@rune-kit/rune 2.8.0 → 2.11.0

package/extensions/security/skills/api-security.md

@@ -1,140 +1,140 @@
----
-name: "api-security"
-pack: "@rune/security"
-description: "API hardening patterns — rate limiting strategies, input sanitization beyond schema validation, CORS configuration, Content Security Policy generation, and security headers middleware. Outputs ready-to-use middleware code for Express, Fastify, and Next.js."
-model: sonnet
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# api-security
-
-API hardening patterns — rate limiting strategies, input sanitization beyond schema validation, CORS configuration, Content Security Policy generation, and security headers middleware. Outputs ready-to-use middleware code for Express, Fastify, and Next.js.
-
-#### Workflow
-
-**Step 1 — Enumerate API Endpoints**
-Use Grep to list all route definitions across the codebase. Categorize by: public (unauthenticated), authenticated, admin, and internal (service-to-service). For each endpoint, note: whether it accepts user-controlled input, whether it has rate limiting applied, and whether it can trigger expensive operations (DB writes, external API calls, file I/O).
-
-**Step 2 — Audit Rate Limiting**
-Check if rate limiting is applied per-endpoint or only globally. Global rate limits are bypassable — an attacker can flood a single expensive endpoint within the global budget. Verify rate limits are enforced at the infrastructure level (not just in-process) so they survive server restarts and work across horizontally scaled instances. Recommend: Redis-backed sliding window for authenticated endpoints, token bucket for public endpoints. Set tighter limits on auth endpoints (login, password reset, OTP verify) to prevent brute force.
-
-**Step 3 — Audit Input Validation**
-Schema validation (Zod, Joi) is necessary but not sufficient. Additionally check:
-- **HTML inputs** — is DOMPurify or equivalent used before any user content is rendered as HTML?
-- **File uploads** — is MIME type validated from magic bytes (not just the `Content-Type` header)? Is file size capped before reading into memory?
-- **Path parameters** — could `req.params.filename` be `../../etc/passwd`? Normalize with `path.resolve` and verify it stays within the allowed base directory.
-- **Numeric IDs** — are they validated as integers to prevent NoSQL/ORM injection via object payloads?
-
-**Step 4 — Verify CORS Configuration**
-Check that `Access-Control-Allow-Origin` is not `*` for authenticated endpoints. Verify origins are defined per-environment (development allows localhost, production allows only the production domain). Check credentials handling — `credentials: true` must never be paired with `origin: '*'`. Verify preflight caching (`Access-Control-Max-Age`) is set to reduce OPTIONS request overhead without being too long.
-
-**Step 5 — Generate CSP Policy**
-Build a Content Security Policy tailored to the application's actual resource origins. Use `script-src 'nonce-{random}'` for inline scripts rather than `'unsafe-inline'`. Generate nonces server-side per request. Define `connect-src` to only allow the actual API and WebSocket origins. Add `upgrade-insecure-requests` for HTTPS-only deployments.
-
-**Step 6 — Emit Security Headers Middleware**
-Produce a complete security headers middleware file. Include: HSTS with preload, X-Content-Type-Options, X-Frame-Options, Referrer-Policy (strict-origin-when-cross-origin), and Permissions-Policy to restrict camera/mic/geolocation access. Output the middleware as a ready-to-paste file for the detected framework.
-
-#### Example
-
-```typescript
-// EXPRESS: complete security headers middleware
-// File to create: src/middleware/security-headers.ts
-
-import { Request, Response, NextFunction } from 'express'
-import crypto from 'crypto'
-
-export function securityHeaders(req: Request, res: Response, next: NextFunction) {
-  const nonce = crypto.randomBytes(16).toString('base64')
-  res.locals.cspNonce = nonce
-
-  res.setHeader('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload')
-  res.setHeader('X-Content-Type-Options', 'nosniff')
-  res.setHeader('X-Frame-Options', 'DENY')
-  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin')
-  res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()')
-  res.setHeader(
-    'Content-Security-Policy',
-    [
-      `script-src 'nonce-${nonce}' 'strict-dynamic'`,
-      "style-src 'self' https://fonts.googleapis.com",
-      "font-src 'self' https://fonts.gstatic.com",
-      "connect-src 'self' wss://api.yourdomain.com",
-      "img-src 'self' data: https:",
-      "frame-ancestors 'none'",
-      'upgrade-insecure-requests',
-    ].join('; ')
-  )
-  next()
-}
-
-// RATE LIMITING: Redis-backed sliding window (express-rate-limit + ioredis)
-import rateLimit from 'express-rate-limit'
-import RedisStore from 'rate-limit-redis'
-import Redis from 'ioredis'
-
-const redis = new Redis(process.env.REDIS_URL)
-
-// Tight limit on auth endpoints — brute force prevention
-export const authRateLimit = rateLimit({
-  windowMs: 15 * 60 * 1000,  // 15 minutes
-  max: 10,                     // 10 attempts per window
-  standardHeaders: 'draft-7',
-  legacyHeaders: false,
-  store: new RedisStore({ sendCommand: (...args) => redis.call(...args) }),
-  message: { error: 'Too many attempts, please try again later' },
-})
-
-// General API limit — per-user sliding window
-export const apiRateLimit = rateLimit({
-  windowMs: 60 * 1000,   // 1 minute
-  max: 100,              // 100 req/min per IP
-  keyGenerator: (req) => req.user?.id ?? req.ip,  // per-user when authenticated
-  store: new RedisStore({ sendCommand: (...args) => redis.call(...args) }),
-})
-
-// INPUT: path traversal prevention for file name parameters
-import path from 'path'
-
-function safeFilePath(baseDir: string, userFilename: string): string {
-  const normalized = path.resolve(baseDir, userFilename)
-  if (!normalized.startsWith(path.resolve(baseDir))) {
-    throw new ForbiddenError('Path traversal attempt detected')
-  }
-  return normalized
-}
-
-// CORS: environment-aware origin allowlist
-const CORS_ORIGINS: Record<string, string[]> = {
-  production:  ['https://app.yourdomain.com'],
-  staging:     ['https://staging.yourdomain.com'],
-  development: ['http://localhost:3000', 'http://localhost:5173'],
-}
-
-export const corsOptions = {
-  origin: (origin: string | undefined, cb: Function) => {
-    const allowed = CORS_ORIGINS[process.env.NODE_ENV ?? 'development']
-    if (!origin || allowed.includes(origin)) return cb(null, true)
-    cb(new Error('Not allowed by CORS'))
-  },
-  credentials: true,
-  maxAge: 600,  // cache preflight for 10 minutes
-}
-```
-
-```typescript
-// NEXT.JS: security headers in next.config.ts
-const securityHeaders = [
-  { key: 'X-DNS-Prefetch-Control', value: 'on' },
-  { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },
-  { key: 'X-Frame-Options', value: 'DENY' },
-  { key: 'X-Content-Type-Options', value: 'nosniff' },
-  { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
-  { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
-]
-
-export default {
-  async headers() {
-    return [{ source: '/(.*)', headers: securityHeaders }]
-  },
-}
-```
+---
+name: "api-security"
+pack: "@rune/security"
+description: "API hardening patterns — rate limiting strategies, input sanitization beyond schema validation, CORS configuration, Content Security Policy generation, and security headers middleware. Outputs ready-to-use middleware code for Express, Fastify, and Next.js."
+model: sonnet
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# api-security
+
+API hardening patterns — rate limiting strategies, input sanitization beyond schema validation, CORS configuration, Content Security Policy generation, and security headers middleware. Outputs ready-to-use middleware code for Express, Fastify, and Next.js.
+
+#### Workflow
+
+**Step 1 — Enumerate API Endpoints**
+Use Grep to list all route definitions across the codebase. Categorize by: public (unauthenticated), authenticated, admin, and internal (service-to-service). For each endpoint, note: whether it accepts user-controlled input, whether it has rate limiting applied, and whether it can trigger expensive operations (DB writes, external API calls, file I/O).
+
+**Step 2 — Audit Rate Limiting**
+Check if rate limiting is applied per-endpoint or only globally. Global rate limits are bypassable — an attacker can flood a single expensive endpoint within the global budget. Verify rate limits are enforced at the infrastructure level (not just in-process) so they survive server restarts and work across horizontally scaled instances. Recommend: Redis-backed sliding window for authenticated endpoints, token bucket for public endpoints. Set tighter limits on auth endpoints (login, password reset, OTP verify) to prevent brute force.
+
+**Step 3 — Audit Input Validation**
+Schema validation (Zod, Joi) is necessary but not sufficient. Additionally check:
+- **HTML inputs** — is DOMPurify or equivalent used before any user content is rendered as HTML?
+- **File uploads** — is MIME type validated from magic bytes (not just the `Content-Type` header)? Is file size capped before reading into memory?
+- **Path parameters** — could `req.params.filename` be `../../etc/passwd`? Normalize with `path.resolve` and verify it stays within the allowed base directory.
+- **Numeric IDs** — are they validated as integers to prevent NoSQL/ORM injection via object payloads?
+
+**Step 4 — Verify CORS Configuration**
+Check that `Access-Control-Allow-Origin` is not `*` for authenticated endpoints. Verify origins are defined per-environment (development allows localhost, production allows only the production domain). Check credentials handling — `credentials: true` must never be paired with `origin: '*'`. Verify preflight caching (`Access-Control-Max-Age`) is set to reduce OPTIONS request overhead without being too long.
+
+**Step 5 — Generate CSP Policy**
+Build a Content Security Policy tailored to the application's actual resource origins. Use `script-src 'nonce-{random}'` for inline scripts rather than `'unsafe-inline'`. Generate nonces server-side per request. Define `connect-src` to only allow the actual API and WebSocket origins. Add `upgrade-insecure-requests` for HTTPS-only deployments.
+
+**Step 6 — Emit Security Headers Middleware**
+Produce a complete security headers middleware file. Include: HSTS with preload, X-Content-Type-Options, X-Frame-Options, Referrer-Policy (strict-origin-when-cross-origin), and Permissions-Policy to restrict camera/mic/geolocation access. Output the middleware as a ready-to-paste file for the detected framework.
+
+#### Example
+
+```typescript
+// EXPRESS: complete security headers middleware
+// File to create: src/middleware/security-headers.ts
+
+import { Request, Response, NextFunction } from 'express'
+import crypto from 'crypto'
+
+export function securityHeaders(req: Request, res: Response, next: NextFunction) {
+  const nonce = crypto.randomBytes(16).toString('base64')
+  res.locals.cspNonce = nonce
+
+  res.setHeader('Strict-Transport-Security', 'max-age=63072000; includeSubDomains; preload')
+  res.setHeader('X-Content-Type-Options', 'nosniff')
+  res.setHeader('X-Frame-Options', 'DENY')
+  res.setHeader('Referrer-Policy', 'strict-origin-when-cross-origin')
+  res.setHeader('Permissions-Policy', 'camera=(), microphone=(), geolocation=()')
+  res.setHeader(
+    'Content-Security-Policy',
+    [
+      `script-src 'nonce-${nonce}' 'strict-dynamic'`,
+      "style-src 'self' https://fonts.googleapis.com",
+      "font-src 'self' https://fonts.gstatic.com",
+      "connect-src 'self' wss://api.yourdomain.com",
+      "img-src 'self' data: https:",
+      "frame-ancestors 'none'",
+      'upgrade-insecure-requests',
+    ].join('; ')
+  )
+  next()
+}
+
+// RATE LIMITING: Redis-backed sliding window (express-rate-limit + ioredis)
+import rateLimit from 'express-rate-limit'
+import RedisStore from 'rate-limit-redis'
+import Redis from 'ioredis'
+
+const redis = new Redis(process.env.REDIS_URL)
+
+// Tight limit on auth endpoints — brute force prevention
+export const authRateLimit = rateLimit({
+  windowMs: 15 * 60 * 1000,  // 15 minutes
+  max: 10,                     // 10 attempts per window
+  standardHeaders: 'draft-7',
+  legacyHeaders: false,
+  store: new RedisStore({ sendCommand: (...args) => redis.call(...args) }),
+  message: { error: 'Too many attempts, please try again later' },
+})
+
+// General API limit — per-user sliding window
+export const apiRateLimit = rateLimit({
+  windowMs: 60 * 1000,   // 1 minute
+  max: 100,              // 100 req/min per IP
+  keyGenerator: (req) => req.user?.id ?? req.ip,  // per-user when authenticated
+  store: new RedisStore({ sendCommand: (...args) => redis.call(...args) }),
+})
+
+// INPUT: path traversal prevention for file name parameters
+import path from 'path'
+
+function safeFilePath(baseDir: string, userFilename: string): string {
+  const normalized = path.resolve(baseDir, userFilename)
+  if (!normalized.startsWith(path.resolve(baseDir))) {
+    throw new ForbiddenError('Path traversal attempt detected')
+  }
+  return normalized
+}
+
+// CORS: environment-aware origin allowlist
+const CORS_ORIGINS: Record<string, string[]> = {
+  production:  ['https://app.yourdomain.com'],
+  staging:     ['https://staging.yourdomain.com'],
+  development: ['http://localhost:3000', 'http://localhost:5173'],
+}
+
+export const corsOptions = {
+  origin: (origin: string | undefined, cb: Function) => {
+    const allowed = CORS_ORIGINS[process.env.NODE_ENV ?? 'development']
+    if (!origin || allowed.includes(origin)) return cb(null, true)
+    cb(new Error('Not allowed by CORS'))
+  },
+  credentials: true,
+  maxAge: 600,  // cache preflight for 10 minutes
+}
+```
+
+```typescript
+// NEXT.JS: security headers in next.config.ts
+const securityHeaders = [
+  { key: 'X-DNS-Prefetch-Control', value: 'on' },
+  { key: 'Strict-Transport-Security', value: 'max-age=63072000; includeSubDomains; preload' },
+  { key: 'X-Frame-Options', value: 'DENY' },
+  { key: 'X-Content-Type-Options', value: 'nosniff' },
+  { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+  { key: 'Permissions-Policy', value: 'camera=(), microphone=(), geolocation=()' },
+]
+
+export default {
+  async headers() {
+    return [{ source: '/(.*)', headers: securityHeaders }]
+  },
+}
+```

package/extensions/security/skills/compliance.md

@@ -1,68 +1,68 @@
----
-name: "compliance"
-pack: "@rune/security"
-description: "Compliance checking — identify applicable standards (SOC 2, GDPR, HIPAA, PCI-DSS v4.0), map requirements to code patterns, perform gap analysis, automate evidence collection, and generate audit-ready evidence packages."
-model: opus
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# compliance
-
-Compliance checking — identify applicable standards (SOC 2, GDPR, HIPAA, PCI-DSS v4.0), map requirements to code patterns, perform gap analysis, automate evidence collection, and generate audit-ready evidence packages.
-
-#### Workflow
-
-**Step 1 — Identify Applicable Standards**
-Read project README, data model, and infrastructure config to determine which standards apply: does the app handle health data (HIPAA), payment card data (PCI-DSS v4.0), EU personal data (GDPR 2016/679), or serve enterprise customers (SOC 2 Type II)? Output a compliance scope document before analysis. Reference standard versions explicitly to prevent stale guidance.
-
-**Step 2 — Map Requirements to Code**
-Use Grep to locate data retention logic, consent flows, access logging, encryption at rest/transit, and data deletion endpoints. Cross-reference each requirement against actual implementation. For each gap, record: requirement (with section number), current state, risk level, and remediation effort estimate.
-
-**Step 3 — Generate Audit Trail**
-Use Read to verify logging coverage on sensitive operations (login, data export, admin actions, PII access). Confirm logs are tamper-evident, include actor identity and timestamp, and are retained for required duration. Emit a structured compliance report suitable for auditor review.
-
-**Step 4 — Automated Evidence Collection**
-For SOC 2 / PCI-DSS audits: automate evidence gathering rather than manual screenshots. Export access logs covering the audit period. Generate a cryptographically signed summary of security controls in place (encryption algorithms, TLS versions, auth mechanisms). For PCI-DSS v4.0 specifically: document Targeted Risk Analysis (TRA) for each customized approach control, verify MFA is enforced on ALL access to the cardholder data environment (not just admin accounts — PCI v4.0 requires it universally), and document compensating controls where requirements cannot be met natively.
-
-**Step 5 — Gap Report and Remediation Roadmap**
-For each compliance gap: assign severity (blocker for certification vs. advisory), estimated remediation effort (hours), and owner. Output a prioritized remediation roadmap with estimated time-to-compliance.
-
-#### Example
-
-```typescript
-// PATTERN: GDPR-compliant audit trail for PII access
-interface AuditEvent {
-  eventId:    string      // UUID, immutable
-  actor:      string      // userId or serviceAccount
-  action:     string      // 'READ_PII' | 'EXPORT_DATA' | 'DELETE_USER'
-  resource:   string      // 'users/{id}'
-  timestamp:  string      // ISO 8601 UTC
-  ip:         string      // requestor IP for breach tracing
-  outcome:    'SUCCESS' | 'DENIED'
-}
-
-// Log to append-only store — never DELETE or UPDATE audit rows
-async function logAuditEvent(event: AuditEvent): Promise<void> {
-  await db.auditLog.create({ data: event })
-  // Also emit to SIEM (Splunk, Datadog) for real-time alerting
-}
-
-// PATTERN: PCI-DSS v4.0 — MFA enforcement check at login
-// Verify ALL users (not just admin) are challenged with MFA
-// Gap example: MFA only on /admin routes → FAIL for PCI v4.0 Req 8.4.2
-async function authenticateUser(credentials: LoginDto): Promise<AuthResult> {
-  const user = await verifyPassword(credentials)
-  // PCI v4.0 Req 8.4.2: MFA required for ALL interactive logins to CDE
-  const mfaRequired = isInCDE(user) // must be true for any CDE-touching user
-  if (mfaRequired && !credentials.mfaToken) {
-    throw new UnauthorizedError('MFA required')
-  }
-  return issueSession(user)
-}
-
-// EVIDENCE COLLECTION: export access log summary for SOC 2 auditor
-// bash: aws cloudtrail lookup-events \
-//   --start-time $(date -d '90 days ago' +%s) \
-//   --query 'Events[*].{Time:EventTime,User:Username,Action:EventName}' \
-//   --output json > soc2-evidence-access-log.json
-```
+---
+name: "compliance"
+pack: "@rune/security"
+description: "Compliance checking — identify applicable standards (SOC 2, GDPR, HIPAA, PCI-DSS v4.0), map requirements to code patterns, perform gap analysis, automate evidence collection, and generate audit-ready evidence packages."
+model: opus
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# compliance
+
+Compliance checking — identify applicable standards (SOC 2, GDPR, HIPAA, PCI-DSS v4.0), map requirements to code patterns, perform gap analysis, automate evidence collection, and generate audit-ready evidence packages.
+
+#### Workflow
+
+**Step 1 — Identify Applicable Standards**
+Read project README, data model, and infrastructure config to determine which standards apply: does the app handle health data (HIPAA), payment card data (PCI-DSS v4.0), EU personal data (GDPR 2016/679), or serve enterprise customers (SOC 2 Type II)? Output a compliance scope document before analysis. Reference standard versions explicitly to prevent stale guidance.
+
+**Step 2 — Map Requirements to Code**
+Use Grep to locate data retention logic, consent flows, access logging, encryption at rest/transit, and data deletion endpoints. Cross-reference each requirement against actual implementation. For each gap, record: requirement (with section number), current state, risk level, and remediation effort estimate.
+
+**Step 3 — Generate Audit Trail**
+Use Read to verify logging coverage on sensitive operations (login, data export, admin actions, PII access). Confirm logs are tamper-evident, include actor identity and timestamp, and are retained for required duration. Emit a structured compliance report suitable for auditor review.
+
+**Step 4 — Automated Evidence Collection**
+For SOC 2 / PCI-DSS audits: automate evidence gathering rather than manual screenshots. Export access logs covering the audit period. Generate a cryptographically signed summary of security controls in place (encryption algorithms, TLS versions, auth mechanisms). For PCI-DSS v4.0 specifically: document Targeted Risk Analysis (TRA) for each customized approach control, verify MFA is enforced on ALL access to the cardholder data environment (not just admin accounts — PCI v4.0 requires it universally), and document compensating controls where requirements cannot be met natively.
+
+**Step 5 — Gap Report and Remediation Roadmap**
+For each compliance gap: assign severity (blocker for certification vs. advisory), estimated remediation effort (hours), and owner. Output a prioritized remediation roadmap with estimated time-to-compliance.
+
+#### Example
+
+```typescript
+// PATTERN: GDPR-compliant audit trail for PII access
+interface AuditEvent {
+  eventId:    string      // UUID, immutable
+  actor:      string      // userId or serviceAccount
+  action:     string      // 'READ_PII' | 'EXPORT_DATA' | 'DELETE_USER'
+  resource:   string      // 'users/{id}'
+  timestamp:  string      // ISO 8601 UTC
+  ip:         string      // requestor IP for breach tracing
+  outcome:    'SUCCESS' | 'DENIED'
+}
+
+// Log to append-only store — never DELETE or UPDATE audit rows
+async function logAuditEvent(event: AuditEvent): Promise<void> {
+  await db.auditLog.create({ data: event })
+  // Also emit to SIEM (Splunk, Datadog) for real-time alerting
+}
+
+// PATTERN: PCI-DSS v4.0 — MFA enforcement check at login
+// Verify ALL users (not just admin) are challenged with MFA
+// Gap example: MFA only on /admin routes → FAIL for PCI v4.0 Req 8.4.2
+async function authenticateUser(credentials: LoginDto): Promise<AuthResult> {
+  const user = await verifyPassword(credentials)
+  // PCI v4.0 Req 8.4.2: MFA required for ALL interactive logins to CDE
+  const mfaRequired = isInCDE(user) // must be true for any CDE-touching user
+  if (mfaRequired && !credentials.mfaToken) {
+    throw new UnauthorizedError('MFA required')
+  }
+  return issueSession(user)
+}
+
+// EVIDENCE COLLECTION: export access log summary for SOC 2 auditor
+// bash: aws cloudtrail lookup-events \
+//   --start-time $(date -d '90 days ago' +%s) \
+//   --query 'Events[*].{Time:EventTime,User:Username,Action:EventName}' \
+//   --output json > soc2-evidence-access-log.json
+```

package/extensions/security/skills/owasp-audit.md

@@ -1,64 +1,64 @@
----
-name: "owasp-audit"
-pack: "@rune/security"
-description: "Deep OWASP Top 10 (2021) + API Security Top 10 (2023) audit — manual code review of authentication flows, session management, access control logic, cryptographic patterns, and CI/CD pipeline security. Produces exploitability-rated findings."
-model: opus
-tools: [Read, Edit, Write, Grep, Glob, Bash]
----
-
-# owasp-audit
-
-Deep OWASP Top 10 (2021) + API Security Top 10 (2023) audit — goes beyond sentinel's automated checks with manual code review of authentication flows, session management, access control logic, cryptographic patterns, and CI/CD pipeline security. Produces exploitability-rated findings.
-
-#### Workflow
-
-**Step 1 — Threat Model**
-Use Read to load entry points (routes, controllers, middleware). Map which OWASP categories apply to this codebase (A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A07 Auth Failures, A08 Software and Data Integrity Failures). Build a risk matrix before touching any code. Tag each route with applicable threat categories.
-
-**Step 2 — Manual Code Review (OWASP Web Top 10)**
-Use Grep to locate auth middleware, session setup, role checks, and crypto calls. Read each file. Manually verify: Are authorization checks applied consistently? Are sessions invalidated on logout? Are crypto primitives current (no MD5/SHA1 for passwords)? Check deserialization endpoints for A08 — untrusted data deserialized without type constraints is a critical integrity failure.
-
-**Step 3 — CI/CD Pipeline Security Check**
-Audit GitHub Actions / GitLab CI / Bitbucket Pipelines yaml files. Check for: expression injection in `run:` steps using untrusted `${{ github.event.* }}` context, env variables printed in logs, third-party actions pinned to mutable tags (use SHA pins), overly broad `permissions:` blocks, secrets exposed via `env:` at workflow level instead of step level.
-
-**Step 4 — OWASP API Security Top 10 (2023)**
-Specifically check:
-- **API1:2023 BOLA** — does every object-level endpoint verify the requesting user owns/has permission for that specific resource ID?
-- **API2:2023 Broken Authentication** — are API keys rotatable? Are JWTs validated (signature, expiry, audience claim)?
-- **API5:2023 Broken Function Level Authorization** — are admin/internal API functions gated by role, not just authentication? Can a regular user reach `/admin/*` or `/internal/*` endpoints by guessing paths?
-- **A08:2021 Integrity Failures** — are deserialized payloads schema-validated before use? Are CI/CD pipelines pulling unverified artifacts?
-
-**Step 5 — Verify Exploitability and Report**
-For each finding, confirm it is reachable from an unauthenticated or low-privilege context. Rate severity (CRITICAL/HIGH/MEDIUM/LOW). Emit a structured report with file:line references and concrete remediation steps.
-
-#### Example
-
-```typescript
-// FINDING: API1:2023 BOLA — missing object-level ownership check
-// File: src/routes/documents.ts, Line: 28
-
-// VULNERABLE: fetches document by ID without verifying ownership
-router.get('/documents/:id', requireAuth, async (req, res) => {
-  const doc = await db.documents.findById(req.params.id) // any user can fetch any doc
-  res.json(doc)
-})
-
-// REMEDIATION: filter by both id AND authenticated user
-router.get('/documents/:id', requireAuth, async (req, res) => {
-  const doc = await db.documents.findOne({
-    id: req.params.id,
-    ownerId: req.user.id,  // enforces ownership at query level
-  })
-  if (!doc) return res.status(404).json({ error: 'Not found' })
-  res.json(doc)
-})
-
-// FINDING: CI/CD injection — GitHub Actions workflow
-// File: .github/workflows/pr-check.yml, Line: 14
-// VULNERABLE: untrusted PR title interpolated directly into run: step
-//   run: echo "PR: ${{ github.event.pull_request.title }}"
-// REMEDIATION: assign to env var first — GitHub sanitizes env var expansion
-//   env:
-//     PR_TITLE: ${{ github.event.pull_request.title }}
-//   run: echo "PR: $PR_TITLE"
-```
+---
+name: "owasp-audit"
+pack: "@rune/security"
+description: "Deep OWASP Top 10 (2021) + API Security Top 10 (2023) audit — manual code review of authentication flows, session management, access control logic, cryptographic patterns, and CI/CD pipeline security. Produces exploitability-rated findings."
+model: opus
+tools: [Read, Edit, Write, Grep, Glob, Bash]
+---
+
+# owasp-audit
+
+Deep OWASP Top 10 (2021) + API Security Top 10 (2023) audit — goes beyond sentinel's automated checks with manual code review of authentication flows, session management, access control logic, cryptographic patterns, and CI/CD pipeline security. Produces exploitability-rated findings.
+
+#### Workflow
+
+**Step 1 — Threat Model**
+Use Read to load entry points (routes, controllers, middleware). Map which OWASP categories apply to this codebase (A01 Broken Access Control, A02 Cryptographic Failures, A03 Injection, A07 Auth Failures, A08 Software and Data Integrity Failures). Build a risk matrix before touching any code. Tag each route with applicable threat categories.
+
+**Step 2 — Manual Code Review (OWASP Web Top 10)**
+Use Grep to locate auth middleware, session setup, role checks, and crypto calls. Read each file. Manually verify: Are authorization checks applied consistently? Are sessions invalidated on logout? Are crypto primitives current (no MD5/SHA1 for passwords)? Check deserialization endpoints for A08 — untrusted data deserialized without type constraints is a critical integrity failure.
+
+**Step 3 — CI/CD Pipeline Security Check**
+Audit GitHub Actions / GitLab CI / Bitbucket Pipelines yaml files. Check for: expression injection in `run:` steps using untrusted `${{ github.event.* }}` context, env variables printed in logs, third-party actions pinned to mutable tags (use SHA pins), overly broad `permissions:` blocks, secrets exposed via `env:` at workflow level instead of step level.
+
+**Step 4 — OWASP API Security Top 10 (2023)**
+Specifically check:
+- **API1:2023 BOLA** — does every object-level endpoint verify the requesting user owns/has permission for that specific resource ID?
+- **API2:2023 Broken Authentication** — are API keys rotatable? Are JWTs validated (signature, expiry, audience claim)?
+- **API5:2023 Broken Function Level Authorization** — are admin/internal API functions gated by role, not just authentication? Can a regular user reach `/admin/*` or `/internal/*` endpoints by guessing paths?
+- **A08:2021 Integrity Failures** — are deserialized payloads schema-validated before use? Are CI/CD pipelines pulling unverified artifacts?
+
+**Step 5 — Verify Exploitability and Report**
+For each finding, confirm it is reachable from an unauthenticated or low-privilege context. Rate severity (CRITICAL/HIGH/MEDIUM/LOW). Emit a structured report with file:line references and concrete remediation steps.
+
+#### Example
+
+```typescript
+// FINDING: API1:2023 BOLA — missing object-level ownership check
+// File: src/routes/documents.ts, Line: 28
+
+// VULNERABLE: fetches document by ID without verifying ownership
+router.get('/documents/:id', requireAuth, async (req, res) => {
+  const doc = await db.documents.findById(req.params.id) // any user can fetch any doc
+  res.json(doc)
+})
+
+// REMEDIATION: filter by both id AND authenticated user
+router.get('/documents/:id', requireAuth, async (req, res) => {
+  const doc = await db.documents.findOne({
+    id: req.params.id,
+    ownerId: req.user.id,  // enforces ownership at query level
+  })
+  if (!doc) return res.status(404).json({ error: 'Not found' })
+  res.json(doc)
+})
+
+// FINDING: CI/CD injection — GitHub Actions workflow
+// File: .github/workflows/pr-check.yml, Line: 14
+// VULNERABLE: untrusted PR title interpolated directly into run: step
+//   run: echo "PR: ${{ github.event.pull_request.title }}"
+// REMEDIATION: assign to env var first — GitHub sanitizes env var expansion
+//   env:
+//     PR_TITLE: ${{ github.event.pull_request.title }}
+//   run: echo "PR: $PR_TITLE"
+```