@geraldmaron/construct 1.0.0

package/skills/security/threat-intel.md

@@ -0,0 +1,89 @@
+<!--
+skills/security/threat-intel.md — Threat Intelligence — Use this skill when performing OSINT, threat modeling, or building threat intell
+
+Use this skill when performing OSINT, threat modeling, or building threat intelligence programs. ## OSINT Collection
+-->
+# Threat Intelligence
+
+Use this skill when performing OSINT, threat modeling, or building threat intelligence programs.
+
+## OSINT Collection
+
+### Domain and Infrastructure
+- DNS records: A, AAAA, MX, TXT, CNAME, NS, SOA
+- Reverse DNS and IP range enumeration
+- Certificate transparency logs (crt.sh, Censys)
+- WHOIS history and registrar patterns
+- Subdomain enumeration via passive sources and brute force
+- Historical snapshots (Wayback Machine)
+
+### Organization and People
+- Public employee directories and org charts
+- Job postings reveal technology stack and priorities
+- Social media for social engineering vectors
+- Code repositories for leaked credentials and internal naming
+- Leaked credential databases (for defensive awareness)
+- Conference talks and publications reveal architecture decisions
+
+### Technology Fingerprinting
+- Web technology stack: Wappalyzer patterns, HTTP headers, JavaScript libraries
+- Cloud provider identification via IP ranges and DNS
+- Email infrastructure: SPF, DKIM, DMARC records
+- Exposed management interfaces and development endpoints
+
+## Threat Modeling
+
+### STRIDE Model
+- **Spoofing**: Can an attacker impersonate a user, service, or component?
+- **Tampering**: Can data be modified in transit or at rest?
+- **Repudiation**: Can actions be performed without attribution?
+- **Information Disclosure**: Can sensitive data be exposed?
+- **Denial of Service**: Can availability be degraded?
+- **Elevation of Privilege**: Can an attacker gain unauthorized access?
+
+### Process
+1. Define the system scope and trust boundaries
+2. Decompose into components and data flows
+3. Identify threats per component using STRIDE
+4. Rate risk: likelihood x impact
+5. Prioritize mitigations by risk and cost
+6. Document accepted risks with justification
+
+## MITRE ATT&CK Mapping
+
+- Map observed behaviors to ATT&CK techniques
+- Use ATT&CK Navigator to visualize coverage and gaps
+- Prioritize detection for techniques used by relevant threat actors
+- Track technique prevalence in your sector
+- Map defensive controls to techniques they detect or prevent
+
+## Threat Actor Profiling
+
+- Categorize: nation-state, cybercrime, hacktivist, insider, opportunistic
+- Document: known TTPs, targeted sectors, infrastructure patterns, tooling
+- Track campaigns and attribute based on overlap in infrastructure, code, and behavior
+- Assess relevance to your organization's risk profile
+- Update profiles as new intelligence emerges
+
+## Intelligence Sharing
+
+### Standards
+- STIX 2.1 for structured threat intelligence objects
+- TAXII for automated exchange
+- OpenIOC for indicator sharing
+- TLP (Traffic Light Protocol) for classification: RED, AMBER, GREEN, CLEAR
+
+### Sources
+- Commercial feeds: CrowdStrike, Recorded Future, Mandiant
+- Open feeds: AlienVault OTX, Abuse.ch, PhishTank
+- ISACs and ISAOs for sector-specific intelligence
+- Government: CISA advisories, FBI flash alerts
+- Internal: your own incident data is the highest-fidelity source
+
+## Metrics
+
+- Intelligence-to-detection conversion rate
+- Time from IOC publication to operational deployment
+- Percentage of incidents with prior intelligence
+- Threat model coverage: components modeled vs total
+- False positive rate of intelligence-derived detections

package/skills/security/vuln-research.md

@@ -0,0 +1,87 @@
+<!--
+skills/security/vuln-research.md — Vulnerability Research — Use this skill when analyzing binaries, fuzzing software, or developing exploits
+
+Use this skill when analyzing binaries, fuzzing software, or developing exploits for security research. ## Binary Analysis
+-->
+# Vulnerability Research
+
+Use this skill when analyzing binaries, fuzzing software, or developing exploits for security research.
+
+## Binary Analysis
+
+### Static Analysis
+- Identify compiler, language, and build flags (stripped, PIE, stack canaries, RELRO)
+- Map function boundaries and call graph
+- Locate string references to identify functionality
+- Check security mitigations: NX, ASLR, stack protector, FORTIFY_SOURCE
+- Identify statically linked libraries and their versions
+
+### Dynamic Analysis
+- Trace system calls and library calls (strace, ltrace, dtrace)
+- Monitor file, network, and registry activity
+- Set breakpoints on interesting functions (malloc, free, recv, send, open)
+- Inspect memory layout at runtime: stack, heap, mapped regions
+- Use hardware breakpoints for anti-debug evasion
+
+## Fuzzing
+
+### Strategy
+- Coverage-guided fuzzing (AFL++, libFuzzer, Honggfuzz) for maximum code coverage
+- Grammar-based fuzzing for structured inputs (protocol buffers, file formats)
+- Mutation-based fuzzing for unknown formats
+- Seed corpus: collect real-world samples, minimize, then fuzz
+
+### Harness Design
+- Isolate the target function from the full program
+- Initialize state once, fuzz in a loop (persistent mode)
+- Sanitizers: AddressSanitizer, UndefinedBehaviorSanitizer, MemorySanitizer
+- Monitor for: crashes, hangs, memory leaks, assertion failures
+
+### Triage
+- Deduplicate crashes by stack hash
+- Minimize crash inputs to smallest reproducer
+- Classify: null deref, buffer overflow, use-after-free, integer overflow, type confusion
+- Determine exploitability: write-what-where, control of instruction pointer, heap corruption state
+
+## Memory Corruption
+
+### Stack Overflow
+- Overwrite return address, saved registers, or local variables
+- Bypass canaries: info leak, format string, brute force (forking servers)
+- ROP chains: find gadgets with ropper/ROPgadget, chain to control execution
+
+### Heap Exploitation
+- Use-after-free: control freed object's memory via replacement allocation
+- Heap overflow: corrupt adjacent chunk metadata or application data
+- Double free: manipulate allocator free list
+- Technique selection depends on allocator: ptmalloc (glibc), jemalloc, tcmalloc, Windows heap
+
+### Format String
+- Read: `%x` to leak stack values, `%s` to read pointers
+- Write: `%n` to write to arbitrary addresses
+- Use direct parameter access (`%7$x`) for precise targeting
+
+### Integer Vulnerabilities
+- Overflow/underflow leading to undersized allocations
+- Sign confusion between signed and unsigned comparisons
+- Truncation when casting between different-width types
+
+## Exploit Development
+
+- Determine target: return address, function pointer, vtable, GOT entry
+- Build primitives: arbitrary read, arbitrary write, code execution
+- Defeat mitigations:
+  - ASLR: information leak to disclose base addresses
+  - NX/DEP: ROP, JIT spraying, code reuse
+  - Stack canary: leak via info disclosure or brute force
+  - CFI: find valid call targets that enable further exploitation
+- Test reliability across runs and environments
+- Document the full exploit chain
+
+## Responsible Disclosure
+
+- Follow coordinated disclosure timelines (typically 90 days)
+- Report to vendor security contact or bug bounty program
+- Provide clear reproduction steps and impact assessment
+- Do not publish exploit code before patch is available
+- Request CVE assignment through CNA or MITRE

package/skills/utility/clean-code.md

@@ -0,0 +1,165 @@
+<!--
+skills/utility/clean-code.md — AI Slop Removal — Patterns and heuristics for identifying and removing AI-generated code smells. U
+
+Patterns and heuristics for identifying and removing AI-generated code smells. Use when cleaning up output from AI coding tools. ## Decision Tree
+-->
+# AI Slop Removal
+
+Patterns and heuristics for identifying and removing AI-generated code smells. Use when cleaning up output from AI coding tools.
+
+## Decision Tree
+
+```
+Is this comment derivable from the function/variable name?
+  YES → Delete it
+
+Is this variable named result, data, temp, item, obj, value, or response?
+  YES → Rename to reflect what it actually contains
+
+Is this a function that only calls one other function with no transformation?
+  YES → Inline it at the call site
+
+Is this a TODO/FIXME comment older than one session, or referencing cleanup that never happened?
+  YES → Delete the comment and the dead code it describes
+
+Is this catch block empty, returning null, or logging a generic "error occurred" message?
+  YES → Fix: propagate, rethrow with context, or log the actual error
+
+Is this docstring/JSDoc restating the parameter names without adding information?
+  YES → Delete it
+```
+
+## 11 Smell Categories
+
+### 1. Obvious Comments
+Comments that restate what the code already says.
+```
+// BEFORE
+// This function returns the sum of two numbers
+function add(a, b) { return a + b; }
+
+// AFTER
+function add(a, b) { return a + b; }
+```
+
+### 2. Hedging Variable Names
+Generic names that hide what the value represents.
+```
+// BEFORE
+const result = await fetchUser(id);
+const data = result.profile;
+
+// AFTER
+const user = await fetchUser(id);
+const profile = user.profile;
+```
+
+### 3. Debug Artifacts
+Leftover logging from development.
+```
+// BEFORE
+console.log('entering loop', items);
+for (const item of items) { ... }
+
+// AFTER
+for (const item of items) { ... }
+```
+
+### 4. Unnecessary Wrappers
+Functions that only delegate without adding value.
+```
+// BEFORE
+function getUser(id) { return userService.findById(id); }
+
+// AFTER (inline at call site)
+const user = await userService.findById(id);
+```
+
+### 5. Dead TODO Blocks
+Stale markers and commented-out code.
+```
+// BEFORE
+// TODO: remove this once the replacement flow ships
+// const unusedUser = transformDraft(raw);
+
+// AFTER
+(deleted)
+```
+
+### 6. Restated Types
+Type annotations that repeat the variable name.
+```
+// BEFORE
+const userList: User[] = [];
+const isLoadingFlag: boolean = false;
+
+// AFTER
+const users: User[] = [];
+const isLoading = false;
+```
+
+### 7. Over-specified Test Assertions
+Tests verifying implementation instead of behavior.
+```
+// BEFORE
+expect(result.constructor.name).toBe('UserService');
+expect(spy).toHaveBeenCalledWith(expect.objectContaining({ method: 'findById' }));
+
+// AFTER
+expect(result).toEqual(expectedUser);
+```
+
+### 8. Swallowed Errors
+Catch blocks that discard context.
+```
+// BEFORE
+try { await saveUser(user); } catch (e) { return null; }
+
+// AFTER
+try { await saveUser(user); } catch (e) {
+  throw new Error(`Failed to save user ${user.id}: ${e.message}`);
+}
+```
+
+### 9. Single-Use Abstractions
+Helpers created for one call site.
+```
+// BEFORE
+function buildUserQuery(id) { return { where: { id } }; }
+const user = await db.user.findFirst(buildUserQuery(userId));
+
+// AFTER
+const user = await db.user.findFirst({ where: { id: userId } });
+```
+
+### 10. Padded Error Messages
+Verbose error strings that obscure the actual failure.
+```
+// BEFORE
+throw new Error('An unexpected error occurred while attempting to process the user authentication request');
+
+// AFTER
+throw new Error(`Authentication failed for user ${userId}`);
+```
+
+### 11. Boilerplate Docstrings
+Documentation that adds no information.
+```
+// BEFORE
+/**
+ * Gets the user by ID.
+ * @param id - The user ID
+ * @returns The user
+ */
+async function getUserById(id: string): Promise<User> { ... }
+
+// AFTER
+async function getUserById(id: string): Promise<User> { ... }
+```
+
+## Rules
+
+- Remove smell, nothing else. Do not refactor, reorganize, or add new abstractions.
+- Keep diffs minimal — one smell per change where possible.
+- Never change behavior. If a removal would change behavior, flag it instead.
+- Show before/after for every change.