@lovehlmmm/primekit 1.0.0

package/skills/security/SKILL.md

@@ -0,0 +1,196 @@
+---
+name: pk:security
+description: "STRIDE + OWASP-based security audit with optional red-team persona discovery loop and auto-fix. Scans code for vulnerabilities from multiple attacker perspectives (auth attacker, supply chain, insider, infrastructure), categorizes by severity, and can iteratively fix findings using pk:autoresearch pattern."
+user-invocable: true
+when_to_use: "Invoke for threat-modeled security audit or auto-fix loops."
+category: utilities
+keywords: [security, STRIDE, OWASP, audit, red-team, penetration-testing, vulnerability-discovery]
+argument-hint: "<scope glob or 'full'> [--fix] [--red-team] [--iterations N]"
+metadata:
+  author: primekit
+  attribution: "Security audit pattern adapted from autoresearch by Udit Goenka (MIT)"
+  license: MIT
+  version: "1.0.0"
+---
+
+# pk:security — Security Audit
+
+Runs a structured STRIDE + OWASP security audit on a given scope. Produces a severity-ranked findings report. With `--fix`, applies fixes iteratively using the pk:autoresearch guard pattern.
+
+## When to Use
+
+- Before a release or major deployment
+- After adding auth, payment, or data-handling features
+- Periodic security review (monthly/quarterly)
+- Compliance check (SOC 2, GDPR, PCI-DSS prep)
+
+## When NOT to Use
+
+- Purely cosmetic changes (CSS, copy edits)
+- No user-facing code or data handling involved
+
+---
+
+## Modes
+
+| Mode | Invocation | Behavior |
+|------|-----------|----------|
+| Audit only | `/pk:security <scope>` | Scan → categorize → report (one-shot) |
+| Red-team discovery | `/pk:security <scope> --red-team` | Iterate 4 attacker personas → STRIDE/OWASP sweep → report |
+| Bounded red-team | `/pk:security <scope> --red-team --iterations N` | Cap persona discovery to N iterations total |
+| Audit + Fix | `/pk:security <scope> --fix` | Scan → categorize → fix iteratively |
+| Red-team + Fix | `/pk:security <scope> --red-team --fix` | Full persona discovery → fix confirmed Critical/High |
+| Bounded fix | `/pk:security <scope> --fix --iterations N` | Limit fix iterations to N |
+
+---
+
+## Audit Methodology
+
+### 1. Scope Resolution
+Expand the provided glob or `full` keyword into a file list. Read all in-scope files before analysis.
+
+### 2. STRIDE Analysis
+Evaluate each threat category systematically:
+- **S**poofing — identity/authentication weaknesses
+- **T**ampering — input validation, integrity controls
+- **R**epudiation — audit logging gaps
+- **I**nformation Disclosure — data leakage, secret exposure
+- **D**enial of Service — rate limits, resource exhaustion
+- **E**levation of Privilege — broken access control, RBAC gaps
+
+### 3. OWASP Top 10 Check
+Map findings to OWASP categories (A01–A10). See `references/stride-owasp-checklist.md` for per-category checks.
+
+### 4. Dependency Audit
+Run the appropriate package audit tool for the detected stack:
+- Node.js: `npm audit`
+- Python: `pip-audit`
+- Go: `govulncheck`
+- Ruby: `bundle audit`
+
+### 5. Secret Detection
+Scan for hardcoded API keys, passwords, tokens, and private keys using regex patterns. See `references/stride-owasp-checklist.md` → Secret Patterns.
+
+### 6. Finding Categorization
+Assign each finding a severity level (see Severity Definitions below).
+
+---
+
+## Output Format
+
+```
+## Security Audit Report
+
+### Summary
+- Files scanned: N
+- Findings: X critical, Y high, Z medium, W low, V info
+
+### Findings
+
+| # | Severity | Category | File:Line | Description | Fix Recommendation |
+|---|----------|----------|-----------|-------------|-------------------|
+| 1 | Critical  | Injection | api/users.ts:45 | SQL string concatenation | Use parameterized queries |
+| 2 | High      | Auth      | auth/login.ts:12 | No rate limiting | Add express-rate-limit |
+```
+
+---
+
+## Red-Team Discovery Mode (--red-team)
+
+When `--red-team` is provided, the audit runs a **multi-persona iterative discovery loop** before (or instead of) the standard one-shot STRIDE/OWASP sweep. Each persona represents a distinct attacker mindset with its own threat model and probe targets.
+
+### Persona Execution Order
+
+1. **Security Adversary** — external hacker; auth bypass, injection, IDOR, privilege escalation
+2. **Supply Chain Attacker** — dependency/CI poisoning; CVEs, unsigned artifacts, overly permissive CI
+3. **Insider Threat** — compromised internal account; horizontal/vertical escalation, bulk export, audit gaps
+4. **Infrastructure Attacker** — runtime/deployment foothold; SSRF, secrets in env, container misconfig
+
+Each persona phase follows the autoresearch iteration protocol:
+- Select next untested attack vector from persona's probe list
+- Assume that attacker's mindset — reason as adversary, not defender
+- Probe relevant code, trace data flows, find missing guards
+- Validate with proof (file:line, attack scenario, impact)
+- Log to `security-audit-results.tsv` with `persona` column
+- Chain: prior persona findings compound into later phases
+
+After all 4 personas complete, a standard STRIDE/OWASP sweep fills remaining coverage gaps.
+
+> See `references/red-team-personas.md` for the full persona catalog: threat models, typical attack vectors, and per-persona probe checklists.
+
+### Credential Hygiene (Mandatory)
+
+All findings across every persona MUST mask secret values before logging. Never emit raw JWTs (`eyJ...`), 32+ char hex strings, AWS key prefixes (`AKIA`, `ASIA`), or connection strings with embedded passwords. Use `<REDACTED_TOKEN>`, `<REDACTED_PASSWORD>`, or reference the env var name only.
+
+---
+
+## Fix Mode (--fix)
+
+When `--fix` is provided, apply fixes iteratively after the audit:
+
+1. Sort all findings by severity (Critical → High → Medium → Low)
+2. For each finding:
+   a. Apply one targeted fix
+   b. Run guard (tests or lint) to verify no regression
+   c. Commit: `security(fix-N): <short description>`
+   d. Advance to next finding
+3. Stop early if guard fails — report the failure instead of proceeding
+4. Uses `pk:autoresearch` guard pattern for regression prevention
+
+> Tip: Use `--iterations N` to cap total fix iterations when scope is large.
+
+---
+
+## Severity Definitions
+
+| Severity | Description | Fix Priority |
+|----------|-------------|-------------|
+| Critical | Exploitable now, data breach or RCE risk | Immediate — block release |
+| High | Exploitable with moderate effort, significant impact | This sprint |
+| Medium | Limited exploitability or impact | Next sprint |
+| Low | Theoretical risk, defense-in-depth improvement | Backlog |
+| Info | Best practice suggestion, no direct risk | Optional |
+
+---
+
+## Integration with Other Skills
+
+- Run after `pk:predict` when the security persona flags concerns
+- Feed Critical/High findings into `pk:autoresearch --fix` for automated remediation
+- Use `pk:scenario` with `--focus authorization` for deeper auth flow testing
+- Pair with `pk:plan` to schedule Medium/Low findings as sprint tasks
+
+---
+
+## Example Invocations
+
+```bash
+# One-shot audit — API layer only
+/pk:security src/api/**/*.ts
+
+# Red-team discovery — full codebase, all 4 personas
+/pk:security full --red-team
+
+# Red-team discovery — bounded to 20 iterations total
+/pk:security src/ --red-team --iterations 20
+
+# Red-team discovery + auto-fix confirmed Critical/High
+/pk:security full --red-team --fix
+
+# One-shot audit + auto-fix, max 15 iterations
+/pk:security src/ --fix --iterations 15
+```
+
+---
+
+See `references/stride-owasp-checklist.md` for the detailed per-category checklist and secret detection regex patterns.
+
+See `references/red-team-personas.md` for the full persona catalog: threat models, attack vectors, probe checklists, discovery loop integration, and TSV schema extension for `--red-team` mode.
+
+---
+
+## Lineage
+
+Faithful absorption (in scope) of upstream `/autoresearch:security` ([uditgoenka/autoresearch](https://github.com/uditgoenka/autoresearch), MIT). The local version supports both one-shot STRIDE + OWASP audit and the red-team-personas iterative discovery loop.
+
+See `/pk:autoresearch` for the full family map.

package/skills/security/references/red-team-personas.md

@@ -0,0 +1,188 @@
+# Red-Team Personas — pk:security Discovery Loop
+
+Adapted from upstream `/autoresearch:security` adversarial lenses (uditgoenka/autoresearch, MIT).
+
+Each persona represents a distinct attacker mindset. When `--red-team` mode is active, the discovery loop iterates over personas in order. Each iteration assumes the persona's threat model and probes from that lens before moving on.
+
+---
+
+## Persona Catalog (4 personas — faithful to upstream)
+
+### 1. Security Adversary (Primary)
+
+**Mindset:** "I'm a hacker trying to breach this system"
+
+**Threat Model:**
+- External attacker with no prior access
+- Goal: authentication bypass, data exfiltration, remote code execution
+- Assumes knowledge of the tech stack from public signals (headers, error messages, job listings)
+
+**Typical Attack Vectors:**
+- Auth bypass via JWT tampering, session fixation, missing CSRF
+- Injection: SQL, NoSQL, command, template (SSTI)
+- Privilege escalation: IDOR, broken access control, RBAC gaps
+- Information disclosure: verbose errors, debug endpoints, PII in responses
+
+**What to Probe:**
+- Trace every input from entry point to sink — find missing validation
+- Check every parameterized route for IDOR (`:id`, `:slug`, `:uuid`)
+- Test JWT: algorithm confusion (`none`/`HS256`→`RS256`), missing expiry, weak secret
+- Find unguarded admin routes; check middleware ordering for auth bypass
+
+---
+
+### 2. Supply Chain Attacker
+
+**Mindset:** "I'm compromising dependencies or build pipeline"
+
+**Threat Model:**
+- Attacker who cannot breach the app directly but can poison an upstream artifact
+- Goal: introduce malicious code via a dependency, CI script, or build artifact
+- Assumes partial knowledge of the dependency tree (public package registries)
+
+**Typical Attack Vectors:**
+- Known CVEs in direct or transitive dependencies
+- Typosquatting / dependency confusion attacks
+- Malicious or unmaintained packages with hidden behavior
+- Unsigned or unverified CI artifacts, missing integrity checks (SRI, checksums)
+- Overly permissive CI/CD permissions (e.g., `write-all` on GitHub Actions)
+
+**What to Probe:**
+- Run `npm audit` / `pip audit` / `go vuln` — catalogue every CVE, triage by exploitability
+- Check `package.json` / `requirements.txt` for unmaintained packages (last publish > 2 years)
+- Review `.github/workflows/` for `permissions: write-all`, `pull_request_target` without trust gates
+- Scan Dockerfile and CI scripts for `curl | sh`, unverified `apt-get`, missing checksum verification
+- Look for prototype pollution vectors in JS dependency tree
+
+---
+
+### 3. Insider Threat
+
+**Mindset:** "I'm a malicious employee or a compromised internal account"
+
+**Threat Model:**
+- Authenticated low-privilege user (e.g., viewer role, read-only API key)
+- Goal: escalate privileges, exfiltrate bulk data, cover tracks
+- Has legitimate credentials but exceeds authorized scope
+
+**Typical Attack Vectors:**
+- Horizontal privilege escalation: user A accessing user B's private resources
+- Vertical privilege escalation: viewer→admin via missing role checks
+- Bulk data export through legitimate endpoints (no pagination limits, no rate limiting)
+- Audit trail gaps: actions that leave no log entry
+
+**What to Probe:**
+- Check every admin/privileged endpoint — is authorization enforced server-side or only in UI?
+- Look for missing `WHERE user_id = current_user` guards in database queries
+- Find any endpoint that returns unbounded lists (no `LIMIT`, no cursor pagination)
+- Check audit log coverage: auth events, data exports, config changes — what goes unlogged?
+- Test whether deleting or modifying another user's resource returns 403 or silently succeeds
+
+---
+
+### 4. Infrastructure Attacker
+
+**Mindset:** "I'm attacking the deployment, not the application code"
+
+**Threat Model:**
+- Attacker who has gained a foothold in the runtime environment (container, VM, CI runner)
+- Goal: escape container, pivot to adjacent services, harvest secrets from environment
+- May start from a compromised low-privilege container process
+
+**Typical Attack Vectors:**
+- Secrets hardcoded in source, committed `.env` files, or leaked via build logs
+- Overly permissive container configs: `--privileged`, mounted host paths, `CAP_SYS_ADMIN`
+- Exposed internal services (metadata endpoints, health endpoints with sensitive data)
+- Network segmentation failures: app container reaching DB directly without firewall
+- SSRF enabling access to cloud metadata APIs (AWS `169.254.169.254`, GCP `metadata.google.internal`)
+
+**What to Probe:**
+- Scan all config files: `Dockerfile`, `docker-compose.yml`, Kubernetes manifests, Helm charts
+- Search for secrets in environment variable handling — are they passed as build args (leaks in image layers)?
+- Check for SSRF vectors: any server-side URL fetch without allowlist validation
+- Look for `process.env` reads that expose raw env vars in API responses or error messages
+- Verify no internal health/debug endpoints are reachable without authentication
+
+---
+
+## Discovery Loop Integration
+
+When `--red-team` flag is active, the audit runs one persona per "phase" before the standard STRIDE/OWASP sweep:
+
+```
+Phase 0: Setup (codebase recon, asset map, attack surface — same as one-shot audit)
+
+Phase 1: Security Adversary lens
+  → Iterate: select attack vector from this persona's list, probe, log
+  → Continue until no new vectors remain for this persona
+
+Phase 2: Supply Chain Attacker lens
+  → Focus: dependency tree, CI/CD pipeline, build artifacts
+
+Phase 3: Insider Threat lens
+  → Focus: access control gaps, data export paths, audit trails
+
+Phase 4: Infrastructure Attacker lens
+  → Focus: deployment config, secrets handling, SSRF, container security
+
+Phase 5: STRIDE/OWASP sweep (standard one-shot audit logic)
+  → Fill remaining coverage gaps across OWASP A01–A10 + STRIDE S/T/R/I/D/E
+
+Phase 6: Finding Consolidation + Report
+  → Deduplicate across phases, rank by severity, generate report
+```
+
+### Iteration Protocol per Persona Phase
+
+Each iteration within a persona phase:
+1. **Select** — pick next untested attack vector from persona's list
+2. **Assume persona mindset** — reason as that attacker, not as a defender
+3. **Probe** — read relevant code, trace data flows, find missing guards
+4. **Validate** — construct proof (file:line, attack scenario, impact)
+5. **Log** — append to `security-audit-results.tsv` with persona column
+6. **Chain** — prior findings compound: if Phase 1 found open endpoint, Phase 3 tests insider bulk-export via that endpoint
+
+### Results Log Extension
+
+When `--red-team` is active, the TSV gains a `persona` column:
+
+```tsv
+iteration	persona	vector	severity	owasp	stride	confidence	location	description
+1	security-adversary	IDOR	High	A01	EoP	Confirmed	src/api/users.ts:42	GET /api/users/:id no ownership check
+2	supply-chain	CVE-2024-1234	High	A06	Tampering	Confirmed	package.json	lodash 4.17.15 prototype pollution
+3	insider-threat	bulk-export	Medium	A01	EoP	Likely	src/api/users.ts:80	GET /api/users returns all users, no pagination limit
+4	infra-attacker	SSRF	High	A10	T	Confirmed	src/lib/fetch.ts:22	fetch(userInput) no allowlist
+```
+
+### Coverage Summary Extension
+
+```
+=== Red-Team Coverage (iteration 15) ===
+Personas: Security Adversary[✓] Supply Chain[✓] Insider[✓] Infrastructure[partial]
+STRIDE Coverage: S[✓] T[✓] R[✗] I[✓] D[✓] E[✓] — 5/6
+OWASP Coverage: A01[✓] A02[✗] A03[✓] A04[✗] A05[✓] A06[✓] A07[✓] A08[✗] A09[✗] A10[✓] — 6/10
+Findings: 2 Critical, 4 High, 3 Medium, 1 Low
+```
+
+---
+
+## Credential Hygiene (Mandatory in All Personas)
+
+Regardless of persona, any finding that references a secret value MUST mask it before logging:
+
+| Pattern | Mask Form |
+|---------|-----------|
+| API keys, JWTs, OAuth tokens | `<REDACTED_TOKEN>` |
+| Connection strings with passwords | `protocol://user:<REDACTED_PASSWORD>@host/db` |
+| Environment variable values | reference var name only: `$DATABASE_URL` |
+| Private keys, certs | first 8 chars + `<...REDACTED...>` + last 8 chars |
+
+Reject any draft finding containing: a JWT (`eyJ...`), 32+ char hex, AWS key prefixes (`AKIA`, `ASIA`), or known token formats. Re-mask before emitting.
+
+---
+
+## Attribution
+
+Persona catalog and discovery loop pattern adapted from:
+- uditgoenka/autoresearch `references/security-workflow.md` § "Red-Team Adversarial Lenses" (MIT License)
+- Strix AI-powered security testing platform patterns (via upstream attribution)

package/skills/security/references/stride-owasp-checklist.md

@@ -0,0 +1,128 @@
+# STRIDE + OWASP Security Checklist
+
+Reference checklist for `pk:security` audits. Use during Step 2 (STRIDE Analysis) and Step 3 (OWASP Top 10 Check).
+
+---
+
+## STRIDE Checklist
+
+### Spoofing (Authentication)
+- [ ] All endpoints require authentication (unless intentionally public)
+- [ ] Passwords hashed with bcrypt/argon2 — not MD5 or SHA1
+- [ ] JWT tokens have expiration (`exp`) and are validated server-side
+- [ ] Session management uses `Secure`, `HttpOnly`, `SameSite` cookie flags
+- [ ] Multi-factor auth available for sensitive operations
+- [ ] OAuth/OIDC flows use `state` parameter to prevent CSRF
+- [ ] Default credentials removed from all services and dependencies
+
+### Tampering (Integrity)
+- [ ] Input validation on all user-supplied data (type, length, format)
+- [ ] Parameterized queries used — no string concatenation for SQL/NoSQL
+- [ ] CSRF tokens present on all state-changing forms
+- [ ] Request signing for API-to-API calls (HMAC or mTLS)
+- [ ] File uploads validated for type (magic bytes), size, and content
+- [ ] Deserialization of untrusted data avoided or sandboxed
+- [ ] HTTP methods restricted per endpoint (no GET for mutations)
+
+### Repudiation (Logging)
+- [ ] Authentication events logged: login, logout, failures
+- [ ] Authorization failures logged with user/resource context
+- [ ] Data modification events logged with actor and timestamp
+- [ ] Logs do not contain sensitive data (passwords, tokens, PII)
+- [ ] Log integrity protected — append-only storage or centralized sink
+- [ ] Logs retained per compliance requirements (90 days minimum)
+
+### Information Disclosure
+- [ ] Error messages do not leak stack traces in production
+- [ ] API responses exclude internal IDs, system paths, or version strings
+- [ ] Sensitive data encrypted at rest (AES-256 or equivalent)
+- [ ] All transport uses TLS 1.2+ — no HTTP for sensitive endpoints
+- [ ] No hardcoded secrets in source code (see Secret Patterns below)
+- [ ] `.env` files and credential files listed in `.gitignore`
+- [ ] API responses filtered to minimum necessary fields (no over-fetching)
+
+### Denial of Service
+- [ ] Rate limiting on authentication and sensitive endpoints
+- [ ] Request body size limits configured at server/gateway level
+- [ ] Pagination enforced on all list endpoints (no unbounded queries)
+- [ ] Timeouts set on all external API and database calls
+- [ ] Connection pools sized and cleaned up properly
+- [ ] Regex patterns reviewed for catastrophic backtracking (ReDoS)
+- [ ] Background jobs have concurrency limits and dead-letter queues
+
+### Elevation of Privilege
+- [ ] Role-based access control (RBAC) enforced server-side, not client-side
+- [ ] Horizontal privilege checks: user A cannot access user B's resources (IDOR)
+- [ ] Admin endpoints have separate, stricter auth middleware
+- [ ] Privilege escalation paths require re-authentication
+- [ ] Service accounts use principle of least privilege
+- [ ] Third-party integrations scoped to minimum required permissions
+
+---
+
+## OWASP Top 10 Quick Reference
+
+| # | Category | What to Check |
+|---|----------|---------------|
+| A01 | Broken Access Control | Missing auth checks, IDOR vulnerabilities, CORS misconfiguration, path traversal |
+| A02 | Cryptographic Failures | Weak hashing (MD5/SHA1), plaintext storage, missing TLS, weak cipher suites |
+| A03 | Injection | SQL, NoSQL, OS command, LDAP, template injection via unsanitized input |
+| A04 | Insecure Design | Missing threat model, business logic flaws, no abuse-case testing |
+| A05 | Security Misconfiguration | Default credentials, verbose error pages, unnecessary features/ports enabled |
+| A06 | Vulnerable Components | Outdated dependencies, known CVEs, unpatched libraries |
+| A07 | Auth Failures | Brute force possible, credential stuffing, session fixation, weak tokens |
+| A08 | Data Integrity Failures | Unsigned updates, unverified deserialization, CI/CD pipeline compromise |
+| A09 | Logging Failures | Missing security event logs, no alerting, insufficient monitoring coverage |
+| A10 | SSRF | Unvalidated user-supplied URLs, internal service access via fetch/curl |
+
+---
+
+## Secret Patterns to Detect
+
+Scan source files for the following regex patterns. Any match is a Critical finding.
+
+```regex
+# Generic API keys
+(?i)(api[_-]?key|apikey)\s*[:=]\s*['"][A-Za-z0-9\-_]{20,}['"]
+
+# AWS access key IDs
+AKIA[0-9A-Z]{16}
+
+# AWS secret access keys
+(?i)aws[_-]?secret[_-]?access[_-]?key\s*[:=]\s*['"][A-Za-z0-9/+]{40}['"]
+
+# JSON Web Tokens
+eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+
+
+# Generic passwords in config/code
+(?i)(password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]
+
+# Private keys (PEM format)
+-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----
+
+# GitHub personal access tokens
+ghp_[A-Za-z0-9]{36}
+
+# Stripe secret keys
+sk_(live|test)_[A-Za-z0-9]{24,}
+
+# Generic bearer tokens
+(?i)bearer\s+[A-Za-z0-9\-._~+/]{20,}
+```
+
+> False positive reduction: skip matches inside `*.test.*`, `*.spec.*`, `*.example`, and `*.md` files when the value is clearly a placeholder (e.g., `YOUR_KEY_HERE`, `<your-token>`).
+
+---
+
+## Dependency Audit Commands
+
+Run the appropriate command for the detected stack and include output in the findings report:
+
+| Stack | Command |
+|-------|---------|
+| Node.js | `npm audit --json` |
+| Python | `pip-audit --format json` |
+| Go | `govulncheck ./...` |
+| Ruby | `bundle audit check --update` |
+| Java/Maven | `mvn dependency-check:check` |
+| Rust | `cargo audit` |

package/skills/security-scan/SKILL.md

@@ -0,0 +1,145 @@
+---
+name: pk:security-scan
+description: "Scan codebase for security vulnerabilities, hardcoded secrets, dependency issues, and OWASP patterns. Use when asked to 'security scan', 'check for secrets', 'audit security', or before major releases."
+user-invocable: true
+when_to_use: "Invoke for secrets, dependency, and OWASP-style scans."
+category: utilities
+keywords: [security, secrets, vulnerabilities, OWASP]
+argument-hint: "[scope] [--secrets-only] [--deps-only] [--full]"
+metadata:
+  author: primekit
+  version: "1.0.0"
+---
+
+# Security Scan
+
+Lightweight security scanner using Claude's reasoning + shell tools. No external dependencies required.
+
+## Usage
+
+```
+/pk:security-scan              # Full scan of current project
+/pk:security-scan --secrets-only   # Only secret/credential detection
+/pk:security-scan --deps-only      # Only dependency audit
+/pk:security-scan src/api/         # Scan specific directory
+```
+
+## Scan Categories
+
+| Category | Method | Speed | Reference |
+|----------|--------|-------|-----------|
+| Secrets | search_files capability regex patterns | Fast | `references/secret-patterns.md` |
+| Dependencies | `npm audit` / `pip audit` | Medium | Built-in |
+| Code patterns | search_files capability + Claude analysis | Medium | `references/vulnerability-patterns.md` |
+
+## Workflow
+
+### 1. Detect Project Type
+
+```
+- Check for package.json → Node.js
+- Check for requirements.txt / pyproject.toml → Python
+- Check for go.mod → Go
+- Check for Cargo.toml → Rust
+```
+
+### 2. Secret Scanning (Always runs first)
+
+Load `references/secret-patterns.md` for regex patterns.
+
+Use search_files capability to search for each pattern category:
+- API keys and tokens (AWS, GitHub, Stripe, etc.)
+- Private keys and certificates
+- Database connection strings with credentials
+- Hardcoded passwords in code
+
+**Exclude**: `.env.example`, test fixtures, documentation, `node_modules/`, `dist/`
+
+For each match:
+- Verify it's a real secret (not a placeholder like `YOUR_API_KEY`)
+- Rate severity: CRITICAL (exposed prod key), HIGH (real credential), MEDIUM (possible credential)
+
+### 3. Dependency Audit (If applicable)
+
+Run the appropriate command:
+```bash
+# Node.js
+npm audit --json 2>/dev/null || echo '{"error":"npm audit failed"}'
+
+# Python (if pip-audit available)
+pip audit --format json 2>/dev/null || echo '{"error":"pip audit unavailable"}'
+```
+
+Parse output, categorize by severity (critical/high/moderate/low).
+
+### 4. Code Pattern Analysis
+
+Load `references/vulnerability-patterns.md` for patterns.
+
+Use search_files capability to search for dangerous patterns:
+- SQL injection (string concatenation in queries)
+- XSS (innerHTML, dangerouslySetInnerHTML without sanitization)
+- Command injection (exec/spawn with unsanitized input)
+- Path traversal (user input in file paths)
+- Insecure randomness (Math.random for security)
+- eval() / Function() with dynamic input
+
+For each match:
+- Read surrounding code context (5-10 lines)
+- Use Claude reasoning to determine if it's a real vulnerability or false positive
+- Rate severity and suggest fix
+
+### 5. .env Exposure Check
+
+```bash
+# Check if .env files are tracked by git
+git ls-files --error-unmatch .env .env.local .env.production 2>/dev/null
+# Check .gitignore for .env patterns
+grep -n "\.env" .gitignore 2>/dev/null
+```
+
+### 6. Generate Report
+
+Output a markdown report directly in chat:
+
+```markdown
+# Security Scan Report
+
+**Project:** {name}
+**Scanned:** {date}
+**Files checked:** {count}
+
+## Summary
+| Category | Critical | High | Medium | Low |
+|----------|----------|------|--------|-----|
+| Secrets  | X | X | X | - |
+| Deps     | X | X | X | X |
+| Code     | X | X | X | - |
+
+## Findings
+
+### CRITICAL
+1. **[SECRET]** Hardcoded AWS key in `src/config.js:42`
+   - Pattern: `AKIA[0-9A-Z]{16}`
+   - Fix: Move to environment variable
+
+### HIGH
+...
+
+## Recommendations
+1. ...
+```
+
+If `--auto` mode active in cook workflow: save report to `{CK_REPORTS_PATH}` or `plans/reports/security-scan-{date}.md`.
+
+## Scope Declaration
+
+This skill handles: Secret detection, dependency auditing, common vulnerability patterns.
+This skill does NOT handle: Penetration testing, runtime security analysis, infrastructure security, compliance audits.
+
+## Security Policy
+
+- NEVER output actual secret values in reports — redact to first 4 + last 2 chars
+- NEVER execute secrets or credentials found during scanning
+- NEVER modify code automatically — only report findings with fix suggestions
+- If a real credential is found, recommend immediate rotation