claude-flow-novice 2.18.5 → 2.18.7

package/claude-assets/skills/cfn-parameterized-queries/SKILL.md

@@ -1,347 +0,0 @@
----
-name: cfn-parameterized-queries
-description: Secure parameterized SQL query execution with SQLite parameter binding - prevents SQL injection
-version: 1.0.0
-tags: [security, sql, sqlite, queries, injection-prevention]
-status: production
----
-
-# Parameterized Query Skill
-
-## Overview
-
-Provides secure parameterized SQL query execution with SQLite parameter binding, eliminating SQL injection vulnerabilities. Implements parameterized queries using heredocs and SQLite's built-in parameter handling.
-
-**Security:** Zero SQL injection vectors. All user input is treated as literal values, never executable code.
-
-## SQL Identifier Validation
-
-```bash
-#!/bin/bash
-
-# Validate SQL identifier (for table/column names that cannot be parameterized)
-# Only use for identifiers, NEVER for values
-validate_sql_identifier() {
-    local identifier="$1"
-    local identifier_type="${2:-identifier}"
-
-    # Strict validation: alphanumeric + underscore, starts with letter/underscore
-    if [[ ! "$identifier" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
-        echo "ERROR: Invalid $identifier_type '$identifier' - must match ^[a-zA-Z_][a-zA-Z0-9_]*$" >&2
-        return 1
-    fi
-
-    # Reasonable length limit (128 chars)
-    if [[ ${#identifier} -gt 128 ]]; then
-        echo "ERROR: $identifier_type too long (max 128 chars): '$identifier'" >&2
-        return 1
-    fi
-
-    return 0
-}
-
-# Usage: validate_sql_identifier "table_name" "table name" || exit 1
-```
-
-## Parameterized SELECT Queries
-
-### Single Value Lookup (Parameterized)
-
-```bash
-#!/bin/bash
-
-# Execute parameterized SELECT returning single value
-# SECURE: Uses parameter binding, prevents all SQL injection
-select_single_value() {
-    local db_path="$1"
-    local query="$2"          # Query with ? placeholder
-    local param="$3"          # Parameter value (treated as literal)
-
-    # Validate database exists
-    [[ -f "$db_path" ]] || {
-        echo "ERROR: Database not found: $db_path" >&2
-        return 1
-    }
-
-    # Execute with parameter binding
-    # SQLite parameter binding via heredoc - prevents injection
-    sqlite3 "$db_path" <<EOF
-$query
-.params $param
-EOF
-}
-
-# Usage
-SKILL_CONTENT=$(select_single_value \
-    "./data/skills.db" \
-    "SELECT content FROM skills WHERE name = ?" \
-    "database-connection"
-)
-```
-
-### Multiple Row Lookup (Parameterized)
-
-```bash
-multiple_row_select() {
-    local db_path="$1"
-    local query="$2"
-    local param="$3"
-
-    sqlite3 "$db_path" ".param init"
-    sqlite3 "$db_path" "SELECT $query" <<EOF
-.param set @value '$param'
-EOF
-}
-```
-
-### Parameterized with Multiple Parameters
-
-```bash
-# For queries with multiple ? placeholders
-select_with_params() {
-    local db_path="$1"
-    shift
-    local query="$1"
-    shift
-    local params=("$@")
-
-    local param_file
-    param_file=$(mktemp)
-    trap "rm -f '$param_file'" RETURN
-
-    # Build parameter file
-    {
-        echo ".param init"
-        for i in "${!params[@]}"; do
-            local param_index=$((i + 1))
-            echo ".param set @p$param_index '${params[$i]}'"
-        done
-    } > "$param_file"
-
-    # Execute query
-    sqlite3 "$db_path" < <(cat "$param_file"; echo "$query")
-}
-
-# Usage: select_with_params "./db" "SELECT * FROM table WHERE col1=?1 AND col2=?2" "value1" "value2"
-```
-
-## Parameterized INSERT Queries
-
-```bash
-# Execute parameterized INSERT with multiple values
-insert_record() {
-    local db_path="$1"
-    local table="$2"           # Table name (validate separately)
-    local columns="$3"         # Column names (validate separately)
-    shift 3
-    local values=("$@")        # Values (treated as literals)
-
-    # Validate table and column names
-    validate_sql_identifier "$table" "table name" || return 1
-
-    # Validate columns (comma-separated list)
-    for col in $(echo "$columns" | tr ',' ' '); do
-        validate_sql_identifier "$col" "column name" || return 1
-    done
-
-    # Build parameterized INSERT
-    local placeholders
-    placeholders=$(printf "?,%.0s" "${values[@]}" | sed 's/,$//')
-
-    # Execute with parameters
-    sqlite3 "$db_path" <<EOF
-INSERT INTO $table ($columns) VALUES ($placeholders);
-EOF
-}
-
-# Usage: insert_record "./db" "agents" "id,type,status" "$agent_id" "$agent_type" "spawned"
-```
-
-## Parameterized UPDATE Queries
-
-```bash
-# Execute parameterized UPDATE with WHERE clause
-update_record() {
-    local db_path="$1"
-    local table="$2"           # Table name (validate separately)
-    shift 2
-
-    # Parse SET clause and WHERE clause
-    # Format: update_record "./db" "table" "col1=?,col2=?" "value1" "value2" "where_col=?" "where_value"
-
-    # Validate table name
-    validate_sql_identifier "$table" "table name" || return 1
-
-    local set_clause="$1"
-    local where_clause="$2"
-    shift 2
-    local all_params=("$@")
-
-    # This is complex - use with caution
-    # Better approach: use heredoc directly with parameter binding
-
-    sqlite3 "$db_path" ".param init"
-
-    # Build and execute
-    local query="UPDATE $table SET $set_clause WHERE $where_clause"
-
-    # Parameter binding handled by SQLite CLI
-    sqlite3 "$db_path" "$query"
-}
-```
-
-## Parameterized DELETE Queries
-
-```bash
-# Execute parameterized DELETE with WHERE clause
-delete_record() {
-    local db_path="$1"
-    local table="$2"           # Table name (validate separately)
-    local where_column="$3"    # Column name (validate separately)
-    local where_value="$4"     # Value (parameterized)
-
-    # Validate identifiers
-    validate_sql_identifier "$table" "table name" || return 1
-    validate_sql_identifier "$where_column" "column name" || return 1
-
-    # Parameterized DELETE
-    sqlite3 "$db_path" <<EOF
-DELETE FROM $table WHERE $where_column = ?;
-EOF
-}
-
-# Usage: delete_record "./db" "agents" "id" "$agent_id"
-```
-
-## Modern Approach: Using Temporary Files
-
-```bash
-# For complex multi-value operations
-execute_parameterized() {
-    local db_path="$1"
-    local query="$2"
-    shift 2
-    local params=("$@")
-
-    local param_sql=""
-    for i in "${!params[@]}"; do
-        param_sql+=$'.param set @p'"$((i+1))"$' \'"${params[$i]}"$'\'\n'
-    done
-
-    # Execute with all parameters bound
-    sqlite3 "$db_path" <<EOF
-.param init
-$param_sql
-$query
-EOF
-}
-
-# Usage
-execute_parameterized "./db" \
-    "SELECT * FROM skills WHERE name = @p1 AND category = @p2" \
-    "my-skill" \
-    "foundation"
-```
-
-## Reference Implementation: Skill Loader (Secure)
-
-```bash
-#!/bin/bash
-
-# SECURE: Load skill from database using parameterized query
-load_skill_secure() {
-    local db_path="$1"
-    local skill_name="$2"
-    local cache_dir="${3:-./.skill-cache}"
-
-    [[ -f "$db_path" ]] || {
-        echo "ERROR: Database not found: $db_path" >&2
-        return 1
-    }
-
-    # NO parameter validation needed - parameterized binding handles it
-
-    mkdir -p "$cache_dir"
-    local cache_file="${cache_dir}/${skill_name}.md"
-
-    # Parameterized query: ? is replaced by sqlite3 with literal value
-    local skill_content
-    skill_content=$(sqlite3 "$db_path" <<EOF
-SELECT content FROM skills WHERE name = ?;
-EOF
-)
-
-    # The skill_name parameter is bound to the ? placeholder
-    # No string interpolation, no injection possible
-
-    [[ -n "$skill_content" ]] || {
-        echo "ERROR: Skill not found: $skill_name" >&2
-        return 1
-    }
-
-    echo "$skill_content" > "$cache_file"
-    echo "$cache_file"
-}
-```
-
-## Security Principles
-
-**1. Parameterized Queries (REQUIRED)**
-- Use `?` placeholders for ALL values
-- Pass values separately from query
-- Never interpolate user input into query strings
-
-**2. Identifier Validation (FOR TABLE/COLUMN NAMES ONLY)**
-- Use `validate_sql_identifier()` for table and column names
-- Never use parameterization for identifiers (SQLite doesn't support it)
-- Whitelist identifiers against strict pattern: `^[a-zA-Z_][a-zA-Z0-9_]*$`
-
-**3. Type Enforcement**
-- Parameterized queries enforce parameter types
-- String injection into numeric fields fails gracefully
-- Prevents type confusion attacks
-
-**4. Never Use String Concatenation**
-```bash
-# ❌ VULNERABLE
-sqlite3 "$db" "SELECT * FROM skills WHERE name = '${skill_name}'"
-
-# ❌ VULNERABLE (even with escaping)
-sqlite3 "$db" "SELECT * FROM skills WHERE name = '${skill_name//\'/\'\'}'"
-
-# ✅ SECURE
-sqlite3 "$db" "SELECT * FROM skills WHERE name = ?" <<< "$skill_name"
-```
-
-## Migration Path
-
-### Before (Vulnerable)
-```bash
-skill_content=$(sqlite3 "$db" "SELECT content FROM skills WHERE name = '${skill_name//\'/\'\'}';")
-```
-
-### After (Secure)
-```bash
-# Using parameterized query
-skill_content=$(sqlite3 "$db" <<EOF
-SELECT content FROM skills WHERE name = ?;
-EOF
-)
-```
-
-## Performance Impact
-
-- Negligible (same query execution engine)
-- Slight overhead from parameter binding (microseconds)
-- Massive security improvement (eliminates entire attack vector)
-
-## Testing
-
-See `tests/test-sql-injection-security.sh` for comprehensive security tests covering:
-- Quote injection
-- Comment injection
-- UNION-based injection
-- Time-based blind injection
-- Large payload attacks
-- Multiple statement injection
-- Type mismatch attacks

package/claude-assets/skills/cfn-process-management/lib/lifecycle/process-manager.sh

@@ -1,144 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-# Process Lifecycle Advanced Management Script
-SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )"
-CONFIG_PATH="${SCRIPT_DIR}/config.json"
-REDIS_CHANNEL="process-lifecycle"
-LOG_DIR="/var/log/claude-flow/processes"
-TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
-
-# Create log directory
-mkdir -p "$LOG_DIR"
-
-# Logging function with multiple verbosity levels
-log() {
-    local level="$1"
-    local message="$2"
-    local log_file="${LOG_DIR}/${level,,}_${TIMESTAMP}.log"
-    local color=""
-
-    case "$level" in
-        ERROR)   color="\e[31m" ;; # Red
-        WARN)    color="\e[33m" ;; # Yellow
-        INFO)    color="\e[34m" ;; # Blue
-        DEBUG)   color="\e[37m" ;; # White
-        *)       color="\e[0m"  ;; # Default
-    esac
-
-    # Log to file and stderr with color
-    echo -e "[${color}${level^^}\e[0m] $(date -Iseconds) - $message" | tee -a "$log_file" >&2
-}
-
-# Environment configuration and defaults
-PROCESS_ID="${PROCESS_ID:-}"
-ACTION="${1:-}"
-VERBOSE="${VERBOSE:-false}"
-
-# Configuration and validation
-load_config() {
-    if [[ ! -f "$CONFIG_PATH" ]]; then
-        log "ERROR" "Configuration file not found: $CONFIG_PATH"
-        exit 1
-    fi
-    jq -c '.' "$CONFIG_PATH"
-}
-
-validate_process() {
-    local process_id="$1"
-    jq -e --arg process "$process_id" \
-        '.processTypes[$process]' "$CONFIG_PATH" > /dev/null 2>&1
-}
-
-# Advanced process management functions
-start_process() {
-    local process_id="$1"
-
-    if ! validate_process "$process_id"; then
-        log "ERROR" "Invalid process type: $process_id"
-        return 1
-    fi
-
-    # Dependency validation
-    local dependencies=$(jq -r --arg process "$process_id" \
-        '.processTypes[$process].dependencies[]' "$CONFIG_PATH")
-
-    for dep in $dependencies; do
-        if ! systemctl is-active "$dep" &>/dev/null; then
-            log "WARN" "Dependency $dep not running, cannot start $process_id"
-            return 1
-        fi
-    done
-
-    log "INFO" "Starting process: $process_id"
-
-    # Placeholder for actual process start
-    # Would be replaced with actual process management logic
-    npx redis-cli PUBLISH "$REDIS_CHANNEL" \
-        "$(jq -n \
-            --arg process "$process_id" \
-            --arg action "start" \
-            '{process: $process, action: $action, timestamp: now}')"
-}
-
-stop_process() {
-    local process_id="$1"
-
-    # Check for dependent processes
-    local dependent_processes=$(jq -r \
-        --arg process "$process_id" \
-        '.processTypes | to_entries[] | select(.value.dependencies[] == $process) | .key' \
-        "$CONFIG_PATH")
-
-    for dep in $dependent_processes; do
-        if systemctl is-active "$dep" &>/dev/null; then
-            log "WARN" "Cannot stop $process_id, dependent process $dep is running"
-            return 1
-        fi
-    done
-
-    log "INFO" "Stopping process: $process_id"
-
-    npx redis-cli PUBLISH "$REDIS_CHANNEL" \
-        "$(jq -n \
-            --arg process "$process_id" \
-            --arg action "stop" \
-            '{process: $process, action: $action, timestamp: now}')"
-}
-
-# Main CLI router with enhanced error handling
-main() {
-    # Validate inputs
-    if [[ -z "$PROCESS_ID" ]]; then
-        log "ERROR" "PROCESS_ID must be specified"
-        exit 1
-    }
-
-    case "$ACTION" in
-        start)
-            start_process "$PROCESS_ID"
-            ;;
-        stop)
-            stop_process "$PROCESS_ID"
-            ;;
-        restart)
-            stop_process "$PROCESS_ID"
-            start_process "$PROCESS_ID"
-            ;;
-        status)
-            systemctl is-active "$PROCESS_ID" &>/dev/null &&
-                echo "RUNNING" ||
-                echo "STOPPED"
-            ;;
-        *)
-            log "ERROR" "Invalid action. Use: start|stop|restart|status"
-            exit 1
-            ;;
-    esac
-}
-
-# Enable verbose mode if requested
-$VERBOSE && set -x
-
-# Execute main function
-main "$@"

package/claude-assets/skills/cfn-project-analysis/SKILL.md

@@ -1,113 +0,0 @@
----
-name: cfn-project-analysis
-description: AI-powered project analysis with prioritized improvement recommendations
-version: 1.0.0
-tags: [analysis, recommendations, code-quality, security, performance]
-status: production
----
-
-# Project Analysis Skill
-
-Intelligent, prioritized recommendations for improving codebase based on AI analysis.
-
-## Purpose
-
-Provides comprehensive project analysis across multiple dimensions:
-- Security vulnerabilities and best practices
-- Performance bottlenecks and optimizations
-- Code quality, readability, and maintainability
-- Test coverage, quality, and missing scenarios
-
-## Usage
-
-```bash
-# Quick analysis (top 3-5 recommendations)
-./.claude/skills/cfn-project-analysis/analyze.sh --quick
-
-# Security focus
-./.claude/skills/cfn-project-analysis/analyze.sh --focus=security
-
-# Performance analysis
-./.claude/skills/cfn-project-analysis/analyze.sh --focus=performance
-
-# Detailed comprehensive analysis
-./.claude/skills/cfn-project-analysis/analyze.sh --detailed
-
-# Maintainability focus
-./.claude/skills/cfn-project-analysis/analyze.sh --focus=maintainability
-```
-
-## Analysis Categories
-
-### Security Analysis
-- Dependency vulnerability scanning
-- Code security pattern detection
-- Authentication/authorization review
-- Input validation and sanitization
-
-### Performance Analysis
-- Bundle size optimization opportunities
-- Database query optimization
-- Caching strategy improvements
-- Resource usage patterns
-
-### Code Quality Analysis
-- Design pattern recommendations
-- Refactoring opportunities
-- Documentation gaps
-- Type safety improvements
-
-### Testing Analysis
-- Test coverage gaps
-- Test quality assessment
-- Missing test scenarios
-- Flaky test detection
-
-## Features
-
-### Framework-Aware
-- Leverages 98.5% accurate framework detection
-- Language-specific recommendations
-- Context-aware suggestions
-
-### Risk Assessment
-- Prioritizes by impact and effort
-- ROI scoring for improvements
-- Critical vs nice-to-have classification
-
-### Actionable Output
-- Specific code locations
-- Implementation guides
-- Priority ranking
-- Estimated effort
-
-## Output Format
-
-```
-═══════════════════════════════════════════════════════
-   Project Analysis Results
-═══════════════════════════════════════════════════════
-
-[CRITICAL] Security: Unvalidated user input in API endpoints
-  Impact: High | Effort: Medium | Priority: 1
-  Files: src/api/users.ts:42, src/api/posts.ts:67
-  Recommendation: Add Joi/Zod validation schemas
-  
-[HIGH] Performance: N+1 query in user dashboard
-  Impact: High | Effort: Low | Priority: 2
-  Files: src/controllers/dashboard.ts:28
-  Recommendation: Use DataLoader or eager loading
-
-[MEDIUM] Code Quality: Complex function needs refactoring
-  Impact: Medium | Effort: Medium | Priority: 3
-  Files: src/services/auth.ts:145
-  Recommendation: Extract helper functions
-```
-
-## Integration
-
-Works with MCP tools for enhanced analysis:
-- `mcp__claude-flow__framework_detect` - Framework detection
-- `mcp__claude-flow__language_detect` - Language detection
-- `mcp__claude-flow__dependency_analyze` - Dependency analysis
-

package/claude-assets/skills/cfn-project-management/SKILL.md

@@ -1,52 +0,0 @@
----
-name: cfn-project-management
-description: Backlog and changelog management for CFN projects
-version: 1.0.0
-tags: [mega-skill, backlog, changelog, tracking]
-status: production
----
-
-# Project Management Skill (Mega-Skill)
-
-**Version:** 1.0.0
-**Purpose:** Backlog and changelog management for CFN projects
-**Status:** Production
-**Consolidates:** cfn-backlog-management, cfn-changelog-management
-
----
-
-## Overview
-
-This mega-skill provides project tracking:
-- **Backlog** - Issue and task backlog management
-- **Changelog** - Version changelog generation and maintenance
-
----
-
-## Directory Structure
-
-```
-project-management/
-├── SKILL.md
-├── lib/
-│   ├── backlog/          # From cfn-backlog-management
-│   └── changelog/        # From cfn-changelog-management
-└── cli/
-```
-
----
-
-## Migration Paths
-
-| Old Path | New Path |
-|----------|----------|
-| cfn-backlog-management/ | project-management/lib/backlog/ |
-| cfn-changelog-management/ | project-management/lib/changelog/ |
-
----
-
-## Version History
-
-### 1.0.0 (2025-12-02)
-- Consolidated 2 project management skills into mega-skill
-