@mmerterden/multi-agent-pipeline 20.0.0 → 20.1.0

package/pipeline/skills/shared/external/security-review/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: security-review
+description: "Run a defensive, static security review of a diff or a repo: build a run-scoped threat model, find vulnerabilities joined to OWASP + CWE with CVSS scoring and evidence, and emit reviewer-shaped findings with before/after fixes. Use when reviewing code for security, auditing a dependency set, preparing a release for a security sign-off, or when a diff touches auth, crypto, input handling, networking or secrets."
+risk: low
+source: multi-agent-pipeline
+date_added: "2026-09-21"
+---
+
+# Security Review (defensive, static)
+
+## Overview
+
+A static, read-only security review. It reads code, configuration and dependency manifests and reports vulnerabilities the way the pipeline can act on them: each finding joined to an OWASP category and a CWE, scored with CVSS 3.1, backed by evidence and its counterevidence, and paired with a before/after fix. It never runs the target, fires a payload, or reaches a live host - the posture is defensive and offline. The output is reviewer-shaped, so a blocking finding merges into triage and blocks the commit like any other blocker.
+
+This is stack-neutral. The same method covers a Swift or Kotlin mobile diff, a TypeScript / Python / Go / Java backend, and a web front-end. What changes per stack is the OWASP catalog (Mobile Top 10 for apps, Web/API Top 10 for services and sites) and the sink vocabulary, not the method.
+
+## When to Use This Skill
+
+- Reviewing a diff whose paths touch authentication, authorization, crypto, input handling, networking, deserialization, file access or secrets.
+- Auditing a dependency set for known-vulnerable packages before a release.
+- Preparing a branch for a security sign-off, or answering "is this change safe to ship".
+- Any run where `/multi-agent:security-review` is invoked, or Phase 3 fires the `security_path` signal.
+
+## How It Works
+
+### Step 1: Build the run-scoped threat model
+
+Before any finding, establish the four-section threat model for THIS change and write it to `.pipeline/threat-model.md` (contract: `threat-model.md` in the pipeline refs). Attacker, trust boundaries, attack surface, severity calibration. Every finding's severity is calibrated against it, and a `blocking` finding must trace to a named assumption in it. A diff with no plausible attacker gets a short model and findings that cap at `suggestion`.
+
+### Step 2: Map the surface to a standard
+
+Join every candidate finding to a checkable standard, never a bare opinion:
+
+- **Web / API** - OWASP Top 10 2021 (`references/owasp-web-api-top10-2021.md`), with the CWE most associated with each category.
+- **Mobile** - OWASP Mobile Top 10 2024 (`references/owasp-mobile-top10-2024.md`).
+
+Walk the checklist against the changed surface only. A finding outside the touched surface is out of scope unless the diff made it reachable, and then you say how.
+
+### Step 3: Score with CVSS, and keep the number honest
+
+For each finding, write a CVSS 3.1 base vector and compute the score with the `security_cvss_score` toolkit tool - never by hand, so the score cannot drift from the vector. The band sets the reviewer severity: critical or high -> `blocking`, medium -> `important`, low or none -> `suggestion`.
+
+Every finding carries:
+
+- **evidence** - what in the code proves it, cited by `file:line`. No evidence, no finding.
+- **counterevidence** - what would disprove it, or the condition that makes it a false positive. Blank asserts there is none.
+- **confidence** - `high|medium|low`. Low does not mean silent; it means report with the counterevidence.
+- **severityChangeConditions** - the assumption the score rests on, so a reader disputes the assumption, not the number.
+
+### Step 4: Inventory dependencies (offline)
+
+Run `security_dep_inventory` on the lockfiles in scope to get a normalized `{ecosystem, name, version}` list. Hand that list to a known-CVE lookup (the analyst toolkit's evidence-registry) as a separate step - this skill contacts nothing itself. A vulnerable dependency is `A06:2021` with the advisory's CWE and CVE, on the manifest file at line 0.
+
+### Step 5: Emit reviewer-shaped findings
+
+Emit one object conforming to `reviewer-output.schema.json`, each finding also conforming to `security-finding.schema.json` (the `security` block). Include the before/after fix as `security.remediationDiff`, and `security.fixVerification` naming the empirical check a human or a later dynamic pass would run - static review cannot fire the exploit itself. `approved` is `false` if any finding is `blocking`.
+
+An empty findings list with `approved: true` is the right answer for a clean diff. Do not invent findings to look thorough, and do not raise a theoretical risk with no path from the threat model's attacker above `suggestion`.
+
+## What This Skill Does Not Do
+
+- No live target, no payloads, no exploitation, no proxy, no browser-driven attack. Defensive and static only.
+- No secret scanning of its own: the pipeline already has that surface (`pre-commit-check.sh` / the egress gate, held in parity against `secret-patterns.json`). Call it; do not hand-roll a fourth list.
+- No store-policy audit: that is the separate `store-ready` device pass under `/multi-agent:test`.

package/pipeline/skills/shared/external/security-review/references/owasp-mobile-top10-2024.md

@@ -0,0 +1,53 @@
+# OWASP Mobile Top 10 2024 - review checklist with CWE mapping
+
+The category id (`M1:2024` .. `M10:2024`) goes in a finding's `security.owaspCategory`; the CWE that names the actual weakness goes in `security.cwe`. For the fuller mobile catalog that ties these to MASVS / MASTG and the store-compliance rules, the swift-security compliance mapping is the deeper reference; this is the review checklist.
+
+## M1:2024 - Improper Credential Usage
+
+Check: hardcoded API keys / passwords / tokens, credentials in source or resource files, credentials in logs, a secret shipped in the binary.
+CWEs: CWE-798 (hardcoded credentials), CWE-259, CWE-522.
+
+## M2:2024 - Inadequate Supply Chain Security
+
+Check: a dependency at a version with a known advisory, an unpinned SDK, a build step pulling an unverified artifact. This is the `security_dep_inventory` -> CVE path (`A06:2021`'s mobile analog).
+CWEs: CWE-1104, plus the advisory's CWE.
+
+## M3:2024 - Insecure Authentication/Authorization
+
+Check: auth decided client-side, a token accepted without verification, missing authorization on a sensitive action, biometric gate that only hides UI without protecting data.
+CWEs: CWE-287, CWE-306 (missing authentication), CWE-862, CWE-863.
+
+## M4:2024 - Insufficient Input/Output Validation
+
+Check: untrusted input into a SQL/content-provider query, a WebView `evaluateJavascript` / `postMessage` handler trusting page content, deep-link parameters used without validation, format-string or path built from input.
+CWEs: CWE-20, CWE-79 (WebView XSS), CWE-89, CWE-22.
+
+## M5:2024 - Insecure Communication
+
+Check: HTTP instead of HTTPS, disabled ATS / cleartext-traffic permitted, `TrustManager` that accepts all certs, missing certificate pinning on a sensitive endpoint, ignored TLS errors.
+CWEs: CWE-319 (cleartext), CWE-295 (improper certificate validation).
+
+## M6:2024 - Inadequate Privacy Controls
+
+Check: PII collected without need, location/contacts/identifiers sent off-device without disclosure, tracking before consent, PII in logs or analytics events.
+CWEs: CWE-359, CWE-200, CWE-532.
+
+## M7:2024 - Insufficient Binary Protections
+
+Check: no tamper/integrity check where the threat model needs one, debug symbols or verbose logging left in a release build, an easily-reversible secret embedded in the binary. Judge against the threat model - most apps do not need anti-reversing, and a `blocking` here needs a named attacker.
+CWEs: CWE-656, CWE-489 (debug code left in).
+
+## M8:2024 - Security Misconfiguration
+
+Check: an exported Android component with no permission, `android:debuggable=true` or `allowBackup=true` on sensitive data, an overly-broad entitlement, a permissive `network_security_config`, default or weak settings.
+CWEs: CWE-16, CWE-276 (incorrect default permissions), CWE-926 (improper export).
+
+## M9:2024 - Insecure Data Storage
+
+Check: sensitive data in `UserDefaults` / `SharedPreferences` / plist / plain files instead of the Keychain / Keystore, a database without encryption, a cache holding secrets, pasteboard leakage.
+CWEs: CWE-312 (cleartext storage), CWE-922 (insecure storage of sensitive info).
+
+## M10:2024 - Insufficient Cryptography
+
+Check: weak or deprecated algorithm (MD5/SHA1 for integrity, DES/ECB), a hardcoded key/IV, a home-rolled cipher, a predictable random source for a security purpose.
+CWEs: CWE-327 (broken/risky algorithm), CWE-326, CWE-330 (insufficient randomness), CWE-338.

package/pipeline/skills/shared/external/security-review/references/owasp-web-api-top10-2021.md

@@ -0,0 +1,56 @@
+# OWASP Top 10 2021 (Web / API) - review checklist with CWE mapping
+
+The category id (`A01:2021` .. `A10:2021`) goes in a finding's `security.owaspCategory`; the CWE most associated with the specific weakness goes in `security.cwe`. One weakness per finding. The CWEs listed per category are the common ones, not the whole set - pick the one that names the actual defect.
+
+## A01:2021 - Broken Access Control
+
+Check: missing authorization on a route or action, IDOR (object id from the request trusted without an ownership check), path traversal, forced browsing, CORS misconfiguration allowing credentialed cross-origin reads, privilege escalation through a mass-assignable field.
+CWEs: CWE-284, CWE-285, CWE-639 (IDOR), CWE-862 (missing authorization), CWE-863 (incorrect authorization), CWE-22 (path traversal), CWE-352 (CSRF).
+Evidence to cite: the handler that reads an id from input and queries without a `where owner = current_user` predicate; a route with no auth middleware.
+
+## A02:2021 - Cryptographic Failures
+
+Check: secrets or PII sent or stored in clear, weak or deprecated algorithms (MD5, SHA1 for passwords, DES, ECB), hardcoded keys, missing TLS, disabled certificate validation, predictable IVs/nonces, passwords hashed without a slow KDF (bcrypt/scrypt/argon2).
+CWEs: CWE-311 (missing encryption), CWE-319 (cleartext transmission), CWE-327 (broken/risky algorithm), CWE-326 (inadequate strength), CWE-798 (hardcoded credentials), CWE-916 (weak password hash).
+
+## A03:2021 - Injection
+
+Check: SQL/NoSQL/ORM query built by string concatenation of untrusted input, OS command built from input, LDAP/XPath injection, unsanitized input reflected into HTML (XSS), template injection, header injection.
+CWEs: CWE-89 (SQL), CWE-78 (OS command), CWE-79 (XSS), CWE-90 (LDAP), CWE-94 (code injection), CWE-943 (NoSQL/query).
+Evidence: the untrusted source and the sink on the same path, with no parameterization or encoding between.
+
+## A04:2021 - Insecure Design
+
+Check: a missing control the design needed - no rate limit on a credential endpoint, no anti-automation on a costly action, trust placed in a client-supplied value that decides server behaviour, a workflow that can be replayed.
+CWEs: CWE-73, CWE-183, CWE-209 (info leak by design), CWE-256, CWE-501 (trust boundary violation), CWE-522.
+
+## A05:2021 - Security Misconfiguration
+
+Check: debug or verbose errors in production, default credentials, an unnecessary feature or port enabled, permissive CORS, missing security headers (CSP, HSTS, X-Content-Type-Options), directory listing, an overly-permissive cloud bucket or IAM policy in config.
+CWEs: CWE-16, CWE-611 (XXE), CWE-732 (incorrect permissions), CWE-1032, CWE-756.
+
+## A06:2021 - Vulnerable and Outdated Components
+
+Check: a dependency at a version with a known advisory. This is the `security_dep_inventory` -> CVE-lookup path. Carry the `cve` and the advisory's CWE; put the finding on the manifest at line 0.
+CWEs: CWE-1104, plus the advisory's own CWE.
+
+## A07:2021 - Identification and Authentication Failures
+
+Check: credential stuffing possible (no throttle/lockout), weak password policy, session id in the URL, session not rotated on login, missing or weak MFA, JWT with `alg:none` accepted or signature not verified, long-lived non-revocable tokens.
+CWEs: CWE-287 (improper auth), CWE-297, CWE-384 (session fixation), CWE-521 (weak password), CWE-613 (insufficient expiration), CWE-347 (improper signature verification).
+
+## A08:2021 - Software and Data Integrity Failures
+
+Check: insecure deserialization of untrusted data, an update or plugin loaded without signature verification, a CI/CD step pulling an unpinned or unverified artifact, client-side data trusted without integrity check.
+CWEs: CWE-502 (deserialization), CWE-345, CWE-494 (download without integrity check), CWE-829.
+
+## A09:2021 - Security Logging and Monitoring Failures
+
+Check: security-relevant events not logged (auth failures, access-control denials, high-value actions), logs containing secrets or PII, no alerting path. Note it as a `suggestion`/`important` gap, rarely `blocking` on its own.
+CWEs: CWE-778 (insufficient logging), CWE-532 (secrets in logs), CWE-223.
+
+## A10:2021 - Server-Side Request Forgery (SSRF)
+
+Check: the server fetches a URL built from user input without an allowlist, letting a caller reach internal services, cloud metadata endpoints, or the loopback interface.
+CWEs: CWE-918.
+Evidence: the input-derived URL reaching an HTTP client with no host allowlist or scheme restriction.

package/pipeline/commands/security-review.md

@@ -1,6 +0,0 @@
----
-description: Deep security audit on iOS project code
-allowed-tools: Read, Glob, Grep, Agent, Bash(git:*), Bash(grep:*)
----
-
-Alias for Phase 4 Reviewer 1 (Opus + security-auditor agent). Invocation: `/multi-agent:review` then select security focus; or invoke directly via Agent tool with subagent_type=security-auditor.