@sylix/coworker 2.0.11 → 2.0.12

package/dist/skills/defaults/security/security.md

@@ -0,0 +1,313 @@
+---
+name: security
+description: Implement application security with authentication, authorization, input validation, and common vulnerability prevention.
+---
+
+# Application Security — CoWorker Edition
+
+Build secure applications by default.
+
+## When to Use This Skill
+
+- Implementing authentication
+- Setting up authorization
+- Securing APIs
+- Preventing common vulnerabilities
+- Handling sensitive data
+
+## Core Concepts
+
+### 1. Authentication
+
+```typescript
+// JWT implementation
+import jwt from 'jsonwebtoken';
+import bcrypt from 'bcrypt';
+
+const JWT_SECRET = process.env.JWT_SECRET!;
+const JWT_EXPIRY = '7d';
+
+interface TokenPayload {
+  userId: string;
+  email: string;
+  roles: string[];
+}
+
+function generateToken(user: User): string {
+  const payload: TokenPayload = {
+    userId: user.id,
+    email: user.email,
+    roles: user.roles
+  };
+  
+  return jwt.sign(payload, JWT_SECRET, {
+    expiresIn: JWT_EXPIRY,
+    issuer: 'coworker-app'
+  });
+}
+
+function verifyToken(token: string): TokenPayload {
+  return jwt.verify(token, JWT_SECRET, {
+    issuer: 'coworker-app'
+  }) as TokenPayload;
+}
+
+// Password hashing
+async function hashPassword(password: string): Promise<string> {
+  return bcrypt.hash(password, 12);
+}
+
+async function verifyPassword(password: string, hash: string): Promise<boolean> {
+  return bcrypt.compare(password, hash);
+}
+```
+
+### 2. Authorization (RBAC)
+
+```typescript
+// Role definitions
+enum Role {
+  ADMIN = 'admin',
+  USER = 'user',
+  GUEST = 'guest'
+}
+
+// Permission system
+enum Permission {
+  READ_USERS = 'read:users',
+  WRITE_USERS = 'write:users',
+  READ_ORDERS = 'read:orders',
+  WRITE_ORDERS = 'write:orders',
+  ADMIN_ALL = 'admin:all'
+}
+
+const rolePermissions: Record<Role, Permission[]> = {
+  [Role.ADMIN]: Object.values(Permission),
+  [Role.USER]: [
+    Permission.READ_USERS,
+    Permission.READ_ORDERS,
+    Permission.WRITE_ORDERS
+  ],
+  [Role.GUEST]: [
+    Permission.READ_ORDERS
+  ]
+};
+
+// Middleware
+function authorize(...requiredPermissions: Permission[]) {
+  return (req: AuthenticatedRequest, res: Response, next: NextFunction) => {
+    const user = req.user;
+    
+    if (!user) {
+      return res.status(401).json({ error: 'Unauthorized' });
+    }
+    
+    const userPermissions = rolePermissions[user.role as Role] || [];
+    
+    const hasPermission = requiredPermissions.every(
+      perm => userPermissions.includes(perm)
+    );
+    
+    if (!hasPermission) {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+    
+    next();
+  };
+}
+
+// Usage
+router.get('/users',
+  authenticate,
+  authorize(Permission.READ_USERS),
+  getUsers
+);
+```
+
+### 3. Input Validation
+
+```typescript
+import { z } from 'zod';
+
+// Validate API inputs
+const CreateUserSchema = z.object({
+  email: z.string().email(),
+  password: z.string().min(8).max(100),
+  name: z.string().min(1).max(100),
+  age: z.number().int().positive().optional()
+});
+
+function validateCreateUser(data: unknown): CreateUserInput {
+  return CreateUserSchema.parse(data);
+}
+
+// SQL injection prevention - use parameterized queries
+async function getUserByEmail(email: string): Promise<User | null> {
+  // GOOD: Parameterized query
+  const result = await db.query(
+    'SELECT * FROM users WHERE email = $1',
+    [email]
+  );
+  
+  // BAD: String interpolation (never do this!)
+  // const result = await db.query(
+  //   `SELECT * FROM users WHERE email = '${email}'`
+  // );
+  
+  return result.rows[0] || null;
+}
+```
+
+### 4. Rate Limiting
+
+```typescript
+import rateLimit from 'express-rate-limit';
+import RedisStore from 'rate-limit-redis';
+
+const generalLimiter = rateLimit({
+  windowMs: 15 * 60 * 1000, // 15 minutes
+  max: 100, // limit each IP to 100 requests per windowMs
+  message: { error: 'Too many requests' },
+  standardHeaders: true,
+  legacyHeaders: false
+});
+
+const authLimiter = rateLimit({
+  windowMs: 60 * 60 * 1000, // 1 hour
+  max: 5, // 5 login attempts per hour
+  skipSuccessfulRequests: true
+});
+
+const apiLimiter = rateLimit({
+  store: new RedisStore({
+    prefix: 'rl:api:',
+    client: redis
+  }),
+  windowMs: 60 * 1000, // 1 minute
+  max: 60
+});
+
+app.use('/api', apiLimiter);
+app.use('/auth/login', authLimiter);
+```
+
+### 5. Security Headers
+
+```typescript
+import helmet from 'helmet';
+
+app.use(helmet());
+
+// Custom configuration
+app.use(helmet.contentSecurityPolicy({
+  directives: {
+    defaultSrc: ["'self'"],
+    scriptSrc: ["'self'", "'unsafe-inline'"],
+    styleSrc: ["'self'", "'unsafe-inline'"],
+    imgSrc: ["'self'", 'data:', 'https:'],
+    connectSrc: ["'self'", 'https://api.example.com'],
+    fontSrc: ["'self'"],
+    objectSrc: ["'none'"],
+    mediaSrc: ["'self'"],
+    frameSrc: ["'none'"]
+  }
+}));
+
+app.use(helmet.hsts({
+  maxAge: 31536000,
+  includeSubDomains: true,
+  preload: true
+}));
+```
+
+### 6. Secure API Design
+
+```typescript
+// Input sanitization
+import DOMPurify from 'isomorphic-dompurify';
+
+function sanitizeInput(input: string): string {
+  return DOMPurify.sanitize(input, {
+    ALLOWED_TAGS: [],
+    ALLOWED_ATTR: []
+  });
+}
+
+// Command injection prevention
+import { execFile } from 'child_process';
+
+async function getFileInfo(filename: string): Promise<string> {
+  // GOOD: Use execFile instead of exec
+  return new Promise((resolve, reject) => {
+    execFile('stat', [filename], (error, stdout) => {
+      if (error) reject(error);
+      else resolve(stdout);
+    });
+  });
+  
+  // BAD: Never use exec with user input
+  // exec(`stat ${filename}`);
+}
+
+// CORS configuration
+import cors from 'cors';
+
+app.use(cors({
+  origin: process.env.ALLOWED_ORIGINS?.split(',') || [],
+  credentials: true,
+  methods: ['GET', 'POST', 'PUT', 'DELETE'],
+  allowedHeaders: ['Content-Type', 'Authorization']
+}));
+```
+
+### 7. Secrets Management
+
+```typescript
+// Environment validation
+import { z } from 'zod';
+
+const envSchema = z.object({
+  DATABASE_URL: z.string().url(),
+  JWT_SECRET: z.string().min(32),
+  REDIS_URL: z.string().url(),
+  AWS_ACCESS_KEY_ID: z.string().min(16),
+  AWS_SECRET_ACCESS_KEY: z.string().min(30),
+  ENCRYPTION_KEY: z.string().length(32)
+});
+
+function loadEnv() {
+  const result = envSchema.safeParse(process.env);
+  
+  if (!result.success) {
+    console.error('Invalid environment:', result.error.flatten());
+    process.exit(1);
+  }
+  
+  return result.data;
+}
+
+const env = loadEnv();
+```
+
+## Best Practices
+
+1. **Defense in depth** - Multiple security layers
+2. **Least privilege** - Minimal permissions
+3. **Input validation** - Validate all inputs
+4. **Parameterized queries** - Prevent SQL injection
+5. **HTTPS only** - Always use TLS
+6. **Secret management** - Never commit secrets
+7. **Rate limiting** - Prevent abuse
+8. **Security headers** - Use helmet
+9. **Audit logging** - Track security events
+
+## Common Vulnerabilities
+
+- SQL Injection
+- XSS (Cross-Site Scripting)
+- CSRF
+- Command Injection
+- Path Traversal
+- Insecure Dependencies
+- Weak Authentication
+- Information Disclosure

package/dist/skills/defaults/security/stride-analysis.md

@@ -0,0 +1,273 @@
+---
+name: stride-analysis-patterns
+description: Apply STRIDE methodology to systematically identify threats. Use when analyzing system security, conducting threat modeling sessions, or creating security documentation.
+---
+
+# STRIDE Analysis Patterns
+
+Systematic threat identification using the STRIDE methodology.
+
+## When to Use This Skill
+
+- Starting new threat modeling sessions
+- Analyzing existing system architecture
+- Reviewing security design decisions
+- Creating threat documentation
+- Training teams on threat identification
+- Compliance and audit preparation
+
+## Core Concepts
+
+### 1. STRIDE Categories
+
+```
+S - Spoofing       → Authentication threats
+T - Tampering      → Integrity threats
+R - Repudiation    → Non-repudiation threats
+I - Information    → Confidentiality threats
+    Disclosure
+D - Denial of      → Availability threats
+    Service
+E - Elevation of   → Authorization threats
+    Privilege
+```
+
+### 2. Threat Analysis Matrix
+
+| Category            | Question                                  | Control Family |
+| ------------------- | ----------------------------------------- | -------------- |
+| **Spoofing**        | Can attacker pretend to be someone else?  | Authentication |
+| **Tampering**       | Can attacker modify data in transit/rest? | Integrity      |
+| **Repudiation**     | Can attacker deny actions?                | Logging/Audit  |
+| **Info Disclosure** | Can attacker access unauthorized data?    | Encryption     |
+| **DoS**             | Can attacker disrupt availability?        | Rate limiting  |
+| **Elevation**       | Can attacker gain higher privileges?      | Authorization  |
+
+## Templates
+
+### Template 1: STRIDE Threat Model Document
+
+```markdown
+# Threat Model: [System Name]
+
+## 1. System Overview
+
+### 1.1 Description
+
+[Brief description of the system and its purpose]
+
+### 1.2 Data Flow Diagram
+
+[User] --> [Web App] --> [API Gateway] --> [Backend Services]
+|
+v
+[Database]
+
+### 1.3 Trust Boundaries
+- **External Boundary**: Internet to DMZ
+- **Internal Boundary**: DMZ to Internal Network
+- **Data Boundary**: Application to Database
+```
+
+### Template 2: STRIDE Analysis Code
+
+```python
+from dataclasses import dataclass, field
+from enum import Enum
+from typing import List, Dict
+
+class StrideCategory(Enum):
+    SPOOFING = "S"
+    TAMPERING = "T"
+    REPUDIATION = "R"
+    INFORMATION_DISCLOSURE = "I"
+    DENIAL_OF_SERVICE = "D"
+    ELEVATION_OF_PRIVILEGE = "E"
+
+
+class Impact(Enum):
+    LOW = 1
+    MEDIUM = 2
+    HIGH = 3
+    CRITICAL = 4
+
+
+class Likelihood(Enum):
+    LOW = 1
+    MEDIUM = 2
+    HIGH = 3
+    CRITICAL = 4
+
+
+@dataclass
+class Threat:
+    id: str
+    category: StrideCategory
+    title: str
+    description: str
+    target: str
+    impact: Impact
+    likelihood: Likelihood
+    mitigations: List[str] = field(default_factory=list)
+    status: str = "open"
+
+    @property
+    def risk_score(self) -> int:
+        return self.impact.value * self.likelihood.value
+
+    @property
+    def risk_level(self) -> str:
+        score = self.risk_score
+        if score >= 12:
+            return "Critical"
+        elif score >= 6:
+            return "High"
+        elif score >= 3:
+            return "Medium"
+        return "Low"
+
+
+@dataclass
+class Asset:
+    name: str
+    sensitivity: str
+    description: str
+
+
+@dataclass
+class ThreatModel:
+    name: str
+    version: str
+    description: str
+    assets: List[Asset] = field(default_factory=list)
+    threats: List[Threat] = field(default_factory=list)
+
+    def add_threat(self, threat: Threat) -> None:
+        self.threats.append(threat)
+
+    def get_threats_by_category(self, category: StrideCategory) -> List[Threat]:
+        return [t for t in self.threats if t.category == category]
+
+    def get_critical_threats(self) -> List[Threat]:
+        return [t for t in self.threats if t.risk_level in ("Critical", "High")]
+
+    def generate_report(self) -> Dict:
+        return {
+            "summary": {
+                "name": self.name,
+                "total_threats": len(self.threats),
+                "critical_threats": len([t for t in self.threats if t.risk_level == "Critical"]),
+            },
+            "top_risks": [
+                {"id": t.id, "title": t.title, "risk_score": t.risk_score}
+                for t in sorted(self.threats, key=lambda x: x.risk_score, reverse=True)[:10]
+            ]
+        }
+```
+
+## Risk Assessment
+
+### Risk Matrix
+
+```
+              IMPACT
+          Low  Med  High Crit
+     Low   1    2    3    4
+
+L Med 2 4 6 8
+I High 3 6 9 12
+K Crit 4 8 12 16
+```
+
+### Prioritized Risks
+
+| Rank | Threat | Risk Score | Priority |
+|------|--------|------------|----------|
+| 1 | SQL Injection | 12 | Critical |
+| 2 | IDOR | 9 | High |
+| 3 | Credential Stuffing | 9 | High |
+| 4 | Data Breach | 8 | High |
+
+## STRIDE Questions by Category
+
+### Spoofing
+- Can an attacker impersonate a legitimate user?
+- Are authentication tokens properly validated?
+- Can session identifiers be predicted or stolen?
+
+### Tampering
+- Can data be modified in transit?
+- Can data be modified at rest?
+- Are input validation controls sufficient?
+
+### Repudiation
+- Are all security-relevant actions logged?
+- Can logs be tampered with?
+- Is there sufficient attribution for actions?
+
+### Information Disclosure
+- Is sensitive data encrypted at rest?
+- Is sensitive data encrypted in transit?
+- Can error messages reveal sensitive information?
+
+### Denial of Service
+- Are rate limits implemented?
+- Can resources be exhausted by malicious input?
+- Are there single points of failure?
+
+### Elevation of Privilege
+- Are authorization checks performed consistently?
+- Can users access other users' resources?
+- Is the principle of least privilege followed?
+
+## Common Mitigations
+
+### Spoofing
+- Implement multi-factor authentication
+- Use secure session management
+- Use cryptographically secure tokens
+
+### Tampering
+- Implement input validation
+- Use parameterized queries
+- Apply integrity checks (HMAC, signatures)
+
+### Repudiation
+- Enable comprehensive audit logging
+- Protect log integrity
+- Implement digital signatures
+
+### Information Disclosure
+- Encrypt data at rest and in transit
+- Implement proper access controls
+- Sanitize error messages
+
+### Denial of Service
+- Implement rate limiting
+- Use auto-scaling
+- Deploy DDoS protection
+
+### Elevation of Privilege
+- Implement proper authorization
+- Follow principle of least privilege
+- Validate permissions server-side
+
+## Best Practices
+
+### Do's
+
+- **Involve stakeholders** - Security, dev, and ops perspectives
+- **Be systematic** - Cover all STRIDE categories
+- **Prioritize realistically** - Focus on high-impact threats
+- **Update regularly** - Threat models are living documents
+
+### Don'ts
+
+- **Don't skip categories** - Each reveals different threats
+- **Don't assume security** - Question every component
+- **Don't work in isolation** - Collaborative modeling is better
+
+## Related Skills
+
+- `sast-configuration` - For automated security scanning
+- `security` - For general security practices