@elizaos/skills 2.0.0-alpha.3

package/skills/sharp-edges/skills/sharp-edges/references/lang-ruby.md

@@ -0,0 +1,273 @@
+# Ruby Sharp Edges
+
+## Dynamic Code Execution
+
+```ruby
+# DANGEROUS: eval executes arbitrary code
+eval(user_input)
+
+# DANGEROUS: send calls arbitrary method
+object.send(user_input, *args)
+object.public_send(user_input)  # Only public, still dangerous
+
+# DANGEROUS: constantize gets arbitrary class
+user_input.constantize  # Rails
+Object.const_get(user_input)
+
+# DANGEROUS: instance_variable_get/set
+obj.instance_variable_set("@#{user_input}", value)
+```
+
+**Real Vulnerabilities**:
+- CVE-2013-0156: Rails XML parameter parsing led to code execution
+- Countless Rails apps vulnerable to controller#action injection
+
+**Fix**: Whitelist allowed values:
+```ruby
+ALLOWED_METHODS = %w[create update delete].freeze
+raise unless ALLOWED_METHODS.include?(user_input)
+object.send(user_input)
+```
+
+## YAML.load RCE
+
+```ruby
+# DANGEROUS: Like pickle, instantiates arbitrary objects
+YAML.load(user_input)
+
+# Attacker payload:
+# --- !ruby/object:Gem::Installer
+# i: x
+# --- !ruby/object:Gem::SpecFetcher
+# i: y
+# --- !ruby/object:Gem::Requirement
+# requirements:
+#   !ruby/object:Gem::Package::TarReader
+#   io: &1 !ruby/object:Net::BufferedIO
+#     ...
+
+# Chains through multiple classes to achieve RCE
+```
+
+**Fix**: Use `YAML.safe_load`:
+```ruby
+YAML.safe_load(user_input)
+YAML.safe_load(user_input, permitted_classes: [Date, Time])
+```
+
+## Mass Assignment
+
+```ruby
+# DANGEROUS: All params assigned to model (Rails < 4)
+User.new(params[:user])
+# If params includes {admin: true, role: "superuser"}...
+
+# Also dangerous with update_attributes
+user.update_attributes(params[:user])
+```
+
+**Fix**: Strong Parameters (Rails 4+):
+```ruby
+def user_params
+    params.require(:user).permit(:name, :email)  # Allowlist
+end
+
+User.new(user_params)
+```
+
+## SQL Injection
+
+```ruby
+# DANGEROUS: String interpolation in queries
+User.where("name = '#{params[:name]}'")
+User.where("name = '" + params[:name] + "'")
+
+# DANGEROUS: Array form with interpolation
+User.where(["name = ?", params[:name]])  # Safe
+User.where(["name = #{params[:name]}"])  # NOT safe!
+
+# DANGEROUS: order() with user input
+User.order(params[:sort])  # Can inject: "name; DROP TABLE users--"
+```
+
+**Fix**: Use parameterized queries:
+```ruby
+User.where(name: params[:name])
+User.where("name = ?", params[:name])
+User.order(Arel.sql(sanitize(params[:sort])))  # With validation
+```
+
+## Command Injection
+
+```ruby
+# DANGEROUS: Backticks and system with interpolation
+`ls #{params[:dir]}`
+system("ls #{params[:dir]}")
+exec("ls #{params[:dir]}")
+%x(ls #{params[:dir]})
+
+# Attacker: dir="; rm -rf /"
+```
+
+**Fix**: Use array form:
+```ruby
+system("ls", params[:dir])  # Argument passed safely
+Open3.capture3("ls", params[:dir])
+```
+
+## Regex Injection
+
+```ruby
+# DANGEROUS: User input in regex
+pattern = Regexp.new(params[:pattern])
+string.match(pattern)
+
+# ReDoS attack: pattern = "(a+)+"
+# Denial of service
+
+# Also: Anchors don't work as expected
+/^admin$/.match("admin\nuser")  # Matches! ^ and $ match line boundaries
+```
+
+**Fix**: Use `\A` and `\z` for string boundaries:
+```ruby
+/\Aadmin\z/  # Only matches exactly "admin"
+Regexp.escape(user_input)  # Escape special characters
+```
+
+## Symbol DoS (Ruby < 2.2)
+
+```ruby
+# DANGEROUS in Ruby < 2.2: Symbols never garbage collected
+params[:key].to_sym  # Each unique key creates permanent symbol
+
+# Attacker sends millions of unique parameter names
+# Memory exhaustion - symbols fill memory
+```
+
+**Note**: Fixed in Ruby 2.2+ with symbol GC, but still worth avoiding unnecessary `to_sym` on user input.
+
+## Method Visibility
+
+```ruby
+# DANGEROUS: private/protected don't prevent send()
+class Secret
+    private
+    def sensitive_data
+        "secret"
+    end
+end
+
+obj.send(:sensitive_data)  # Works!
+obj.sensitive_data         # NoMethodError (as expected)
+```
+
+## Default Mutable Arguments
+
+```ruby
+# DANGEROUS: Same pattern as Python
+def add_item(item, list = [])
+    list << item
+    list
+end
+
+add_item(1)  # [1]
+add_item(2)  # [1, 2] - same array!
+```
+
+**Fix**: Use nil default:
+```ruby
+def add_item(item, list = nil)
+    list ||= []
+    list << item
+end
+```
+
+## ERB Template Injection
+
+```ruby
+# DANGEROUS: User input in ERB template
+template = ERB.new(params[:template])
+template.result(binding)
+
+# Attacker template: <%= `whoami` %>
+# Executes shell command
+
+# Also via:
+template = params[:template]
+eval("\"#{template}\"")  # If template contains #{}
+```
+
+## File Operations
+
+```ruby
+# DANGEROUS: Path traversal
+File.read("uploads/#{params[:filename]}")
+# Attacker: filename=../../../etc/passwd
+
+# DANGEROUS: File.open with pipe
+File.open("|#{params[:cmd]}")  # Executes command!
+
+# The | prefix runs a command and opens pipe to it
+File.read("|whoami")  # Returns output of whoami
+```
+
+**Fix**: Validate and sanitize paths:
+```ruby
+path = File.expand_path(params[:filename], uploads_dir)
+raise unless path.start_with?(uploads_dir)
+```
+
+## Comparison Gotchas
+
+```ruby
+# DANGEROUS: == vs eql? vs equal?
+a = "hello"
+b = "hello"
+
+a == b       # true - value comparison
+a.eql?(b)    # true - value + type comparison
+a.equal?(b)  # false - identity comparison
+
+# Array comparison
+[1, 2] == [1, 2]  # true
+[1, 2].eql?([1, 2])  # true
+[1, 2].equal?([1, 2])  # false
+```
+
+## Thread Safety
+
+```ruby
+# DANGEROUS: Ruby global interpreter lock (GIL) doesn't protect everything
+@counter = 0
+
+threads = 10.times.map do
+    Thread.new { 1000.times { @counter += 1 } }
+end
+threads.each(&:join)
+
+@counter  # May not be 10000! Read-modify-write isn't atomic
+```
+
+**Fix**: Use Mutex or atomic operations:
+```ruby
+mutex = Mutex.new
+mutex.synchronize { @counter += 1 }
+```
+
+## Detection Patterns
+
+| Pattern | Risk |
+|---------|------|
+| `eval(`, `instance_eval(` | Code execution |
+| `.send(user_input`, `.public_send(` | Method injection |
+| `.constantize`, `const_get(` | Class injection |
+| `YAML.load(` | Deserialization RCE |
+| `.new(params[` without strong params | Mass assignment |
+| `where("... #{` | SQL injection |
+| `` `...#{` ``, `system("...#{` | Command injection |
+| `Regexp.new(user_input)` | ReDoS |
+| `params[:x].to_sym` | Symbol DoS (old Ruby) |
+| `ERB.new(user_input)` | Template injection |
+| `File.read("|...` or `File.open("|...` | Command execution |
+| `File.read(params[` without path validation | Path traversal |

package/skills/sharp-edges/skills/sharp-edges/references/lang-rust.md

@@ -0,0 +1,272 @@
+# Rust Sharp Edges
+
+## Integer Overflow Behavior Differs by Build
+
+```rust
+// In debug builds: panics
+// In release builds: wraps silently!
+let x: u8 = 255;
+let y = x + 1;  // Debug: panic! Release: y = 0
+
+fn calculate_size(count: usize, element_size: usize) -> usize {
+    count * element_size  // Panics in debug, wraps in release
+}
+```
+
+**The Problem**: Behavior differs between debug and release. Bugs may only manifest in production.
+
+**Fix**: Use explicit methods:
+```rust
+// Wrapping (explicitly allows overflow)
+let y = x.wrapping_add(1);
+
+// Checked (returns Option)
+let y = x.checked_add(1);  // None if overflow
+
+// Saturating (clamps to max/min)
+let y = x.saturating_add(1);  // 255 if would overflow
+
+// Overflowing (returns value + overflow flag)
+let (y, overflowed) = x.overflowing_add(1);
+```
+
+## Unsafe Blocks
+
+```rust
+// DANGEROUS: Unsafe disables Rust's safety guarantees
+unsafe {
+    // Can dereference raw pointers
+    let ptr: *const i32 = &42;
+    let val = *ptr;
+
+    // Can call unsafe functions
+    libc::free(ptr as *mut libc::c_void);
+
+    // Can access mutable statics
+    GLOBAL_COUNTER += 1;
+
+    // Can implement unsafe traits
+}
+
+// Real vulnerabilities from unsafe:
+// - CVE-2019-15548: memory safety bug in slice::from_raw_parts
+// - Many FFI-related vulnerabilities
+```
+
+**Audit Focus**: Every `unsafe` block should have a SAFETY comment explaining invariants.
+
+```rust
+// GOOD: Documented safety invariants
+// SAFETY: ptr is valid for reads of `len` bytes,
+// properly aligned, and the memory won't be mutated
+// for the lifetime 'a
+unsafe { std::slice::from_raw_parts(ptr, len) }
+```
+
+## Mem::forget Skips Destructors
+
+```rust
+// DANGEROUS: Resources never cleaned up
+let guard = mutex.lock().unwrap();
+std::mem::forget(guard);  // Lock never released = deadlock
+
+let file = File::open("data.txt")?;
+std::mem::forget(file);  // File descriptor leaked
+
+// Can be used to create memory unsafety with certain types
+let mut vec = vec![1, 2, 3];
+let ptr = vec.as_mut_ptr();
+std::mem::forget(vec);  // Vec's memory leaked, but ptr still valid... maybe
+```
+
+**Note**: `mem::forget` is safe (not `unsafe`), but can cause resource leaks and logical bugs.
+
+## Panics and Unwinding
+
+```rust
+// DANGEROUS: Panic in FFI boundary is UB
+#[no_mangle]
+pub extern "C" fn called_from_c() {
+    panic!("oops");  // Undefined behavior!
+}
+
+// SAFE: Catch panic at FFI boundary
+#[no_mangle]
+pub extern "C" fn called_from_c() -> i32 {
+    match std::panic::catch_unwind(|| {
+        might_panic();
+    }) {
+        Ok(_) => 0,
+        Err(_) => -1,
+    }
+}
+
+// DANGEROUS: Panic in Drop can abort
+impl Drop for MyType {
+    fn drop(&mut self) {
+        if something_wrong() {
+            panic!("in drop");  // If already unwinding, aborts!
+        }
+    }
+}
+```
+
+## Unwrap and Expect
+
+```rust
+// DANGEROUS: Panics on None/Err
+let value = some_option.unwrap();  // Panics if None
+let result = fallible_fn().unwrap();  // Panics if Err
+
+// In libraries: propagate errors with ?
+fn library_fn() -> Result<T, E> {
+    let value = fallible_fn()?;  // Propagates error
+    Ok(value)
+}
+
+// In binaries: use expect() with context
+let config = load_config()
+    .expect("failed to load config from config.toml");
+```
+
+## Interior Mutability Pitfalls
+
+```rust
+// DANGEROUS: RefCell panics at runtime on borrow violations
+use std::cell::RefCell;
+
+let cell = RefCell::new(42);
+let borrow1 = cell.borrow_mut();
+let borrow2 = cell.borrow_mut();  // PANIC: already borrowed
+
+// Can happen across function calls - hard to track
+fn takes_ref(cell: &RefCell<i32>) {
+    let _b = cell.borrow_mut();
+    other_fn(cell);  // If this also borrows_mut: panic!
+}
+
+// SAFER: Use try_borrow_mut
+if let Ok(mut borrow) = cell.try_borrow_mut() {
+    *borrow += 1;
+}
+```
+
+## Send and Sync Misuse
+
+```rust
+// DANGEROUS: Incorrect Send/Sync implementations
+struct MyWrapper(*mut SomeType);
+
+// This is WRONG if SomeType isn't thread-safe:
+unsafe impl Send for MyWrapper {}
+unsafe impl Sync for MyWrapper {}
+
+// Real vulnerability: Rc<T> is not Send/Sync for good reason
+// Incorrectly marking a type as Send/Sync enables data races
+```
+
+## Lifetime Elision Surprises
+
+```rust
+// The compiler infers lifetimes, but sometimes wrong
+impl MyStruct {
+    // Elided: fn get(&self) -> &str
+    // Means:  fn get<'a>(&'a self) -> &'a str
+    fn get(&self) -> &str {
+        &self.data
+    }
+}
+
+// But what if you return something else?
+impl MyStruct {
+    // WRONG: Elision assumes output lifetime = self lifetime
+    fn get_static(&self) -> &str {
+        "static string"  // Actually 'static, not 'self
+    }
+
+    // RIGHT: Be explicit
+    fn get_static(&self) -> &'static str {
+        "static string"
+    }
+}
+```
+
+## Deref Coercion Confusion
+
+```rust
+// Can be confusing when method resolution happens
+use std::ops::Deref;
+
+struct Wrapper(String);
+impl Deref for Wrapper {
+    type Target = String;
+    fn deref(&self) -> &String { &self.0 }
+}
+
+let w = Wrapper(String::from("hello"));
+w.len();  // Calls String::len via Deref
+w.capacity();  // Also String::capacity
+
+// What if Wrapper has its own len()?
+impl Wrapper {
+    fn len(&self) -> usize { 42 }
+}
+w.len();  // Now calls Wrapper::len, not String::len
+(*w).len();  // Explicitly calls String::len
+```
+
+## Drop Order
+
+```rust
+// Fields dropped in declaration order
+struct S {
+    first: A,   // Dropped last
+    second: B,  // Dropped first
+}
+
+// Can cause issues if B depends on A
+struct Connection {
+    pool: Arc<Pool>,      // Dropped second
+    conn: PooledConn,     // Dropped first - needs pool!
+}
+
+// Fix: reorder fields, or use ManuallyDrop
+```
+
+## Macro Hygiene Gaps
+
+```rust
+// macro_rules! has hygiene gaps
+macro_rules! make_var {
+    ($name:ident) => {
+        let $name = 42;
+    }
+}
+
+make_var!(x);
+println!("{}", x);  // Works - x is in scope
+
+// But: macros can capture identifiers unexpectedly
+macro_rules! double {
+    ($e:expr) => {
+        { let x = $e; x + x }  // Shadows any x in $e!
+    }
+}
+
+let x = 10;
+double!(x + 1)  // Doesn't do what you expect
+```
+
+## Detection Patterns
+
+| Pattern | Risk |
+|---------|------|
+| `+`, `-`, `*` on integers | Overflow (release wraps) |
+| `unsafe { }` | All bets off - audit carefully |
+| `mem::forget()` | Resource leak, deadlock |
+| `.unwrap()`, `.expect()` | Panic on None/Err |
+| `RefCell::borrow_mut()` | Runtime panic on double borrow |
+| `unsafe impl Send/Sync` | Potential data races |
+| `extern "C" fn` without catch_unwind | UB on panic |
+| Drop impl with panic | Double panic = abort |
+| Complex deref chains | Method resolution confusion |