@jakkrichm/create-nexus-devflow 2.0.0 → 2.0.2

package/template/.agents/skills/security-and-hardening/security-checklist.md

@@ -1,134 +1,134 @@
-# Security Checklist
-
-Quick reference for web application security. Use alongside the `security-and-hardening` skill.
-
-## Table of Contents
-
-- [Pre-Commit Checks](#pre-commit-checks)
-- [Authentication](#authentication)
-- [Authorization](#authorization)
-- [Input Validation](#input-validation)
-- [Security Headers](#security-headers)
-- [CORS Configuration](#cors-configuration)
-- [Data Protection](#data-protection)
-- [Dependency Security](#dependency-security)
-- [Error Handling](#error-handling)
-- [OWASP Top 10 Quick Reference](#owasp-top-10-quick-reference)
-
-## Pre-Commit Checks
-
-- [ ] No secrets in code (`git diff --cached | grep -i "password\|secret\|api_key\|token"`)
-- [ ] `.gitignore` covers: `.env`, `.env.local`, `*.pem`, `*.key`
-- [ ] `.env.example` uses placeholder values (not real secrets)
-
-## Authentication
-
-- [ ] Passwords hashed with bcrypt (≥12 rounds), scrypt, or argon2
-- [ ] Session cookies: `httpOnly`, `secure`, `sameSite: 'lax'`
-- [ ] Session expiration configured (reasonable max-age)
-- [ ] Rate limiting on login endpoint (≤10 attempts per 15 minutes)
-- [ ] Password reset tokens: time-limited (≤1 hour), single-use
-- [ ] Account lockout after repeated failures (optional, with notification)
-- [ ] MFA supported for sensitive operations (optional but recommended)
-
-## Authorization
-
-- [ ] Every protected endpoint checks authentication
-- [ ] Every resource access checks ownership/role (prevents IDOR)
-- [ ] Admin endpoints require admin role verification
-- [ ] API keys scoped to minimum necessary permissions
-- [ ] JWT tokens validated (signature, expiration, issuer)
-
-## Input Validation
-
-- [ ] All user input validated at system boundaries (API routes, form handlers)
-- [ ] Validation uses allowlists (not denylists)
-- [ ] String lengths constrained (min/max)
-- [ ] Numeric ranges validated
-- [ ] Email, URL, and date formats validated with proper libraries
-- [ ] File uploads: type restricted, size limited, content verified
-- [ ] SQL queries parameterized (no string concatenation)
-- [ ] HTML output encoded (use framework auto-escaping)
-- [ ] URLs validated before redirect (prevent open redirect)
-
-## Security Headers
-
-```
-Content-Security-Policy: default-src 'self'; script-src 'self'
-Strict-Transport-Security: max-age=31536000; includeSubDomains
-X-Content-Type-Options: nosniff
-X-Frame-Options: DENY
-X-XSS-Protection: 0  (disabled, rely on CSP)
-Referrer-Policy: strict-origin-when-cross-origin
-Permissions-Policy: camera=(), microphone=(), geolocation=()
-```
-
-## CORS Configuration
-
-```typescript
-// Restrictive (recommended)
-cors({
-  origin: ['https://yourdomain.com', 'https://app.yourdomain.com'],
-  credentials: true,
-  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
-  allowedHeaders: ['Content-Type', 'Authorization'],
-})
-
-// NEVER use in production:
-cors({ origin: '*' })  // Allows any origin
-```
-
-## Data Protection
-
-- [ ] Sensitive fields excluded from API responses (`passwordHash`, `resetToken`, etc.)
-- [ ] Sensitive data not logged (passwords, tokens, full CC numbers)
-- [ ] PII encrypted at rest (if required by regulation)
-- [ ] HTTPS for all external communication
-- [ ] Database backups encrypted
-
-## Dependency Security
-
-```bash
-# Audit dependencies
-npm audit
-
-# Fix automatically where possible
-npm audit fix
-
-# Check for critical vulnerabilities
-npm audit --audit-level=critical
-
-# Keep dependencies updated
-npx npm-check-updates
-```
-
-## Error Handling
-
-```typescript
-// Production: generic error, no internals
-res.status(500).json({
-  error: { code: 'INTERNAL_ERROR', message: 'Something went wrong' }
-});
-
-// NEVER in production:
-res.status(500).json({
-  error: err.message,
-  stack: err.stack,         // Exposes internals
-  query: err.sql,           // Exposes database details
-});
-```
-
-## OWASP Top 10 Quick Reference
-
-| # | Vulnerability | Prevention |
-|---|---|---|
-| 1 | Broken Access Control | Auth checks on every endpoint, ownership verification |
-| 2 | Cryptographic Failures | HTTPS, strong hashing, no secrets in code |
-| 3 | Injection | Parameterized queries, input validation |
-| 4 | Insecure Design | Threat modeling, spec-driven development |
-| 5 | Security Misconfiguration | Security headers, minimal permissions, audit deps |
-| 6 | Vulnerable Components | `npm audit`, keep deps updated, minimal deps |
-| 7 | Auth Failures | Strong passwords, rate limiting, session management |
-| 8 | Data Integrity Failures | Verify updates/dependencies, signed artifacts |
-| 9 | Logging Failures | Log security events, don't log secrets |
-| 10 | SSRF | Validate/allowlist URLs, restrict outbound requests |
+# Security Checklist
+
+Quick reference for web application security. Use alongside the `security-and-hardening` skill.
+
+## Table of Contents
+
+- [Pre-Commit Checks](#pre-commit-checks)
+- [Authentication](#authentication)
+- [Authorization](#authorization)
+- [Input Validation](#input-validation)
+- [Security Headers](#security-headers)
+- [CORS Configuration](#cors-configuration)
+- [Data Protection](#data-protection)
+- [Dependency Security](#dependency-security)
+- [Error Handling](#error-handling)
+- [OWASP Top 10 Quick Reference](#owasp-top-10-quick-reference)
+
+## Pre-Commit Checks
+
+- [ ] No secrets in code (`git diff --cached | grep -i "password\|secret\|api_key\|token"`)
+- [ ] `.gitignore` covers: `.env`, `.env.local`, `*.pem`, `*.key`
+- [ ] `.env.example` uses placeholder values (not real secrets)
+
+## Authentication
+
+- [ ] Passwords hashed with bcrypt (≥12 rounds), scrypt, or argon2
+- [ ] Session cookies: `httpOnly`, `secure`, `sameSite: 'lax'`
+- [ ] Session expiration configured (reasonable max-age)
+- [ ] Rate limiting on login endpoint (≤10 attempts per 15 minutes)
+- [ ] Password reset tokens: time-limited (≤1 hour), single-use
+- [ ] Account lockout after repeated failures (optional, with notification)
+- [ ] MFA supported for sensitive operations (optional but recommended)
+
+## Authorization
+
+- [ ] Every protected endpoint checks authentication
+- [ ] Every resource access checks ownership/role (prevents IDOR)
+- [ ] Admin endpoints require admin role verification
+- [ ] API keys scoped to minimum necessary permissions
+- [ ] JWT tokens validated (signature, expiration, issuer)
+
+## Input Validation
+
+- [ ] All user input validated at system boundaries (API routes, form handlers)
+- [ ] Validation uses allowlists (not denylists)
+- [ ] String lengths constrained (min/max)
+- [ ] Numeric ranges validated
+- [ ] Email, URL, and date formats validated with proper libraries
+- [ ] File uploads: type restricted, size limited, content verified
+- [ ] SQL queries parameterized (no string concatenation)
+- [ ] HTML output encoded (use framework auto-escaping)
+- [ ] URLs validated before redirect (prevent open redirect)
+
+## Security Headers
+
+```
+Content-Security-Policy: default-src 'self'; script-src 'self'
+Strict-Transport-Security: max-age=31536000; includeSubDomains
+X-Content-Type-Options: nosniff
+X-Frame-Options: DENY
+X-XSS-Protection: 0  (disabled, rely on CSP)
+Referrer-Policy: strict-origin-when-cross-origin
+Permissions-Policy: camera=(), microphone=(), geolocation=()
+```
+
+## CORS Configuration
+
+```typescript
+// Restrictive (recommended)
+cors({
+  origin: ['https://yourdomain.com', 'https://app.yourdomain.com'],
+  credentials: true,
+  methods: ['GET', 'POST', 'PUT', 'PATCH', 'DELETE'],
+  allowedHeaders: ['Content-Type', 'Authorization'],
+})
+
+// NEVER use in production:
+cors({ origin: '*' })  // Allows any origin
+```
+
+## Data Protection
+
+- [ ] Sensitive fields excluded from API responses (`passwordHash`, `resetToken`, etc.)
+- [ ] Sensitive data not logged (passwords, tokens, full CC numbers)
+- [ ] PII encrypted at rest (if required by regulation)
+- [ ] HTTPS for all external communication
+- [ ] Database backups encrypted
+
+## Dependency Security
+
+```bash
+# Audit dependencies
+npm audit
+
+# Fix automatically where possible
+npm audit fix
+
+# Check for critical vulnerabilities
+npm audit --audit-level=critical
+
+# Keep dependencies updated
+npx npm-check-updates
+```
+
+## Error Handling
+
+```typescript
+// Production: generic error, no internals
+res.status(500).json({
+  error: { code: 'INTERNAL_ERROR', message: 'Something went wrong' }
+});
+
+// NEVER in production:
+res.status(500).json({
+  error: err.message,
+  stack: err.stack,         // Exposes internals
+  query: err.sql,           // Exposes database details
+});
+```
+
+## OWASP Top 10 Quick Reference
+
+| # | Vulnerability | Prevention |
+|---|---|---|
+| 1 | Broken Access Control | Auth checks on every endpoint, ownership verification |
+| 2 | Cryptographic Failures | HTTPS, strong hashing, no secrets in code |
+| 3 | Injection | Parameterized queries, input validation |
+| 4 | Insecure Design | Threat modeling, spec-driven development |
+| 5 | Security Misconfiguration | Security headers, minimal permissions, audit deps |
+| 6 | Vulnerable Components | `npm audit`, keep deps updated, minimal deps |
+| 7 | Auth Failures | Strong passwords, rate limiting, session management |
+| 8 | Data Integrity Failures | Verify updates/dependencies, signed artifacts |
+| 9 | Logging Failures | Log security events, don't log secrets |
+| 10 | SSRF | Validate/allowlist URLs, restrict outbound requests |

package/template/.agents/skills/security-review/SKILL.md

@@ -1,166 +1,166 @@
 ---name: security-review
-
-description: High-severity security code review for folders, projects, files, or diffs with English Markdown output contract.
-argument-hint: "[target folder, project path, file list, or git diff] [--lang=en]"
----
-
-# Security Review
-
-$ARGUMENTS
-
-Perform a focused security-only review of a specified target (directory, project, list of files, or code diff) for **High Severity** and **Critical** security vulnerabilities.
-
-This workflow is a companion command in DevFlow 2.0. It creates a standardized stage artifact contract inside the active workspace.
-
-## Purpose
-
-Use this workflow to check an entire folder, project, or changed files for major security risks. It ensures your codebase does not introduce high-severity flaws before advancing to verification or release.
-
-## Behavior
-
-When `Security-Review` is triggered:
-
-1. **Resolve target and scope**:
-   - Determine the target folder, project, list of files, or git diff from the arguments.
-   - Scan all source files in the target directory recursively, or evaluate the specific list of files/diff.
-2. **Anchor the run**:
-   - Locate the active `running_id` from the workspace.
-   - If no active running ID is found, prompt the user or create a temporary run workspace (e.g., `sec-global` under `devflow/runs/sec-global/`).
-3. **Execute security-focused analysis**:
-   - Trace trust boundaries and inputs across the target files.
-   - Check only for **High Severity** and **Critical** security vulnerabilities (e.g., SQL/Command Injection, hardcoded secrets, authentication bypass, path traversal, RCE, data exposure).
-   - Ignore theoretical, style, low-impact, or medium/low severity findings for status blocking, but report them under Suggestions if present.
-4. **Load Template**:
-   - Inspect `.agent/resources/schemas/security_review.template.md`.
+
+description: High-severity security code review for folders, projects, files, or diffs with English Markdown output contract.
+argument-hint: "[target folder, project path, file list, or git diff] [--lang=en]"
+---
+
+# Security Review
+
+$ARGUMENTS
+
+Perform a focused security-only review of a specified target (directory, project, list of files, or code diff) for **High Severity** and **Critical** security vulnerabilities.
+
+This workflow is a companion command in DevFlow 2.0. It creates a standardized stage artifact contract inside the active workspace.
+
+## Purpose
+
+Use this workflow to check an entire folder, project, or changed files for major security risks. It ensures your codebase does not introduce high-severity flaws before advancing to verification or release.
+
+## Behavior
+
+When `Security-Review` is triggered:
+
+1. **Resolve target and scope**:
+   - Determine the target folder, project, list of files, or git diff from the arguments.
+   - Scan all source files in the target directory recursively, or evaluate the specific list of files/diff.
+2. **Anchor the run**:
+   - Locate the active `running_id` from the workspace.
+   - If no active running ID is found, prompt the user or create a temporary run workspace (e.g., `sec-global` under `devflow/runs/sec-global/`).
+3. **Execute security-focused analysis**:
+   - Trace trust boundaries and inputs across the target files.
+   - Check only for **High Severity** and **Critical** security vulnerabilities (e.g., SQL/Command Injection, hardcoded secrets, authentication bypass, path traversal, RCE, data exposure).
+   - Ignore theoretical, style, low-impact, or medium/low severity findings for status blocking, but report them under Suggestions if present.
+4. **Load Template**:
+   - Inspect `.agent/resources/schemas/security_review.template.md`.
    - Read the `artifact_language` configuration (framework default: `"th"`).
-   - Generate the report in English.
-5. **Write the Artifact**:
-   - Write the finalized security report to `devflow/runs/{ID}-{slug}/security-review.md`.
-   - Ensure the output strictly follows the template contract structure (Headings 1 to 11).
-
-## Output Contract & Formats
-
-The generated artifact must follow the English contract shape below.
-
-### English Output Template
-
-```markdown
----
-id: "{running_id}-security-review"
-title: "Security Review: {Work Title}"
-doc_type: "companion"
-stage: "security-review"
-created: "{Date}"
-updated: "{Date}"
-owner: "{Owner}"
-status: "draft"
-artifact_language: "th"
-related_run: "{running_id}"
-related_files: []
----
-
-# Security Review: {Work Title}
-
-## 1. Objective
-
-- Perform a focused security review on the target directory, project, or files to detect High Severity and Critical security vulnerabilities.
-
-## 2. Source Inputs
-
-- Review Target: {Review Target}
-- Files Evaluated: []
-
-## 3. Project Context To Preserve
-
-- Global security constraints and authorization invariants.
-- Known exceptions or legacy patterns excluded from security flags.
-
-## 4. Stage-Specific Content
-
-### 🛡️ Security Review Result
-- **Status:** [pass | fail]
-- **Reason:** [Explain in detail with file and line references if fail, or "No high-severity or Critical security vulnerabilities found" if pass]
-
-### 💡 Suggestions for Next Agent Action / Handoff
-[Provide concrete instructions and guidance for the subsequent Agent. If pass, list any medium/low security findings or recommendations for human consideration, directing the next verification/release Agent accordingly. If fail, list step-by-step remediation tasks for the implementer Agent to execute.]
-
-### 🔍 Detailed Scope Analysis
-- **Secrets & Configuration:** [Pass | Fail]
-- **Input Validation & Injection:** [Pass | Fail]
-- **Access Control & Auth:** [Pass | Fail]
-- **Data Protection & Cryptography:** [Pass | Fail]
-- **File System & Shell Safety:** [Pass | Fail]
-
-## 5. AI Actions Performed
-
-- Analyzed target codebase and traced untrusted inputs to critical sinks.
-- Scanned for hardcoded secrets, API keys, and environment leaks.
-
-## 6. Human Review Required
-
-- Verify findings and evaluate false positives if any.
-- Review medium/low risk suggestions for optional implementation.
-
-## 7. Approval Status
-
-- Pending
-
-## 8. Next Allowed Command
-
-- `/40-Implement {running_id}` (if fail, for code remediation)
-- `/50-Verify {running_id}` (if pass, to verify execution correctness)
-
-## 9. Nexus Event
-
-- `Debug` for deep-dive diagnostics or debugging.
-- `grill-with-docs` to clarify security guidelines.
-
-## 10. Change Log
-
-- {Date}: Initial English security review report created.
-
-## 11. Additional Notes
-
-- [Add custom sub-headings below if needed]
-```
-
-## Pass Response Requirements
-
-When no High Severity or Critical vulnerability is found, the sections under **Stage-Specific Content** must be formatted as:
-
-```markdown
-### 🛡️ Security Review Result
-- **Status:** pass
-- **Reason:** No high-severity or Critical security vulnerabilities found
-
-### 💡 Suggestions for Next Agent Action / Handoff
-[List any medium, low security findings or recommendations for human consideration, directing the next verification/release Agent accordingly]
-```
-
-## Fail Response Requirements
-
-When a High Severity or Critical vulnerability is found:
-
-- Use status `fail`.
-- Explain why the issue is High/Critical Severity with file and line references.
-- In **Suggestions for Next Agent Action / Handoff**, write a clear set of step-by-step remediation tasks for the Coder/Implementer Agent to resolve the vulnerability.
-
-## Security Scope & Rules
-
-Evaluate high-severity risks including:
-- **Hardcoded secrets**: passwords, API keys, private keys, database strings.
-- **Injections**: SQL, NoSQL, OS Command, Template, or Path traversal.
-- **Unvalidated inputs**: dynamic evaluation (`eval`), shell execution, or raw unescaped HTML rendering.
-- **Insecure configuration**: broken authorization, sensitive exposure in public endpoints/logs.
-
-## Relationship To DevFlow 2.0
-
-- **Classification**: Companion command
-- **Mainline Status**: Not part of the linear Timeline. Can be run at any stage.
-- **Typical Entry Points**: Any stage, especially before `/50-Verify` or `/70-Release` to verify security health.
-
-## Sources
-
-- `AGENTS.md`
-- `.agent/resources/schemas/security_review.template.md`
-- `docs/workspace-artifacts.md`
+   - Generate the report in English.
+5. **Write the Artifact**:
+   - Write the finalized security report to `devflow/runs/{ID}-{slug}/security-review.md`.
+   - Ensure the output strictly follows the template contract structure (Headings 1 to 11).
+
+## Output Contract & Formats
+
+The generated artifact must follow the English contract shape below.
+
+### English Output Template
+
+```markdown
+---
+id: "{running_id}-security-review"
+title: "Security Review: {Work Title}"
+doc_type: "companion"
+stage: "security-review"
+created: "{Date}"
+updated: "{Date}"
+owner: "{Owner}"
+status: "draft"
+artifact_language: "th"
+related_run: "{running_id}"
+related_files: []
+---
+
+# Security Review: {Work Title}
+
+## 1. Objective
+
+- Perform a focused security review on the target directory, project, or files to detect High Severity and Critical security vulnerabilities.
+
+## 2. Source Inputs
+
+- Review Target: {Review Target}
+- Files Evaluated: []
+
+## 3. Project Context To Preserve
+
+- Global security constraints and authorization invariants.
+- Known exceptions or legacy patterns excluded from security flags.
+
+## 4. Stage-Specific Content
+
+### 🛡️ Security Review Result
+- **Status:** [pass | fail]
+- **Reason:** [Explain in detail with file and line references if fail, or "No high-severity or Critical security vulnerabilities found" if pass]
+
+### 💡 Suggestions for Next Agent Action / Handoff
+[Provide concrete instructions and guidance for the subsequent Agent. If pass, list any medium/low security findings or recommendations for human consideration, directing the next verification/release Agent accordingly. If fail, list step-by-step remediation tasks for the implementer Agent to execute.]
+
+### 🔍 Detailed Scope Analysis
+- **Secrets & Configuration:** [Pass | Fail]
+- **Input Validation & Injection:** [Pass | Fail]
+- **Access Control & Auth:** [Pass | Fail]
+- **Data Protection & Cryptography:** [Pass | Fail]
+- **File System & Shell Safety:** [Pass | Fail]
+
+## 5. AI Actions Performed
+
+- Analyzed target codebase and traced untrusted inputs to critical sinks.
+- Scanned for hardcoded secrets, API keys, and environment leaks.
+
+## 6. Human Review Required
+
+- Verify findings and evaluate false positives if any.
+- Review medium/low risk suggestions for optional implementation.
+
+## 7. Approval Status
+
+- Pending
+
+## 8. Next Allowed Command
+
+- `/40-Implement {running_id}` (if fail, for code remediation)
+- `/50-Verify {running_id}` (if pass, to verify execution correctness)
+
+## 9. Nexus Event
+
+- `Debug` for deep-dive diagnostics or debugging.
+- `grill-with-docs` to clarify security guidelines.
+
+## 10. Change Log
+
+- {Date}: Initial English security review report created.
+
+## 11. Additional Notes
+
+- [Add custom sub-headings below if needed]
+```
+
+## Pass Response Requirements
+
+When no High Severity or Critical vulnerability is found, the sections under **Stage-Specific Content** must be formatted as:
+
+```markdown
+### 🛡️ Security Review Result
+- **Status:** pass
+- **Reason:** No high-severity or Critical security vulnerabilities found
+
+### 💡 Suggestions for Next Agent Action / Handoff
+[List any medium, low security findings or recommendations for human consideration, directing the next verification/release Agent accordingly]
+```
+
+## Fail Response Requirements
+
+When a High Severity or Critical vulnerability is found:
+
+- Use status `fail`.
+- Explain why the issue is High/Critical Severity with file and line references.
+- In **Suggestions for Next Agent Action / Handoff**, write a clear set of step-by-step remediation tasks for the Coder/Implementer Agent to resolve the vulnerability.
+
+## Security Scope & Rules
+
+Evaluate high-severity risks including:
+- **Hardcoded secrets**: passwords, API keys, private keys, database strings.
+- **Injections**: SQL, NoSQL, OS Command, Template, or Path traversal.
+- **Unvalidated inputs**: dynamic evaluation (`eval`), shell execution, or raw unescaped HTML rendering.
+- **Insecure configuration**: broken authorization, sensitive exposure in public endpoints/logs.
+
+## Relationship To DevFlow 2.0
+
+- **Classification**: Companion command
+- **Mainline Status**: Not part of the linear Timeline. Can be run at any stage.
+- **Typical Entry Points**: Any stage, especially before `/50-Verify` or `/70-Release` to verify security health.
+
+## Sources
+
+- `AGENTS.md`
+- `.agent/resources/schemas/security_review.template.md`
+- `docs/workspace-artifacts.md`