@event4u/agent-config 5.10.1 → 6.1.0

package/dist/agent-src/skills/testing-anti-patterns/SKILL.md

@@ -0,0 +1,164 @@
+---
+model_tier: medium
+name: testing-anti-patterns
+description: "Use BEFORE writing or changing tests, adding mocks, or putting test-only methods on production classes — five Iron Laws and gates against mocking-the-mock, production pollution, silent partial mocks."
+domain: quality
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+---
+
+# testing-anti-patterns
+
+Tests must verify real behavior, not mock behavior. Mocks isolate; they are not the thing under test. This skill is the **prevention** layer; [`judge-test-coverage`](../judge-test-coverage/SKILL.md) catches what slips through afterwards.
+
+For the **process / rationalization** failure modes that fire *before* a
+test is written (the urges to skip TDD, keep code "as reference", patch
+without a regression test), see the sibling reference table in
+[`process-anti-patterns.md`](process-anti-patterns.md). Both layers are
+required — a correctly-mocked test that was written *after* the code is
+still test-after-the-fact.
+
+## When to use
+
+- About to write a new test that mocks a collaborator.
+- Tempted to add a method to a production class purely for test cleanup.
+- Mock setup is becoming longer than the test logic itself.
+- A test passes but you cannot explain *what real behavior* it verified.
+- Code review of a diff that adds mocks — run the gates below before approving.
+
+Do NOT use when:
+
+- You need to *write* tests (no anti-pattern present yet) — route to [`pest-testing`](../pest-testing/SKILL.md) or [`test-driven-development`](../test-driven-development/SKILL.md).
+- The test failure is a real bug — route to [`systematic-debugging`](../systematic-debugging/SKILL.md).
+- You need overall coverage assessment of a finished diff — route to [`judge-test-coverage`](../judge-test-coverage/SKILL.md).
+
+## The Iron Laws
+
+```
+1. NEVER test mock behavior — assert on real component behavior.
+2. NEVER add test-only methods to production classes — put them in test utilities.
+3. NEVER mock without understanding the dependency chain — observe first, mock minimally.
+4. NEVER ship partial mocks — mirror the real response shape completely.
+5. NEVER treat tests as an afterthought — write the failing test first.
+```
+
+## Procedure: Run the gate before each anti-pattern
+
+### 1. Inspect the diff before any new mock
+
+Before writing or extending a test, **inspect** the code under test and identify which collaborators are real, which are mocked, and which produce side effects the assertion depends on. Open the file, read the dependency chain, and write the chain down. Do not start mocking until the chain is on paper.
+
+### Anti-Pattern 1 — Asserting on mock elements
+
+Symptom: `expect(screen.getByTestId('sidebar-mock')).toBeInTheDocument()` or `$this->assertSee('mock-sidebar')`. Test passes when the mock is present, fails when it is not — proves nothing about the component.
+
+Gate:
+
+```
+BEFORE asserting on any mocked element / id / class:
+  Ask: "Am I asserting that the mock exists, or that the component behaves correctly?"
+
+  IF asserting that the mock exists:
+    STOP — delete the assertion or unmock the dependency.
+    Replace with a behavior assertion (role, output, side effect).
+```
+
+### Anti-Pattern 2 — Test-only methods in production classes
+
+Symptom: `Session::destroy()` only ever called from `tearDown`. Production class polluted with code dangerous in production.
+
+Gate:
+
+```
+BEFORE adding any method to a production class:
+  Ask: "Is this only used by tests?"
+  IF yes:
+    STOP — move it to a test utility / trait / helper.
+  Ask: "Does this class own this resource's lifecycle?"
+  IF no:
+    STOP — wrong class for this method.
+```
+
+Replacement: a `tests/Support/cleanupSession.php` helper or a trait used only by test classes.
+
+### Anti-Pattern 3 — Mocking without understanding
+
+Symptom: A mocked method had a side effect the test depended on (e.g. wrote config). Mock kills the side effect; the test passes for the wrong reason or fails mysteriously.
+
+Gate:
+
+```
+BEFORE mocking any method:
+  STOP — do not mock yet.
+  1. List the side effects the real method produces.
+  2. List which of those side effects the test actually depends on.
+  3. If the test depends on any of them, mock at a *lower* level (the slow / external bit), preserving the necessary behavior.
+  IF unsure:
+    Run the test with the real implementation FIRST. Observe what fails.
+    THEN mock minimally, just below the failing seam.
+
+  Red flags:
+    - "I'll mock this just to be safe."
+    - "This might be slow, better mock it."
+    - You cannot draw the dependency chain.
+```
+
+### Anti-Pattern 4 — Partial / incomplete mocks
+
+Symptom: Mock returns only the fields the immediate test reads. Downstream code accesses an absent field and the test passes; integration breaks.
+
+Iron Rule: mock the **complete** response shape that the real API returns, not just the fields your assertion uses. If you cannot enumerate the shape, you should not mock.
+
+```
+BEFORE creating a mock response object:
+  1. Examine the real response (docs, recorded fixture, type definition).
+  2. Include EVERY documented field — even ones the test does not read.
+  3. If the shape is unknown, capture a real response into `tests/fixtures/` instead of inventing one.
+```
+
+**Concrete capture tools** for recording the real shape: `curl -s <url> | jq '.'` against a staging endpoint, Postman's "Save Response", Laravel's `Http::fake()` in record mode, or a Playwright network-trace export. Filter the captured payload with `jq` / `grep` to keep only the fields your fixture documents — **do not** dump unredacted secrets into `tests/fixtures/`.
+
+### Anti-Pattern 5 — Tests as an afterthought
+
+Symptom: "Implementation complete, ready for testing." Implementation went in without tests. TDD was skipped, anti-patterns 1–4 are now likely.
+
+Gate: a feature is not complete until a failing-then-passing test cycle ran for it. Route to [`test-driven-development`](../test-driven-development/SKILL.md).
+
+## Output format
+
+1. The mocking decision recorded as a one-line comment in the test file (`// mock at <seam>: <reason>`).
+2. The replacement test (or refactor) once an anti-pattern is identified.
+3. If a test-only method moved out of production, the diff must show both the deletion and the test-utility addition.
+
+## Gotcha
+
+- Vague-test asserts (`assertTrue($result)`) hide mock-behavior assertions — flag any test where the assertion does not name an observable behavior.
+- A "complete" mock that mirrors a v1 API silently rots when v2 ships — link mock fixtures to a real recorded response and re-record on schema changes.
+- Layer 3 environment guards from [`defense-in-depth`](../defense-in-depth/SKILL.md) often expose anti-pattern 2: if a production guard fires only in tests, the test setup is wrong, not the guard.
+- Long mock setups (> 50% of the test) are a signal that integration tests would be simpler — consider it before piling on more mocks.
+- **Diagnose, do not brute-force.** If a test fails after a mock change, **never guess** at another mock tweak — drop a debugger / Xdebug breakpoint at the seam, observe the real call shape, then mock minimally. Two retries without a root-cause hypothesis = STOP and rethink.
+
+## Do NOT
+
+- Do NOT add `*-mock` test ids to production templates.
+- Do NOT extend a production class to expose internals "just for testing".
+- Do NOT mock a method whose side effects the test depends on without reading the implementation.
+- Do NOT invent mock data shapes from memory — record from the real source.
+- Do NOT mark a story complete until at least one test was watched failing first.
+
+## Auto-trigger keywords
+
+- testing anti-patterns
+- mock behavior
+- test-only method
+- partial mock
+- mock without understanding
+
+## Provenance
+
+- Adopted from: an external reference (MIT, © 2025 an external reference).
+- Cross-linked: [`pest-testing`](../pest-testing/SKILL.md), [`test-driven-development`](../test-driven-development/SKILL.md), [`judge-test-coverage`](../judge-test-coverage/SKILL.md).
+- Provenance registry: `agents/settings/contexts/skills-provenance.yml` (entry: `testing-anti-patterns`).
+- Iron-Law floor: `verify-before-complete`, `skill-quality`.

package/dist/agent-src/skills/testing-anti-patterns/process-anti-patterns.md

@@ -0,0 +1,67 @@
+# Testing process anti-patterns — reference table
+
+Sibling reference for [`testing-anti-patterns`](SKILL.md) and
+[`test-driven-development`](../test-driven-development/SKILL.md).
+
+`testing-anti-patterns/SKILL.md` covers **mock-isolation** failure modes
+(mocking-the-mock, production pollution, partial mocks). This doc covers
+the **process / rationalization** failure modes — the urges that fire
+*before* the test is written and convince you to skip TDD entirely.
+
+Both layers are required. A correctly-mocked test that was written *after*
+the code is still test-after-the-fact. A TDD-first test that mocks itself
+is still mocking the mock.
+
+## The Iron Law (delete-and-restart)
+
+```
+WHEN YOU FIND YOURSELF KEEPING UNTESTED CODE "AS REFERENCE" WHILE WRITING
+A TEST FOR IT — DELETE THE CODE. WRITE THE TEST. THEN REIMPLEMENT.
+```
+
+The cheap path is one extra round-trip. The expensive path is a test that
+silently encodes the bug it was supposed to catch.
+
+## 12-row anti-rationalization table
+
+The urge to skip TDD is strongest on tasks where TDD matters most. Name
+the rationalization, then reject it:
+
+| # | Thought | Reality |
+|---|---|---|
+| 1 | "This is too simple to need a test" | Simple code still breaks. A test takes less time than one debug cycle. |
+| 2 | "I'll add the test after the code works" | A test written after code that passed first try has never failed. It does not prove the code is correct. |
+| 3 | "I already ran it manually" | Manual runs are not repeatable. The next edit breaks it silently. |
+| 4 | "Deleting code I just wrote is wasteful" | Sunk cost. The cheap path: delete, write the test, reimplement minimally. |
+| 5 | "I'll keep the code as reference while I write the test" | You will read it and adapt to it. That is test-after-the-fact with extra steps. Delete it. |
+| 6 | "I just need to explore the API first" | Spike on a throwaway branch. Then delete the spike and restart with TDD. |
+| 7 | "The test is too hard to write" | That signals a design problem in the code, not the test. Listen to it — refactor the seam, then test. |
+| 8 | "This bug is urgent, no time for a test" | The test **is** the fastest path to a verified fix. Guessing takes longer and re-occurs. |
+| 9 | "CI is red — patch first, test later" | A red CI is the cheapest moment to write the regression test. The patch without the test invites the same bug back. |
+| 10 | "The test is just proof-of-work for the PR review" | A test that exists to placate review is not a test — it is theater. Either it asserts behavior or delete it. |
+| 11 | "The dependency is too awkward to seam" | The seam discomfort *is* the design feedback. A constructor-injection refactor pays for itself the second time you change the dependency. |
+| 12 | "We'll add the test in a follow-up PR" | Follow-up PRs that add tests to merged code arrive 0% of the time. The test ships with the change or never. |
+
+## When to use this doc
+
+- Reviewing your own draft before writing a test — read the table, check
+  none of the 12 are firing in your head.
+- Reviewing a teammate's PR — if the PR description matches one of the 12
+  patterns, surface the row number in the review.
+- Onboarding — pair with [`test-driven-development`](../test-driven-development/SKILL.md)
+  to give new devs the *why* behind the discipline.
+
+## Cross-references
+
+- Mock-specific anti-patterns: [`testing-anti-patterns`](SKILL.md)
+- TDD discipline: [`test-driven-development`](../test-driven-development/SKILL.md)
+- Coverage hygiene on a finished diff: [`judge-test-coverage`](../judge-test-coverage/SKILL.md)
+- Pest conventions: [`pest-testing`](../pest-testing/SKILL.md)
+- Quality tooling: [`quality-tools`](../quality-tools/SKILL.md)
+
+## Provenance
+
+- Adapted from an external reference `testing/anti-patterns.md`.
+- Council convergence (anthropic/claude-sonnet-4-5 + openai/gpt-4o,
+  2026-05-07): both members ADOPT — the catalogue surfaces specific
+  rationalization patterns that would otherwise leak past code review.

package/dist/agent-src/skills/threat-modeling/SKILL.md

@@ -0,0 +1,207 @@
+---
+model_tier: high
+name: threat-modeling
+description: "Use when adding auth, webhooks, uploads, queues, secrets, tenant boundaries, or public endpoints — produces trust boundaries + abuse cases mapped to files, BEFORE implementation."
+personas:
+  - security-engineer
+domain: quality
+council_depth: deep
+workspaces:
+  - engineering
+packs:
+  - engineering-base
+---
+
+# threat-modeling
+
+
+> **Grounded corpus (Tier-1 consultation):** ground surface → threats →
+> controls before enumerating from memory — `python3
+> <skills-root>/corpus-grounding/scripts/ground.py ground --manifest
+> <skills-root>/threat-modeling/data/manifest.json "<surface description>"`
+> returns surface class, ATT&CK/CWE-cited threats, required controls, and
+> negative tests, with confidence + evidence-gap. Propose grounded
+> findings; human confirms. Corpus: [`data/threats.csv`](data/threats.csv)
+> (MITRE ATT&CK v16 / OWASP ASVS-derived; owner + cadence in the manifest).
+
+> You are a reviewer specialized in **pre-impl threat analysis**.
+> Your only job is to produce a compact threat model for a planned change —
+> actors, assets, trust boundaries, abuse cases, and the minimum controls
+> the implementer must add. You do **not** audit existing code end-to-end,
+> you do **not** review diffs, you do **not** implement controls — sibling
+> skills handle those.
+
+## When to use
+
+* The change adds or modifies authentication, authorization, or permission checks
+* The change adds a public endpoint, webhook, file upload, queue worker,
+  scheduled task, or third-party integration
+* The change touches sensitive data, tenant boundaries, secrets, billing flows,
+  or admin-only capabilities
+* A `security-sensitive-stop-rule` trigger fired and the agent must produce a
+  risk review before patching
+
+Do NOT use when:
+
+* The change is a cosmetic refactor or documentation-only edit — skip entirely
+* The change is a diff ready for review — route to
+  [`judge-security-auditor`](../judge-security-auditor/SKILL.md)
+* The concern is a full-codebase security posture review — route to
+  [`security-audit`](../security-audit/SKILL.md)
+* The concern is end-to-end authorization enforcement — route to
+  [`authz-review`](../authz-review/SKILL.md)
+* The concern is output/log leakage on an existing API — route to
+  [`data-exposure-review`](../data-exposure-review/SKILL.md)
+* The concern is implementing the controls once identified — route to
+  [`security`](../security/SKILL.md)
+
+## Procedure
+
+### 1. Anchor on the planned change
+
+Read the task description (ticket, feature plan, spec) and the entrypoints
+the change will touch. You are modelling **the stated change**, not the
+whole system. If the change is unclear from available context, stop and ask
+before continuing — never invent a threat model for an imagined feature.
+
+### 2. Inspect the execution path
+
+Trace the path once through existing code:
+
+- Where does untrusted input enter? (route, webhook, queue payload, CLI arg,
+  uploaded file, imported record)
+- Which actor types cross this path? (anonymous, authenticated user, admin,
+  service account, queue worker, cron)
+- What assets does the path touch? (PII, credentials, internal IDs, billing,
+  tenant-scoped records, files, secrets)
+- Where are the privilege boundaries? (auth gate, authorization layer, tenant
+  scope, admin gate)
+
+### 3. Model the risks
+
+For every distinct abuse case, answer:
+
+| Field | What to fill in |
+|---|---|
+| Entry point | route / job / webhook + concrete file |
+| Actor | who can trigger it |
+| Precondition | what must be true (auth state, data state) |
+| Impact | concrete damage (data loss, privilege escalation, DoS, leakage) |
+| Current control | what exists today |
+| Missing control | what the change must add |
+
+Prioritize by **impact × plausibility**, not by novelty. Skip generic
+OWASP bullets unless you can anchor them in a concrete file or line.
+
+### 4. Convert risks to engineering actions
+
+For each prioritized abuse case, propose the **smallest effective control**
+and name the exact file/layer it belongs in:
+
+- input validation → where
+- authorization check → where
+- rate limiting → where
+- output filtering → where
+- safer default → where
+- logging / alerting → where
+
+State whether a new **negative test** is required and what condition it
+must assert (e.g. *"POST /imports with tenant-B id from tenant-A session
+returns 403"*).
+
+## Validation
+
+Before finalizing the threat model, confirm:
+
+1. Every entry point has at least one identified control owner
+2. Every 🔴 abuse case has either an existing control or a required new one
+3. Every 🔴 abuse case has at least one proposed negative test
+4. You have NOT produced generic advice — every risk cites a file, route, or job
+5. You have NOT proposed offensive testing steps, exploit chains, or bypass ideas
+6. If the change is out of scope for threat modelling (no trust boundary
+   crossed), you have said so explicitly and stopped
+
+## Output format
+
+```
+Skill:   threat-modeling
+Target:  <feature / ticket / change summary>
+
+Actors:   <list, one per line>
+Assets:   <list, one per line>
+Entry points:   <route / job / webhook — file:line>
+Trust boundaries:   <where untrusted → trusted crossings happen>
+
+Abuse cases (prioritized):
+  🔴  <name> — entry point · actor · precondition
+      Impact: <concrete damage>
+      Current control: <what exists>
+      Missing control: <what to add, where>
+      Required test: <negative assertion>
+  🟡  ...
+  🟢  ...
+
+Implementation plan:
+  1. <control>, <file/layer>
+  2. ...
+
+Missing tests:
+  1. <assertion>, <test file>
+```
+
+Severity: 🔴 exploitable by external actor with current or no privilege /
+🟡 exploitable only with elevated privilege or partial auth / 🟢 defense-in-depth
+improvement, not a concrete exploit path.
+
+Required fields (ordered):
+
+1. **Skill** and **Target** — one-line change summary
+2. **Actors**, **Assets**, **Entry points**, **Trust boundaries**
+3. **Abuse cases** — prioritized; every entry cites entry point + actor + impact + current + missing control + required test
+4. **Implementation plan** — ordered controls mapped to files/layers
+5. **Missing tests** — ordered negative assertions
+
+Runtime confirmation (e.g. *"reproduce the abuse against staging"*, *"query
+the DB to confirm scope leakage exists today"*) is a follow-up for the
+implementer — **this skill does not execute tools, reproduce exploits, or
+run tests**.
+
+## Gotcha
+
+* **Generic OWASP bullets without a file anchor** — "SQL injection risk" is
+  noise unless you cite the query. Drop it or anchor it.
+* **Confusing authentication with authorization** — a logged-in user is not an
+  authorized user. Model authorization as a distinct boundary even when auth
+  is already enforced upstream.
+* **Treating queue workers and webhooks as trusted** — they carry attacker-
+  influenced payloads. Model them as untrusted entry points.
+* **Modelling the whole system when the change is narrow** — the model is
+  scoped to the planned change. Out-of-scope risks belong to `security-audit`.
+* **Producing offensive test steps** — you name abuse cases and required
+  controls, not exploit procedures.
+
+## Do NOT
+
+* NEVER produce exploit chains, payloads, or bypass techniques — if the task
+  asks for offensive work, stop and refuse per `never-help-build-offensive-cyber-capability`
+* NEVER return a threat model out of politeness when no trust boundary is crossed — say so and stop
+* NEVER treat "internal" or "behind the WAF" as a substitute for a control
+* NEVER approve a plan without at least one negative test per 🔴 abuse case
+* NEVER silently fall back to a generic checklist when the diff context is missing — ask instead
+
+## References
+
+- **STRIDE threat model** — Microsoft Security Development Lifecycle, Shostack
+  *Threat Modeling: Designing for Security* (2014). Framing basis for the
+  Actors / Assets / Entry Points / Trust Boundaries / Abuse Cases rubric.
+  [learn.microsoft.com/en-us/security/engineering/threat-modeling-tool-threats](https://learn.microsoft.com/en-us/security/engineering/threat-modeling-tool-threats)
+- **OWASP ASVS v4.0.3** — Authorization (V4), Validation & Encoding (V5),
+  Session Management (V3) — default baseline for "Missing control" entries.
+  [owasp.org/www-project-application-security-verification-standard/](https://owasp.org/www-project-application-security-verification-standard/)
+- **OWASP Top 10 2021** — A01 Broken Access Control, A04 Insecure Design,
+  A05 Security Misconfiguration — cross-reference when naming abuse cases.
+  [owasp.org/Top10/](https://owasp.org/Top10/)
+- [`authz-review`](../authz-review/SKILL.md),
+  [`data-exposure-review`](../data-exposure-review/SKILL.md),
+  [`security`](../security/SKILL.md),
+  [`security-audit`](../security-audit/SKILL.md) — sibling review / impl skills.

package/dist/agent-src/skills/threat-modeling/data/manifest.json

@@ -0,0 +1,83 @@
+{
+  "manifest_version": 1,
+  "domain": "security-threat-modeling",
+  "tier": "conditional-grounding",
+  "retriever": "bm25",
+  "default_domain": "threats",
+  "domains": {
+    "surfaces": {
+      "file": "surfaces.csv",
+      "search_cols": [
+        "Surface",
+        "Keywords"
+      ],
+      "output_cols": [
+        "Surface",
+        "Surface Class",
+        "Data Classes",
+        "Notes"
+      ],
+      "max_results": 1
+    },
+    "threats": {
+      "file": "threats.csv",
+      "search_cols": [
+        "Surface Class",
+        "Threat",
+        "Abuse Case",
+        "Source Refs"
+      ],
+      "output_cols": [
+        "Surface Class",
+        "Threat",
+        "Source Refs",
+        "Abuse Case",
+        "Required Controls",
+        "Negative Tests",
+        "Severity"
+      ],
+      "max_results": 4
+    }
+  },
+  "detect": {
+    "surfaces": [
+      "surface",
+      "login",
+      "upload",
+      "webhook",
+      "tenant",
+      "billing",
+      "secret",
+      "endpoint"
+    ],
+    "threats": [
+      "threat",
+      "abuse",
+      "attack",
+      "idor",
+      "ssrf",
+      "forgery",
+      "stuffing",
+      "escalation"
+    ]
+  },
+  "reasoning": {
+    "file": "reasoning.csv",
+    "category_domain": "surfaces",
+    "category_column": "Surface Class",
+    "match_column": "Surface_Class",
+    "rules_column": "Decision_Rules",
+    "plan": {
+      "surfaces": 1,
+      "threats": 4
+    }
+  },
+  "default_category": "General",
+  "owner": "package-maintainer",
+  "refresh_cadence": "quarterly",
+  "upstream": {
+    "repo": "derived: MITRE ATT&CK + CWE + OWASP API Top 10 / ASVS 4.0",
+    "sha": "ATT&CK v16 / ASVS 4.0.3",
+    "last_checked": "2026-06-07"
+  }
+}

package/dist/agent-src/skills/threat-modeling/data/reasoning.csv

@@ -0,0 +1,10 @@
+Surface_Class,Priority_Controls,Decision_Rules,Anti_Patterns,Severity
+authentication,MFA + rate-limit + rotation baseline,"{""if_password_reset"": ""single-use-hashed-tokens"", ""if_sso"": ""validate-audience-and-issuer"", ""if_remember_me"": ""rotate-on-privilege-change""}",Custom crypto + roll-your-own session store,HIGH
+authorization,"Object-level policy checks, deny-by-default","{""if_admin_panel"": ""separate-admin-guard"", ""if_mass_assignment_possible"": ""explicit-allowlist-dto""}",Route-middleware-only authorization,CRITICAL
+tenancy,ORM-layer global scope + sealed job context,"{""if_background_jobs"": ""seal-tenant-at-dispatch"", ""if_reports_or_exports"": ""scope-exports-explicitly""}",tenant_id from request body,CRITICAL
+file-upload,Content-sniffed allowlist outside webroot,"{""if_url_fetch"": ""ssrf-denylist-post-dns"", ""if_image_processing"": ""reencode-dont-trust""}",Extension-only validation,HIGH
+external-integration,HMAC + replay window + idempotency,"{""if_outbound_calls"": ""timeout-and-circuit-break"", ""if_queue_consumer"": ""verify-before-enqueue""}",Trusting source IP alone,HIGH
+public-endpoint,Rate limit + cache + minimal payload,"{""if_search_endpoint"": ""cap-page-size"", ""if_health_check"": ""no-version-disclosure""}",Expensive unauthenticated queries,MEDIUM
+billing,Ledger + idempotency + server-side amounts,"{""if_refunds"": ""one-way-state-machine"", ""if_webhooks_from_psp"": ""verify-signature-and-amount""}",Mutable balance column updates,CRITICAL
+secrets,Manager + redaction + scan,"{""if_third_party_keys"": ""scope-and-rotate-quarterly"", ""if_ci_pipeline"": ""masked-vars-only""}",Secrets in env committed to VCS,HIGH
+data-exposure,Allowlist serializers + contract tests,"{""if_admin_fields"": ""separate-serializer"", ""if_logs_contain_payloads"": ""logger-redaction-keys""}",Spreading model attributes into responses,MEDIUM

package/dist/agent-src/skills/threat-modeling/data/surfaces.csv

@@ -0,0 +1,10 @@
+Surface,Keywords,Surface Class,Data Classes,Notes
+Login / session / token issuance,login password session jwt token oauth sso 2fa mfa reset,authentication,"credentials, session tokens",Covers password reset and remember-me flows
+Authorization / policy / role check,authorization policy gate voter role permission admin rbac acl,authorization,entitlements,Includes admin-only routes and ownership checks
+Tenant boundary / row-level scope,tenant multi-tenant tenant_id scope row-level isolation,tenancy,all tenant data,Any query touching tenant-scoped tables
+File upload / user-supplied URL,upload file image attachment url fetch import csv,file-upload,"user files, server filesystem",Includes URL-fetch (SSRF surface)
+Outbound integration / webhook consumer,webhook integration third-party callback queue consumer api client,external-integration,"partner payloads, secrets",Inbound webhooks AND outbound calls
+Public unauthenticated endpoint,public endpoint health status unauthenticated anonymous,public-endpoint,whatever it returns,Includes health/status and marketing forms
+Billing / payment / balance mutation,billing payment charge refund invoice subscription balance credit,billing,money movement,Anything that changes an amount owed/paid
+Secrets / key handling,secret api-key signing key env vault kms rotation,secrets,credentials,"Storage, rotation, and logging paths"
+Data export / serializer / log channel,export serializer api-resource log audit csv download report,data-exposure,"PII, internal fields",Response shaping and log sinks

package/dist/agent-src/skills/threat-modeling/data/threats.csv

@@ -0,0 +1,16 @@
+Surface Class,Threat,Source Refs,Abuse Case,Required Controls,Negative Tests,Severity
+authentication,Credential stuffing / brute force,"ATT&CK T1110, CWE-307",Attacker replays breached credential lists against login,Rate-limit per account+IP; lockout with jitter; breached-password check; MFA,Test: >N failed logins → 429/lockout; lockout not bypassable via case-variant email,HIGH
+authentication,Session fixation / insufficient invalidation,"CWE-384, ATT&CK T1563",Attacker fixes a session id pre-login or reuses one post-logout/password-change,Rotate session id on login + privilege change; invalidate all sessions on password reset,Test: session id differs pre/post login; old token rejected after reset,HIGH
+authentication,Password-reset token abuse,CWE-640,Attacker enumerates/reuses reset tokens or intercepts via referrer leak,"Single-use, short-TTL, hashed-at-rest tokens; uniform response on unknown email; no token in URL logs",Test: token unusable twice; expired token rejected; response identical for known/unknown email,HIGH
+authorization,IDOR / missing object-level check,"CWE-639, OWASP API1",Authenticated user swaps an id in the request and reads/writes another user's object,Object-level ownership check in policy (never only route middleware); deny-by-default,"Test: user A GET/PUT on B's resource id → 403/404, for EVERY verb",CRITICAL
+authorization,Privilege escalation via mass assignment,CWE-915,Attacker posts role/is_admin fields the endpoint binds blindly,Explicit allowlist DTO/fillable; server-side role assignment only via admin flow,Test: POST with role=admin → field ignored AND audit-logged,HIGH
+tenancy,Cross-tenant read via unscoped query,CWE-639,Missing tenant_id scope on a query/report/export leaks another tenant's rows,Global scope at the ORM/repository layer; tenant from session never from request; scoped test fixtures,Test: tenant A token + tenant B resource id across list/show/export/report → empty/403,CRITICAL
+tenancy,Cross-tenant write via background job,CWE-862,Queued job re-resolves tenant from payload an attacker influenced,Jobs carry tenant context sealed at dispatch; consumer re-asserts scope before write,Test: forged job payload with foreign tenant_id → rejected,HIGH
+file-upload,Malicious file / polyglot upload,"CWE-434, ATT&CK T1105",Attacker uploads webshell/polyglot accepted by extension-only check,Content-sniff + allowlist MIME; store outside webroot with random names; never execute; AV scan if executable risk,Test: .php/.svg-with-script renamed .jpg → rejected or neutralized; direct URL fetch of stored file cannot execute,HIGH
+file-upload,SSRF via user-supplied URL,"CWE-918, ATT&CK T1090",URL-fetch feature pointed at cloud metadata / internal services,Deny private/link-local ranges post-DNS-resolution; scheme allowlist; egress proxy; response-size cap,Test: http://169.254.169.254/ and DNS-rebinding host → blocked,CRITICAL
+external-integration,Webhook forgery / replay,CWE-345,Attacker posts forged or replayed events to the webhook consumer,HMAC signature verification with rotation; timestamp tolerance window; idempotency key store,Test: bad signature → 401; stale timestamp → rejected; duplicate event id processed once,HIGH
+public-endpoint,Resource exhaustion / scraping,"CWE-770, ATT&CK T1499",Unauthenticated endpoint hammered for DoS or bulk data harvest,Rate limit + cache; no expensive queries pre-auth; pagination caps; no PII in public responses,Test: response carries rate-limit headers; page size capped server-side,MEDIUM
+billing,Race condition on balance / double-spend,CWE-362,Parallel requests redeem the same credit/refund twice,DB-level constraint or SELECT FOR UPDATE / idempotency key on money mutations; ledger over mutable balance,Test: N parallel redeems of one voucher → exactly one success,CRITICAL
+billing,Price/amount tampering,CWE-602,Client-supplied price or currency trusted at checkout,Recompute amounts server-side from catalog; signed cart or server-held cart only,Test: tampered client amount → server total unchanged,CRITICAL
+secrets,Secret leakage via logs / errors / VCS,"CWE-532, ATT&CK T1552","Key appears in exception payload, debug log, or committed .env",Centralized secret manager; logger redaction list; pre-commit secret scan; scoped short-lived tokens,Test: forced exception on auth path → no credential substring in log sink,HIGH
+data-exposure,Over-broad serializer / API resource,"CWE-213, OWASP API3","Serializer returns internal fields (cost, flags, foreign tenant refs) the UI ignores but attackers read",Explicit field allowlist per resource; separate admin vs public serializers; contract test on response shape,Test: schema-diff response against documented contract → no undocumented fields,MEDIUM