claude-flow-novice 2.18.6 → 2.18.7

package/claude-assets/skills/cfn-parameterized-queries/SKILL.md

@@ -1,347 +0,0 @@
----
-name: cfn-parameterized-queries
-description: Secure parameterized SQL query execution with SQLite parameter binding - prevents SQL injection
-version: 1.0.0
-tags: [security, sql, sqlite, queries, injection-prevention]
-status: production
----
-
-# Parameterized Query Skill
-
-## Overview
-
-Provides secure parameterized SQL query execution with SQLite parameter binding, eliminating SQL injection vulnerabilities. Implements parameterized queries using heredocs and SQLite's built-in parameter handling.
-
-**Security:** Zero SQL injection vectors. All user input is treated as literal values, never executable code.
-
-## SQL Identifier Validation
-
-```bash
-#!/bin/bash
-
-# Validate SQL identifier (for table/column names that cannot be parameterized)
-# Only use for identifiers, NEVER for values
-validate_sql_identifier() {
-    local identifier="$1"
-    local identifier_type="${2:-identifier}"
-
-    # Strict validation: alphanumeric + underscore, starts with letter/underscore
-    if [[ ! "$identifier" =~ ^[a-zA-Z_][a-zA-Z0-9_]*$ ]]; then
-        echo "ERROR: Invalid $identifier_type '$identifier' - must match ^[a-zA-Z_][a-zA-Z0-9_]*$" >&2
-        return 1
-    fi
-
-    # Reasonable length limit (128 chars)
-    if [[ ${#identifier} -gt 128 ]]; then
-        echo "ERROR: $identifier_type too long (max 128 chars): '$identifier'" >&2
-        return 1
-    fi
-
-    return 0
-}
-
-# Usage: validate_sql_identifier "table_name" "table name" || exit 1
-```
-
-## Parameterized SELECT Queries
-
-### Single Value Lookup (Parameterized)
-
-```bash
-#!/bin/bash
-
-# Execute parameterized SELECT returning single value
-# SECURE: Uses parameter binding, prevents all SQL injection
-select_single_value() {
-    local db_path="$1"
-    local query="$2"          # Query with ? placeholder
-    local param="$3"          # Parameter value (treated as literal)
-
-    # Validate database exists
-    [[ -f "$db_path" ]] || {
-        echo "ERROR: Database not found: $db_path" >&2
-        return 1
-    }
-
-    # Execute with parameter binding
-    # SQLite parameter binding via heredoc - prevents injection
-    sqlite3 "$db_path" <<EOF
-$query
-.params $param
-EOF
-}
-
-# Usage
-SKILL_CONTENT=$(select_single_value \
-    "./data/skills.db" \
-    "SELECT content FROM skills WHERE name = ?" \
-    "database-connection"
-)
-```
-
-### Multiple Row Lookup (Parameterized)
-
-```bash
-multiple_row_select() {
-    local db_path="$1"
-    local query="$2"
-    local param="$3"
-
-    sqlite3 "$db_path" ".param init"
-    sqlite3 "$db_path" "SELECT $query" <<EOF
-.param set @value '$param'
-EOF
-}
-```
-
-### Parameterized with Multiple Parameters
-
-```bash
-# For queries with multiple ? placeholders
-select_with_params() {
-    local db_path="$1"
-    shift
-    local query="$1"
-    shift
-    local params=("$@")
-
-    local param_file
-    param_file=$(mktemp)
-    trap "rm -f '$param_file'" RETURN
-
-    # Build parameter file
-    {
-        echo ".param init"
-        for i in "${!params[@]}"; do
-            local param_index=$((i + 1))
-            echo ".param set @p$param_index '${params[$i]}'"
-        done
-    } > "$param_file"
-
-    # Execute query
-    sqlite3 "$db_path" < <(cat "$param_file"; echo "$query")
-}
-
-# Usage: select_with_params "./db" "SELECT * FROM table WHERE col1=?1 AND col2=?2" "value1" "value2"
-```
-
-## Parameterized INSERT Queries
-
-```bash
-# Execute parameterized INSERT with multiple values
-insert_record() {
-    local db_path="$1"
-    local table="$2"           # Table name (validate separately)
-    local columns="$3"         # Column names (validate separately)
-    shift 3
-    local values=("$@")        # Values (treated as literals)
-
-    # Validate table and column names
-    validate_sql_identifier "$table" "table name" || return 1
-
-    # Validate columns (comma-separated list)
-    for col in $(echo "$columns" | tr ',' ' '); do
-        validate_sql_identifier "$col" "column name" || return 1
-    done
-
-    # Build parameterized INSERT
-    local placeholders
-    placeholders=$(printf "?,%.0s" "${values[@]}" | sed 's/,$//')
-
-    # Execute with parameters
-    sqlite3 "$db_path" <<EOF
-INSERT INTO $table ($columns) VALUES ($placeholders);
-EOF
-}
-
-# Usage: insert_record "./db" "agents" "id,type,status" "$agent_id" "$agent_type" "spawned"
-```
-
-## Parameterized UPDATE Queries
-
-```bash
-# Execute parameterized UPDATE with WHERE clause
-update_record() {
-    local db_path="$1"
-    local table="$2"           # Table name (validate separately)
-    shift 2
-
-    # Parse SET clause and WHERE clause
-    # Format: update_record "./db" "table" "col1=?,col2=?" "value1" "value2" "where_col=?" "where_value"
-
-    # Validate table name
-    validate_sql_identifier "$table" "table name" || return 1
-
-    local set_clause="$1"
-    local where_clause="$2"
-    shift 2
-    local all_params=("$@")
-
-    # This is complex - use with caution
-    # Better approach: use heredoc directly with parameter binding
-
-    sqlite3 "$db_path" ".param init"
-
-    # Build and execute
-    local query="UPDATE $table SET $set_clause WHERE $where_clause"
-
-    # Parameter binding handled by SQLite CLI
-    sqlite3 "$db_path" "$query"
-}
-```
-
-## Parameterized DELETE Queries
-
-```bash
-# Execute parameterized DELETE with WHERE clause
-delete_record() {
-    local db_path="$1"
-    local table="$2"           # Table name (validate separately)
-    local where_column="$3"    # Column name (validate separately)
-    local where_value="$4"     # Value (parameterized)
-
-    # Validate identifiers
-    validate_sql_identifier "$table" "table name" || return 1
-    validate_sql_identifier "$where_column" "column name" || return 1
-
-    # Parameterized DELETE
-    sqlite3 "$db_path" <<EOF
-DELETE FROM $table WHERE $where_column = ?;
-EOF
-}
-
-# Usage: delete_record "./db" "agents" "id" "$agent_id"
-```
-
-## Modern Approach: Using Temporary Files
-
-```bash
-# For complex multi-value operations
-execute_parameterized() {
-    local db_path="$1"
-    local query="$2"
-    shift 2
-    local params=("$@")
-
-    local param_sql=""
-    for i in "${!params[@]}"; do
-        param_sql+=$'.param set @p'"$((i+1))"$' \'"${params[$i]}"$'\'\n'
-    done
-
-    # Execute with all parameters bound
-    sqlite3 "$db_path" <<EOF
-.param init
-$param_sql
-$query
-EOF
-}
-
-# Usage
-execute_parameterized "./db" \
-    "SELECT * FROM skills WHERE name = @p1 AND category = @p2" \
-    "my-skill" \
-    "foundation"
-```
-
-## Reference Implementation: Skill Loader (Secure)
-
-```bash
-#!/bin/bash
-
-# SECURE: Load skill from database using parameterized query
-load_skill_secure() {
-    local db_path="$1"
-    local skill_name="$2"
-    local cache_dir="${3:-./.skill-cache}"
-
-    [[ -f "$db_path" ]] || {
-        echo "ERROR: Database not found: $db_path" >&2
-        return 1
-    }
-
-    # NO parameter validation needed - parameterized binding handles it
-
-    mkdir -p "$cache_dir"
-    local cache_file="${cache_dir}/${skill_name}.md"
-
-    # Parameterized query: ? is replaced by sqlite3 with literal value
-    local skill_content
-    skill_content=$(sqlite3 "$db_path" <<EOF
-SELECT content FROM skills WHERE name = ?;
-EOF
-)
-
-    # The skill_name parameter is bound to the ? placeholder
-    # No string interpolation, no injection possible
-
-    [[ -n "$skill_content" ]] || {
-        echo "ERROR: Skill not found: $skill_name" >&2
-        return 1
-    }
-
-    echo "$skill_content" > "$cache_file"
-    echo "$cache_file"
-}
-```
-
-## Security Principles
-
-**1. Parameterized Queries (REQUIRED)**
-- Use `?` placeholders for ALL values
-- Pass values separately from query
-- Never interpolate user input into query strings
-
-**2. Identifier Validation (FOR TABLE/COLUMN NAMES ONLY)**
-- Use `validate_sql_identifier()` for table and column names
-- Never use parameterization for identifiers (SQLite doesn't support it)
-- Whitelist identifiers against strict pattern: `^[a-zA-Z_][a-zA-Z0-9_]*$`
-
-**3. Type Enforcement**
-- Parameterized queries enforce parameter types
-- String injection into numeric fields fails gracefully
-- Prevents type confusion attacks
-
-**4. Never Use String Concatenation**
-```bash
-# ❌ VULNERABLE
-sqlite3 "$db" "SELECT * FROM skills WHERE name = '${skill_name}'"
-
-# ❌ VULNERABLE (even with escaping)
-sqlite3 "$db" "SELECT * FROM skills WHERE name = '${skill_name//\'/\'\'}'"
-
-# ✅ SECURE
-sqlite3 "$db" "SELECT * FROM skills WHERE name = ?" <<< "$skill_name"
-```
-
-## Migration Path
-
-### Before (Vulnerable)
-```bash
-skill_content=$(sqlite3 "$db" "SELECT content FROM skills WHERE name = '${skill_name//\'/\'\'}';")
-```
-
-### After (Secure)
-```bash
-# Using parameterized query
-skill_content=$(sqlite3 "$db" <<EOF
-SELECT content FROM skills WHERE name = ?;
-EOF
-)
-```
-
-## Performance Impact
-
-- Negligible (same query execution engine)
-- Slight overhead from parameter binding (microseconds)
-- Massive security improvement (eliminates entire attack vector)
-
-## Testing
-
-See `tests/test-sql-injection-security.sh` for comprehensive security tests covering:
-- Quote injection
-- Comment injection
-- UNION-based injection
-- Time-based blind injection
-- Large payload attacks
-- Multiple statement injection
-- Type mismatch attacks

package/claude-assets/skills/cfn-planning/SKILL.md

@@ -1,55 +0,0 @@
----
-name: cfn-planning
-description: Epic decomposition, coordinator planning, and scope management
-version: 1.0.0
-tags: [mega-skill, epic, planning, scope, decomposition]
-status: production
----
-
-# Planning Skill (Mega-Skill)
-
-**Version:** 1.0.0
-**Purpose:** Epic decomposition, coordinator planning, and scope management
-**Status:** Production
-**Consolidates:** cfn-epic-decomposer, cfn-multi-coordinator-planning, cfn-scope-simplifier
-
----
-
-## Overview
-
-This mega-skill provides planning capabilities:
-- **Epic** - Epic decomposition into sprints/tasks
-- **Coordinator** - Multi-coordinator planning and orchestration
-- **Scope** - Scope simplification and boundary management
-
----
-
-## Directory Structure
-
-```
-planning/
-├── SKILL.md
-├── lib/
-│   ├── epic/             # From cfn-epic-decomposer
-│   ├── coordinator/      # From cfn-multi-coordinator-planning
-│   └── scope/            # From cfn-scope-simplifier
-└── cli/
-```
-
----
-
-## Migration Paths
-
-| Old Path | New Path |
-|----------|----------|
-| cfn-epic-decomposer/ | planning/lib/epic/ |
-| cfn-multi-coordinator-planning/ | planning/lib/coordinator/ |
-| cfn-scope-simplifier/ | planning/lib/scope/ |
-
----
-
-## Version History
-
-### 1.0.0 (2025-12-02)
-- Consolidated 3 planning skills into mega-skill
-

package/claude-assets/skills/cfn-planning/lib/coordinator/README.md

@@ -1,256 +0,0 @@
-# Multi-Coordinator Planning Skill
-
-**Purpose:** Systematic planning and validation for parallel multi-coordinator execution workflows, designed to prevent Zone B-style execution failures.
-
-## Overview
-
-This skill provides comprehensive pre-flight planning for multi-coordinator execution, addressing the critical failures identified in the Zone B analysis:
-- Redis namespace collision (Echo zone)
-- Protocol compliance breakdown (Alpha/Charlie zones)
-- Orchestration gaps (Delta zone)
-- Consensus on vapor anti-patterns (Bravo zone)
-
-## Quick Start
-
-```bash
-# Create zone configuration
-cat > zone-config.json << 'EOF'
-{
-  "zones": [
-    {
-      "name": "zone-alpha",
-      "task_description": "Implement React authentication component with TypeScript interfaces",
-      "deliverables": [
-        "src/components/AuthForm.tsx",
-        "src/types/auth.ts",
-        "src/hooks/useAuth.ts",
-        "tests/auth.test.ts"
-      ],
-      "agent_types": ["react-frontend-engineer", "reviewer", "tester"],
-      "acceptance_criteria": [
-        "Form validates user input",
-        "Authentication state managed globally",
-        "Component tested with >80% coverage"
-      ],
-      "in_scope": ["React components", "TypeScript interfaces"],
-      "out_of_scope": ["Backend authentication"],
-      "directory": "src/auth"
-    }
-  ]
-}
-EOF
-
-# Execute planning
-./.claude/skills/cfn-multi-coordinator-planning/plan-multi-coordinator-work.sh zone-config.json
-```
-
-## Components
-
-### 1. Main Planning Script
-- **`plan-multi-coordinator-work.sh`** - Orchestrates all planning phases
-
-### 2. Planning Phase Scripts
-- **`validate-task-planning.sh`** - Task configuration validation
-- **`plan-coordinator-resources.sh`** - Resource allocation and namespace planning
-- **`map-dependencies-conflicts.sh`** - Dependency analysis and conflict resolution
-- **`plan-risk-rollout.sh`** - Risk-based rollout strategy
-
-### 3. Testing
-- **`test-multi-coordinator-planning.sh`** - Comprehensive test suite
-
-## Configuration Format
-
-### Zone Configuration Structure
-```json
-{
-  "zones": [
-    {
-      "name": "zone-identifier",
-      "task_description": "Specific implementation task with clear deliverables",
-      "deliverables": [
-        "file/path/to/deliverable.ext"
-      ],
-      "agent_types": ["required-agent-types"],
-      "acceptance_criteria": [
-        "Measurable acceptance criteria"
-      ],
-      "in_scope": ["items in scope"],
-      "out_of_scope": ["items out of scope"],
-      "directory": "working/directory",
-      "risk_factors": ["optional-risk-factors"]
-    }
-  ]
-}
-```
-
-### Validation Requirements
-- **Minimum 3 deliverables** for software tasks
-- **Minimum 2 agent types** (prevents single-agent anti-patterns)
-- **Specific task descriptions** (no generic "implementation" tasks)
-- **Acceptance criteria** required
-- **In-scope/out-of-scope boundaries** required
-
-## Usage Examples
-
-### Basic Planning
-```bash
-./plan-multi-coordinator-work.sh zone-config.json
-```
-
-### Advanced Planning with Custom Parameters
-```bash
-./plan-multi-coordinator-work.sh zone-config.json \
-  --max-zones-per-phase 3 \
-  --output-dir ./plans \
-  --dry-run
-```
-
-### Skip Validation (Not Recommended)
-```bash
-./plan-multi-coordinator-work.sh zone-config.json --skip-validation
-```
-
-## Planning Phases
-
-### Phase 1: Task Validation
-- Deliverable specificity verification
-- Agent type diversity requirements
-- Context completeness scoring
-- Anti-pattern detection
-
-### Phase 2: Resource Allocation
-- Redis namespace reservation and isolation
-- Memory/CPU capacity planning
-- Coordinator limit calculations
-- Working directory allocation
-
-### Phase 3: Dependency Analysis
-- Cross-zone dependency identification
-- Shared resource conflict detection
-- Completion pathway validation
-- Resolution strategy creation
-
-### Phase 4: Risk-Based Rollout
-- Zone complexity ranking
-- Graduated phase rollout
-- Success gate definition
-- Rollback trigger configuration
-
-## Output Files
-
-### Generated Plans
-- `coordinator-resource-plan-*.json` - Resource allocation mapping
-- `dependency-conflict-analysis-*.json` - Dependencies and conflicts analysis
-- `rollout-plan-*.json` - Risk-based rollout strategy
-- `multi-coordinator-planning-summary-*.json` - Execution summary
-
-### Structure
-```json
-{
-  "timestamp": 1699123456,
-  "zone_count": 2,
-  "system_resources": {...},
-  "resource_plans": [...],
-  "phases": [...],
-  "success_criteria": [...],
-  "rollback_triggers": [...]
-}
-```
-
-## Risk Mitigation
-
-### Prevents Zone B Failures
-1. **Namespace Collision Prevention** - Redis DB allocation per zone
-2. **Protocol Compliance** - Agent completion pathway validation
-3. **Orchestration Gaps** - Coordinator lifecycle management
-4. **Anti-Pattern Detection** - Consensus on vapor prevention
-
-### Rollback Strategies
-- Immediate rollback on critical failures
-- Phase-specific rollback triggers
-- Context preservation and recovery
-- Emergency stop and cleanup procedures
-
-## Testing
-
-```bash
-# Run comprehensive test suite
-./test-multi-coordinator-planning.sh
-
-# Test individual components
-./validate-task-planning.sh test-config.json
-./plan-coordinator-resources.sh test-config.json
-./map-dependencies-conflicts.sh test-config.json
-./plan-risk-rollout.sh test-config.json
-```
-
-## Integration with CFN Loop
-
-This skill integrates with the existing CFN Loop ecosystem:
-
-### Pre-Flight Validation
-- Use before `/cfn-loop-cli` multi-coordinator execution
-- Validates coordinator readiness and resource availability
-- Prevents execution failures through comprehensive planning
-
-### CLI Spawning Support
-- Generates CLI-compatible coordinator configurations
-- Supports the recommendation to spawn coordinators via CLI
-- Enables Main Chat monitoring and interjection capabilities
-
-### Redis Coordination
-- Uses existing Redis coordination patterns
-- Integrates with `cfn-redis-coordination` skill
-- Maintains namespace isolation standards
-
-## Best Practices
-
-### Planning Phase
-1. **Always validate configurations** before execution
-2. **Use graduated rollout** for complex multi-zone scenarios
-3. **Monitor resource utilization** during planning
-4. **Test rollback procedures** before production execution
-
-### Configuration
-1. **Be specific** about deliverables and acceptance criteria
-2. **Include risk factors** for accurate complexity assessment
-3. **Define clear scope boundaries** to prevent scope creep
-4. **Use appropriate agent types** for task complexity
-
-### Execution
-1. **Follow the rollout sequence** generated by the planner
-2. **Monitor each phase** before proceeding to the next
-3. **Be prepared to rollback** on trigger activation
-4. **Document lessons learned** for future planning
-
-## Troubleshooting
-
-### Common Issues
-- **Redis connection failures** - Check Redis service status
-- **Resource exhaustion** - Reduce concurrent zones or increase resources
-- **Validation failures** - Review configuration against requirements
-- **Namespace conflicts** - Ensure unique zone names and task IDs
-
-### Debug Mode
-```bash
-# Enable verbose output
-set -x
-./plan-multi-coordinator-work.sh zone-config.json
-set +x
-```
-
-## Dependencies
-
-- **jq** - JSON processing
-- **redis-cli** - Redis connectivity and namespace planning
-- **bc** - Mathematical calculations
-- **Redis server** - Namespace reservation and coordination
-
-## Maintenance
-
-- Regular testing of all planning phases
-- Update validation rules based on new failure patterns
-- Enhance resource planning algorithms
-- Extend rollback trigger configurations
-
----