code-ai-installer 3.0.0 → 4.0.1-a

package/domains/development/locales/en/.agents/skills/cloud-infrastructure-security/SKILL.md

@@ -1,22 +1,74 @@
 ---
 name: cloud-infrastructure-security
-description: Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR.
+description: "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR."
+type: discretionary
+domain: development
+owners:
+  - devops
+  - reviewer
+gates:
+  - OPS
+  - REV
+tech: []
+topic:
+  - review
+  - security
+  - ops
+triggers:
+  - cloud security
+  - IAM policies
+  - secrets manager
+  - CI/CD security
+  - WAF and CDN
+  - infra audit
+  - backup and DR
+related:
+  - architecture-doc
+  - dependency-supply-chain-review
+  - deployment-ci-plan
+  - deployment-ci-plan-reference
+  - docker-kubernetes-architecture
+  - k8s-manifests-conventions
+  - security-review-baseline
+  - threat-model-baseline
+budget_lines: 500
+schema_version: 1
 ---
 
-# Skill: Cloud Infrastructure Security Review
 
-Security review for cloud environments, infrastructure as code, and CI/CD pipelines.
+# Skill: Cloud & Infrastructure Security
+
+Security review for cloud environments, infrastructure as code, CI/CD pipelines and edge.
 
 **Sections:**
-1. [Workflow](#1-workflow)
-2. [Checklist (Cloud Security Baseline)](#2-checklist)
-3. [Verification Methods](#3-methods)
-4. [Red Flags](#4-red-flags)
-5. [Output Template](#5-output)
+1. [When to activate](#1-when-to-activate)
+2. [Workflow](#2-workflow)
+3. [Checklist (Cloud Security Baseline)](#3-checklist)
+4. [Verification Methods](#4-verification)
+5. [Platform-Specific Examples](#5-examples)
+6. [CI/CD Security Pipeline](#6-cicd)
+7. [Red Flags](#7-red-flags)
+8. [Pre-Deployment Gate](#8-pre-deploy)
+9. [Output Template](#9-output)
+
+---
+
+## 1. When to activate <a id="1-when-to-activate"></a>
+
+| Trigger | Focus |
+|---------|-------|
+| Deploy on AWS / GCP / Azure / Vercel / Railway | Full review |
+| IAM policies / roles changed | IAM section |
+| CI/CD pipeline modified | CI/CD section |
+| New infrastructure (Terraform / CloudFormation) | Full review |
+| Setup secrets management | Secrets section |
+| CDN / WAF configuration | CDN/WAF section |
+| Disaster recovery planning | Backup/DR section |
+| Docker / K8s deployment | → also apply `$docker-kubernetes-architecture` |
 
 ---
 
-## 1. Workflow
+## 2. Workflow <a id="2-workflow"></a>
 
 ```
 1. Get the architecture context (from $architecture-doc & $deployment-ci-plan)
@@ -38,69 +90,102 @@ Security review for cloud environments, infrastructure as code, and CI/CD pipeli
 
 ---
 
-## 2. Checklist (Cloud Security Baseline)
+## 3. Checklist (Cloud Security Baseline) <a id="3-checklist"></a>
 
-### 2.1 IAM & Authentication
+### 3.1 IAM & Access Control
 
 | # | Check | Severity | Status |
 |---|-------|----------|--------|
-| CLOUD-01 | Principle of Least Privilege (PoLP) enforced for all roles | 🔴 P0 | ☐ |
-| CLOUD-02 | No shared accounts/credentials used | 🔴 P0 | ☐ |
-| CLOUD-03 | MFA enforced for all console access | 🔴 P0 | ☐ |
-| CLOUD-04 | Service Accounts instead of user credentials for automation | 🔴 P0 | ☐ |
+| INF-01 | Least privilege (no `*` in policies, PoLP enforced for all roles) | 🔴 P0 | ☐ |
+| INF-02 | MFA for privileged accounts (admin, deploy, all console access) | 🔴 P0 | ☐ |
+| INF-03 | No root account usage in production | 🔴 P0 | ☐ |
+| INF-04 | No shared accounts/credentials | 🔴 P0 | ☐ |
+| INF-05 | Service accounts: one per app, minimal scope, not user credentials for automation | 🟠 P1 | ☐ |
+| INF-06 | Access review: quarterly, remove stale users | 🟠 P1 | ☐ |
+| INF-07 | SSO / federated identity (if org > 5 people) | 🟡 P2 | ☐ |
 
-### 2.2 Secrets Management
+### 3.2 Secrets Management
 
 | # | Check | Severity | Status |
 |---|-------|----------|--------|
-| CLOUD-05 | Secrets stored in a dedicated Secret Manager (Vault, AWS Secrets, GitHub Secrets) | 🔴 P0 | ☐ |
-| CLOUD-06 | NO hardcoded credentials in source code or `Dockerfile` | 🔴 P0 | ☐ |
-| CLOUD-07 | Environment variables not exposing secrets (e.g., in React frontend code) | 🔴 P0 | ☐ |
-| CLOUD-08 | Audit trail for secret access enabled | 🟠 P1 | ☐ |
+| INF-08 | Platform secret manager (AWS SSM, GCP Secret Manager, Vault, Doppler, GitHub Secrets) | 🔴 P0 | ☐ |
+| INF-09 | No hardcoded credentials in source code, Dockerfile, configs | 🔴 P0 | ☐ |
+| INF-10 | Environment variables not exposing secrets (e.g., in React frontend code) | 🔴 P0 | ☐ |
+| INF-11 | No secrets in CI logs, build output, Docker images | 🔴 P0 | ☐ |
+| INF-12 | `.env` files gitignored, `.env.example` committed | 🔴 P0 | ☐ |
+| INF-13 | Rotation plan for DB credentials (90 days max) | 🟠 P1 | ☐ |
+| INF-14 | Audit log on secret access | 🟠 P1 | ☐ |
 
-### 2.3 Network Security & Boundaries
+### 3.3 Network Security
 
 | # | Check | Severity | Status |
 |---|-------|----------|--------|
-| CLOUD-09 | Default deny inbound traffic rules | 🔴 P0 | ☐ |
-| CLOUD-10 | Databases NOT exposed to the public internet | 🔴 P0 | ☐ |
-| CLOUD-11 | WAF / DDoS protection active for public endpoints | 🟠 P1 | ☐ |
-| CLOUD-12 | TLS 1.2+ enforced for all in-transit data (HTTPS) | 🔴 P0 | ☐ |
-| CLOUD-13 | Private network/VPC/Subnets used to isolate layers | 🟠 P1 | ☐ |
+| INF-15 | Database not publicly accessible | 🔴 P0 | ☐ |
+| INF-16 | Default deny inbound, security groups least privilege (no 0.0.0.0/0 on DB) | 🔴 P0 | ☐ |
+| INF-17 | TLS/HTTPS everywhere, TLS 1.2+ enforced (no plain HTTP in prod) | 🔴 P0 | ☐ |
+| INF-18 | SSH/RDP only through VPN/bastion | 🟠 P1 | ☐ |
+| INF-19 | Internal services: private network only, VPC/subnet isolation | 🟠 P1 | ☐ |
 
-### 2.4 Logging & Monitoring
+### 3.4 Logging & Monitoring
 
 | # | Check | Severity | Status |
 |---|-------|----------|--------|
-| CLOUD-14 | Centralized logging for all infrastructure components | 🟠 P1 | ☐ |
-| CLOUD-15 | Access logs enabled on storage buckets / databases | 🟡 P2 | ☐ |
-| CLOUD-16 | Alerts configured for critical security events (failed logins, root access) | 🟠 P1 | ☐ |
+| INF-20 | No PII/secrets in infrastructure logs | 🔴 P0 | ☐ |
+| INF-21 | Centralized logging for all infrastructure components | 🟠 P1 | ☐ |
+| INF-22 | Admin actions audited (who/what/when) | 🟠 P1 | ☐ |
+| INF-23 | Log retention ≥ 90 days (or per compliance) | 🟠 P1 | ☐ |
+| INF-24 | Alerts on failed auth attempts, permission changes, root access, unusual traffic | 🟠 P1 | ☐ |
+| INF-25 | Access logs enabled on storage buckets / databases | 🟡 P2 | ☐ |
 
-### 2.5 Compute & Container Security
+### 3.5 Compute & Container Security
 
 | # | Check | Severity | Status |
 |---|-------|----------|--------|
-| CLOUD-17 | Containers do NOT run as `root` user | 🔴 P0 | ☐ |
-| CLOUD-18 | Minimal base images used (e.g., `alpine`, `distroless`) | 🟠 P1 | ☐ |
-| CLOUD-19 | Read-only root filesystem where possible | 🟡 P2 | ☐ |
+| INF-26 | Containers do NOT run as `root` user | 🔴 P0 | ☐ |
+| INF-27 | Minimal base images (e.g., `alpine`, `distroless`) | 🟠 P1 | ☐ |
+| INF-28 | Read-only root filesystem where possible | 🟡 P2 | ☐ |
 
-### 2.6 CI/CD & Supply Chain
+### 3.6 CI/CD Pipeline Security
 
 | # | Check | Severity | Status |
 |---|-------|----------|--------|
-| CLOUD-20 | Dependency scanning (SCA) active in CI | 🔴 P0 | ☐ |
-| CLOUD-21 | SAST (Static Analysis) tools running on PRs | 🟠 P1 | ☐ |
-| CLOUD-22 | Secrets scanning active (preventing commits with secrets) | 🔴 P0 | ☐ |
-| CLOUD-23 | Branch protection rules: Require PR reviews, disallow direct commits to `main` | 🔴 P0 | ☐ |
+| INF-29 | CI env isolated from production | 🔴 P0 | ☐ |
+| INF-30 | Secret scanning in CI (gitleaks, secretlint) — preventing commits with secrets | 🔴 P0 | ☐ |
+| INF-31 | Dependency audit (SCA) in CI (`npm audit --audit-level=high`) | 🔴 P0 | ☐ |
+| INF-32 | Branch protection: required reviews, no force push, disallow direct commits to `main` | 🔴 P0 | ☐ |
+| INF-33 | OIDC for deploy (no long-lived credentials) | 🟠 P1 | ☐ |
+| INF-34 | Container image scanning (trivy, grype) | 🟠 P1 | ☐ |
+| INF-35 | SAST (Static Analysis) on PRs (CodeQL, Semgrep) | 🟠 P1 | ☐ |
+
+### 3.7 CDN / WAF / Edge
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| INF-36 | Strict TLS 1.2+ (no SSL v3, TLS 1.0/1.1) | 🔴 P0 | ☐ |
+| INF-37 | WAF managed rules enabled (OWASP Core Rule Set) | 🟠 P1 | ☐ |
+| INF-38 | Rate limiting on public endpoints | 🟠 P1 | ☐ |
+| INF-39 | Security headers at edge (HSTS, X-Frame-Options, CSP) | 🟠 P1 | ☐ |
+| INF-40 | Origin server not directly accessible (CDN proxy only) | 🟠 P1 | ☐ |
+| INF-41 | Bot protection / challenge mode | 🟡 P2 | ☐ |
+
+### 3.8 Backup & DR
+
+| # | Check | Severity | Status |
+|---|-------|----------|--------|
+| INF-42 | Automated backups (DB, configs) | 🟠 P1 | ☐ |
+| INF-43 | Backup retention defined (30+ days) | 🟠 P1 | ☐ |
+| INF-44 | Restore tested (at least once) | 🟠 P1 | ☐ |
+| INF-45 | RPO / RTO documented | 🟠 P1 | ☐ |
+| INF-46 | PITR enabled (if available) | 🟡 P2 | ☐ |
 
 ---
 
-## 3. Verification Methods
+## 4. Verification Methods <a id="4-verification"></a>
 
 ### Grep patterns for misconfigurations
 
 ```bash
-# 🔴 P0: Detect Hardcoded Secrets (General patterns)
+# 🔴 P0: Detect Hardcoded Secrets (general patterns)
 grep_search: Query="password\s*=\s*[\"'][^\"']+[\"']" IsRegex=true
 grep_search: Query="secret\s*=\s*[\"'][^\"']+[\"']" IsRegex=true
 grep_search: Query="token\s*=\s*[\"'][a-zA-Z0-9_\-]+[\"']" IsRegex=true
@@ -121,30 +206,150 @@ grep_search: Query="dependabot" Includes=[".github/workflows/*"]
 
 ---
 
-## 4. Red Flags
+## 5. Platform-Specific Examples <a id="5-examples"></a>
+
+### AWS IAM Policy (least privilege)
+
+```json
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": [
+        "s3:GetObject",
+        "s3:PutObject"
+      ],
+      "Resource": "arn:aws:s3:::my-app-uploads/*"
+    }
+  ]
+}
+```
+
+```
+// ❌ DON'T
+"Action": "*"
+"Resource": "*"
+
+// ✅ DO
+"Action": ["s3:GetObject", "s3:PutObject"]
+"Resource": "arn:aws:s3:::specific-bucket/*"
+```
+
+### Cloudflare WAF Rule
+
+```
+Expression: (http.request.uri.path contains "/api/" and
+             not http.request.uri.path contains "/health/")
+Action: Challenge
+Rate limit: 100 req/min per IP
+```
+
+### Security Headers (Cloudflare / Caddy)
+
+```
+# Caddy security headers
+header {
+    X-Content-Type-Options    "nosniff"
+    X-Frame-Options           "SAMEORIGIN"
+    X-XSS-Protection          "1; mode=block"
+    Strict-Transport-Security "max-age=31536000; includeSubDomains"
+    Referrer-Policy            "strict-origin-when-cross-origin"
+    Permissions-Policy         "camera=(), microphone=(), geolocation=()"
+}
+```
+
+### Docker Compose Network Isolation
+
+```yaml
+services:
+  api:
+    networks: [frontend, backend]
+  gateway:
+    networks: [frontend]
+  mongo:
+    networks: [backend]    # Not accessible from gateway!
+
+networks:
+  frontend:
+  backend:
+    internal: true  # No external access
+```
+
+---
+
+## 6. CI/CD Security Pipeline <a id="6-cicd"></a>
+
+```yaml
+# GitHub Actions security job
+security:
+  runs-on: ubuntu-latest
+  steps:
+    - uses: actions/checkout@v4
+
+    # Secret scanning
+    - name: Gitleaks
+      uses: gitleaks/gitleaks-action@v2
+
+    # Dependency audit
+    - name: npm audit
+      run: npm audit --audit-level=high
+
+    # Container scanning
+    - name: Trivy
+      uses: aquasecurity/trivy-action@master
+      with:
+        image-ref: 'app-api:latest'
+        severity: 'CRITICAL,HIGH'
+        exit-code: '1'
+
+    # SAST (static analysis)
+    - name: CodeQL
+      uses: github/codeql-action/analyze@v3
+```
+
+---
+
+## 7. Red Flags <a id="7-red-flags"></a>
 
 | Red Flag | Description | Severity | Fix |
 |----------|-------------|----------|-----|
-| **Public Database** | DB port (e.g., 5432, 27017) bound to `0.0.0.0` or open in Security Group | 🔴 P0 | Bind to localhost (`127.0.0.1`) or inside private VPC. |
-| **Secrets in code** | AWS keys, API tokens committed to repository | 🔴 P0 | Revoke immediately. Use `.env` file + secret manager. |
-| **Full Admin IAM** | Workloads or user roles have `AdministratorAccess` wildcard (`*`) | 🔴 P0 | Scope down to specific actions and resources (PoLP). |
-| **Root Containers** | Docker images running as default `root` | 🔴 P0 | Add `USER node` (or equivalent) in Dockerfile. |
-| **No Branch Protection** | Main branch accepts direct commits without review | 🔴 P0 | Enforce PRs and 1+ reviewers in GitHub settings. |
+| **Public Database** | DB port (e.g., 5432, 27017) bound to `0.0.0.0` or open in Security Group | 🔴 P0 | Bind to localhost (`127.0.0.1`) or inside private VPC |
+| **Secrets in code** | AWS keys, API tokens committed to repository | 🔴 P0 | Revoke immediately. Use `.env` file + secret manager |
+| **Full Admin IAM** | Workloads or user roles have `AdministratorAccess` wildcard (`*`) | 🔴 P0 | Scope down to specific actions and resources (PoLP) |
+| **Root Containers** | Docker images running as default `root` | 🔴 P0 | Add `USER node` (or equivalent) in Dockerfile |
+| **No Branch Protection** | Main branch accepts direct commits without review | 🔴 P0 | Enforce PRs and 1+ reviewers in GitHub settings |
 
 ---
 
-## 5. Output Template
+## 8. Pre-Deployment Gate <a id="8-pre-deploy"></a>
+
+### Security sign-off checklist
+
+| # | Category | Check | Status |
+|---|----------|-------|--------|
+| 1 | IAM | Least privilege verified | ☐ |
+| 2 | Secrets | All in secret manager, rotation documented | ☐ |
+| 3 | Network | DB private, TLS everywhere, firewalls set | ☐ |
+| 4 | Logging | Audit logging enabled, no PII | ☐ |
+| 5 | Compute | Containers non-root, minimal base images | ☐ |
+| 6 | CI/CD | Secret scan + dep audit + image scan pass | ☐ |
+| 7 | CDN/WAF | WAF rules active, rate limits set | ☐ |
+| 8 | Encryption | TLS 1.2+, data at rest encrypted | ☐ |
+| 9 | Backup | Backups scheduled, restore tested | ☐ |
+| 10 | Runbooks | Deploy, rollback, incident docs exist | ☐ |
+| 11 | Incident plan | Contact list, escalation path defined | ☐ |
+## 9. Output Template <a id="9-output"></a>
 
 ```markdown
-# Cloud Infrastructure Security Review
+# Cloud & Infrastructure Security Review
 
-**Scope:** <Infrastructure repo / CI/CD pipeline / Module>
+**Scope:** <infrastructure repo / CI/CD pipeline / module>
 **Reviewer:** Reviewer Agent
 **Date:** YYYY-MM-DD
 **Reference:** $deployment-ci-plan, $docker-kubernetes-architecture
 
 ## Findings Summary
-
 - **Total Checks Assessed:** X
 - **P0 Blockers:** Y
 - **P1 Concerns:** Z
@@ -152,34 +357,44 @@ grep_search: Query="dependabot" Includes=[".github/workflows/*"]
 
 ## Detailed Findings
 
-| # | Severity | Check Code | File/Component | Finding Description | Fix Recommended |
-|---|----------|------------|----------------|---------------------|-----------------|
-| 1 | 🔴 P0 | CLOUD-06 | `docker-compose.yml` | DB password hardcoded (`MYSQL_PASSWORD=root`) | Inject via `.env` file and Docker Secrets. |
-| 2 | 🔴 P0 | CLOUD-17 | `Dockerfile` | Image runs as root | Add `USER node` before `CMD`. |
-| 3 | 🟠 P1 | CLOUD-21 | `.github/workflows/ci.yml` | No SAST/SCA step in pipeline | Add `npm audit` or CodeQL step to CI. |
-| 4 | 🟡 P2 | CLOUD-19 | `deployment.yaml` | Root FS is writable | Mount specific paths as writeable, set `readOnlyRootFilesystem: true`. |
-
-## Compliance Overview (by Domain)
-
-| Domain | Status |
-|--------|:------:|
-| IAM & Auth | ✅ |
-| Secrets Management | ❌ |
-| Network Security | ✅ |
-| Logging & Monitoring | ⚠️ |
-| Compute/Containers | ❌ |
-| CI/CD & Supply Chain | ⚠️ |
+| # | Severity | Check Code | File/Component | Finding | Fix |
+|---|----------|------------|----------------|---------|-----|
+| 1 | 🔴 P0 | INF-15 | `docker-compose.yml` | MongoDB port 27017 publicly accessible | Restrict to private network |
+| 2 | 🔴 P0 | INF-09 | `docker-compose.yml` | DB password hardcoded (`MYSQL_PASSWORD=root`) | Inject via `.env` + secret manager |
+| 3 | 🔴 P0 | INF-26 | `Dockerfile` | Image runs as root | Add `USER node` before `CMD` |
+| 4 | 🟠 P1 | INF-30 | `.github/workflows/ci.yml` | No secret scanning | Add gitleaks step |
+| 5 | 🟠 P1 | INF-37 | CDN config | No WAF rules configured | Enable OWASP Core Rule Set |
+
+## Checklist Summary
+
+| Section | Pass | Fail | Total |
+|---------|:----:|:----:|:-----:|
+| IAM & Access | 6 | 1 | 7 |
+| Secrets | 5 | 2 | 7 |
+| Network | 3 | 2 | 5 |
+| Logging | 5 | 1 | 6 |
+| Compute/Containers | 2 | 1 | 3 |
+| CI/CD | 5 | 2 | 7 |
+| CDN/WAF | 5 | 1 | 6 |
+| Backup & DR | 4 | 1 | 5 |
+
+## Pre-Deployment Gate
+<section 8 checklist with status>
 
 ## Verdict
-- [ ] **PASS** - Cloud baseline met. Safe to deploy.
-- [ ] **WARN** - Minor deviations (P1/P2). Fix before next release.
-- [x] **FAIL** - Critical P0 issues found. Do NOT deploy until fixed.
+- ✅ **PASS** — Cloud baseline met. Safe to deploy.
+- ⚠️ **CONDITIONAL** — Minor deviations (P1/P2). Fix before next release
+- ❌ **FAIL** — Critical P0 issues. Do NOT deploy until fixed
 ```
 
 ---
 
 ## See also
-- `$deployment-ci-plan` — The plan this review acts upon.
-- `$docker-kubernetes-architecture` — Best practices for containerization.
-- `$dependency-supply-chain-review` — Deeper dive into SCA and dependencies.
-- `$security-review-baseline` — AppSec layer (complementary to this Cloud/Infra layer).
+- `$architecture-doc` — architectural context for review scope
+- `$deployment-ci-plan` — the plan being reviewed
+- `$deployment-ci-plan-reference` — extended reference materials
+- `$docker-kubernetes-architecture` — container/K8s security details
+- `$k8s-manifests-conventions` — K8s security policies
+- `$dependency-supply-chain-review` — deeper dive into SCA and dependencies
+- `$security-review-baseline` — AppSec layer (complementary to Cloud/Infra)
+- `$threat-model-baseline` — application-level threat model

package/domains/development/locales/en/.agents/skills/cloud-infrastructure-security/agents/kimi.yaml

@@ -1,15 +1,15 @@
-name: "cloud-infrastructure-security"
-display_name: "Cloud Infrastructure Security Review"
-description: "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR."
-default_prompt: "Use $cloud-infrastructure-security when the task matches the \"Cloud Infrastructure Security Review\" skill."
-triggers:
-  - "cloud-infrastructure-security"
-  - "cloud infrastructure security"
-  - "Cloud Infrastructure Security Review"
-  - "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR"
-capabilities:
-  - "cloud"
-  - "infrastructure"
-  - "security"
-tools: []
-implicit_invocation: true
+name: "cloud-infrastructure-security"
+display_name: "Cloud Infrastructure Security Review"
+description: "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR."
+default_prompt: "Use $cloud-infrastructure-security when the task matches the \"Cloud Infrastructure Security Review\" skill."
+triggers:
+  - "cloud-infrastructure-security"
+  - "cloud infrastructure security"
+  - "Cloud Infrastructure Security Review"
+  - "Cloud/Infra/CI/CD Security Review — IAM, secrets manager, network, logging/monitoring, supply chain, CDN/WAF, backup/DR"
+capabilities:
+  - "cloud"
+  - "infrastructure"
+  - "security"
+tools: []
+implicit_invocation: true