@kenkaiiii/ggcoder 5.40.1 → 5.41.0

package/README.md

@@ -35,10 +35,10 @@ OAuth for Anthropic and OpenAI (log in once, auto-refresh, no key to leak). API
 
 Every token in the system prompt gets processed on **every single turn**. It's not a one-time cost. It's a tax on every request.
 
-| | **Claude Code / Agent SDK** | **GG Coder** |
-|---|---|---|
-| System prompt size | ~15,000 tokens | **~1,100 tokens** |
-| Ratio | baseline | **~13x smaller** |
+|                    | **Claude Code / Agent SDK** | **GG Coder**      |
+| ------------------ | --------------------------- | ----------------- |
+| System prompt size | ~15,000 tokens              | **~1,100 tokens** |
+| Ratio              | baseline                    | **~13x smaller**  |
 
 ### Why you should care
 
@@ -67,16 +67,16 @@ You can still add your own MCPs if you need them. But start with less. You'll ge
 
 Switch mid-conversation with `/model`. Not locked to anyone.
 
-| Provider | Models | Auth |
-|---|---|---|
-| **Anthropic** | Claude Opus 5, Sonnet 5, Haiku 4.5 | OAuth |
-| **OpenAI** | GPT-5.5, GPT-5.5 Pro, GPT-5.4, GPT-5.3 Codex | OAuth |
-| **Moonshot** | Kimi K3, Kimi K2.7 Code | OAuth or API key |
-| **Z.AI (GLM)** | GLM-5.1, GLM-4.7, GLM-4.7 Flash | API key |
-| **MiniMax** | MiniMax M3 (image + video) | API key |
-| **Xiaomi (MiMo)** | MiMo-V2.5-Pro, MiMo-V2.5-Pro-UltraSpeed, MiMo-V2.5 (image + video) | API key |
-| **DeepSeek** | DeepSeek V4 Pro, V4 Flash | API key |
-| **OpenRouter** | Qwen3.6-Plus + multi-provider gateway | API key |
+| Provider          | Models                                                             | Auth             |
+| ----------------- | ------------------------------------------------------------------ | ---------------- |
+| **Anthropic**     | Claude Opus 5, Sonnet 5, Haiku 4.5                                 | OAuth            |
+| **OpenAI**        | GPT-5.5, GPT-5.5 Pro, GPT-5.4, GPT-5.3 Codex                       | OAuth            |
+| **Moonshot**      | Kimi K3, Kimi K2.7 Code                                            | OAuth or API key |
+| **Z.AI (GLM)**    | GLM-5.1, GLM-4.7, GLM-4.7 Flash                                    | API key          |
+| **MiniMax**       | MiniMax M3 (image + video)                                         | API key          |
+| **Xiaomi (MiMo)** | MiMo-V2.5-Pro, MiMo-V2.5-Pro-UltraSpeed, MiMo-V2.5 (image + video) | API key          |
+| **DeepSeek**      | DeepSeek V4 Pro, V4 Flash                                          | API key          |
+| **OpenRouter**    | Qwen3.6-Plus + multi-provider gateway                              | API key          |
 
 The same conversation, the same tools, the same project context — only the model changes. Use a strong reasoning model when you need it, swap to a fast cheap one for grunt work, never restart your session.
 
@@ -104,15 +104,15 @@ Run `ggcoder` directly when you're heads-down on one project. Switch to `ggboss`
 
 ## ⌨️ Keybindings
 
-| Key | What it does |
-|---|---|
-| <kbd>Ctrl+T</kbd> | Open the Task pane |
-| <kbd>Ctrl+S</kbd> | Open the Skills pane |
-| <kbd>Shift+Tab</kbd> | Cycle extended thinking (off / low / medium / high / max) |
-| <kbd>Esc</kbd> | Interrupt the agent mid-turn |
-| <kbd>Ctrl+C</kbd> ×2 | Exit |
-| <kbd>↑</kbd> / <kbd>↓</kbd> | Recall previous prompts (when input is empty) |
-| <kbd>Enter</kbd> | Send · <kbd>Shift+Enter</kbd> newline · `/` opens the slash menu |
+| Key                         | What it does                                                     |
+| --------------------------- | ---------------------------------------------------------------- |
+| <kbd>Ctrl+T</kbd>           | Open the Task pane                                               |
+| <kbd>Ctrl+S</kbd>           | Open the Skills pane                                             |
+| <kbd>Shift+Tab</kbd>        | Cycle extended thinking (off / low / medium / high / max)        |
+| <kbd>Esc</kbd>              | Interrupt the agent mid-turn                                     |
+| <kbd>Ctrl+C</kbd> ×2        | Exit                                                             |
+| <kbd>↑</kbd> / <kbd>↓</kbd> | Recall previous prompts (when input is empty)                    |
+| <kbd>Enter</kbd>            | Send · <kbd>Shift+Enter</kbd> newline · `/` opens the slash menu |
 
 ---
 
@@ -120,25 +120,24 @@ Run `ggcoder` directly when you're heads-down on one project. Switch to `ggboss`
 
 Everything runs through slash commands inside the session. Not CLI flags.
 
-| Command | What it does |
-|---|---|
-| `/model` (`/m`) | Switch model on the fly |
-| `/compact` (`/c`) | Compress context when it gets long |
-| `/new` (`/n`) | Start a fresh session in this project |
-| `/session` (`/s`) | Resume a prior session |
-| `/branch` (`/b`) | Branch the current conversation |
-| `/branches` | List branches of the current session |
-| `/rewind` | Restore files and/or conversation to an earlier checkpoint |
-| `/buddy` | Spin up a second model to review the current chat |
-| `/settings` (`/config`) | Open settings |
-| `/help` (`/h`, `/?`) | Show all commands |
-| `/quit` (`/q`, `/exit`) | Exit |
+| Command                 | What it does                                               |
+| ----------------------- | ---------------------------------------------------------- |
+| `/model` (`/m`)         | Switch model on the fly                                    |
+| `/compact` (`/c`)       | Compress context when it gets long                         |
+| `/new` (`/n`)           | Start a fresh session in this project                      |
+| `/session` (`/s`)       | Resume a prior session                                     |
+| `/branch` (`/b`)        | Branch the current conversation                            |
+| `/branches`             | List branches of the current session                       |
+| `/rewind`               | Restore files and/or conversation to an earlier checkpoint |
+| `/buddy`                | Spin up a second model to review the current chat          |
+| `/settings` (`/config`) | Open settings                                              |
+| `/help` (`/h`, `/?`)    | Show all commands                                          |
+| `/quit` (`/q`, `/exit`) | Exit                                                       |
 
 Plus built-in workflows that ship with the binary:
 
 ```bash
 /expand        # Compare against current alternatives and report gaps
-/bullet-proof  # Run a defensive security review
 /init          # Generate CLAUDE.md for your project
 /setup-commit  # Generate a /commit command with quality checks
 /setup-skills  # Audit and recommend reusable skills
@@ -205,6 +204,14 @@ Reusable behaviors across projects. Drop `.md` files in:
 
 They get loaded into the system prompt automatically. The agent knows what it can do without you explaining it each session. <kbd>Ctrl+S</kbd> opens a pane to browse and toggle them.
 
+Three ship built in, and route themselves when the work matches:
+
+| Skill              | Fires on                                                                                                                                                                                                                            |
+| ------------------ | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `bulletproof`      | Code an attacker will reach — auth, untrusted input, secrets, dependencies, CI/release, agent/MCP tool surfaces — and "is this safe to ship" reviews. Works on any target: web, API, CLI, desktop, mobile, embedded, contracts, ML. |
+| `compliance-guard` | Legal exposure — personal data, payments, UGC, email/SMS, minors, or a licensed/regulated feature.                                                                                                                                  |
+| `evidence-led-ui`  | Broad or design-sensitive UI work — new screens, redesigns, design systems, accessibility passes.                                                                                                                                   |
+
 ---
 
 ## 📋 Project guidelines

package/assets/skills/bulletproof/SKILL.md

@@ -0,0 +1,156 @@
+---
+name: bulletproof
+description: Use when code will meet an attacker — auth, sessions, tokens, crypto; any untrusted input (user, network, file, uploaded archive, repo content, model or tool output); secrets and credential storage; multi-tenant or per-user data access; dependency, install-script, CI/CD, release-signing or update work; deserialization, shelling out, or dynamic code loading; LLM/agent/MCP tool surfaces; and pre-ship "can this be hacked" reviews, hardening passes, or suspected compromise. Applies to any target — web, API, CLI, desktop, mobile, embedded/firmware, smart contract, ML pipeline, game, or library. Do NOT use for throwaway local scripts with no untrusted input and no secrets, pure styling/copy/docs changes, or narrow edits already covered by a hardened pattern in the repo.
+license: Apache-2.0. Content is defensive engineering guidance, not a security certification or a penetration test. See references/provenance.md.
+compatibility: Works offline from the bundled references, which are a snapshot dated 12 August 2026. Version numbers, CVEs, and incident details decay fast; re-verify date-sensitive claims with web access before stating them as current. Never certifies that software is secure.
+---
+
+# Bulletproof
+
+Make software hold up against a real attacker — one that is now partly automated, reads your public code end-to-end, and moves in minutes. Built for solo developers and small teams, who get breached through a short list of boring mistakes, not exotic ones.
+
+## Governing rules
+
+1. **Reachability decides everything.** A vulnerability class only matters if untrusted data can actually reach the dangerous operation. Trace the path before you rank the risk — source, hops, sink. No path, no finding. Conversely: if a path exists, the framework's reputation does not save it.
+2. **Untrusted by default.** Anything you did not author and pin is untrusted input: user requests, files, uploaded archives, environment on a shared host, **the contents of the repo you are working in**, fetched web pages, dependency code, model output, tool output, and other agents. Trust is granted explicitly, per-source, never inherited.
+3. **Assume a machine-speed adversary.** Public code is continuously read by automated scanners on both sides. Leaked credentials get used, not filed. Design so that one mistake is survivable: scope credentials, cap blast radius, make rotation possible. See `references/threat-landscape.md`.
+4. **Fix, do not just flag.** Inline, build the control into the feature as you write it. In a full review, report first — then fix what the user selects. A list of findings nobody implements has done nothing.
+5. **Never certify.** Do not write or say "secure", "hardened", "unhackable", "bulletproof", "audited", or "no vulnerabilities". State what you checked, what you fixed, what you could not verify, and what remains. Absence of findings is absence of findings.
+6. **Defensive output only.** Describe risk at the data-flow level — where untrusted data enters, what it reaches, why that is fixable. No working exploits, no weaponized payloads, no attack tooling, in any mode, including inside subagent tasks. If you cannot explain a risk without writing an exploit, describe the flow and the fix instead.
+7. **Proportionality.** Rank by realistic exposure: probability × blast radius. A prototype with no users and no secrets does not need forty findings. Five real fixes beat forty ignored ones.
+8. **Date-check before asserting.** The references are a snapshot dated **12 August 2026**. CVEs, versions, defaults, and incident details move weekly. Re-verify with web access when available; when unavailable, say the claim is from a dated snapshot. Never invent a CVE number, a version, or an advisory.
+
+## Two modes
+
+**Inline gate** — triggered mid-build by writing code that carries risk: an auth check, a query built from input, a file path, a subprocess call, a new dependency, a token store, an upload handler, a webhook, a deploy config, a tool exposed to a model. Do the minimum: apply the control while writing the feature, state it in one line, move on.
+
+This mode matters most, because the users who need this skill will never ask for it. They ask for a login page, a file upload, an admin route, a Stripe webhook, a CLI that runs a command. **Write the safe version the first time** — parameterize the query, enforce authorization at the data layer, resolve the path and check containment, pass argv instead of a shell string, pin the dependency after verifying it exists. Do not stop the build to deliver a lecture, and do not ship the unsafe version intending to flag it later.
+
+**Full review** — triggered by "is this safe to ship", a hardening pass, pre-launch, suspected compromise, or first use of this skill on a project. Run the workflow below; the full multi-agent protocol, audit catalog, false-positive filter, and report template live in `references/audit-protocol.md`.
+
+## Workflow
+
+### 1. Profile the attack surface from the code
+
+Do this before asking the user anything.
+
+- **Shape**: what is this — web app, API, CLI, desktop app, mobile app, library, firmware, contract, ML pipeline, game server? Read manifests, lockfiles, CI configs, Dockerfiles, IaC, store metadata, install scripts.
+- **Reach**: who can send it bytes? Anonymous internet, authenticated users, other tenants, local users on the same machine, a build system, a model, a physical attacker with the device in hand.
+- **Sources**: every entry point where untrusted data crosses in — route handlers, argv/stdin, env, queue consumers, WebSocket and IPC receivers, deep links and custom URL schemes, file and archive readers, deserializers, plugin/model loaders, MCP and tool handlers, webhook endpoints.
+- **Sinks**: every dangerous operation — shell exec, SQL/NoSQL/LDAP/XPath, eval/Function/exec/pickle/yaml.load/Marshal/ObjectInputStream, file write, dynamic require/import, network egress, auth decisions, secret reads, native deserializers, contract external calls, privileged setters.
+- **Assets**: what must not leak or move — credentials and tokens, customer data, signing and update keys, CI secrets, model API keys, on-chain funds, session state, source with IP value.
+- **Existing controls**: what already works. Framework escaping, ORM parameterization, a middleware auth layer, RLS policies, CSP, a sandbox. Never re-flag what the framework already handles, and never remove a control you did not understand.
+
+`references/platform-playbooks.md` has the per-platform detection sweep — grep targets and config keys for web/API, mobile, desktop, CLI, embedded, web3, ML, and games.
+
+### 2. Ask only what the code cannot tell you
+
+Cap at **five questions**, batched in one message, each stating the default you will assume if unanswered. Assume the user does not know security vocabulary — ask about facts they know.
+
+| Ask | Default if unanswered |
+|---|---|
+| Is this reachable from the public internet, or only your machine / a private network? | Public, if any deploy config or hosting file exists; local-only for a bare script |
+| Do real people's accounts or data live in it, or is it test data? | Real data once there is a users/accounts table, auth, or a payment path |
+| Can users see each other's data if they are meant to be separated (multi-tenant, teams, orgs)? | Assume separation is required wherever a tenant/org/user foreign key exists |
+| Who is trusted to run privileged actions — is there an admin role, and who has it? | Assume an admin surface exists if any route, flag, or column implies one |
+| Has anything already gone wrong — leaked key, odd logins, unexpected charges, a dependency alert? | Assume no active incident, but treat any exposed secret found in the repo as already compromised |
+
+If the user says a surface is out of scope, record it as their stated assumption and report it as not-checked rather than silently dropping it.
+
+### 3. Rank what actually kills small teams
+
+For this population, findings cluster hard. Work the list in this order unless recon says otherwise — this ordering reflects what is actually being exploited at scale, not what is most interesting.
+
+| Rank | Failure | Why it is first |
+|---|---|---|
+| 1 | **Secrets in code, history, bundles, logs, or CI** | Highest-volume real-world compromise. A committed key is a live key; treat any exposure as burned and rotate. `references/secure-defaults.md` |
+| 2 | **Missing or wrong authorization at the data layer** | IDOR/BOLA, disabled or permissive row-level security, tenant checks only in the UI. Public API keys plus an open table is the standard indie breach. `references/platform-playbooks.md` |
+| 3 | **Supply chain and install-time execution** | Dependencies, lockfiles, postinstall hooks, CI workflows, release signing, editor extensions, MCP servers. `references/supply-chain.md` |
+| 4 | **Injection into an interpreter** | SQL, shell, template, deserialization, dynamic code load — and XSS, which is injection into an HTML parser. XSS and SQL injection are ranks 1 and 2 of the 2025 CWE Top 25. |
+| 5 | **Agent and AI surfaces** | Prompt injection reaching a tool with credentials and an egress path. `references/agent-surface.md` |
+| 6 | **Auth, session, and crypto correctness** | Token validation, session lifecycle, password storage, signature verification. `references/secure-defaults.md` |
+| 7 | **Platform-specific exposure** | Deep links, exported components, IPC, loopback servers, updater integrity, debug interfaces, proxy admin keys. `references/platform-playbooks.md` |
+| 8 | **Everything else** | Backlog unless recon shows a concrete path. |
+
+### 4. Build the control, do not describe it
+
+Every fix lands as code where code can express it. Prefer, in order:
+
+1. **Eliminate the class.** Parameterized query instead of string building. `spawn(file, args)` instead of a shell string. `safetensors` instead of pickle. A memory-safe language for new parsing code. A class removed cannot regress.
+2. **Enforce at the chokepoint, not the call site.** Authorization in the data layer or a single middleware, not repeated in forty handlers. One HTTP client with the egress allowlist. One place that opens files under the project root. Scattered checks rot.
+3. **Default deny.** Allowlists over denylists, for hosts, paths, file types, commands, origins, capabilities, and tools. A denylist is a list of the attacks you already thought of.
+4. **Least privilege and least agency.** Scope every credential to one job, one resource, one lifetime. For agents, grant the minimum autonomy the task needs, not just the minimum permissions.
+5. **Contain the blast.** Assume the control fails: what is reachable then? Separate keys per environment, per-tenant scoping, short-lived tokens, network egress limits, rotation that is actually possible.
+6. **Fail closed.** An exception in an auth check must deny. Catch-and-continue around a verification step is a vulnerability, and now has its own OWASP category (A10:2025).
+
+When you change security-sensitive behavior, say so in one line — what you enforced and what it prevents. Never silently weaken a control to make something work; if a control blocks the feature, say that and propose the safe path.
+
+### 5. Verify, then leave the check behind
+
+A fix you did not exercise is a hypothesis.
+
+- **Prove the fix with a test** that fails against the old behavior: the unauthorized request gets 403, the traversal path is rejected, the other tenant's row is invisible, the malformed token is refused. Authorization tests are the highest-value tests in most codebases and are almost always missing.
+- **Run the free scanners** rather than reasoning about them: secret scanning over the full history, dependency audit, static analysis, and the platform's own linter. Exact commands are in `references/verification.md`.
+- **Leave a CI gate** so the fix cannot silently regress — secret scan, dependency review, and the new test on every PR. One workflow file is usually all it takes.
+- **Label every claim** `RUNTIME` (you ran it and observed the result), `CODE` (you read it), or `DEDUCED` (you inferred it). Never present something you read as something you ran.
+
+### 6. Report
+
+For a full review, use the report template in `references/audit-protocol.md`. For an inline fix, one or two sentences.
+
+Whatever the mode, the report must state **what was not checked**. A review that silently skips the mobile client, the admin panel, or the infra repo reads as complete coverage and is more dangerous than no review.
+
+### 7. Write it for someone who has never read a CVE
+
+- Lead with what an attacker gets, in plain words: "anyone who knows a user's ID can read their invoices", not "IDOR in the invoice controller".
+- Name the file and line, then the fix, then the reason — in that order.
+- Give the base rate honestly. Do not use fear as a lever; a scared user makes worse decisions and often ships nothing.
+- Keep the standards jargon (CWE, OWASP IDs) in a labelled field, not in the sentence that has to be understood.
+
+## Severity ladder
+
+Rank by what the attacker ends up holding, not by how clever the bug is.
+
+| Severity | Meaning |
+|---|---|
+| **Critical** | Remote code execution, full authentication bypass, credential or signing-key theft, any user's data readable by any other, loss of funds, supply-chain compromise of a shipped artifact |
+| **High** | Privilege escalation, cross-tenant access requiring some authentication, exposure of a live secret, unauthenticated access to an admin or internal surface, integrity failure in an update channel |
+| **Medium** | Scoped information disclosure, weakened crypto with no direct break, partial bypass needing an unlikely precondition, missing defense-in-depth on a path with another working control |
+| **Low** | Hardening gaps with no demonstrated path. Backlog them; do not lead with them. |
+
+Downgrade one level when a working compensating control sits in the path. Upgrade one level when the asset is a credential, a signing key, or an update channel — those turn one bug into every user's bug.
+
+## Hard stops
+
+This skill is defensive. Refuse and offer the defensive equivalent:
+
+- Working exploits, weaponized payloads, or proof-of-concept attack code against anything — including the user's own systems. Data-flow descriptions and regression tests do the same job for defense.
+- Offensive tooling: scanners aimed at third parties, credential stuffers, botnet or C2 infrastructure, ransomware or wiper logic, stealers, obfuscators whose purpose is evading detection.
+- Auditing or "testing" a system the user does not own or clearly operate. Ask whose system it is before proceeding; authorization is the whole difference between this work and a crime.
+- Backdoors, hidden telemetry, covert data collection, deliberate weakening of another party's control, or anything that hides its behavior from the person running it.
+- Bypassing an access control, license check, anti-cheat, or age gate you do not own.
+
+Building detection, hardening, monitoring, honeypots on your own systems, and CTF-style analysis of code you own are all in scope.
+
+## Honesty rules
+
+- Never state or imply the software is secure. State what was checked, what was fixed, what remains, and what was not looked at.
+- Never present a scan as proof. Automated tools find a minority of defects; say so when you cite one.
+- Never fabricate a CVE, advisory, version number, or incident. If unsure, say "verify this" and mark confidence.
+- Distinguish **verified**, **snapshot (12 Aug 2026, re-verify)**, and **uncertain**. The references carry these markers — preserve them; do not launder a flagged-uncertain item into a confident claim.
+- Report the false-positive rate of your own work: how many candidates you dropped and why. A report that only shows survivors hides its own noise.
+- "I could not verify this" is a legitimate and useful output. A fabricated confirmation is not.
+- If you find evidence of an actual compromise — an unexplained committed key in use, unfamiliar workflow files, a backdoored dependency, unknown collaborators — stop and say so first, plainly, before continuing the review. Rotation and containment come before hardening.
+
+## Reference map
+
+Resolve every path from the installed skill root. Load only what the profile triggered.
+
+- `references/threat-landscape.md` — who is attacking this class of software in 2026, how automation changed the economics, named incidents with defensive fingerprints. Read once per full review.
+- `references/audit-protocol.md` — the full-review protocol: recon agents, audit catalog, subagent briefs, false-positive filter, hard exclusions, report template. Read for any full review.
+- `references/platform-playbooks.md` — per-platform controls and grep targets: web/API, mobile, desktop, CLI/dev tooling, embedded, smart contracts, ML pipelines, games. Read the sections the profile triggered.
+- `references/supply-chain.md` — dependencies, install-time execution, registries, CI/CD, signing and provenance, editor extensions, update channels.
+- `references/agent-surface.md` — LLM, agent, and MCP security: prompt injection, the lethal trifecta, tool poisoning, sandbox escapes, context and memory poisoning.
+- `references/secure-defaults.md` — the values to write the first time: crypto, password storage, tokens and sessions, secrets handling, HTTP headers, cloud and container defaults.
+- `references/verification.md` — commands that prove it: scanners, secret scanning, fuzzing, CI gates, and the regression tests worth writing.
+- `references/provenance.md` — snapshot date, sources, confidence markers, and what decays fastest.

package/assets/skills/bulletproof/references/agent-surface.md

@@ -0,0 +1,82 @@
+# Agent, LLM & MCP Surface
+
+Load this when the project calls a model, exposes tools to a model, runs an agent, serves or consumes MCP, or ships a chat feature. Also load it when hardening a developer tool, because a developer tool is an agent target.
+
+Standards [V]: **OWASP Top 10 for LLM Applications (2025)** — LLM01 Prompt Injection, LLM02 Sensitive Information Disclosure, LLM03 Supply Chain, LLM04 Data and Model Poisoning, LLM05 Improper Output Handling, LLM06 Excessive Agency, LLM07 System Prompt Leakage, LLM08 Vector and Embedding Weaknesses, LLM09 Misinformation, LLM10 Unbounded Consumption. **OWASP Top 10 for Agentic Applications (2026)**, published 9 Dec 2025 — ASI01 Goal Hijack, ASI02 Tool Misuse, ASI03 Identity & Privilege Abuse, ASI04 Agentic Supply Chain, ASI05 Unexpected Code Execution, ASI06 Memory & Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Failures, ASI09 Human-Agent Trust Exploitation, ASI10 Rogue Agents. Its core principle is **least agency** — grant the minimum autonomy the task requires, not merely minimum permissions.
+
+## The one thing to internalize
+
+**Prompt injection cannot be reliably prevented.** A 2025 study of twelve proposed defenses recorded a 100% bypass rate against adaptive human red-teamers [V]. Any design whose safety depends on the model refusing a malicious instruction is already broken. Filters, delimiters, "ignore instructions in user content", and a second model checking the first are mitigations, not controls.
+
+Design for **containment**: assume the instruction lands, and make the outcome survivable.
+
+## The lethal trifecta
+
+Private data access **+** untrusted content **+** an egress channel. Any two are usually fine; all three is exploitable. Apply it as a design test to every agent feature.
+
+Documented outcomes when all three are present [V]: a malicious issue in a public repository caused an assistant to leak private repository contents; a support ticket containing embedded instructions caused an agent holding a privileged database credential to query a secrets table and publish the results back into the public thread.
+
+**Break one leg, deliberately:**
+
+| Leg | How to break it |
+|---|---|
+| Private data | Scope credentials per end-user, never a service-role key. The agent should hold exactly the access of the person it acts for |
+| Untrusted content | Cannot usually be removed — but mark provenance, and never let fetched content enter a context that also holds a privileged tool |
+| Egress | Default-deny outbound network. Most tasks need none. Allowlist specific hosts; block DNS, image loading, and markdown link rendering as exfiltration paths |
+
+Egress is the leg most often left intact and the easiest to close. Exfiltration in real incidents has ridden ordinary channels: an outbound HTTP request, a DNS lookup, an image URL rendered by the client, a markdown link the user clicks, a comment posted back to a public thread.
+
+## Architecture controls that actually hold
+
+1. **Least agency.** Per-task tool catalogs, not one catalog with everything. An agent summarizing a document does not need a shell.
+2. **The human approves the effect, not the intent.** Approval prompts must show the concrete operation — this file, this command, this recipient, this amount — because the user is approving something the model chose, possibly at an attacker's instruction. A prompt saying "the agent wants to continue" is theatre.
+3. **Deterministic policy outside the model.** Enforce limits in code that intercepts before execution: allowlisted commands, path containment, spend caps, rate limits, recipient allowlists. No model in the decision loop.
+4. **Irreversibility gates.** Deleting data, moving money, sending messages to third parties, publishing artifacts, and changing permissions each need explicit confirmation, and should be unavailable in autonomous runs.
+5. **Audit trail.** Log every tool invocation with arguments and outcome. EDR sees execution, not intent — a legitimately-instructed agent doing destructive work looks entirely normal [V], so the tool log is your only forensic record.
+6. **Treat model output as untrusted input** (LLM05). Never feed it to `eval`, a shell, SQL, `innerHTML`, or a file path without the same validation you would apply to a web form.
+7. **Isolate the workspace.** Run agent execution in a container or sandbox with no credentials mounted, no network by default, and a bounded filesystem.
+
+## Sandbox escapes — the 2026 pattern
+
+Multiple critical escapes were disclosed across the major coding-agent products in 2026 [S], and they share one root cause worth designing against:
+
+> **Files the agent writes inside the sandbox are later read, loaded, or executed by a trusted process outside it.**
+
+Concretely: symlinks created inside the workspace that an unsandboxed process later writes through; configuration and hook files inside the workspace that a trusted process loads; a writable-path parameter added to an allowlist without validation; allowlisted commands that are not actually read-only; a container socket reachable from inside.
+
+Checks: resolve and re-verify containment **after** opening a path, never before; never load configuration, hooks, or plugins from the sandboxed workspace into a trusted process; allowlist by resolved absolute path, not by name; verify that "read-only" commands are read-only, including their subcommands and flags.
+
+## Context and rules-file poisoning
+
+Instructions hidden in files the agent reads land directly in its context, which is the same as landing in its instructions [V].
+
+- **Invisible Unicode**: tag codepoints, bidirectional controls, zero-width characters. Documented in a backdoored public skill that multiple models interpreted as instructions. At least one vendor now detects and refuses tag characters [S] — do not assume all do.
+- **Vector files**: `CLAUDE.md`, `AGENTS.md`, `.cursorrules`, skill and extension files, MCP tool descriptions, and the same files in parent directories.
+- **Documented payloads**: instructing the agent to POST local `.env` contents to a webhook "for team sync" while suppressing output; and — worse — instructing the agent to inject a credential-harvesting block into every file it generates, so the backdoor propagates into CI and production through normal code review [V].
+- **Defenses**: scan context files for non-printable and bidi characters and normalize before use; diff them in code review like any other code; do not walk parent directories outside the project root for instruction files; pin and review shared skills and rules the way you review dependencies.
+
+## MCP specifics
+
+- **Servers are dependencies.** Install from a registry with signing and verification, pin the version, and re-review the tool list after every update. The first malicious server in the wild built trust across fifteen clean releases before adding a silent BCC header [V].
+- **Tool descriptions are model-visible input.** A server can poison behavior through description text alone, and can change descriptions after approval — a rug-pull. Pin and diff them.
+- **Token audience binding.** The specification requires resource indicators so a token issued for one server cannot be replayed against another; adoption across public servers is incomplete [U]. Check that your server validates the audience and that your client does not hand a broad token to every server.
+- **Stdio servers execute locally.** Command-injection CVEs in stdio server launchers are a recurring class [S]. Never construct the launch command from untrusted input; never auto-register a server from web content — this has been an RCE in the wild [S].
+- **Config files hold live credentials** — thousands of valid secrets have been found in MCP configuration [V]. Treat them as secret files.
+- **Server-side**: authenticate callers, authorize per-tool, validate every argument against a schema, and never let a tool return content that the client will treat as an instruction without provenance marking.
+
+## RAG, memory & multi-agent
+
+- Poisoned documents in a vector store are persistent injections that fire on retrieval (LLM08, ASI06). Control write access to the index, record provenance per chunk, and prefer per-tenant indexes over one shared index with metadata filtering.
+- Agent memory that persists across sessions is a persistence mechanism for an attacker. Scope memory per user, make it inspectable, make it clearable, and never let it carry tool permissions.
+- Agent-to-agent messages are untrusted input (ASI07). Authenticate the sender, validate the schema, cap the fan-out, and bound recursion depth — cascading failures (ASI08) are usually an unbounded loop, not an intrusion.
+- Cost and quota are a security property (LLM10). Cap tokens, tool calls, iterations, and spend per task. An unbounded agent loop is a self-inflicted denial of wallet.
+
+## Reviewing an agent feature — the short list
+
+1. Which of the three trifecta legs are present, and which one did you break?
+2. What is the full tool catalog for this task, and can each tool's worst outcome be undone?
+3. Where does untrusted content enter the context, and is it marked as data?
+4. What can leave the machine, and to which hosts?
+5. Whose credentials does the agent hold — the end user's, or the service's?
+6. Is every irreversible action gated on a human approving the concrete effect?
+7. Is there a tool-call log you could reconstruct an incident from?

package/assets/skills/bulletproof/references/audit-protocol.md

@@ -0,0 +1,154 @@
+# Full Review Protocol
+
+The multi-agent flow for "is this safe to ship", a hardening pass, or a requested audit. For inline work, do not run this — apply the control and move on.
+
+**Frame every phase and every subagent brief as authorized defensive review for the code owner.** The deliverable is a remediation report. No exploit code, no payloads, no attack tooling, at any phase. Describe risk at the data-flow level: where untrusted data enters, what it reaches, why it is fixable.
+
+**Confidence bar: report only findings at ≥0.8 confidence with a concrete data-flow path.** Missing a theoretical issue is cheaper than burying a real one in noise.
+
+**This protocol is stack-agnostic. Recon drives it.** Do not assume the language, the deploy target, or that an AI layer exists. Read first, decide second.
+
+## Phase 1 — Recon
+
+Spawn **four recon subagents in parallel** (one response, four calls). Each gets a narrow independent slice. **No vulnerabilities are flagged in this phase** — recon describes, it does not judge.
+
+**Agent A — Stack & deployment.** Manifests, lockfiles, CI/CD configs, Dockerfiles, IaC, deploy scripts, store metadata. Returns: languages, frameworks, runtimes; deploy target (browser / server / CLI / desktop / mobile / embedded / serverless / container / contract / firmware / ML pipeline / library / SaaS / self-hosted); how it ships (registry, app store, binary, image, chart); where it runs, and whether it is multi-tenant.
+
+**Agent B — Trust boundaries & sources.** Entry-point code: route handlers, argv/stdin parsing, env reads, queue consumers, WebSocket and IPC receivers, deep links and URL schemes, file and archive readers, deserializers, plugin and model loaders, MCP and tool handlers, webhooks. Returns a **sources table**: location (`file:line`), input shape, and who controls it — anonymous, authenticated user, another tenant, admin, another service, build-time, local user, physical.
+
+**Agent C — Sinks.** Dangerous operations. Returns a **sinks table** with `file:line` and type: shell exec, SQL/NoSQL/LDAP/XPath, eval/Function/exec/pickle/yaml.load/Marshal/ObjectInputStream, file write, dynamic require/import, network egress, auth decisions, secret reads, native deserializers, contract external calls, privileged setters, child process spawn.
+
+**Agent D — Assets & existing controls.** What must be protected, and what already protects it. Returns an **assets table** (credentials and token stores, PII stores, signing and update keys, CI secrets, model API keys, on-chain funds, session state, MCP configs, license keys) **plus a controls table** — the auth middleware, the ORM, RLS policies, CSP, sandbox, escaping layer, validation schema. The controls table is what stops Phase 3 from reporting forty things the framework already handles.
+
+**Then synthesize, in the main thread:**
+
+1. Assemble the four tables.
+2. Write the **threat model** — specific to this project. Who realistically targets it, for what, and through which surface? Ground it in `threat-landscape.md`, but name concrete actors and objectives for *this* codebase: supply-chain risk to downstream users of a library; cross-tenant abuse on a SaaS; a malicious repository opened by a developer tool; a hostile counterparty on a contract; a physical attacker with the device.
+3. Note gaps recon flagged for a deeper look.
+
+## Phase 2 — Plan the audit
+
+From recon, choose which classes apply. **Skip audits with no entry surface.** A static site gets no SQL audit. Firmware in Rust gets no prompt-injection audit. An ML pipeline gets deserialization. A published library weights supply chain heavily.
+
+| Audit | Fires when | Covers |
+|---|---|---|
+| **Access control** | any per-user, per-tenant, or role-gated data | IDOR/BOLA, missing function-level checks, RLS disabled or permissive, tenant filter only in the UI, authorization bypass through a user-controlled key, mass assignment |
+| **Injection** | untrusted input reaches an interpreter | SQL/NoSQL/LDAP/XPath, command injection, template injection, eval/exec, pickle/yaml.load, prompt injection into a privileged tool |
+| **AuthN & session** | any auth, session, or token logic | token signature and claim validation, algorithm confusion, session fixation and lifetime, OAuth redirect/state/PKCE, missing rate limits on credential checks, password reset flows, MFA bypass |
+| **Secrets & exposure** | any credential exists | hardcoded keys, git history, client bundles and source maps, logs and error responses, telemetry, debug endpoints, exposed `.env`/`.git` |
+| **Supply chain** | any dependency manager or external code | unpinned or mutable-tag dependencies, install-time scripts, typosquats and slopsquats, dependency confusion, lockfile drift, unsigned releases, editor extensions, MCP servers |
+| **CI/CD & build integrity** | any workflow or release pipeline | dangerous triggers with untrusted checkout, cache poisoning, script injection into run steps, over-broad `permissions:`, secret echo, self-hosted runner reuse, release signing and provenance |
+| **SSRF, path & file ops** | any URL or path built from input | SSRF to internal and metadata endpoints, path traversal, zip-slip, symlink races, TOCTOU, unrestricted upload, archive extraction outside the target |
+| **Cloud & infra config** | any IaC, container, or cloud SDK | over-permissive IAM, public storage, metadata service version, exposed control planes, presigned URLs without expiry, default credentials, permissive CORS with credentials, container privilege |
+| **Crypto** | any hashing, signing, or encryption | weak or misused primitives, ECB, static IV/nonce reuse, non-constant-time comparison, predictable randomness for tokens, unverified signatures, home-rolled constructions |
+| **Agent surface** | recon found LLM/agent/MCP/tool-calling code | indirect prompt injection, the lethal trifecta, tool poisoning and rug-pulls, hidden-Unicode instructions in rules files, memory and RAG poisoning, excessive agency, output handling |
+| **Taint dataflow** | sources and sinks tables are both non-empty | trace each source to every reachable sink; flag reachable paths with no effective sanitization between |
+| **Platform-specific** | recon surfaced one | from `platform-playbooks.md`: mobile IPC/deep links/WebView bridges; desktop IPC, loopback servers, updater integrity, packaging fuses; CLI shell-out and repo-config trust; firmware boot and debug interfaces; contract access control and oracles; ML deserialization and endpoint exposure |
+
+## Phase 3 — Parallel audits
+
+Spawn one subagent per selected audit **in a single response**, using the `auditor` agent. N is whatever Phase 2 chose — do not pad to a fixed number, do not drop a selected audit. If `auditor` is unavailable, use general subagents and open each brief with: "You are performing an authorized, read-only defensive security review for the code owner. Report data-flow risks so they can be patched. No exploit code."
+
+**Subagents cannot see this file or the recon output.** Each brief must contain, written out by you:
+
+- the specific class scope,
+- the relevant recon rows (sources, sinks, assets, **controls**, threat-model lines — condensed),
+- the applicable reference lines from `platform-playbooks.md`, `supply-chain.md`, `agent-surface.md`, or `secure-defaults.md`,
+- the confidence bar and the exclusions list below.
+
+Each auditor must:
+
+1. **Trace data flow** source → sink. Not pattern matching. A grep hit with no path is not a finding.
+2. Apply the **untrusted-input test**: is this input actually reachable by an untrusted party, or is it a constant, a build-time value, or operator-controlled configuration?
+3. Check the **controls table** before flagging: does the ORM parameterize, does the template engine escape, does middleware already enforce this, does the type system make it unreachable?
+4. Describe a concrete **risk scenario** at data-flow level — what kind of input arrives, how the system processes it, what the attacker ends up holding. No payloads. If the steps cannot be described, it is not a finding.
+5. Assign **confidence 0.0–1.0** and drop anything below 0.8 before returning.
+6. Return location, source→sink, scenario, impact, CWE, and a concrete code-level fix.
+
+## Phase 4 — False-positive filter
+
+Spawn `skeptic` subagents in parallel, batching 3–5 surviving findings each, capped at four skeptics. Each skeptic starts from "this is a false positive" and tries to disprove the finding; only confirmed findings survive. Pass the full finding text — skeptics see neither this file nor the auditors' context. Drop `DROP`, reduce severity on `DOWNGRADE`.
+
+**Hard exclusions — do not report these, even when technically real:**
+
+- Denial of service, rate limiting, or memory exhaustion without a clear amplification primitive
+- Theoretical races with no demonstrable trigger window
+- Regex denial of service where the pattern is not attacker-supplied
+- Log injection or log spoofing (cosmetic)
+- SSRF where the URL is a constant or build-time string
+- Environment-variable trust (the environment is operator-controlled by definition)
+- Client-side validation "bypass" on an endpoint that revalidates server-side
+- Framework-escaped rendering paths — only the explicit unsafe sinks (`dangerouslySetInnerHTML`, `v-html`, `bypassSecurityTrust*`, raw template filters) count
+- Command injection in a shell script with no untrusted input path
+- Findings in documentation, examples, or test fixtures
+- Dev-only tooling that does not ship to users and does not process untrusted repositories
+- Missing hardening headers or "could be improved" preferences with no demonstrated path
+- Secrets that are obviously test fixtures or public sample keys — but say you saw them and confirmed they are not live
+
+## Phase 5 — Report
+
+One report. No code edits in this phase.
+
+```
+# Bulletproof Report — [project]
+Date: [today]   Scope: [what was reviewed]   Not reviewed: [what was not]
+
+## Exposure summary
+[One paragraph: realistic exposure profile, where untrusted data enters, what an attacker would be after.]
+
+## Threat model
+[2–4 concrete scenarios from recon, each with actor, objective, and entry surface.]
+
+## Sources / Sinks / Assets / Existing controls
+[Compact tables from recon.]
+
+## Risk matrix
+| Severity | Count | Definition |
+|---|---|---|
+| Critical | N | RCE, full auth bypass, credential or key theft, cross-user data access, fund loss, shipped-artifact compromise |
+| High | N | privilege escalation, cross-tenant access with auth, live secret exposure, unauthenticated admin surface, update-channel integrity |
+| Medium | N | scoped disclosure, weakened crypto, partial bypass behind another control |
+
+## Findings
+
+### [BP-001] <title> — Critical
+- Location: path:line
+- Category: <slug>   CWE: CWE-XXX   Confidence: 0.95   Evidence: RUNTIME | CODE | DEDUCED
+- Reachable by: <anonymous internet / authenticated user / other tenant / local user / malicious repo / build system>
+- Source → Sink: <`POST /api/invoice` `body.id` → `db.query` string concat>
+- Risk scenario (data-flow level, no payloads):
+  1. Untrusted input of <shape> reaches <source>
+  2. It is processed as <what>, with <no/ineffective> validation at <where>
+  3. Result: <what the attacker holds>
+- Impact: <blast radius: whose data, how many, what spreads>
+- Fix: <concrete, code-level, at the chokepoint>
+- Verify: <the test or command that proves the fix>
+
+[…ordered Critical → High → Medium…]
+
+## What was not flagged
+[Which classes returned zero findings, how many candidates the filter dropped and why. Show the work, not only the survivors.]
+
+## Not checked
+[Surfaces, repos, or components outside this pass.]
+```
+
+## Phase 6 — Ask before fixing
+
+After the report, ask which findings to fix — all Critical and High, specific IDs, a category, or none. **Do not start fixing until the user picks.**
+
+When the user selects, do not fix directly in one pass. Add one task per finding (or per tightly coupled group) with the `tasks` tool, ordered by severity, exploitability and dependency. Each task needs a short title and a standalone prompt containing: the finding ID, the risk scenario, the affected files and anchors, the concrete remediation, an instruction to check security-sensitive implementation details against authoritative documentation before editing, the project's verification commands, and an instruction to re-check the finished fix against authoritative documentation before completing. Then tell the user where to find the task list, and do not begin executing unless they say so.
+
+If a Critical finding involves an exposed live credential, do not wait for the fix queue: tell the user to rotate it now, in the first line of the report.
+
+## Standards mapping
+
+Cite these in the `Category`/`CWE` fields, not in prose. Verified 12 Aug 2026 — re-verify before quoting as current.
+
+- **OWASP Top 10:2025** (final) — A01 Broken Access Control (SSRF folded in), A02 Security Misconfiguration, A03 Software Supply Chain Failures, A04 Cryptographic Failures, A05 Injection, A06 Insecure Design, A07 Authentication Failures, A08 Software or Data Integrity Failures, A09 Security Logging & Alerting Failures, A10 Mishandling of Exceptional Conditions. Note the renumbering: A03 is supply chain now, not injection.
+- **CWE Top 25 (2025 edition)**, top ten in order — CWE-79 XSS, CWE-89 SQLi, CWE-352 CSRF, CWE-862 Missing Authorization, CWE-787 Out-of-bounds Write, CWE-22 Path Traversal, CWE-416 Use After Free, CWE-125 Out-of-bounds Read, CWE-78 OS Command Injection, CWE-94 Code Injection.
+- **OWASP API Security Top 10 (2023, still current)** — API1 BOLA, API2 Broken Authentication, API3 BOPLA, API4 Unrestricted Resource Consumption, API5 Broken Function Level Authorization, API6 Unrestricted Access to Sensitive Business Flows, API7 SSRF, API8 Misconfiguration, API9 Improper Inventory Management, API10 Unsafe Consumption of APIs.
+- **OWASP ASVS 5.0.0** (May 2025) — ~350 requirements, cumulative L1/L2/L3. Requirement IDs were renumbered from 4.x; do not cite a 4.x ID as 5.0.
+- **OWASP Top 10 for LLM Applications (2025)** — LLM01 Prompt Injection … LLM10 Unbounded Consumption.
+- **OWASP Top 10 for Agentic Applications (2026)** — ASI01 Agent Goal Hijack, ASI02 Tool Misuse, ASI03 Agent Identity & Privilege Abuse, ASI04 Agentic Supply Chain, ASI05 Unexpected Code Execution, ASI06 Memory & Context Poisoning, ASI07 Insecure Inter-Agent Communication, ASI08 Cascading Agent Failures, ASI09 Human-Agent Trust Exploitation, ASI10 Rogue Agents.
+- **OWASP MASVS v2.1.0** — eight categories (STORAGE, CRYPTO, AUTH, NETWORK, PLATFORM, CODE, RESILIENCE, PRIVACY). **There are no L1/L2 levels since v2.0.0**; cite MASTG test IDs instead.