@kensaurus/skills 0.0.0-stage → 2.1.0

package/skills/plan-capacitor-hardening/SKILL.md

@@ -0,0 +1,217 @@
+---
+name: plan-capacitor-hardening
+description: >
+  Plan-only Capacitor/Ionic native-layer security audit: WebView, token
+  storage, deep links, OAuth, cleartext traffic, exported activities. Use
+  when "is my Capacitor app secure?" or "harden my hybrid app". Store
+  readiness → plan-mobile-readiness.
+license: MIT
+effort: high
+---
+
+# Capacitor Native-Layer Hardening Audit + Remediation Plan
+
+**Degree of freedom: HIGH** — native-layer inventory and plan. Stay
+**plan-only**. No config, manifest, or code edits until approved.
+
+## This skill vs neighbors
+
+| Skill | Owns |
+|---|---|
+| **plan-capacitor-hardening** (this) | Native-layer / WebView security plan |
+| `plan-mobile-readiness` | Store submission mechanics |
+| `enhance-capacitor-ui` | Hybrid shell UI |
+
+## How to reason (every plan item)
+
+1. **Propose** — config, storage, deep-link, or WebView change
+2. **Risk** — what a extracted APK or hijacked scheme actually exposes
+3. **Keep-working** — native controls that already hold in production
+4. **Phase** — prod-config leaks → tokens → auth → WebView → OTA (do not execute)
+
+## Worked example
+
+> **Propose:** `server.cleartext` and `webContentsDebuggingEnabled` false in prod; move auth tokens off Preferences onto Keychain/Keystore.
+> **Risk:** release APK allows remote WebView inspect + plaintext token backup exfil.
+> **Keep-working:** iOS ATS already blocks cleartext.
+> **Phase:** Phase 1 — strip dev config from prod.
+
+**Role:** Senior mobile security engineer (Capacitor / hybrid WebView surface).
+
+**Task:** Inventory `capacitor.config`, native manifests, token storage, OAuth/deep-links,
+and OTA setup against pillars 1–5; build config-vs-production table, phase remediations,
+emit `plan-capacitor-hardening.md`. **Audit & plan only — no config, manifest, or code
+edits until approved.**
+
+**Audit the native layer the web view hides. Change nothing until approved.**
+
+Capacitor's official guidance: audit **Data, Authentication/Deep-Linking, Network, and
+WebView security** — "without proper care, major security issues can crop up which can
+prove extremely damaging and expensive." Recurring vibe-coded failures: tokens in plaintext
+`localStorage`/`Preferences`, dev config (`cleartext: true`, `webContentsDebuggingEnabled`,
+broad `allowNavigation`) in production builds, OAuth on hijackable custom URL schemes, and
+Android components left `exported`. **Every finding here is invisible to web-only review.**
+
+---
+
+## When this fires
+
+Trigger phrases: *"is my Capacitor app secure"*, *"harden my hybrid app"*,
+*"WebView security"*, *"secure storage for tokens"*, *"deep link / OAuth security"*,
+*"cleartext traffic"*, *"allowNavigation"*, *"exported activity"*, *"is my OTA update
+safe"*, *"pre-store Capacitor hardening"*.
+
+Do **not** fire for: UI polish (`enhance-capacitor-ui`), RN perf (`mobile-rn-performance`),
+or store paperwork (`plan-mobile-readiness` — pairs with this). This owns the *native-layer
+security surface*.
+
+---
+
+## Why a dedicated skill
+
+`plan-rls-audit`, `plan-secrets-audit`, and `plan-input-validation` cover backend/web.
+None know `capacitor.config`, `AndroidManifest.xml`, `Info.plist`, the WebView bridge, or
+Keychain/Keystore. Hybrid-native gaps are invisible if you only review web code.
+
+---
+
+## The audit — four pillars (+ OTA)  [HIGH freedom]
+
+### 1 · Data security
+- **Secrets in the bundle** — API keys, tokens hardcoded in JS or build-time env injection.
+  Bundle is extractable; move secret-key ops server-side. → `plan-secrets-audit`
+- **Plaintext token storage** — auth tokens in `localStorage`, `@capacitor/preferences`,
+  IndexedDB, plain SQLite. Wrong. Use memory-only or **iOS Keychain / Android Keystore**
+  (`@aparajita/capacitor-secure-storage`, `capacitor-secure-storage-plugin`; both fall back to
+  plain `localStorage` on web). Ionic Identity Vault: no new sales since 2025-02.
+- **`allowBackup`** (Android) — `android:allowBackup="true"` exfiltrates app data via backups.
+
+### 2 · Authentication & deep linking
+- **Custom URL scheme OAuth** — `myapp://` not globally owned; malicious app can intercept.
+- **No PKCE** — OAuth2 in native apps **must** use PKCE.
+- **Custom scheme vs App/Universal Links** — prefer Universal Links (iOS) / App Links
+  (Android) with `assetlinks.json` / AASA. Note silent verification fallback to browser.
+- **Exported Android components** — `exported=true` + `BROWSABLE` + no validation = common
+  deep-link compromise. Audit every `<intent-filter>`.
+- **Deep-link input not validated** — URI params → `WebView.loadUrl`, file access, queries.
+  `startsWith` host checks inadequate.
+
+### 3 · Network security
+- **Non-HTTPS** — any `http://` in plaintext.
+- **`cleartext: true`** in `capacitor.config` — dev/live-reload only; never production.
+- **Missing `network_security_config`** (Android) — `usesCleartextTraffic="false"`; pinning
+  for high-assurance (note bypass risks).
+
+### 4 · WebView security
+- **No / weak CSP** — `Content-Security-Policy` meta tag scoping loads.
+- **Broad `allowNavigation`** — untrusted hosts load with native bridge attached; scope to
+  trusted API origin(s). Note `getPlatform()` quirk on navigated URLs.
+- **`webContentsDebuggingEnabled: true`** in production — remote inspection; gate to dev.
+- **`addJavascriptInterface` / bridge exposure** — untrusted content + JS interface =
+  Critical RCE vector.
+- **`setAllowFileAccess*` / `file://`**, `eval` on user input, insecure `postMessage`.
+
+### 5 · OTA / live-update governance
+- **Update channel integrity** — OTA bundles signed/encrypted; unauthenticated path = RCE.
+- **Store-policy** — Google permits WebView updates; **Apple: OTA must not alter core
+  functionality** (App Store violation independent of security).
+- **Rollback / kill switch** — can a bad update be reverted?
+
+Severity aligned with Capsec (`@capgo/capgo-sec`) rules where applicable: CAP001–011,
+AND001–010, and the SEC, STO, NET, IOS, AUTH, WEB, CRY, LOG and DBG families.
+`npx @capgo/capgo-sec rules` lists the current set.
+
+For each finding: location, gap, exposure, severity, remediation *direction*.
+
+---
+
+## Procedure  [HIGH freedom]
+
+1. **Inventory.** Read `capacitor.config.*`, `AndroidManifest.xml`, `Info.plist`, network
+   configs, OAuth/deep-link setup, token storage. State what you couldn't see.
+2. **Run pillars 1–5.** Tag **Critical** (bridge/`addJavascriptInterface` to untrusted
+   content, hardcoded signing key, plaintext secrets shipped), **High** (cleartext, broad
+   `allowNavigation`, exported component, custom-scheme OAuth w/o PKCE, plaintext tokens),
+   **Med** (debug flags, allowBackup, weak CSP), **Low** (logging nits).
+3. **Config-vs-production table** — dev-only settings live in prod build.
+4. **Phase** burndown. Production-config leaks and token storage first.
+5. **Emit `plan-capacitor-hardening.md`, then end the turn** with a standalone recap in chat: the two or three highest-impact findings and the first phase to approve. The file is the deliverable — write it before the recap.
+
+---
+
+## Guardrails  [LOW freedom — run exactly]
+
+- **Plan only.** No config, manifest, or storage migration edits.
+- **"Works in the browser" hides all of this.** Say so explicitly.
+- **Dev config is a production vulnerability.** `cleartext`, `webContentsDebuggingEnabled`,
+  broad `allowNavigation` must not ship.
+- **In-memory or hardware-backed only** for tokens/keys — not `Preferences`/`localStorage`.
+- **Universal/App Links + PKCE** for sensitive OAuth; custom scheme = High even if "works".
+- **Cross-hand:** bundle secrets → `plan-secrets-audit`; deep-link validation →
+  `plan-input-validation`; submission → `plan-mobile-readiness`.
+- **Minimal quoting** of config/manifest.
+
+## Self-critique before the burndown  [LOW freedom — do not skip]
+
+1. **evidenced-not-assumed** — config/manifest path or storage API, not "hybrid apps are risky"
+2. **plan-only** — no config, manifest, or storage migration this pass
+3. **phase justified** — prod-config leaks and plaintext tokens before OTA polish
+4. **right-owner** — bundle secrets → `plan-secrets-audit`; store paperwork → `plan-mobile-readiness`
+5. **no-false-safety** — "works in the browser" hides this surface; custom-scheme OAuth is High even if it works
+
+---
+
+## Report template — `plan-capacitor-hardening.md`
+
+```markdown
+# Capacitor Native-Layer Hardening Audit — <app>
+
+_Audit-only. Native security. Nothing changes until each phase is approved._
+_These findings are invisible to web-only review._
+
+## Scope
+- Inspected: capacitor.config ☐ AndroidManifest ☐ Info.plist ☐ token storage ☐ OAuth ☐ OTA ☐
+- Platforms: iOS ☐ Android ☐  | Assumptions: …
+
+## Dev-config-in-production
+| Setting | Prod value | Risk | Direction |
+|---------|------------|------|-----------|
+| server.cleartext | true | plaintext HTTP | false |
+| webContentsDebuggingEnabled | true | remote inspection | dev-only |
+| server.allowNavigation | ["*"] | bridge on untrusted origin | scope to API |
+
+## Verdict
+| Pillar | Crit | High | Med | Worst item |
+|--------|------|------|-----|-----------|
+| Data | n | n | n | tokens in localStorage |
+| Auth/Deep-link | n | n | n | custom-scheme OAuth, no PKCE |
+| Network | n | n | n | cleartext enabled |
+| WebView | n | n | n | bridge exposed |
+| OTA | n | n | n | unsigned channel |
+
+## Findings
+| # | Pillar | Location | Gap | Sev | Direction |
+|---|--------|----------|-----|-----|-----------|
+
+## Phased burndown
+- **Phase 1 — Strip dev config from prod** → `mobile-capacitor-platform`
+- **Phase 2 — Secure token storage** → `mobile-capacitor-platform` / `plan-secrets-audit`
+- **Phase 3 — Auth & deep-link** → PKCE, App/Universal Links, exported review
+- **Phase 4 — WebView & network** → CSP, network_security_config, bridge exposure
+- **Phase 5 — OTA governance** → sign channel, store-policy, rollback
+
+## Execution handoff
+Re-audit native files after each phase; verify secure storage + deep-links on real devices.
+```
+
+---
+
+## Chains with
+
+- **Launch gates** — run with `plan-mobile-readiness` before store submit.
+- **`plan-secrets-audit`** — bundle secrets cross-hand.
+- **`plan-input-validation`** — deep-link / WebView input validation cross-hand.
+- **Execution:** `mobile-capacitor-platform`, `backend-patterns`, `mobile-emulator-test`.
+- **Verify:** real-device secure storage + deep-link test; no dev config in release build.
+
+> Planned at high effort; executed at the default effort under the approved-plan execution rule (`approved-plan-execution.mdc`), which forbids reward hacking and feature deletion on any model.

package/skills/plan-data-integrity/SKILL.md

@@ -0,0 +1,187 @@
+---
+name: plan-data-integrity
+description: >
+  Plan-only audit of destructive-operation and migration safety. Use when "is
+  my migration safe", "could I lose data", or "my agent might delete prod".
+  Restore drills, RPO/RTO → plan-backup-dr. Code transforms →
+  audit-codemod-safety.
+license: MIT
+effort: high
+---
+
+# Data-Integrity & Destructive-Op Audit + Safeguard Plan
+
+**Degree of freedom: HIGH** — map wipe paths, score irreversibility, emit a plan.
+Stay **plan-only**. No migrations, tokens, or destructive commands until approved.
+
+**Role:** Senior platform engineer (destructive-op + migration safety).
+
+**Task:** Map every path to irreversible data loss, score by irreversibility × reach,
+phase structural safeguards, emit `plan-data-integrity.md`. **Audit & plan only — no
+migrations, tokens, or destructive commands until each phase is approved.**
+
+**Find what could wipe prod. Gate it. Change nothing until approved.**
+
+## This skill vs neighbors
+
+| Skill | Owns |
+|---|---|
+| **plan-data-integrity** (this) | Prevent irreversible loss — unguarded deletes, unsafe migrations, backups the agent can also wipe |
+| `plan-backup-dr` | Can you restore? RPO/RTO, drill evidence |
+| `audit-db-schema` | Schema design quality |
+| `plan-rls-audit` | Who can read/write which rows |
+
+## How to reason (every plan item)
+
+1. **Propose** — gate, blast-radius split, backfill-before-drop, or token scope
+2. **Risk** — irreversible prod loss, including backups the same identity can wipe
+3. **Keep-working** — already-gated, transactional, isolated paths
+4. **Phase** — Gates & isolation → Migration safety → Backup blast-radius → Least-privilege (do not execute)
+
+## Worked example
+
+> **Propose:** scope the agent token to non-destructive; move backups off the prod volume; split `0007_drop_legacy.sql` into backfill → verify → drop.
+> **Risk:** same identity can `DROP` prod *and* the backups — restore is theater.
+> **Keep-working:** additive migrations already wrap in a transaction.
+> **Phase:** Phase 1 — Gates & isolation (Critical).
+> **Restore proof:** `plan-backup-dr`, never this skill.
+
+In a widely reported 2026 incident, an AI agent deleted a startup's entire production
+database — *and every backup* — in seconds. Four structural failures: **overprivileged
+tokens**, **shared blast radius** (backups on same volume as prod), **no environment
+isolation**, **no destructive-action gate**. Written rules were ignored. Soft prompt-rules
+are not a control; the guardrail must be a *system boundary*.
+
+---
+
+## When this fires
+
+Trigger phrases: *"is this migration safe"*, *"could I lose data"*,
+*"destructive operations"*, *"my agent might nuke prod"*, *"safe schema
+change"*, *"pre-launch data safety"*.
+
+Do **not** fire for: query speed (`backend-db-performance`), RLS access
+(`plan-rls-audit`), schema *design* (`audit-db-schema`), or *"can we restore /
+what's our RPO / disaster recovery"* → `plan-backup-dr`. This skill owns
+*preventing* irreversible loss; that skill owns *recovering* after one.
+
+---
+
+## Why a dedicated skill
+
+The `db-migrator` subagent *executes* migrations; this *audits the safety net*
+before you trust automated execution. Distinct from `audit-db-schema` — here the
+only question is: *"what here could destroy data, and what stops it?"*
+
+---
+
+## The audit  [HIGH freedom]
+
+### A · Destructive operations in code & migrations
+- **Unguarded `DELETE` / `UPDATE` without `WHERE`** — or WHERE that matches all.
+- **`TRUNCATE`, `DROP TABLE`, `DROP COLUMN`** in migrations — confirm intent.
+- **Column drops/renames without backfill** — silent data loss.
+- **Cascade reach** — `ON DELETE CASCADE` further than intended.
+- **Destructive verbs in agent/CI scope** — `drop`, `truncate`, `destroy`, `rm -rf`.
+
+### B · Migration discipline
+- **No transaction wrapping** — half-applied migrations.
+- **No down/rollback path.**
+- **Run straight against prod** — no staging dry-run.
+- **Supabase specifics** — prod-linked CLI without branch/preview check.
+
+### C · Backup blast radius (prevent-wipe only)
+- **Backups in the same blast radius** as production — same credentials can delete both.
+- Hand restore drills, RPO/RTO, and "can we recover" to `plan-backup-dr`. This
+  section only asks: can the same identity that wipes prod also wipe the backups?
+
+### D · Privilege & isolation (least privilege)
+- **Overprivileged tokens** — destructive scope when only read/narrow write needed.
+- **No environment isolation** — staging reaches prod; shared connection strings.
+- **Production reachable from agent context** — top finding regardless of prompts.
+
+### E · Confirmation gates
+- **No out-of-band gate** on destructive ops — must be system boundary (RBAC/
+  approval), not prompt text.
+- **No kill switch / audit log** for agent operations.
+
+---
+
+## Procedure  [HIGH freedom — plan only]
+
+1. **Inventory destructive surface.** Migrations, SQL, scripts, agent/CI scopes.
+2. **Trace each to impact.** Reversible? gated? backed up outside blast radius?
+3. **Score.** "Agent can delete prod, backups share volume" = Critical, top of list.
+4. **Phase** — gates and blast-radius separation first.
+5. **Emit `plan-data-integrity.md`, then end the turn** with a standalone recap in chat: the two or three highest-impact findings and the first phase to approve. The file is the deliverable — write it before the recap. **Do not edit anything.**
+
+---
+
+## Guardrails
+
+- **Plan only.** No migration edits, token changes, backup config, and **never run
+  destructive commands to "verify".**
+- **System boundaries over prompt-rules.** Recommend structural gates, not more
+  agent instructions.
+- **Least privilege is the cheapest win.**
+- **Backups outside the blast radius or they don't count.**
+- **Backfill before drop.** One-step column drops on populated data = data loss.
+
+## Self-critique before the burndown  [LOW freedom — do not skip]
+
+1. **evidenced-not-assumed** — every wipe path cites a migration, script, or token scope
+2. **plan-only** — no SQL, no token edits, **never** a destructive "verify"
+3. **severity/phase justified** — agent-can-wipe-prod-and-backups is Critical, top of list
+4. **right-owner** — RPO/RTO/restore drill → `plan-backup-dr`; who-can-read-rows → `plan-rls-audit`; key rotation → `plan-secrets-audit`
+5. **no-false-safety** — prompt-rules are not a gate; backups in the same blast radius do not count
+
+---
+
+## Report template — `plan-data-integrity.md`
+
+```markdown
+# Data-Integrity & Destructive-Op Audit — <repo>
+
+_Audit-only. No migration, token, or backup config changes until approved._
+_No destructive command is run for any reason._
+
+## Scope
+- Audited: migrations ☐  SQL/scripts ☐  agent/CI token scopes ☐  backup config ☐
+- Stack: Supabase ☐  Railway ☐  Vercel ☐  AWS ☐  | Assumptions: …
+
+## Verdict
+| Severity | Count | Worst case |
+|----------|-------|-----------|
+| Critical | n | irreversible prod loss, no gate, backups in blast radius |
+| High     | n | unbackfilled drop, over-scoped token |
+| Medium   | n | no rollback path |
+
+## Findings
+| # | Operation / location | Data at risk | Reversible? | Gated? | Sev | Direction |
+|---|----------------------|--------------|-------------|--------|-----|-----------|
+| D1 | agent token scope | all prod tables | no | no | Crit | scope token; read-only default; approval gate |
+| D2 | backups on prod volume | all backups | no | no | Crit | move backups to isolated/immutable store |
+| D3 | 0007_drop_legacy.sql | users.legacy_id | no | no | High | backfill→verify→drop in separate migration |
+
+## Phased burndown
+- **Phase 1 — Gates & isolation** → infra/RBAC config — D1, D2 (make catastrophe impossible)
+- **Phase 2 — Migration safety** → `db-migrator` — backfill steps, transactions, rollbacks
+- **Phase 3 — Backup blast-radius gates** → isolate backups from the agent identity; restore drills / RPO stay on `plan-backup-dr`
+- **Phase 4 — Least-privilege sweep** → infra + `plan-secrets-audit` — token scoping
+
+## Execution handoff
+Approve a phase to run it. Confirm the agent identity cannot delete backups.
+Restore proof is `plan-backup-dr`, never this skill.
+```
+
+---
+
+## Chains with
+
+- **Security spine** — blast-radius layer (**this skill**); cross-hand tokens to
+  `plan-secrets-audit`. Recoverability → `plan-backup-dr`.
+- **Source transforms** (jscodeshift / find-replace / AI bulk edit) → `audit-codemod-safety`.
+- **Execution:** `db-migrator`, `backend-patterns`, infra config, `create-hook`.
+- **Verify:** confirm agent token can't reach prod; restore proof lives on `plan-backup-dr`.
+
+> Planned at high effort; executed at the default effort under the approved-plan execution rule (`approved-plan-execution.mdc`). Highest-stakes plan in the set — the plan says *what* can destroy data; the rule forbids the agent from doing it autonomously, on any model.