cc-codeconductor 0.5.0 → 1.1.0

package/presets/agy/skills/security-incident-response/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-incident-response
+description: >
+  Coordinate containment, eradication, and recovery for an authorized incident. Preserve evidence, communicate facts, and avoid destructive actions without approval.
+---
+
+# Incident Response
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Follow the org IR plan: detect, contain, eradicate, recover, lessons
+- Preserve logs and disk images before reboot or wipe
+- Redact secrets from tickets and chat
+- Track timeline, systems, and decision-makers
+
+## Do not
+
+- Wipe systems before evidence capture unless imminent ransomware spread is approved
+- Blame individuals in the working notes; stick to systems and facts
+- Reuse attacker tooling from the incident as a 'test'
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-incident-response`.
+Example prompts:
+
+- `P1: suspected token theft on api-prod. Draft containment and evidence steps for the IR commander.`
+- `After containment, write the lessons-learned outline and the regression tests we should add.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-log-analysis/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-log-analysis
+description: >
+  Query and interpret security logs you are authorized to read. Build detections and investigations without leaking PII.
+---
+
+# Security Log Analysis
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Minimize PII in saved queries and screenshots
+- Time-box queries; record the query and the index in the ticket
+- Correlate identity, source IP, and resource — not just a single field
+
+## Do not
+
+- Export full production logs to a laptop or public gist
+- Query other customers' tenants in a multi-tenant SaaS
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-log-analysis`.
+Example prompts:
+
+- `Find failed logins then a success from a new country for our IdP (last 24h).`
+- `Explain this CloudTrail burst: is it deploy automation or a key leak?`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-malware-analysis/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-malware-analysis
+description: >
+  Analyze suspicious artifacts in an isolated lab to contain and recover. For incident responders on owned estates. Never write, improve, or distribute malware.
+---
+
+# Defensive Malware Analysis
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Work only in an isolated lab with no production credentials
+- Capture IOCs, family labels, and containment steps for the IR ticket
+- Prefer vendor/sandbox reports plus hash look-ups over sample execution when possible
+
+## Do not
+
+- Write, compile, or 'improve' malware, ransomware, or wipers
+- Share live samples outside the IR chain of custody
+- Give attackers persistence or packing recipes
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-malware-analysis`.
+Example prompts:
+
+- `A phishing attachment landed in our sandbox hash X. Summarize likely objectives and containment for IR — do not recreate the sample.`
+- `Translate this EDR alert into a containment checklist for our Windows fleet.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-mobile/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-mobile
+description: >
+  Harden iOS/Android apps you ship: storage, TLS pinning policy, IPC, and backend trust. You still enforce authz on the server.
+---
+
+# Mobile App Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Assume the client is hostile; enforce authz on APIs
+- Review local storage, backup flags, and WebView URLs
+- Pin or constrain TLS per org policy; never ship debug trust-all
+
+## Do not
+
+- Provide IPA/APK cracking or cert-unpinning recipes for others' apps
+- Store long-lived tokens in world-readable prefs
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-mobile`.
+Example prompts:
+
+- `Review Android SharedPreferences usage for tokens in this module.`
+- `Check that certificate pinning failures fail closed in release builds.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-network/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-network
+description: >
+  Harden network architecture, segmentation, TLS, and allowlists for systems you operate. Defensive design and review only.
+---
+
+# Network Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Prefer deny-by-default, least privilege, and explicit allowlists
+- Review security groups, NACLs, and mesh policies against the threat model
+- Require TLS with modern ciphers; flag plaintext admin paths
+
+## Do not
+
+- Provide packet-crafting or MITM instructions against third-party networks
+- Open 0.0.0.0/0 'just for debugging' in production
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-network`.
+Example prompts:
+
+- `Review terraform for the prod VPC: public subnets, SG ingress, and admin jump box.`
+- `Propose segmentation between PCI and non-PCI subnets with testable terraform assertions.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-ot-ics/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-ot-ics
+description: >
+  Advise on defensive security for industrial control systems you operate. Safety first. No process-disruption guidance.
+---
+
+# OT / ICS Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Separate OT networks; no direct internet to PLCs
+- Change default credentials; document who can stop a line
+- Patch with maintenance windows; test on a replica
+
+## Do not
+
+- Suggest actions that could halt unsafe physical processes
+- Scan or 'test' live safety systems without OT engineering approval
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-ot-ics`.
+Example prompts:
+
+- `Review the jump-host design between IT and the plant VLAN.`
+- `Draft a change window checklist for a PLC firmware update.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-recon/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-recon
+description: >
+  Map owned assets, attack surface, and inventory for systems the requester is authorized to assess. Use for asset discovery, service catalogs, and exposure reviews — never unauthorized scanning.
+---
+
+# Authorized Reconnaissance
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Inventory hosts, services, and identities the authorization letter names
+- Prefer read-only, rate-limited discovery against owned environments
+- Record data sources (CMDB, cloud APIs, repo maps) in the Task Card
+- Flag shadow IT only to the asset owner
+
+## Do not
+
+- Scan networks, IPs, or tenants outside the authorization window
+- Use third-party scanners against production without change control
+- Store credentials, tokens, or dumps in the skill output
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-recon`.
+Example prompts:
+
+- `Inventory the staging VPC we own: services, public endpoints, and IAM principals in scope for Q3.`
+- `From this repo, list internet-facing routes and compare them to the authorized asset list.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-red-team/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-red-team
+description: >
+  Plan purple-team / adversary-simulation exercises against systems you are contracted to test. High-level objectives and detection gaps only. No live attack procedures or payloads.
+---
+
+# Authorized Adversary Simulation (Planning)
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Require a rules-of-engagement document before any exercise
+- Map ATT&CK techniques to detections you want to validate
+- Coordinate with blue team; prefer tabletop if production risk is high
+
+## Do not
+
+- Provide exploit steps, malware, phishing kits, or C2 playbooks
+- Run unapproved tests against production
+- Help with unauthorized 'red team' against third parties
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-red-team`.
+Example prompts:
+
+- `Draft ROE and in-scope techniques for an internal purple-team week on staging.`
+- `List detections we should have for credential stuffing against our login — no attack scripts.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-reverse-engineering/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-reverse-engineering
+description: >
+  Analyze binaries or protocols you own (or have license to inspect) to improve security, compatibility, or incident response. Not for cracking, DRM bypass, or malware creation.
+---
+
+# Authorized Reverse Engineering
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Confirm license and ownership before inspecting a binary
+- Focus on trust boundaries, crypto misuse, and update integrity
+- Document findings as hardening tasks with tests where code exists
+
+## Do not
+
+- Bypass license checks, DRM, or access controls you do not own
+- Publish unpacking or unpacker tutorials for third-party software
+- Produce malware droppers or obfuscators
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-reverse-engineering`.
+Example prompts:
+
+- `Review our firmware update signer: how is the public key pinned, and what tests prove tamper detection?`
+- `Map native JNI entrypoints in our Android app for unsafe string concatenation.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-soc-automation/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-soc-automation
+description: >
+  Automate detection, enrichment, and response playbooks for a SOC you operate. Keep humans in the loop for destructive actions.
+---
+
+# SOC Automation
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Automate enrichment (WHOIS, asset owner, hash reputation) not auto-wipe
+- Version playbooks; require approval for isolate/disable-user actions
+- Test detections with synthetic events in a lab tenant
+
+## Do not
+
+- Auto-disable production users or servers without an approval gate
+- Pipe raw secrets from tickets into chat webhooks
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-soc-automation`.
+Example prompts:
+
+- `Draft a SOAR playbook: phishing report → hash lookup → ticket, no auto-containment.`
+- `Turn this Sigma-style idea into a documented detection plus a false-positive test.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-threat-hunting/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-threat-hunting
+description: >
+  Hunt for adversary techniques in telemetry you are authorized to query. Hypothesis-driven, evidence-first, no live offensive operations.
+---
+
+# Threat Hunting
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- State a hypothesis (technique + data source + expected artifact)
+- Query only approved telemetry (SIEM, EDR, cloud logs)
+- Promote confirmed hits to IR with timestamps and host identity
+
+## Do not
+
+- Run offensive tooling on production to 'verify' a hunt
+- Query personal mailboxes or systems outside the authorization scope
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-threat-hunting`.
+Example prompts:
+
+- `Hypothesis: stolen refresh tokens in our IdP logs this week. Query patterns and list follow-ups.`
+- `Hunt for unusual service-account key creation in GCP for project X (authorized).`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-vuln-assessment/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-vuln-assessment
+description: >
+  Plan and report authorized vulnerability assessments on owned systems. Prioritize evidence, severity, and remediations. Do not deliver exploit payloads.
+---
+
+# Vulnerability Assessment
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Use scanner findings plus code review as evidence, not as a scoreboard
+- Map issues to OWASP / CWE and to a concrete fix in the repo
+- Require a reproduction that is safe (config, unit test, or staging)
+- Track false positives explicitly
+
+## Do not
+
+- Ship exploit PoCs, weaponized payloads, or live attack scripts
+- Scan production without a documented freeze and rollback
+- Mark a finding closed without a failing-then-passing test when code changes
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-vuln-assessment`.
+Example prompts:
+
+- `Assess the checkout API in staging (ticket SEC-214). Report exploitable authz gaps as remediations, not exploits.`
+- `Triage SAST results on src/auth and turn confirmed issues into failing tests plus patches.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/skills/security-web/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-web
+description: >
+  Review and harden web apps (authz, XSS, CSRF, SSRF, injection) on code you maintain. Complements the OWASP `security` skill. No exploit kits.
+---
+
+# Web Application Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Enforce authorization on every handler; never rely on the UI
+- Parameterize queries; reject unknown fields
+- Treat cookies, tokens, and redirects as untrusted until validated
+- Add tests for authz, CSRF, and open redirects when you change those paths
+
+## Do not
+
+- Provide XSS or SQLi payloads for use against systems you do not own
+- Disable CSRF or SameSite 'to make local dev easier' in production configs
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-web`.
+Example prompts:
+
+- `Review our Next.js Server Actions for IDOR and CSRF. Propose tests, not exploits.`
+- `Harden the file-upload endpoint: type, size, path containment, and tests.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/agy/workflows/cc-api-contract.md

@@ -9,6 +9,18 @@ description:
 
 API contract request: $ARGUMENTS
 
+## Step 0 — CCEP Bootstrap
+
+Command: `api-contract` (fixed for this workflow — do not infer from user text)
+
+1. Run: `npx cc-codeconductor ccep parse --command api-contract "$ARGUMENTS" --output json`
+2. Run: `npx cc-codeconductor ccep resolve --command api-contract "$ARGUMENTS" --output json`
+3. Run: `npx cc-codeconductor ccep profile api-contract --output json`
+4. After planner/intake JSON is available, run: `npx cc-codeconductor ccep evaluate --command api-contract --input <planner.json> --output json`. If `stop` is true, show questions or risks and wait for human input.
+5. Delegate to subagents using compiled CCEP prompts — never forward raw `$ARGUMENTS` to planners.
+
+---
+
 ## Step 1 — Task Card validation (task-coach)
 
 Invoke `task-coach` with the request above.

package/presets/agy/workflows/cc-ask.md

@@ -0,0 +1,56 @@
+---
+description: >-
+  [cc: alias] Recommend one CodeConductor slash command from a natural-language
+  problem. Does not start that workflow.
+---
+
+# Ask — recommend a slash command
+
+Problem: $ARGUMENTS
+
+This is a **router**, not a delivery workflow. Recommend exactly one command.
+Do **not** run the recommended `/cc:` command unless the human confirms.
+
+---
+
+## Step 1 — Recommend (deterministic)
+
+Run (local repo: `bun run dev`; published package: `npx cc-codeconductor`):
+
+```bash
+bun run dev ask "$ARGUMENTS" --output json
+```
+
+or:
+
+```bash
+npx cc-codeconductor ask "$ARGUMENTS" --output json
+```
+
+The catalog is only:
+
+| Slash | When |
+| ----- | ---- |
+| `/cc:feature` | new behavior |
+| `/cc:fix` | bug / regression |
+| `/cc:refactor` | structure, no behavior change |
+| `/cc:review` | inspect a diff/PR |
+| `/cc:tdd-cycle` | red → green → refactor |
+| `/cc:backlog` | create or append BACKLOG.md / objectives |
+| `/cc:openspec` | BACKLOG / BC-xxx delivery |
+
+If the CLI is unavailable, apply the same catalog and the same priority:
+backlog (author) vs openspec (deliver) → tdd-cycle → review → refactor → fix → feature (default).
+
+---
+
+## Step 2 — Show and stop
+
+Print:
+
+- **Recommended:** the slash command
+- **Why:** one or two sentences from the CLI `reason` (or your matching)
+
+**STOP.** Wait for the human. Do not invoke the recommended workflow.
+
+For a full preset inventory (skills, commands on disk), use `/cc:help` / `cc-help`.