@ngxtm/devkit 3.7.0 → 3.9.0

package/merged-commands/finishing-a-development-branch.md

@@ -0,0 +1,200 @@
+---
+name: finishing-a-development-branch
+description: Use when implementation is complete, all tests pass, and you need to decide how to integrate the work - guides completion of development work by presenting structured options for merge, PR, or cleanup
+---
+
+# Finishing a Development Branch
+
+## Overview
+
+Guide completion of development work by presenting clear options and handling chosen workflow.
+
+**Core principle:** Verify tests → Present options → Execute choice → Clean up.
+
+**Announce at start:** "I'm using the finishing-a-development-branch skill to complete this work."
+
+## The Process
+
+### Step 1: Verify Tests
+
+**Before presenting options, verify tests pass:**
+
+```bash
+# Run project's test suite
+npm test / cargo test / pytest / go test ./...
+```
+
+**If tests fail:**
+```
+Tests failing (<N> failures). Must fix before completing:
+
+[Show failures]
+
+Cannot proceed with merge/PR until tests pass.
+```
+
+Stop. Don't proceed to Step 2.
+
+**If tests pass:** Continue to Step 2.
+
+### Step 2: Determine Base Branch
+
+```bash
+# Try common base branches
+git merge-base HEAD main 2>/dev/null || git merge-base HEAD master 2>/dev/null
+```
+
+Or ask: "This branch split from main - is that correct?"
+
+### Step 3: Present Options
+
+Present exactly these 4 options:
+
+```
+Implementation complete. What would you like to do?
+
+1. Merge back to <base-branch> locally
+2. Push and create a Pull Request
+3. Keep the branch as-is (I'll handle it later)
+4. Discard this work
+
+Which option?
+```
+
+**Don't add explanation** - keep options concise.
+
+### Step 4: Execute Choice
+
+#### Option 1: Merge Locally
+
+```bash
+# Switch to base branch
+git checkout <base-branch>
+
+# Pull latest
+git pull
+
+# Merge feature branch
+git merge <feature-branch>
+
+# Verify tests on merged result
+<test command>
+
+# If tests pass
+git branch -d <feature-branch>
+```
+
+Then: Cleanup worktree (Step 5)
+
+#### Option 2: Push and Create PR
+
+```bash
+# Push branch
+git push -u origin <feature-branch>
+
+# Create PR
+gh pr create --title "<title>" --body "$(cat <<'EOF'
+## Summary
+<2-3 bullets of what changed>
+
+## Test Plan
+- [ ] <verification steps>
+EOF
+)"
+```
+
+Then: Cleanup worktree (Step 5)
+
+#### Option 3: Keep As-Is
+
+Report: "Keeping branch <name>. Worktree preserved at <path>."
+
+**Don't cleanup worktree.**
+
+#### Option 4: Discard
+
+**Confirm first:**
+```
+This will permanently delete:
+- Branch <name>
+- All commits: <commit-list>
+- Worktree at <path>
+
+Type 'discard' to confirm.
+```
+
+Wait for exact confirmation.
+
+If confirmed:
+```bash
+git checkout <base-branch>
+git branch -D <feature-branch>
+```
+
+Then: Cleanup worktree (Step 5)
+
+### Step 5: Cleanup Worktree
+
+**For Options 1, 2, 4:**
+
+Check if in worktree:
+```bash
+git worktree list | grep $(git branch --show-current)
+```
+
+If yes:
+```bash
+git worktree remove <worktree-path>
+```
+
+**For Option 3:** Keep worktree.
+
+## Quick Reference
+
+| Option | Merge | Push | Keep Worktree | Cleanup Branch |
+|--------|-------|------|---------------|----------------|
+| 1. Merge locally | ✓ | - | - | ✓ |
+| 2. Create PR | - | ✓ | ✓ | - |
+| 3. Keep as-is | - | - | ✓ | - |
+| 4. Discard | - | - | - | ✓ (force) |
+
+## Common Mistakes
+
+**Skipping test verification**
+- **Problem:** Merge broken code, create failing PR
+- **Fix:** Always verify tests before offering options
+
+**Open-ended questions**
+- **Problem:** "What should I do next?" → ambiguous
+- **Fix:** Present exactly 4 structured options
+
+**Automatic worktree cleanup**
+- **Problem:** Remove worktree when might need it (Option 2, 3)
+- **Fix:** Only cleanup for Options 1 and 4
+
+**No confirmation for discard**
+- **Problem:** Accidentally delete work
+- **Fix:** Require typed "discard" confirmation
+
+## Red Flags
+
+**Never:**
+- Proceed with failing tests
+- Merge without verifying tests on result
+- Delete work without confirmation
+- Force-push without explicit request
+
+**Always:**
+- Verify tests before offering options
+- Present exactly 4 options
+- Get typed confirmation for Option 4
+- Clean up worktree for Options 1 & 4 only
+
+## Integration
+
+**Called by:**
+- **subagent-driven-development** (Step 7) - After all tasks complete
+- **executing-plans** (Step 5) - After all batches complete
+
+**Pairs with:**
+- **using-git-worktrees** - Cleans up worktree created by that skill

package/merged-commands/firebase.md

@@ -0,0 +1,56 @@
+---
+name: firebase
+description: "Firebase gives you a complete backend in minutes - auth, database, storage, functions, hosting. But the ease of setup hides real complexity. Security rules are your last line of defense, and they're often wrong. Firestore queries are limited, and you learn this after you've designed your data model.  This skill covers Firebase Authentication, Firestore, Realtime Database, Cloud Functions, Cloud Storage, and Firebase Hosting. Key insight: Firebase is optimized for read-heavy, denormalized data. I"
+source: vibeship-spawner-skills (Apache 2.0)
+---
+
+# Firebase
+
+You're a developer who has shipped dozens of Firebase projects. You've seen the
+"easy" path lead to security breaches, runaway costs, and impossible migrations.
+You know Firebase is powerful, but you also know its sharp edges.
+
+Your hard-won lessons: The team that skipped security rules got pwned. The team
+that designed Firestore like SQL couldn't query their data. The team that
+attached listeners to large collections got a $10k bill. You've learned from
+all of them.
+
+You advocate for Firebase w
+
+## Capabilities
+
+- firebase-auth
+- firestore
+- firebase-realtime-database
+- firebase-cloud-functions
+- firebase-storage
+- firebase-hosting
+- firebase-security-rules
+- firebase-admin-sdk
+- firebase-emulators
+
+## Patterns
+
+### Modular SDK Import
+
+Import only what you need for smaller bundles
+
+### Security Rules Design
+
+Secure your data with proper rules from day one
+
+### Data Modeling for Queries
+
+Design Firestore data structure around query patterns
+
+## Anti-Patterns
+
+### ❌ No Security Rules
+
+### ❌ Client-Side Admin Operations
+
+### ❌ Listener on Large Collections
+
+## Related Skills
+
+Works well with: `nextjs-app-router`, `react-patterns`, `authentication-oauth`, `stripe`

package/merged-commands/firecrawl-scraper.md

@@ -0,0 +1,37 @@
+---
+name: firecrawl-scraper
+description: Deep web scraping, screenshots, PDF parsing, and website crawling using Firecrawl API
+---
+
+# firecrawl-scraper
+
+## Overview
+Deep web scraping, screenshots, PDF parsing, and website crawling using Firecrawl API
+
+## When to Use
+- When you need deep content extraction from web pages
+- When page interaction is required (clicking, scrolling, etc.)
+- When you want screenshots or PDF parsing
+- When batch scraping multiple URLs
+
+## Installation
+```bash
+npx skills add -g BenedictKing/firecrawl-scraper
+```
+
+## Step-by-Step Guide
+1. Install the skill using the command above
+2. Configure Firecrawl API key
+3. Use naturally in Claude Code conversations
+
+## Examples
+See [GitHub Repository](https://github.com/BenedictKing/firecrawl-scraper) for examples.
+
+## Best Practices
+- Configure API keys via environment variables
+
+## Troubleshooting
+See the GitHub repository for troubleshooting guides.
+
+## Related Skills
+- context7-auto-research, tavily-web, exa-search, codex-review

package/merged-commands/firmware-analyst.md

@@ -0,0 +1,320 @@
+---
+name: firmware-analyst
+description: Expert firmware analyst specializing in embedded systems, IoT
+  security, and hardware reverse engineering. Masters firmware extraction,
+  analysis, and vulnerability research for routers, IoT devices, automotive
+  systems, and industrial controllers. Use PROACTIVELY for firmware security
+  audits, IoT penetration testing, or embedded systems research.
+metadata:
+  model: opus
+---
+
+# Download from vendor
+wget http://vendor.com/firmware/update.bin
+
+# Extract from device via debug interface
+# UART console access
+screen /dev/ttyUSB0 115200
+# Copy firmware partition
+dd if=/dev/mtd0 of=/tmp/firmware.bin
+
+# Extract via network protocols
+# TFTP during boot
+# HTTP/FTP from device web interface
+```
+
+### Hardware Methods
+```
+UART access         - Serial console connection
+JTAG/SWD           - Debug interface for memory access
+SPI flash dump     - Direct chip reading
+NAND/NOR dump      - Flash memory extraction
+Chip-off           - Physical chip removal and reading
+Logic analyzer     - Protocol capture and analysis
+```
+
+## Use this skill when
+
+- Working on download from vendor tasks or workflows
+- Needing guidance, best practices, or checklists for download from vendor
+
+## Do not use this skill when
+
+- The task is unrelated to download from vendor
+- You need a different domain or tool outside this scope
+
+## Instructions
+
+- Clarify goals, constraints, and required inputs.
+- Apply relevant best practices and validate outcomes.
+- Provide actionable steps and verification.
+- If detailed examples are required, open `resources/implementation-playbook.md`.
+
+## Firmware Analysis Workflow
+
+### Phase 1: Identification
+```bash
+# Basic file identification
+file firmware.bin
+binwalk firmware.bin
+
+# Entropy analysis (detect compression/encryption)
+# Binwalk v3: generates entropy PNG graph
+binwalk --entropy firmware.bin
+binwalk -E firmware.bin  # Short form
+
+# Identify embedded file systems and auto-extract
+binwalk --extract firmware.bin
+binwalk -e firmware.bin  # Short form
+
+# String analysis
+strings -a firmware.bin | grep -i "password\|key\|secret"
+```
+
+### Phase 2: Extraction
+```bash
+# Binwalk v3 recursive extraction (matryoshka mode)
+binwalk --extract --matryoshka firmware.bin
+binwalk -eM firmware.bin  # Short form
+
+# Extract to custom directory
+binwalk -e -C ./extracted firmware.bin
+
+# Verbose output during recursive extraction
+binwalk -eM --verbose firmware.bin
+
+# Manual extraction for specific formats
+# SquashFS
+unsquashfs filesystem.squashfs
+
+# JFFS2
+jefferson filesystem.jffs2 -d output/
+
+# UBIFS
+ubireader_extract_images firmware.ubi
+
+# YAFFS
+unyaffs filesystem.yaffs
+
+# Cramfs
+cramfsck -x output/ filesystem.cramfs
+```
+
+### Phase 3: File System Analysis
+```bash
+# Explore extracted filesystem
+find . -name "*.conf" -o -name "*.cfg"
+find . -name "passwd" -o -name "shadow"
+find . -type f -executable
+
+# Find hardcoded credentials
+grep -r "password" .
+grep -r "api_key" .
+grep -rn "BEGIN RSA PRIVATE KEY" .
+
+# Analyze web interface
+find . -name "*.cgi" -o -name "*.php" -o -name "*.lua"
+
+# Check for vulnerable binaries
+checksec --dir=./bin/
+```
+
+### Phase 4: Binary Analysis
+```bash
+# Identify architecture
+file bin/httpd
+readelf -h bin/httpd
+
+# Load in Ghidra with correct architecture
+# For ARM: specify ARM:LE:32:v7 or similar
+# For MIPS: specify MIPS:BE:32:default
+
+# Set up cross-compilation for testing
+# ARM
+arm-linux-gnueabi-gcc exploit.c -o exploit
+# MIPS
+mipsel-linux-gnu-gcc exploit.c -o exploit
+```
+
+## Common Vulnerability Classes
+
+### Authentication Issues
+```
+Hardcoded credentials     - Default passwords in firmware
+Backdoor accounts         - Hidden admin accounts
+Weak password hashing     - MD5, no salt
+Authentication bypass     - Logic flaws in login
+Session management        - Predictable tokens
+```
+
+### Command Injection
+```c
+// Vulnerable pattern
+char cmd[256];
+sprintf(cmd, "ping %s", user_input);
+system(cmd);
+
+// Test payloads
+; id
+| cat /etc/passwd
+`whoami`
+$(id)
+```
+
+### Memory Corruption
+```
+Stack buffer overflow    - strcpy, sprintf without bounds
+Heap overflow           - Improper allocation handling
+Format string           - printf(user_input)
+Integer overflow        - Size calculations
+Use-after-free          - Improper memory management
+```
+
+### Information Disclosure
+```
+Debug interfaces        - UART, JTAG left enabled
+Verbose errors          - Stack traces, paths
+Configuration files     - Exposed credentials
+Firmware updates        - Unencrypted downloads
+```
+
+## Tool Proficiency
+
+### Extraction Tools
+```
+binwalk v3           - Firmware extraction and analysis (Rust rewrite, faster, fewer false positives)
+firmware-mod-kit     - Firmware modification toolkit
+jefferson            - JFFS2 extraction
+ubi_reader           - UBIFS extraction
+sasquatch            - SquashFS with non-standard features
+```
+
+### Analysis Tools
+```
+Ghidra               - Multi-architecture disassembly
+IDA Pro              - Commercial disassembler
+Binary Ninja         - Modern RE platform
+radare2              - Scriptable analysis
+Firmware Analysis Toolkit (FAT)
+FACT                 - Firmware Analysis and Comparison Tool
+```
+
+### Emulation
+```
+QEMU                 - Full system and user-mode emulation
+Firmadyne            - Automated firmware emulation
+EMUX                 - ARM firmware emulator
+qemu-user-static     - Static QEMU for chroot emulation
+Unicorn              - CPU emulation framework
+```
+
+### Hardware Tools
+```
+Bus Pirate           - Universal serial interface
+Logic analyzer       - Protocol analysis
+JTAGulator           - JTAG/UART discovery
+Flashrom             - Flash chip programmer
+ChipWhisperer        - Side-channel analysis
+```
+
+## Emulation Setup
+
+### QEMU User-Mode Emulation
+```bash
+# Install QEMU user-mode
+apt install qemu-user-static
+
+# Copy QEMU static binary to extracted rootfs
+cp /usr/bin/qemu-arm-static ./squashfs-root/usr/bin/
+
+# Chroot into firmware filesystem
+sudo chroot squashfs-root /usr/bin/qemu-arm-static /bin/sh
+
+# Run specific binary
+sudo chroot squashfs-root /usr/bin/qemu-arm-static /bin/httpd
+```
+
+### Full System Emulation with Firmadyne
+```bash
+# Extract firmware
+./sources/extractor/extractor.py -b brand -sql 127.0.0.1 \
+    -np -nk "firmware.bin" images
+
+# Identify architecture and create QEMU image
+./scripts/getArch.sh ./images/1.tar.gz
+./scripts/makeImage.sh 1
+
+# Infer network configuration
+./scripts/inferNetwork.sh 1
+
+# Run emulation
+./scratch/1/run.sh
+```
+
+## Security Assessment
+
+### Checklist
+```markdown
+[ ] Firmware extraction successful
+[ ] File system mounted and explored
+[ ] Architecture identified
+[ ] Hardcoded credentials search
+[ ] Web interface analysis
+[ ] Binary security properties (checksec)
+[ ] Network services identified
+[ ] Debug interfaces disabled
+[ ] Update mechanism security
+[ ] Encryption/signing verification
+[ ] Known CVE check
+```
+
+### Reporting Template
+```markdown
+# Firmware Security Assessment
+
+## Device Information
+- Manufacturer:
+- Model:
+- Firmware Version:
+- Architecture:
+
+## Findings Summary
+| Finding | Severity | Location |
+|---------|----------|----------|
+
+## Detailed Findings
+### Finding 1: [Title]
+- Severity: Critical/High/Medium/Low
+- Location: /path/to/file
+- Description:
+- Proof of Concept:
+- Remediation:
+
+## Recommendations
+1. ...
+```
+
+## Ethical Guidelines
+
+### Appropriate Use
+- Security audits with device owner authorization
+- Bug bounty programs
+- Academic research
+- CTF competitions
+- Personal device analysis
+
+### Never Assist With
+- Unauthorized device compromise
+- Bypassing DRM/licensing illegally
+- Creating malicious firmware
+- Attacking devices without permission
+- Industrial espionage
+
+## Response Approach
+
+1. **Verify authorization**: Ensure legitimate research context
+2. **Assess device**: Understand target device type and architecture
+3. **Guide acquisition**: Appropriate firmware extraction method
+4. **Analyze systematically**: Follow structured analysis workflow
+5. **Identify issues**: Security vulnerabilities and misconfigurations
+6. **Document findings**: Clear reporting with remediation guidance

package/merged-commands/fix-review.md

@@ -0,0 +1,53 @@
+---
+name: fix-review
+description: "Verify fix commits address audit findings without new bugs"
+source: "https://github.com/trailofbits/skills/tree/main/plugins/fix-review"
+risk: safe
+---
+
+# Fix Review
+
+## Overview
+
+Verify that fix commits properly address audit findings without introducing new bugs or security vulnerabilities.
+
+## When to Use This Skill
+
+Use this skill when you need to verify fix commits address audit findings without new bugs.
+
+Use this skill when:
+- Reviewing commits that address security audit findings
+- Verifying that fixes don't introduce new vulnerabilities
+- Ensuring code changes properly resolve identified issues
+- Validating that remediation efforts are complete and correct
+
+## Instructions
+
+This skill helps verify that fix commits properly address audit findings:
+
+1. **Review Fix Commits**: Analyze commits that claim to fix audit findings
+2. **Verify Resolution**: Ensure the original issue is properly addressed
+3. **Check for Regressions**: Verify no new bugs or vulnerabilities are introduced
+4. **Validate Completeness**: Ensure all aspects of the finding are resolved
+
+## Review Process
+
+When reviewing fix commits:
+
+1. Compare the fix against the original audit finding
+2. Verify the fix addresses the root cause, not just symptoms
+3. Check for potential side effects or new issues
+4. Validate that tests cover the fixed scenario
+5. Ensure no similar vulnerabilities exist elsewhere
+
+## Best Practices
+
+- Review fixes in context of the full codebase
+- Verify test coverage for the fixed issue
+- Check for similar patterns that might need fixing
+- Ensure fixes follow security best practices
+- Document the resolution approach
+
+## Resources
+
+For more information, see the [source repository](https://github.com/trailofbits/skills/tree/main/plugins/fix-review).