| `'` | `&#x27;` |
+
+### HTML Attribute Context
+
+```html
+<!-- VULNERABLE: Unquoted attribute -->
+<input value=${userInput}>
+
+<!-- VULNERABLE: Event handler with user data -->
+<button onclick="doSomething('${userInput}')">
+
+<!-- SAFE: Quoted attribute with encoding -->
+<input value="${htmlEncode(userInput)}">
+```
+
+**Rules:**
+- Always quote attribute values
+- Never place user input in event handlers (`onclick`, `onerror`, etc.)
+- Use `setAttribute()` which auto-encodes
+
+### JavaScript Context
+
+```javascript
+// VULNERABLE: eval with user input
+eval(userInput);
+
+// VULNERABLE: setTimeout with string
+setTimeout("doSomething('" + userInput + "')", 1000);
+
+// VULNERABLE: Function constructor
+new Function("return " + userInput)();
+
+// SAFE: JSON encoding for data
+const data = JSON.parse(jsonString);
+
+// SAFE: setTimeout with function
+setTimeout(() => doSomething(userInput), 1000);
+```
+
+**Safe JavaScript Locations** (with proper encoding):
+- Inside quoted string values only
+- Never directly in script blocks
+
+### URL Context
+
+```javascript
+// VULNERABLE: User input in href
+element.href = userInput;
+
+// VULNERABLE: javascript: URL scheme
+<a href="javascript:${userInput}">
+
+// SAFE: Validate URL scheme
+const url = new URL(userInput);
+if (url.protocol === 'https:' || url.protocol === 'http:') {
+    element.href = url.toString();
+}
+
+// SAFE: Encode URL parameters
+const encoded = encodeURIComponent(userInput);
+```
+
+### CSS Context
+
+```css
+/* VULNERABLE: User input in style */
+.element { background: url(${userInput}); }
+
+/* VULNERABLE: Expression in CSS */
+.element { behavior: expression(${userInput}); }
+```
+
+**Rules:**
+- Place user data only in CSS property values
+- Never allow user input in selectors or URLs
+
+---
+
+## Safe DOM Sinks
+
+**Use These:**
+```javascript
+elem.textContent = variable;
+elem.insertAdjacentText('beforeend', variable);
+elem.className = variable;  // for class names
+elem.setAttribute('data-value', variable);
+formField.value = variable;
+document.createTextNode(variable);
+```
+
+**Avoid These:**
+```javascript
+elem.innerHTML = variable;        // XSS
+elem.outerHTML = variable;        // XSS
+document.write(variable);         // XSS
+document.writeln(variable);       // XSS
+eval(variable);                   // Code execution
+setTimeout(variable);             // If string argument
+setInterval(variable);            // If string argument
+new Function(variable);           // Code execution
+elem.insertAdjacentHTML();        // XSS
+elem.onevent = variable;          // Event handler
+```
+
+---
+
+## Framework-Specific Considerations
+
+### React
+
+```jsx
+// SAFE: Auto-escaped by default
+<div>{userInput}</div>
+
+// VULNERABLE: dangerouslySetInnerHTML
+<div dangerouslySetInnerHTML={{__html: userInput}} />
+
+// SAFE: Sanitize before using dangerouslySetInnerHTML
+import DOMPurify from 'dompurify';
+<div dangerouslySetInnerHTML={{__html: DOMPurify.sanitize(userInput)}} />
+```
+
+### Angular
+
+```typescript
+// SAFE: Auto-escaped by default
+<div>{{ userInput }}</div>
+
+// VULNERABLE: bypassSecurityTrust*
+this.sanitizer.bypassSecurityTrustHtml(userInput);
+
+// Use bypassSecurityTrust* only with sanitized input
+```
+
+### Vue
+
+```html
+<!-- SAFE: Auto-escaped -->
+<div>{{ userInput }}</div>
+
+<!-- VULNERABLE: v-html directive -->
+<div v-html="userInput"></div>
+
+<!-- SAFE: Sanitize first -->
+<div v-html="sanitizedInput"></div>
+```
+
+### Django/Jinja2
+
+```django
+<!-- SAFE: Auto-escaped by default -->
+{{ user_input }}
+
+<!-- VULNERABLE: |safe filter -->
+{{ user_input|safe }}
+
+<!-- VULNERABLE: {% autoescape off %} -->
+{% autoescape off %}
+    {{ user_input }}
+{% endautoescape %}
+```
+
+---
+
+## HTML Sanitization
+
+When users must submit HTML (rich text editors), use a sanitization library.
+
+```javascript
+// Recommended: DOMPurify
+import DOMPurify from 'dompurify';
+
+const clean = DOMPurify.sanitize(dirty);
+
+// With configuration
+const clean = DOMPurify.sanitize(dirty, {
+    ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a'],
+    ALLOWED_ATTR: ['href']
+});
+```
+
+**Key Points:**
+- Keep sanitization libraries updated
+- Configure allowed tags/attributes based on needs
+- Sanitize on output, not just input
+
+---
+
+## Content Security Policy (CSP)
+
+CSP provides defense-in-depth but should not be the primary XSS defense.
+
+### Strict CSP (Recommended)
+
+```
+Content-Security-Policy:
+    default-src 'self';
+    script-src 'nonce-{RANDOM}' 'strict-dynamic';
+    object-src 'none';
+    base-uri 'none';
+```
+
+### Nonce-Based Approach
+
+```html
+<!-- Server generates unique nonce per request -->
+<script nonce="r4nd0m123">
+    // Allowed script
+</script>
+
+<script>
+    // Blocked - no nonce
+</script>
+```
+
+### Hash-Based Approach
+
+```
+Content-Security-Policy: script-src 'sha256-base64hash...'
+```
+
+---
+
+## DOM-based XSS Prevention
+
+### Dangerous Sources
+
+```javascript
+// Attacker-controllable sources
+location.hash
+location.search
+document.referrer
+window.name
+postMessage data
+```
+
+### Prevention
+
+```javascript
+// VULNERABLE: Direct use of source in sink
+element.innerHTML = location.hash.slice(1);
+
+// SAFE: Validate and encode
+const hash = location.hash.slice(1);
+if (/^[a-zA-Z0-9-]+$/.test(hash)) {
+    element.textContent = hash;
+}
+```
+
+---
+
+## Key Grep Patterns for Detection
+
+```bash
+# Dangerous DOM sinks
+grep -rn "innerHTML\|outerHTML\|document\.write" --include="*.js" --include="*.jsx"
+grep -rn "dangerouslySetInnerHTML" --include="*.jsx" --include="*.tsx"
+grep -rn "v-html" --include="*.vue"
+grep -rn "\|safe\|autoescape off" --include="*.html" --include="*.jinja"
+
+# Dangerous JavaScript
+grep -rn "eval(\|Function(\|setTimeout.*string\|setInterval.*string" --include="*.js"
+
+# Framework bypasses
+grep -rn "bypassSecurityTrust" --include="*.ts"
+grep -rn "mark_safe\|SafeString" --include="*.py"
+```
+
+---
+
+## Testing Payloads
+
+**Basic:**
+```
+<script>alert('XSS')</script>
+<img src=x onerror=alert('XSS')>
+<svg onload=alert('XSS')>
+```
+
+**Attribute Escape:**
+```
+" onmouseover="alert('XSS')
+' onclick='alert("XSS")
+```
+
+**JavaScript Context:**
+```
+';alert('XSS')//
+\';alert(\'XSS\')//
+</script><script>alert('XSS')</script>
+```
+
+---
+
+## References
+
+- [OWASP XSS Prevention Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html)
+- [OWASP DOM-based XSS Prevention](https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html)
+- [OWASP CSP Cheat Sheet](https://cheatsheetseries.owasp.org/cheatsheets/Content_Security_Policy_Cheat_Sheet.html)
+- [CWE-79: Cross-site Scripting](https://cwe.mitre.org/data/definitions/79.html)

package/src/.agents/skills/subagent-driven-development/SKILL.md

@@ -0,0 +1,275 @@
+---
+name: subagent-driven-development
+description: Use when executing implementation plans with independent tasks in the current session
+---
+
+# Subagent-Driven Development
+
+Execute plan by dispatching fresh subagent per task, with two-stage review after each: spec compliance review first, then code quality review.
+
+**Core principle:** Fresh subagent per task + two-stage review (spec then quality) = high quality, fast iteration
+
+## When to Use
+
+```dot
+digraph when_to_use {
+    "Have implementation plan?" [shape=diamond];
+    "Tasks mostly independent?" [shape=diamond];
+    "Stay in this session?" [shape=diamond];
+    "subagent-driven-development" [shape=box];
+    "executing-plans" [shape=box];
+    "Manual execution or brainstorm first" [shape=box];
+
+    "Have implementation plan?" -> "Tasks mostly independent?" [label="yes"];
+    "Have implementation plan?" -> "Manual execution or brainstorm first" [label="no"];
+    "Tasks mostly independent?" -> "Stay in this session?" [label="yes"];
+    "Tasks mostly independent?" -> "Manual execution or brainstorm first" [label="no - tightly coupled"];
+    "Stay in this session?" -> "subagent-driven-development" [label="yes"];
+    "Stay in this session?" -> "executing-plans" [label="no - parallel session"];
+}
+```
+
+**vs. Executing Plans (parallel session):**
+- Same session (no context switch)
+- Fresh subagent per task (no context pollution)
+- Two-stage review after each task: spec compliance first, then code quality
+- Faster iteration (no human-in-loop between tasks)
+
+## The Process
+
+```dot
+digraph process {
+    rankdir=TB;
+
+    subgraph cluster_per_task {
+        label="Per Task";
+        "Dispatch implementer subagent (./implementer-prompt.md)" [shape=box];
+        "Implementer subagent asks questions?" [shape=diamond];
+        "Answer questions, provide context" [shape=box];
+        "Implementer subagent implements, tests, commits, self-reviews" [shape=box];
+        "Dispatch spec reviewer subagent (./spec-reviewer-prompt.md)" [shape=box];
+        "Spec reviewer subagent confirms code matches spec?" [shape=diamond];
+        "Implementer subagent fixes spec gaps" [shape=box];
+        "Dispatch code quality reviewer subagent (./code-quality-reviewer-prompt.md)" [shape=box];
+        "Code quality reviewer subagent approves?" [shape=diamond];
+        "Implementer subagent fixes quality issues" [shape=box];
+        "Mark task complete in TodoWrite" [shape=box];
+    }
+
+    "Read plan, extract all tasks with full text, note context, create TodoWrite" [shape=box];
+    "More tasks remain?" [shape=diamond];
+    "Dispatch final code reviewer subagent for entire implementation" [shape=box];
+    "Use superpowers:finishing-a-development-branch" [shape=box style=filled fillcolor=lightgreen];
+
+    "Read plan, extract all tasks with full text, note context, create TodoWrite" -> "Dispatch implementer subagent (./implementer-prompt.md)";
+    "Dispatch implementer subagent (./implementer-prompt.md)" -> "Implementer subagent asks questions?";
+    "Implementer subagent asks questions?" -> "Answer questions, provide context" [label="yes"];
+    "Answer questions, provide context" -> "Dispatch implementer subagent (./implementer-prompt.md)";
+    "Implementer subagent asks questions?" -> "Implementer subagent implements, tests, commits, self-reviews" [label="no"];
+    "Implementer subagent implements, tests, commits, self-reviews" -> "Dispatch spec reviewer subagent (./spec-reviewer-prompt.md)";
+    "Dispatch spec reviewer subagent (./spec-reviewer-prompt.md)" -> "Spec reviewer subagent confirms code matches spec?";
+    "Spec reviewer subagent confirms code matches spec?" -> "Implementer subagent fixes spec gaps" [label="no"];
+    "Implementer subagent fixes spec gaps" -> "Dispatch spec reviewer subagent (./spec-reviewer-prompt.md)" [label="re-review"];
+    "Spec reviewer subagent confirms code matches spec?" -> "Dispatch code quality reviewer subagent (./code-quality-reviewer-prompt.md)" [label="yes"];
+    "Dispatch code quality reviewer subagent (./code-quality-reviewer-prompt.md)" -> "Code quality reviewer subagent approves?";
+    "Code quality reviewer subagent approves?" -> "Implementer subagent fixes quality issues" [label="no"];
+    "Implementer subagent fixes quality issues" -> "Dispatch code quality reviewer subagent (./code-quality-reviewer-prompt.md)" [label="re-review"];
+    "Code quality reviewer subagent approves?" -> "Mark task complete in TodoWrite" [label="yes"];
+    "Mark task complete in TodoWrite" -> "More tasks remain?";
+    "More tasks remain?" -> "Dispatch implementer subagent (./implementer-prompt.md)" [label="yes"];
+    "More tasks remain?" -> "Dispatch final code reviewer subagent for entire implementation" [label="no"];
+    "Dispatch final code reviewer subagent for entire implementation" -> "Use superpowers:finishing-a-development-branch";
+}
+```
+
+## Model Selection
+
+Use the least powerful model that can handle each role to conserve cost and increase speed.
+
+**Mechanical implementation tasks** (isolated functions, clear specs, 1-2 files): use a fast, cheap model. Most implementation tasks are mechanical when the plan is well-specified.
+
+**Integration and judgment tasks** (multi-file coordination, pattern matching, debugging): use a standard model.
+
+**Architecture, design, and review tasks**: use the most capable available model.
+
+**Task complexity signals:**
+- Touches 1-2 files with a complete spec → cheap model
+- Touches multiple files with integration concerns → standard model
+- Requires design judgment or broad codebase understanding → most capable model
+
+## Handling Implementer Status
+
+Implementer subagents report one of four statuses. Handle each appropriately:
+
+**DONE:** Proceed to spec compliance review.
+
+**DONE_WITH_CONCERNS:** The implementer completed the work but flagged doubts. Read the concerns before proceeding. If the concerns are about correctness or scope, address them before review. If they're observations (e.g., "this file is getting large"), note them and proceed to review.
+
+**NEEDS_CONTEXT:** The implementer needs information that wasn't provided. Provide the missing context and re-dispatch.
+
+**BLOCKED:** The implementer cannot complete the task. Assess the blocker:
+1. If it's a context problem, provide more context and re-dispatch with the same model
+2. If the task requires more reasoning, re-dispatch with a more capable model
+3. If the task is too large, break it into smaller pieces
+4. If the plan itself is wrong, escalate to the human
+
+**Never** ignore an escalation or force the same model to retry without changes. If the implementer said it's stuck, something needs to change.
+
+## Prompt Templates
+
+- `./implementer-prompt.md` - Dispatch implementer subagent
+- `./spec-reviewer-prompt.md` - Dispatch spec compliance reviewer subagent
+- `./code-quality-reviewer-prompt.md` - Dispatch code quality reviewer subagent
+
+## Example Workflow
+
+```
+You: I'm using Subagent-Driven Development to execute this plan.
+
+[Read plan file once: docs/superpowers/plans/feature-plan.md]
+[Extract all 5 tasks with full text and context]
+[Create TodoWrite with all tasks]
+
+Task 1: Hook installation script
+
+[Get Task 1 text and context (already extracted)]
+[Dispatch implementation subagent with full task text + context]
+
+Implementer: "Before I begin - should the hook be installed at user or system level?"
+
+You: "User level (~/.config/superpowers/hooks/)"
+
+Implementer: "Got it. Implementing now..."
+[Later] Implementer:
+  - Implemented install-hook command
+  - Added tests, 5/5 passing
+  - Self-review: Found I missed --force flag, added it
+  - Committed
+
+[Dispatch spec compliance reviewer]
+Spec reviewer: ✅ Spec compliant - all requirements met, nothing extra
+
+[Get git SHAs, dispatch code quality reviewer]
+Code reviewer: Strengths: Good test coverage, clean. Issues: None. Approved.
+
+[Mark Task 1 complete]
+
+Task 2: Recovery modes
+
+[Get Task 2 text and context (already extracted)]
+[Dispatch implementation subagent with full task text + context]
+
+Implementer: [No questions, proceeds]
+Implementer:
+  - Added verify/repair modes
+  - 8/8 tests passing
+  - Self-review: All good
+  - Committed
+
+[Dispatch spec compliance reviewer]
+Spec reviewer: ❌ Issues:
+  - Missing: Progress reporting (spec says "report every 100 items")
+  - Extra: Added --json flag (not requested)
+
+[Implementer fixes issues]
+Implementer: Removed --json flag, added progress reporting
+
+[Spec reviewer reviews again]
+Spec reviewer: ✅ Spec compliant now
+
+[Dispatch code quality reviewer]
+Code reviewer: Strengths: Solid. Issues (Important): Magic number (100)
+
+[Implementer fixes]
+Implementer: Extracted PROGRESS_INTERVAL constant
+
+[Code reviewer reviews again]
+Code reviewer: ✅ Approved
+
+[Mark Task 2 complete]
+
+...
+
+[After all tasks]
+[Dispatch final code-reviewer]
+Final reviewer: All requirements met, ready to merge
+
+Done!
+```
+
+## Advantages
+
+**vs. Manual execution:**
+- Subagents follow TDD naturally
+- Fresh context per task (no confusion)
+- Parallel-safe (subagents don't interfere)
+- Subagent can ask questions (before AND during work)
+
+**vs. Executing Plans:**
+- Same session (no handoff)
+- Continuous progress (no waiting)
+- Review checkpoints automatic
+
+**Efficiency gains:**
+- No file reading overhead (controller provides full text)
+- Controller curates exactly what context is needed
+- Subagent gets complete information upfront
+- Questions surfaced before work begins (not after)
+
+**Quality gates:**
+- Self-review catches issues before handoff
+- Two-stage review: spec compliance, then code quality
+- Review loops ensure fixes actually work
+- Spec compliance prevents over/under-building
+- Code quality ensures implementation is well-built
+
+**Cost:**
+- More subagent invocations (implementer + 2 reviewers per task)
+- Controller does more prep work (extracting all tasks upfront)
+- Review loops add iterations
+- But catches issues early (cheaper than debugging later)
+
+## Red Flags
+
+**Never:**
+- Start implementation on main/master branch without explicit user consent
+- Skip reviews (spec compliance OR code quality)
+- Proceed with unfixed issues
+- Dispatch multiple implementation subagents in parallel (conflicts)
+- Make subagent read plan file (provide full text instead)
+- Skip scene-setting context (subagent needs to understand where task fits)
+- Ignore subagent questions (answer before letting them proceed)
+- Accept "close enough" on spec compliance (spec reviewer found issues = not done)
+- Skip review loops (reviewer found issues = implementer fixes = review again)
+- Let implementer self-review replace actual review (both are needed)
+- **Start code quality review before spec compliance is ✅** (wrong order)
+- Move to next task while either review has open issues
+
+**If subagent asks questions:**
+- Answer clearly and completely
+- Provide additional context if needed
+- Don't rush them into implementation
+
+**If reviewer finds issues:**
+- Implementer (same subagent) fixes them
+- Reviewer reviews again
+- Repeat until approved
+- Don't skip the re-review
+
+**If subagent fails task:**
+- Dispatch fix subagent with specific instructions
+- Don't try to fix manually (context pollution)
+
+## Integration
+
+**Required workflow skills:**
+- **superpowers:using-git-worktrees** - REQUIRED: Set up isolated workspace before starting
+- **superpowers:writing-plans** - Creates the plan this skill executes
+- **superpowers:requesting-code-review** - Code review template for reviewer subagents
+- **superpowers:finishing-a-development-branch** - Complete development after all tasks
+
+**Subagents should use:**
+- **superpowers:test-driven-development** - Subagents follow TDD for each task
+
+**Alternative workflow:**
+- **superpowers:executing-plans** - Use for parallel session instead of same-session execution

package/src/.agents/skills/subagent-driven-development/code-quality-reviewer-prompt.md

@@ -0,0 +1,26 @@
+# Code Quality Reviewer Prompt Template
+
+Use this template when dispatching a code quality reviewer subagent.
+
+**Purpose:** Verify implementation is well-built (clean, tested, maintainable)
+
+**Only dispatch after spec compliance review passes.**
+
+```
+Task tool (superpowers:code-reviewer):
+  Use template at requesting-code-review/code-reviewer.md
+
+  WHAT_WAS_IMPLEMENTED: [from implementer's report]
+  PLAN_OR_REQUIREMENTS: Task N from [plan-file]
+  BASE_SHA: [commit before task]
+  HEAD_SHA: [current commit]
+  DESCRIPTION: [task summary]
+```
+
+**In addition to standard code quality concerns, the reviewer should check:**
+- Does each file have one clear responsibility with a well-defined interface?
+- Are units decomposed so they can be understood and tested independently?
+- Is the implementation following the file structure from the plan?
+- Did this implementation create new files that are already large, or significantly grow existing files? (Don't flag pre-existing file sizes — focus on what this change contributed.)
+
+**Code reviewer returns:** Strengths, Issues (Critical/Important/Minor), Assessment