claude-skill-lord 1.5.0

package/skills/tier-1/security-review/cloud-infrastructure-security.md

@@ -0,0 +1,361 @@
+| name | description |
+|------|-------------|
+| cloud-infrastructure-security | Use this skill when deploying to cloud platforms, configuring infrastructure, managing IAM policies, setting up logging/monitoring, or implementing CI/CD pipelines. Provides cloud security checklist aligned with best practices. |
+
+# Cloud & Infrastructure Security Skill
+
+This skill ensures cloud infrastructure, CI/CD pipelines, and deployment configurations follow security best practices and comply with industry standards.
+
+## When to Activate
+
+- Deploying applications to cloud platforms (AWS, Vercel, Railway, Cloudflare)
+- Configuring IAM roles and permissions
+- Setting up CI/CD pipelines
+- Implementing infrastructure as code (Terraform, CloudFormation)
+- Configuring logging and monitoring
+- Managing secrets in cloud environments
+- Setting up CDN and edge security
+- Implementing disaster recovery and backup strategies
+
+## Cloud Security Checklist
+
+### 1. IAM & Access Control
+
+#### Principle of Least Privilege
+
+```yaml
+# ✅ CORRECT: Minimal permissions
+iam_role:
+  permissions:
+    - s3:GetObject  # Only read access
+    - s3:ListBucket
+  resources:
+    - arn:aws:s3:::my-bucket/*  # Specific bucket only
+
+# ❌ WRONG: Overly broad permissions
+iam_role:
+  permissions:
+    - s3:*  # All S3 actions
+  resources:
+    - "*"  # All resources
+```
+
+#### Multi-Factor Authentication (MFA)
+
+```bash
+# ALWAYS enable MFA for root/admin accounts
+aws iam enable-mfa-device \
+  --user-name admin \
+  --serial-number arn:aws:iam::123456789:mfa/admin \
+  --authentication-code1 123456 \
+  --authentication-code2 789012
+```
+
+#### Verification Steps
+
+- [ ] No root account usage in production
+- [ ] MFA enabled for all privileged accounts
+- [ ] Service accounts use roles, not long-lived credentials
+- [ ] IAM policies follow least privilege
+- [ ] Regular access reviews conducted
+- [ ] Unused credentials rotated or removed
+
+### 2. Secrets Management
+
+#### Cloud Secrets Managers
+
+```typescript
+// ✅ CORRECT: Use cloud secrets manager
+import { SecretsManager } from '@aws-sdk/client-secrets-manager';
+
+const client = new SecretsManager({ region: 'us-east-1' });
+const secret = await client.getSecretValue({ SecretId: 'prod/api-key' });
+const apiKey = JSON.parse(secret.SecretString).key;
+
+// ❌ WRONG: Hardcoded or in environment variables only
+const apiKey = process.env.API_KEY; // Not rotated, not audited
+```
+
+#### Secrets Rotation
+
+```bash
+# Set up automatic rotation for database credentials
+aws secretsmanager rotate-secret \
+  --secret-id prod/db-password \
+  --rotation-lambda-arn arn:aws:lambda:region:account:function:rotate \
+  --rotation-rules AutomaticallyAfterDays=30
+```
+
+#### Verification Steps
+
+- [ ] All secrets stored in cloud secrets manager (AWS Secrets Manager, Vercel Secrets)
+- [ ] Automatic rotation enabled for database credentials
+- [ ] API keys rotated at least quarterly
+- [ ] No secrets in code, logs, or error messages
+- [ ] Audit logging enabled for secret access
+
+### 3. Network Security
+
+#### VPC and Firewall Configuration
+
+```terraform
+# ✅ CORRECT: Restricted security group
+resource "aws_security_group" "app" {
+  name = "app-sg"
+  
+  ingress {
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["10.0.0.0/16"]  # Internal VPC only
+  }
+  
+  egress {
+    from_port   = 443
+    to_port     = 443
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]  # Only HTTPS outbound
+  }
+}
+
+# ❌ WRONG: Open to the internet
+resource "aws_security_group" "bad" {
+  ingress {
+    from_port   = 0
+    to_port     = 65535
+    protocol    = "tcp"
+    cidr_blocks = ["0.0.0.0/0"]  # All ports, all IPs!
+  }
+}
+```
+
+#### Verification Steps
+
+- [ ] Database not publicly accessible
+- [ ] SSH/RDP ports restricted to VPN/bastion only
+- [ ] Security groups follow least privilege
+- [ ] Network ACLs configured
+- [ ] VPC flow logs enabled
+
+### 4. Logging & Monitoring
+
+#### CloudWatch/Logging Configuration
+
+```typescript
+// ✅ CORRECT: Comprehensive logging
+import { CloudWatchLogsClient, CreateLogStreamCommand } from '@aws-sdk/client-cloudwatch-logs';
+
+const logSecurityEvent = async (event: SecurityEvent) => {
+  await cloudwatch.putLogEvents({
+    logGroupName: '/aws/security/events',
+    logStreamName: 'authentication',
+    logEvents: [{
+      timestamp: Date.now(),
+      message: JSON.stringify({
+        type: event.type,
+        userId: event.userId,
+        ip: event.ip,
+        result: event.result,
+        // Never log sensitive data
+      })
+    }]
+  });
+};
+```
+
+#### Verification Steps
+
+- [ ] CloudWatch/logging enabled for all services
+- [ ] Failed authentication attempts logged
+- [ ] Admin actions audited
+- [ ] Log retention configured (90+ days for compliance)
+- [ ] Alerts configured for suspicious activity
+- [ ] Logs centralized and tamper-proof
+
+### 5. CI/CD Pipeline Security
+
+#### Secure Pipeline Configuration
+
+```yaml
+# ✅ CORRECT: Secure GitHub Actions workflow
+name: Deploy
+
+on:
+  push:
+    branches: [main]
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read  # Minimal permissions
+      
+    steps:
+      - uses: actions/checkout@v4
+      
+      # Scan for secrets
+      - name: Secret scanning
+        uses: trufflesecurity/trufflehog@main
+        
+      # Dependency audit
+      - name: Audit dependencies
+        run: npm audit --audit-level=high
+        
+      # Use OIDC, not long-lived tokens
+      - name: Configure AWS credentials
+        uses: aws-actions/configure-aws-credentials@v4
+        with:
+          role-to-assume: arn:aws:iam::123456789:role/GitHubActionsRole
+          aws-region: us-east-1
+```
+
+#### Supply Chain Security
+
+```json
+// package.json - Use lock files and integrity checks
+{
+  "scripts": {
+    "install": "npm ci",  // Use ci for reproducible builds
+    "audit": "npm audit --audit-level=moderate",
+    "check": "npm outdated"
+  }
+}
+```
+
+#### Verification Steps
+
+- [ ] OIDC used instead of long-lived credentials
+- [ ] Secrets scanning in pipeline
+- [ ] Dependency vulnerability scanning
+- [ ] Container image scanning (if applicable)
+- [ ] Branch protection rules enforced
+- [ ] Code review required before merge
+- [ ] Signed commits enforced
+
+### 6. Cloudflare & CDN Security
+
+#### Cloudflare Security Configuration
+
+```typescript
+// ✅ CORRECT: Cloudflare Workers with security headers
+export default {
+  async fetch(request: Request): Promise<Response> {
+    const response = await fetch(request);
+    
+    // Add security headers
+    const headers = new Headers(response.headers);
+    headers.set('X-Frame-Options', 'DENY');
+    headers.set('X-Content-Type-Options', 'nosniff');
+    headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
+    headers.set('Permissions-Policy', 'geolocation=(), microphone=()');
+    
+    return new Response(response.body, {
+      status: response.status,
+      headers
+    });
+  }
+};
+```
+
+#### WAF Rules
+
+```bash
+# Enable Cloudflare WAF managed rules
+# - OWASP Core Ruleset
+# - Cloudflare Managed Ruleset
+# - Rate limiting rules
+# - Bot protection
+```
+
+#### Verification Steps
+
+- [ ] WAF enabled with OWASP rules
+- [ ] Rate limiting configured
+- [ ] Bot protection active
+- [ ] DDoS protection enabled
+- [ ] Security headers configured
+- [ ] SSL/TLS strict mode enabled
+
+### 7. Backup & Disaster Recovery
+
+#### Automated Backups
+
+```terraform
+# ✅ CORRECT: Automated RDS backups
+resource "aws_db_instance" "main" {
+  allocated_storage     = 20
+  engine               = "postgres"
+  
+  backup_retention_period = 30  # 30 days retention
+  backup_window          = "03:00-04:00"
+  maintenance_window     = "mon:04:00-mon:05:00"
+  
+  enabled_cloudwatch_logs_exports = ["postgresql"]
+  
+  deletion_protection = true  # Prevent accidental deletion
+}
+```
+
+#### Verification Steps
+
+- [ ] Automated daily backups configured
+- [ ] Backup retention meets compliance requirements
+- [ ] Point-in-time recovery enabled
+- [ ] Backup testing performed quarterly
+- [ ] Disaster recovery plan documented
+- [ ] RPO and RTO defined and tested
+
+## Pre-Deployment Cloud Security Checklist
+
+Before ANY production cloud deployment:
+
+- [ ] **IAM**: Root account not used, MFA enabled, least privilege policies
+- [ ] **Secrets**: All secrets in cloud secrets manager with rotation
+- [ ] **Network**: Security groups restricted, no public databases
+- [ ] **Logging**: CloudWatch/logging enabled with retention
+- [ ] **Monitoring**: Alerts configured for anomalies
+- [ ] **CI/CD**: OIDC auth, secrets scanning, dependency audits
+- [ ] **CDN/WAF**: Cloudflare WAF enabled with OWASP rules
+- [ ] **Encryption**: Data encrypted at rest and in transit
+- [ ] **Backups**: Automated backups with tested recovery
+- [ ] **Compliance**: GDPR/HIPAA requirements met (if applicable)
+- [ ] **Documentation**: Infrastructure documented, runbooks created
+- [ ] **Incident Response**: Security incident plan in place
+
+## Common Cloud Security Misconfigurations
+
+### S3 Bucket Exposure
+
+```bash
+# ❌ WRONG: Public bucket
+aws s3api put-bucket-acl --bucket my-bucket --acl public-read
+
+# ✅ CORRECT: Private bucket with specific access
+aws s3api put-bucket-acl --bucket my-bucket --acl private
+aws s3api put-bucket-policy --bucket my-bucket --policy file://policy.json
+```
+
+### RDS Public Access
+
+```terraform
+# ❌ WRONG
+resource "aws_db_instance" "bad" {
+  publicly_accessible = true  # NEVER do this!
+}
+
+# ✅ CORRECT
+resource "aws_db_instance" "good" {
+  publicly_accessible = false
+  vpc_security_group_ids = [aws_security_group.db.id]
+}
+```
+
+## Resources
+
+- [AWS Security Best Practices](https://aws.amazon.com/security/best-practices/)
+- [CIS AWS Foundations Benchmark](https://www.cisecurity.org/benchmark/amazon_web_services)
+- [Cloudflare Security Documentation](https://developers.cloudflare.com/security/)
+- [OWASP Cloud Security](https://owasp.org/www-project-cloud-security/)
+- [Terraform Security Best Practices](https://www.terraform.io/docs/cloud/guides/recommended-practices/)
+
+**Remember**: Cloud misconfigurations are the leading cause of data breaches. A single exposed S3 bucket or overly permissive IAM policy can compromise your entire infrastructure. Always follow the principle of least privilege and defense in depth.

package/skills/tier-1/sequential-thinking/.env.example

@@ -0,0 +1,8 @@
+# Sequential Thinking Configuration
+
+# Disable thought logging output (useful for automated processing)
+# Set to "true" to disable console logging
+DISABLE_THOUGHT_LOGGING=false
+
+# History file location (optional, defaults to scripts/.thought-history.json)
+# THOUGHT_HISTORY_FILE=/path/to/custom/history.json

package/skills/tier-1/sequential-thinking/README.md

@@ -0,0 +1,183 @@
+# Sequential Thinking Agent Skill
+
+Structured, reflective problem-solving methodology converted from the sequential-thinking MCP server into a native Agent Skill.
+
+## Overview
+
+This skill teaches Claude to apply systematic sequential thinking methodology for complex problem-solving, without relying on external MCP tools. It enables:
+- Breaking down complex problems into manageable thought sequences
+- Dynamic adjustment of thought count as understanding evolves
+- Revision of previous thoughts when new insights emerge
+- Branching into alternative reasoning paths
+- Hypothesis generation and verification
+
+## Skill Structure
+
+```
+sequential-thinking/
+├── SKILL.md (105 lines)
+│   Core methodology, when to apply, scripts usage
+│
+├── package.json
+│   Test dependencies (jest)
+│
+├── .env.example
+│   Configuration options
+│
+├── scripts/
+│   ├── process-thought.js (executable)
+│   │   Validate and track thoughts deterministically
+│   │
+│   └── format-thought.js (executable)
+│       Format thoughts for display (box/simple/markdown)
+│
+├── tests/
+│   ├── process-thought.test.js
+│   │   Validation, tracking, history tests
+│   │
+│   └── format-thought.test.js
+│       Formatting tests (all formats)
+│
+└── references/
+    ├── core-patterns.md (95 lines)
+    │   Essential revision & branching patterns
+    │
+    ├── examples-api.md (88 lines)
+    │   API design example walkthrough
+    │
+    ├── examples-debug.md (90 lines)
+    │   Performance debugging example
+    │
+    ├── examples-architecture.md (94 lines)
+    │   Architecture decision example
+    │
+    ├── advanced-techniques.md (76 lines)
+    │   Spiral refinement, hypothesis testing, convergence
+    │
+    └── advanced-strategies.md (79 lines)
+        Uncertainty management, revision cascades, meta-thinking
+```
+
+**Documentation**: 627 lines across 7 files (all under 100 lines)
+**Scripts**: 2 executable Node.js scripts with tests
+
+## Key Features
+
+### Progressive Disclosure Design
+Each file focuses on specific aspects, loaded only when needed:
+- **SKILL.md**: Quick reference with core methodology
+- **core-patterns.md**: Common patterns for everyday use
+- **examples-*.md**: Real-world walkthroughs for learning
+- **advanced-*.md**: Sophisticated techniques for complex scenarios
+
+### Token Efficiency
+- Concise explanations sacrifice grammar for brevity
+- Examples demonstrate patterns without verbose explanation
+- Cross-references between files avoid duplication
+
+### Methodology Conversion
+Extracted from MCP server's approach and converted to instructions:
+- MCP tool provided **interface** for sequential thinking
+- Agent skill provides **methodology** to think sequentially
+- No dependency on external tools—pure instructional approach
+
+## Usage Modes
+
+**Explicit Mode**: Use visible thought markers
+```
+Thought 1/5: [Analysis]
+Thought 2/5: [Further analysis]
+```
+
+**Implicit Mode**: Apply methodology internally without cluttering output
+
+## When Claude Should Use This Skill
+
+Automatically activated for:
+- Complex problem decomposition
+- Adaptive planning with potential revisions
+- Debugging and root cause analysis
+- Architecture and design decisions
+- Problems with unclear or emerging scope
+- Multi-step solutions requiring context
+
+## Scripts Usage
+
+### Process Thought (Validation & Tracking)
+
+```bash
+# Process a thought
+node scripts/process-thought.js --thought "Initial analysis" --number 1 --total 5 --next true
+
+# Process with revision
+node scripts/process-thought.js --thought "Corrected analysis" --number 2 --total 5 --next true --revision 1
+
+# Process with branching
+node scripts/process-thought.js --thought "Branch A" --number 2 --total 5 --next true --branch 1 --branchId "branch-a"
+
+# View history
+node scripts/process-thought.js --history
+
+# Reset history
+node scripts/process-thought.js --reset
+```
+
+### Format Thought (Display)
+
+```bash
+# Box format (default)
+node scripts/format-thought.js --thought "Analysis" --number 1 --total 5
+
+# Simple text format
+node scripts/format-thought.js --thought "Analysis" --number 1 --total 5 --format simple
+
+# Markdown format
+node scripts/format-thought.js --thought "Analysis" --number 1 --total 5 --format markdown
+
+# With revision
+node scripts/format-thought.js --thought "Revised" --number 2 --total 5 --revision 1
+
+# With branch
+node scripts/format-thought.js --thought "Branch" --number 2 --total 5 --branch 1 --branchId "a"
+```
+
+### Running Tests
+
+```bash
+# Install dependencies (first time only)
+npm install
+
+# Run all tests
+npm test
+
+# Run tests in watch mode
+npm run test:watch
+
+# Run with coverage
+npm run test:coverage
+```
+
+## When to Use Scripts
+
+**Use scripts when**:
+- Need deterministic validation of thought structure
+- Want persistent thought history tracking
+- Require formatted output for documentation
+- Building tools that integrate with sequential thinking
+
+**Don't use scripts when**:
+- Applying methodology directly in responses
+- Want lightweight, inline thinking
+- No need for validation or tracking
+
+Scripts are **optional tooling** - the methodology can be applied without them.
+
+## Source
+
+Converted from: https://github.com/modelcontextprotocol/servers/tree/main/src/sequentialthinking
+
+Original MCP server by Anthropic (MIT License).
+Skill conversion:
+- Extracts methodology as instructions
+- Adds executable scripts for deterministic validation
+- Makes tool-independent while preserving functionality

package/skills/tier-1/sequential-thinking/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: sequential-thinking
+description: Apply structured, reflective problem-solving for complex tasks requiring multi-step analysis, revision capability, and hypothesis verification. Use for complex problem decomposition, adaptive planning, analysis needing course correction, problems with unclear scope, multi-step solutions, and hypothesis-driven work.
+version: 1.0.0
+license: MIT
+---
+
+# Sequential Thinking
+
+Structured problem-solving via manageable, reflective thought sequences with dynamic adjustment.
+
+## When to Apply
+
+- Complex problem decomposition
+- Adaptive planning with revision capability
+- Analysis needing course correction
+- Problems with unclear/emerging scope
+- Multi-step solutions requiring context maintenance
+- Hypothesis-driven investigation/debugging
+
+## Core Process
+
+### 1. Start with Loose Estimate
+```
+Thought 1/5: [Initial analysis]
+```
+Adjust dynamically as understanding evolves.
+
+### 2. Structure Each Thought
+- Build on previous context explicitly
+- Address one aspect per thought
+- State assumptions, uncertainties, realizations
+- Signal what next thought should address
+
+### 3. Apply Dynamic Adjustment
+- **Expand**: More complexity discovered → increase total
+- **Contract**: Simpler than expected → decrease total
+- **Revise**: New insight invalidates previous → mark revision
+- **Branch**: Multiple approaches → explore alternatives
+
+### 4. Use Revision When Needed
+```
+Thought 5/8 [REVISION of Thought 2]: [Corrected understanding]
+- Original: [What was stated]
+- Why revised: [New insight]
+- Impact: [What changes]
+```
+
+### 5. Branch for Alternatives
+```
+Thought 4/7 [BRANCH A from Thought 2]: [Approach A]
+Thought 4/7 [BRANCH B from Thought 2]: [Approach B]
+```
+Compare explicitly, converge with decision rationale.
+
+### 6. Generate & Verify Hypotheses
+```
+Thought 6/9 [HYPOTHESIS]: [Proposed solution]
+Thought 7/9 [VERIFICATION]: [Test results]
+```
+Iterate until hypothesis verified.
+
+### 7. Complete Only When Ready
+Mark final: `Thought N/N [FINAL]`
+
+Complete when:
+- Solution verified
+- All critical aspects addressed
+- Confidence achieved
+- No outstanding uncertainties
+
+## Application Modes
+
+**Explicit**: Use visible thought markers when complexity warrants visible reasoning or user requests breakdown.
+
+**Implicit**: Apply methodology internally for routine problem-solving where thinking aids accuracy without cluttering response.
+
+## Scripts (Optional)
+
+Optional scripts for deterministic validation/tracking:
+- `scripts/process-thought.js` - Validate & track thoughts with history
+- `scripts/format-thought.js` - Format for display (box/markdown/simple)
+
+See README.md for usage examples. Use when validation/persistence needed; otherwise apply methodology directly.
+
+## References
+
+Load when deeper understanding needed:
+- `references/core-patterns.md` - Revision & branching patterns
+- `references/examples-api.md` - API design example
+- `references/examples-debug.md` - Debugging example
+- `references/examples-architecture.md` - Architecture decision example
+- `references/advanced-techniques.md` - Spiral refinement, hypothesis testing, convergence
+- `references/advanced-strategies.md` - Uncertainty, revision cascades, meta-thinking

package/skills/tier-1/sequential-thinking/package.json

@@ -0,0 +1,31 @@
+{
+  "name": "sequential-thinking-skill",
+  "version": "1.0.0",
+  "description": "Sequential thinking methodology with thought processing scripts",
+  "main": "scripts/process-thought.js",
+  "scripts": {
+    "test": "jest",
+    "test:watch": "jest --watch",
+    "test:coverage": "jest --coverage"
+  },
+  "keywords": [
+    "sequential-thinking",
+    "problem-solving",
+    "agent-skill"
+  ],
+  "author": "Converted from Anthropic MCP Server",
+  "license": "MIT",
+  "devDependencies": {
+    "jest": "^29.7.0"
+  },
+  "jest": {
+    "testEnvironment": "node",
+    "testMatch": [
+      "**/tests/**/*.test.js"
+    ],
+    "coveragePathIgnorePatterns": [
+      "/node_modules/",
+      "/tests/"
+    ]
+  }
+}