@monoes/monomindcli 2.15.3 → 2.15.4

package/org-skills/secure-code-guardian/references/input-validation.md

@@ -0,0 +1,146 @@
+# Input Validation
+
+## Zod Validation
+
+```typescript
+import { z } from 'zod';
+
+const UserSchema = z.object({
+  email: z.string().email().max(255),
+  name: z.string().min(1).max(100).regex(/^[\w\s-]+$/),
+  age: z.number().int().min(0).max(150).optional(),
+  role: z.enum(['user', 'admin']).default('user'),
+});
+
+function validateUser(data: unknown) {
+  return UserSchema.parse(data); // Throws on invalid
+}
+
+// Safe parse (no throw)
+const result = UserSchema.safeParse(data);
+if (!result.success) {
+  console.error(result.error.issues);
+}
+```
+
+## SQL Injection Prevention
+
+```typescript
+// ❌ NEVER do this
+const bad = `SELECT * FROM users WHERE id = ${userId}`;
+const bad2 = `SELECT * FROM users WHERE name = '${name}'`;
+
+// ✅ Parameterized queries
+const good = await db.query(
+  'SELECT * FROM users WHERE id = $1 AND name = $2',
+  [userId, name]
+);
+
+// ✅ Use ORM
+const user = await prisma.user.findFirst({
+  where: { id: userId, name: name }
+});
+
+// ✅ Query builder
+const user = await knex('users')
+  .where({ id: userId, name: name })
+  .first();
+```
+
+## Path Traversal Prevention
+
+```typescript
+import path from 'path';
+
+// ❌ Vulnerable
+const vulnerable = path.join('/uploads', userInput);
+
+// ✅ Safe - validate and sanitize
+function getSecurePath(baseDir: string, userInput: string): string {
+  // Remove any path traversal attempts
+  const sanitized = path.basename(userInput);
+
+  // Resolve and verify it's within base directory
+  const fullPath = path.resolve(baseDir, sanitized);
+
+  if (!fullPath.startsWith(path.resolve(baseDir))) {
+    throw new Error('Invalid path');
+  }
+
+  return fullPath;
+}
+```
+
+## Command Injection Prevention
+
+```typescript
+import { execFile } from 'child_process';
+
+// ❌ Never use exec with user input
+exec(`convert ${userInput}`); // Vulnerable!
+
+// ✅ Use execFile with arguments array
+execFile('convert', ['-resize', '100x100', safeFilename], (error, stdout) => {
+  // ...
+});
+
+// ✅ Better: Use library functions instead of shell
+import sharp from 'sharp';
+await sharp(inputPath).resize(100, 100).toFile(outputPath);
+```
+
+## URL Validation
+
+```typescript
+function validateUrl(input: string, allowedHosts: string[]): URL {
+  const url = new URL(input);
+
+  // Check protocol
+  if (!['http:', 'https:'].includes(url.protocol)) {
+    throw new Error('Invalid protocol');
+  }
+
+  // Check host allowlist
+  if (!allowedHosts.includes(url.hostname)) {
+    throw new Error('Host not allowed');
+  }
+
+  return url;
+}
+```
+
+## File Upload Validation
+
+```typescript
+const ALLOWED_TYPES = ['image/jpeg', 'image/png', 'image/gif'];
+const MAX_SIZE = 5 * 1024 * 1024; // 5MB
+
+function validateUpload(file: Express.Multer.File) {
+  if (!ALLOWED_TYPES.includes(file.mimetype)) {
+    throw new Error('Invalid file type');
+  }
+
+  if (file.size > MAX_SIZE) {
+    throw new Error('File too large');
+  }
+
+  // Verify magic bytes (not just extension)
+  const buffer = fs.readFileSync(file.path);
+  const type = fileType.fromBuffer(buffer);
+
+  if (!type || !ALLOWED_TYPES.includes(type.mime)) {
+    throw new Error('Invalid file content');
+  }
+}
+```
+
+## Quick Reference
+
+| Input Type | Validation |
+|------------|------------|
+| Email | Regex + max length |
+| URL | Protocol + host allowlist |
+| File path | basename + resolve check |
+| SQL | Parameterized queries |
+| Command | execFile + no shell |
+| File upload | Type + size + magic bytes |

package/org-skills/secure-code-guardian/references/owasp-prevention.md

@@ -0,0 +1,135 @@
+# OWASP Top 10 Prevention
+
+## OWASP Top 10 Quick Reference
+
+| # | Vulnerability | Prevention |
+|---|---------------|------------|
+| 1 | Injection | Parameterized queries, ORMs |
+| 2 | Broken Auth | Strong passwords, MFA, secure sessions |
+| 3 | Sensitive Data | Encryption at rest/transit |
+| 4 | XXE | Disable DTDs, use JSON |
+| 5 | Broken Access | Deny by default, server-side validation |
+| 6 | Misconfig | Security headers, disable defaults |
+| 7 | XSS | Output encoding, CSP |
+| 8 | Insecure Deserialization | Schema validation, allowlists |
+| 9 | Known Vulnerabilities | Dependency scanning |
+| 10 | Insufficient Logging | Log security events |
+
+## A01: Injection Prevention
+
+```typescript
+// SQL Injection - Use parameterized queries
+// ❌ Bad
+const bad = `SELECT * FROM users WHERE id = ${userId}`;
+
+// ✅ Good
+const good = await db.query('SELECT * FROM users WHERE id = $1', [userId]);
+
+// ✅ Good - Use ORM
+const user = await prisma.user.findUnique({ where: { id: userId } });
+
+// Command Injection - Avoid shell execution
+// ❌ Bad
+exec(`ls ${userInput}`);
+
+// ✅ Good - Use library functions
+const files = fs.readdirSync(safeDirectory);
+```
+
+## A02: Broken Authentication
+
+```typescript
+// Use bcrypt for passwords
+const hash = await bcrypt.hash(password, 12);
+const isValid = await bcrypt.compare(password, hash);
+
+// Implement account lockout
+if (failedAttempts >= 5) {
+  await lockAccount(userId, 15 * 60 * 1000); // 15 min
+}
+
+// Use secure session configuration
+app.use(session({
+  secret: process.env.SESSION_SECRET,
+  cookie: {
+    httpOnly: true,
+    secure: true,
+    sameSite: 'strict',
+    maxAge: 15 * 60 * 1000, // 15 minutes
+  },
+}));
+```
+
+## A03: Sensitive Data Exposure
+
+```typescript
+// Encrypt sensitive data at rest
+import crypto from 'crypto';
+
+function encrypt(text: string, key: Buffer): string {
+  const iv = crypto.randomBytes(16);
+  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
+  // ... encryption logic
+}
+
+// Use HTTPS only
+app.use((req, res, next) => {
+  if (!req.secure) {
+    return res.redirect(`https://${req.hostname}${req.url}`);
+  }
+  next();
+});
+```
+
+## A05: Broken Access Control
+
+```typescript
+// Always validate on server side
+async function getResource(userId: string, resourceId: string) {
+  const resource = await db.resource.findUnique({ where: { id: resourceId } });
+
+  // Verify ownership
+  if (resource.ownerId !== userId) {
+    throw new ForbiddenError('Access denied');
+  }
+
+  return resource;
+}
+
+// Use role-based access
+function requireRole(...roles: string[]) {
+  return (req: Request, res: Response, next: NextFunction) => {
+    if (!roles.includes(req.user.role)) {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+    next();
+  };
+}
+```
+
+## A07: XSS Prevention
+
+```typescript
+// Use Content Security Policy
+app.use(helmet.contentSecurityPolicy({
+  directives: {
+    defaultSrc: ["'self'"],
+    scriptSrc: ["'self'"],
+    styleSrc: ["'self'", "'unsafe-inline'"],
+  },
+}));
+
+// Sanitize user input for HTML
+import DOMPurify from 'dompurify';
+const clean = DOMPurify.sanitize(userInput);
+```
+
+## Quick Reference
+
+| Attack | Defense |
+|--------|---------|
+| SQL Injection | Parameterized queries |
+| XSS | Output encoding, CSP |
+| CSRF | CSRF tokens |
+| IDOR | Authorization checks |
+| Command Injection | Avoid exec(), validate input |

package/org-skills/secure-code-guardian/references/security-headers.md

@@ -0,0 +1,133 @@
+# Security Headers
+
+## Helmet (Express)
+
+```typescript
+import helmet from 'helmet';
+
+app.use(helmet()); // Enable all defaults
+
+// Or configure individually
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'"],
+      styleSrc: ["'self'", "'unsafe-inline'"],
+    },
+  },
+  hsts: {
+    maxAge: 31536000,
+    includeSubDomains: true,
+    preload: true,
+  },
+}));
+```
+
+## Manual Headers
+
+```typescript
+app.use((req, res, next) => {
+  // Prevent clickjacking
+  res.setHeader('X-Frame-Options', 'DENY');
+
+  // Prevent MIME sniffing
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+
+  // HSTS (HTTPS only)
+  res.setHeader('Strict-Transport-Security', 'max-age=31536000; includeSubDomains');
+
+  // Referrer policy
+  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+
+  // Permissions policy
+  res.setHeader('Permissions-Policy', 'geolocation=(), microphone=(), camera=()');
+
+  next();
+});
+```
+
+## Rate Limiting
+
+```typescript
+import rateLimit from 'express-rate-limit';
+
+// General API rate limit
+const apiLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 100,
+  message: { error: 'Too many requests' },
+  standardHeaders: true,
+  legacyHeaders: false,
+});
+
+app.use('/api/', apiLimiter);
+
+// Strict limit for auth endpoints
+const authLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000,
+  max: 5,
+  message: { error: 'Too many login attempts' },
+  skipSuccessfulRequests: true,
+});
+
+app.post('/api/login', authLimiter, loginHandler);
+app.post('/api/register', authLimiter, registerHandler);
+```
+
+## CORS Configuration
+
+```typescript
+import cors from 'cors';
+
+// Strict CORS
+app.use(cors({
+  origin: ['https://example.com', 'https://app.example.com'],
+  methods: ['GET', 'POST', 'PUT', 'DELETE'],
+  allowedHeaders: ['Content-Type', 'Authorization'],
+  credentials: true,
+  maxAge: 86400, // Cache preflight for 24 hours
+}));
+
+// Dynamic origin validation
+app.use(cors({
+  origin: (origin, callback) => {
+    const allowedOrigins = ['https://example.com'];
+    if (!origin || allowedOrigins.includes(origin)) {
+      callback(null, true);
+    } else {
+      callback(new Error('Not allowed by CORS'));
+    }
+  },
+}));
+```
+
+## Cookie Security
+
+```typescript
+res.cookie('session', token, {
+  httpOnly: true,      // No JavaScript access
+  secure: true,        // HTTPS only
+  sameSite: 'strict',  // CSRF protection
+  maxAge: 900000,      // 15 minutes
+  path: '/',
+  domain: '.example.com',
+});
+```
+
+## Quick Reference
+
+| Header | Value | Purpose |
+|--------|-------|---------|
+| X-Frame-Options | DENY | Clickjacking |
+| X-Content-Type-Options | nosniff | MIME sniffing |
+| Strict-Transport-Security | max-age=31536000 | Force HTTPS |
+| Content-Security-Policy | default-src 'self' | XSS |
+| Referrer-Policy | strict-origin-when-cross-origin | Privacy |
+
+| Cookie Flag | Purpose |
+|-------------|---------|
+| httpOnly | No JS access |
+| secure | HTTPS only |
+| sameSite=strict | CSRF protection |
+| maxAge | Expiration |

package/org-skills/secure-code-guardian/references/xss-csrf.md

@@ -0,0 +1,157 @@
+# XSS & CSRF Prevention
+
+## XSS Prevention
+
+### Output Encoding
+
+```typescript
+// React automatically escapes by default
+function SafeComponent({ userInput }: { userInput: string }) {
+  return <div>{userInput}</div>; // Safe - auto-escaped
+}
+
+// If you must render HTML, sanitize first
+import DOMPurify from 'dompurify';
+
+function HtmlContent({ html }: { html: string }) {
+  return (
+    <div
+      dangerouslySetInnerHTML={{
+        __html: DOMPurify.sanitize(html)
+      }}
+    />
+  );
+}
+```
+
+### Content Security Policy
+
+```typescript
+import helmet from 'helmet';
+
+app.use(helmet.contentSecurityPolicy({
+  directives: {
+    defaultSrc: ["'self'"],
+    scriptSrc: ["'self'"],
+    styleSrc: ["'self'", "'unsafe-inline'"],
+    imgSrc: ["'self'", "data:", "https:"],
+    connectSrc: ["'self'", "https://api.example.com"],
+    fontSrc: ["'self'"],
+    objectSrc: ["'none'"],
+    frameSrc: ["'none'"],
+    upgradeInsecureRequests: [],
+  },
+}));
+```
+
+### Input Sanitization
+
+```typescript
+import DOMPurify from 'dompurify';
+
+// Sanitize HTML
+const clean = DOMPurify.sanitize(dirty);
+
+// Sanitize with config
+const cleanStrict = DOMPurify.sanitize(dirty, {
+  ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a'],
+  ALLOWED_ATTR: ['href'],
+});
+
+// Strip all HTML
+const textOnly = DOMPurify.sanitize(dirty, { ALLOWED_TAGS: [] });
+```
+
+## CSRF Prevention
+
+### Synchronizer Token Pattern
+
+```typescript
+import csrf from 'csurf';
+
+const csrfProtection = csrf({ cookie: true });
+
+// Add to forms
+app.get('/form', csrfProtection, (req, res) => {
+  res.render('form', { csrfToken: req.csrfToken() });
+});
+
+// Validate on submission
+app.post('/submit', csrfProtection, (req, res) => {
+  // Token validated automatically
+});
+```
+
+### Double Submit Cookie
+
+```typescript
+// Set CSRF cookie
+res.cookie('csrf', token, {
+  httpOnly: false, // Must be readable by JS
+  secure: true,
+  sameSite: 'strict',
+});
+
+// Client sends in header
+fetch('/api/action', {
+  method: 'POST',
+  headers: {
+    'X-CSRF-Token': getCookie('csrf'),
+  },
+});
+
+// Server validates
+if (req.cookies.csrf !== req.headers['x-csrf-token']) {
+  return res.status(403).json({ error: 'CSRF validation failed' });
+}
+```
+
+### SameSite Cookies
+
+```typescript
+// Modern CSRF protection
+app.use(session({
+  cookie: {
+    httpOnly: true,
+    secure: true,
+    sameSite: 'strict', // Or 'lax' for GET requests
+  },
+}));
+```
+
+## HTTP Headers
+
+```typescript
+// Security headers
+app.use((req, res, next) => {
+  // Prevent clickjacking
+  res.setHeader('X-Frame-Options', 'DENY');
+
+  // Prevent MIME sniffing
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+
+  // XSS filter (legacy)
+  res.setHeader('X-XSS-Protection', '1; mode=block');
+
+  // Referrer policy
+  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin');
+
+  next();
+});
+```
+
+## Quick Reference
+
+| Attack | Prevention |
+|--------|------------|
+| Reflected XSS | Output encoding |
+| Stored XSS | Input sanitization + encoding |
+| DOM XSS | Avoid innerHTML, use textContent |
+| CSRF | Tokens + SameSite cookies |
+
+| Header | Purpose |
+|--------|---------|
+| CSP | Script/resource restrictions |
+| X-Frame-Options | Clickjacking |
+| X-Content-Type-Options | MIME sniffing |
+| SameSite | CSRF protection |

package/{dist/src/orgrt/role-skills/security-architect.md → org-skills/security-architect/SKILL.md}

@@ -1,3 +1,11 @@
+---
+name: security-architect
+description: "Security Architect role best practices. Designs security into systems before they're built — threat models, trust boundaries, zero-trust architecture, and authn/authz patterns — so vulnerabilities never get a chance to ship."
+tags: ["security"]
+tools: ["monograph_query","monograph_context","monograph_impact"]
+license: Apache-2.0
+source: https://github.com/monoes/monomind
+---
 # Security Architect — Best Practices
 
 ## Focus

package/{dist/src/orgrt/role-skills/security-auditor.md → org-skills/security-auditor/SKILL.md}

@@ -1,3 +1,11 @@
+---
+name: security-auditor
+description: "Security Auditor role best practices. Independently assesses existing code and systems for exploitable vulnerabilities, evidences findings with severity and remediation, and verifies fixes actually close the gap."
+tags: ["security"]
+tools: ["monograph_query","monograph_context","monograph_impact"]
+license: Apache-2.0
+source: https://github.com/monoes/monomind
+---
 # Security Auditor — Best Practices
 
 ## Focus

package/org-skills/security-review/LICENSE.txt

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Affaan Mustafa
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.