@dollhousemcp/mcp-server 1.3.0

package/data/skills/data-analysis.md

@@ -0,0 +1,160 @@
+---
+name: "Data Analysis"
+description: "Statistical analysis, visualization, and insights extraction from datasets"
+type: "skill"
+version: "1.0.0"
+author: "DollhouseMCP"
+created: "2025-07-23"
+category: "analytics"
+tags: ["data", "statistics", "visualization", "insights", "analytics"]
+proficiency_levels:
+  beginner: "Basic statistics and simple charts"
+  intermediate: "Correlation analysis and trend detection"
+  advanced: "Predictive modeling and complex visualizations"
+parameters:
+  analysis_type:
+    type: "array"
+    description: "Types of analysis to perform"
+    default: ["descriptive", "diagnostic"]
+    enum: ["descriptive", "diagnostic", "predictive", "prescriptive"]
+  visualization_format:
+    type: "string"
+    description: "Preferred visualization format"
+    default: "auto"
+    enum: ["auto", "charts", "tables", "narrative", "dashboard"]
+  confidence_level:
+    type: "number"
+    description: "Statistical confidence level"
+    default: 0.95
+    min: 0.90
+    max: 0.99
+  handle_missing_data:
+    type: "string"
+    description: "How to handle missing values"
+    default: "interpolate"
+    enum: ["ignore", "interpolate", "drop", "flag"]
+---
+
+# Data Analysis Skill
+
+This skill provides comprehensive data analysis capabilities for extracting insights, identifying patterns, and making data-driven recommendations.
+
+## Core Capabilities
+
+### 1. Descriptive Analysis
+- **Central Tendency**: Mean, median, mode
+- **Dispersion**: Standard deviation, variance, range
+- **Distribution**: Skewness, kurtosis, percentiles
+- **Frequency**: Histograms, frequency tables
+
+### 2. Diagnostic Analysis
+- **Correlation Analysis**: Pearson, Spearman, Kendall
+- **Regression**: Linear, logistic, polynomial
+- **Time Series**: Trends, seasonality, decomposition
+- **Anomaly Detection**: Outliers, unusual patterns
+
+### 3. Predictive Analysis
+- **Forecasting**: Time series prediction
+- **Classification**: Category prediction
+- **Clustering**: Group identification
+- **Probability**: Risk assessment
+
+### 4. Visualization
+- **Charts**: Line, bar, scatter, pie, heatmap
+- **Distributions**: Histograms, box plots, violin plots
+- **Relationships**: Scatter plots, correlation matrices
+- **Comparisons**: Grouped bars, stacked charts
+
+## Analysis Process
+
+### Step 1: Data Profiling
+```
+Dataset Overview:
+- Rows: 10,432
+- Columns: 15
+- Missing values: 2.3%
+- Data types: 5 numeric, 8 categorical, 2 datetime
+```
+
+### Step 2: Quality Assessment
+- Completeness check
+- Consistency validation
+- Outlier identification
+- Data type verification
+
+### Step 3: Analysis Execution
+- Apply statistical methods
+- Generate visualizations
+- Extract key findings
+- Identify patterns
+
+### Step 4: Insight Generation
+- Summarize findings
+- Highlight anomalies
+- Provide recommendations
+- Suggest next steps
+
+## Output Formats
+
+### 1. Executive Summary
+```
+Key Findings:
+• Sales increased 23% year-over-year
+• Customer retention improved by 15%
+• Regional performance varies significantly
+• Seasonal patterns strongly influence demand
+```
+
+### 2. Detailed Report
+```
+Statistical Analysis Results:
+
+Correlation Matrix:
+         Sales  Marketing  Satisfaction
+Sales     1.00      0.82         0.65
+Marketing 0.82      1.00         0.54
+Satisfaction 0.65   0.54         1.00
+
+Regression Analysis:
+Sales = 1,234 + 2.5×Marketing + 156×Satisfaction
+R² = 0.78, p < 0.001
+```
+
+### 3. Visual Dashboard
+```
+[Chart: Monthly Sales Trend]
+📊 ────────────────────
+   │     ╱╲    ╱╲
+   │   ╱╲  ╲  ╱  ╲
+   │ ╱╲    ╲╱    ╲
+   └─────────────────
+   J F M A M J J A S
+```
+
+## Special Features
+
+### 1. Natural Language Insights
+Converts statistical findings into plain English:
+- "Sales peak in December (43% above average)"
+- "Customer age strongly correlates with purchase frequency (r=0.72)"
+- "Northern region underperforms by 18% compared to others"
+
+### 2. Automated Recommendations
+Based on analysis results:
+- "Consider increasing marketing spend in Q3"
+- "Focus on customer retention in 25-34 age group"
+- "Investigate northern region performance issues"
+
+### 3. Interactive Analysis
+- Drill-down capabilities
+- What-if scenarios
+- Sensitivity analysis
+- Custom segmentation
+
+## Integration Notes
+
+Works well with:
+- Business Consultant persona for strategic insights
+- Technical Analyst for deep-dive investigations
+- Report templates for standardized output
+- Dashboard agents for real-time monitoring

package/data/skills/penetration-testing.md

@@ -0,0 +1,374 @@
+---
+name: "Penetration Testing"
+description: "Systematic security testing methodology for identifying vulnerabilities through ethical hacking"
+type: "skill"
+version: "1.0.0"
+author: "DollhouseMCP"
+created: "2025-07-23"
+category: "security"
+tags: ["penetration-testing", "ethical-hacking", "vulnerability-assessment", "security", "testing"]
+proficiency_levels:
+  beginner: "Basic vulnerability scanning and tool usage"
+  intermediate: "Manual testing techniques and exploit development"
+  advanced: "Advanced persistent threats and custom payload creation"
+parameters:
+  test_scope:
+    type: "array"
+    description: "Areas to test"
+    default: ["web_application", "network", "wireless", "social_engineering"]
+  methodology:
+    type: "string"
+    description: "Testing methodology to follow"
+    default: "OWASP"
+    enum: ["OWASP", "NIST", "PTES", "OSsTMM", "OWASP-WSTG"]
+  test_depth:
+    type: "string"
+    description: "Depth of testing"
+    default: "comprehensive"
+    enum: ["surface", "standard", "comprehensive", "red_team"]
+  stealth_level:
+    type: "string"
+    description: "How stealthy to be"
+    default: "normal"
+    enum: ["aggressive", "normal", "stealth", "passive"]
+---
+
+# Penetration Testing Skill
+
+This skill provides systematic penetration testing capabilities using industry-standard methodologies to identify security vulnerabilities through controlled, ethical attacks.
+
+## Core Capabilities
+
+### 1. Reconnaissance & Information Gathering
+- **Passive Reconnaissance**: OSINT, DNS enumeration, search engine discovery
+- **Active Reconnaissance**: Port scanning, service enumeration, banner grabbing
+- **Social Engineering**: Phishing simulations, pretexting, physical security
+- **Network Mapping**: Topology discovery, trust relationships, attack paths
+
+### 2. Vulnerability Assessment
+- **Automated Scanning**: Nessus, OpenVAS, Qualys integration
+- **Manual Testing**: Custom payloads, logic flaws, business logic bypasses
+- **Configuration Review**: Hardening standards, security baselines
+- **Compliance Validation**: PCI-DSS, SOX, HIPAA requirements
+
+### 3. Exploitation Techniques
+- **Web Application**: OWASP Top 10, injection attacks, broken authentication
+- **Network Services**: Buffer overflows, privilege escalation, lateral movement
+- **Wireless Security**: WPA/WEP cracking, rogue access points, evil twins
+- **Cloud Security**: Misconfigurations, IAM weaknesses, container escapes
+
+### 4. Post-Exploitation Activities
+- **Persistence**: Backdoors, scheduled tasks, registry modifications
+- **Privilege Escalation**: Local/domain admin compromise
+- **Data Exfiltration**: Sensitive data identification and extraction simulation
+- **Lateral Movement**: Pivot techniques, credential harvesting
+
+## Testing Methodologies
+
+### OWASP Web Security Testing Guide (WSTG)
+```
+Phase 1: Information Gathering
+├── Conduct Search Engine Discovery (WSTG-INFO-01)
+├── Fingerprint Web Server (WSTG-INFO-02)
+├── Review Webserver Metafiles (WSTG-INFO-03)
+└── Enumerate Applications (WSTG-INFO-04)
+
+Phase 2: Configuration and Deployment
+├── Test Network Infrastructure (WSTG-CONF-01)
+├── Test Application Platform (WSTG-CONF-02)
+├── Test File Extensions Handling (WSTG-CONF-03)
+└── Review Old Backup Files (WSTG-CONF-04)
+
+Phase 3: Identity Management Testing
+├── Test Role Definitions (WSTG-IDNT-01)
+├── Test User Registration Process (WSTG-IDNT-02)
+├── Test Account Provisioning (WSTG-IDNT-03)
+└── Test Account Enumeration (WSTG-IDNT-05)
+```
+
+### PTES (Penetration Testing Execution Standard)
+```
+1. Pre-engagement Interactions
+   - Scope definition
+   - Rules of engagement
+   - Legal considerations
+
+2. Intelligence Gathering
+   - Active/passive reconnaissance
+   - Corporate information gathering
+   - Individual information gathering
+
+3. Threat Modeling
+   - Business asset analysis
+   - Threat agent identification
+   - Attack vector analysis
+
+4. Vulnerability Analysis
+   - Vulnerability research
+   - Vulnerability validation
+   - Attack planning
+
+5. Exploitation
+   - Precision attacks
+   - Customized attacks
+   - Persistence mechanisms
+
+6. Post Exploitation
+   - Infrastructure analysis
+   - Pillaging
+   - Network traversal
+   - Cleanup
+
+7. Reporting
+   - Executive summary
+   - Technical findings
+   - Risk ratings
+   - Remediation roadmap
+```
+
+## Testing Phases
+
+### Phase 1: Planning & Reconnaissance
+```
+Objectives:
+• Define scope and rules of engagement
+• Gather public information about target
+• Identify potential attack vectors
+• Map external network presence
+
+Tools & Techniques:
+• Nmap for network discovery
+• Recon-ng for OSINT gathering
+• theHarvester for email enumeration
+• Shodan for exposed services
+• Social media reconnaissance
+
+Deliverables:
+• Test plan and scope document
+• Network topology diagram
+• External attack surface map
+• OSINT intelligence report
+```
+
+### Phase 2: Scanning & Enumeration
+```
+Objectives:
+• Identify live systems and services
+• Enumerate software versions
+• Discover potential vulnerabilities
+• Map trust relationships
+
+Tools & Techniques:
+• Nessus/OpenVAS vulnerability scanning
+• Nikto web server scanning
+• Enum4linux SMB enumeration
+• SNMP walking and enumeration
+• DNS zone transfers
+
+Deliverables:
+• Vulnerability assessment report
+• Service enumeration results
+• Potential attack vectors list
+• Risk prioritization matrix
+```
+
+### Phase 3: Exploitation
+```
+Objectives:
+• Validate identified vulnerabilities
+• Gain initial system access
+• Demonstrate business impact
+• Test defense mechanisms
+
+Tools & Techniques:
+• Metasploit exploitation framework
+• Custom exploit development
+• Password attacks (Hydra, Hashcat)
+• Social engineering toolkit
+• Physical security testing
+
+Deliverables:
+• Proof-of-concept exploits
+• Screenshots of compromised systems
+• Extracted sensitive data samples
+• Attack timeline documentation
+```
+
+### Phase 4: Post-Exploitation
+```
+Objectives:
+• Maintain persistent access
+• Escalate privileges
+• Move laterally through network
+• Assess data exposure risk
+
+Tools & Techniques:
+• Privilege escalation exploits
+• Credential dumping (Mimikatz)
+• Network pivoting (ProxyChains)
+• PowerShell Empire/Cobalt Strike
+• Data mining and classification
+
+Deliverables:
+• Network compromise diagram
+• Sensitive data inventory
+• Privilege escalation paths
+• Persistence mechanism documentation
+```
+
+## Specialized Testing Areas
+
+### Web Application Testing
+```
+Authentication Testing:
+□ Username enumeration
+□ Brute force protection
+□ Session management
+□ Password policy enforcement
+□ Multi-factor authentication bypass
+
+Authorization Testing:
+□ Path traversal attacks
+□ Privilege escalation
+□ Insecure direct object references
+□ Missing function level access control
+
+Input Validation Testing:
+□ SQL injection (all types)
+□ Cross-site scripting (XSS)
+□ Command injection
+□ LDAP injection
+□ XML/XXE attacks
+
+Session Management:
+□ Session token analysis
+□ Session fixation
+□ Cross-site request forgery
+□ Session timeout validation
+```
+
+### Network Infrastructure Testing
+```
+Network Reconnaissance:
+• Port scanning and service enumeration
+• SNMP community string testing
+• Network protocol analysis
+• Wireless network assessment
+
+Service Testing:
+• SSH/Telnet brute forcing
+• SMB share enumeration
+• FTP anonymous access
+• Database service testing
+
+Network Segmentation:
+• VLAN hopping attempts
+• Firewall rule validation
+• Network access control bypass
+• DMZ security assessment
+```
+
+### Wireless Security Testing
+```
+Wireless Reconnaissance:
+• Access point discovery
+• Encryption type identification
+• Client device enumeration
+• Hidden SSID detection
+
+Attack Techniques:
+• WEP key cracking
+• WPA/WPA2 dictionary attacks
+• WPS PIN attacks
+• Evil twin access points
+• Wireless packet injection
+
+Assessment Areas:
+• Guest network isolation
+• Enterprise authentication
+• Rogue access point detection
+• Wireless intrusion prevention
+```
+
+## Report Generation
+
+### Executive Summary Template
+```
+EXECUTIVE SUMMARY
+
+Overall Risk Rating: [HIGH/MEDIUM/LOW]
+Critical Findings: X
+High Risk Findings: Y
+Medium Risk Findings: Z
+
+BUSINESS IMPACT:
+• Potential for complete network compromise
+• Risk of sensitive data exposure
+• Compliance violation concerns
+• Estimated remediation cost: $X
+
+TOP 3 RECOMMENDATIONS:
+1. [Most critical remediation]
+2. [Second priority fix]
+3. [Third priority improvement]
+
+TIMELINE FOR REMEDIATION:
+• Critical issues: 7 days
+• High risk issues: 30 days
+• Medium risk issues: 90 days
+```
+
+### Technical Finding Format
+```
+FINDING: [Vulnerability Name]
+SEVERITY: [Critical/High/Medium/Low]
+CVSS Score: X.X
+CWE ID: CWE-XXX
+
+DESCRIPTION:
+[Technical description of the vulnerability]
+
+IMPACT:
+[What an attacker could accomplish]
+
+PROOF OF CONCEPT:
+[Steps to reproduce or exploit code]
+
+AFFECTED SYSTEMS:
+• System 1 (IP: x.x.x.x)
+• System 2 (IP: x.x.x.x)
+
+REMEDIATION:
+[Specific steps to fix the issue]
+
+REFERENCES:
+• CVE-XXXX-XXXX
+• https://example.com/advisory
+```
+
+## Integration Notes
+
+Works exceptionally well with:
+- **Security Analyst Persona**: Strategic security guidance
+- **Code Review Skill**: Static analysis correlation  
+- **Vulnerability Assessment templates**: Structured reporting
+- **Risk Assessment templates**: Business impact analysis
+- **Incident Response procedures**: Breach simulation
+
+## Compliance Considerations
+
+Testing approach adapts to:
+- **PCI-DSS**: Payment card industry requirements
+- **HIPAA**: Healthcare data protection standards
+- **SOX**: Financial reporting security controls
+- **GDPR**: Data protection impact assessments
+- **ISO 27001**: Information security management
+
+## Ethical Guidelines
+
+All testing follows strict ethical boundaries:
+- Written authorization required before testing
+- Scope strictly limited to agreed boundaries
+- No unnecessary system damage or disruption
+- Confidential handling of discovered vulnerabilities
+- Responsible disclosure of findings

package/data/skills/research.md

@@ -0,0 +1,181 @@
+---
+name: "Research"
+description: "Comprehensive research methodology for gathering and synthesizing information"
+type: "skill"
+version: "1.0.0"
+author: "DollhouseMCP"
+created: "2025-07-23"
+category: "knowledge"
+tags: ["research", "analysis", "synthesis", "investigation", "fact-checking"]
+proficiency_levels:
+  beginner: "Basic fact-finding and summarization"
+  intermediate: "Multi-source synthesis and validation"
+  advanced: "Academic-level research with citations"
+parameters:
+  research_depth:
+    type: "string"
+    description: "How deep to research"
+    default: "standard"
+    enum: ["quick", "standard", "comprehensive", "exhaustive"]
+  source_types:
+    type: "array"
+    description: "Types of sources to consider"
+    default: ["academic", "industry", "news", "expert"]
+  citation_style:
+    type: "string"
+    description: "Citation format to use"
+    default: "none"
+    enum: ["none", "APA", "MLA", "Chicago", "Harvard"]
+  fact_checking:
+    type: "boolean"
+    description: "Verify claims and cross-reference"
+    default: true
+---
+
+# Research Skill
+
+This skill provides systematic research capabilities for investigating topics, validating information, and synthesizing knowledge from multiple sources.
+
+## Core Capabilities
+
+### 1. Information Gathering
+- **Source Identification**: Finding relevant, credible sources
+- **Data Collection**: Systematic information extraction
+- **Cross-referencing**: Validating across multiple sources
+- **Bias Detection**: Identifying potential biases
+
+### 2. Analysis Methods
+- **Comparative Analysis**: Contrasting different viewpoints
+- **Trend Identification**: Spotting patterns over time
+- **Gap Analysis**: Finding missing information
+- **Critical Evaluation**: Assessing source credibility
+
+### 3. Synthesis Techniques
+- **Thematic Organization**: Grouping by themes
+- **Chronological Ordering**: Timeline-based structure
+- **Hierarchical Structure**: Main points and sub-points
+- **Narrative Integration**: Coherent storytelling
+
+### 4. Validation Process
+- **Fact-checking**: Verifying claims
+- **Source Verification**: Confirming authenticity
+- **Date Validation**: Ensuring currency
+- **Expert Validation**: Cross-checking with authorities
+
+## Research Process
+
+### Phase 1: Planning
+```
+Research Plan:
+Topic: [Subject]
+Scope: [Boundaries]
+Questions: [Key questions to answer]
+Timeline: [Research schedule]
+```
+
+### Phase 2: Discovery
+- Initial exploration
+- Source identification
+- Preliminary reading
+- Keyword refinement
+
+### Phase 3: Deep Dive
+- Detailed investigation
+- Note-taking and organization
+- Pattern identification
+- Gap filling
+
+### Phase 4: Synthesis
+- Information integration
+- Conclusion drawing
+- Recommendation formulation
+- Report creation
+
+## Output Formats
+
+### 1. Executive Brief
+```
+Topic: AI Ethics in Healthcare
+
+Key Findings:
+• 78% of healthcare AI applications lack ethical frameworks
+• Patient privacy concerns top priority (mentioned in 92% of studies)
+• Regulatory gaps exist in 15 identified areas
+
+Recommendations:
+1. Implement ethical review boards
+2. Develop privacy-first architectures
+3. Create regulatory roadmap
+```
+
+### 2. Detailed Research Report
+```
+I. Introduction
+   A. Background
+   B. Research objectives
+   C. Methodology
+
+II. Literature Review
+   A. Current state of knowledge
+   B. Key debates
+   C. Research gaps
+
+III. Findings
+   A. Primary discoveries
+   B. Supporting evidence
+   C. Contradictory data
+
+IV. Analysis
+   A. Interpretation
+   B. Implications
+   C. Limitations
+
+V. Conclusions
+   A. Summary
+   B. Recommendations
+   C. Future research
+```
+
+### 3. Annotated Bibliography
+```
+Smith, J. (2024). "AI Ethics Framework." Journal of Tech Ethics, 15(3), 45-62.
+   - Proposes comprehensive framework
+   - Strong empirical foundation
+   - Limited to US context
+
+Chen, L. (2024). "Global AI Governance." AI Policy Review, 8(2), 12-28.
+   - International perspective
+   - Policy-focused
+   - Recent data (2023-2024)
+```
+
+## Special Features
+
+### 1. Research Strategies
+- **Systematic Review**: Comprehensive literature analysis
+- **Meta-Analysis**: Statistical combination of studies
+- **Case Study**: Deep dive into specific instances
+- **Survey Research**: Primary data collection
+
+### 2. Quality Indicators
+```
+Source Quality: ⭐⭐⭐⭐⭐
+- Peer-reviewed: ✓
+- Recent (< 2 years): ✓
+- High citation count: ✓
+- Reputable publisher: ✓
+```
+
+### 3. Research Tools
+- Boolean search optimization
+- Citation tracking
+- Duplicate detection
+- Bias assessment
+
+## Integration Notes
+
+Works well with:
+- Technical Analyst for specialized research
+- Academic Writer for scholarly output
+- Data Analysis skill for quantitative research
+- Report templates for standardized formatting