cc-codeconductor 1.0.0 → 1.1.0

package/presets/claude/skills/security/SKILL.md

@@ -0,0 +1,382 @@
+---
+id: security
+version: 1.0.0
+name: Security
+description: >
+  Provides expert knowledge for implementing and reviewing application security following OWASP Top 10 (2021), with stack-specific patterns for Spring Boot, Django, Next.js, and Astro.
+
+user-invokable: true
+license: MIT
+metadata:
+  author: lgzarturo
+  category: security
+
+compatibility:
+  tools: [claude, codex, gemini, agy, opencode]
+  stacks:
+    languages: []
+    frameworks: []
+
+risk:
+  level: high
+  can_execute_shell: false
+  can_modify_files: true
+  requires_network: false
+
+inputs: []
+
+outputs: []
+
+quality:
+  reviewed_by: codeconductor-core
+  version: 0.1.0
+---
+
+
+
+# Security
+
+## OWASP Top 10 (2021) — Quick Reference
+
+| # | Category | What to check |
+|---|----------|--------------|
+| A01 | Broken Access Control | Is authorization enforced on every endpoint? |
+| A02 | Cryptographic Failures | Are secrets encrypted at rest and in transit? |
+| A03 | Injection | Is all input sanitized or parameterized? |
+| A04 | Insecure Design | Is the threat model documented? |
+| A05 | Security Misconfiguration | Are defaults changed? Debug off in prod? |
+| A06 | Vulnerable Components | Are dependencies up to date? |
+| A07 | Auth & Session Failures | Are sessions invalidated on logout? Token expiry set? |
+| A08 | Software Integrity Failures | Are supply-chain dependencies verified? |
+| A09 | Logging & Monitoring Failures | Are security events logged without leaking PII? |
+| A10 | SSRF | Are outbound URLs allowlisted? |
+
+## Input Validation
+
+Validate all input at system boundaries. Never trust data from: HTTP request
+body, query parameters, headers, cookies, or environment variables passed by
+external systems.
+
+**Rules:**
+
+- Validate type, format, length, and range
+- Reject unknown fields — do not silently ignore them
+- Use allowlists (accept known-good), not blocklists (reject known-bad)
+- Validate at the API layer before it reaches the service layer
+
+```kotlin
+// Spring Boot — Bean Validation
+data class CreateUserRequest(
+    @field:NotBlank @field:Email val email: String,
+    @field:Size(min = 8, max = 72) val password: String,
+    @field:Size(max = 100) val name: String
+)
+
+@PostMapping
+fun createUser(@Valid @RequestBody request: CreateUserRequest): ResponseEntity<UserResponse> {
+    // request is guaranteed valid here
+}
+```
+
+```python
+# Django REST Framework — serializer validation
+class CreateUserSerializer(serializers.Serializer):
+    email = serializers.EmailField(max_length=254)
+    password = serializers.CharField(min_length=8, max_length=72, write_only=True)
+    name = serializers.CharField(max_length=100)
+
+    def validate_email(self, value):
+        if User.objects.filter(email=value).exists():
+            raise serializers.ValidationError("Email already registered.")
+        return value.lower()
+```
+
+```typescript
+// Next.js / Astro — Zod
+import { z } from 'zod';
+
+const CreateUserSchema = z.object({
+  email: z.string().email().max(254),
+  password: z.string().min(8).max(72),
+  name: z.string().max(100),
+});
+
+const result = CreateUserSchema.safeParse(body);
+if (!result.success) {
+  return Response.json({ error: result.error.flatten() }, { status: 400 });
+}
+```
+
+## Authentication
+
+### JWT (Stateless)
+
+Use JWTs for stateless API authentication. Keep access tokens short-lived.
+
+**Token lifetimes:**
+
+| Token | Lifetime | Storage |
+|-------|----------|---------|
+| Access token | 15 minutes | Memory (never localStorage) |
+| Refresh token | 7–30 days | HttpOnly cookie |
+
+Never store access tokens in `localStorage` — XSS can read them. Store in
+memory (React state, module variable) and refresh via the HttpOnly cookie.
+
+```kotlin
+// Spring Security 6 + JWT
+@Configuration
+@EnableWebSecurity
+class SecurityConfig(private val jwtFilter: JwtAuthenticationFilter) {
+
+    @Bean
+    fun filterChain(http: HttpSecurity): SecurityFilterChain = http
+        .csrf { it.disable() }                         // stateless API — CSRF not needed
+        .sessionManagement { it.sessionCreationPolicy(SessionCreationPolicy.STATELESS) }
+        .authorizeHttpRequests { auth ->
+            auth
+                .requestMatchers("/api/auth/**").permitAll()
+                .requestMatchers("/api/admin/**").hasRole("ADMIN")
+                .anyRequest().authenticated()
+        }
+        .addFilterBefore(jwtFilter, UsernamePasswordAuthenticationFilter::class.java)
+        .build()
+}
+```
+
+```python
+# Django — djangorestframework-simplejwt
+# settings.py
+SIMPLE_JWT = {
+    "ACCESS_TOKEN_LIFETIME": timedelta(minutes=15),
+    "REFRESH_TOKEN_LIFETIME": timedelta(days=7),
+    "ROTATE_REFRESH_TOKENS": True,
+    "BLACKLIST_AFTER_ROTATION": True,
+    "ALGORITHM": "HS256",
+    "AUTH_HEADER_TYPES": ("Bearer",),
+}
+```
+
+```typescript
+// Next.js — Auth.js (NextAuth v5)
+// auth.ts
+import NextAuth from 'next-auth';
+import Credentials from 'next-auth/providers/credentials';
+
+export const { auth, signIn, signOut } = NextAuth({
+  providers: [
+    Credentials({
+      authorize: async (credentials) => {
+        // validate and return user or null
+      },
+    }),
+  ],
+  session: { strategy: 'jwt', maxAge: 7 * 24 * 60 * 60 },
+});
+```
+
+### Password Hashing
+
+Never store plaintext passwords. Never use MD5 or SHA-1 for password hashing.
+
+| Algorithm | Use | Work factor |
+|-----------|-----|-------------|
+| bcrypt | default | cost=12 |
+| Argon2id | preferred when available | m=65536, t=3 |
+| PBKDF2 | FIPS environments | iterations=600000 |
+
+```kotlin
+// Spring Security uses bcrypt by default
+@Bean
+fun passwordEncoder(): PasswordEncoder = BCryptPasswordEncoder(12)
+```
+
+```python
+# Django uses PBKDF2 by default; switch to Argon2 for stronger hashing
+# pip install django[argon2]
+PASSWORD_HASHERS = [
+    "django.contrib.auth.hashers.Argon2PasswordHasher",
+    "django.contrib.auth.hashers.PBKDF2PasswordHasher",  # fallback for existing hashes
+]
+```
+
+## Authorization
+
+**Principle of least privilege:** every endpoint must explicitly declare who
+can access it. Deny by default.
+
+```kotlin
+// Spring — method-level security
+@PreAuthorize("hasRole('ADMIN') or #userId == authentication.name")
+fun getUser(userId: String): UserResponse { ... }
+```
+
+```python
+# Django REST Framework
+class UserDetailView(RetrieveUpdateAPIView):
+    permission_classes = [IsAuthenticated, IsOwnerOrAdmin]
+    queryset = User.objects.all()
+
+class IsOwnerOrAdmin(BasePermission):
+    def has_object_permission(self, request, view, obj):
+        return request.user.is_staff or obj == request.user
+```
+
+Always check authorization at the **object level**, not just the endpoint
+level. An authenticated user should not be able to access another user's data
+by changing an ID in the URL.
+
+## CORS
+
+```kotlin
+// Spring Boot — explicit allowlist; never use "*" in production
+@Bean
+fun corsConfigurationSource(): CorsConfigurationSource {
+    val config = CorsConfiguration().apply {
+        allowedOrigins = listOf("https://app.example.com")
+        allowedMethods = listOf("GET", "POST", "PUT", "DELETE")
+        allowedHeaders = listOf("Authorization", "Content-Type")
+        allowCredentials = true
+        maxAge = 3600L
+    }
+    return UrlBasedCorsConfigurationSource().apply {
+        registerCorsConfiguration("/api/**", config)
+    }
+}
+```
+
+```python
+# Django — django-cors-headers
+CORS_ALLOWED_ORIGINS = [
+    "https://app.example.com",
+]
+CORS_ALLOW_CREDENTIALS = True
+CORS_ALLOW_ALL_ORIGINS = False  # never True in production
+```
+
+## Security Headers
+
+Set these headers on every response. They defend against XSS, clickjacking,
+and MIME sniffing.
+
+```text
+Strict-Transport-Security: max-age=63072000; includeSubDomains; preload
+Content-Security-Policy: default-src 'self'; script-src 'self'; object-src 'none'
+X-Frame-Options: DENY
+X-Content-Type-Options: nosniff
+Referrer-Policy: strict-origin-when-cross-origin
+Permissions-Policy: camera=(), microphone=(), geolocation=()
+```
+
+```typescript
+// Next.js — next.config.ts
+const securityHeaders = [
+  { key: 'X-Frame-Options', value: 'DENY' },
+  { key: 'X-Content-Type-Options', value: 'nosniff' },
+  { key: 'Referrer-Policy', value: 'strict-origin-when-cross-origin' },
+  {
+    key: 'Strict-Transport-Security',
+    value: 'max-age=63072000; includeSubDomains; preload',
+  },
+];
+
+export default {
+  headers: async () => [
+    { source: '/(.*)', headers: securityHeaders },
+  ],
+};
+```
+
+## Secrets Management
+
+**Never commit secrets to source control.** No exceptions.
+
+```text
+✗ DATABASE_URL = "postgres://user:password@prod.example.com/db"  # in source
+✓ DATABASE_URL = env("DATABASE_URL")                              # from environment
+```
+
+Rules:
+
+- Load secrets from environment variables or a secrets manager (AWS Secrets
+  Manager, Vault, GCP Secret Manager)
+- Rotate credentials on any suspected exposure
+- Use separate credentials per environment (dev, staging, prod)
+- Add `.env` to `.gitignore` and never commit it
+
+```python
+# Django — django-environ
+import environ
+env = environ.Env()
+environ.Env.read_env()  # reads .env in development only
+
+SECRET_KEY = env("SECRET_KEY")
+DATABASE_URL = env.db("DATABASE_URL")
+```
+
+## Rate Limiting
+
+Protect authentication endpoints. Brute-force without rate limiting can
+compromise any account with a weak password.
+
+```kotlin
+// Spring Boot — Bucket4j
+@Component
+class RateLimitFilter(private val rateLimiter: RateLimiter) : OncePerRequestFilter() {
+
+    override fun doFilterInternal(request: HttpServletRequest, response: HttpServletResponse, chain: FilterChain) {
+        if (request.requestURI.startsWith("/api/auth/")) {
+            val probe = rateLimiter.tryConsumeAndReturnRemaining(1)
+            if (!probe.isConsumed) {
+                response.status = HttpStatus.TOO_MANY_REQUESTS.value()
+                return
+            }
+        }
+        chain.doFilter(request, response)
+    }
+}
+```
+
+Minimum rate limits for auth endpoints: 5 requests per minute per IP. Stricter
+limits (e.g., 3 per 15 minutes) are better for login endpoints.
+
+## SQL Injection Prevention
+
+Never concatenate user input into SQL strings. Always use parameterized queries
+or an ORM.
+
+```kotlin
+// bad — SQL injection risk
+val user = jdbcTemplate.queryForObject("SELECT * FROM users WHERE email = '$email'")
+
+// good — parameterized
+val user = jdbcTemplate.queryForObject(
+    "SELECT * FROM users WHERE email = ?",
+    UserRowMapper(),
+    email
+)
+```
+
+```python
+# bad
+User.objects.raw(f"SELECT * FROM users WHERE email = '{email}'")
+
+# good — Django ORM handles parameterization automatically
+User.objects.filter(email=email)
+```
+
+## Logging Security Events
+
+Log authentication events without including sensitive data.
+
+```text
+Log:   login success/failure, permission denied, password reset, token refresh
+Never: passwords, tokens, PII (full email in prod logs), credit card numbers
+```
+
+```kotlin
+// Log security events at INFO level; failures at WARN
+log.info("Authentication successful for user={}", userId)
+log.warn("Authentication failed: invalid credentials for user={}", maskedEmail)
+log.warn("Authorization denied: user={} attempted access to resource={}", userId, resourceId)
+```

package/presets/claude/skills/security-ai-llm/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-ai-llm
+description: >
+  Harden LLM and agent integrations you operate: prompt injection, tool allowlists, secret leakage, and supply-chain of models. Defensive only.
+---
+
+# AI / LLM Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Treat model output as untrusted; never exec it without a schema
+- Allowlist tools and paths; contain file writes
+- Keep secrets out of prompts and logs
+
+## Do not
+
+- Help jailbreak third-party products or steal model weights
+- Log raw user PII to prompt-debug stores
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-ai-llm`.
+Example prompts:
+
+- `Review our agent tool runner for path traversal and unbounded shell.`
+- `Add tests that a prompt cannot make the bot dump .env.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-blue-team/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-blue-team
+description: >
+  Improve detections, hardening, and response for the estate you defend. Detection-as-code and control design, not offense.
+---
+
+# Blue Team Defense
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Tune detections for true positives; document exceptions
+- Pair every new control with a test or canary
+- Share hunt hypotheses with IR, not with the public internet
+
+## Do not
+
+- Disable EDR or logging to 'reduce noise' without a ticket
+- Copy attacker malware into production 'for training'
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-blue-team`.
+Example prompts:
+
+- `We missed a token-replay. Propose a detection plus a unit test for the API gateway.`
+- `Harden CI: pin actions, require reviews on workflows that deploy.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-cloud/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-cloud
+description: >
+  Harden IAM, storage, keys, and org policies in cloud accounts you administer. Focus on identity, logging, and public-exposure controls.
+---
+
+# Cloud Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Prefer roles over long-lived keys; require MFA on human admins
+- Block public buckets and overly broad IAM `*` unless justified
+- Turn on cloud audit logs and retain them per policy
+
+## Do not
+
+- Disable logging or GuardDuty/Security Command Center 'to save cost' without a recorded exception
+- Share account credentials in chat or tickets
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-cloud`.
+Example prompts:
+
+- `Audit this AWS account's IAM: unused keys, admin wildcards, and public S3.`
+- `Write a policy-as-code check that fails CI if a bucket ACL is public.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-crypto/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-crypto
+description: >
+  Choose and review cryptographic usage in your codebase: TLS, hashing, KMS, secret storage. Prefer standard libraries and vetted constructions.
+---
+
+# Applied Cryptography
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Use platform TLS and KMS; do not invent protocols
+- Hash passwords with a memory-hard KDF; never roll your own
+- Keep keys out of git; rotate on leak
+
+## Do not
+
+- Recommend ECB, MD5 for security, or home-grown ciphers
+- Ask models to 'break' or weaken crypto for a CTF against third parties
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-crypto`.
+Example prompts:
+
+- `Review how we store refresh tokens. Propose KMS envelope encryption and tests.`
+- `Replace SHA-1 password hashes in this legacy module with a modern KDF and a migration plan.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-exploit-dev/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-exploit-dev
+description: >
+  Understand how a confirmed vulnerability in an owned system is triggered so you can patch and test it. This is not exploit development for offense. No payloads, malware, or attack procedures.
+---
+
+# Defensive Exploit Analysis (Authorized)
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Describe the bug class (e.g. missing authz) at a design level
+- Write a regression test that fails before the fix and passes after
+- Prefer sanitizers, type systems, and least-privilege patches
+- Stop and refuse if the user asks for a working exploit, PoC payload, or bypass kit
+
+## Do not
+
+- Write exploits, exploit PoCs, shellcode, or weaponized requests
+- Document step-by-step attack procedures against any system
+- Help with CTF flags, cracking, or unauthorized access
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-exploit-dev`.
+Example prompts:
+
+- `We confirmed IDOR on /invoices/:id in our app. Help design the authz check and a RED test — no exploit.`
+- `Turn this crash report from our fuzzer into a defensive patch and a regression test.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-grc/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-grc
+description: >
+  Map controls to SOC2, ISO 27001, PCI, or internal policy for the org you work for. Evidence and control design — not audit theater.
+---
+
+# GRC / Compliance Engineering
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Map each control to an owner, evidence path, and test
+- Prefer automated evidence (CI, IaC, tickets) over screenshots
+- Record exceptions with expiry dates
+
+## Do not
+
+- Fabricate evidence or backdate approvals
+- Copy another company's policies without legal review
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-grc`.
+Example prompts:
+
+- `Map our GitHub branch protection to SOC2 CC6.6 and list evidence.`
+- `List gaps: secrets in git, missing MFA on GitHub org owners.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-incident-response/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-incident-response
+description: >
+  Coordinate containment, eradication, and recovery for an authorized incident. Preserve evidence, communicate facts, and avoid destructive actions without approval.
+---
+
+# Incident Response
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Follow the org IR plan: detect, contain, eradicate, recover, lessons
+- Preserve logs and disk images before reboot or wipe
+- Redact secrets from tickets and chat
+- Track timeline, systems, and decision-makers
+
+## Do not
+
+- Wipe systems before evidence capture unless imminent ransomware spread is approved
+- Blame individuals in the working notes; stick to systems and facts
+- Reuse attacker tooling from the incident as a 'test'
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-incident-response`.
+Example prompts:
+
+- `P1: suspected token theft on api-prod. Draft containment and evidence steps for the IR commander.`
+- `After containment, write the lessons-learned outline and the regression tests we should add.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`