cc-codeconductor 0.5.0 → 1.1.0

package/presets/opencode/skills/security-blue-team/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-blue-team
+description: >
+  Improve detections, hardening, and response for the estate you defend. Detection-as-code and control design, not offense.
+---
+
+# Blue Team Defense
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Tune detections for true positives; document exceptions
+- Pair every new control with a test or canary
+- Share hunt hypotheses with IR, not with the public internet
+
+## Do not
+
+- Disable EDR or logging to 'reduce noise' without a ticket
+- Copy attacker malware into production 'for training'
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-blue-team`.
+Example prompts:
+
+- `We missed a token-replay. Propose a detection plus a unit test for the API gateway.`
+- `Harden CI: pin actions, require reviews on workflows that deploy.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-cloud/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-cloud
+description: >
+  Harden IAM, storage, keys, and org policies in cloud accounts you administer. Focus on identity, logging, and public-exposure controls.
+---
+
+# Cloud Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Prefer roles over long-lived keys; require MFA on human admins
+- Block public buckets and overly broad IAM `*` unless justified
+- Turn on cloud audit logs and retain them per policy
+
+## Do not
+
+- Disable logging or GuardDuty/Security Command Center 'to save cost' without a recorded exception
+- Share account credentials in chat or tickets
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-cloud`.
+Example prompts:
+
+- `Audit this AWS account's IAM: unused keys, admin wildcards, and public S3.`
+- `Write a policy-as-code check that fails CI if a bucket ACL is public.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-crypto/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-crypto
+description: >
+  Choose and review cryptographic usage in your codebase: TLS, hashing, KMS, secret storage. Prefer standard libraries and vetted constructions.
+---
+
+# Applied Cryptography
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Use platform TLS and KMS; do not invent protocols
+- Hash passwords with a memory-hard KDF; never roll your own
+- Keep keys out of git; rotate on leak
+
+## Do not
+
+- Recommend ECB, MD5 for security, or home-grown ciphers
+- Ask models to 'break' or weaken crypto for a CTF against third parties
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-crypto`.
+Example prompts:
+
+- `Review how we store refresh tokens. Propose KMS envelope encryption and tests.`
+- `Replace SHA-1 password hashes in this legacy module with a modern KDF and a migration plan.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-exploit-dev/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-exploit-dev
+description: >
+  Understand how a confirmed vulnerability in an owned system is triggered so you can patch and test it. This is not exploit development for offense. No payloads, malware, or attack procedures.
+---
+
+# Defensive Exploit Analysis (Authorized)
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Describe the bug class (e.g. missing authz) at a design level
+- Write a regression test that fails before the fix and passes after
+- Prefer sanitizers, type systems, and least-privilege patches
+- Stop and refuse if the user asks for a working exploit, PoC payload, or bypass kit
+
+## Do not
+
+- Write exploits, exploit PoCs, shellcode, or weaponized requests
+- Document step-by-step attack procedures against any system
+- Help with CTF flags, cracking, or unauthorized access
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-exploit-dev`.
+Example prompts:
+
+- `We confirmed IDOR on /invoices/:id in our app. Help design the authz check and a RED test — no exploit.`
+- `Turn this crash report from our fuzzer into a defensive patch and a regression test.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-grc/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-grc
+description: >
+  Map controls to SOC2, ISO 27001, PCI, or internal policy for the org you work for. Evidence and control design — not audit theater.
+---
+
+# GRC / Compliance Engineering
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Map each control to an owner, evidence path, and test
+- Prefer automated evidence (CI, IaC, tickets) over screenshots
+- Record exceptions with expiry dates
+
+## Do not
+
+- Fabricate evidence or backdate approvals
+- Copy another company's policies without legal review
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-grc`.
+Example prompts:
+
+- `Map our GitHub branch protection to SOC2 CC6.6 and list evidence.`
+- `List gaps: secrets in git, missing MFA on GitHub org owners.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-incident-response/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-incident-response
+description: >
+  Coordinate containment, eradication, and recovery for an authorized incident. Preserve evidence, communicate facts, and avoid destructive actions without approval.
+---
+
+# Incident Response
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Follow the org IR plan: detect, contain, eradicate, recover, lessons
+- Preserve logs and disk images before reboot or wipe
+- Redact secrets from tickets and chat
+- Track timeline, systems, and decision-makers
+
+## Do not
+
+- Wipe systems before evidence capture unless imminent ransomware spread is approved
+- Blame individuals in the working notes; stick to systems and facts
+- Reuse attacker tooling from the incident as a 'test'
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-incident-response`.
+Example prompts:
+
+- `P1: suspected token theft on api-prod. Draft containment and evidence steps for the IR commander.`
+- `After containment, write the lessons-learned outline and the regression tests we should add.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-log-analysis/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-log-analysis
+description: >
+  Query and interpret security logs you are authorized to read. Build detections and investigations without leaking PII.
+---
+
+# Security Log Analysis
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Minimize PII in saved queries and screenshots
+- Time-box queries; record the query and the index in the ticket
+- Correlate identity, source IP, and resource — not just a single field
+
+## Do not
+
+- Export full production logs to a laptop or public gist
+- Query other customers' tenants in a multi-tenant SaaS
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-log-analysis`.
+Example prompts:
+
+- `Find failed logins then a success from a new country for our IdP (last 24h).`
+- `Explain this CloudTrail burst: is it deploy automation or a key leak?`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-malware-analysis/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-malware-analysis
+description: >
+  Analyze suspicious artifacts in an isolated lab to contain and recover. For incident responders on owned estates. Never write, improve, or distribute malware.
+---
+
+# Defensive Malware Analysis
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Work only in an isolated lab with no production credentials
+- Capture IOCs, family labels, and containment steps for the IR ticket
+- Prefer vendor/sandbox reports plus hash look-ups over sample execution when possible
+
+## Do not
+
+- Write, compile, or 'improve' malware, ransomware, or wipers
+- Share live samples outside the IR chain of custody
+- Give attackers persistence or packing recipes
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-malware-analysis`.
+Example prompts:
+
+- `A phishing attachment landed in our sandbox hash X. Summarize likely objectives and containment for IR — do not recreate the sample.`
+- `Translate this EDR alert into a containment checklist for our Windows fleet.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-mobile/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-mobile
+description: >
+  Harden iOS/Android apps you ship: storage, TLS pinning policy, IPC, and backend trust. You still enforce authz on the server.
+---
+
+# Mobile App Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Assume the client is hostile; enforce authz on APIs
+- Review local storage, backup flags, and WebView URLs
+- Pin or constrain TLS per org policy; never ship debug trust-all
+
+## Do not
+
+- Provide IPA/APK cracking or cert-unpinning recipes for others' apps
+- Store long-lived tokens in world-readable prefs
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-mobile`.
+Example prompts:
+
+- `Review Android SharedPreferences usage for tokens in this module.`
+- `Check that certificate pinning failures fail closed in release builds.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-network/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-network
+description: >
+  Harden network architecture, segmentation, TLS, and allowlists for systems you operate. Defensive design and review only.
+---
+
+# Network Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Prefer deny-by-default, least privilege, and explicit allowlists
+- Review security groups, NACLs, and mesh policies against the threat model
+- Require TLS with modern ciphers; flag plaintext admin paths
+
+## Do not
+
+- Provide packet-crafting or MITM instructions against third-party networks
+- Open 0.0.0.0/0 'just for debugging' in production
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-network`.
+Example prompts:
+
+- `Review terraform for the prod VPC: public subnets, SG ingress, and admin jump box.`
+- `Propose segmentation between PCI and non-PCI subnets with testable terraform assertions.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-ot-ics/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-ot-ics
+description: >
+  Advise on defensive security for industrial control systems you operate. Safety first. No process-disruption guidance.
+---
+
+# OT / ICS Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Separate OT networks; no direct internet to PLCs
+- Change default credentials; document who can stop a line
+- Patch with maintenance windows; test on a replica
+
+## Do not
+
+- Suggest actions that could halt unsafe physical processes
+- Scan or 'test' live safety systems without OT engineering approval
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-ot-ics`.
+Example prompts:
+
+- `Review the jump-host design between IT and the plant VLAN.`
+- `Draft a change window checklist for a PLC firmware update.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-recon/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-recon
+description: >
+  Map owned assets, attack surface, and inventory for systems the requester is authorized to assess. Use for asset discovery, service catalogs, and exposure reviews — never unauthorized scanning.
+---
+
+# Authorized Reconnaissance
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Inventory hosts, services, and identities the authorization letter names
+- Prefer read-only, rate-limited discovery against owned environments
+- Record data sources (CMDB, cloud APIs, repo maps) in the Task Card
+- Flag shadow IT only to the asset owner
+
+## Do not
+
+- Scan networks, IPs, or tenants outside the authorization window
+- Use third-party scanners against production without change control
+- Store credentials, tokens, or dumps in the skill output
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-recon`.
+Example prompts:
+
+- `Inventory the staging VPC we own: services, public endpoints, and IAM principals in scope for Q3.`
+- `From this repo, list internet-facing routes and compare them to the authorized asset list.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-red-team/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-red-team
+description: >
+  Plan purple-team / adversary-simulation exercises against systems you are contracted to test. High-level objectives and detection gaps only. No live attack procedures or payloads.
+---
+
+# Authorized Adversary Simulation (Planning)
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Require a rules-of-engagement document before any exercise
+- Map ATT&CK techniques to detections you want to validate
+- Coordinate with blue team; prefer tabletop if production risk is high
+
+## Do not
+
+- Provide exploit steps, malware, phishing kits, or C2 playbooks
+- Run unapproved tests against production
+- Help with unauthorized 'red team' against third parties
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-red-team`.
+Example prompts:
+
+- `Draft ROE and in-scope techniques for an internal purple-team week on staging.`
+- `List detections we should have for credential stuffing against our login — no attack scripts.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-reverse-engineering/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-reverse-engineering
+description: >
+  Analyze binaries or protocols you own (or have license to inspect) to improve security, compatibility, or incident response. Not for cracking, DRM bypass, or malware creation.
+---
+
+# Authorized Reverse Engineering
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Confirm license and ownership before inspecting a binary
+- Focus on trust boundaries, crypto misuse, and update integrity
+- Document findings as hardening tasks with tests where code exists
+
+## Do not
+
+- Bypass license checks, DRM, or access controls you do not own
+- Publish unpacking or unpacker tutorials for third-party software
+- Produce malware droppers or obfuscators
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-reverse-engineering`.
+Example prompts:
+
+- `Review our firmware update signer: how is the public key pinned, and what tests prove tamper detection?`
+- `Map native JNI entrypoints in our Android app for unsafe string concatenation.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/opencode/skills/security-soc-automation/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-soc-automation
+description: >
+  Automate detection, enrichment, and response playbooks for a SOC you operate. Keep humans in the loop for destructive actions.
+---
+
+# SOC Automation
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Automate enrichment (WHOIS, asset owner, hash reputation) not auto-wipe
+- Version playbooks; require approval for isolate/disable-user actions
+- Test detections with synthetic events in a lab tenant
+
+## Do not
+
+- Auto-disable production users or servers without an approval gate
+- Pipe raw secrets from tickets into chat webhooks
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-soc-automation`.
+Example prompts:
+
+- `Draft a SOAR playbook: phishing report → hash lookup → ticket, no auto-containment.`
+- `Turn this Sigma-style idea into a documented detection plus a false-positive test.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`