@nockdev/awf 6.2.0

package/.agent/skills/core/security/data/language-specific/kotlin-security.yaml

@@ -0,0 +1,198 @@
+metadata:
+  skill: security
+  domain: kotlin_security
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: kotlin-security.csv
+  patterns_count: 20
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - description
+  - detection_pattern
+  - fix_pattern
+  - cwe
+  - example_code
+patterns:
+- id: KT-01
+  name: Coroutine Exception Leak
+  severity: HIGH
+  category: Concurrency
+  description: Uncaught exception in coroutine crashes app
+  detection_pattern: launch\\s*\\{(?!.*try|supervisorScope)
+  fix_pattern: Use supervisorScope or CoroutineExceptionHandler
+  cwe: CWE-755
+  example_code: // Crash on exception\nlaunch { throw Exception() }\n// SAFE\nsupervisorScope { launch { ... } }
+- id: KT-02
+  name: SharedFlow Backpressure
+  severity: MEDIUM
+  category: Concurrency
+  description: SharedFlow without buffer can drop events
+  detection_pattern: MutableSharedFlow\\((?!.*replay|buffer)
+  fix_pattern: Set appropriate replay and buffer values
+  cwe: CWE-400
+  example_code: // Lost events\nMutableSharedFlow<Event>()\n// SAFE\nMutableSharedFlow<Event>(replay = 1, onBufferOverflow = DROP_OLDEST)
+- id: KT-03
+  name: Null Safety Bypass
+  severity: HIGH
+  category: Memory
+  description: Force unwrap !! on nullable can crash
+  detection_pattern: '!!(?!.*\\?\\?|requireNotNull)'
+  fix_pattern: Use safe call ?. or require with message
+  cwe: CWE-476
+  example_code: '// Crash\nval name = user!!.name\n// SAFE\nval name = user?.name ?: \default\""'
+- id: KT-04
+  name: Android Keystore Weak
+  severity: HIGH
+  category: Crypto
+  description: Keystore without hardware backing
+  detection_pattern: KeyGenParameterSpec(?!.*setIsStrongBoxBacked)
+  fix_pattern: Use setIsStrongBoxBacked when available
+  cwe: CWE-326
+  example_code: // Software-only\nKeyGenParameterSpec.Builder(...)\n// SAFE\n.setIsStrongBoxBacked(true)
+- id: KT-05
+  name: Parcelable Deserialization
+  severity: HIGH
+  category: Android
+  description: Custom Parcelable without validation
+  detection_pattern: createFromParcel(?!.*validate|require)
+  fix_pattern: Validate all fields from Parcel
+  cwe: CWE-502
+  example_code: '// Unsafe\noverride fun createFromParcel(parcel: Parcel) = MyClass(parcel.readString()!!)\n// SAFE: Validate'
+- id: KT-06
+  name: WebView JavaScript
+  severity: CRITICAL
+  category: Android
+  description: WebView with JavaScript and loadUrl user input
+  detection_pattern: setJavaScriptEnabled\\(true\\).*loadUrl.*\\+
+  fix_pattern: Disable JS or validate URLs strictly
+  cwe: CWE-79
+  example_code: '// XSS\nwebView.settings.javaScriptEnabled = true\nwebView.loadUrl(userUrl)\n// SAFE: Whitelist URLs'
+- id: KT-07
+  name: Broadcast Unprotected
+  severity: HIGH
+  category: Android
+  description: Broadcast without permission check
+  detection_pattern: registerReceiver(?!.*permission|RECEIVER_EXPORTED)
+  fix_pattern: Use explicit receivers or permission
+  cwe: CWE-926
+  example_code: // Unprotected\nregisterReceiver(receiver, filter)\n// SAFE\nregisterReceiver(receiver, filter, permission, null)
+- id: KT-08
+  name: Intent Redirect
+  severity: HIGH
+  category: Android
+  description: User-controlled intent can access other apps
+  detection_pattern: startActivity\\(.*getIntent|extras(?!.*validate))
+  fix_pattern: Validate intent extras and component
+  cwe: CWE-940
+  example_code: '// Redirect\nstartActivity(intent.getParcelableExtra(\target\"))\n// SAFE: Validate package"'
+- id: KT-09
+  name: Path Traversal Files
+  severity: HIGH
+  category: Android
+  description: File operations with user path
+  detection_pattern: File\\(.*\\+|openFileInput.*params
+  fix_pattern: Use canonical path validation
+  cwe: CWE-22
+  example_code: // Path traversal\nFile(baseDir, userPath)\n// SAFE\nFile(baseDir, userPath).canonicalPath.startsWith(baseDir)
+- id: KT-10
+  name: SQL Injection Room
+  severity: HIGH
+  category: Android
+  description: Raw query without parameters in Room
+  detection_pattern: '@RawQuery|query\\(.*\\+.*\\+'
+  fix_pattern: Use @Query with parameters
+  cwe: CWE-89
+  example_code: '// SQLi\n@RawQuery fun search(query: String)\n// SAFE\n@Query(\SELECT * FROM users WHERE name = :name\")"'
+- id: KT-11
+  name: Logging Sensitive Data
+  severity: MEDIUM
+  category: Privacy
+  description: Password/token in logs
+  detection_pattern: Log\\.(d|i|v).*password|token|secret
+  fix_pattern: Never log sensitive data
+  cwe: CWE-532
+  example_code: '// Leaking\nLog.d(TAG, \Token: $token\")\n// SAFE: Log only IDs"'
+- id: KT-12
+  name: Reflection Abuse
+  severity: HIGH
+  category: Injection
+  description: Reflection on user-controlled class name
+  detection_pattern: Class\\.forName\\(.*\\+|::class.*params
+  fix_pattern: Whitelist allowed classes
+  cwe: CWE-470
+  example_code: '// Dangerous\nClass.forName(params[\class\"]).newInstance()\n// SAFE: Whitelist classes"'
+- id: KT-13
+  name: lateinit Crash
+  severity: MEDIUM
+  category: Memory
+  description: lateinit access before initialization
+  detection_pattern: lateinit.*(?!.*isInitialized)
+  fix_pattern: Check isInitialized before access
+  cwe: CWE-824
+  example_code: // Crash\nprintln(lateinitVar)\n// SAFE\nif (::lateinitVar.isInitialized) println(lateinitVar)
+- id: KT-14
+  name: Ktor Client Insecure
+  severity: HIGH
+  category: Network
+  description: Ktor client without certificate validation
+  detection_pattern: HttpClient(?!.*expectSuccess|certificate)
+  fix_pattern: Enable certificate pinning
+  cwe: CWE-295
+  example_code: '// No validation\nHttpClient()\n// SAFE: Configure certificate pinning'
+- id: KT-15
+  name: Mutex Deadlock
+  severity: HIGH
+  category: Concurrency
+  description: Mutex without withLock or timeout
+  detection_pattern: mutex\\.lock\\(\\)(?!.*finally.*unlock)
+  fix_pattern: Use withLock or withTimeout
+  cwe: CWE-833
+  example_code: // Deadlock risk\nmutex.lock(); doWork(); mutex.unlock()\n// SAFE\nmutex.withLock { doWork() }
+- id: KT-16
+  name: StateFlow Thread
+  severity: MEDIUM
+  category: Concurrency
+  description: StateFlow value read without collect on main
+  detection_pattern: stateFlow\\.value(?!.*Dispatchers\\.Main)
+  fix_pattern: Use collectAsState or observe on correct dispatcher
+  cwe: CWE-362
+  example_code: // Wrong thread\nval value = stateFlow.value\n// SAFE\nstateFlow.collectLatest { ... }
+- id: KT-17
+  name: Jetpack Navigation Args
+  severity: MEDIUM
+  category: Android
+  description: Navigation arguments without null check
+  detection_pattern: arguments\\?\\.(get|getString)(?!.*\\?:|default)
+  fix_pattern: Provide default values or check null
+  cwe: CWE-476
+  example_code: '// Crash\nval id = arguments?.getString(\id\")!!\n// SAFE\nval id = arguments?.getString(\"id\") ?: return"'
+- id: KT-18
+  name: Compose Remember Key
+  severity: MEDIUM
+  category: Android
+  description: remember without key loses state on recomposition
+  detection_pattern: remember\\s*\\{(?!.*key)
+  fix_pattern: Use remember(key) for dependent values
+  cwe: CWE-1188
+  example_code: // Wrong state\nremember { expensiveCalc() }\n// SAFE\nremember(dependency) { expensiveCalc(dependency) }
+- id: KT-19
+  name: Channel Close Leak
+  severity: MEDIUM
+  category: Concurrency
+  description: Channel not closed leaks resources
+  detection_pattern: Channel<(?!.*close|consumeEach)
+  fix_pattern: Close channel or use consumeEach
+  cwe: CWE-772
+  example_code: // Leak\nval channel = Channel<Int>()\n// SAFE\nchannel.close() or channel.consumeEach { ... }
+- id: KT-20
+  name: runBlocking Main
+  severity: HIGH
+  category: Android
+  description: runBlocking on main thread causes ANR
+  detection_pattern: runBlocking(?!.*Dispatchers\\.IO|withContext)
+  fix_pattern: Use launch or withContext(Dispatchers.IO)
+  cwe: CWE-400
+  example_code: // ANR\nrunBlocking { networkCall() }\n// SAFE\nlifecycleScope.launch { withContext(IO) { networkCall() } }

package/.agent/skills/core/security/data/language-specific/php-security.yaml

@@ -0,0 +1,219 @@
+metadata:
+  skill: security
+  domain: php_security
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: php-security.csv
+  patterns_count: 20
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - description
+  - detection_pattern
+  - fix_pattern
+  - cwe
+  - example_vuln
+  - example_fix
+patterns:
+- id: PHP-01
+  name: SQL Injection
+  severity: CRITICAL
+  category: Injection
+  description: Variable interpolation in SQL queries
+  detection_pattern: (mysql_query|mysqli_query|->query).*\\$(?!.*prepare|bindParam)
+  fix_pattern: Use PDO with prepared statements
+  cwe: CWE-89
+  example_vuln: mysqli_query($conn, \SELECT * FROM users WHERE id = $id\");"
+  example_fix: $stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');\n$stmt->execute([$id]);
+- id: PHP-02
+  name: XSS Output
+  severity: HIGH
+  category: XSS
+  description: User input echoed without htmlspecialchars
+  detection_pattern: echo.*\\$_(GET|POST|REQUEST)(?!.*htmlspecialchars)
+  fix_pattern: Use htmlspecialchars with ENT_QUOTES
+  cwe: CWE-79
+  example_vuln: echo $_GET['name'];
+  example_fix: echo htmlspecialchars($_GET['name'], ENT_QUOTES, 'UTF-8');
+- id: PHP-03
+  name: Command Injection
+  severity: CRITICAL
+  category: Injection
+  description: User input in shell_exec or system
+  detection_pattern: (shell_exec|system|exec|passthru).*\\$(?!.*escapeshellarg)
+  fix_pattern: Use escapeshellarg and escapeshellcmd
+  cwe: CWE-78
+  example_vuln: system('ping ' . $_GET['host']);
+  example_fix: system('ping ' . escapeshellarg($_GET['host']));
+- id: PHP-04
+  name: File Inclusion
+  severity: CRITICAL
+  category: LFI
+  description: User input in include or require
+  detection_pattern: (include|require|include_once|require_once).*\\$(?!.*whitelist)
+  fix_pattern: Use whitelist validate against allowed files
+  cwe: CWE-98
+  example_vuln: include($_GET['page'] . '.php');
+  example_fix: $allowed = ['home', 'about'];\nif (in_array($page, $allowed)) include($page . '.php');
+- id: PHP-05
+  name: Path Traversal
+  severity: HIGH
+  category: File
+  description: User input in file functions
+  detection_pattern: (file_get_contents|fopen|readfile).*\\$(?!.*realpath|basename)
+  fix_pattern: Use realpath and validate against base directory
+  cwe: CWE-22
+  example_vuln: readfile('uploads/' . $_GET['file']);
+  example_fix: $path = realpath('uploads/' . $_GET['file']);\nif (strpos($path, realpath('uploads/')) !== 0) die('Invalid');
+- id: PHP-06
+  name: Insecure Deserialization
+  severity: CRITICAL
+  category: Deserialization
+  description: unserialize on user input
+  detection_pattern: unserialize.*\\$_(GET|POST|REQUEST|COOKIE)
+  fix_pattern: Use JSON or restrict allowed classes
+  cwe: CWE-502
+  example_vuln: $data = unserialize($_POST['data']);
+  example_fix: '$data = unserialize($_POST[''data''], [''allowed_classes'' => false]);\n// Or: $data = json_decode($_POST[''data'']);'
+- id: PHP-07
+  name: Weak Password Hash
+  severity: HIGH
+  category: Crypto
+  description: MD5 or SHA1 for password hashing
+  detection_pattern: (md5|sha1).*password|\\$_POST\\['password'\\]
+  fix_pattern: Use password_hash with PASSWORD_DEFAULT
+  cwe: CWE-327
+  example_vuln: $hash = md5($password);
+  example_fix: '$hash = password_hash($password, PASSWORD_DEFAULT);\n// Verify: password_verify($input, $hash)'
+- id: PHP-08
+  name: CSRF Missing
+  severity: HIGH
+  category: CSRF
+  description: Form without CSRF token validation
+  detection_pattern: \\$_POST(?!.*csrf|token.*verify)
+  fix_pattern: Implement CSRF tokens validate on submit
+  cwe: CWE-352
+  example_vuln: if ($_POST['action'] == 'delete') { /* delete */ }
+  example_fix: if (!hash_equals($_SESSION['csrf'], $_POST['csrf'])) die('Invalid');
+- id: PHP-09
+  name: Session Fixation
+  severity: HIGH
+  category: Session
+  description: Session ID not regenerated on login
+  detection_pattern: session_start(?!.*session_regenerate_id)
+  fix_pattern: Call session_regenerate_id after authentication
+  cwe: CWE-384
+  example_vuln: session_start();\n$_SESSION['user'] = $user;
+  example_fix: session_start();\nsession_regenerate_id(true);\n$_SESSION['user'] = $user;
+- id: PHP-10
+  name: Insecure Cookie
+  severity: HIGH
+  category: Session
+  description: Cookies without security flags
+  detection_pattern: setcookie.*(?!.*httponly|secure|samesite)
+  fix_pattern: Set httponly secure samesite flags
+  cwe: CWE-614
+  example_vuln: setcookie('session', $token);
+  example_fix: setcookie('session', $token, [\n  'httponly' => true,\n  'secure' => true,\n  'samesite' => 'Strict'\n]);
+- id: PHP-11
+  name: Open Redirect
+  severity: MEDIUM
+  category: Redirect
+  description: User input in header redirect
+  detection_pattern: header.*Location.*\\$(?!.*allowlist)
+  fix_pattern: Validate redirect URLs against allowlist
+  cwe: CWE-601
+  example_vuln: 'header(''Location: '' . $_GET[''url'']);'
+  example_fix: '$allowed = [''/'', ''/dashboard''];\nif (in_array($url, $allowed)) header(''Location: '' . $url);'
+- id: PHP-12
+  name: XML External Entity
+  severity: CRITICAL
+  category: XXE
+  description: XML parsing with external entities
+  detection_pattern: libxml_disable_entity_loader.*false|DOMDocument(?!.*LIBXML_NOENT)
+  fix_pattern: Disable external entity loading
+  cwe: CWE-611
+  example_vuln: $doc = new DOMDocument();\n$doc->loadXML($xml);
+  example_fix: libxml_disable_entity_loader(true);\n$doc = new DOMDocument();\n$doc->loadXML($xml, LIBXML_NOENT | LIBXML_DTDLOAD);
+- id: PHP-13
+  name: Information Exposure
+  severity: MEDIUM
+  category: Info
+  description: Error display enabled in production
+  detection_pattern: display_errors.*On|error_reporting.*E_ALL
+  fix_pattern: Disable display_errors log to file instead
+  cwe: CWE-209
+  example_vuln: display_errors = On
+  example_fix: display_errors = Off\nlog_errors = On
+- id: PHP-14
+  name: Unsafe File Upload
+  severity: CRITICAL
+  category: Upload
+  description: File upload without validation
+  detection_pattern: move_uploaded_file(?!.*mime|extension.*whitelist)
+  fix_pattern: Validate MIME type extension and scan content
+  cwe: CWE-434
+  example_vuln: move_uploaded_file($_FILES['f']['tmp_name'], $target);
+  example_fix: $allowed = ['image/jpeg', 'image/png'];\nif (!in_array($_FILES['f']['type'], $allowed)) die();
+- id: PHP-15
+  name: Eval Injection
+  severity: CRITICAL
+  category: Injection
+  description: User input in eval or create_function
+  detection_pattern: (eval|create_function|assert).*\\$
+  fix_pattern: Never use eval with user input use alternatives
+  cwe: CWE-94
+  example_vuln: eval('$result = ' . $_GET['expr'] . ';');
+  example_fix: // Use a math parser library instead of eval
+- id: PHP-16
+  name: Preg Callback Injection
+  severity: HIGH
+  category: Injection
+  description: PREG_REPLACE_EVAL or preg_replace with /e modifier
+  detection_pattern: preg_replace.*\\/e|PREG_REPLACE_EVAL
+  fix_pattern: Use preg_replace_callback instead
+  cwe: CWE-94
+  example_vuln: preg_replace('/.*/e', $_GET['code'], $input);
+  example_fix: preg_replace_callback('/.*/', function($m) { /* safe */ }, $input);
+- id: PHP-17
+  name: Type Juggling
+  severity: HIGH
+  category: Auth
+  description: Loose comparison with user input
+  detection_pattern: ==.*\\$_(GET|POST)|\\$_(GET|POST).*==
+  fix_pattern: Use strict comparison === or hash_equals
+  cwe: CWE-697
+  example_vuln: if ($_POST['token'] == $secret) { /* bypass */ }
+  example_fix: if (hash_equals($secret, $_POST['token'])) { }
+- id: PHP-18
+  name: Unvalidated Redirect
+  severity: MEDIUM
+  category: Redirect
+  description: header() with unvalidated user input
+  detection_pattern: header\\s*\\(.*\\$(?!.*parse_url|filter_var)
+  fix_pattern: Validate URL format and domain
+  cwe: CWE-601
+  example_vuln: 'header(''Refresh: 0; url='' . $_GET[''url'']);'
+  example_fix: '$url = filter_var($_GET[''url''], FILTER_VALIDATE_URL);\nif ($url && parse_url($url, PHP_URL_HOST) === ''example.com'') header(''Location: '' . $url);'
+- id: PHP-19
+  name: Insecure Random
+  severity: HIGH
+  category: Crypto
+  description: Using rand() or mt_rand() for security
+  detection_pattern: (rand|mt_rand|uniqid)\\(\\)(?!.*random_bytes)
+  fix_pattern: Use random_bytes or random_int for security
+  cwe: CWE-338
+  example_vuln: $token = md5(mt_rand());
+  example_fix: $token = bin2hex(random_bytes(32));
+- id: PHP-20
+  name: Register Globals Style
+  severity: HIGH
+  category: Config
+  description: Direct use of uninitialized variables
+  detection_pattern: \\$(?!_(GET|POST|SESSION|SERVER|FILES))\\w+(?!.*=).*\\$_(GET|POST)
+  fix_pattern: Always initialize variables validate input
+  cwe: CWE-94
+  example_vuln: if ($admin) { /* bypass if $admin in GET */ }
+  example_fix: $admin = false;\n$admin = isset($_SESSION['admin']) && $_SESSION['admin'];