@harness-engineering/cli 1.23.2 → 1.24.0

package/dist/agents/skills/gemini-cli/owasp-secrets-management/skill.yaml

@@ -0,0 +1,44 @@
+name: owasp-secrets-management
+version: "1.0.0"
+description: Manage secrets safely via env vars and secrets managers, never logging or hardcoding credentials
+cognitive_mode: advisory-guide
+type: knowledge
+tier: 3
+triggers:
+  - manual
+platforms:
+  - claude-code
+  - gemini-cli
+  - cursor
+  - codex
+tools: []
+paths:
+  - "**/auth/**"
+  - "**/security/**"
+  - "**/middleware/**"
+  - "**/guards/**"
+  - "**/config/**"
+related_skills:
+  - owasp-logging-monitoring
+  - owasp-cryptography
+  - nestjs-guards-pattern
+stack_signals:
+  - nodejs
+  - typescript
+  - security
+keywords:
+  - secrets
+  - secrets-manager
+  - environment-variables
+  - credentials
+  - api-keys
+  - vault
+  - rotation
+  - owasp
+metadata:
+  author: community
+  upstream: "owasp.org/www-project-top-ten/"
+state:
+  persistent: false
+  files: []
+depends_on: []

package/dist/agents/skills/gemini-cli/owasp-security-headers/SKILL.md

@@ -0,0 +1,221 @@
+# HTTP Security Headers
+
+> Configure HTTP security headers to protect against XSS, clickjacking, MIME sniffing, and information leakage
+
+## When to Use
+
+- Setting up a new web application or API
+- Hardening an existing application's HTTP responses
+- Implementing Content Security Policy (CSP)
+- Preventing clickjacking, MIME sniffing, and protocol downgrade attacks
+- Preparing for a security audit or penetration test
+
+## Instructions
+
+1. **Use Helmet.js to set secure defaults.** Helmet configures most security headers with sensible defaults in one line.
+
+```bash
+npm install helmet
+```
+
+```typescript
+import helmet from 'helmet';
+
+app.use(helmet());
+```
+
+This sets: `Content-Security-Policy`, `Cross-Origin-Embedder-Policy`, `Cross-Origin-Opener-Policy`, `Cross-Origin-Resource-Policy`, `X-DNS-Prefetch-Control`, `X-Frame-Options`, `Strict-Transport-Security`, `X-Download-Options`, `X-Content-Type-Options`, `Origin-Agent-Cluster`, `X-Permitted-Cross-Domain-Policies`, `Referrer-Policy`, `X-XSS-Protection` (disabled — see below).
+
+2. **Configure Content-Security-Policy (CSP) explicitly.** CSP is the most important security header. It controls which resources the browser is allowed to load, preventing XSS and data injection.
+
+```typescript
+app.use(
+  helmet({
+    contentSecurityPolicy: {
+      directives: {
+        defaultSrc: ["'self'"],
+        scriptSrc: ["'self'", "'strict-dynamic'"],
+        styleSrc: ["'self'", "'unsafe-inline'"], // Inline styles needed for most UI frameworks
+        imgSrc: ["'self'", 'data:', 'https://cdn.example.com'],
+        fontSrc: ["'self'", 'https://fonts.gstatic.com'],
+        connectSrc: ["'self'", 'https://api.example.com'],
+        frameSrc: ["'none'"],
+        objectSrc: ["'none'"],
+        baseUri: ["'self'"],
+        formAction: ["'self'"],
+        upgradeInsecureRequests: [],
+      },
+    },
+  })
+);
+```
+
+3. **Enable Strict-Transport-Security (HSTS)** to force HTTPS for all future requests.
+
+```typescript
+app.use(
+  helmet({
+    strictTransportSecurity: {
+      maxAge: 63072000, // 2 years in seconds
+      includeSubDomains: true,
+      preload: true, // Submit to HSTS preload list
+    },
+  })
+);
+```
+
+After enabling, submit your domain to https://hstspreload.org/ for inclusion in browser preload lists.
+
+4. **Prevent clickjacking with `X-Frame-Options` and `frame-ancestors` CSP directive.**
+
+```typescript
+// X-Frame-Options (legacy, but still needed for older browsers)
+// Set by Helmet: SAMEORIGIN by default
+
+// CSP frame-ancestors (modern, preferred)
+contentSecurityPolicy: {
+  directives: {
+    frameAncestors: ["'self'"], // Or "'none'" to block all framing
+  },
+}
+```
+
+5. **Prevent MIME type sniffing with `X-Content-Type-Options: nosniff`.** Without this, browsers may interpret a file as a different MIME type than declared, enabling XSS via uploaded files.
+
+```
+X-Content-Type-Options: nosniff
+```
+
+Set by Helmet by default. Ensure all responses include correct `Content-Type` headers.
+
+6. **Control referrer information with `Referrer-Policy`.** Prevent leaking URLs (which may contain tokens or sensitive data) in the `Referer` header.
+
+```typescript
+app.use(
+  helmet({
+    referrerPolicy: { policy: 'strict-origin-when-cross-origin' },
+  })
+);
+```
+
+Options from most restrictive to least:
+
+- `no-referrer` — never send referrer
+- `same-origin` — send referrer only for same-origin requests
+- `strict-origin-when-cross-origin` (recommended) — full URL for same-origin, origin only for cross-origin HTTPS, nothing for downgrades
+- `origin` — send only the origin, not the full URL
+
+7. **Set `Permissions-Policy` to disable unnecessary browser features.**
+
+```typescript
+app.use((req, res, next) => {
+  res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=(), payment=(self)');
+  next();
+});
+```
+
+This prevents embedded third-party content from accessing device APIs even if your page includes it.
+
+8. **Set Cross-Origin headers for isolation.**
+
+```typescript
+// Prevent your resources from being loaded by other origins
+res.setHeader('Cross-Origin-Resource-Policy', 'same-origin');
+
+// Prevent other pages from getting a reference to your window
+res.setHeader('Cross-Origin-Opener-Policy', 'same-origin');
+```
+
+9. **Remove headers that leak server information.**
+
+```typescript
+app.disable('x-powered-by'); // Removes "X-Powered-By: Express"
+// Also remove Server header at the reverse proxy level
+```
+
+10. **Deploy CSP in report-only mode first** to identify violations before enforcing.
+
+```typescript
+app.use(
+  helmet({
+    contentSecurityPolicy: {
+      directives: {
+        // ... your policy
+        reportUri: '/api/csp-report',
+      },
+      reportOnly: true, // Log violations without blocking
+    },
+  })
+);
+
+// Collect CSP violation reports
+app.post('/api/csp-report', express.json({ type: 'application/csp-report' }), (req, res) => {
+  logger.warn({ event: 'csp.violation', report: req.body }, 'CSP violation');
+  res.sendStatus(204);
+});
+```
+
+## Details
+
+**Essential headers checklist:**
+
+| Header                       | Purpose                          | Value                                          |
+| ---------------------------- | -------------------------------- | ---------------------------------------------- |
+| Content-Security-Policy      | XSS prevention, resource control | `default-src 'self'; script-src 'self'`        |
+| Strict-Transport-Security    | Force HTTPS                      | `max-age=63072000; includeSubDomains; preload` |
+| X-Content-Type-Options       | Prevent MIME sniffing            | `nosniff`                                      |
+| X-Frame-Options              | Prevent clickjacking             | `DENY` or `SAMEORIGIN`                         |
+| Referrer-Policy              | Control referrer leakage         | `strict-origin-when-cross-origin`              |
+| Permissions-Policy           | Disable unused browser APIs      | `camera=(), microphone=()`                     |
+| Cross-Origin-Opener-Policy   | Window isolation                 | `same-origin`                                  |
+| Cross-Origin-Resource-Policy | Resource isolation               | `same-origin`                                  |
+
+**CSP `'strict-dynamic'` explained:** When `'strict-dynamic'` is present in `script-src`, dynamically created scripts inherit trust from the script that created them. This allows legitimate runtime-generated scripts (bundler chunks, lazy-loaded modules) while still blocking injected scripts. Pair with nonce-based CSP for maximum security.
+
+**Nonce-based CSP for inline scripts:**
+
+```typescript
+app.use((req, res, next) => {
+  const nonce = crypto.randomBytes(16).toString('base64');
+  res.locals.cspNonce = nonce;
+  res.setHeader('Content-Security-Policy', `script-src 'nonce-${nonce}' 'strict-dynamic'`);
+  next();
+});
+```
+
+```html
+<script nonce="<%= cspNonce %>">
+  /* inline script is allowed */
+</script>
+```
+
+**API-only applications:** For APIs that do not serve HTML, a minimal header set suffices: `X-Content-Type-Options: nosniff`, `Strict-Transport-Security`, `Cache-Control: no-store` (for sensitive data), and `Content-Type: application/json`.
+
+**Testing headers:** Use https://securityheaders.com or https://observatory.mozilla.org to scan your application and get a grade.
+
+**Common mistakes:**
+
+- Setting CSP to `'unsafe-inline' 'unsafe-eval'` (defeats the purpose of CSP)
+- Not testing CSP before enforcing (breaks legitimate functionality)
+- Missing HSTS on API subdomains (cookie theft via HTTP)
+- Setting `X-Frame-Options: ALLOW-FROM` (deprecated, unsupported in modern browsers — use `frame-ancestors`)
+
+## Source
+
+https://cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet.html
+
+## Process
+
+1. Read the instructions and examples in this document.
+2. Apply the patterns to your implementation, adapting to your specific context.
+3. Verify your implementation against the details and edge cases listed above.
+
+## Harness Integration
+
+- **Type:** knowledge — this skill is a reference document, not a procedural workflow.
+- **No tools or state** — consumed as context by other skills and agents.
+
+## Success Criteria
+
+- The patterns described in this document are applied correctly in the implementation.
+- Edge cases and anti-patterns listed in this document are avoided.

package/dist/agents/skills/gemini-cli/owasp-security-headers/skill.yaml

@@ -0,0 +1,40 @@
+name: owasp-security-headers
+version: '1.0.0'
+description: Configure HTTP security headers to protect against XSS, clickjacking, MIME sniffing, and data leaks
+cognitive_mode: advisory-guide
+type: knowledge
+tier: 3
+triggers:
+  - manual
+platforms:
+  - claude-code
+  - gemini-cli
+  - cursor
+  - codex
+tools: []
+paths:
+  - '**/middleware/**'
+  - '**/security/**'
+  - '**/server.*'
+related_skills:
+  - owasp-xss-prevention
+  - owasp-csrf-protection
+stack_signals:
+  - nodejs
+  - typescript
+  - security
+keywords:
+  - security-headers
+  - csp
+  - helmet
+  - hsts
+  - clickjacking
+  - content-security-policy
+  - x-frame-options
+metadata:
+  author: community
+  upstream: cheatsheetseries.owasp.org/cheatsheets/HTTP_Headers_Cheat_Sheet
+state:
+  persistent: false
+  files: []
+depends_on: []

package/dist/agents/skills/gemini-cli/owasp-xss-prevention/SKILL.md

@@ -0,0 +1,174 @@
+# OWASP XSS Prevention
+
+> Block script injection by encoding output, sanitizing HTML, and enforcing Content Security Policy
+
+## When to Use
+
+- Rendering user-supplied content in HTML templates or React components
+- Building rich text editors or comment/markdown systems
+- Setting up HTTP security headers for a web application
+- Auditing code that uses `innerHTML`, `dangerouslySetInnerHTML`, or `eval`
+- Implementing server-side rendering with dynamic user data
+
+## Instructions
+
+### React — Avoid dangerouslySetInnerHTML
+
+React auto-escapes JSX expressions. The main risk is `dangerouslySetInnerHTML`:
+
+```tsx
+// BAD — direct HTML injection
+function Comment({ html }: { html: string }) {
+  return <div dangerouslySetInnerHTML={{ __html: html }} />;
+}
+
+// GOOD — sanitize with DOMPurify before rendering
+import DOMPurify from 'dompurify';
+
+function Comment({ html }: { html: string }) {
+  const clean = DOMPurify.sanitize(html, {
+    ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a', 'ul', 'li', 'p'],
+    ALLOWED_ATTR: ['href', 'rel', 'target'],
+  });
+  return <div dangerouslySetInnerHTML={{ __html: clean }} />;
+}
+```
+
+### Server-Side Output Encoding
+
+In Express/NestJS template engines, always use auto-escaping. For raw HTML responses:
+
+```typescript
+import escapeHtml from 'escape-html';
+
+// Escapes <, >, &, ", ' — safe for HTML context
+const safeOutput = escapeHtml(userInput);
+
+// For HTML attribute context — additional encoding needed
+function encodeAttr(value: string): string {
+  return value
+    .replace(/&/g, '&amp;')
+    .replace(/"/g, '&quot;')
+    .replace(/'/g, '&#x27;')
+    .replace(/</g, '&lt;')
+    .replace(/>/g, '&gt;');
+}
+```
+
+### Content Security Policy
+
+CSP is the strongest browser-level defense. Set via HTTP header (not meta tag):
+
+```typescript
+import helmet from 'helmet';
+
+app.use(
+  helmet.contentSecurityPolicy({
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'", "'nonce-{NONCE}'"], // nonce-based is better than unsafe-inline
+      styleSrc: ["'self'", "'unsafe-inline'"], // Tailwind requires this (or use nonces)
+      imgSrc: ["'self'", 'data:', 'https:'],
+      connectSrc: ["'self'"],
+      fontSrc: ["'self'", 'https://fonts.gstatic.com'],
+      objectSrc: ["'none'"],
+      baseUri: ["'self'"],
+      formAction: ["'self'"],
+      frameAncestors: ["'none'"],
+      upgradeInsecureRequests: [],
+    },
+  })
+);
+```
+
+For nonce-based CSP with Next.js or Express:
+
+```typescript
+import crypto from 'crypto';
+
+function cspMiddleware(req: Request, res: Response, next: NextFunction) {
+  const nonce = crypto.randomBytes(16).toString('base64');
+  res.locals.cspNonce = nonce;
+  res.setHeader(
+    'Content-Security-Policy',
+    `script-src 'self' 'nonce-${nonce}'; object-src 'none';`
+  );
+  next();
+}
+```
+
+### DOM XSS — Dangerous Sinks
+
+Avoid these JavaScript APIs with user input:
+
+```typescript
+// DANGEROUS SINKS — never pass untrusted data to these
+element.innerHTML = userInput; // use textContent instead
+document.write(userInput);
+eval(userInput);
+setTimeout(userInput, 0); // string form of setTimeout
+location.href = userInput; // validate URL schema first
+element.setAttribute('src', userInput); // validate URL schema
+```
+
+```typescript
+// SAFE alternatives
+element.textContent = userInput; // no HTML parsing
+element.setAttribute('data-val', userInput); // data attributes are safe
+
+// URL validation before href/src assignment
+function isSafeUrl(url: string): boolean {
+  try {
+    const parsed = new URL(url, window.location.origin);
+    return ['http:', 'https:'].includes(parsed.protocol);
+  } catch {
+    return false;
+  }
+}
+```
+
+## Details
+
+**Three XSS types:**
+
+- **Reflected** — payload in request URL reflected immediately in response
+- **Stored** — payload persisted (database/comments) and rendered to other users
+- **DOM-based** — payload processed entirely in the browser via dangerous JS sinks
+
+**Defense priority:**
+
+1. Avoid dangerous sinks (structural — most effective)
+2. Output encoding per context (HTML, attribute, JS, URL, CSS contexts have different rules)
+3. Input sanitization (DOMPurify for HTML, allowlist for other contexts)
+4. CSP as last line of defense (catches mistakes)
+
+**DOMPurify server-side (SSR/Node):**
+
+```typescript
+import { JSDOM } from 'jsdom';
+import createDOMPurify from 'dompurify';
+
+const window = new JSDOM('').window;
+const DOMPurify = createDOMPurify(window as any);
+const clean = DOMPurify.sanitize(dirty);
+```
+
+## Source
+
+https://owasp.org/www-project-top-ten/
+
+## Process
+
+1. Read the instructions and examples in this document.
+2. Apply the patterns to your implementation, adapting to your specific context.
+3. Verify your implementation against the details and edge cases listed above.
+
+## Harness Integration
+
+- **Type:** knowledge — this skill is a reference document, not a procedural workflow.
+- **No tools or state** — consumed as context by other skills and agents.
+
+## Success Criteria
+
+- The patterns described in this document are applied correctly in the implementation.
+- Edge cases and anti-patterns listed in this document are avoided.

package/dist/agents/skills/gemini-cli/owasp-xss-prevention/skill.yaml

@@ -0,0 +1,42 @@
+name: owasp-xss-prevention
+version: "1.0.0"
+description: Prevent reflected, stored, and DOM-based XSS via CSP headers, output encoding, and input sanitization
+cognitive_mode: advisory-guide
+type: knowledge
+tier: 3
+triggers:
+  - manual
+platforms:
+  - claude-code
+  - gemini-cli
+  - cursor
+  - codex
+tools: []
+paths:
+  - "**/auth/**"
+  - "**/security/**"
+  - "**/middleware/**"
+  - "**/guards/**"
+related_skills:
+  - owasp-security-headers
+  - owasp-csrf-protection
+  - nestjs-guards-pattern
+stack_signals:
+  - nodejs
+  - typescript
+  - security
+keywords:
+  - xss
+  - cross-site-scripting
+  - csp
+  - dompurify
+  - input-sanitization
+  - content-security-policy
+  - owasp
+metadata:
+  author: community
+  upstream: "owasp.org/www-project-top-ten/"
+state:
+  persistent: false
+  files: []
+depends_on: []

package/dist/agents/skills/gemini-cli/prisma-client-queries/SKILL.md

@@ -0,0 +1,147 @@
+# Prisma Client Queries
+
+> Query data with Prisma Client findUnique/findMany, create/update/delete, upsert, select, include
+
+## When to Use
+
+- Reading data from the database with type-safe queries
+- Creating, updating, or deleting records
+- Selecting specific fields or including related records
+- Performing upserts (create-or-update) operations
+
+## Instructions
+
+1. **Instantiate the client once** and reuse it. Never create a new `PrismaClient` per request:
+
+```typescript
+// lib/prisma.ts
+import { PrismaClient } from '@prisma/client';
+
+const globalForPrisma = globalThis as unknown as { prisma: PrismaClient };
+export const prisma = globalForPrisma.prisma ?? new PrismaClient();
+
+if (process.env.NODE_ENV !== 'production') globalForPrisma.prisma = prisma;
+```
+
+2. **Find a single record** — use `findUnique` for lookups by `@id` or `@unique` fields. Use `findFirst` when filtering by non-unique fields:
+
+```typescript
+const user = await prisma.user.findUnique({ where: { id: userId } });
+const admin = await prisma.user.findFirst({ where: { role: 'ADMIN' } });
+```
+
+3. **Find multiple records** — `findMany` returns an array. Always paginate large result sets:
+
+```typescript
+const users = await prisma.user.findMany({
+  where: { role: 'USER' },
+  take: 20,
+  skip: 0,
+  orderBy: { createdAt: 'desc' },
+});
+```
+
+4. **Select specific fields** to avoid over-fetching:
+
+```typescript
+const names = await prisma.user.findMany({
+  select: { id: true, name: true, email: true },
+});
+// Type: { id: string; name: string | null; email: string }[]
+```
+
+5. **Include related records** with `include`:
+
+```typescript
+const userWithPosts = await prisma.user.findUnique({
+  where: { id: userId },
+  include: { posts: { where: { published: true }, take: 10 } },
+});
+```
+
+6. **Create a record** — all required fields must be provided:
+
+```typescript
+const user = await prisma.user.create({
+  data: { email: 'new@example.com', name: 'New User' },
+});
+```
+
+7. **Update a record** — requires a unique `where` clause:
+
+```typescript
+const updated = await prisma.user.update({
+  where: { id: userId },
+  data: { name: 'Updated Name' },
+});
+```
+
+8. **Upsert** — create if not found, update if found:
+
+```typescript
+const user = await prisma.user.upsert({
+  where: { email: 'user@example.com' },
+  create: { email: 'user@example.com', name: 'New' },
+  update: { name: 'Existing' },
+});
+```
+
+9. **Delete** — use `delete` for single records, `deleteMany` for bulk:
+
+```typescript
+await prisma.user.delete({ where: { id: userId } });
+await prisma.post.deleteMany({ where: { authorId: userId } });
+```
+
+10. **Nested writes** — create or connect related records in one operation:
+
+```typescript
+const user = await prisma.user.create({
+  data: {
+    email: 'author@example.com',
+    posts: { create: [{ title: 'First Post' }, { title: 'Second Post' }] },
+  },
+  include: { posts: true },
+});
+```
+
+## Details
+
+Prisma Client is auto-generated from the schema and provides full TypeScript types for every query. The generated types enforce that you only pass valid field names, filter operators, and relation includes.
+
+**`select` vs `include`:** These are mutually exclusive at the same level. `select` returns only the specified fields (plus any nested `select`/`include`). `include` returns all scalar fields plus the specified relations.
+
+**`findUnique` vs `findFirst`:** `findUnique` can only filter by `@id` or `@unique` fields and benefits from Prisma's internal query deduplication (DataLoader batching). `findFirst` can filter by any field but does not deduplicate.
+
+**`findUniqueOrThrow` / `findFirstOrThrow`:** These variants throw a `PrismaClientKnownRequestError` with code `P2025` instead of returning `null`. Use them when absence is an error condition.
+
+**Nested writes are atomic:** `create` with nested `create`/`connect`/`connectOrCreate` runs in a single implicit transaction. If any nested operation fails, the entire write is rolled back.
+
+**Return types narrow automatically:** When you use `select`, the return type includes only the selected fields. This is enforced at the TypeScript level, so your code stays type-safe.
+
+**Common mistakes:**
+
+- Using `findFirst` where `findUnique` would work — loses batching optimization
+- Deeply nesting `include` — each level adds a separate database query. Three levels deep on a list page causes N+1 problems
+- Not handling `null` from `findUnique` — always check or use `findUniqueOrThrow`
+- Forgetting that `updateMany`/`deleteMany` do not return the affected records — only a count
+
+## Source
+
+https://prisma.io/docs/orm/prisma-client/queries
+
+## Process
+
+1. Read the instructions and examples in this document.
+2. Apply the patterns to your implementation, adapting to your specific context.
+3. Verify your implementation against the details and edge cases listed above.
+
+## Harness Integration
+
+- **Type:** knowledge — this skill is a reference document, not a procedural workflow.
+- **No tools or state** — consumed as context by other skills and agents.
+
+## Success Criteria
+
+- The patterns described in this document are applied correctly in the implementation.
+- Edge cases and anti-patterns listed in this document are avoided.