@geraldmaron/construct 1.0.0

package/skills/roles/security.md

@@ -0,0 +1,68 @@
+<!--
+skills/roles/security.md — Anti-pattern guidance for the Security role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the security domain and counter-moves to avoid them.
+Applies to: cx-security, cx-legal-compliance.
+-->
+---
+role: security
+applies_to: [cx-security, cx-legal-compliance]
+inherits: null
+version: 1
+---
+# Security — Role guidance
+
+Load this before drafting. These are the failure modes that separate strong role output from weak role output — check your draft against each.
+
+
+### 1. Defense in absence
+**Symptom**: protection depends on a single layer — a firewall, a middleware, a validation step — with no defense if that layer is bypassed.
+**Why it fails**: one misconfiguration or bug eliminates all protection at once.
+**Counter-move**: assume any single control can fail. Layer controls at the network, application, and data boundaries.
+
+### 2. Secrets in config
+**Symptom**: API keys, tokens, or passwords committed to the repo, hardcoded in code, or checked into `.env` files in source control.
+**Why it fails**: git history preserves them forever; every developer, CI run, and forked repo now has them.
+**Counter-move**: secrets go in a secret manager. The repo contains variable names and example values only.
+
+### 3. Trusting user input
+**Symptom**: user-supplied strings concatenated into SQL, shell commands, file paths, URLs, or rendered HTML without validation or escaping.
+**Why it fails**: injection attacks are the most common root cause of data breaches. None of them require a clever attacker.
+**Counter-move**: validate input at the boundary. Use parameterized queries, safe templating, and path canonicalization.
+
+### 4. No threat model
+**Symptom**: security review cannot answer "who are we defending against and what do they want".
+**Why it fails**: effort is spent on showy controls while real attack paths go unconsidered.
+**Counter-move**: name the attacker, the asset, and the worst-case outcome before choosing controls.
+
+### 5. Authentication without authorization
+**Symptom**: the system checks who the user is but not whether they are allowed to do this specific thing with this specific resource.
+**Why it fails**: IDOR and privilege-escalation bugs. Any authenticated user can see or modify any record.
+**Counter-move**: every protected resource access is accompanied by a per-resource authorization check, not just a session check.
+
+### 6. Silent failures in crypto
+**Symptom**: signature verification, token expiry, or certificate validation failures are logged and ignored, or caught and swallowed.
+**Why it fails**: an attacker with a forged token or expired session gets the same treatment as a legitimate user.
+**Counter-move**: crypto failures halt the operation. Errors are surfaced, not logged-and-continued.
+
+### 7. Rolling your own
+**Symptom**: hand-written crypto, session management, password hashing, or random-number generation.
+**Why it fails**: subtle flaws that a specialist would catch in seconds but the author will never see.
+**Counter-move**: use the standard library or a vetted third-party library. Review configuration, not implementation.
+
+### 8. Error messages that leak
+**Symptom**: production errors return stack traces, SQL queries, internal paths, or schema details.
+**Why it fails**: gives an attacker a map of the system; turns a reconnaissance step into a freebie.
+**Counter-move**: user-facing errors are generic. Detailed context goes to logs with appropriate access controls.
+
+## Self-check before shipping
+
+- [ ] No single control is the only line of defense
+- [ ] Secrets live in a secret manager, not in the repo
+- [ ] User input is validated and escaped at every boundary
+- [ ] Threat model names attacker, asset, and worst case
+- [ ] Every protected resource has a per-resource authorization check
+- [ ] Crypto failures halt the operation and surface explicitly
+- [ ] No custom crypto; vetted libraries only
+- [ ] Production errors are generic; details are in controlled logs

package/skills/roles/security.privacy.md

@@ -0,0 +1,37 @@
+<!--
+skills/roles/security.privacy.md — Anti-pattern guidance for the Security.privacy (privacy) role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the security.privacy (privacy) domain and counter-moves to avoid them.
+Applies to: cx-security, cx-legal-compliance.
+-->
+---
+role: security.privacy
+applies_to: [cx-security, cx-legal-compliance]
+inherits: security
+version: 1
+---
+# Privacy Security Overlay
+
+Additional failure modes on top of the security core.
+
+### 1. Data collection without minimization
+**Symptom**: events, logs, prompts, or exports include fields because they might be useful later.
+**Why it fails**: unnecessary data increases breach, compliance, and deletion risk.
+**Counter-move**: require purpose, minimization, retention, deletion, and consent/legal basis for personal data.
+
+### 2. PII hidden in operational paths
+**Symptom**: support tools, traces, analytics, or embeddings store sensitive data outside primary databases.
+**Why it fails**: privacy reviews often miss secondary stores.
+**Counter-move**: inventory every store and transfer path, including telemetry and vector indexes.
+
+### 3. Deletion impossible to prove
+**Symptom**: user deletion removes primary records but not logs, caches, exports, or embeddings.
+**Why it fails**: deletion obligations require complete lifecycle control.
+**Counter-move**: define deletion propagation, retention exceptions, and evidence of completion.
+
+## Self-check before shipping
+- [ ] Purpose, minimization, retention, and legal basis are explicit
+- [ ] Telemetry, traces, exports, and embeddings are included in the data map
+- [ ] Deletion and access requests have end-to-end handling
+- [ ] Sensitive data is redacted before logs or prompts

package/skills/roles/security.supply-chain.md

@@ -0,0 +1,37 @@
+<!--
+skills/roles/security.supply-chain.md — Anti-pattern guidance for the Security.supply-chain (supply chain) role.
+
+Loaded at sync time to inline role-specific failure modes into specialist agent prompts.
+Covers common failure modes for the security.supply-chain (supply chain) domain and counter-moves to avoid them.
+Applies to: cx-security, cx-platform-engineer.
+-->
+---
+role: security.supply-chain
+applies_to: [cx-security, cx-platform-engineer]
+inherits: security
+version: 1
+---
+# Supply Chain Security Overlay
+
+Additional failure modes on top of the security core.
+
+### 1. Dependency trust by popularity
+**Symptom**: packages, actions, images, or plugins are accepted because they are common.
+**Why it fails**: supply-chain incidents often target trusted transitive paths.
+**Counter-move**: verify provenance, pin versions, inspect permissions, and track CVEs.
+
+### 2. CI as an unguarded privileged system
+**Symptom**: workflows can access secrets broadly or run untrusted code with write permissions.
+**Why it fails**: CI compromise becomes source, package, or credential compromise.
+**Counter-move**: scope tokens, split trusted/untrusted workflows, and protect release jobs.
+
+### 3. Release artifacts not reproducible
+**Symptom**: builds cannot prove what source produced the shipped artifact.
+**Why it fails**: incident response and rollback become guesswork.
+**Counter-move**: require lockfiles, SBOMs, provenance attestations, and signed artifacts where appropriate.
+
+## Self-check before shipping
+- [ ] Dependencies, actions, images, and plugins are pinned or justified
+- [ ] CI permissions and secret exposure are scoped
+- [ ] SBOM/provenance/signing expectations are defined
+- [ ] Release artifact source can be traced

package/skills/routing.md

@@ -0,0 +1,139 @@
+<!--
+skills/routing.md — Construct AI Agent — Skill Routing — Read the matching skill file before responding when the user's request matches t
+
+Read the matching skill file before responding when the user's request matches trigger keywords below. ## Exploration Domain
+-->
+# Construct AI Agent — Skill Routing
+
+Read the matching skill file before responding when the user's request matches trigger keywords below.
+
+## Exploration Domain
+
+| Trigger Keywords | Skill File | Description |
+|---|---|---|
+| explore repo, map codebase, understand codebase, unfamiliar codebase, slog through, get oriented, codebase map, how is this structured, how does this work, where is X, entry point, hot path, code map | `skills/exploration/repo-map.md` | Systematic repo exploration — produce .cx/codebase-map.md |
+
+## Quality Gates
+
+| Trigger Keywords | Skill File | Description |
+|---|---|---|
+| security scan, vulnerability, secrets, auth audit | `skills/quality-gates/verify-security.md` | Security vulnerability scan |
+| code quality, complexity, code smell, naming | `skills/quality-gates/verify-quality.md` | Code quality analysis |
+| change impact, what broke, doc sync, regression | `skills/quality-gates/verify-change.md` | Change impact analysis |
+| module structure, exports, completeness | `skills/quality-gates/verify-module.md` | Module structure check |
+| parallel review, adversarial review, 5-reviewer, pre-merge review | `skills/quality-gates/review-work.md` | 5-role parallel adversarial review methodology |
+
+## Utility Domain
+
+| Trigger Keywords | Skill File | Description |
+|---|---|---|
+| ai slop, verbose code, over-commented, clean code, hedging names, dead comments, unnecessary wrapper | `skills/utility/clean-code.md` | AI slop removal patterns and heuristics |
+
+## Security Domain
+
+| Trigger Keywords | Skill File | Description |
+|---|---|---|
+| pentest, red team, exploit, C2, lateral movement, privilege escalation, evasion, persistence | `skills/security/red-team.md` | Red team attack techniques |
+| blue team, alert, IOC, incident response, forensics, SIEM, EDR, containment | `skills/security/blue-team.md` | Blue team defense and incident response |
+| web pentest, API security, OWASP, SQLi, XSS, SSRF, RCE, injection | `skills/security/pentest.md` | Web and API penetration testing |
+| code audit, dangerous function, taint analysis, sink, source | `skills/security/code-audit.md` | Source code security audit |
+| binary, reversing, PWN, fuzzing, stack overflow, heap overflow, ROP | `skills/security/vuln-research.md` | Vulnerability research and exploitation |
+| OSINT, threat intelligence, threat modeling, ATT&CK, threat hunting | `skills/security/threat-intel.md` | Threat intelligence and OSINT |
+
+## Architecture Domain
+
+| Trigger Keywords | Skill File | Description |
+|---|---|---|
+| API design, REST, GraphQL, gRPC, endpoint, versioning | `skills/architecture/api-design.md` | API design patterns |
+| caching, Redis, Memcached, cache invalidation, CDN | `skills/architecture/caching.md` | Caching strategies |
+| cloud native, Kubernetes, Docker, microservice, service mesh | `skills/architecture/cloud-native.md` | Cloud-native architecture |
+| message queue, Kafka, RabbitMQ, event driven, pub/sub | `skills/architecture/message-queue.md` | Message queue and event-driven patterns |
+| security architecture, zero trust, defense in depth, IAM | `skills/architecture/security-arch.md` | Security architecture |
+
+## AI / MLOps Domain
+
+| Trigger Keywords | Skill File | Description |
+|---|---|---|
+| RAG, retrieval augmented, vector database, embedding, chunking | `skills/ai/rag-system.md` | RAG system design |
+| AI agent, tool use, function calling, agent framework, orchestration | `skills/ai/agent-dev.md` | AI agent development |
+| workflow state, orchestration state, task key, handoff contract, phase gate, project alignment | `skills/ai/orchestration-workflow.md` | Construct-style workflow state and phase alignment |
+| LLM security, prompt injection, jailbreak, guardrail | `skills/ai/llm-security.md` | LLM security and guardrails |
+| prompt engineering, model evaluation, benchmark, fine-tuning | `skills/ai/prompt-and-eval.md` | Prompt engineering and evaluation |
+| prompt optimization, improve prompt, optimize agent, quality score, staging prompt, promotion | `skills/ai/prompt-optimizer.md` | Closed-loop prompt auto-optimization via Langfuse traces |
+| MLOps, ML pipeline, model registry, model deployment, feature store, drift detection, model monitoring, training pipeline | `skills/ai/ml-ops.md` | ML operations and model lifecycle |
+
+## DevOps Domain
+
+| Trigger Keywords | Skill File | Description |
+|---|---|---|
+| Git workflow, branching strategy, trunk-based, GitFlow | `skills/devops/git-workflow.md` | Git workflow patterns |
+| testing strategy, unit test, integration test, e2e, test pyramid | `skills/devops/testing.md` | Testing strategy |
+| database, migration, schema design, indexing, query optimization | `skills/devops/database.md` | Database patterns |
+| performance, profiling, load test, latency, throughput | `skills/devops/performance.md` | Performance engineering |
+| observability, logging, tracing, metrics, Prometheus, Grafana | `skills/devops/observability.md` | Observability and monitoring |
+| DevSecOps, CI security, SAST, DAST, supply chain | `skills/devops/devsecops.md` | DevSecOps practices |
+| cost optimization, cloud cost, FinOps, resource right-sizing | `skills/devops/cost-optimization.md` | Cloud cost optimization |
+| CI/CD, pipeline, GitHub Actions, GitLab CI, workflow, continuous integration, continuous deployment, build pipeline | `skills/devops/ci-cd.md` | CI/CD pipeline design and optimization |
+| monorepo, pnpm workspaces, Turborepo, Nx, Bazel, workspace, multi-package, affected builds | `skills/devops/monorepo.md` | Monorepo tooling and management |
+| dependency upgrade, package update, lock file, Dependabot, Renovate, transitive CVE, npm audit, vulnerability, outdated packages | `skills/devops/dependency-management.md` | Dependency management and upgrade safety |
+| Docker, container, Dockerfile, multi-stage, image scanning, Trivy, Snyk, OCI, containerize | `skills/devops/containerization.md` | Docker and OCI container best practices |
+| incident response, on-call, runbook, post-mortem, blameless, PagerDuty, SLA, outage, escalation | `skills/devops/incident-response.md` | Incident response and post-mortem process |
+| data pipeline, ELT, ETL, dbt, Airflow, Kafka, Spark, Flink, data warehouse, feature store, data contract | `skills/devops/data-engineering.md` | Data pipeline and warehouse engineering |
+
+## Development Domain
+
+| Trigger Keywords | Skill File | Description |
+|---|---|---|
+| Python, Django, Flask, FastAPI, pip, poetry | `skills/development/python.md` | Python best practices |
+| Go, Golang, goroutine, channel | `skills/development/go.md` | Go best practices |
+| Rust, cargo, borrow checker, lifetime | `skills/development/rust.md` | Rust best practices |
+| TypeScript, JavaScript, Node, Deno, Bun | `skills/development/typescript.md` | TypeScript best practices |
+| Java, Kotlin, Spring, JVM, Maven, Gradle | `skills/development/java.md` | Java best practices |
+| C, C++, CMake, pointer, memory management | `skills/development/cpp.md` | C/C++ best practices |
+| Shell, Bash, Zsh, scripting, CLI | `skills/development/shell.md` | Shell scripting best practices |
+| Swift, iOS, SwiftUI, Xcode, UIKit, Combine | `skills/development/swift.md` | Swift / iOS development |
+| Kotlin Android, Jetpack Compose, coroutines, Android, Hilt | `skills/development/kotlin.md` | Kotlin / Android development |
+| Flutter, React Native, cross-platform mobile, Dart, Expo | `skills/development/mobile-crossplatform.md` | Cross-platform mobile frameworks |
+
+## Frontend Design Domain
+
+| Trigger Keywords | Skill File | Description |
+|---|---|---|
+| UI aesthetics, visual design, color theory, layout | `skills/frontend-design/ui-aesthetics.md` | UI visual design |
+| UX principles, usability, user flow, information architecture | `skills/frontend-design/ux-principles.md` | UX design principles |
+| component patterns, design system, atomic design | `skills/frontend-design/component-patterns.md` | Component architecture |
+| state management, Redux, Zustand, Pinia, context | `skills/frontend-design/state-management.md` | Frontend state management |
+| frontend engineering, build tool, bundler, SSR, SSG | `skills/frontend-design/engineering.md` | Frontend engineering |
+| accessibility, WCAG, ARIA, screen reader, keyboard navigation, a11y, color contrast, inclusive design | `skills/frontend-design/accessibility.md` | WCAG 2.2 accessibility and inclusive design |
+
+## Frameworks Domain
+
+| Trigger Keywords | Skill File | Description |
+|---|---|---|
+| React, JSX, hooks, useState, useEffect, RSC, Server Components | `skills/frameworks/react.md` | React patterns and best practices |
+| Next.js, App Router, Server Actions, ISR, route handler, Vercel | `skills/frameworks/nextjs.md` | Next.js App Router |
+| Django, DRF, Django REST, Django ORM, Django views | `skills/frameworks/django.md` | Django and Django REST Framework |
+| Spring Boot, Spring Security, JPA, @RestController, @Service | `skills/frameworks/spring-boot.md` | Spring Boot layered architecture |
+
+## Documentation Domain
+
+| Trigger Keywords | Skill File | Description |
+|---|---|---|
+| init docs, create docs structure, set up documentation, docs scaffold, documentation init | `skills/docs/init-docs.md` | Initialize required project-state docs and documentation structure |
+| research X, investigate X, find evidence, gather evidence | `skills/docs/research-workflow.md` | Research workflow — question to .cx/research/ file |
+| product intelligence, customer notes, field notes, product signals, customer profile, evidence brief, signal brief, backlog proposal | `skills/docs/product-intelligence-workflow.md` | Product Intelligence workflow — evidence to product artifacts |
+| ingest evidence, ingest customer notes, ingest Slack thread, ingest support ticket, normalize field notes | `skills/docs/evidence-ingest-workflow.md` | Evidence ingest workflow — raw source to .cx/product-intel/ |
+| write a PRD, create requirements, spec out, requirements document, Meta PRD, platform PRD | `skills/docs/prd-workflow.md` | PRD workflow — requirements to docs/prd/ or docs/meta-prd/ |
+| write a PRFAQ, working backwards doc, press release FAQ | `skills/docs/prfaq-workflow.md` | PRFAQ workflow — launch narrative from PRD or evidence |
+| create Jira proposal, update Linear, backlog proposal, issue proposal | `skills/docs/backlog-proposal-workflow.md` | Backlog proposal workflow — approval-gated issue tracker changes |
+| record this decision, create an ADR, architecture decision | `skills/docs/adr-workflow.md` | ADR workflow — decision to docs/adr/ file |
+| write a runbook, document this operation, operational procedure | `skills/docs/runbook-workflow.md` | Runbook workflow — operation to docs/runbooks/ file |
+| init project, new project setup, join project, set up doc structure | `skills/docs/init-project.md` | Project initialization via construct init-docs |
+
+## Routing Rules
+
+1. Match on intent, not exact string. "How do I prevent SQL injection" triggers `pentest.md`.
+2. When a request spans two domains, read both skill files.
+3. Detect programming language from file extensions or context and read the corresponding development skill.
+4. Read each skill file once per conversation.
+5. Skill file content is authoritative over training data when they conflict.

package/skills/security/blue-team.md

@@ -0,0 +1,83 @@
+<!--
+skills/security/blue-team.md — Blue Team — Use this skill when defending systems, responding to incidents, or building dete
+
+Use this skill when defending systems, responding to incidents, or building detection and monitoring capabilities. ## Detection Engineering
+-->
+# Blue Team
+
+Use this skill when defending systems, responding to incidents, or building detection and monitoring capabilities.
+
+## Detection Engineering
+
+- Write detection rules based on known TTPs, not just IOCs
+- Use SIGMA rules for vendor-agnostic detection logic
+- Test detections against atomic red team or similar frameworks
+- Tune alert thresholds to minimize false positives without losing true positives
+- Layer detections: network, endpoint, identity, application
+
+## SIEM Operations
+
+- Normalize log formats before ingestion
+- Correlate events across sources: firewall, endpoint, identity, application
+- Build dashboards for: authentication anomalies, lateral movement indicators, data exfiltration patterns
+- Retain logs for compliance period plus investigative buffer
+- Index critical fields for fast search: source IP, user, process, command line
+
+## EDR and Endpoint Defense
+
+- Deploy agents on all endpoints including servers
+- Monitor: process creation trees, network connections, file modifications, registry changes
+- Block known-bad hashes and suspicious behaviors
+- Investigate alerts within SLA: Critical <1h, High <4h, Medium <24h
+- Maintain exclusion lists carefully; review quarterly
+
+## Incident Response Process
+
+1. **Detect**: Alert triggers or user report
+2. **Triage**: Confirm true positive, assess scope, assign severity
+3. **Contain**: Isolate affected systems, block IOCs, disable compromised accounts
+4. **Investigate**: Build timeline, identify root cause, determine blast radius
+5. **Eradicate**: Remove attacker presence, patch vulnerability, rotate credentials
+6. **Recover**: Restore from clean backups, monitor for re-compromise
+7. **Lessons learned**: Document findings, update runbooks, improve detections
+
+## Forensics Fundamentals
+
+- Preserve evidence before remediation (memory dumps, disk images, logs)
+- Maintain chain of custody documentation
+- Analyze artifacts: prefetch, event logs, browser history, shellbags, MFT
+- Timeline analysis using multiple artifact sources
+- Hash all evidence for integrity verification
+
+## Threat Hunting
+
+- Hypothesis-driven: start from a TTP, look for evidence
+- Data-driven: anomaly detection on baselines (unusual process, new scheduled task, rare DNS query)
+- Hunt regularly, not only after incidents
+- Document and share findings to improve detection coverage
+- Track hunt coverage against MITRE ATT&CK matrix
+
+## IOC Management
+
+- Categorize: IP, domain, hash, URL, email, certificate, mutex
+- Score by confidence and relevance
+- Expire IOCs that are no longer active
+- Automate ingestion from threat feeds into blocking and detection tools
+- Share IOCs with trusted peers via STIX/TAXII or equivalent
+
+## Hardening Baselines
+
+- CIS benchmarks as starting point for OS and service hardening
+- Disable unnecessary services and protocols
+- Enforce least privilege on all accounts
+- Segment networks by trust zone
+- Patch within SLA: Critical <48h, High <7d, Medium <30d
+- Review firewall rules quarterly; remove stale entries
+
+## Metrics
+
+- Mean time to detect (MTTD)
+- Mean time to respond (MTTR)
+- Alert-to-incident ratio (false positive rate)
+- MITRE ATT&CK technique coverage percentage
+- Patch compliance rate

package/skills/security/code-audit.md

@@ -0,0 +1,94 @@
+<!--
+skills/security/code-audit.md — Code Audit — Use this skill when reviewing source code for security vulnerabilities through s
+
+Use this skill when reviewing source code for security vulnerabilities through static analysis. ## Taint Analysis
+-->
+# Code Audit
+
+Use this skill when reviewing source code for security vulnerabilities through static analysis.
+
+## Taint Analysis
+
+Trace data flow from sources to sinks. Any path from untrusted input to a dangerous operation without sanitization is a finding.
+
+### Sources (Untrusted Input)
+- HTTP request: params, headers, cookies, body, uploaded files
+- Database reads (if user-influenced)
+- Environment variables from external config
+- File reads, IPC, message queue payloads
+- Third-party API responses
+- URL fragments and query strings
+
+### Sinks (Dangerous Operations)
+- SQL/NoSQL query construction
+- OS command execution (`exec`, `system`, `spawn`, `popen`)
+- File system operations (open, read, write, delete, path construction)
+- HTML/template rendering
+- HTTP redirects and URL construction
+- Deserialization (`pickle`, `unserialize`, `JSON.parse` of untrusted classes)
+- Dynamic code evaluation (`eval`, `Function()`, `exec()`)
+- Logging (sensitive data leakage)
+
+### Sanitization Verification
+- Is the sanitizer appropriate for the sink? (HTML escaping does not prevent SQL injection)
+- Is the sanitizer applied consistently on all paths?
+- Is the sanitizer applied before the sink, not after?
+- Does the sanitizer handle edge cases: null bytes, Unicode normalization, double encoding?
+
+## Dangerous Function Patterns
+
+### Language-Specific Red Flags
+
+**JavaScript/TypeScript**: `eval`, `Function()`, `innerHTML`, `document.write`, `child_process.exec`, `require()` with dynamic input
+**Python**: `eval`, `exec`, `pickle.loads`, `subprocess.shell=True`, `os.system`, `yaml.load` (use safe_load)
+**Java**: `Runtime.exec`, `ProcessBuilder`, `ObjectInputStream.readObject`, `Statement.execute` (use PreparedStatement)
+**Go**: `os/exec.Command` with user input, `html/template` vs `text/template` confusion, `unsafe` package usage
+**Rust**: `unsafe` blocks, `Command::new` with user input, raw pointer operations
+**PHP**: `eval`, `system`, `exec`, `passthru`, `preg_replace` with `e` modifier, `unserialize`
+
+## Authentication and Session Review
+
+- Password comparison uses constant-time comparison
+- Session tokens generated with CSPRNG
+- Session invalidated on logout and password change
+- Token expiry enforced server-side
+- No session data in URLs
+
+## Access Control Review
+
+- Authorization checked on every request, not cached from prior request
+- Role checks happen server-side
+- Object-level authorization verified (not just endpoint-level)
+- Admin functionality isolated from user-facing code paths
+
+## Cryptography Review
+
+- No custom cryptographic implementations
+- Key material not hardcoded or logged
+- IV/nonce never reused with the same key
+- Signatures verified before trusting data
+- Constant-time comparison for MAC/signature verification
+
+## File and Path Operations
+
+- User input never directly used in file paths
+- Path traversal prevention: canonicalize then validate prefix
+- File uploads: validate type, limit size, store outside webroot, randomize names
+- Temporary files created securely and cleaned up
+
+## Error Handling Review
+
+- Exceptions do not expose internal state to users
+- Catch blocks do not silently swallow security-relevant errors
+- Fallback behavior does not weaken security (fail-open vs fail-closed)
+- Resource cleanup happens in all exit paths
+
+## Reporting Format
+
+For each finding:
+1. **Location**: file, line, function
+2. **Category**: injection, auth, crypto, data exposure, etc.
+3. **Severity**: Critical / High / Medium / Low
+4. **Data flow**: source -> [transforms] -> sink
+5. **Proof**: concrete exploit scenario or test case
+6. **Fix**: specific remediation with code example

package/skills/security/pentest.md

@@ -0,0 +1,84 @@
+<!--
+skills/security/pentest.md — Penetration Testing — Use this skill when testing web applications or APIs for security vulnerabilitie
+
+Use this skill when testing web applications or APIs for security vulnerabilities. ## OWASP Top 10 Checklist
+-->
+# Penetration Testing
+
+Use this skill when testing web applications or APIs for security vulnerabilities.
+
+## OWASP Top 10 Checklist
+
+### Broken Access Control
+- Test horizontal privilege escalation: access another user's resources by changing IDs
+- Test vertical privilege escalation: access admin functions as regular user
+- Test IDOR on every endpoint that accepts an identifier
+- Verify server-side enforcement, not just UI hiding
+
+### Cryptographic Failures
+- Check for sensitive data in URLs, logs, and error messages
+- Verify TLS configuration (SSL Labs A+ target)
+- Check for weak cipher suites and protocol versions
+- Verify sensitive data encrypted at rest
+
+### Injection
+- SQL: test with `' OR 1=1--`, time-based blind, UNION-based
+- NoSQL: test with `{"$gt": ""}` and operator injection
+- OS Command: test with `; id`, `| whoami`, backtick substitution
+- LDAP, XPath, template injection where applicable
+
+### Insecure Design
+- Business logic flaws: race conditions, price manipulation, workflow bypass
+- Missing rate limiting on sensitive operations
+- Lack of fraud detection on financial transactions
+
+### Security Misconfiguration
+- Default credentials on admin panels, databases, services
+- Unnecessary HTTP methods enabled (TRACE, OPTIONS)
+- Directory listing enabled
+- Stack traces and debug info in production responses
+- CORS misconfiguration: wildcard origins, credential reflection
+
+### Vulnerable Components
+- Run `npm audit`, `pip audit`, `cargo audit`
+- Check for known CVEs in server software and frameworks
+- Verify component versions against vulnerability databases
+
+### Authentication Failures
+- Brute force resistance: account lockout or progressive delays
+- Credential stuffing protection
+- Session fixation and session hijacking
+- JWT: algorithm confusion, none algorithm, key leakage, expiry validation
+- Password reset flow: token predictability, expiry, single use
+
+### Data Integrity Failures
+- Deserialization: test for RCE via crafted objects
+- Verify integrity of software updates and CI/CD pipelines
+- Check for unsigned or unverified data in trust decisions
+
+### Logging and Monitoring Failures
+- Verify login attempts are logged
+- Verify failed access control is logged
+- Check that logs do not contain sensitive data
+- Confirm alerting exists for suspicious patterns
+
+### SSRF
+- Test URL parameters for internal network access
+- Check for cloud metadata endpoint access (169.254.169.254)
+- Test DNS rebinding scenarios
+- Verify allowlist-based URL validation
+
+## API-Specific Testing
+
+- Test all HTTP methods on each endpoint
+- Fuzz parameters with unexpected types and sizes
+- Test pagination for data leakage beyond authorized scope
+- Verify rate limiting per endpoint and per user
+- Check GraphQL: introspection disabled in prod, query depth limits, batch attack resistance
+
+## Reporting
+
+- Severity rated by exploitability and business impact
+- Each finding includes: description, reproduction steps, evidence, remediation
+- Group findings by category for systemic issues
+- Provide a prioritized remediation roadmap

package/skills/security/red-team.md

@@ -0,0 +1,81 @@
+<!--
+skills/security/red-team.md — Red Team — Use this skill when planning or executing offensive security assessments, advers
+
+Use this skill when planning or executing offensive security assessments, adversary emulation, or attack simulations. ## Reconnaissance
+-->
+# Red Team
+
+Use this skill when planning or executing offensive security assessments, adversary emulation, or attack simulations.
+
+## Reconnaissance
+
+- Passive: DNS records, WHOIS, certificate transparency, public repos, social media, job postings
+- Active: port scanning, service fingerprinting, directory brute-forcing, virtual host enumeration
+- Map the attack surface before attempting exploitation
+- Document all discovered assets, services, and potential entry points
+
+## Initial Access
+
+- Phishing: credential harvesting, macro-enabled documents, HTML smuggling
+- Exposed services: default credentials, known CVEs, misconfigured cloud storage
+- Supply chain: compromised dependencies, typosquatting packages
+- Web application: authentication bypass, injection, file upload abuse
+- Always verify scope before attempting access vectors
+
+## Privilege Escalation
+
+- Linux: SUID binaries, writable cron jobs, kernel exploits, sudo misconfigurations, capability abuse
+- Windows: unquoted service paths, DLL hijacking, token impersonation, AlwaysInstallElevated, PrintNightmare variants
+- Cloud: over-permissive IAM roles, instance metadata SSRF, cross-account trust abuse
+- Enumerate before escalating; avoid unnecessary noise
+
+## Lateral Movement
+
+- Credential reuse across hosts
+- Pass-the-hash and pass-the-ticket (Kerberos)
+- Remote services: WMI, PSRemoting, SSH, RDP
+- Internal pivoting through compromised hosts
+- Abuse of administrative shares and trust relationships
+- Document each hop for the attack path narrative
+
+## Persistence
+
+- Scheduled tasks and cron jobs
+- Registry run keys and startup folders
+- Web shells and reverse shells
+- Service creation and modification
+- Golden/silver tickets in Active Directory
+- Cloud: persistent IAM keys, backdoor roles, lambda triggers
+
+## Command and Control
+
+- HTTP/HTTPS beaconing with domain fronting
+- DNS tunneling for restrictive networks
+- Encrypted channels with jitter and sleep intervals
+- Redirectors to protect infrastructure
+- Avoid patterns that trigger common EDR signatures
+
+## Evasion
+
+- AMSI bypass techniques for PowerShell
+- Living-off-the-land binaries (LOLBins)
+- Process injection: hollowing, DLL injection, APC queue
+- Timestomping and log tampering (document for report, do not destroy evidence)
+- Obfuscation of tooling and payloads
+
+## Reporting
+
+- Document the full kill chain with timestamps
+- Map findings to MITRE ATT&CK techniques
+- Provide reproduction steps for each finding
+- Rate severity by business impact, not technical complexity
+- Include remediation recommendations with priority
+- Separate executive summary from technical details
+
+## Rules of Engagement
+
+- Operate strictly within authorized scope
+- Maintain out-of-band communication with the client
+- Have emergency stop procedures ready
+- Log all actions for accountability
+- Never exfiltrate real sensitive data; use proof-of-access artifacts