cc-codeconductor 1.4.1 → 1.5.0

package/presets/codex/skills/nextjs-typescript/SKILL.md

@@ -0,0 +1,390 @@
+---
+id: nextjs-typescript
+name: nextjs-typescript
+description: >
+  Provides expert knowledge for building Next.js 15+ applications with the App Router, TypeScript, Server Components, Server Actions, and TanStack Query.
+
+user-invokable: true
+license: MIT
+metadata:
+  author: lgzarturo
+  category: frontend
+
+compatibility:
+  tools: [claude, codex, gemini, agy, opencode]
+  stacks:
+    languages: []
+    frameworks: []
+
+risk:
+  level: medium
+  can_execute_shell: false
+  can_modify_files: true
+  requires_network: false
+
+inputs: []
+
+outputs: []
+
+quality:
+  reviewed_by: codeconductor-core
+  version: 0.1.0
+---
+
+
+
+# Next.js + TypeScript
+
+## Server vs Client Components
+
+The App Router defaults to Server Components. Every component is a Server
+Component unless it explicitly opts in to the client.
+
+### Decision Rule
+
+```text
+Does the component need any of the following?
+  - useState / useReducer
+  - useEffect / lifecycle methods
+  - Browser APIs (window, document, localStorage)
+  - Event listeners (onClick, onChange, onSubmit)
+  - Third-party libraries that require the DOM
+
+  YES → Client Component (`"use client"` directive)
+  NO  → Server Component (default, no directive needed)
+```
+
+Keep the `"use client"` boundary as far down the component tree as possible.
+Wrap only the interactive leaf node, not the entire page.
+
+### Server Component (default)
+
+```tsx
+// app/users/page.tsx — no directive needed
+import { db } from '@/lib/db';
+
+export default async function UsersPage() {
+  // Direct database access — no API round-trip needed
+  const users = await db.user.findMany({ orderBy: { createdAt: 'desc' } });
+
+  return (
+    <ul>
+      {users.map(user => (
+        <li key={user.id}>{user.email}</li>
+      ))}
+    </ul>
+  );
+}
+```
+
+### Client Component
+
+```tsx
+// components/ui/counter.tsx
+'use client';
+
+import { useState } from 'react';
+
+interface Props {
+  initialCount?: number;
+}
+
+export function Counter({ initialCount = 0 }: Props) {
+  const [count, setCount] = useState(initialCount);
+  return <button onClick={() => setCount(c => c + 1)}>Count: {count}</button>;
+}
+```
+
+### Composing Server and Client
+
+```tsx
+// app/dashboard/page.tsx — Server Component
+import { Counter } from '@/components/ui/counter';  // Client
+import { getUser } from '@/lib/queries';            // Server-only function
+
+export default async function DashboardPage() {
+  const user = await getUser();  // runs on the server
+
+  return (
+    <div>
+      <h1>Welcome, {user.name}</h1>
+      <Counter initialCount={user.loginCount} />  {/* client island */}
+    </div>
+  );
+}
+```
+
+Passing server data to client components as props is correct. The server
+renders the Server Component tree first, serializes the props, and sends them
+to the client.
+
+## Data Fetching
+
+### Server Component Fetching (recommended for initial data)
+
+```tsx
+// app/posts/[id]/page.tsx
+interface Props {
+  params: Promise<{ id: string }>;
+}
+
+export default async function PostPage({ params }: Props) {
+  const { id } = await params;
+  const post = await fetch(`https://api.example.com/posts/${id}`, {
+    next: { revalidate: 3600 },  // ISR: revalidate every hour
+  }).then(r => r.json());
+
+  if (!post) notFound();
+
+  return <article>{post.title}</article>;
+}
+```
+
+Cache strategies:
+
+| `cache` option | Behavior |
+|----------------|----------|
+| `force-cache` | Cache indefinitely (default for fetch in RSC) |
+| `no-store` | Never cache — fresh on every request |
+| `next: { revalidate: N }` | ISR — revalidate after N seconds |
+| `next: { tags: ['posts'] }` | On-demand revalidation via tag |
+
+### Server Actions (mutations)
+
+Server Actions run on the server. Use them for form submissions and mutations.
+Never use them for reads.
+
+```tsx
+// app/posts/create/actions.ts
+'use server';
+
+import { revalidatePath } from 'next/cache';
+import { redirect } from 'next/navigation';
+import { z } from 'zod';
+import { db } from '@/lib/db';
+
+const CreatePostSchema = z.object({
+  title: z.string().min(1).max(200),
+  content: z.string().min(1),
+});
+
+export async function createPost(formData: FormData) {
+  const parsed = CreatePostSchema.safeParse({
+    title: formData.get('title'),
+    content: formData.get('content'),
+  });
+
+  if (!parsed.success) {
+    return { error: parsed.error.flatten().fieldErrors };
+  }
+
+  await db.post.create({ data: parsed.data });
+
+  revalidatePath('/posts');
+  redirect('/posts');
+}
+```
+
+```tsx
+// app/posts/create/page.tsx
+import { createPost } from './actions';
+
+export default function CreatePostPage() {
+  return (
+    <form action={createPost}>
+      <input name="title" type="text" required />
+      <textarea name="content" required />
+      <button type="submit">Create</button>
+    </form>
+  );
+}
+```
+
+Rules for Server Actions:
+
+- Always validate input with Zod — do not trust `FormData` values
+- Return error objects for validation failures; use `redirect()` for success
+- Call `revalidatePath()` or `revalidateTag()` after mutations that affect
+  cached data
+- Never put secrets or auth logic in Client Components — keep it in actions
+
+### TanStack Query (client-side data)
+
+Use TanStack Query for data that must stay fresh on the client: real-time
+feeds, user-specific data after mutations, optimistic updates.
+
+```tsx
+// components/posts/post-list.tsx
+'use client';
+
+import { useQuery } from '@tanstack/react-query';
+
+interface Post {
+  id: string;
+  title: string;
+}
+
+export function PostList() {
+  const { data, isLoading, error } = useQuery<Post[]>({
+    queryKey: ['posts'],
+    queryFn: () => fetch('/api/posts').then(r => r.json()),
+    staleTime: 60_000,   // treat data as fresh for 60 seconds
+  });
+
+  if (isLoading) return <p>Loading...</p>;
+  if (error) return <p>Failed to load posts.</p>;
+
+  return (
+    <ul>
+      {data?.map(post => <li key={post.id}>{post.title}</li>)}
+    </ul>
+  );
+}
+```
+
+Do not use TanStack Query for data that a Server Component can fetch directly.
+The extra client-side fetch is unnecessary when the data can be fetched at
+render time on the server.
+
+## Route Handlers
+
+Use route handlers for: webhooks, third-party OAuth callbacks, or endpoints
+consumed by non-Next.js clients.
+
+```typescript
+// app/api/posts/route.ts
+import { NextRequest, NextResponse } from 'next/server';
+import { z } from 'zod';
+import { db } from '@/lib/db';
+
+const CreatePostBody = z.object({
+  title: z.string().min(1),
+  content: z.string().min(1),
+});
+
+export async function GET() {
+  const posts = await db.post.findMany({ orderBy: { createdAt: 'desc' } });
+  return NextResponse.json(posts);
+}
+
+export async function POST(request: NextRequest) {
+  const body = await request.json();
+  const parsed = CreatePostBody.safeParse(body);
+
+  if (!parsed.success) {
+    return NextResponse.json(
+      { error: parsed.error.flatten() },
+      { status: 400 }
+    );
+  }
+
+  const post = await db.post.create({ data: parsed.data });
+  return NextResponse.json(post, { status: 201 });
+}
+```
+
+## Metadata API
+
+```tsx
+// app/posts/[id]/page.tsx
+import type { Metadata } from 'next';
+
+interface Props {
+  params: Promise<{ id: string }>;
+}
+
+export async function generateMetadata({ params }: Props): Promise<Metadata> {
+  const { id } = await params;
+  const post = await fetch(`/api/posts/${id}`).then(r => r.json());
+
+  return {
+    title: post.title,
+    description: post.excerpt,
+    openGraph: {
+      title: post.title,
+      images: [{ url: post.coverImage }],
+    },
+  };
+}
+```
+
+Never hardcode metadata in `<head>` tags — use the Metadata API. It handles
+deduplication, inheritance, and streaming correctly.
+
+## Streaming with Suspense
+
+```tsx
+// app/dashboard/page.tsx
+import { Suspense } from 'react';
+import { UserStats } from './user-stats';   // slow data fetch
+import { RecentActivity } from './recent'; // fast data fetch
+
+export default function DashboardPage() {
+  return (
+    <div>
+      <RecentActivity />   {/* renders immediately */}
+      <Suspense fallback={<p>Loading stats...</p>}>
+        <UserStats />      {/* streams in when ready */}
+      </Suspense>
+    </div>
+  );
+}
+```
+
+Wrap independently slow data sources in their own `<Suspense>` boundaries.
+Do not wrap the entire page — that defeats streaming.
+
+## TypeScript Conventions
+
+```typescript
+// Use type imports for type-only imports
+import type { User } from '@prisma/client';
+
+// Prefer interfaces for object shapes that may be extended
+interface UserCardProps {
+  user: Pick<User, 'id' | 'name' | 'email'>;
+  onSelect?: (id: string) => void;
+}
+
+// Use type aliases for unions and computed types
+type Status = 'active' | 'inactive' | 'pending';
+type UserWithPosts = User & { posts: Post[] };
+```
+
+Rules:
+
+- Never use `any` — use `unknown` and narrow with type guards
+- Use `satisfies` to validate objects against a type without widening
+- Co-locate type definitions with the component or function that uses them;
+  export only what other modules need
+- Use `next/navigation` hooks (`useRouter`, `usePathname`) not `next/router` —
+  the latter is Pages Router only
+
+## Project Structure
+
+```text
+app/
+  (auth)/                — route group, no URL segment
+    login/page.tsx
+    register/page.tsx
+  (dashboard)/
+    dashboard/page.tsx
+    posts/
+      [id]/page.tsx
+      create/
+        page.tsx
+        actions.ts
+  api/
+    posts/route.ts
+  layout.tsx             — root layout
+  not-found.tsx
+
+components/
+  ui/                    — generic, reusable components
+  posts/                 — domain-specific components
+
+lib/
+  db.ts                  — database client
+  auth.ts                — auth configuration
+  queries.ts             — reusable server-side query functions
+```

package/presets/codex/skills/pagespeed-perf/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: pagespeed-perf
-name: PageSpeed Performance Audit
+name: pagespeed-perf
 description: >
   Web Performance Engineering — analyzes Core Web Vitals using the PageSpeed
   Insights API (PSI v5) and applies the 80/20 principle: identify the 20% of

package/presets/codex/skills/python/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: python
-name: Python
+name: python
 description: >
   Python development best practices: clean code, patterns,
   type hints, decorators, context managers, and architecture.

package/presets/codex/skills/python-django-stack/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: python-django-stack
-name: Python Django Stack
+name: python-django-stack
 description: >
   Python and Django conventions for multi-tenant SaaS POS projects:
   views, services, naming, JSON APIs, PDFs, and cart patterns.

package/presets/codex/skills/python-fastapi-stack/SKILL.md

@@ -1,6 +1,6 @@
 ---
 id: python-fastapi-stack
-name: Python FastAPI Stack
+name: python-fastapi-stack
 description: >
   FastAPI conventions for REST APIs: routers, Pydantic v2 schemas, dependency
   injection, error handling, pagination, and project structure.

package/presets/codex/skills/security-ai-llm/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-ai-llm
+description: >
+  Harden LLM and agent integrations you operate: prompt injection, tool allowlists, secret leakage, and supply-chain of models. Defensive only.
+---
+
+# AI / LLM Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Treat model output as untrusted; never exec it without a schema
+- Allowlist tools and paths; contain file writes
+- Keep secrets out of prompts and logs
+
+## Do not
+
+- Help jailbreak third-party products or steal model weights
+- Log raw user PII to prompt-debug stores
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-ai-llm`.
+Example prompts:
+
+- `Review our agent tool runner for path traversal and unbounded shell.`
+- `Add tests that a prompt cannot make the bot dump .env.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/codex/skills/security-blue-team/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-blue-team
+description: >
+  Improve detections, hardening, and response for the estate you defend. Detection-as-code and control design, not offense.
+---
+
+# Blue Team Defense
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Tune detections for true positives; document exceptions
+- Pair every new control with a test or canary
+- Share hunt hypotheses with IR, not with the public internet
+
+## Do not
+
+- Disable EDR or logging to 'reduce noise' without a ticket
+- Copy attacker malware into production 'for training'
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-blue-team`.
+Example prompts:
+
+- `We missed a token-replay. Propose a detection plus a unit test for the API gateway.`
+- `Harden CI: pin actions, require reviews on workflows that deploy.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/codex/skills/security-cloud/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-cloud
+description: >
+  Harden IAM, storage, keys, and org policies in cloud accounts you administer. Focus on identity, logging, and public-exposure controls.
+---
+
+# Cloud Security
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Prefer roles over long-lived keys; require MFA on human admins
+- Block public buckets and overly broad IAM `*` unless justified
+- Turn on cloud audit logs and retain them per policy
+
+## Do not
+
+- Disable logging or GuardDuty/Security Command Center 'to save cost' without a recorded exception
+- Share account credentials in chat or tickets
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-cloud`.
+Example prompts:
+
+- `Audit this AWS account's IAM: unused keys, admin wildcards, and public S3.`
+- `Write a policy-as-code check that fails CI if a bucket ACL is public.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/codex/skills/security-crypto/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-crypto
+description: >
+  Choose and review cryptographic usage in your codebase: TLS, hashing, KMS, secret storage. Prefer standard libraries and vetted constructions.
+---
+
+# Applied Cryptography
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Use platform TLS and KMS; do not invent protocols
+- Hash passwords with a memory-hard KDF; never roll your own
+- Keep keys out of git; rotate on leak
+
+## Do not
+
+- Recommend ECB, MD5 for security, or home-grown ciphers
+- Ask models to 'break' or weaken crypto for a CTF against third parties
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-crypto`.
+Example prompts:
+
+- `Review how we store refresh tokens. Propose KMS envelope encryption and tests.`
+- `Replace SHA-1 password hashes in this legacy module with a modern KDF and a migration plan.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/codex/skills/security-exploit-dev/SKILL.md

@@ -0,0 +1,45 @@
+---
+name: security-exploit-dev
+description: >
+  Understand how a confirmed vulnerability in an owned system is triggered so you can patch and test it. This is not exploit development for offense. No payloads, malware, or attack procedures.
+---
+
+# Defensive Exploit Analysis (Authorized)
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Describe the bug class (e.g. missing authz) at a design level
+- Write a regression test that fails before the fix and passes after
+- Prefer sanitizers, type systems, and least-privilege patches
+- Stop and refuse if the user asks for a working exploit, PoC payload, or bypass kit
+
+## Do not
+
+- Write exploits, exploit PoCs, shellcode, or weaponized requests
+- Document step-by-step attack procedures against any system
+- Help with CTF flags, cracking, or unauthorized access
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-exploit-dev`.
+Example prompts:
+
+- `We confirmed IDOR on /invoices/:id in our app. Help design the authz check and a RED test — no exploit.`
+- `Turn this crash report from our fuzzer into a defensive patch and a regression test.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`

package/presets/codex/skills/security-grc/SKILL.md

@@ -0,0 +1,43 @@
+---
+name: security-grc
+description: >
+  Map controls to SOC2, ISO 27001, PCI, or internal policy for the org you work for. Evidence and control design — not audit theater.
+---
+
+# GRC / Compliance Engineering
+
+## Authorization
+
+Use this skill only with **explicit written authorization** for a named
+scope (systems, environments, and time window). If authorization is missing,
+expired, or the request is for someone else's systems, **stop**.
+
+This skill is **defensive and owner-authorized**. It does not authorize
+offensive cyber operations.
+
+## Do
+
+- Map each control to an owner, evidence path, and test
+- Prefer automated evidence (CI, IaC, tickets) over screenshots
+- Record exceptions with expiry dates
+
+## Do not
+
+- Fabricate evidence or backdate approvals
+- Copy another company's policies without legal review
+
+- Do not produce exploit payloads, malware, or attack procedures.
+
+## How to Use
+
+Load this skill from `/cc-security` when the Task Card domain is `security-grc`.
+Example prompts:
+
+- `Map our GitHub branch protection to SOC2 CC6.6 and list evidence.`
+- `List gaps: secrets in git, missing MFA on GitHub org owners.`
+
+## Integration
+
+- Workflow: `/cc-security` (CCEP command `security`)
+- Existing OWASP application-security skill remains `security` (not this id)
+- High-risk changes still require `security-reviewer`