@nockdev/awf 6.2.0

package/.agent/skills/core/api-design/data/test-apis.yaml

@@ -0,0 +1,217 @@
+metadata:
+  skill: api-design
+  domain: test_apis
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: test-apis.csv
+  patterns_count: 25
+  columns:
+  - id
+  - name
+  - url
+  - description
+  - methods
+  - features
+  - category
+  - use_case
+patterns:
+- id: TEST-01
+  name: JSONPlaceholder
+  url: https://jsonplaceholder.typicode.com
+  description: Free fake REST API for testing
+  methods: GET POST PUT PATCH DELETE
+  features: posts users comments albums todos photos
+  category: REST
+  use_case: Prototyping demos learning
+- id: TEST-02
+  name: httpbin
+  url: https://httpbin.org
+  description: HTTP request/response testing
+  methods: GET POST PUT DELETE
+  features: headers status-codes auth cookies
+  category: HTTP Debug
+  use_case: Request inspection learning
+- id: TEST-03
+  name: Reqres
+  url: https://reqres.in
+  description: Hosted REST API with user data
+  methods: GET POST PUT PATCH DELETE
+  features: users register login pagination delay
+  category: REST Auth
+  use_case: Frontend prototyping
+- id: TEST-04
+  name: Random User
+  url: https://randomuser.me/api
+  description: Random user generator
+  methods: GET
+  features: user-profiles photos nationalities
+  category: Data Gen
+  use_case: UI testing sample data
+- id: TEST-05
+  name: Dog API
+  url: https://dog.ceo/api
+  description: Random dog images
+  methods: GET
+  features: breed-images random
+  category: Fun API
+  use_case: Learning callbacks
+- id: TEST-06
+  name: Cat Facts
+  url: https://catfact.ninja/fact
+  description: Random cat facts
+  methods: GET
+  features: facts breeds pagination
+  category: Fun API
+  use_case: Simple GET practice
+- id: TEST-07
+  name: Pokemon API
+  url: https://pokeapi.co/api/v2
+  description: Pokemon data comprehensive
+  methods: GET
+  features: pokemon abilities moves items
+  category: Data API
+  use_case: GraphQL REST learning
+- id: TEST-08
+  name: OpenWeather Mock
+  url: https://api.openweathermap.org/data/2.5
+  description: Weather data (free tier)
+  methods: GET
+  features: weather forecast geolocation
+  category: Weather
+  use_case: Real API keys practice
+- id: TEST-09
+  name: Postman Echo
+  url: https://postman-echo.com
+  description: Postman request testing
+  methods: GET POST PUT DELETE
+  features: echo headers auth cookies
+  category: HTTP Debug
+  use_case: Postman learning
+- id: TEST-10
+  name: SWAPI
+  url: https://swapi.dev/api
+  description: Star Wars data
+  methods: GET
+  features: films people planets species
+  category: Data API
+  use_case: Async patterns
+- id: TEST-11
+  name: REST Countries
+  url: https://restcountries.com/v3.1
+  description: Country information
+  methods: GET
+  features: countries flags currencies
+  category: Data API
+  use_case: Filtering searching
+- id: TEST-12
+  name: Beeceptor
+  url: https://beeceptor.com
+  description: Custom mock API creator
+  methods: GET POST PUT DELETE
+  features: custom-endpoints rules delays
+  category: Mock Server
+  use_case: Custom testing
+- id: TEST-13
+  name: Mocky
+  url: https://run.mocky.io
+  description: Custom mock responses
+  methods: GET POST
+  features: custom-json custom-headers
+  category: Mock Server
+  use_case: Response testing
+- id: TEST-14
+  name: GitHub API
+  url: https://api.github.com
+  description: GitHub REST API (public)
+  methods: GET POST PUT DELETE
+  features: repos users issues pulls
+  category: Real API
+  use_case: OAuth learning
+- id: TEST-15
+  name: JSONBin
+  url: https://jsonbin.io
+  description: JSON storage REST API
+  methods: GET POST PUT DELETE
+  features: store retrieve update bins
+  category: Storage
+  use_case: Persistence testing
+- id: TEST-16
+  name: httpbin.dmuth.org
+  url: https://httpbin.dmuth.org
+  description: Self-hosted httpbin alternative
+  methods: GET POST PUT DELETE
+  features: all-httpbin-features
+  category: HTTP Debug
+  use_case: Enterprise testing
+- id: TEST-17
+  name: MockAPI.io
+  url: https://mockapi.io
+  description: Custom REST API generator
+  methods: GET POST PUT DELETE
+  features: custom-resources relations
+  category: Mock Server
+  use_case: Team collaboration
+- id: TEST-18
+  name: Dummy JSON
+  url: https://dummyjson.com
+  description: Comprehensive dummy data
+  methods: GET POST PUT DELETE
+  features: products carts users quotes
+  category: Data API
+  use_case: E-commerce prototyping
+- id: TEST-19
+  name: FakeStore API
+  url: https://fakestoreapi.com
+  description: E-commerce mock data
+  methods: GET POST PUT DELETE
+  features: products carts users auth
+  category: E-commerce
+  use_case: Shopping cart testing
+- id: TEST-20
+  name: GoREST
+  url: https://gorest.co.in
+  description: User management API
+  methods: GET POST PUT DELETE
+  features: users posts comments todos GraphQL
+  category: REST GraphQL
+  use_case: CRUD operations
+- id: TEST-21
+  name: Spotify Mock
+  url: N/A - Use Spotify Web API
+  description: Music data (OAuth required)
+  methods: GET POST PUT DELETE
+  features: tracks playlists artists
+  category: Real API
+  use_case: OAuth2 flow practice
+- id: TEST-22
+  name: Stripe Test
+  url: https://api.stripe.com (test mode)
+  description: Payment testing (test keys)
+  methods: GET POST
+  features: payments customers subscriptions
+  category: Payment
+  use_case: Webhook testing
+- id: TEST-23
+  name: Twilio Test
+  url: https://api.twilio.com (test creds)
+  description: SMS testing credentials
+  methods: GET POST
+  features: messages voice verify
+  category: Communication
+  use_case: Integration testing
+- id: TEST-24
+  name: httpstat.us
+  url: https://httpstat.us
+  description: HTTP status code testing
+  methods: GET
+  features: 100-599 status codes random delay
+  category: Status Codes
+  use_case: Error handling
+- id: TEST-25
+  name: Public APIs List
+  url: https://api.publicapis.org
+  description: API discovery endpoint
+  methods: GET
+  features: list random categories
+  category: Meta
+  use_case: Finding more APIs

package/.agent/skills/core/authentication/META.yaml

@@ -0,0 +1,73 @@
+name: authentication
+version: "6.2.0"
+display: Authentication Patterns
+category: core
+tier: 1
+priority: 0
+
+desc: "Comprehensive authentication patterns including JWT, OAuth 2.1, passkeys/FIDO2, sessions, MFA, and password security for 12 languages."
+
+triggers:
+  file_patterns: []
+  keywords:
+    - authentication
+    - authorization
+    - jwt
+    - oauth
+    - oauth2
+    - passkeys
+    - fido2
+    - webauthn
+    - session
+    - cookie
+    - mfa
+    - 2fa
+    - password
+    - login
+    - token
+    - refresh
+    - bearer
+  intents:
+    - auth system
+    - login flow
+    - oauth integration
+    - jwt implementation
+
+caps:
+  - JWT token patterns
+  - OAuth 2.1 flows
+  - Passkey/FIDO2 implementation
+  - Session management
+  - MFA integration
+  - Password security
+
+hsa:
+  enabled: true
+  adapter: authentication_adapter.py
+  functions:
+    - search_authentication_patterns
+    - get_jwt_patterns
+    - get_oauth_patterns
+    - get_passkey_patterns
+    - get_session_patterns
+    - get_mfa_patterns
+    - get_password_patterns
+    - get_auth_language_patterns
+    - get_auth_anti_patterns
+
+data_files:
+  - data/core-patterns.yaml
+  - data/jwt-patterns.yaml
+  - data/oauth-patterns.yaml
+  - data/passkeys-webauthn.yaml
+  - data/session-patterns.yaml
+  - data/mfa-patterns.yaml
+  - data/password-patterns.yaml
+  - data/language-go.yaml
+  - data/language-python.yaml
+  - data/language-typescript.yaml
+  - data/language-rust.yaml
+  - data/language-java.yaml
+  - data/language-csharp.yaml
+  - data/language-mobile.yaml
+  - data/anti-patterns.yaml

package/.agent/skills/core/authentication/SKILL.md

@@ -0,0 +1,166 @@
+# Authentication Skill v1.0
+
+> **370+ Patterns** | **12 Languages** | **OAuth 2.1 + Passkeys**
+
+---
+
+## Quick Stats
+
+| Metric      | Value                  |
+| ----------- | ---------------------- |
+| Patterns    | 370+                   |
+| Languages   | 12                     |
+| Categories  | 8                      |
+| HSA Adapter | authentication_adapter |
+
+---
+
+## Core Concepts
+
+### Authentication Factors
+
+| Factor     | Description        | Examples            |
+| ---------- | ------------------ | ------------------- |
+| Knowledge  | Something you know | Password, PIN       |
+| Possession | Something you have | Phone, hardware key |
+| Inherence  | Something you are  | Fingerprint, face   |
+
+### Modern Auth Landscape (2025-2026)
+
+| Method          | Security | UX   | Adoption   |
+| --------------- | -------- | ---- | ---------- |
+| Passkeys        | Highest  | Best | Growing    |
+| OAuth 2.1       | High     | Good | Standard   |
+| JWT + Refresh   | Medium   | Good | Common     |
+| Session cookies | Medium   | Fair | Legacy     |
+| Basic Auth      | Low      | Poor | Deprecated |
+
+---
+
+## Language Coverage
+
+| Language   | Libraries                           | Patterns |
+| ---------- | ----------------------------------- | -------- |
+| Go         | golang-jwt, x/oauth2, goth          | 25       |
+| Python     | FastAPI OAuth2, Flask-Login, Django | 25       |
+| TypeScript | Auth.js, Passport.js, jose          | 25       |
+| Rust       | jsonwebtoken, axum-jwt-auth         | 25       |
+| Java       | Spring Security, Keycloak           | 25       |
+| C#         | ASP.NET Identity, MSAL              | 25       |
+| Swift      | AuthenticationServices, Keychain    | 15       |
+| Kotlin     | Firebase Auth, BiometricPrompt      | 15       |
+
+---
+
+## Core Patterns
+
+### JWT Best Practices
+
+```yaml
+jwt_security:
+  access_token:
+    expiry: "15-30 minutes"
+    storage: "Memory or HttpOnly cookie"
+    algorithm: "RS256 preferred"
+  refresh_token:
+    expiry: "7-30 days"
+    storage: "HttpOnly cookie"
+    rotation: "On each use"
+  claims:
+    required: [iss, sub, exp, iat, aud]
+    avoid: "Sensitive data (PII)"
+```
+
+### OAuth 2.1 Flows
+
+```yaml
+oauth_flows:
+  authorization_code:
+    use_for: "Web apps, SPAs with backend"
+    pkce: "Required"
+  client_credentials:
+    use_for: "Service-to-service"
+  device_code:
+    use_for: "CLI, smart TV"
+```
+
+### Passkeys/WebAuthn
+
+```yaml
+passkeys:
+  registration:
+    - "Generate challenge"
+    - "Create credential (biometric)"
+    - "Store public key"
+  authentication:
+    - "Generate challenge"
+    - "Sign with private key"
+    - "Verify signature"
+  benefits:
+    - "Phishing resistant"
+    - "No passwords to steal"
+    - "Biometric convenience"
+```
+
+---
+
+## HSA Integration
+
+### Available Functions
+
+```python
+# General search
+search_authentication_patterns("jwt refresh token", top_k=10)
+
+# Category-specific
+get_jwt_patterns(limit=25)
+get_oauth_patterns(flow="authorization_code")
+get_passkey_patterns()
+get_session_patterns()
+get_mfa_patterns()
+get_password_patterns()
+
+# Language-specific
+get_auth_language_patterns("go")      # 25 patterns
+get_auth_language_patterns("python")  # 25 patterns
+get_auth_language_patterns("swift")   # 15 patterns
+```
+
+---
+
+## Data Files (15 CSVs)
+
+| Category  | File                    | Patterns |
+| --------- | ----------------------- | -------- |
+| Core      | core-patterns.csv       | 30       |
+| Core      | jwt-patterns.csv        | 30       |
+| Core      | oauth-patterns.csv      | 30       |
+| Core      | passkeys-webauthn.csv   | 25       |
+| Core      | session-patterns.csv    | 25       |
+| Core      | mfa-patterns.csv        | 20       |
+| Core      | password-patterns.csv   | 20       |
+| Languages | language-go.csv         | 25       |
+| Languages | language-python.csv     | 25       |
+| Languages | language-typescript.csv | 25       |
+| Languages | language-rust.csv       | 25       |
+| Languages | language-java.csv       | 25       |
+| Languages | language-csharp.csv     | 25       |
+| Languages | language-mobile.csv     | 25       |
+| Anti      | anti-patterns.csv       | 15       |
+| **Total** | -                       | **~370** |
+
+---
+
+## Anti-Patterns
+
+| Anti-Pattern                | Risk            | Fix                    |
+| --------------------------- | --------------- | ---------------------- |
+| Storing JWT in localStorage | XSS theft       | HttpOnly cookie        |
+| Long-lived access tokens    | Token theft     | Short expiry + refresh |
+| Hardcoded secrets           | Credential leak | Environment variables  |
+| No token rotation           | Session hijack  | Rotate refresh tokens  |
+| MD5/SHA1 password hash      | Rainbow tables  | bcrypt/argon2          |
+
+---
+
+_DOMYH Awesome Code - Authentication Skill v1.0 - OAuth 2.1 + Passkeys_

package/.agent/skills/core/authentication/data/anti-patterns.yaml

@@ -0,0 +1,135 @@
+metadata:
+  skill: authentication
+  domain: anti_patterns
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: anti-patterns.csv
+  patterns_count: 15
+  columns:
+  - id
+  - pattern_name
+  - description
+  - risk_level
+  - impact
+  - keywords
+patterns:
+- id: ANTI-001
+  pattern_name: Storing JWT in localStorage
+  description: XSS can steal tokens from localStorage
+  risk_level: critical
+  impact: Token theft
+  keywords:
+  - localstorage
+  - xss
+- id: ANTI-002
+  pattern_name: Long-lived Access Tokens
+  description: Hours or days expiry increases theft risk
+  risk_level: high
+  impact: Extended access
+  keywords:
+  - longlife
+  - expiry
+- id: ANTI-003
+  pattern_name: Hardcoded Secrets
+  description: API keys in source code
+  risk_level: critical
+  impact: Credential leak
+  keywords:
+  - hardcoded
+  - secrets
+- id: ANTI-004
+  pattern_name: MD5 Password Hash
+  description: Trivially crackable hash algorithm
+  risk_level: critical
+  impact: Password exposure
+  keywords:
+  - md5
+  - weak
+- id: ANTI-005
+  pattern_name: SHA1 Password Hash
+  description: Rainbow table vulnerable
+  risk_level: critical
+  impact: Password exposure
+  keywords:
+  - sha1
+  - rainbow
+- id: ANTI-006
+  pattern_name: No Salt in Hashing
+  description: Same password same hash
+  risk_level: critical
+  impact: Bulk cracking
+  keywords:
+  - nosalt
+  - hash
+- id: ANTI-007
+  pattern_name: No Token Rotation
+  description: Refresh tokens never change
+  risk_level: high
+  impact: Session hijack
+  keywords:
+  - norotation
+  - refresh
+- id: ANTI-008
+  pattern_name: Algorithm None Attack
+  description: Accepting unsigned JWT
+  risk_level: critical
+  impact: Bypass auth
+  keywords:
+  - none
+  - unsigned
+- id: ANTI-009
+  pattern_name: Weak JWT Secret
+  description: Short or predictable secret
+  risk_level: critical
+  impact: Signature forge
+  keywords:
+  - weak
+  - secret
+- id: ANTI-010
+  pattern_name: Session Fixation
+  description: Not regenerating session ID
+  risk_level: high
+  impact: Hijacking
+  keywords:
+  - fixation
+  - session
+- id: ANTI-011
+  pattern_name: Verbose Error Messages
+  description: Revealing user exists or not
+  risk_level: medium
+  impact: Enumeration
+  keywords:
+  - verbose
+  - enumeration
+- id: ANTI-012
+  pattern_name: No Rate Limiting
+  description: Unlimited login attempts
+  risk_level: high
+  impact: Brute force
+  keywords:
+  - noratelimit
+  - brute
+- id: ANTI-013
+  pattern_name: Token in URL
+  description: JWT in query parameter
+  risk_level: high
+  impact: Log exposure
+  keywords:
+  - url
+  - querystring
+- id: ANTI-014
+  pattern_name: Missing HTTPS
+  description: Transmitting tokens over HTTP
+  risk_level: critical
+  impact: Interception
+  keywords:
+  - http
+  - plaintext
+- id: ANTI-015
+  pattern_name: Trusting Client Claims
+  description: Using unverified JWT claims
+  risk_level: critical
+  impact: Privilege escalation
+  keywords:
+  - trust
+  - unverified