@xgent-ai/skills 0.3.0 → 0.4.0

package/skills/security-audit/references/secret-patterns.md

@@ -0,0 +1,178 @@
+# Secret & Credential Detection Patterns
+
+Load this file during Step 3 (Secrets & Exposure Scan).
+
+---
+
+## High-Confidence Secret Patterns
+
+These patterns almost always indicate a real secret:
+
+### API Keys & Tokens
+```regex
+# OpenAI
+sk-[a-zA-Z0-9]{48}
+
+# Anthropic
+sk-ant-[a-zA-Z0-9\-_]{90,}
+
+# AWS Access Key
+AKIA[0-9A-Z]{16}
+
+# AWS Secret Key (look for near AWS_ACCESS_KEY_ID assignment)
+[0-9a-zA-Z/+]{40}
+
+# GitHub Token
+gh[pousr]_[a-zA-Z0-9]{36,}
+github_pat_[a-zA-Z0-9]{82}
+
+# Stripe
+sk_live_[a-zA-Z0-9]{24,}
+rk_live_[a-zA-Z0-9]{24,}
+
+# Twilio Account SID
+AC[a-z0-9]{32}
+# Twilio API Key
+SK[a-z0-9]{32}
+
+# SendGrid
+SG\.[a-zA-Z0-9\-_.]{66}
+
+# Slack
+xoxb-[0-9]+-[0-9]+-[a-zA-Z0-9]+
+xoxp-[0-9]+-[0-9]+-[0-9]+-[a-zA-Z0-9]+
+xapp-[0-9]+-[A-Z0-9]+-[0-9]+-[a-zA-Z0-9]+
+
+# Google API Key
+AIza[0-9A-Za-z\-_]{35}
+
+# Google OAuth
+[0-9]+-[0-9A-Za-z_]{32}\.apps\.googleusercontent\.com
+
+# Cloudflare (near CF_API_TOKEN)
+[a-zA-Z0-9_\-]{37}
+
+# Mailgun
+key-[a-zA-Z0-9]{32}
+
+# Heroku
+[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}
+```
+
+### Private Keys
+```regex
+-----BEGIN (RSA |EC |OPENSSH |DSA |PGP )?PRIVATE KEY( BLOCK)?-----
+-----BEGIN CERTIFICATE-----
+```
+
+### Database Connection Strings
+```regex
+# MongoDB
+mongodb(\+srv)?:\/\/[^:]+:[^@]+@
+
+# PostgreSQL / MySQL
+(postgres|postgresql|mysql):\/\/[^:]+:[^@]+@
+
+# Redis with password
+redis:\/\/:[^@]+@
+
+# Generic connection string with password
+(connection[_-]?string|connstr|db[_-]?url).*password=
+```
+
+### Hardcoded Passwords (variable name signals)
+```regex
+# Variable names that suggest secrets
+(password|passwd|pwd|secret|api_key|apikey|auth_token|access_token|private_key)
+  \s*[=:]\s*["'][^"']{8,}["']
+```
+
+---
+
+## Entropy-Based Detection
+
+Apply to string literals > 20 characters in assignment context.
+High entropy (Shannon entropy > 4.5 bits/char) + length > 20 = likely secret.
+
+```
+Calculate entropy: -sum(p * log2(p)) for each character frequency p
+Threshold: > 4.5 bits/char AND > 20 chars AND assigned to a variable
+```
+
+Common false positives to exclude:
+- Lorem ipsum text
+- HTML/CSS content
+- Base64-encoded non-sensitive config (but flag and note)
+- UUID/GUID (entropy is high but format is recognizable)
+
+---
+
+## Files That Should Never Be Committed
+
+Flag if these files exist in the repo root or are tracked by git:
+```
+.env
+.env.local
+.env.production
+.env.staging
+*.pem
+*.key
+*.p12
+*.pfx
+id_rsa
+id_ed25519
+credentials.json
+service-account.json
+gcp-key.json
+secrets.yaml
+secrets.json
+config/secrets.yml
+```
+
+Also check `.gitignore` — if a secret file pattern is NOT in .gitignore, flag it.
+
+---
+
+## CI/CD & IaC Secret Risks
+
+### GitHub Actions — flag these patterns:
+```yaml
+# Hardcoded values in env: blocks (should use ${{ secrets.NAME }})
+env:
+  API_KEY: "actual-value-here"   # VULNERABLE
+
+# Printing secrets
+- run: echo ${{ secrets.MY_SECRET }}   # leaks to logs
+```
+
+### Docker — flag these:
+```dockerfile
+# Secrets in ENV (persisted in image layers)
+ENV AWS_SECRET_KEY=actual-value
+
+# Secrets passed as build args (visible in image history)
+ARG API_KEY=actual-value
+```
+
+### Terraform — flag these:
+```hcl
+# Hardcoded sensitive values (should use var or data source)
+password = "hardcoded-password"
+access_key = "AKIAIOSFODNN7EXAMPLE"
+```
+
+---
+
+## Safe Patterns (Do NOT flag)
+
+These are intentional placeholders — recognize and skip:
+```
+"your-api-key-here"
+"<YOUR_API_KEY>"
+"${API_KEY}"
+"${process.env.API_KEY}"
+"os.environ.get('API_KEY')"
+"REPLACE_WITH_YOUR_KEY"
+"xxx...xxx"
+"sk-..." (in documentation/comments)
+```

package/skills/security-audit/references/vuln-categories.md

@@ -0,0 +1,288 @@
+# Vulnerability Categories — Deep Reference
+
+This file contains detailed detection guidance for every vulnerability category.
+Load this during Step 4 of the scan workflow.
+
+---
+
+## 1. Injection Flaws
+
+### SQL Injection
+**What to look for:**
+- String concatenation or interpolation inside SQL queries
+- Raw `.query()`, `.execute()`, `.raw()` calls with variables
+- ORM `whereRaw()`, `selectRaw()`, `orderByRaw()` with user input
+- Second-order SQLi: data stored safely, then used unsafely later
+- Stored procedures called with unsanitized input
+
+**Detection signals (all languages):**
+```
+"SELECT ... " + variable
+`SELECT ... ${variable}`
+f"SELECT ... {variable}"
+"SELECT ... %s" % variable   # Only safe with proper driver parameterization
+cursor.execute("... " + input)
+db.raw(`... ${req.params.id}`)
+```
+
+**Safe patterns (parameterized):**
+```js
+db.query('SELECT * FROM users WHERE id = ?', [userId])
+User.findOne({ where: { id: userId } })  // ORM safe
+```
+
+**Escalation checkers:**
+- Is the query result ever used in another query? (second-order)
+- Is the table/column name user-controlled? (cannot be parameterized — must allowlist)
+
+---
+
+### Cross-Site Scripting (XSS)
+**What to look for:**
+- `innerHTML`, `outerHTML`, `document.write()` with user data
+- `dangerouslySetInnerHTML` in React
+- Template engines rendering unescaped: `{{{ var }}}` (Handlebars), `!= var` (Pug)
+- jQuery `.html()`, `.append()` with user data
+- `eval()`, `setTimeout(string)`, `setInterval(string)` with user data
+- DOM-based: `location.hash`, `document.referrer`, `window.name` written to DOM
+- Stored XSS: user input saved to DB, rendered without escaping later
+
+**Detection by framework:**
+- **React**: Safe by default EXCEPT `dangerouslySetInnerHTML`
+- **Angular**: Safe by default EXCEPT `bypassSecurityTrustHtml`
+- **Vue**: Safe by default EXCEPT `v-html`
+- **Vanilla JS**: Every DOM write is suspect
+
+**Safe patterns:**
+```js
+element.textContent = userInput                     // plain text, never parsed as HTML
+element.innerHTML = DOMPurify.sanitize(userInput)   // when HTML must be rendered
+```
+
+---
+
+### Command Injection
+**What to look for (Node.js):**
+```js
+exec(userInput)
+execSync(`ping ${host}`)
+spawn('sh', ['-c', userInput])
+child_process.exec('ls ' + dir)
+```
+
+**What to look for (Python):**
+```python
+os.system(user_input)
+subprocess.call(user_input, shell=True)
+eval(user_input)
+```
+
+**What to look for (PHP):**
+```php
+exec($input)
+system($_GET['cmd'])
+passthru($input)
+`$input`  # backtick operator
+```
+
+**Safe alternatives:** Use array form of spawn/subprocess without shell=True; use allowlists for commands.
+
+---
+
+### Server-Side Request Forgery (SSRF)
+**What to look for:**
+- HTTP requests where the URL is user-controlled
+- Webhooks, URL preview, image fetch features
+- PDF generators that fetch external URLs
+- Redirects to user-supplied URLs
+
+**High-risk targets:**
+- AWS metadata service: `169.254.169.254`
+- Internal services: `localhost`, `127.0.0.1`, `10.x.x.x`, `192.168.x.x`
+- Cloud metadata endpoints
+
+**Detection:**
+```js
+fetch(req.body.url)
+axios.get(userSuppliedUrl)
+http.get(params.webhook)
+```
+
+---
+
+## 2. Authentication & Access Control
+
+### Broken Object Level Authorization (BOLA / IDOR)
+**What to look for:**
+- Resource IDs taken directly from URL/params without ownership check
+- `findById(req.params.id)` without verifying `userId === currentUser.id`
+- Numeric sequential IDs (easily guessable)
+
+**Example vulnerable pattern:**
+```js
+// VULNERABLE: no ownership check
+app.get('/api/documents/:id', async (req, res) => {
+  const doc = await Document.findById(req.params.id);
+  res.json(doc);
+});
+
+// SAFE: verify ownership
+app.get('/api/documents/:id', async (req, res) => {
+  const doc = await Document.findOne({ _id: req.params.id, owner: req.user.id });
+  if (!doc) return res.status(403).json({ error: 'Forbidden' });
+  res.json(doc);
+});
+```
+
+---
+
+### JWT Vulnerabilities
+**What to look for:**
+- `alg: "none"` accepted
+- Weak or hardcoded secrets: `secret`, `password`, `1234`
+- No expiry (`exp` claim) validation
+- Algorithm confusion (RS256 → HS256 downgrade)
+- JWT stored in `localStorage` (XSS risk; prefer httpOnly cookie)
+
+**Detection:**
+```js
+jwt.verify(token, secret, { algorithms: ['HS256'] })  // Check algorithms array
+jwt.decode(token)  // WARNING: decode does NOT verify signature
+```
+
+---
+
+### Missing Authentication / Authorization
+**What to look for:**
+- Admin or sensitive endpoints missing auth middleware
+- Routes defined after `app.use(authMiddleware)` vs before it
+- Feature flags or debug endpoints left exposed in production
+- GraphQL resolvers missing auth checks at field level
+
+---
+
+### CSRF
+**What to look for:**
+- State-changing operations (POST/PUT/DELETE) without CSRF token
+- APIs relying only on cookies for auth without SameSite attribute
+- Missing `SameSite=Strict` or `SameSite=Lax` on session cookies
+
+---
+
+## 3. Secrets & Sensitive Data Exposure
+
+### In-Code Secrets
+Look for patterns like:
+```
+API_KEY = "sk-..."
+password = "hunter2"
+SECRET = "abc123"
+private_key = "-----BEGIN RSA PRIVATE KEY-----"
+aws_secret_access_key = "wJalrXUtn..."
+```
+
+Entropy heuristic: strings > 20 chars with high character variety in assignment context
+are likely secrets even if the variable name doesn't say so.
+
+### In Logs / Error Messages
+```js
+console.log('User password:', password)
+logger.info({ user, token })   // token shouldn't be logged
+res.status(500).json({ error: err.stack })  // stack traces expose internals
+```
+
+### Sensitive Data in API Responses
+- Returning full user object including `password_hash`, `ssn`, `credit_card`
+- Including internal IDs or system paths in error responses
+
+---
+
+## 4. Cryptography
+
+### Weak Algorithms
+| Algorithm | Issue | Replace With |
+|-----------|-------|--------------|
+| MD5 | Broken for security | SHA-256 or bcrypt (passwords) |
+| SHA-1 | Collision attacks | SHA-256 |
+| DES / 3DES | Weak key size | AES-256-GCM |
+| RC4 | Broken | AES-GCM |
+| ECB mode | No IV, patterns visible | GCM or CBC with random IV |
+
+### Weak Randomness
+```js
+// VULNERABLE
+Math.random()                    // not cryptographically secure
+Date.now()                       // predictable
+Math.random().toString(36)       // weak token generation
+
+// SAFE
+crypto.randomBytes(32)           // Node.js
+secrets.token_urlsafe(32)        // Python
+```
+
+### Password Hashing
+```python
+# VULNERABLE
+User(username=username, password=password).save()   # plaintext — no hash at all
+hashlib.md5(password.encode()).hexdigest()
+hashlib.sha256(password.encode()).hexdigest()
+
+# SAFE
+bcrypt.hashpw(password, bcrypt.gensalt(rounds=12))
+argon2.hash(password)
+```
+
+---
+
+## 5. Insecure Dependencies
+
+### What to flag:
+- Packages with known CVEs in installed version range
+- Packages abandoned > 2 years with no security updates
+- Packages with extremely broad permissions for their stated purpose
+- Transitive dependencies pulling in known-bad packages
+- Pinned versions that are significantly behind current (possible unpatched vulns)
+
+### High-risk package watchlist: see `references/vulnerable-packages.md`
+
+---
+
+## 6. Business Logic
+
+### Race Conditions (TOCTOU)
+```js
+// VULNERABLE: check then act without atomic lock
+const balance = await getBalance(userId);
+if (balance >= amount) {
+  await deductBalance(userId, amount);  // race condition between check and deduct
+}
+
+// SAFE: use atomic DB transaction or optimistic locking
+await db.transaction(async (trx) => {
+  const user = await User.query(trx).forUpdate().findById(userId);
+  if (user.balance < amount) throw new Error('Insufficient funds');
+  await user.$query(trx).patch({ balance: user.balance - amount });
+});
+```
+
+### Missing Rate Limiting
+Flag endpoints that:
+- Accept authentication credentials (login, 2FA)
+- Send emails or SMS
+- Perform expensive operations
+- Expose user enumeration (password reset, registration)
+
+---
+
+## 7. Path Traversal
+```python
+# VULNERABLE
+filename = request.args.get('file')
+with open(f'/var/uploads/{filename}') as f:  # ../../../../etc/passwd
+
+# SAFE
+filename = os.path.basename(request.args.get('file'))
+safe_path = os.path.join('/var/uploads', filename)
+if not safe_path.startswith('/var/uploads/'):
+    abort(400)
+```

package/skills/security-audit/references/vulnerable-packages.md

@@ -0,0 +1,111 @@
+# Vulnerable & High-Risk Package Watchlist
+
+Load this during Step 2 (Dependency Audit). Check versions in the project's lock files.
+
+---
+
+## npm / Node.js
+
+| Package | Vulnerable Versions | Issue | Safe Version |
+|---------|-------------------|-------|--------------|
+| lodash | < 4.17.21 | Prototype pollution (CVE-2021-23337) | >= 4.17.21 |
+| axios | < 1.6.0 | SSRF, open redirect | >= 1.6.0 |
+| jsonwebtoken | < 9.0.0 | Algorithm confusion bypass | >= 9.0.0 |
+| node-jose | < 2.2.0 | Key confusion | >= 2.2.0 |
+| shelljs | < 0.8.5 | ReDoS | >= 0.8.5 |
+| tar | < 6.1.9 | Path traversal | >= 6.1.9 |
+| minimist | < 1.2.6 | Prototype pollution | >= 1.2.6 |
+| qs | < 6.7.3 | Prototype pollution | >= 6.7.3 |
+| express | < 4.19.2 | Open redirect | >= 4.19.2 |
+| multer | < 1.4.4 | DoS | >= 1.4.4-lts.1 |
+| xml2js | < 0.5.0 | Prototype pollution | >= 0.5.0 |
+| fast-xml-parser | < 4.2.4 | ReDoS | >= 4.2.4 |
+| semver | < 7.5.2 | ReDoS | >= 7.5.2 |
+| tough-cookie | < 4.1.3 | Prototype pollution | >= 4.1.3 |
+| word-wrap | < 1.2.4 | ReDoS | >= 1.2.4 |
+| vm2 | ANY | Sandbox escape (deprecated) | Use isolated-vm instead |
+| serialize-javascript | < 3.1.0 | XSS | >= 3.1.0 |
+| node-fetch | < 2.6.7 | Open redirect | >= 2.6.7 or 3.x |
+
+### Patterns to flag (regardless of version):
+- `eval` or `vm.runInContext` in dependencies
+- Any package pulling in `node-gyp` native addons from unknown publishers
+- Packages with < 1000 weekly downloads but required in production code (supply chain risk)
+
+---
+
+## Python / pip
+
+| Package | Vulnerable Versions | Issue | Safe Version |
+|---------|-------------------|-------|--------------|
+| Pillow | < 10.0.1 | Multiple CVEs, buffer overflow | >= 10.0.1 |
+| cryptography | < 41.0.0 | OpenSSL vulnerabilities | >= 41.0.0 |
+| PyYAML | < 6.0 | Arbitrary code via yaml.load() | >= 6.0 |
+| paramiko | < 3.4.0 | Authentication bypass | >= 3.4.0 |
+| requests | < 2.31.0 | Proxy auth info leak | >= 2.31.0 |
+| urllib3 | < 2.0.7 | Header injection | >= 2.0.7 |
+| Django | < 4.2.16 | Various | >= 4.2.16 |
+| Flask | < 3.0.3 | Various | >= 3.0.3 |
+| Jinja2 | < 3.1.4 | HTML attribute injection | >= 3.1.4 |
+| sqlalchemy | < 2.0.28 | Various | >= 2.0.28 |
+| aiohttp | < 3.9.4 | SSRF, path traversal | >= 3.9.4 |
+| werkzeug | < 3.0.3 | Various | >= 3.0.3 |
+
+---
+
+## Java / Maven
+
+| Package | Vulnerable Versions | Issue |
+|---------|-------------------|-------|
+| log4j-core | 2.0-2.14.1 | Log4Shell RCE (CVE-2021-44228) — CRITICAL |
+| log4j-core | 2.15.0 | Incomplete fix — still vulnerable |
+| Spring Framework | < 5.3.28, < 6.0.13 | Various CVEs |
+| Spring Boot | < 3.1.4 | Various |
+| Jackson-databind | < 2.14.0 | Deserialization |
+| Apache Commons Text | < 1.10.0 | Text4Shell RCE (CVE-2022-42889) |
+| Apache Struts | < 6.3.0 | Various RCE |
+| Netty | < 4.1.94 | HTTP request smuggling |
+
+---
+
+## Ruby / Gems
+
+| Gem | Vulnerable Versions | Issue |
+|-----|-------------------|-------|
+| rails | < 7.1.3 | Various | 
+| nokogiri | < 1.16.2 | XXE, various |
+| rexml | < 3.2.7 | ReDoS |
+| rack | < 3.0.9 | Various |
+| devise | < 4.9.3 | Various |
+
+---
+
+## Rust / Cargo
+
+| Crate | Issue |
+|-------|-------|
+| openssl | Check advisory db for current version |
+| hyper | Check advisory db for current version |
+
+Reference: https://rustsec.org/advisories/
+
+---
+
+## Go
+
+Reference: https://pkg.go.dev/vuln/ and https://vuln.go.dev
+
+Common risky patterns:
+- `golang.org/x/crypto` — check if version is within 6 months of current
+- Any dependency using `syscall` package directly — review carefully
+
+---
+
+## General Red Flags (Any Ecosystem)
+
+Flag any dependency that:
+1. Has not been updated in > 2 years AND has > 10 open security issues
+2. Has been deprecated by its maintainer with a security advisory
+3. Is a fork of a known package from an unknown publisher (typosquatting)
+4. Has a name that's one character off from a popular package (e.g., `lodash` vs `1odash`)
+5. Was recently transferred to a new owner (check git history / npm transfer notices)