@martinffx/atelier 1.0.2 → 1.1.0

package/skills/code-perf/references/profiling-tools.md

@@ -1,126 +0,0 @@
-# Profiling Tools
-
-## Node.js
-
-### Built-in
-
-```bash
-# CPU profile
-node --prof app.js
-# Creates isolate-*.log
-
-# Analyze
-node --prof-process isolate-*.log
-
-# Memory
-node --inspect app.js
-# Open chrome://inspect
-```
-
-### clinic.js
-
-```bash
-npm install -g clinic
-
-# CPU + event loop
-clinic doctor -- node app.js
-
-# CPU flame graph
-clinic flame -- node app.js
-
-# Memory flame graph
-clinic泡沫 -- node app.js
-```
-
----
-
-## Python
-
-### cProfile
-
-```bash
-# Profile
-python -m cProfile -o profile.prof app.py
-
-# Analyze (sorted by cumulative)
-python -m cProfile -s cumulative app.py
-
-# Analyze (sorted by time)
-python -m cProfile -s tottime app.py
-
-# Interactive
-python -m cProfile -m app.py
-```
-
-### line-profiler
-
-```bash
-pip install line_profiler
-
-# Add @profile decorator
-@profile
-def slow_function():
-    ...
-
-# Run
-kernprof -l -v app.py
-```
-
----
-
-## Go
-
-### pprof
-
-```bash
-# CPU profile
-go test -cpuprofile=cpu.prof -bench=.
-go tool pprof cpu.prof
-
-# Memory profile
-go test -memprofile=mem.prof -bench=.
-go tool pprof mem.prof
-
-# Web UI
-go tool pprof -http=:8080 cpu.prof
-```
-
-### Built-in
-
-```bash
-# Runtime stats
-import runtime
-
-func printStats() {
-  var m runtime.MemStats
-  runtime.ReadMemStats(&m)
-  println(m.Alloc, m.TotalAlloc, m.Mallocs)
-}
-```
-
----
-
-## Browser
-
-### Chrome DevTools
-
-1. Open DevTools (F12)
-2. Performance tab
-3. Click Record
-4. Perform action
-5. Click Stop
-6. Analyze flame graph
-
-### What to Look For
-
-- Long tasks (50ms+)
-- Large paint/layout
-- Expensive JS functions
-- Memory growth over time
-
-### Memory Tab
-
-- Take heap snapshot
-- Compare snapshots
-- Find detached DOM trees
-- Track memory growth

package/skills/code-security/SKILL.md

@@ -1,183 +0,0 @@
----
-name: code-security
-description: >
-  Security audit and vulnerability detection. Use when reviewing code for security issues,
-  scanning dependencies, or addressing security concerns. Triggers on "security", "vulnerability",
-  "audit", "CVE", "injection", "XSS", "SQL injection", "auth", or when the user asks to check
-  for security issues.
-user-invocable: true
----
-
-# Code Security
-
-Security audit workflow and checklist.
-
-## The Workflow
-
-### 1. Scan
-
-Run automated security tools.
-
-```bash
-# Check dependencies
-npm audit
-pip audit
-cargo audit
-
-# Run security scanner
-trivy fs .
-snyk test
-```
-
-### 2. Review
-
-Manual code review against checklist.
-
-See references/owasp-top-10.md for common vulnerabilities.
-
-### 3. Fix
-
-Remediate vulnerabilities found.
-
-### 4. Verify
-
-Re-scan to confirm fixes.
-
----
-
-## Security Checklist
-
-### Injection
-
-| Check | Pattern |
-|-------|---------|
-| SQL | Parameterized queries |
-| Command | No shell execution with user input |
-| XSS | Escape/validate output |
-| LDAP | Escape DN components |
-
-### Authentication
-
-| Check | Pattern |
-|-------|---------|
-| Passwords | Hash with bcrypt/argon2 |
-| Sessions | Secure, httpOnly cookies |
-| Tokens | Short-lived, proper validation |
-| MFA | Consider for sensitive ops |
-
-### Data Protection
-
-| Check | Pattern |
-|-------|---------|
-| Secrets | Never in code |
-| PII | Encrypt at rest |
-| Transport | HTTPS only |
-| Logs | No sensitive data |
-
-### Dependencies
-
-| Check | Pattern |
-|-------|---------|
-| Vulnerabilities | Scan regularly |
-| Outdated | Update promptly |
-| Sources | Trusted packages only |
-
----
-
-## Common Vulnerabilities
-
-See references/vulnerability-patterns.md for detailed patterns:
-
-### SQL Injection
-
-```python
-# BAD
-query = f"SELECT * FROM users WHERE id = {user_id}"
-
-# GOOD
-query = "SELECT * FROM users WHERE id = %s"
-cursor.execute(query, (user_id,))
-```
-
-### XSS
-
-```javascript
-// BAD
-element.innerHTML = userInput;
-
-// GOOD
-element.textContent = userInput;
-// or
-element.setAttribute('title', sanitize(userInput))
-```
-
-### Command Injection
-
-```python
-# BAD
-os.system(f"ping {host}")
-
-# GOOD
-subprocess.run(['ping', host])
-```
-
-### Hardcoded Secrets
-
-```javascript
-// BAD
-const apiKey = "sk_live_12345";
-
-// GOOD (environment variable)
-const apiKey = process.env.API_KEY;
-```
-
----
-
-## Tools
-
-See references/security-tools.md for setup and usage:
-
-| Tool | Ecosystem | Purpose |
-|------|-----------|---------|
-| npm audit | Node.js | Dependency vulnerabilities |
-| pip-audit | Python | Dependency vulnerabilities |
-| cargo-audit | Rust | Dependency vulnerabilities |
-| Snyk | Multi | Vulnerability scanning |
-| Trivy | Multi | Container/infra scanning |
-| OWASP ZAP | Multi | Web app scanning |
-| bandit | Python | Static analysis |
-| ESLint security | JS/TS | Static analysis |
-
----
-
-## Output Format
-
-After security audit:
-
-```markdown
-## Security Audit
-
-### Scan Results
-- Dependencies: 0 vulnerabilities
-- Static analysis: 1 issue found
-
-### Issues Found
-
-| Severity | Issue | Location | Fix |
-|----------|-------|----------|-----|
-| High | SQL injection | users.py:42 | Use parameterized query |
-| Medium | Hardcoded secret | config.js:5 | Use env var |
-
-### Recommendations
-1. Enable 2FA for admin accounts
-2. Rotate API keys quarterly
-3. Set up automated dependency scanning
-```
-
----
-
-## Skill Loading
-
-- For database issues → load python-sqlalchemy or typescript-drizzle-orm
-- For auth issues → load relevant auth patterns
-- For deployment security → load infra skills if available

package/skills/code-security/references/owasp-top-10.md

@@ -1,129 +0,0 @@
-# OWASP Top 10 (2021)
-
-## A01: Broken Access Control
-
-Users acting outside their intended permissions.
-
-**Check:**
-- Enforce authorization on every request
-- Don't rely on hidden URLs
-- Disable directory listing
-- Log access control failures
-
-**Patterns:**
-```javascript
-// Check permission
-if (user.id !== resource.ownerId) {
-  throw new ForbiddenError();
-}
-```
-
----
-
-## A02: Cryptographic Failures
-
-Data exposure due to weak cryptography.
-
-**Check:**
-- Encrypt sensitive data at rest
-- Use strong encryption (AES-256, RSA-2048+)
-- Don't use deprecated algorithms (MD5, SHA1)
-- Proper key management
-
----
-
-## A03: Injection
-
-User data interpreted as code.
-
-**Types:**
-- SQL
-- NoSQL
-- OS Command
-- LDAP
-- Expression Language
-
-**Prevention:**
-- Parameterized queries
-- Input validation
-- Escape output
-
----
-
-## A04: Insecure Design
-
-Missing security controls in design.
-
-**Check:**
-- Threat modeling
-- Secure design patterns
-- Segregation of duties
-
----
-
-## A05: Security Misconfiguration
-
-Incorrect security settings.
-
-**Check:**
-- Default credentials
-- Unnecessary features
-- Error handling (no stack traces)
-- Security headers
-
----
-
-## A06: Vulnerable Components
-
-Using components with known vulnerabilities.
-
-**Check:**
-- Keep dependencies updated
-- Monitor CVE feeds
-- Remove unused components
-
----
-
-## A07: Auth Failures
-
-Weaknesses in authentication.
-
-**Check:**
-- Don't ship with default credentials
-- Implement MFA
-- Proper session handling
-- Credential recovery flows
-
----
-
-## A08: Software/Data Integrity Failures
-
-Assuming software updates are safe.
-
-**Check:**
-- Verify integrity (signatures, checksums)
-- Don't use untrusted CDNs
-- CI/CD security
-
----
-
-## A09: Logging Failures
-
-Insufficient logging and monitoring.
-
-**Check:**
-- Log access control failures
-- Log sensitive operations
-- Don't log secrets
-- Set up alerting
-
----
-
-## A10: SSRF
-
-Fetching remote resources without validating URLs.
-
-**Check:**
-- Validate URLs
-- Disable HTTP redirects
-- Use allowlists

package/skills/code-security/references/security-tools.md

@@ -1,102 +0,0 @@
-# Security Tools
-
-## Node.js
-
-### npm audit
-
-```bash
-npm audit
-npm audit fix
-npm audit --audit-level=high
-```
-
-### Snyk
-
-```bash
-npm install -g snyk
-snyk auth
-snyk test
-snyk monitor
-```
-
-### ESLint Security
-
-```bash
-npm install --save-dev eslint-plugin-security
-```
-
-.eslintrc.json:
-```json
-{
-  "plugins": ["security"],
-  "rules": {
-    "security/detect-object-injection": "error",
-    "security/detect-non-literal-fs-filename": "error"
-  }
-}
-```
-
----
-
-## Python
-
-### pip-audit
-
-```bash
-pip install pip-audit
-pip-audit
-```
-
-### Bandit
-
-```bash
-pip install bandit
-bandit -r src/
-bandit -r src/ -f json -o report.json
-```
-
-### Safety
-
-```bash
-pip install safety
-safety check
-safety check --json
-```
-
----
-
-## Go
-
-### govulncheck
-
-```bash
-go install golang.org/x/vuln/cmd/govulncheck@latest
-govulncheck ./...
-```
-
-### gosec
-
-```bash
-go install github.com/securego/gosec/cmd/gosec@latest
-gosec ./...
-```
-
----
-
-## Multi-Language
-
-### Trivy
-
-```bash
-brew install trivy
-trivy fs .
-trivy fs --severity HIGH,CRITICAL .
-trivy image myimage:latest
-```
-
-### OWASP ZAP
-
-```bash
-# Docker
-docker run -p 8080:8080 owasp/zap2docker-stable zap-baseline.py -t https://example.com
-```

package/skills/code-security/references/vulnerability-patterns.md

@@ -1,129 +0,0 @@
-# Vulnerability Patterns
-
-## SQL Injection
-
-### Bad
-```python
-query = f"SELECT * FROM users WHERE id = {user_id}"
-```
-
-### Good
-```python
-query = "SELECT * FROM users WHERE id = %s"
-cursor.execute(query, (user_id,))
-```
-
----
-
-## Command Injection
-
-### Bad
-```python
-os.system(f"ping {host}")
-```
-
-### Good
-```python
-subprocess.run(['ping', host], check=True)
-```
-
----
-
-## XSS (Cross-Site Scripting)
-
-### Bad
-```javascript
-element.innerHTML = userInput;
-```
-
-### Good
-```javascript
-element.textContent = userInput;
-// or
-element.setAttribute('title', sanitize(userInput));
-```
-
----
-
-## Path Traversal
-
-### Bad
-```python
-file = open(f"uploads/{filename}")
-```
-
-### Good
-```python
-import os
-base = "/app/uploads"
-filename = os.path.basename(filename)
-filepath = os.path.join(base, filename)
-if not filepath.startswith(base):
-    raise ValueError("Invalid path")
-file = open(filepath)
-```
-
----
-
-## Hardcoded Secrets
-
-### Bad
-```javascript
-const API_KEY = "sk_live_abc123";
-```
-
-### Good
-```javascript
-const API_KEY = process.env.API_KEY;
-if (!API_KEY) throw new Error("API_KEY not set");
-```
-
----
-
-## Insecure Random
-
-### Bad
-```javascript
-const token = Math.random().toString(36);
-```
-
-### Good
-```javascript
-const crypto = require('crypto');
-const token = crypto.randomBytes(32).toString('hex');
-```
-
----
-
-## Unvalidated Redirect
-
-### Bad
-```javascript
-res.redirect(req.query.url);
-```
-
-### Good
-```javascript
-const allowed = ['/dashboard', '/profile'];
-if (allowed.includes(req.query.url)) {
-  res.redirect(req.query.url);
-}
-```
-
----
-
-## Mass Assignment
-
-### Bad
-```javascript
-const user = req.body;  // All fields accepted
-```
-
-### Good
-```javascript
-const user = {
-  name: req.body.name,
-  email: req.body.email
-  // Explicitly select allowed fields
-};
-```