cli-jaw 0.1.6 → 0.1.8

package/skills_ref/static-analysis/skills/codeql/references/ruleset-catalog.md

@@ -1,63 +0,0 @@
-# Ruleset Catalog
-
-## Official CodeQL Suites
-
-| Suite | False Positives | Use Case |
-|-------|-----------------|----------|
-| `security-extended` | Low | **Default** - Security audits |
-| `security-and-quality` | Medium | Comprehensive review |
-| `security-experimental` | Higher | Research, vulnerability hunting |
-
-**Usage:** `codeql/<lang>-queries:codeql-suites/<lang>-security-extended.qls`
-
-**Languages:** `cpp`, `csharp`, `go`, `java`, `javascript`, `python`, `ruby`, `swift`
-
----
-
-## Trail of Bits Packs
-
-| Pack | Language | Focus |
-|------|----------|-------|
-| `trailofbits/cpp-queries` | C/C++ | Memory safety, integer overflows |
-| `trailofbits/go-queries` | Go | Concurrency, error handling |
-| `trailofbits/java-queries` | Java | Security, code quality |
-
-**Install:**
-```bash
-codeql pack download trailofbits/cpp-queries
-codeql pack download trailofbits/go-queries
-codeql pack download trailofbits/java-queries
-```
-
----
-
-## CodeQL Community Packs
-
-| Pack | Language |
-|------|----------|
-| `GitHubSecurityLab/CodeQL-Community-Packs-JavaScript` | JavaScript/TypeScript |
-| `GitHubSecurityLab/CodeQL-Community-Packs-Python` | Python |
-| `GitHubSecurityLab/CodeQL-Community-Packs-Go` | Go |
-| `GitHubSecurityLab/CodeQL-Community-Packs-Java` | Java |
-| `GitHubSecurityLab/CodeQL-Community-Packs-CPP` | C/C++ |
-| `GitHubSecurityLab/CodeQL-Community-Packs-CSharp` | C# |
-| `GitHubSecurityLab/CodeQL-Community-Packs-Ruby` | Ruby |
-
-**Install:**
-```bash
-codeql pack download GitHubSecurityLab/CodeQL-Community-Packs-<Lang>
-```
-
-**Source:** [github.com/GitHubSecurityLab/CodeQL-Community-Packs](https://github.com/GitHubSecurityLab/CodeQL-Community-Packs)
-
----
-
-## Verify Installation
-
-```bash
-# List all installed packs
-codeql resolve qlpacks
-
-# Check specific packs
-codeql resolve qlpacks | grep -E "(trailofbits|GitHubSecurityLab)"
-```

package/skills_ref/static-analysis/skills/codeql/references/threat-models.md

@@ -1,44 +0,0 @@
-# Threat Models Reference
-
-Control which source categories are active during CodeQL analysis. By default, only `remote` sources are tracked.
-
-## Available Models
-
-| Model | Sources Included | When to Enable | False Positive Impact |
-|-------|------------------|----------------|----------------------|
-| `remote` | HTTP requests, network input | Always (default). Covers web services, APIs, network-facing code. | Low — these are the most common attack vectors. |
-| `local` | Command line args, local files | CLI tools, batch processors, desktop apps where local users are untrusted. | Medium — generates noise for web-only services where CLI args are developer-controlled. |
-| `environment` | Environment variables | Apps that read config from env vars at runtime (12-factor apps, containers). Skip for apps that only read env at startup into validated config objects. | Medium — many env reads are startup-only config, not runtime-tainted data. |
-| `database` | Database query results | Second-order injection scenarios: stored XSS, data from shared databases where other writers are untrusted. | High — most apps trust their own database. Only enable when auditing for stored/second-order attacks. |
-| `file` | File contents | File upload processors, log parsers, config file readers that accept user-provided files. | Medium — triggers on all file reads including trusted config files. |
-
-## Default Behavior
-
-With no `--threat-models` flag, CodeQL uses `remote` only. This is correct for most web applications and APIs. Expanding beyond `remote` is useful when the application's trust boundary extends to local inputs.
-
-## Usage
-
-Enable additional threat models with the `--threat-models` flag:
-
-```bash
-# Web service (default — remote only)
-codeql database analyze codeql.db \
-  -- codeql/python-queries
-
-# CLI tool — local users can provide malicious input
-codeql database analyze codeql.db \
-  --threat-models=remote,local \
-  -- codeql/python-queries
-
-# Container app reading env vars from untrusted orchestrator
-codeql database analyze codeql.db \
-  --threat-models=remote,environment \
-  -- codeql/python-queries
-
-# Full coverage — audit mode for all input vectors
-codeql database analyze codeql.db \
-  --threat-models=remote,local,environment,database,file \
-  -- codeql/python-queries
-```
-
-Multiple models can be combined. Each additional model expands the set of sources CodeQL considers tainted, increasing coverage but potentially increasing false positives. Start with the narrowest set that matches the application's actual threat model, then expand if needed.