cc-codeconductor 1.0.0 → 1.1.0

package/presets/claude/skills/security-log-analysis/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-log-analysis
+description: >
+  Query and interpret security logs you are authorized to read. Build detections and investigations without leaking PII.
+---
+
+# Security Log Analysis
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Minimize PII in saved queries and screenshots
+- Time-box queries; record the query and the index in the ticket
+- Correlate identity, source IP, and resource — not just a single field
+
+## Do not
+
+- Export full production logs to a laptop or public gist
+- Query other customers' tenants in a multi-tenant SaaS
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-log-analysis`.
+Example prompts:
+
+- `Find failed logins then a success from a new country for our IdP (last 24h).`
+- `Explain this CloudTrail burst: is it deploy automation or a key leak?`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-malware-analysis/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-malware-analysis
+description: >
+  Analyze suspicious artifacts in an isolated lab to contain and recover. For incident responders on owned estates. Never write, improve, or distribute malware.
+---
+
+# Defensive Malware Analysis
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Work only in an isolated lab with no production credentials
+- Capture IOCs, family labels, and containment steps for the IR ticket
+- Prefer vendor/sandbox reports plus hash look-ups over sample execution when possible
+
+## Do not
+
+- Write, compile, or 'improve' malware, ransomware, or wipers
+- Share live samples outside the IR chain of custody
+- Give attackers persistence or packing recipes
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-malware-analysis`.
+Example prompts:
+
+- `A phishing attachment landed in our sandbox hash X. Summarize likely objectives and containment for IR — do not recreate the sample.`
+- `Translate this EDR alert into a containment checklist for our Windows fleet.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-mobile/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-mobile
+description: >
+  Harden iOS/Android apps you ship: storage, TLS pinning policy, IPC, and backend trust. You still enforce authz on the server.
+---
+
+# Mobile App Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Assume the client is hostile; enforce authz on APIs
+- Review local storage, backup flags, and WebView URLs
+- Pin or constrain TLS per org policy; never ship debug trust-all
+
+## Do not
+
+- Provide IPA/APK cracking or cert-unpinning recipes for others' apps
+- Store long-lived tokens in world-readable prefs
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-mobile`.
+Example prompts:
+
+- `Review Android SharedPreferences usage for tokens in this module.`
+- `Check that certificate pinning failures fail closed in release builds.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-network/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-network
+description: >
+  Harden network architecture, segmentation, TLS, and allowlists for systems you operate. Defensive design and review only.
+---
+
+# Network Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Prefer deny-by-default, least privilege, and explicit allowlists
+- Review security groups, NACLs, and mesh policies against the threat model
+- Require TLS with modern ciphers; flag plaintext admin paths
+
+## Do not
+
+- Provide packet-crafting or MITM instructions against third-party networks
+- Open 0.0.0.0/0 'just for debugging' in production
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-network`.
+Example prompts:
+
+- `Review terraform for the prod VPC: public subnets, SG ingress, and admin jump box.`
+- `Propose segmentation between PCI and non-PCI subnets with testable terraform assertions.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-ot-ics/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-ot-ics
+description: >
+  Advise on defensive security for industrial control systems you operate. Safety first. No process-disruption guidance.
+---
+
+# OT / ICS Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Separate OT networks; no direct internet to PLCs
+- Change default credentials; document who can stop a line
+- Patch with maintenance windows; test on a replica
+
+## Do not
+
+- Suggest actions that could halt unsafe physical processes
+- Scan or 'test' live safety systems without OT engineering approval
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-ot-ics`.
+Example prompts:
+
+- `Review the jump-host design between IT and the plant VLAN.`
+- `Draft a change window checklist for a PLC firmware update.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-recon/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-recon
+description: >
+  Map owned assets, attack surface, and inventory for systems the requester is authorized to assess. Use for asset discovery, service catalogs, and exposure reviews — never unauthorized scanning.
+---
+
+# Authorized Reconnaissance
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Inventory hosts, services, and identities the authorization letter names
+- Prefer read-only, rate-limited discovery against owned environments
+- Record data sources (CMDB, cloud APIs, repo maps) in the Task Card
+- Flag shadow IT only to the asset owner
+
+## Do not
+
+- Scan networks, IPs, or tenants outside the authorization window
+- Use third-party scanners against production without change control
+- Store credentials, tokens, or dumps in the skill output
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-recon`.
+Example prompts:
+
+- `Inventory the staging VPC we own: services, public endpoints, and IAM principals in scope for Q3.`
+- `From this repo, list internet-facing routes and compare them to the authorized asset list.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-red-team/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-red-team
+description: >
+  Plan purple-team / adversary-simulation exercises against systems you are contracted to test. High-level objectives and detection gaps only. No live attack procedures or payloads.
+---
+
+# Authorized Adversary Simulation (Planning)
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Require a rules-of-engagement document before any exercise
+- Map ATT&CK techniques to detections you want to validate
+- Coordinate with blue team; prefer tabletop if production risk is high
+
+## Do not
+
+- Provide exploit steps, malware, phishing kits, or C2 playbooks
+- Run unapproved tests against production
+- Help with unauthorized 'red team' against third parties
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-red-team`.
+Example prompts:
+
+- `Draft ROE and in-scope techniques for an internal purple-team week on staging.`
+- `List detections we should have for credential stuffing against our login — no attack scripts.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-reverse-engineering/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-reverse-engineering
+description: >
+  Analyze binaries or protocols you own (or have license to inspect) to improve security, compatibility, or incident response. Not for cracking, DRM bypass, or malware creation.
+---
+
+# Authorized Reverse Engineering
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Confirm license and ownership before inspecting a binary
+- Focus on trust boundaries, crypto misuse, and update integrity
+- Document findings as hardening tasks with tests where code exists
+
+## Do not
+
+- Bypass license checks, DRM, or access controls you do not own
+- Publish unpacking or unpacker tutorials for third-party software
+- Produce malware droppers or obfuscators
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-reverse-engineering`.
+Example prompts:
+
+- `Review our firmware update signer: how is the public key pinned, and what tests prove tamper detection?`
+- `Map native JNI entrypoints in our Android app for unsafe string concatenation.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-soc-automation/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-soc-automation
+description: >
+  Automate detection, enrichment, and response playbooks for a SOC you operate. Keep humans in the loop for destructive actions.
+---
+
+# SOC Automation
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Automate enrichment (WHOIS, asset owner, hash reputation) not auto-wipe
+- Version playbooks; require approval for isolate/disable-user actions
+- Test detections with synthetic events in a lab tenant
+
+## Do not
+
+- Auto-disable production users or servers without an approval gate
+- Pipe raw secrets from tickets into chat webhooks
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-soc-automation`.
+Example prompts:
+
+- `Draft a SOAR playbook: phishing report → hash lookup → ticket, no auto-containment.`
+- `Turn this Sigma-style idea into a documented detection plus a false-positive test.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-threat-hunting/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-threat-hunting
+description: >
+  Hunt for adversary techniques in telemetry you are authorized to query. Hypothesis-driven, evidence-first, no live offensive operations.
+---
+
+# Threat Hunting
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- State a hypothesis (technique + data source + expected artifact)
+- Query only approved telemetry (SIEM, EDR, cloud logs)
+- Promote confirmed hits to IR with timestamps and host identity
+
+## Do not
+
+- Run offensive tooling on production to 'verify' a hunt
+- Query personal mailboxes or systems outside the authorization scope
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-threat-hunting`.
+Example prompts:
+
+- `Hypothesis: stolen refresh tokens in our IdP logs this week. Query patterns and list follow-ups.`
+- `Hunt for unusual service-account key creation in GCP for project X (authorized).`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-vuln-assessment/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-vuln-assessment
+description: >
+  Plan and report authorized vulnerability assessments on owned systems. Prioritize evidence, severity, and remediations. Do not deliver exploit payloads.
+---
+
+# Vulnerability Assessment
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Use scanner findings plus code review as evidence, not as a scoreboard
+- Map issues to OWASP / CWE and to a concrete fix in the repo
+- Require a reproduction that is safe (config, unit test, or staging)
+- Track false positives explicitly
+
+## Do not
+
+- Ship exploit PoCs, weaponized payloads, or live attack scripts
+- Scan production without a documented freeze and rollback
+- Mark a finding closed without a failing-then-passing test when code changes
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-vuln-assessment`.
+Example prompts:
+
+- `Assess the checkout API in staging (ticket SEC-214). Report exploitable authz gaps as remediations, not exploits.`
+- `Triage SAST results on src/auth and turn confirmed issues into failing tests plus patches.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/claude/skills/security-web/SKILL.md

@@ -0,0 +1,44 @@
+---
+name: security-web
+description: >
+  Review and harden web apps (authz, XSS, CSRF, SSRF, injection) on code you maintain. Complements the OWASP `security` skill. No exploit kits.
+---
+
+# Web Application Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Enforce authorization on every handler; never rely on the UI
+- Parameterize queries; reject unknown fields
+- Treat cookies, tokens, and redirects as untrusted until validated
+- Add tests for authz, CSRF, and open redirects when you change those paths
+
+## Do not
+
+- Provide XSS or SQLi payloads for use against systems you do not own
+- Disable CSRF or SameSite 'to make local dev easier' in production configs
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-web`.
+Example prompts:
+
+- `Review our Next.js Server Actions for IDOR and CSRF. Propose tests, not exploits.`
+- `Harden the file-upload endpoint: type, size, path containment, and tests.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/codex/commands/cc-ask.md

@@ -36,10 +36,11 @@ The catalog is only:
 | `/cc:refactor` | structure, no behavior change |
 | `/cc:review` | inspect a diff/PR |
 | `/cc:tdd-cycle` | red → green → refactor |
+| `/cc:backlog` | create or append BACKLOG.md / objectives |
 | `/cc:openspec` | BACKLOG / BC-xxx delivery |
 
 If the CLI is unavailable, apply the same catalog and the same priority:
-openspec → tdd-cycle → review → refactor → fix → feature (default).
+backlog (author) vs openspec (deliver) → tdd-cycle → review → refactor → fix → feature (default).
 
 ---
 

package/presets/codex/gates/pre-commit/GATE.md

@@ -1,6 +1,6 @@
-# Pre-commit Gate: Typecheck and Test
+# Pre-commit Gate: Typecheck, Lint, and Test
 
-Este gate instala un hook `pre-commit` que ejecuta `bun run typecheck` y `bun run test` antes de permitir commits en el repositorio. Si cualquiera de estos comandos falla, el commit es bloqueado.
+Este gate instala un hook `pre-commit` que ejecuta `bun run typecheck`, `bun run lint` y `bun run test` antes de permitir commits en el repositorio. Si cualquiera de estos comandos falla, el commit es bloqueado.
 
 ## Cuándo usar
 
@@ -63,6 +63,7 @@ mkdir -p "$GIT_DIR/hooks"
 cat > "$HOOK_PATH" << 'HOOK_EOF'
 #!/bin/bash
 bun run typecheck || exit 1
+bun run lint || exit 1
 bun run test || exit 1
 HOOK_EOF
 
@@ -78,7 +79,7 @@ echo "Pre-commit hook installed successfully."
 - **Resolución dinámica de git dir**: Usa `git rev-parse --git-dir` para localizar el directorio correcto, incluso en worktrees.
 - **Detección de conflictos**: Si Husky o lint-staged ya está en `package.json`, el script avisa y no instala para evitar conflictos.
 - **Protección de hooks existentes**: Si ya existe un `.git/hooks/pre-commit`, el script no lo sobrescribe.
-- **Solo Bun**: El hook ejecuta `bun run typecheck` y `bun run test`. Asegúrate de que estos scripts están definidos en `package.json`.
+- **Solo Bun**: El hook ejecuta `bun run typecheck`, `bun run lint` y `bun run test`. Asegúrate de que estos scripts están definidos en `package.json`.
 
 ## Verificación
 
@@ -121,7 +122,7 @@ Verifica que el hook es ejecutable:
 
     chmod +x .git/hooks/pre-commit
 
-Verifica que `bun run typecheck` y `bun run test` existen en `package.json`:
+Verifica que `bun run typecheck`, `bun run lint` y `bun run test` existen en `package.json`:
 
     cat package.json | grep -A 5 '"scripts"'
 

package/presets/cursor/AGENTS.md

@@ -391,8 +391,8 @@ definition, or the DDD→SDD→TDD pipeline is triggered.
 When the active task touches stack-specific code, apply rules in `.cursor/skills/`.
 Invoke skills via `/skill-name` or let the agent auto-load scoped skills.
 
-Key skills: `security`, `django-orm`, `spring-boot-kotlin`, `nextjs-typescript`,
-`laravel-specialist`, `openspec`, `evaluation`, `multi-agent-orchestration`.
+Key skills: `security`, `security-*`, `django-orm`, `spring-boot-kotlin`, `nextjs-typescript`,
+`laravel-specialist`, `openspec`, `backlog`, `evaluation`, `multi-agent-orchestration`.
 
 ## Hard Rules (all agents)
 

package/presets/cursor/commands/cc/ask.md

@@ -36,10 +36,11 @@ The catalog is only:
 | `/cc:refactor` | structure, no behavior change |
 | `/cc:review` | inspect a diff/PR |
 | `/cc:tdd-cycle` | red → green → refactor |
+| `/cc:backlog` | create or append BACKLOG.md / objectives |
 | `/cc:openspec` | BACKLOG / BC-xxx delivery |
 
 If the CLI is unavailable, apply the same catalog and the same priority:
-openspec → tdd-cycle → review → refactor → fix → feature (default).
+backlog (author) vs openspec (deliver) → tdd-cycle → review → refactor → fix → feature (default).
 
 ---