code-ai-installer 2.4.1 → 3.0.0

package/locales/en/.agents/skills/security-review/SKILL.md

@@ -1,277 +0,0 @@
----
-name: security-review
-description: AppSec review for endpoints/authorization/input/secrets/sensitive features. Checklist + patterns (OWASP baseline).
----
-
-# Skill: Security Review (AppSec)
-
-Deep code security review: from secrets to injection.
-
-**Sections:**
-1. [When to activate](#1-when)
-2. [Checklist](#2-checklist)
-3. [DO / DON'T Examples](#3-examples)
-4. [Automated Scans](#4-automated)
-5. [Output Template](#5-output)
-
----
-
-## 1. When to activate
-
-| Trigger | Depth |
-|---------|-------|
-| New API endpoint | Full review |
-| AuthN/AuthZ changes | Focus: auth section |
-| User input / file uploads | Focus: injection, XSS |
-| Secrets/credentials touched | Focus: secrets |
-| Payments / PII / sensitive data | Full review + GDPR check |
-| Third-party integration | Focus: SSRF, secrets, injection |
-| Webhook handler | Focus: auth, injection, idempotency |
-
----
-
-## 2. Checklist
-
-### 2.1 Secrets Management
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| SEC-01 | No hardcoded secrets (passwords, API keys, tokens) | 🔴 P0 | ☐ |
-| SEC-02 | Secrets in env vars only, `.env.example` committed (no values) | 🔴 P0 | ☐ |
-| SEC-03 | pino redact configured for `password`, `token`, `authorization`, `cookie` | 🟠 P1 | ☐ |
-| SEC-04 | `.gitignore` includes `.env`, `*.pem`, `*.key` | 🔴 P0 | ☐ |
-| SEC-05 | Secrets validated at startup (fail fast if missing) | 🟠 P1 | ☐ |
-
-### 2.2 Input Validation
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| SEC-06 | Zod schema on every endpoint (whitelist approach) | 🔴 P0 | ☐ |
-| SEC-07 | Validation in middleware, before business logic | 🟠 P1 | ☐ |
-| SEC-08 | Error response doesn't expose internals (no Mongoose, no stack) | 🔴 P0 | ☐ |
-| SEC-09 | Numeric/string limits enforced (max length, min/max value) | 🟠 P1 | ☐ |
-
-### 2.3 Injection
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| SEC-10 | No string concatenation for queries (`Model.find(req.query)` = P0) | 🔴 P0 | ☐ |
-| SEC-11 | Safe filter builder for MongoDB (no `$where`, no user `$` operators) | 🔴 P0 | ☐ |
-| SEC-12 | No `eval()`, `Function()`, `child_process.exec(userInput)` | 🔴 P0 | ☐ |
-| SEC-13 | Mongoose `strictQuery: true` | 🟠 P1 | ☐ |
-
-### 2.4 Auth & AuthZ
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| SEC-14 | Auth check on every protected endpoint | 🔴 P0 | ☐ |
-| SEC-15 | IDOR prevention: verify ownership before data access | 🔴 P0 | ☐ |
-| SEC-16 | Tokens not in localStorage (prefer httpOnly cookies or server-side) | 🟠 P1 | ☐ |
-| SEC-17 | JWT expiration enforced, refresh flow defined | 🟠 P1 | ☐ |
-
-### 2.5 XSS & CSP
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| SEC-18 | No `dangerouslySetInnerHTML` without DOMPurify | 🔴 P0 | ☐ |
-| SEC-19 | User-generated content sanitized before rendering | 🔴 P0 | ☐ |
-| SEC-20 | Helmet configured with CSP (if applicable) | 🟠 P1 | ☐ |
-
-### 2.6 CSRF
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| SEC-21 | Cookie-based auth: `SameSite=Strict/Lax` | 🟠 P1 | ☐ |
-| SEC-22 | CSRF token for state-changing operations (if cookie auth) | 🟠 P1 | ☐ |
-
-### 2.7 Rate Limiting
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| SEC-23 | Rate limiting on public endpoints | 🟠 P1 | ☐ |
-| SEC-24 | Stricter limits on auth endpoints (login, register) | 🟠 P1 | ☐ |
-| SEC-25 | Rate limiting on expensive operations (file upload, search) | 🟡 P2 | ☐ |
-
-### 2.8 Data Exposure
-
-| # | Check | Severity | Status |
-|---|-------|----------|--------|
-| SEC-26 | No stack trace in production error responses | 🔴 P0 | ☐ |
-| SEC-27 | No PII/secrets in logs | 🔴 P0 | ☐ |
-| SEC-28 | `.select()` on queries — don't return unnecessary fields | 🟠 P1 | ☐ |
-| SEC-29 | Response doesn't include internal IDs unnecessarily | 🟡 P2 | ☐ |
-
----
-
-## 3. DO / DON'T Examples
-
-### Input Validation
-
-```javascript
-// ❌ DON'T: No validation, raw body to DB
-router.post('/coupons', async (req, res) => {
-  const coupon = await Coupon.create(req.body); // NoSQL injection risk!
-  res.json(coupon);
-});
-
-// ✅ DO: Zod validation middleware, safe create
-router.post('/coupons', validate(createCouponSchema), async (req, res) => {
-  const coupon = await couponService.create(req.validated);
-  res.status(201).json({ data: coupon });
-});
-```
-
-### NoSQL Injection
-
-```javascript
-// ❌ DON'T: User input directly in query
-const user = await User.findOne({ email: req.query.email }); // $gt injection
-// Attack: ?email[$gt]= → matches ALL documents
-
-// ✅ DO: Safe filter builder
-const email = String(req.query.email); // Force string, strip operators
-const user = await User.findOne({ email });
-```
-
-### IDOR (Insecure Direct Object Reference)
-
-```javascript
-// ❌ DON'T: No ownership check
-router.get('/settings/:id', async (req, res) => {
-  const settings = await Settings.findById(req.params.id);
-  res.json(settings); // Any user can read ANY settings!
-});
-
-// ✅ DO: Verify ownership
-router.get('/settings/:id', auth, async (req, res) => {
-  const settings = await Settings.findOne({
-    _id: req.params.id,
-    appInstanceId: req.appInstanceId  // Only own data
-  });
-  if (!settings) return res.status(404).json({ error: { code: 'NOT_FOUND' } });
-  res.json({ data: settings });
-});
-```
-
-### Error Exposure
-
-```javascript
-// ❌ DON'T: Expose internals
-app.use((err, req, res, next) => {
-  res.status(500).json({
-    error: err.message,    // Mongoose error with field names
-    stack: err.stack,      // Full stack trace!
-    query: err.query       // DB query details!
-  });
-});
-
-// ✅ DO: Safe error handler
-app.use((err, req, res, next) => {
-  req.log.error({ err, requestId: req.id }, 'Unhandled error');
-  res.status(500).json({
-    error: { code: 'INTERNAL_ERROR', message: 'Something went wrong' }
-  });
-});
-```
-
-### Secrets in Code
-
-```javascript
-// ❌ DON'T
-const API_KEY = 'sk-live-abc123xyz';  // Hardcoded!
-console.log('Token:', user.refreshToken); // PII in logs!
-
-// ✅ DO
-const API_KEY = process.env.WIX_APP_SECRET;
-if (!API_KEY) throw new Error('WIX_APP_SECRET is required');
-logger.info({ userId: user.id }, 'User authenticated'); // No token
-```
-
----
-
-## 4. Automated Scans
-
-### Grep patterns
-
-```bash
-# 🔴 P0 — Immediate action
-grep_search: Query="eval("                         → Code injection
-grep_search: Query="dangerouslySetInnerHTML"        → XSS risk
-grep_search: Query="password.*=.*['\"]"             → Hardcoded secret
-grep_search: Query="apiKey.*=.*['\"]"               → Hardcoded secret
-grep_search: Query="Model.find(req."               → NoSQL injection
-grep_search: Query="child_process"                  → Command injection risk
-grep_search: Query="\\$where"                       → MongoDB $where injection
-
-# 🟠 P1 — Review needed
-grep_search: Query="console.log"                    → Replace with pino
-grep_search: Query="localStorage.setItem.*token"    → Token in storage
-grep_search: Query="res.status(500).json.*err"      → Error exposure
-grep_search: Query="cors({ origin: '*'"             → Open CORS
-```
-
-### CLI commands
-
-```bash
-# Dependency audit
-npm audit --audit-level=high
-
-# Secret scanning
-npx secretlint "**/*"
-
-# Outdated packages
-npm outdated
-```
-
----
-
-## 5. Output Template
-
-```markdown
-# Security Review Report
-
-**Scope:** <PR/feature/module>
-**Reviewer:** Reviewer Agent
-**Date:** YYYY-MM-DD
-**OWASP categories checked:** 8/10
-
-## Findings
-
-| # | Severity | Category | File:Line | Finding | Fix |
-|---|----------|----------|-----------|---------|-----|
-| 1 | 🔴 P0 | Injection | `routes/settings.js:32` | Raw `req.body` passed to `Model.create()` | Add Zod validation middleware |
-| 2 | 🔴 P0 | IDOR | `controllers/coupon.js:18` | No ownership check on DELETE | Verify `appInstanceId` match |
-| 3 | 🟠 P1 | Headers | `server.js` | No Helmet middleware | Add `app.use(helmet())` |
-
-## Automated Scan Results
-| Scan | Result |
-|------|--------|
-| npm audit | ✅ No high/critical |
-| secretlint | ✅ Clean |
-| grep: eval/exec | ✅ Clean |
-| grep: hardcoded secrets | ⚠️ 1 finding (SEC-01) |
-
-## Checklist Summary
-- P0: X findings (must fix)
-- P1: Y findings (should fix)
-- P2: Z findings (optional)
-
-## Security Test Recommendations
-- [ ] Test: invalid input → 400 (not 500)
-- [ ] Test: wrong appInstanceId → 403
-- [ ] Test: duplicate create → 409
-- [ ] Test: missing auth → 401
-
-## Verdict
-- ✅ SECURE — no P0/P1
-- ⚠️ CONDITIONAL — fix P0 before merge
-- ❌ BLOCKED — critical vulnerabilities found
-```
-
----
-
-## See also
-- `$security-baseline-dev` — implementation patterns (Zod, Helmet, safe filter)
-- `$threat-model-baseline` — architecture-level threat model
-- `$code-review-checklist` — general code review
-- `$review-reference-snippets` — more DO/DON'T examples

package/locales/en/.agents/skills/security-review/agents/claude.json

@@ -1,18 +0,0 @@
-{
-  "name": "security-review",
-  "display_name": "Security Review (AppSec)",
-  "description": "AppSec review for endpoints/authorization/input/secrets/sensitive features. Checklist + patterns (OWASP baseline).",
-  "default_prompt": "Use $security-review when the task matches the \"Security Review (AppSec)\" skill.",
-  "triggers": [
-    "security-review",
-    "security review",
-    "Security Review (AppSec)",
-    "AppSec review for endpoints/authorization/input/secrets/sensitive features"
-  ],
-  "capabilities": [
-    "security",
-    "review"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/skills/security-review/agents/copilot.json

@@ -1,18 +0,0 @@
-{
-  "name": "security-review",
-  "display_name": "Security Review (AppSec)",
-  "description": "AppSec review for endpoints/authorization/input/secrets/sensitive features. Checklist + patterns (OWASP baseline).",
-  "default_prompt": "Use $security-review when the task matches the \"Security Review (AppSec)\" skill.",
-  "triggers": [
-    "security-review",
-    "security review",
-    "Security Review (AppSec)",
-    "AppSec review for endpoints/authorization/input/secrets/sensitive features"
-  ],
-  "capabilities": [
-    "security",
-    "review"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/skills/security-review/agents/gemini.json

@@ -1,18 +0,0 @@
-{
-  "name": "security-review",
-  "display_name": "Security Review (AppSec)",
-  "description": "AppSec review for endpoints/authorization/input/secrets/sensitive features. Checklist + patterns (OWASP baseline).",
-  "default_prompt": "Use $security-review when the task matches the \"Security Review (AppSec)\" skill.",
-  "triggers": [
-    "security-review",
-    "security review",
-    "Security Review (AppSec)",
-    "AppSec review for endpoints/authorization/input/secrets/sensitive features"
-  ],
-  "capabilities": [
-    "security",
-    "review"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/skills/security-review/agents/openai.yaml

@@ -1,8 +0,0 @@
-interface:
-  display_name: "Security Review (AppSec)"
-  short_description: "AppSec review for endpoints/authorization/input/secrets/sensitive features. Checklist + pattern…"
-  default_prompt: "Use $security-review when the task matches the \"Security Review (AppSec)\" skill."
-dependencies:
-  tools: []
-policy:
-  allow_implicit_invocation: true

package/locales/en/.agents/skills/security-review/agents/qwen.json

@@ -1,18 +0,0 @@
-{
-  "name": "security-review",
-  "display_name": "Security Review (AppSec)",
-  "description": "AppSec review for endpoints/authorization/input/secrets/sensitive features. Checklist + patterns (OWASP baseline).",
-  "default_prompt": "Use $security-review when the task matches the \"Security Review (AppSec)\" skill.",
-  "triggers": [
-    "security-review",
-    "security review",
-    "Security Review (AppSec)",
-    "AppSec review for endpoints/authorization/input/secrets/sensitive features"
-  ],
-  "capabilities": [
-    "security",
-    "review"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/skills/security-review/agents/skill.yaml

@@ -1,22 +0,0 @@
-version: 1
-name: "security-review"
-display_name: "Security Review (AppSec)"
-description: "AppSec review for endpoints/authorization/input/secrets/sensitive features. Checklist + patterns (OWASP baseline)."
-default_prompt: "Use $security-review when the task matches the \"Security Review (AppSec)\" skill."
-triggers:
-  - "security-review"
-  - "security review"
-  - "Security Review (AppSec)"
-  - "AppSec review for endpoints/authorization/input/secrets/sensitive features"
-capabilities:
-  - "security"
-  - "review"
-tools: []
-invocation:
-  explicit: true
-  implicit: true
-localization:
-  default_locale: "en"
-  available_locales:
-    - "ru"
-    - "en"

package/locales/en/.agents/skills/security-review-baseline/SKILL.md

@@ -1,119 +0,0 @@
----
-name: security-review-baseline
-description: Security review by baseline — OWASP risks, authz, validation, SSRF/XSS/CSRF, secrets, safe logs/errors, least privilege.
----
-
-# Skill: Security Review Baseline
-
-Quick security review using a basic checklist. For a deep review → `$security-review`.
-
-> **When to use:** Quick baseline during every review (5-10 min).
-> **For deep review** of specific areas → `$security-review`.
-
-**Sections:**
-1. [Quick Checklist](#1-checklist)
-2. [Automated Scan](#2-scan)
-3. [Quick Reference](#3-reference)
-4. [Output Template](#4-output)
-
----
-
-## 1. Quick Checklist
-
-| # | Category | Check | Severity | Status |
-|---|----------|-------|----------|--------|
-| SB-01 | **Secrets** | No hardcoded passwords/tokens/API keys in code | 🔴 P0 | ☐ |
-| SB-02 | **Secrets** | No secrets in logs or error responses | 🔴 P0 | ☐ |
-| SB-03 | **Secrets** | `.env` in `.gitignore`, `.env.example` committed | 🔴 P0 | ☐ |
-| SB-04 | **Validation** | Zod/schema validation on every API endpoint | 🔴 P0 | ☐ |
-| SB-05 | **Validation** | Error responses don't expose internals (no stack, no DB errors) | 🔴 P0 | ☐ |
-| SB-06 | **Auth** | Server-side auth check on protected endpoints | 🔴 P0 | ☐ |
-| SB-07 | **Auth** | IDOR prevention (ownership verification before data access) | 🔴 P0 | ☐ |
-| SB-08 | **Injection** | No `eval()`, `Function()`, `child_process.exec(userInput)` | 🔴 P0 | ☐ |
-| SB-09 | **Injection** | No raw user input in DB queries (NoSQL injection) | 🔴 P0 | ☐ |
-| SB-10 | **XSS** | No `dangerouslySetInnerHTML` without sanitize | 🔴 P0 | ☐ |
-| SB-11 | **CSRF** | Cookie auth → `SameSite=Strict/Lax` + CSRF token | 🟠 P1 | ☐ |
-| SB-12 | **SSRF** | User-controlled URL fetch → allowlist + block internal ranges | 🔴 P0 | ☐ |
-| SB-13 | **Rate Limit** | Rate limiting on public/expensive endpoints | 🟠 P1 | ☐ |
-| SB-14 | **Logging** | No PII in logs (email masked, no passwords/tokens) | 🔴 P0 | ☐ |
-| SB-15 | **Logging** | Audit trail for critical operations | 🟠 P1 | ☐ |
-| SB-16 | **Deps** | `npm audit` — no high/critical vulnerabilities | 🟠 P1 | ☐ |
-| SB-17 | **Headers** | Helmet configured (or security headers set) | 🟠 P1 | ☐ |
-
----
-
-## 2. Automated Scan
-
-Run these during every review:
-
-```bash
-# 🔴 P0 checks
-grep_search: Query="eval("                          → Code injection
-grep_search: Query="dangerouslySetInnerHTML"         → XSS risk
-grep_search: Query="password.*=.*['\"]"              → Hardcoded secret
-grep_search: Query="apiKey.*=.*['\"]"                → Hardcoded secret
-grep_search: Query="token.*=.*['\"]"                 → Hardcoded secret
-grep_search: Query="Model.find(req."                → NoSQL injection
-grep_search: Query="child_process"                   → Command injection
-grep_search: Query="\\$where"                        → MongoDB injection
-
-# 🟠 P1 checks
-grep_search: Query="console.log"                     → Replace with pino
-grep_search: Query="cors({ origin: '*'"              → Open CORS
-grep_search: Query="eslint-disable"                  → Rule bypass
-
-# CLI
-npm audit --audit-level=high
-```
-
----
-
-## 3. Quick Reference
-
-For DO/DON'T examples → see `$review-reference-snippets`:
-- Secrets: sections A, B
-- Validation: section C
-- Errors: section D
-- Injection: sections E, E2
-- Auth: section G
-- XSS: section I
-- SSRF: section J
-- CSRF: section H
-
----
-
-## 4. Output Template
-
-```markdown
-# Security Baseline Check
-
-**Scope:** <PR/module>
-**Date:** YYYY-MM-DD
-
-## Quick Scan Results
-| Check | Result |
-|-------|--------|
-| Hardcoded secrets | ✅ Clean |
-| eval/exec | ✅ Clean |
-| npm audit | ⚠️ 1 moderate |
-| XSS risk | ✅ Clean |
-
-## Findings
-| # | Severity | Check | File:Line | Finding | Fix |
-|---|----------|-------|-----------|---------|-----|
-| 1 | 🔴 P0 | SB-07 | `routes/settings.js:25` | No ownership check | Add appInstanceId verification |
-
-## Summary
-- P0: X findings → must fix
-- P1: Y findings → should fix
-
-## Need deeper review?
-→ Activate `$security-review` for: [auth / injection / SSRF / etc.]
-```
-
----
-
-## See also
-- `$security-review` — deep AppSec review (29 checks)
-- `$review-reference-snippets` — DO/DON'T code examples (A-V)
-- `$threat-model-baseline` — architecture-level threats

package/locales/en/.agents/skills/security-review-baseline/agents/claude.json

@@ -1,18 +0,0 @@
-{
-  "name": "security-review-baseline",
-  "display_name": "Security Review Baseline",
-  "description": "Security review by baseline — OWASP risks, authz, validation, SSRF/XSS/CSRF, secrets, safe logs/errors, least privilege.",
-  "default_prompt": "Use $security-review-baseline when the task matches the \"Security Review Baseline\" skill.",
-  "triggers": [
-    "security-review-baseline",
-    "security review baseline",
-    "Security review by baseline — OWASP risks, authz, validation, SSRF/XSS/CSRF, secrets, safe logs/errors, least privilege"
-  ],
-  "capabilities": [
-    "security",
-    "review",
-    "baseline"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/skills/security-review-baseline/agents/copilot.json

@@ -1,18 +0,0 @@
-{
-  "name": "security-review-baseline",
-  "display_name": "Security Review Baseline",
-  "description": "Security review by baseline — OWASP risks, authz, validation, SSRF/XSS/CSRF, secrets, safe logs/errors, least privilege.",
-  "default_prompt": "Use $security-review-baseline when the task matches the \"Security Review Baseline\" skill.",
-  "triggers": [
-    "security-review-baseline",
-    "security review baseline",
-    "Security review by baseline — OWASP risks, authz, validation, SSRF/XSS/CSRF, secrets, safe logs/errors, least privilege"
-  ],
-  "capabilities": [
-    "security",
-    "review",
-    "baseline"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/skills/security-review-baseline/agents/gemini.json

@@ -1,18 +0,0 @@
-{
-  "name": "security-review-baseline",
-  "display_name": "Security Review Baseline",
-  "description": "Security review by baseline — OWASP risks, authz, validation, SSRF/XSS/CSRF, secrets, safe logs/errors, least privilege.",
-  "default_prompt": "Use $security-review-baseline when the task matches the \"Security Review Baseline\" skill.",
-  "triggers": [
-    "security-review-baseline",
-    "security review baseline",
-    "Security review by baseline — OWASP risks, authz, validation, SSRF/XSS/CSRF, secrets, safe logs/errors, least privilege"
-  ],
-  "capabilities": [
-    "security",
-    "review",
-    "baseline"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/skills/security-review-baseline/agents/openai.yaml

@@ -1,8 +0,0 @@
-interface:
-  display_name: "Security Review Baseline"
-  short_description: "Security review by baseline — OWASP risks, authz, validation, SSRF/XSS/CSRF, secrets, safe logs…"
-  default_prompt: "Use $security-review-baseline when the task matches the \"Security Review Baseline\" skill."
-dependencies:
-  tools: []
-policy:
-  allow_implicit_invocation: true

package/locales/en/.agents/skills/security-review-baseline/agents/qwen.json

@@ -1,18 +0,0 @@
-{
-  "name": "security-review-baseline",
-  "display_name": "Security Review Baseline",
-  "description": "Security review by baseline — OWASP risks, authz, validation, SSRF/XSS/CSRF, secrets, safe logs/errors, least privilege.",
-  "default_prompt": "Use $security-review-baseline when the task matches the \"Security Review Baseline\" skill.",
-  "triggers": [
-    "security-review-baseline",
-    "security review baseline",
-    "Security review by baseline — OWASP risks, authz, validation, SSRF/XSS/CSRF, secrets, safe logs/errors, least privilege"
-  ],
-  "capabilities": [
-    "security",
-    "review",
-    "baseline"
-  ],
-  "tools": [],
-  "implicit_invocation": true
-}

package/locales/en/.agents/skills/security-review-baseline/agents/skill.yaml

@@ -1,22 +0,0 @@
-version: 1
-name: "security-review-baseline"
-display_name: "Security Review Baseline"
-description: "Security review by baseline — OWASP risks, authz, validation, SSRF/XSS/CSRF, secrets, safe logs/errors, least privilege."
-default_prompt: "Use $security-review-baseline when the task matches the \"Security Review Baseline\" skill."
-triggers:
-  - "security-review-baseline"
-  - "security review baseline"
-  - "Security review by baseline — OWASP risks, authz, validation, SSRF/XSS/CSRF, secrets, safe logs/errors, least privilege"
-capabilities:
-  - "security"
-  - "review"
-  - "baseline"
-tools: []
-invocation:
-  explicit: true
-  implicit: true
-localization:
-  default_locale: "en"
-  available_locales:
-    - "ru"
-    - "en"