ai-developer-skill-os 8.2.0 → 8.3.0

package/.agents/skills/qk-security-audit/SKILL.md

@@ -1,135 +1,259 @@
----
-# ── Identity ───────────────────────────────────────────────
-name: qk-security-audit
-version: 8.1.0
-status: experimental
-description: "Security audit (OWASP, dependency security, secret detection, permission model)."
-platforms: [antigravity, claude-code, cursor, windsurf, kilo-code]
-
-# ── V8: Classification ─────────────────────────────────────
-type: capability
-
-intent:
-  - security-audit
-  - vulnerability-scan
-  - secret-detection
-  - permission-review
-
-complexity:
-  level: high
-  criteria:
-    files_affected: "1-10"
-    has_behavior_change: true
-    has_external_dependency: true
-    has_breaking_change: false
-
-triggers:
-  - "kiểm tra bảo mật"
-  - "scan lỗ hổng"
-  - "audit code"
-  - "tìm secret leak"
-
-# ── V8: References ─────────────────────────────────────────
-workflow: security-audit
-
-rules:
-  - global
-  - security
-
-tools:
-  - filesystem
-  - terminal
-
-related_skills:
-  - qk-access-policy
-
-knowledge_scope:
-  domain:
-    - security-practices
-    - vulnerability-detection
-  concepts:
-    - owasp
-    - secret-detection
-  references:
-    - architecture
-
-decision_boundary:
-  owns:
-    - application-security
-    - agent-security
-    - prompt-injection
-    - dependency-risk
-  does_not_own:
-    - access control implementation
-    - penetration testing
-    - compliance certification
-  conflicts_with: []
-  delegates_to:
-    - qk-validation-gate
-
-# ── V8: Verification ───────────────────────────────────────
-verification:
-  required: true
-  strategy: feature
-
-lifecycle:
-  promotion_gate:
-    requirements:
-      tests:
-        minimum_pass_rate: 0.95
-      usage:
-        minimum_runs: 20
-      conflicts:
-        zero_boundary_violation: true
-      evidence:
-        required:
-          - evaluation_report
-          - usage_history
-          - boundary_audit
-  demotion_gate:
-    triggers:
-      - repeated_failure
-      - boundary_violation
-      - outdated_reference
-    action:
-      change_status: "stable -> experimental"
-
-selection:
-  priority: high
-  confidence_threshold: 0.85
-
-examples: []
-learnings: []
-
-# ── V7 Runtime ─────────────────────────────────────────────
-execution_mode: deterministic
-cost: medium
-latency: slow
-risk: low
-side_effects: read_only
-produces: [report, security_fixes]
-consumes: [user-description]
-
-token_budget:
-  max_files_read: 10
-  max_lines_per_read: 150
-  max_shell_commands: 2
-  stop_early: false
-
-exit_codes: [SUCCESS, BLOCKED, FAILED, PARTIAL]
----
-
-# qk-security-audit — Security Auditor
-
-> **Language rule:** Code, identifiers, file names → English. Explanations, summaries → Vietnamese.
-
-## Preconditions
-- [ ] Tuân thủ `security.md`.
-- [ ] Xác định phạm vi codebase cần audit.
-
-## Scope
-- Quét và phát hiện các rủi ro bảo mật từ dependencies bên thứ ba.
-- Nhận diện secret bị hardcode/leak (API keys, passwords, tokens).
-- Rà soát mô hình phân quyền (RBAC, ABAC) và kiểm tra lỗ hổng logic (BOLA, Broken Auth).
-- Check dựa trên OWASP Top 10.
-- Khuyến nghị bản vá bảo mật tương ứng.
+---
+# ── Identity ───────────────────────────────────────────────
+name: qk-security-audit
+version: 8.1.0
+status: experimental
+description: "Security audit (OWASP, dependency security, secret detection, permission model)."
+platforms: [antigravity, claude-code, cursor, windsurf, kilo-code]
+
+# ── V8: Classification ─────────────────────────────────────
+type: capability
+
+intent:
+  - security-audit
+  - vulnerability-scan
+  - secret-detection
+  - permission-review
+
+complexity:
+  level: high
+  criteria:
+    files_affected: "1-10"
+    has_behavior_change: true
+    has_external_dependency: true
+    has_breaking_change: false
+
+triggers:
+  - "kiểm tra bảo mật"
+  - "scan lỗ hổng"
+  - "audit code"
+  - "tìm secret leak"
+
+# ── V8: References ─────────────────────────────────────────
+workflow: security-audit
+
+rules:
+  - global
+  - security
+
+tools:
+  - filesystem
+  - terminal
+
+related_skills:
+  - qk-access-policy
+
+knowledge_scope:
+  domain:
+    - security-practices
+    - vulnerability-detection
+  concepts:
+    - owasp
+    - secret-detection
+  references:
+    - architecture
+    - security
+    - anti-patterns
+
+decision_boundary:
+  owns:
+    - application-security
+    - agent-security
+    - prompt-injection
+    - dependency-risk
+  does_not_own:
+    - access control implementation
+    - penetration testing
+    - compliance certification
+  conflicts_with: []
+  delegates_to:
+    - qk-validation-gate
+
+# ── V8: Verification ───────────────────────────────────────
+verification:
+  required: true
+  strategy: feature
+
+lifecycle:
+  promotion_gate:
+    requirements:
+      tests:
+        minimum_pass_rate: 0.95
+      usage:
+        minimum_runs: 20
+      conflicts:
+        zero_boundary_violation: true
+      evidence:
+        required:
+          - evaluation_report
+          - usage_history
+          - boundary_audit
+  demotion_gate:
+    triggers:
+      - repeated_failure
+      - boundary_violation
+      - outdated_reference
+    action:
+      change_status: "stable -> experimental"
+
+selection:
+  priority: high
+  confidence_threshold: 0.85
+
+examples: []
+learnings: []
+
+# ── V7 Runtime ─────────────────────────────────────────────
+execution_mode: deterministic
+cost: medium
+latency: slow
+risk: low
+side_effects: read_only
+produces: [report, security_fixes]
+consumes: [user-description]
+
+token_budget:
+  max_files_read: 10
+  max_lines_per_read: 150
+  max_shell_commands: 2
+  stop_early: true
+
+exit_codes: [SUCCESS, BLOCKED, FAILED, PARTIAL]
+---
+
+# qk-security-audit — Security Auditor
+
+> **Language rule:** Code, identifiers, file names → English. Explanations, summaries → Vietnamese.
+
+## Preconditions
+- [ ] Tuân thủ `security.md`.
+- [ ] Xác định phạm vi codebase cần audit.
+
+## Scope
+- Quét và phát hiện các rủi ro bảo mật từ dependencies bên thứ ba.
+- Nhận diện secret bị hardcode/leak (API keys, passwords, tokens).
+- Rà soát mô hình phân quyền (RBAC, ABAC) và kiểm tra lỗ hổng logic (BOLA, Broken Auth).
+- **Quét lỗ hổng Prompt Injection và xác minh ranh giới Zero-Trust theo đúng R-SEC-04.**
+- Check dựa trên OWASP Top 10.
+- Khuyến nghị bản vá bảo mật tương ứng.
+
+## Non-Goals
+- ❌ Provide implementation outside of Security Vulnerability Detection scope
+- ❌ Override explicit user directives without explanation
+- ❌ Guess ambiguous requirements without asking
+
+## Priority Order
+
+| Priority | Task | Skip Threshold |
+|----------|------|----------------|
+| P1 | Core Security Vulnerability Detection analysis and decision making | Never |
+| P2 | Validation of existing patterns | Budget < 30% |
+| P3 | Detailed documentation generation | Budget < 50% |
+| P4 | Edge case exploration | Budget < 70% |
+
+## Workflow
+
+### Phase 1 — Context Loading
+**Steps:**
+1. Read existing configuration and requirements related to Security Vulnerability Detection.
+2. Check for missing preconditions.
+
+**Decision:**
+```
+IF context is clear
+  → Confidence: HIGH → go to Phase 2
+ELSE
+  → EXIT: BLOCKED — ask user
+```
+
+### Phase 2 — Analysis & Strategy
+**Steps:**
+1. Analyze the current state against Security Vulnerability Detection best practices.
+2. Formulate strategy or audit report based on findings.
+
+**Decision:**
+```
+IF strategy/audit is complete
+  → Confidence: HIGH → go to Phase 3
+ELSE IF minor gaps exist
+  → Confidence: MEDIUM → proceed with assumptions noted
+```
+
+### Phase 3 — Finalization
+**Steps:**
+1. Generate final report or configuration.
+2. Prepare handoff data for subsequent skills.
+
+## Confidence Model
+
+| Level | Condition | Action |
+|-------|-----------|--------|
+| HIGH | All preconditions met, context fully understood | Proceed directly |
+| MEDIUM | Some context missing but safe defaults exist | Proceed and note assumptions |
+| LOW | Core requirements missing | EXIT: BLOCKED |
+
+## Severity (for findings)
+
+| Level | Definition |
+|-------|-----------|
+| CRITICAL | Severe violation of Security Vulnerability Detection principles |
+| HIGH | Significant risk or technical debt |
+| MEDIUM | Suboptimal pattern but functional |
+| LOW | Minor style or documentation issue |
+
+## Evidence Format
+
+```
+[SEVERITY] Context/File
+Issue:      [what was found]
+Confidence: HIGH
+Recommendation: [actionable advice]
+```
+
+## Retry Policy
+```
+Task fails due to missing context
+  └─ Ask user for clarification
+       ├─ Provided → Retry Phase 1
+       └─ Not provided → EXIT: BLOCKED
+```
+
+## Escalation Rules
+
+```
+BLOCKED: Missing critical context for Security Vulnerability Detection
+Missing:
+  - [Specific requirement]
+Questions:
+  1. Bạn có thể cung cấp thêm thông tin về yêu cầu này không?
+  2. Mục tiêu chính của bạn là gì?
+Recommended Assumptions: none
+```
+
+## Handoff Contract
+
+### Consumes
+```json
+{
+  "from": "user or qk-orchestrator",
+  "required_fields": ["context"],
+  "optional_fields": ["existing_config"]
+}
+```
+
+### Produces
+```json
+{
+  "to": "user or downstream skill",
+  "output_fields": ["strategy_report", "exit_code"]
+}
+```
+
+## Exit Codes
+
+| Code | Meaning | When |
+|------|---------|------|
+| SUCCESS | Security Vulnerability Detection task completed successfully | Strategy/audit generated |
+| PARTIAL | Task completed with assumptions | Medium confidence |
+| BLOCKED | Missing context | Cannot proceed |
+| FAILED | Critical conflict or error | Unresolvable constraint |

package/.agents/skills/qk-system-evolution/SKILL.md

@@ -50,6 +50,8 @@ knowledge_scope:
   references:
     - testing
     - architecture
+    - security
+    - anti-patterns
 
 # ── V8: Verification ───────────────────────────────────────
 verification:
@@ -76,7 +78,7 @@ token_budget:
   max_files_read: 4
   max_lines_per_read: 100
   max_shell_commands: 2
-  stop_early: false
+  stop_early: true
 
 exit_codes: [SUCCESS, BLOCKED, FAILED, PARTIAL]
 ---
@@ -96,11 +98,6 @@ On missing precondition:
   Message: "Rollback plan required before any major upgrade. Specify: target version + rollback method."
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Scope
 - ✅ Read official Changelog/Migration Guide for breaking changes
 - ✅ Apply incremental upgrades (not big-bang)
@@ -112,11 +109,6 @@ schema_version: 2
 - ❌ Skip reading Changelog for major version bumps
 - ❌ Upgrade multiple major versions at once (one at a time)
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Priority Order
 
 | Priority | Check | Skip Threshold |
@@ -128,19 +120,15 @@ schema_version: 2
 | P5 | Fix breaking changes if minor (< 3 files affected) | Budget < 40% |
 | P6 | Update documentation/README | Budget < 70% |
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Workflow
 
 ### Phase 1 — Breaking Change Analysis
 
 **Steps:**
-1. `view_file` or `read_url` — read official Changelog for target version
+1. `view_file` or `read_url` — read official Changelog for target version. **Đồng thời kiểm tra Security Advisory (CVEs) của version cũ.**
 2. List all `BREAKING CHANGE` entries
 3. Map each breaking change to affected files in current codebase (`grep_search`)
+4. *Lưu ý:* Nếu đây là bản vá bảo mật khẩn cấp (Security Patch), phải ưu tiên nâng cấp ngay cả khi có minor breaking changes, nhưng vẫn tuân thủ rollback plan.
 
 **Decision:**
 ```
@@ -155,11 +143,6 @@ IF > 3 breaking changes OR affects core files
   → Recommend: plan as a dedicated migration project
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ### Phase 2 — Rollback Snapshot
 
 **Steps:**
@@ -173,11 +156,6 @@ schema_version: 2
 
 **Exit When:** Rollback procedure documented → go to Phase 3
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ### Phase 3 — Incremental Upgrade
 
 **Steps:**
@@ -194,11 +172,6 @@ IF install fails (peer dep conflict)
   → EXIT: PARTIAL — report conflict, suggest resolution
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ### Phase 4 — Verification
 
 **Steps:**
@@ -219,11 +192,6 @@ IF > 3 tests fail OR core tests fail
   → Provide exact rollback command
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Confidence Model
 
 | Level | Condition | Action |
@@ -232,11 +200,6 @@ schema_version: 2
 | MEDIUM | Changelog read, some uncertainties remain | Proceed with caution, note risks |
 | LOW | Cannot access Changelog or no tests available | EXIT: BLOCKED |
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Severity
 
 | Level | Definition |
@@ -246,11 +209,6 @@ schema_version: 2
 | MEDIUM | Utility library, build tool upgrade |
 | LOW | Dev dependency, formatter upgrade |
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Evidence Format
 
 ```
@@ -261,11 +219,6 @@ Confidence:       [HIGH|MEDIUM|LOW]
 Rollback:         git checkout [tag] OR npm install [name]@[old-version]
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Rollback Procedure (Required Output)
 
 Every upgrade must document:
@@ -277,11 +230,6 @@ Method 2 (npm):  npm install [package]@[previous-version]
 Snapshot tag:    [pre-upgrade-[package]-[date]]
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
 ## Handoff Contract
 
 ### Consumes
@@ -301,22 +249,25 @@ schema_version: 2
 }
 ```
 
-skill_version: 7.5.0
-runtime_version: 1
-schema_version: 2
----
-
-
 ---
 
 ## Escalation Rules
-
-
+```
+BLOCKED: Missing rollback plan
+Questions:
+  1. Bạn muốn rollback bằng git tag hay snapshot?
+  2. Có test suite nào để chạy sau khi upgrade không?
+Recommended Assumptions: none
+```
 ---
 
 ## Retry Policy
-
-
+```
+Install fails due to peer conflict
+  └─ run with --legacy-peer-deps
+       ├─ PASS → log as PARTIAL
+       └─ FAIL → DO NOT retry again
+```
 ---
 ## Exit Codes
 
@@ -329,4 +280,3 @@ schema_version: 2
 
 ---
 
-