agent-bober 0.17.1 → 0.19.0

package/skills/bober.security-igaming/SKILL.md

@@ -0,0 +1,290 @@
+---
+name: bober.security-igaming
+description: "iGaming/betting backend security signature library. Not a workflow skill -- a data file of discrete vulnerable/safe code signature blocks read by SecuritySignatureParser. Covers TOCTOU balance double-spend, non-atomic settlement/idempotency, client-supplied odds trust, negative/zero stake, float money, missing webhook HMAC, seamless-wallet rollback abuse, non-CSPRNG outcomes, client-side outcome determination, client-side-only limits, bonus/wagering abuse, and settlement replay."
+---
+
+# bober.security-igaming — iGaming/Betting Backend Security Signature Library
+
+This skill is a **signature-library** file, not a workflow skill. It is read (as raw
+markdown text) by `SecuritySignatureParser.parse()`
+(`src/orchestrator/security-knowledge/parser.ts`) and turned into typed
+`SecuritySignature[]` records used by the security-audit agent team. Do not confuse this
+with `bober.security-audit`, which is the audit *workflow* skill.
+
+## Signature Block Format
+
+Each signature is a level-3 heading (three `#` characters, a space, then the
+`signatureId`) followed by labelled fields and two fenced code examples. This file and
+`SecuritySignatureParser` are one executable spec — keep them in sync.
+
+Required fields per block:
+- The heading text itself is the `signatureId` (must be non-empty).
+- `- **Title:** <human-readable title>`
+- `- **CWE:** CWE-xx` (optional — omit the line entirely for `cwe: null`)
+- `- **Severity:** critical|high|medium|low|info`
+- `- **VulnClass:** <a VulnClass union member, verbatim — see security-audit-types.ts>`
+- `- **Invariant:** <the safety invariant this signature protects>`
+- `- **Keywords:** comma, separated, keywords`
+
+Then two labelled fenced code examples:
+- `**Unsafe:**` followed by a fenced `ts` block with the vulnerable example.
+- `**Safe:**` followed by a fenced `ts` block with the fixed example.
+
+A block missing `Title`, a valid `VulnClass`, a valid `Severity`, or a non-empty
+unsafe/safe example is dropped by the parser — never a fatal error.
+
+## Signatures
+
+### igaming.toctou-balance-double-spend
+- **Title:** TOCTOU balance double-spend (read-check-write, no lock)
+- **CWE:** CWE-362
+- **Severity:** critical
+- **VulnClass:** race-condition
+- **Invariant:** A balance debit is a single atomic conditional write — the check and the write execute as one statement, never a separate read followed by a later write.
+- **Keywords:** balance, FOR UPDATE, TOCTOU, double-spend, atomic
+
+**Unsafe:**
+```ts
+const account = await db.query("SELECT balance FROM accounts WHERE id = $1", [id]);
+if (account.balance >= amount) {
+  await db.query("UPDATE accounts SET balance = balance - $1 WHERE id = $2", [amount, id]);
+}
+```
+
+**Safe:**
+```ts
+const result = await db.query(
+  "UPDATE accounts SET balance = balance - $1 WHERE id = $2 AND balance >= $1 RETURNING balance",
+  [amount, id],
+);
+if (result.rowCount === 0) throw new Error("insufficient balance");
+```
+
+### igaming.non-atomic-idempotency
+- **Title:** Missing/non-atomic idempotency key on deposit/settlement
+- **CWE:** CWE-362
+- **Severity:** critical
+- **VulnClass:** race-condition
+- **Invariant:** A deposit or settlement request is applied at most once per idempotency key, enforced by a unique constraint at the database layer, not by an application-level check-then-insert.
+- **Keywords:** idempotency, idempotency-key, settlement, unique, upsert
+
+**Unsafe:**
+```ts
+const existing = await db.query("SELECT id FROM settlements WHERE key = $1", [idempotencyKey]);
+if (!existing) await db.query("INSERT INTO settlements (key, amount) VALUES ($1, $2)", [idempotencyKey, amount]);
+```
+
+**Safe:**
+```ts
+await db.query(
+  "INSERT INTO settlements (key, amount) VALUES ($1, $2) ON CONFLICT (key) DO NOTHING", // key has a UNIQUE constraint
+  [idempotencyKey, amount],
+);
+```
+
+### igaming.client-supplied-odds
+- **Title:** Trusting client-supplied odds/price at bet acceptance
+- **CWE:** CWE-602
+- **Severity:** critical
+- **VulnClass:** money-integrity
+- **Invariant:** The payout for an accepted bet is computed from the server's current price for the selection id at acceptance time, never from an odds value the client submitted in the request body.
+- **Keywords:** odds, price, selectionId, payout, re-resolve
+
+**Unsafe:**
+```ts
+const payout = req.body.stake * req.body.odds; // client controls the multiplier directly
+```
+
+**Safe:**
+```ts
+const currentOdds = await priceService.getOdds(req.body.selectionId); // server-resolved at acceptance
+const payout = req.body.stake * currentOdds;
+```
+
+### igaming.negative-zero-stake
+- **Title:** Negative/zero stake inverts debit to credit
+- **CWE:** CWE-20
+- **Severity:** critical
+- **VulnClass:** money-integrity
+- **Invariant:** A stake amount is validated as a positive integer above the platform's minimum before any debit occurs — a negative or zero value is rejected, never processed.
+- **Keywords:** stake, negative, amount, validation, <= 0
+
+**Unsafe:**
+```ts
+await debit(userId, req.body.stake); // stake = -1000 credits the account instead of debiting it
+```
+
+**Safe:**
+```ts
+if (!Number.isInteger(req.body.stake) || req.body.stake <= 0) throw new Error("invalid stake");
+await debit(userId, req.body.stake);
+```
+
+### igaming.float-money
+- **Title:** Float money instead of integer minor units / Decimal
+- **CWE:** CWE-681
+- **Severity:** high
+- **VulnClass:** money-integrity
+- **Invariant:** Monetary amounts are represented as integer minor units (cents) or an arbitrary-precision Decimal type end-to-end — never IEEE-754 floats, which drift under repeated arithmetic.
+- **Keywords:** float, Number, minor units, Decimal, rounding, cents
+
+**Unsafe:**
+```ts
+balance += 0.1; // repeated float addition drifts from the true balance over many operations
+```
+
+**Safe:**
+```ts
+balanceCents += 10; // integer minor units, no drift
+```
+
+### igaming.missing-webhook-hmac
+- **Title:** Missing/incorrect provider webhook HMAC + timestamp verification
+- **CWE:** CWE-345
+- **Severity:** critical
+- **VulnClass:** authn-authz
+- **Invariant:** A webhook payload is only processed after its HMAC signature over the raw request body is verified with a constant-time comparison and its timestamp is checked against replay drift.
+- **Keywords:** webhook, HMAC, timingSafeEqual, raw-body, timestamp
+
+**Unsafe:**
+```ts
+app.post("/webhook", (req, res) => { applySettlement(req.body); }); // body trusted, unsigned
+```
+
+**Safe:**
+```ts
+const expected = crypto.createHmac("sha256", secret).update(rawBody).digest("hex");
+if (!crypto.timingSafeEqual(Buffer.from(expected), Buffer.from(req.headers["x-signature"])) ||
+    Date.now() - Number(req.headers["x-timestamp"]) > MAX_SKEW_MS) {
+  return res.status(401).end();
+}
+applySettlement(req.body);
+```
+
+### igaming.seamless-wallet-orphan-rollback
+- **Title:** Orphan / replayed seamless-wallet rollback credit
+- **Severity:** critical
+- **VulnClass:** money-integrity
+- **Invariant:** A rollback credit is only applied when it matches an existing debit transaction by a composite provider/round/transaction key, and each rollback key is processed at most once.
+- **Keywords:** seamless wallet, rollback, orphan, roundId, txId, dedup
+
+**Unsafe:**
+```ts
+await credit(userId, req.body.amount); // rollback credited with no matching prior debit, replayable
+```
+
+**Safe:**
+```ts
+const debit = await findDebit(providerId, req.body.roundId, req.body.txId);
+if (!debit) throw new Error("no matching debit for rollback");
+await db.query(
+  "INSERT INTO rollbacks (provider_id, round_id, tx_id, tx_type) VALUES ($1, $2, $3, 'rollback') ON CONFLICT DO NOTHING RETURNING id",
+  [providerId, req.body.roundId, req.body.txId],
+);
+await credit(userId, debit.amount);
+```
+
+### igaming.non-csprng-outcome
+- **Title:** Math.random() for game outcome (fails GLI-19 certification)
+- **CWE:** CWE-338
+- **Severity:** critical
+- **VulnClass:** insecure-randomness
+- **Invariant:** A game outcome that determines a payout is generated from a certified CSPRNG seeded with at least 256 bits of entropy, never `Math.random()`.
+- **Keywords:** Math.random, RNG, CSPRNG, outcome, seed, GLI-19
+
+**Unsafe:**
+```ts
+const outcome = Math.floor(Math.random() * reelSymbols.length); // predictable, not certifiable
+```
+
+**Safe:**
+```ts
+const outcome = certifiedRng.nextInt(reelSymbols.length); // certified CSPRNG, seeded >= 256 bits
+```
+
+### igaming.client-side-outcome
+- **Title:** Client-determined outcome trusted by server
+- **CWE:** CWE-602
+- **Severity:** critical
+- **VulnClass:** authn-authz
+- **Invariant:** The server independently computes the authoritative round outcome; a client-submitted result value is never accepted as-is for settlement.
+- **Keywords:** client-side, outcome, server-authoritative, trust boundary
+
+**Unsafe:**
+```ts
+await settleRound(req.body.result); // client tells the server what it won
+```
+
+**Safe:**
+```ts
+const result = await computeAuthoritativeOutcome(roundId); // server-computed, ignores client claims
+await settleRound(result);
+```
+
+### igaming.limits-client-only
+- **Title:** Deposit-limit / self-exclusion enforced client-side only
+- **CWE:** CWE-602
+- **Severity:** high
+- **VulnClass:** authn-authz
+- **Invariant:** Deposit limits and self-exclusion status are enforced by a server-side check on every deposit/bet request, not merely by disabling controls in the UI.
+- **Keywords:** deposit limit, self-exclusion, KYC, client-side, GAMSTOP
+
+**Unsafe:**
+```ts
+// UI disables the deposit button once the limit is reached; the API accepts any amount
+app.post("/deposit", (req, res) => { processDeposit(req.body.amount); });
+```
+
+**Safe:**
+```ts
+app.post("/deposit", async (req, res) => {
+  await assertWithinDepositLimit(req.session.userId, req.body.amount); // server-enforced, throws if exceeded
+  await assertNotSelfExcluded(req.session.userId);
+  processDeposit(req.body.amount);
+});
+```
+
+### igaming.bonus-wagering-abuse
+- **Title:** Bonus / wagering-requirement bypass (multi-account, self-referral)
+- **CWE:** CWE-841
+- **Severity:** high
+- **VulnClass:** money-integrity
+- **Invariant:** Bonus funds are withdrawable only after the wagering requirement is met on qualifying real-money play, and bonus eligibility is checked against multi-account/self-referral signals, not per-account state alone.
+- **Keywords:** bonus, wagering requirement, multi-account, self-referral
+
+**Unsafe:**
+```ts
+await withdraw(userId, bonusBalance); // no check that wagering requirement was met
+```
+
+**Safe:**
+```ts
+const progress = await getWageringProgress(userId);
+if (progress.wagered < progress.required) throw new Error("wagering requirement not met");
+if (await isSelfReferralOrMultiAccount(userId)) throw new Error("bonus ineligible");
+await withdraw(userId, bonusBalance);
+```
+
+### igaming.settlement-replay
+- **Title:** Replayed settlement/payout webhook without provider-event dedup
+- **Severity:** critical
+- **VulnClass:** money-integrity
+- **Invariant:** Each provider settlement event is applied at most once, keyed by the provider's unique event id enforced with a database uniqueness constraint.
+- **Keywords:** settlement, replay, dedup, provider-event, unique
+
+**Unsafe:**
+```ts
+app.post("/settlement", async (req, res) => { await applyPayout(req.body); }); // same event processed twice on retry
+```
+
+**Safe:**
+```ts
+app.post("/settlement", async (req, res) => {
+  const inserted = await db.query(
+    "INSERT INTO settlement_events (event_id) VALUES ($1) ON CONFLICT DO NOTHING RETURNING event_id",
+    [req.body.eventId],
+  );
+  if (inserted.rowCount === 0) return res.status(200).end(); // already processed
+  await applyPayout(req.body);
+});
+```

package/skills/bober.security-node/SKILL.md

@@ -0,0 +1,267 @@
+---
+name: bober.security-node
+description: "Node/Express backend security signature library. Not a workflow skill -- a data file of discrete vulnerable/safe code signature blocks read by SecuritySignatureParser. Covers SQL/NoSQL injection, ORM raw escape hatches, command injection, path traversal, SSRF, BOLA, mass assignment (BOPLA), BFLA, insecure deserialization, vm-as-sandbox misuse, hardcoded/logged secrets, and JWT/session weaknesses."
+---
+
+# bober.security-node — Node/Express Backend Security Signature Library
+
+This skill is a **signature-library** file, not a workflow skill. It is read (as raw
+markdown text) by `SecuritySignatureParser.parse()`
+(`src/orchestrator/security-knowledge/parser.ts`) and turned into typed
+`SecuritySignature[]` records used by the security-audit agent team. Do not confuse this
+with `bober.security-audit`, which is the audit *workflow* skill.
+
+## Signature Block Format
+
+Each signature is a level-3 heading (three `#` characters, a space, then the
+`signatureId`) followed by labelled fields and two fenced code examples. This file and
+`SecuritySignatureParser` are one executable spec — keep them in sync.
+
+Required fields per block:
+- The heading text itself is the `signatureId` (must be non-empty).
+- `- **Title:** <human-readable title>`
+- `- **CWE:** CWE-xx` (optional — omit the line entirely for `cwe: null`)
+- `- **Severity:** critical|high|medium|low|info`
+- `- **VulnClass:** <a VulnClass union member, verbatim — see security-audit-types.ts>`
+- `- **Invariant:** <the safety invariant this signature protects>`
+- `- **Keywords:** comma, separated, keywords`
+
+Then two labelled fenced code examples:
+- `**Unsafe:**` followed by a fenced `ts` block with the vulnerable example.
+- `**Safe:**` followed by a fenced `ts` block with the fixed example.
+
+A block missing `Title`, a valid `VulnClass`, a valid `Severity`, or a non-empty
+unsafe/safe example is dropped by the parser — never a fatal error.
+
+## Signatures
+
+### node.sql-injection
+- **Title:** SQL injection via string concatenation / template literal
+- **CWE:** CWE-89
+- **Severity:** critical
+- **VulnClass:** injection
+- **Invariant:** A SQL query built from request-derived data always uses parameterized placeholders — the query text is never built by concatenating or interpolating untrusted input.
+- **Keywords:** sql, query, concat, template-literal, parameterized
+
+**Unsafe:**
+```ts
+const rows = await db.query(`SELECT * FROM users WHERE id = ${req.query.id}`);
+```
+
+**Safe:**
+```ts
+const rows = await db.query("SELECT * FROM users WHERE id = $1", [req.query.id]);
+```
+
+### node.orm-raw-escape-hatch
+- **Title:** ORM raw escape hatch (.raw/.literal/$queryRawUnsafe/$where) with interpolated input
+- **CWE:** CWE-89
+- **Severity:** critical
+- **VulnClass:** injection
+- **Invariant:** When an ORM's raw-SQL escape hatch is used, the query text is a static tagged template or the ORM's own bound-parameter form — request-derived values are never string-concatenated into it.
+- **Keywords:** ORM, raw, $queryRawUnsafe, literal, $where, prisma, knex
+
+**Unsafe:**
+```ts
+await prisma.$queryRawUnsafe(`SELECT * FROM users WHERE name = '${req.query.name}'`);
+```
+
+**Safe:**
+```ts
+await prisma.$queryRaw`SELECT * FROM users WHERE name = ${req.query.name}`;
+```
+
+### node.command-injection
+- **Title:** OS command injection via exec / shell:true
+- **CWE:** CWE-78
+- **Severity:** critical
+- **VulnClass:** injection
+- **Invariant:** A subprocess is spawned with an explicit binary and an argument array, never through a shell, so request-derived data cannot be interpreted as shell syntax.
+- **Keywords:** exec, child_process, shell, execFile, command
+
+**Unsafe:**
+```ts
+exec(`convert ${req.body.file} out.png`);
+```
+
+**Safe:**
+```ts
+execFile("convert", [req.body.file, "out.png"]);
+```
+
+### node.path-traversal
+- **Title:** Path traversal via path.join/resolve with no boundary assertion
+- **CWE:** CWE-22
+- **Severity:** high
+- **VulnClass:** path-traversal
+- **Invariant:** A file path built from a request-supplied name is resolved and asserted to remain inside the intended base directory before any filesystem access.
+- **Keywords:** path.join, path.resolve, traversal, ../, boundary
+
+**Unsafe:**
+```ts
+const filePath = path.join(baseDir, req.params.name);
+await fs.readFile(filePath);
+```
+
+**Safe:**
+```ts
+const filePath = path.resolve(baseDir, req.params.name);
+if (!filePath.startsWith(path.resolve(baseDir) + path.sep)) throw new Error("invalid path");
+await fs.readFile(filePath);
+```
+
+### node.ssrf-outbound-fetch
+- **Title:** SSRF via unvalidated outbound fetch/axios (cloud metadata / RFC1918)
+- **CWE:** CWE-918
+- **Severity:** critical
+- **VulnClass:** ssrf
+- **Invariant:** An outbound HTTP request to a user-supplied URL is only made after the resolved host is checked against an allowlist and internal/link-local address ranges are blocked at connect time.
+- **Keywords:** ssrf, fetch, axios, 169.254.169.254, RFC1918, metadata
+
+**Unsafe:**
+```ts
+const res = await fetch(req.body.url);
+```
+
+**Safe:**
+```ts
+assertAllowedOutboundHost(req.body.url); // rejects RFC1918 / 169.254.169.254 / non-allowlisted hosts
+const res = await fetch(req.body.url);
+```
+
+### node.bola-missing-ownership
+- **Title:** BOLA: object id looked up with no owner predicate
+- **CWE:** CWE-639
+- **Severity:** critical
+- **VulnClass:** idor-bola
+- **Invariant:** A lookup by object id is always scoped to the requesting session's owner id in the query itself — the object is never fetched by id alone and checked afterward.
+- **Keywords:** BOLA, IDOR, ownerId, object id, authorization
+
+**Unsafe:**
+```ts
+const doc = await db.query("SELECT * FROM documents WHERE id = $1", [req.params.id]);
+```
+
+**Safe:**
+```ts
+const doc = await db.query(
+  "SELECT * FROM documents WHERE id = $1 AND owner_id = $2",
+  [req.params.id, req.session.userId],
+);
+```
+
+### node.mass-assignment-bopla
+- **Title:** BOPLA / mass assignment via Model.update(req.body)
+- **CWE:** CWE-915
+- **Severity:** critical
+- **VulnClass:** idor-bola
+- **Invariant:** An update from request data only writes an explicit allowlist of updatable fields — the raw request body is never passed directly to a model update call.
+- **Keywords:** mass assignment, BOPLA, req.body, allowlist, isAdmin
+
+**Unsafe:**
+```ts
+await User.update(req.body, { where: { id: req.session.userId } });
+```
+
+**Safe:**
+```ts
+const { name, email } = req.body; // explicit allowlist, excludes isAdmin/role/etc.
+await User.update({ name, email }, { where: { id: req.session.userId } });
+```
+
+### node.bfla-admin-no-role-gate
+- **Title:** BFLA: admin/privileged route with no role gate
+- **CWE:** CWE-862
+- **Severity:** critical
+- **VulnClass:** authn-authz
+- **Invariant:** A route performing a privileged function is always guarded by a role check that runs before the handler executes — the function-level authorization is never assumed from the route existing under an "/admin" prefix.
+- **Keywords:** BFLA, admin route, role, requireRole, authorization
+
+**Unsafe:**
+```ts
+app.post("/admin/users/:id/delete", async (req, res) => { await deleteUser(req.params.id); });
+```
+
+**Safe:**
+```ts
+app.post("/admin/users/:id/delete", requireRole("admin"), async (req, res) => {
+  await deleteUser(req.params.id);
+});
+```
+
+### node.insecure-deserialization
+- **Title:** Insecure deserialization of untrusted input
+- **CWE:** CWE-502
+- **Severity:** critical
+- **VulnClass:** deserialization
+- **Invariant:** Untrusted input is only decoded with a format-safe parser (plain JSON, or a YAML loader restricted to a safe schema) — a deserializer capable of reconstructing arbitrary objects or executing code is never applied to request data.
+- **Keywords:** deserialization, unserialize, yaml.load, node-serialize, gadget
+
+**Unsafe:**
+```ts
+const obj = serialize.unserialize(req.body.payload); // node-serialize: gadget chain -> RCE
+```
+
+**Safe:**
+```ts
+const obj = JSON.parse(req.body.payload); // or yaml.load(input, { schema: JSON_SCHEMA })
+```
+
+### node.vm-not-a-sandbox
+- **Title:** vm/new Function/eval on tainted input (vm is not a sandbox)
+- **CWE:** CWE-94
+- **Severity:** critical
+- **VulnClass:** injection
+- **Invariant:** Request-derived strings are never passed to eval, new Function, or Node's built-in vm module as executable code — vm does not provide a security boundary against untrusted code.
+- **Keywords:** vm, vm2, new Function, eval, runInNewContext, sandbox
+
+**Unsafe:**
+```ts
+const result = new vm.Script(req.body.code).runInNewContext({});
+```
+
+**Safe:**
+```ts
+// never eval untrusted input; use a real out-of-process sandbox (worker with no
+// filesystem/network access) plus an explicit allowlist of permitted operations
+const result = await runInIsolatedWorker(req.body.code, { allowlist: SAFE_OPS });
+```
+
+### node.secrets-hardcoded-logged
+- **Title:** Hard-coded or logged secrets
+- **CWE:** CWE-798
+- **Severity:** high
+- **VulnClass:** secret-handling
+- **Invariant:** Credentials and API keys are read from environment variables or a secret manager at runtime and are never embedded as string literals or written to application logs.
+- **Keywords:** secret, API key, hardcoded, logger, redact, .env
+
+**Unsafe:**
+```ts
+const stripeKey = "sk_live_51H8x...";
+logger.info("charging user", { apiKey: stripeKey, amount });
+```
+
+**Safe:**
+```ts
+const stripeKey = process.env.STRIPE_SECRET_KEY;
+logger.info("charging user", { amount }); // secret never included in log fields
+```
+
+### node.jwt-alg-none
+- **Title:** JWT alg:none / weak secret / session fixation
+- **CWE:** CWE-347
+- **Severity:** critical
+- **VulnClass:** authn-authz
+- **Invariant:** A JWT is verified with a pinned strong algorithm and a high-entropy secret or key, and a session identifier is rotated on every successful login — a token is never accepted with an attacker-chosen algorithm or a weak shared secret.
+- **Keywords:** JWT, alg none, algorithms, session fixation, verify
+
+**Unsafe:**
+```ts
+const payload = jwt.verify(token, secret, { algorithms: ["none", "HS256"] });
+```
+
+**Safe:**
+```ts
+const payload = jwt.verify(token, strongSecret, { algorithms: ["HS256"] });
+req.session.regenerate(() => { req.session.userId = payload.sub; }); // rotate on login
+```