@nockdev/awf 6.2.0

package/.agent/skills/core/security/data/language-specific/swift-security.yaml

@@ -0,0 +1,198 @@
+metadata:
+  skill: security
+  domain: swift_security
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: swift-security.csv
+  patterns_count: 20
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - description
+  - detection_pattern
+  - fix_pattern
+  - cwe
+  - example_code
+patterns:
+- id: SW-01
+  name: Keychain Without ACL
+  severity: HIGH
+  category: iOS
+  description: Keychain item without biometric protection
+  detection_pattern: kSecAttrAccessible(?!.*kSecAccessControl)
+  fix_pattern: Use kSecAccessControlBiometryAny for sensitive data
+  cwe: CWE-522
+  example_code: // Weak\nkSecAttrAccessibleWhenUnlocked\n// SAFE\nSecAccessControlCreateWithFlags(nil, .biometryAny, ...)
+- id: SW-02
+  name: ATS Bypass Domain
+  severity: HIGH
+  category: iOS
+  description: App Transport Security disabled for domain
+  detection_pattern: NSExceptionDomains|NSAllowsArbitraryLoads
+  fix_pattern: Avoid ATS exceptions or whitelist specific domains only
+  cwe: CWE-319
+  example_code: '// Insecure\n<key>NSAllowsArbitraryLoads</key><true/>\n// SAFE: Use HTTPS only'
+- id: SW-03
+  name: Hardcoded Credentials
+  severity: CRITICAL
+  category: iOS
+  description: API key or password in source code
+  detection_pattern: (apiKey|password|secret)\\s*=\\s*\[^\"]+\""
+  fix_pattern: Use Keychain or environment variables
+  cwe: CWE-798
+  example_code: '// Exposed\nlet apiKey = \sk-1234567890\"\n// SAFE: Keychain or .xcconfig"'
+- id: SW-04
+  name: Jailbreak Detection Weak
+  severity: MEDIUM
+  category: iOS
+  description: Simple jailbreak check easily bypassed
+  detection_pattern: fileExists.*cydia|canOpenURL.*cydia
+  fix_pattern: Use multiple detection methods and obfuscate
+  cwe: CWE-693
+  example_code: '// Weak\nFileManager.default.fileExists(atPath: \/Applications/Cydia.app\")\n// SAFE: Multiple checks + native code"'
+- id: SW-05
+  name: UserDefaults Sensitive
+  severity: HIGH
+  category: iOS
+  description: Sensitive data in unencrypted UserDefaults
+  detection_pattern: UserDefaults.*password|token|secret
+  fix_pattern: Use Keychain for sensitive data
+  cwe: CWE-312
+  example_code: '// Unencrypted\nUserDefaults.standard.set(token, forKey: \token\")\n// SAFE: Keychain"'
+- id: SW-06
+  name: URLSession No Pin
+  severity: HIGH
+  category: iOS
+  description: URLSession without certificate pinning
+  detection_pattern: URLSession(?!.*urlSession.*didReceive.*challenge)
+  fix_pattern: Implement certificate pinning delegate
+  cwe: CWE-295
+  example_code: '// No pinning\nURLSession.shared.dataTask(...)\n// SAFE: Custom session with pinning'
+- id: SW-07
+  name: WebView WKWebView JS
+  severity: HIGH
+  category: iOS
+  description: WKWebView with unsafe JavaScript bridge
+  detection_pattern: WKScriptMessageHandler|evaluateJavaScript.*\\+
+  fix_pattern: Validate JavaScript input/output strictly
+  cwe: CWE-79
+  example_code: '// XSS risk\nwebView.evaluateJavaScript(userScript)\n// SAFE: Whitelist commands'
+- id: SW-08
+  name: Biometric No Domain
+  severity: MEDIUM
+  category: iOS
+  description: LAContext without kSecUseAuthenticationContext
+  detection_pattern: evaluatePolicy(?!.*kSecUseAuthenticationContext)
+  fix_pattern: Use domainState to detect biometric changes
+  cwe: CWE-287
+  example_code: '// Bypassed if fingerprint changed\ncontext.evaluatePolicy(.biometricOnly)\n// SAFE: Check domainState'
+- id: SW-09
+  name: Pasteboard Leak
+  severity: MEDIUM
+  category: iOS
+  description: Sensitive data copied to pasteboard persists
+  detection_pattern: UIPasteboard.*setString|copiedText.*password
+  fix_pattern: Clear pasteboard after short timeout
+  cwe: CWE-200
+  example_code: '// Persists\nUIPasteboard.general.string = password\n// SAFE: Clear after 30 seconds'
+- id: SW-10
+  name: URL Scheme Hijack
+  severity: HIGH
+  category: iOS
+  description: Custom URL scheme without source validation
+  detection_pattern: openURL\\(.*\\)|application.*openURL(?!.*sourceApplication)
+  fix_pattern: Validate source application and URL parameters
+  cwe: CWE-601
+  example_code: '// Hijackable\nfunc application(_ app: UIApplication, open url: URL)\n// SAFE: Validate sourceApplication'
+- id: SW-11
+  name: Screenshot Capture
+  severity: MEDIUM
+  category: iOS
+  description: Sensitive view not hidden on background
+  detection_pattern: applicationWillResignActive(?!.*blur|hide)
+  fix_pattern: Blur or hide sensitive content on backgrounding
+  cwe: CWE-200
+  example_code: '// Visible in task switcher\nfunc applicationWillResignActive(_:) {}\n// SAFE: Add blur overlay'
+- id: SW-12
+  name: Swift Concurrency Race
+  severity: HIGH
+  category: Concurrency
+  description: Actor state accessed from nonisolated context
+  detection_pattern: nonisolated.*self\\.|Task\\s*\\{.*self\\.(?!await)
+  fix_pattern: Use MainActor or proper isolation
+  cwe: CWE-362
+  example_code: '// Race condition\nnonisolated func update() { self.state = new }\n// SAFE: @MainActor'
+- id: SW-13
+  name: Unowned Crash
+  severity: HIGH
+  category: Memory
+  description: unowned reference accessed after deallocation
+  detection_pattern: unowned\\s+(var|let)(?!.*\\[weak\\])
+  fix_pattern: Use weak with guard instead of unowned
+  cwe: CWE-416
+  example_code: '// Crash\nunowned let delegate: Delegate\n// SAFE\nweak var delegate: Delegate?'
+- id: SW-14
+  name: Force Unwrap Optional
+  severity: MEDIUM
+  category: Memory
+  description: Force unwrap ! on optional can crash
+  detection_pattern: \\!(?!.*guard|if\\s+let)
+  fix_pattern: Use guard let or if let with fallback
+  cwe: CWE-476
+  example_code: // Crash\nlet value = optional!\n// SAFE\nguard let value = optional else { return }
+- id: SW-15
+  name: Crypto Deprecated
+  severity: HIGH
+  category: Crypto
+  description: Using deprecated Security.framework APIs
+  detection_pattern: SecKeyEncrypt|CC_MD5|SecTransform
+  fix_pattern: Use CryptoKit for modern encryption
+  cwe: CWE-327
+  example_code: '// Deprecated\nCC_MD5(data, len, digest)\n// SAFE\nCryptoKit.SHA256.hash(data: data)'
+- id: SW-16
+  name: CoreData No Encryption
+  severity: HIGH
+  category: iOS
+  description: CoreData store without file protection
+  detection_pattern: NSSQLiteStoreType(?!.*NSFileProtection)
+  fix_pattern: Enable NSFileProtectionComplete
+  cwe: CWE-311
+  example_code: '// Unencrypted\nNSSQLiteStoreType\n// SAFE: Add NSPersistentStoreFileProtectionKey: .complete'
+- id: SW-17
+  name: Notification Payload
+  severity: MEDIUM
+  category: iOS
+  description: Sensitive data in push notification payload
+  detection_pattern: UNNotificationContent.*body.*secret|password
+  fix_pattern: Avoid sensitive data in notifications
+  cwe: CWE-200
+  example_code: '// Exposed\ncontent.body = \Your OTP is \\(otp)\"\n// SAFE: Use silent push and fetch from server"'
+- id: SW-18
+  name: Debug Build Leak
+  severity: LOW
+  category: iOS
+  description: Debug assertions compiled in release
+  detection_pattern: '#if DEBUG(?!.*#endif)|assert\\(.*DEBUG)'
+  fix_pattern: Ensure assertions stripped in release
+  cwe: CWE-215
+  example_code: '// Left in release\nassert(isValid())\n// SAFE: Use #if DEBUG properly'
+- id: SW-19
+  name: Sendable Violation
+  severity: HIGH
+  category: Concurrency
+  description: Non-Sendable type across actor boundary
+  detection_pattern: Task\\s*\\{.*capture.*(?!Sendable)
+  fix_pattern: Mark types as Sendable or use @unchecked carefully
+  cwe: CWE-362
+  example_code: '// Data race\nTask { self.mutableArray.append() }\n// SAFE: Make Sendable or copy'
+- id: SW-20
+  name: Path Traversal Bundle
+  severity: HIGH
+  category: iOS
+  description: User path accessing outside app bundle
+  detection_pattern: Bundle\\.main\\.path.*\\+.*user|URL.*appendingPathComponent.*params
+  fix_pattern: Validate paths stay within allowed directories
+  cwe: CWE-22
+  example_code: '// Traversal\nBundle.main.path(forResource: userInput, ofType: nil)\n// SAFE: Validate and sanitize'

package/.agent/skills/core/security/data/language-specific/typescript-security.yaml

@@ -0,0 +1,295 @@
+metadata:
+  skill: security
+  domain: typescript_security
+  version: 6.2.0
+  updated: '2026-02-05'
+  migrated_from: typescript-security.csv
+  patterns_count: 25
+  columns:
+  - id
+  - name
+  - severity
+  - category
+  - description
+  - detection_pattern
+  - fix_pattern
+  - cwe
+  - cve_reference
+  - example_vuln
+  - example_fix
+patterns:
+- id: TS-01
+  name: Prototype Pollution
+  severity: CRITICAL
+  category: Injection
+  description: Object.assign or merge with user input pollutes Object.prototype
+  detection_pattern: (Object\\.assign|\\.\\.\\.|merge|extend).*input(?!.*sanitize)
+  fix_pattern: Use Object.create(null) or validate keys against __proto__
+  cwe: CWE-1321
+  cve_reference: CVE-2024-29650,CVE-2024-21529
+  example_vuln: Object.assign(target, userInput)
+  example_fix: const safe = Object.create(null);\nfor (const k of Object.keys(userInput)) {\n  if (!['__proto__', 'constructor', 'prototype'].includes(k)) safe[k] = userInput[k];\n}
+- id: TS-02
+  name: ReDoS Regex
+  severity: HIGH
+  category: DoS
+  description: User input in RegExp causes catastrophic backtracking
+  detection_pattern: new\\s+RegExp.*input(?!.*timeout|safe-regex)
+  fix_pattern: Use safe-regex library or re2 with timeout
+  cwe: CWE-1333
+  cve_reference: n/a
+  example_vuln: new RegExp(userPattern).test(data)
+  example_fix: import * as re2 from 're2';\nnew re2.RE2(userPattern).test(data);
+- id: TS-03
+  name: eval/Function RCE
+  severity: CRITICAL
+  category: Injection
+  description: eval or new Function with user input leads to RCE
+  detection_pattern: (eval|new\\s+Function)\\s*\\(.*input
+  fix_pattern: Never use eval with user input use JSON.parse for data
+  cwe: CWE-94
+  cve_reference: n/a
+  example_vuln: eval(userCode)
+  example_fix: JSON.parse(userData) // For data only
+- id: TS-04
+  name: vm Module Sandbox Escape
+  severity: CRITICAL
+  category: Sandbox
+  description: vm.runInContext can be escaped via constructor
+  detection_pattern: vm\\.(runIn|createContext).*input(?!.*vm2|isolated)
+  fix_pattern: Use vm2 or isolated-vm with proper limits
+  cwe: CWE-94
+  cve_reference: CVE-2024-21534
+  example_vuln: vm.runInNewContext(userCode)
+  example_fix: 'import ivm from ''isolated-vm'';\nconst isolate = new ivm.Isolate({ memoryLimit: 128 });'
+- id: TS-05
+  name: jsonpath-plus RCE
+  severity: CRITICAL
+  category: Injection
+  description: jsonpath-plus before 10.0.0 allows RCE via expressions
+  detection_pattern: jsonpath-plus(?!.*10\\.|[1-9][0-9]+\\.)
+  fix_pattern: Upgrade jsonpath-plus to 10.0.0+ or use safe alternatives
+  cwe: CWE-94
+  cve_reference: CVE-2024-21534
+  example_vuln: const { JSONPath } = require('jsonpath-plus'); // < 10.0.0
+  example_fix: npm install jsonpath-plus@^10.0.0
+- id: TS-06
+  name: Source Map Exposure
+  severity: MEDIUM
+  category: Information
+  description: Source maps exposed in production reveal original code
+  detection_pattern: sourceMappingURL(?=.*production)|\\*.map.*public
+  fix_pattern: Remove source maps from production builds
+  cwe: CWE-540
+  cve_reference: n/a
+  example_vuln: // bundle.js.map accessible in production
+  example_fix: '// webpack.prod.js\ndevtool: false'
+- id: TS-07
+  name: postMessage Origin
+  severity: HIGH
+  category: XSS
+  description: postMessage without origin validation allows XSS
+  detection_pattern: postMessage\\((?!.*targetOrigin)|onmessage(?!.*origin)
+  fix_pattern: Always check event.origin and use specific targetOrigin
+  cwe: CWE-346
+  cve_reference: n/a
+  example_vuln: window.postMessage(data, '*')
+  example_fix: 'window.postMessage(data, ''https://trusted.com'');\n// receiver: if (event.origin !== ''https://trusted.com'') return;'
+- id: TS-08
+  name: DOM Clobbering
+  severity: MEDIUM
+  category: XSS
+  description: HTML elements can clobber global document properties
+  detection_pattern: document\\.[a-zA-Z]+\\s*=(?!.*sanitize)
+  fix_pattern: Validate element IDs and names sanitize HTML
+  cwe: CWE-79
+  cve_reference: n/a
+  example_vuln: <form name=location href=javascript:alert(1)>
+  example_fix: 'DOMPurify.sanitize(html, { SANITIZE_DOM: true })'
+- id: TS-09
+  name: TypeScript any Bypass
+  severity: MEDIUM
+  category: Types
+  description: any type bypasses TypeScript's type system
+  detection_pattern: :\\s*any(?!.*\\/\\/\\s*(allowed|TODO))
+  fix_pattern: Use strict types unknown with type guards or generics
+  cwe: CWE-1287
+  cve_reference: n/a
+  example_vuln: 'function process(data: any) { data.anything() }'
+  example_fix: 'function process(data: unknown) { if (isValidData(data)) process(data); }'
+- id: TS-10
+  name: Template Literal Injection
+  severity: HIGH
+  category: Injection
+  description: Template literals with user input allow injection
+  detection_pattern: \\`[^\\`]*\\$\\{.*input[^\\`]*\\`(?!.*sanitize)
+  fix_pattern: Sanitize user input before template interpolation
+  cwe: CWE-94
+  cve_reference: n/a
+  example_vuln: '`SELECT * WHERE id=${userId}`'
+  example_fix: sql`SELECT * WHERE id=${userId}` // Use tagged template
+- id: TS-11
+  name: localStorage Secrets
+  severity: HIGH
+  category: Secrets
+  description: Sensitive data stored in localStorage accessible via XSS
+  detection_pattern: localStorage\\.(setItem|getItem).*token|secret|password
+  fix_pattern: Use httpOnly cookies for sensitive tokens
+  cwe: CWE-922
+  cve_reference: n/a
+  example_vuln: localStorage.setItem('authToken', token)
+  example_fix: // Use httpOnly cookie set by server instead
+- id: TS-12
+  name: Buffer Overread
+  severity: HIGH
+  category: Memory
+  description: Buffer.from with invalid length causes memory leaks
+  detection_pattern: Buffer\\.(from|alloc).*length(?!.*validate)
+  fix_pattern: Validate buffer sizes and use Buffer.allocSafe
+  cwe: CWE-125
+  cve_reference: n/a
+  example_vuln: Buffer.from(userInput, 0, userLength)
+  example_fix: const len = Math.min(userLength, MAX_SIZE);\nBuffer.allocSafe(len).fill(userInput);
+- id: TS-13
+  name: Path Traversal
+  severity: HIGH
+  category: File
+  description: User input in path.join without validation
+  detection_pattern: path\\.join.*input(?!.*normalize)
+  fix_pattern: Use path.normalize and validate against base directory
+  cwe: CWE-22
+  cve_reference: n/a
+  example_vuln: path.join(base, userInput)
+  example_fix: const full = path.normalize(path.join(base, userInput));\nif (!full.startsWith(base)) throw new Error();
+- id: TS-14
+  name: Command Injection
+  severity: CRITICAL
+  category: Injection
+  description: child_process.exec with user input allows command injection
+  detection_pattern: exec\\(.*input|execSync.*input
+  fix_pattern: Use execFile with array arguments
+  cwe: CWE-78
+  cve_reference: n/a
+  example_vuln: exec('ls ' + userInput)
+  example_fix: execFile('ls', [userInput])
+- id: TS-15
+  name: SSRF fetch
+  severity: HIGH
+  category: Network
+  description: fetch with user URL allows SSRF
+  detection_pattern: fetch\\(.*input(?!.*allowlist|validate)
+  fix_pattern: Validate URLs against allowlist block internal IPs
+  cwe: CWE-918
+  cve_reference: n/a
+  example_vuln: fetch(userUrl)
+  example_fix: if (isExternalUrl(userUrl)) fetch(userUrl)
+- id: TS-16
+  name: Insecure Random
+  severity: HIGH
+  category: Cryptography
+  description: Math.random used for security-sensitive values
+  detection_pattern: Math\\.random\\(\\).*token|session|secret
+  fix_pattern: Use crypto.randomBytes or crypto.randomUUID
+  cwe: CWE-330
+  cve_reference: n/a
+  example_vuln: const token = Math.random().toString(36)
+  example_fix: import { randomUUID } from 'crypto';\nconst token = randomUUID();
+- id: TS-17
+  name: SQL Injection Knex
+  severity: HIGH
+  category: Injection
+  description: Knex raw query with string interpolation
+  detection_pattern: knex\\.raw\\(.*\\+.*input|knex\\.raw\\(.*\\$\\{
+  fix_pattern: Use parameterized queries with knex.raw
+  cwe: CWE-89
+  cve_reference: n/a
+  example_vuln: knex.raw(`SELECT * WHERE id = ${id}`)
+  example_fix: knex.raw('SELECT * WHERE id = ?', [id])
+- id: TS-18
+  name: XSS dangerouslySetInnerHTML
+  severity: HIGH
+  category: XSS
+  description: React dangerouslySetInnerHTML with unsanitized input
+  detection_pattern: dangerouslySetInnerHTML.*input(?!.*DOMPurify)
+  fix_pattern: Use DOMPurify.sanitize before dangerouslySetInnerHTML
+  cwe: CWE-79
+  cve_reference: n/a
+  example_vuln: '<div dangerouslySetInnerHTML={{__html: userHtml}} />'
+  example_fix: 'import DOMPurify from ''dompurify'';\n<div dangerouslySetInnerHTML={{__html: DOMPurify.sanitize(userHtml)}} />'
+- id: TS-19
+  name: JWT Algorithm None
+  severity: CRITICAL
+  category: Authentication
+  description: JWT verification allows algorithm none or symmetric/asymmetric confusion
+  detection_pattern: jwt\\.verify(?!.*algorithms)
+  fix_pattern: Explicitly specify allowed algorithms in JWT verification
+  cwe: CWE-347
+  cve_reference: n/a
+  example_vuln: jwt.verify(token, key)
+  example_fix: 'jwt.verify(token, key, { algorithms: [''RS256''] })'
+- id: TS-20
+  name: Express Trust Proxy
+  severity: MEDIUM
+  category: Configuration
+  description: Express trust proxy misconfigured allows IP spoofing
+  detection_pattern: app\\.set.*trust\\s+proxy.*true
+  fix_pattern: Set trust proxy to specific count or proxy addresses
+  cwe: CWE-290
+  cve_reference: n/a
+  example_vuln: app.set('trust proxy', true)
+  example_fix: app.set('trust proxy', 1) // Trust only first proxy
+- id: TS-21
+  name: NoSQL Injection
+  severity: HIGH
+  category: Injection
+  description: MongoDB query with user object allows operator injection
+  detection_pattern: (find|findOne|updateOne).*input(?!.*sanitize)
+  fix_pattern: Sanitize input or use mongo-sanitize library
+  cwe: CWE-943
+  cve_reference: n/a
+  example_vuln: 'db.users.findOne({ user: userInput }) // userInput = {$gt: ''''}'
+  example_fix: 'import mongoSanitize from ''mongo-sanitize'';\ndb.users.findOne({ user: mongoSanitize(userInput) })'
+- id: TS-22
+  name: Type Juggling eqeq
+  severity: MEDIUM
+  category: Logic
+  description: == comparison allows type coercion bypass
+  detection_pattern: '[^!=]={1}[^=](?!.*===)'
+  fix_pattern: Always use === for equality comparison
+  cwe: CWE-1287
+  cve_reference: n/a
+  example_vuln: if (input == 'admin') // '0' == false is true
+  example_fix: if (input === 'admin')
+- id: TS-23
+  name: Insecure Deserialization
+  severity: HIGH
+  category: Deserialization
+  description: serialize-javascript or similar with user input
+  detection_pattern: (serialize|deserialize|unserialize).*input
+  fix_pattern: Use JSON.parse for data never execute serialized code
+  cwe: CWE-502
+  cve_reference: n/a
+  example_vuln: eval(deserialize(userInput))
+  example_fix: JSON.parse(userInput)
+- id: TS-24
+  name: CORS Misconfiguration
+  severity: HIGH
+  category: Configuration
+  description: CORS allows any origin or reflects origin header
+  detection_pattern: Access-Control-Allow-Origin.*\\*|origin.*req\\.headers
+  fix_pattern: Specify allowed origins explicitly never use wildcard with credentials
+  cwe: CWE-346
+  cve_reference: n/a
+  example_vuln: res.setHeader('Access-Control-Allow-Origin', '*')
+  example_fix: res.setHeader('Access-Control-Allow-Origin', 'https://trusted.com')
+- id: TS-25
+  name: DevTools Detection Bypass
+  severity: MEDIUM
+  category: Client
+  description: Client-side DevTools detection can be bypassed
+  detection_pattern: devtools.*detect|isDebuggerPresent(?!.*server)
+  fix_pattern: Don't rely on client-side detection for security
+  cwe: CWE-693
+  cve_reference: n/a
+  example_vuln: if (devtools.isOpen) redirect()
+  example_fix: // Move sensitive logic to server-side