agentic-qe 3.4.0 → 3.4.2

package/.claude/skills/n8n-security-testing/schemas/output.json

@@ -0,0 +1,293 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://agentic-qe.dev/schemas/skills/n8n-security-testing/output.json",
+  "title": "N8N Security Testing Skill Output Schema",
+  "description": "Schema for n8n-security-testing skill output. Validates credential security, data exposure, and workflow security vulnerabilities.",
+  "type": "object",
+  "required": ["skillName", "version", "timestamp", "status", "trustTier", "output"],
+  "properties": {
+    "skillName": {
+      "type": "string",
+      "const": "n8n-security-testing"
+    },
+    "version": {
+      "type": "string",
+      "pattern": "^\\d+\\.\\d+\\.\\d+(-[a-zA-Z0-9]+)?$"
+    },
+    "timestamp": {
+      "type": "string",
+      "format": "date-time"
+    },
+    "status": {
+      "type": "string",
+      "enum": ["success", "partial", "failed", "skipped"]
+    },
+    "trustTier": {
+      "type": "integer",
+      "const": 3
+    },
+    "output": {
+      "type": "object",
+      "required": ["summary", "securityFindings", "credentialAudit"],
+      "properties": {
+        "summary": {
+          "type": "string",
+          "minLength": 20,
+          "maxLength": 2000
+        },
+        "securityFindings": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/securityFinding"
+          },
+          "maxItems": 500
+        },
+        "credentialAudit": {
+          "$ref": "#/$defs/credentialAudit"
+        },
+        "workflowValidation": {
+          "$ref": "#/$defs/workflowValidation"
+        },
+        "dataExposureRisks": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/dataExposureRisk"
+          }
+        },
+        "nodeSecurityScores": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/nodeSecurityScore"
+          }
+        },
+        "recommendations": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/recommendation"
+          },
+          "maxItems": 100
+        },
+        "complianceChecks": {
+          "type": "array",
+          "items": {
+            "$ref": "#/$defs/complianceCheck"
+          }
+        },
+        "metrics": {
+          "$ref": "#/$defs/metrics"
+        }
+      }
+    },
+    "metadata": {
+      "$ref": "#/$defs/metadata"
+    },
+    "validation": {
+      "$ref": "#/$defs/validationResult"
+    },
+    "learning": {
+      "$ref": "#/$defs/learningData"
+    }
+  },
+  "$defs": {
+    "securityFinding": {
+      "type": "object",
+      "required": ["id", "title", "severity", "category"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^SEC-N8N-\\d{3,6}$"
+        },
+        "title": {
+          "type": "string",
+          "minLength": 10,
+          "maxLength": 200
+        },
+        "description": {
+          "type": "string",
+          "maxLength": 2000
+        },
+        "severity": {
+          "type": "string",
+          "enum": ["critical", "high", "medium", "low", "info"]
+        },
+        "category": {
+          "type": "string",
+          "enum": ["credential-exposure", "data-leakage", "injection", "auth-bypass", "insecure-config", "sensitive-data", "access-control"]
+        },
+        "nodeName": {
+          "type": "string"
+        },
+        "nodeType": {
+          "type": "string"
+        },
+        "location": {
+          "type": "object",
+          "properties": {
+            "workflowId": { "type": "string" },
+            "nodeId": { "type": "string" },
+            "parameter": { "type": "string" }
+          }
+        },
+        "evidence": {
+          "type": "string",
+          "maxLength": 5000
+        },
+        "remediation": {
+          "type": "string",
+          "maxLength": 2000
+        },
+        "cwe": {
+          "type": "string",
+          "pattern": "^CWE-\\d{1,4}$"
+        },
+        "owasp": {
+          "type": "string",
+          "pattern": "^A(0[1-9]|10):20(21|25)$"
+        },
+        "falsePositive": {
+          "type": "boolean"
+        },
+        "confidence": {
+          "type": "number",
+          "minimum": 0,
+          "maximum": 1
+        }
+      }
+    },
+    "credentialAudit": {
+      "type": "object",
+      "required": ["totalCredentials", "secureCredentials", "insecureCredentials"],
+      "properties": {
+        "totalCredentials": { "type": "integer", "minimum": 0 },
+        "secureCredentials": { "type": "integer", "minimum": 0 },
+        "insecureCredentials": { "type": "integer", "minimum": 0 },
+        "expiredCredentials": { "type": "integer", "minimum": 0 },
+        "unusedCredentials": { "type": "integer", "minimum": 0 },
+        "credentialIssues": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "credentialName": { "type": "string" },
+              "issue": { "type": "string" },
+              "severity": { "type": "string", "enum": ["critical", "high", "medium", "low"] }
+            }
+          }
+        },
+        "overallScore": { "type": "number", "minimum": 0, "maximum": 100 }
+      }
+    },
+    "workflowValidation": {
+      "type": "object",
+      "required": ["workflowId", "secure"],
+      "properties": {
+        "workflowId": { "type": "string" },
+        "workflowName": { "type": "string" },
+        "secure": { "type": "boolean" },
+        "criticalFindings": { "type": "integer", "minimum": 0 },
+        "highFindings": { "type": "integer", "minimum": 0 },
+        "mediumFindings": { "type": "integer", "minimum": 0 },
+        "lowFindings": { "type": "integer", "minimum": 0 },
+        "securityScore": { "type": "number", "minimum": 0, "maximum": 100 },
+        "grade": { "type": "string", "pattern": "^[A-F][+-]?$" },
+        "riskLevel": { "type": "string", "enum": ["critical", "high", "medium", "low", "minimal"] }
+      }
+    },
+    "dataExposureRisk": {
+      "type": "object",
+      "required": ["riskType", "severity"],
+      "properties": {
+        "riskType": {
+          "type": "string",
+          "enum": ["pii-exposure", "credential-leak", "api-key-exposure", "token-exposure", "logging-sensitive-data", "external-transmission"]
+        },
+        "severity": { "type": "string", "enum": ["critical", "high", "medium", "low"] },
+        "affectedNodes": { "type": "array", "items": { "type": "string" } },
+        "dataTypes": { "type": "array", "items": { "type": "string" } },
+        "description": { "type": "string" },
+        "mitigation": { "type": "string" }
+      }
+    },
+    "nodeSecurityScore": {
+      "type": "object",
+      "required": ["nodeName", "nodeType", "score"],
+      "properties": {
+        "nodeName": { "type": "string" },
+        "nodeType": { "type": "string" },
+        "score": { "type": "number", "minimum": 0, "maximum": 100 },
+        "grade": { "type": "string", "pattern": "^[A-F][+-]?$" },
+        "vulnerabilities": { "type": "integer", "minimum": 0 },
+        "riskFactors": { "type": "array", "items": { "type": "string" } }
+      }
+    },
+    "complianceCheck": {
+      "type": "object",
+      "required": ["standard", "passed"],
+      "properties": {
+        "standard": { "type": "string", "enum": ["GDPR", "HIPAA", "PCI-DSS", "SOC2", "OWASP"] },
+        "passed": { "type": "boolean" },
+        "requirements": {
+          "type": "array",
+          "items": {
+            "type": "object",
+            "properties": {
+              "requirement": { "type": "string" },
+              "passed": { "type": "boolean" },
+              "notes": { "type": "string" }
+            }
+          }
+        }
+      }
+    },
+    "recommendation": {
+      "type": "object",
+      "required": ["id", "title", "priority"],
+      "properties": {
+        "id": { "type": "string", "pattern": "^REC-\\d{3,6}$" },
+        "title": { "type": "string", "maxLength": 200 },
+        "description": { "type": "string", "maxLength": 2000 },
+        "priority": { "type": "string", "enum": ["critical", "high", "medium", "low"] },
+        "relatedFindings": { "type": "array", "items": { "type": "string" } },
+        "effort": { "type": "string", "enum": ["trivial", "low", "medium", "high", "major"] }
+      }
+    },
+    "metrics": {
+      "type": "object",
+      "properties": {
+        "totalFindings": { "type": "integer", "minimum": 0 },
+        "criticalCount": { "type": "integer", "minimum": 0 },
+        "highCount": { "type": "integer", "minimum": 0 },
+        "mediumCount": { "type": "integer", "minimum": 0 },
+        "lowCount": { "type": "integer", "minimum": 0 },
+        "nodesScanned": { "type": "integer", "minimum": 0 },
+        "credentialsAudited": { "type": "integer", "minimum": 0 },
+        "securityScore": { "type": "number", "minimum": 0, "maximum": 100 }
+      }
+    },
+    "metadata": {
+      "type": "object",
+      "properties": {
+        "executionTimeMs": { "type": "integer", "minimum": 0 },
+        "toolsUsed": { "type": "array", "items": { "type": "string" } },
+        "agentId": { "type": "string", "pattern": "^qe-[a-z][a-z0-9-]*$" },
+        "n8nVersion": { "type": "string" },
+        "scanDepth": { "type": "string", "enum": ["quick", "standard", "deep"] }
+      }
+    },
+    "validationResult": {
+      "type": "object",
+      "properties": {
+        "schemaValid": { "type": "boolean" },
+        "contentValid": { "type": "boolean" },
+        "confidence": { "type": "number", "minimum": 0, "maximum": 1 }
+      }
+    },
+    "learningData": {
+      "type": "object",
+      "properties": {
+        "patternsDetected": { "type": "array", "items": { "type": "string" } },
+        "reward": { "type": "number", "minimum": 0, "maximum": 1 }
+      }
+    }
+  }
+}

package/.claude/skills/n8n-security-testing/scripts/validate.sh

@@ -0,0 +1,120 @@
+#!/bin/bash
+# =============================================================================
+# AQE Skill Validator: n8n-security-testing v1.0.0
+# =============================================================================
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
+PROJECT_ROOT="$(cd "$SKILL_DIR/../../.." && pwd)"
+
+for lib_path in "$PROJECT_ROOT/.claude/skills/.validation/templates/validator-lib.sh" "$SKILL_DIR/scripts/validator-lib.sh"; do
+  [[ -f "$lib_path" ]] && source "$lib_path" && break
+done
+
+SKILL_NAME="n8n-security-testing"
+SKILL_VERSION="1.0.0"
+REQUIRED_TOOLS=("jq")
+SCHEMA_PATH="$SKILL_DIR/schemas/output.json"
+REQUIRED_FIELDS=("skillName" "status" "output" "output.summary" "output.securityFindings" "output.credentialAudit")
+MUST_CONTAIN_TERMS=("security" "credential")
+MUST_NOT_CONTAIN_TERMS=("TODO" "FIXME")
+ENUM_VALIDATIONS=(".status:success,partial,failed,skipped")
+
+validate_skill_specific() {
+  local output_file="$1"
+  local has_errors=false
+
+  # Validate security findings
+  local finding_count
+  finding_count=$(jq '.output.securityFindings | length' "$output_file" 2>/dev/null || echo "0")
+
+  if [[ "$finding_count" -gt 0 ]]; then
+    local invalid_findings
+    invalid_findings=$(jq '[.output.securityFindings[]? | select(.id == null or .title == null or .severity == null or .category == null)] | length' "$output_file" 2>/dev/null || echo "0")
+
+    if [[ "$invalid_findings" -gt 0 ]]; then
+      warn "$invalid_findings finding(s) missing required fields"
+    fi
+
+    # Validate severity enum
+    local valid_severities="critical high medium low info"
+    local severities
+    severities=$(jq -r '.output.securityFindings[]?.severity // empty' "$output_file" 2>/dev/null || true)
+
+    for sev in $severities; do
+      if ! echo "$valid_severities" | grep -qw "$sev"; then
+        error "Invalid severity: $sev"
+        has_errors=true
+      fi
+    done
+
+    # Validate finding ID pattern
+    local invalid_ids
+    invalid_ids=$(jq '[.output.securityFindings[]?.id // empty | select(test("^SEC-N8N-[0-9]{3,6}$") | not)] | length' "$output_file" 2>/dev/null || echo "0")
+
+    if [[ "$invalid_ids" -gt 0 ]]; then
+      warn "$invalid_ids finding(s) have invalid ID format (should be SEC-N8N-NNN)"
+    fi
+  fi
+
+  # Validate credential audit
+  local has_audit
+  has_audit=$(jq '.output.credentialAudit | has("totalCredentials") and has("secureCredentials") and has("insecureCredentials")' "$output_file" 2>/dev/null)
+
+  if [[ "$has_audit" != "true" ]]; then
+    error "Credential audit missing required fields"
+    has_errors=true
+  else
+    # Validate credential counts are consistent
+    local total secure insecure
+    total=$(jq '.output.credentialAudit.totalCredentials' "$output_file" 2>/dev/null)
+    secure=$(jq '.output.credentialAudit.secureCredentials' "$output_file" 2>/dev/null)
+    insecure=$(jq '.output.credentialAudit.insecureCredentials' "$output_file" 2>/dev/null)
+
+    if [[ -n "$total" && -n "$secure" && -n "$insecure" ]]; then
+      if [[ $((secure + insecure)) -gt $total ]]; then
+        warn "Credential counts inconsistent: secure($secure) + insecure($insecure) > total($total)"
+      fi
+    fi
+  fi
+
+  if [[ "$has_errors" == "true" ]]; then return 1; fi
+  success "N8N security testing validation passed"
+  return 0
+}
+
+OUTPUT_FILE="${1:-}"
+
+# Handle --self-test flag
+if [[ "$OUTPUT_FILE" == "--self-test" ]]; then
+  echo "=== Self-Test: $SKILL_NAME v$SKILL_VERSION ==="
+  echo "[PASS] Required tool: jq"
+  if [[ -f "$SCHEMA_PATH" ]]; then
+    echo "[PASS] Schema file exists"
+    if jq empty "$SCHEMA_PATH" 2>/dev/null; then
+      echo "[PASS] Schema is valid JSON"
+    else
+      echo "[FAIL] Schema is invalid JSON"
+      exit 1
+    fi
+  else
+    echo "[WARN] Schema file not found"
+  fi
+  echo "[PASS] Self-test completed"
+  exit 0
+fi
+
+[[ -z "$OUTPUT_FILE" ]] && { echo "Usage: $0 <output-file> | --self-test"; exit 1; }
+[[ ! -f "$OUTPUT_FILE" ]] && { echo "ERROR: File not found: $OUTPUT_FILE"; exit 1; }
+
+echo "Validating $SKILL_NAME output..."
+jq empty "$OUTPUT_FILE" 2>/dev/null || { echo "ERROR: Invalid JSON"; exit 1; }
+
+if validate_skill_specific "$OUTPUT_FILE"; then
+  echo "PASSED: $SKILL_NAME validation"
+  exit 0
+else
+  echo "FAILED: $SKILL_NAME validation"
+  exit 1
+fi

package/.claude/skills/n8n-trigger-testing-strategies/SKILL.md

@@ -11,6 +11,12 @@ last_optimized: 2025-12-15
 dependencies: []
 quick_reference_card: true
 tags: [n8n, triggers, webhook, schedule, cron, polling, testing]
+trust_tier: 3
+validation:
+  schema_path: schemas/output.json
+  validator_path: scripts/validate.sh
+  eval_path: evals/n8n-trigger-testing-strategies.yaml
+
 ---
 
 # n8n Trigger Testing Strategies