@harness-engineering/cli 1.23.1 → 1.24.0

package/dist/agents/skills/cursor/owasp-cryptography/SKILL.md

@@ -0,0 +1,191 @@
+# Cryptography Best Practices
+
+> Apply cryptographic best practices for password hashing, data encryption, digital signing, and key management
+
+## When to Use
+
+- Hashing passwords for storage
+- Encrypting sensitive data at rest or in transit
+- Generating and verifying digital signatures or HMACs
+- Choosing between encryption algorithms
+- Managing encryption keys and initialization vectors
+
+## Instructions
+
+1. **Use bcrypt or Argon2 for password hashing.** Never use MD5, SHA-1, or SHA-256 alone for passwords — they are too fast and vulnerable to brute force. Use a purpose-built password hashing function with built-in salting and configurable cost.
+
+```typescript
+import bcrypt from 'bcrypt';
+
+const SALT_ROUNDS = 12; // Adjust for ~250ms hash time on your hardware
+
+async function hashPassword(plaintext: string): Promise<string> {
+  return bcrypt.hash(plaintext, SALT_ROUNDS);
+}
+
+async function verifyPassword(plaintext: string, hash: string): Promise<boolean> {
+  return bcrypt.compare(plaintext, hash);
+}
+```
+
+For higher security requirements, use Argon2id:
+
+```typescript
+import argon2 from 'argon2';
+
+async function hashPassword(plaintext: string): Promise<string> {
+  return argon2.hash(plaintext, {
+    type: argon2.argon2id,
+    memoryCost: 65536, // 64 MB
+    timeCost: 3,
+    parallelism: 4,
+  });
+}
+```
+
+2. **Use AES-256-GCM for symmetric encryption.** GCM provides both confidentiality and authenticity (authenticated encryption). Always use a unique IV for every encryption operation.
+
+```typescript
+import crypto from 'node:crypto';
+
+const ALGORITHM = 'aes-256-gcm';
+const IV_LENGTH = 12; // 96 bits for GCM
+const TAG_LENGTH = 16; // 128 bits
+
+function encrypt(plaintext: string, key: Buffer): string {
+  const iv = crypto.randomBytes(IV_LENGTH);
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv, { authTagLength: TAG_LENGTH });
+
+  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
+  const tag = cipher.getAuthTag();
+
+  // Prepend IV and tag to ciphertext for storage
+  return Buffer.concat([iv, tag, encrypted]).toString('base64');
+}
+
+function decrypt(encoded: string, key: Buffer): string {
+  const data = Buffer.from(encoded, 'base64');
+  const iv = data.subarray(0, IV_LENGTH);
+  const tag = data.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
+  const ciphertext = data.subarray(IV_LENGTH + TAG_LENGTH);
+
+  const decipher = crypto.createDecipheriv(ALGORITHM, key, iv, { authTagLength: TAG_LENGTH });
+  decipher.setAuthTag(tag);
+
+  return decipher.update(ciphertext) + decipher.final('utf8');
+}
+```
+
+3. **Generate cryptographically secure random values.** Use `crypto.randomBytes()` or `crypto.randomUUID()` — never `Math.random()` for security purposes.
+
+```typescript
+import crypto from 'node:crypto';
+
+// Random bytes for keys, IVs, tokens
+const token = crypto.randomBytes(32).toString('hex');
+
+// Random UUID
+const id = crypto.randomUUID();
+```
+
+4. **Use HMAC for data integrity verification.** HMAC combines a hash function with a secret key to produce a message authentication code.
+
+```typescript
+function createHmac(data: string, secret: string): string {
+  return crypto.createHmac('sha256', secret).update(data).digest('hex');
+}
+
+function verifyHmac(data: string, secret: string, expectedMac: string): boolean {
+  const computed = createHmac(data, secret);
+  return crypto.timingSafeEqual(Buffer.from(computed), Buffer.from(expectedMac));
+}
+```
+
+5. **Always use timing-safe comparison for secrets.** Never compare hashes, tokens, or MACs with `===` — it is vulnerable to timing attacks. Use `crypto.timingSafeEqual()`.
+
+```typescript
+function safeCompare(a: string, b: string): boolean {
+  if (a.length !== b.length) return false;
+  return crypto.timingSafeEqual(Buffer.from(a), Buffer.from(b));
+}
+```
+
+6. **Derive encryption keys from passwords with PBKDF2 or scrypt.** Never use a password directly as an encryption key.
+
+```typescript
+function deriveKey(password: string, salt: Buffer): Promise<Buffer> {
+  return new Promise((resolve, reject) => {
+    crypto.scrypt(password, salt, 32, { N: 16384, r: 8, p: 1 }, (err, key) => {
+      if (err) reject(err);
+      else resolve(key);
+    });
+  });
+}
+```
+
+7. **Use RSA or Ed25519 for asymmetric operations (signing, key exchange).**
+
+```typescript
+// Generate key pair
+const { publicKey, privateKey } = crypto.generateKeyPairSync('ed25519');
+
+// Sign
+const signature = crypto.sign(null, Buffer.from(data), privateKey);
+
+// Verify
+const isValid = crypto.verify(null, Buffer.from(data), publicKey, signature);
+```
+
+8. **Rotate encryption keys periodically.** Implement key versioning — store the key version with encrypted data so you know which key to use for decryption.
+
+```typescript
+interface EncryptedField {
+  keyVersion: number;
+  ciphertext: string;
+}
+```
+
+## Details
+
+**Algorithm selection guide:**
+| Purpose | Recommended | Avoid |
+|---|---|---|
+| Password hashing | Argon2id, bcrypt, scrypt | MD5, SHA-\*, plain text |
+| Symmetric encryption | AES-256-GCM | AES-ECB, DES, 3DES, RC4 |
+| Hashing (non-password) | SHA-256, SHA-3 | MD5, SHA-1 |
+| Signing | Ed25519, RSA-PSS (2048+) | RSA-PKCS1v15 |
+| Key derivation | scrypt, PBKDF2 (600K+ iterations) | Single-pass hash |
+| Random generation | crypto.randomBytes | Math.random |
+
+**Why GCM over CBC:** GCM is an authenticated encryption mode — it detects tampering. CBC requires a separate HMAC step for integrity, and incorrect implementations lead to padding oracle attacks.
+
+**IV/nonce rules:** Never reuse an IV with the same key. For AES-GCM, IV reuse completely breaks security. Generate a random IV for every encrypt call.
+
+**Common mistakes:**
+
+- Using MD5 or SHA-256 for password hashing (too fast, no salting)
+- Reusing IVs/nonces with the same key
+- Comparing secrets with `===` instead of `timingSafeEqual`
+- Hardcoding encryption keys in source code
+- Using ECB mode (encrypts identical blocks to identical ciphertext — patterns visible)
+- Rolling your own crypto instead of using well-tested libraries
+
+## Source
+
+https://cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet.html
+
+## Process
+
+1. Read the instructions and examples in this document.
+2. Apply the patterns to your implementation, adapting to your specific context.
+3. Verify your implementation against the details and edge cases listed above.
+
+## Harness Integration
+
+- **Type:** knowledge — this skill is a reference document, not a procedural workflow.
+- **No tools or state** — consumed as context by other skills and agents.
+
+## Success Criteria
+
+- The patterns described in this document are applied correctly in the implementation.
+- Edge cases and anti-patterns listed in this document are avoided.

package/dist/agents/skills/cursor/owasp-cryptography/skill.yaml

@@ -0,0 +1,42 @@
+name: owasp-cryptography
+version: '1.0.0'
+description: Apply cryptographic best practices for hashing, encryption, signing, and key management
+cognitive_mode: advisory-guide
+type: knowledge
+tier: 3
+triggers:
+  - manual
+platforms:
+  - claude-code
+  - gemini-cli
+  - cursor
+  - codex
+tools: []
+paths:
+  - '**/auth/**'
+  - '**/security/**'
+  - '**/middleware/**'
+  - '**/crypto/**'
+related_skills:
+  - owasp-secrets-management
+  - owasp-auth-patterns
+stack_signals:
+  - nodejs
+  - typescript
+  - security
+keywords:
+  - cryptography
+  - hashing
+  - encryption
+  - bcrypt
+  - aes
+  - jwt
+  - hmac
+  - key-derivation
+metadata:
+  author: community
+  upstream: cheatsheetseries.owasp.org/cheatsheets/Cryptographic_Storage_Cheat_Sheet
+state:
+  persistent: false
+  files: []
+depends_on: []

package/dist/agents/skills/cursor/owasp-csrf-protection/SKILL.md

@@ -0,0 +1,175 @@
+# OWASP CSRF Protection
+
+> Prevent cross-site request forgery by validating request origin and requiring unpredictable tokens for state-changing operations
+
+## When to Use
+
+- Building any application that uses cookie-based session authentication
+- Implementing state-changing API endpoints (POST, PUT, DELETE, PATCH)
+- Setting session cookie attributes
+- Adding CSRF middleware to an Express or NestJS application
+- Auditing forms and AJAX requests for missing CSRF protection
+
+## Instructions
+
+### SameSite Cookies — First Line of Defense
+
+Modern browsers support `SameSite=Strict` or `SameSite=Lax` which blocks CSRF for most cases:
+
+```typescript
+res.cookie('session_id', sessionId, {
+  httpOnly: true,
+  secure: true,
+  sameSite: 'strict', // cross-site requests never send this cookie
+  maxAge: 15 * 60 * 1000,
+});
+```
+
+- `Strict` — cookie never sent on cross-site requests (strongest, may break OAuth flows)
+- `Lax` — cookie sent on top-level GET navigations, not POST; good balance
+- `None` — must pair with `Secure: true` and add CSRF tokens
+
+### Synchronizer Token Pattern
+
+For forms and traditional server-rendered pages:
+
+```typescript
+import csrf from 'csurf';
+
+// Express — csurf middleware
+const csrfProtection = csrf({ cookie: { sameSite: 'strict', httpOnly: true } });
+
+app.get('/form', csrfProtection, (req, res) => {
+  // Pass token to the template
+  res.render('form', { csrfToken: req.csrfToken() });
+});
+
+app.post('/submit', csrfProtection, (req, res) => {
+  // csurf validates _csrf field automatically
+  res.json({ ok: true });
+});
+```
+
+```html
+<!-- Include hidden CSRF field in every form -->
+<form method="POST" action="/submit">
+  <input type="hidden" name="_csrf" value="<%= csrfToken %>" />
+  <!-- form fields -->
+</form>
+```
+
+### Double-Submit Cookie Pattern (Stateless APIs)
+
+For SPAs where the backend is stateless:
+
+```typescript
+import crypto from 'crypto';
+
+function csrfMiddleware(req: Request, res: Response, next: NextFunction) {
+  if (['GET', 'HEAD', 'OPTIONS'].includes(req.method)) return next();
+
+  const cookieToken = req.cookies['csrf-token'];
+  const headerToken = req.headers['x-csrf-token'];
+
+  if (!cookieToken || !headerToken || cookieToken !== headerToken) {
+    return res.status(403).json({ error: 'CSRF validation failed' });
+  }
+  next();
+}
+
+// On session creation, set the cookie
+function setCSRFCookie(res: Response) {
+  const token = crypto.randomBytes(32).toString('hex');
+  res.cookie('csrf-token', token, {
+    secure: true,
+    sameSite: 'strict',
+    // NOT httpOnly — frontend JS must be able to read it
+  });
+}
+```
+
+```typescript
+// SPA — send CSRF token on every mutating request
+const csrfToken = document.cookie
+  .split('; ')
+  .find((row) => row.startsWith('csrf-token='))
+  ?.split('=')[1];
+
+fetch('/api/update', {
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    'X-CSRF-Token': csrfToken ?? '',
+  },
+  body: JSON.stringify(data),
+});
+```
+
+### Origin Header Validation
+
+Simplest approach for API-only backends that don't serve HTML:
+
+```typescript
+const ALLOWED_ORIGINS = new Set(['https://app.example.com', 'https://www.example.com']);
+
+function originValidator(req: Request, res: Response, next: NextFunction) {
+  if (['GET', 'HEAD', 'OPTIONS'].includes(req.method)) return next();
+
+  const origin = req.headers.origin || req.headers.referer;
+  if (!origin) return res.status(403).json({ error: 'Missing origin' });
+
+  const url = new URL(origin);
+  const originBase = `${url.protocol}//${url.host}`;
+
+  if (!ALLOWED_ORIGINS.has(originBase)) {
+    return res.status(403).json({ error: 'Invalid origin' });
+  }
+  next();
+}
+```
+
+## Details
+
+**CSRF is only possible when:**
+
+1. The browser automatically sends credentials (cookies, Basic auth) with cross-origin requests
+2. The server cannot distinguish legitimate from forged requests
+
+**APIs using Bearer tokens in Authorization header are immune to CSRF** — browsers do not automatically send Authorization headers cross-origin. Only protect cookie-authenticated routes.
+
+**Defense selection guide:**
+
+- Cookie session app → `SameSite=Strict` + CSRF token
+- SPA + cookie session → `SameSite=Strict` + double-submit cookie
+- REST API + Bearer JWT → no CSRF protection needed
+- Server-rendered forms → synchronizer token pattern
+
+**NestJS — CsrfGuard:**
+
+```typescript
+import { CsrfGuard } from '@tekuconcept/nestjs-csrf';
+
+@UseGuards(CsrfGuard)
+@Post('transfer')
+transfer(@Body() dto: TransferDto) { ... }
+```
+
+## Source
+
+https://owasp.org/www-project-top-ten/
+
+## Process
+
+1. Read the instructions and examples in this document.
+2. Apply the patterns to your implementation, adapting to your specific context.
+3. Verify your implementation against the details and edge cases listed above.
+
+## Harness Integration
+
+- **Type:** knowledge — this skill is a reference document, not a procedural workflow.
+- **No tools or state** — consumed as context by other skills and agents.
+
+## Success Criteria
+
+- The patterns described in this document are applied correctly in the implementation.
+- Edge cases and anti-patterns listed in this document are avoided.

package/dist/agents/skills/cursor/owasp-csrf-protection/skill.yaml

@@ -0,0 +1,42 @@
+name: owasp-csrf-protection
+version: "1.0.0"
+description: Defend state-changing endpoints with CSRF tokens, SameSite cookies, and origin validation
+cognitive_mode: advisory-guide
+type: knowledge
+tier: 3
+triggers:
+  - manual
+platforms:
+  - claude-code
+  - gemini-cli
+  - cursor
+  - codex
+tools: []
+paths:
+  - "**/auth/**"
+  - "**/security/**"
+  - "**/middleware/**"
+  - "**/guards/**"
+related_skills:
+  - owasp-auth-patterns
+  - owasp-security-headers
+  - nestjs-guards-pattern
+stack_signals:
+  - nodejs
+  - typescript
+  - security
+keywords:
+  - csrf
+  - cross-site-request-forgery
+  - samesite
+  - csrf-tokens
+  - double-submit-cookie
+  - origin-validation
+  - owasp
+metadata:
+  author: community
+  upstream: "owasp.org/www-project-top-ten/"
+state:
+  persistent: false
+  files: []
+depends_on: []

package/dist/agents/skills/cursor/owasp-dependency-security/SKILL.md

@@ -0,0 +1,173 @@
+# Dependency Security
+
+> Manage third-party dependency risks with auditing, lockfiles, automated scanning, and supply chain hardening
+
+## When to Use
+
+- Adding new dependencies to a project
+- Setting up automated vulnerability scanning in CI
+- Responding to a CVE in a dependency
+- Reviewing the dependency tree for unnecessary packages
+- Hardening the supply chain against typosquatting and malicious packages
+
+## Instructions
+
+1. **Run `npm audit` regularly and in CI.** It checks installed packages against the npm advisory database for known vulnerabilities.
+
+```bash
+# Check for vulnerabilities
+npm audit
+
+# Fix automatically where possible
+npm audit fix
+
+# Only report high and critical severity
+npm audit --audit-level=high
+
+# CI gate — fail build on high/critical vulnerabilities
+npm audit --audit-level=high --production
+```
+
+2. **Always commit lockfiles.** `package-lock.json`, `yarn.lock`, or `pnpm-lock.yaml` pin exact dependency versions. Without a lockfile, `npm install` can silently install different (potentially compromised) versions.
+
+3. **Set up automated dependency updates with Dependabot or Renovate.**
+
+```yaml
+# .github/dependabot.yml
+version: 2
+updates:
+  - package-ecosystem: npm
+    directory: /
+    schedule:
+      interval: weekly
+    open-pull-requests-limit: 10
+    groups:
+      dev-dependencies:
+        dependency-type: development
+        update-types: [minor, patch]
+      production-dependencies:
+        dependency-type: production
+        update-types: [patch]
+    ignore:
+      - dependency-name: '*'
+        update-types: ['version-update:semver-major']
+```
+
+4. **Review new dependencies before adding them.** Check these criteria:
+
+```bash
+# Check package health signals
+npm info <package> # Last publish date, maintainers, weekly downloads
+npx is-my-dep-secure <package> # Security audit
+
+# Manual checklist:
+# - Actively maintained? (commits within last 6 months)
+# - Trusted maintainer? (known individual or organization)
+# - Reasonable download count? (not a typosquat of a popular package)
+# - Small dependency tree? (fewer transitive deps = smaller attack surface)
+# - License compatible? (MIT, Apache-2.0, ISC are safe for commercial use)
+```
+
+5. **Use `--ignore-scripts` for untrusted packages.** Postinstall scripts can execute arbitrary code. Disable them globally and whitelist trusted packages.
+
+```bash
+# Disable all lifecycle scripts globally
+npm config set ignore-scripts true
+
+# Allow specific packages
+npx allow-scripts
+
+# Or use package.json
+{
+  "scripts": {
+    "preinstall": "npx only-allow pnpm"
+  }
+}
+```
+
+6. **Pin critical production dependencies.** For security-sensitive packages (auth, crypto, parsing), use exact versions instead of semver ranges.
+
+```json
+{
+  "dependencies": {
+    "jsonwebtoken": "9.0.2",
+    "bcrypt": "5.1.1",
+    "helmet": "7.1.0"
+  }
+}
+```
+
+7. **Monitor for vulnerabilities continuously.** Use GitHub's security alerts, Snyk, or Socket.dev for real-time notifications when new CVEs affect your dependencies.
+
+```yaml
+# GitHub Actions — run audit on every PR
+- name: Security audit
+  run: npm audit --audit-level=high --production
+```
+
+8. **Remove unused dependencies.** Dead dependencies still introduce risk. Use `depcheck` to find unused packages.
+
+```bash
+npx depcheck
+# Lists unused dependencies, missing dependencies, and unused devDependencies
+```
+
+9. **Use Subresource Integrity (SRI) for CDN-loaded scripts.** If loading JavaScript from a CDN, use `integrity` attributes to verify the script has not been tampered with.
+
+```html
+<script
+  src="https://cdn.example.com/lib.js"
+  integrity="sha384-abc123..."
+  crossorigin="anonymous"
+></script>
+```
+
+10. **Keep Node.js itself updated.** The runtime has its own vulnerability history. Use LTS versions and update when security patches are released.
+
+## Details
+
+**Supply chain attack vectors:**
+
+- **Typosquatting:** `lodas` instead of `lodash` — a malicious package with a similar name
+- **Dependency confusion:** A public package with the same name as an internal package — npm may pull the public one
+- **Maintainer compromise:** Legitimate package maintainer's account is hacked (e.g., event-stream incident)
+- **Malicious postinstall scripts:** Code runs during `npm install` before you ever import the package
+
+**Dependency confusion prevention:** Use scoped packages (`@company/utils`), configure `.npmrc` to point to your private registry for scoped packages, and use `npm-package-arg` to detect resolution anomalies.
+
+```ini
+# .npmrc
+@company:registry=https://npm.company.com/
+```
+
+**SBOM (Software Bill of Materials):** Generate an SBOM for compliance and audit trails. Use `cyclonedx-npm` or `spdx-sbom-generator` to produce machine-readable dependency inventories.
+
+**When to accept audit findings:** Some vulnerabilities are in dev dependencies that never run in production, or in code paths your application does not exercise. Document accepted risks rather than ignoring them silently.
+
+**Common mistakes:**
+
+- Ignoring `npm audit` output because "everything still works"
+- Not committing the lockfile (different installs on different machines)
+- Using `npm audit fix --force` without reviewing breaking changes
+- Installing packages from unverified registries
+- Running `npm install` in production instead of `npm ci` (lockfile not respected)
+
+## Source
+
+https://cheatsheetseries.owasp.org/cheatsheets/Vulnerable_and_Outdated_Components_Cheat_Sheet.html
+
+## Process
+
+1. Read the instructions and examples in this document.
+2. Apply the patterns to your implementation, adapting to your specific context.
+3. Verify your implementation against the details and edge cases listed above.
+
+## Harness Integration
+
+- **Type:** knowledge — this skill is a reference document, not a procedural workflow.
+- **No tools or state** — consumed as context by other skills and agents.
+
+## Success Criteria
+
+- The patterns described in this document are applied correctly in the implementation.
+- Edge cases and anti-patterns listed in this document are avoided.

package/dist/agents/skills/cursor/owasp-dependency-security/skill.yaml

@@ -0,0 +1,41 @@
+name: owasp-dependency-security
+version: '1.0.0'
+description: Manage third-party dependency risks with auditing, lockfiles, and vulnerability scanning
+cognitive_mode: advisory-guide
+type: knowledge
+tier: 3
+triggers:
+  - manual
+platforms:
+  - claude-code
+  - gemini-cli
+  - cursor
+  - codex
+tools: []
+paths:
+  - '**/package.json'
+  - '**/package-lock.json'
+  - '**/yarn.lock'
+  - '**/pnpm-lock.yaml'
+related_skills:
+  - owasp-secrets-management
+  - owasp-logging-monitoring
+stack_signals:
+  - nodejs
+  - typescript
+  - security
+keywords:
+  - dependencies
+  - vulnerabilities
+  - npm-audit
+  - supply-chain
+  - lockfile
+  - snyk
+  - dependabot
+metadata:
+  author: community
+  upstream: cheatsheetseries.owasp.org/cheatsheets/Vulnerable_and_Outdated_Components
+state:
+  persistent: false
+  files: []
+depends_on: []