code-ai-installer 3.0.0 → 4.0.1-a

package/domains/development/locales/en/.agents/skills/security-baseline-dev/SKILL.md

@@ -1,14 +1,47 @@
 ---
-name: security-baseline-dev
-description: >
-  Baseline security in implementation — input validation (Zod), secrets management, safe errors,
-  auth/authz patterns, XSS/injection prevention, dependency audit, secure headers. DO/DON'T examples.
-  Activate when writing any code that works with user input, auth, secrets, or when asked "how to do this securely".
+name: 'security-baseline-dev'
+description: 'Baseline security in implementation — decision rules for input validation (Zod), secrets management, safe errors, auth/authz, XSS/injection prevention, dependency audit, secure headers. Activate when writing any code that works with user input, auth, secrets, or when asked "how to do this securely". Full code templates — in `$security-baseline-dev-reference`.'
+type: 'discretionary'
+domain: 'development'
+owners:
+  - 'devops'
+  - 'senior_full_stack'
+gates:
+  - 'OPS'
+  - 'DEV'
+tech: []
+topic:
+  - 'general'
+  - 'ops'
+  - 'security'
+triggers:
+  - secure code
+  - Zod input validation
+  - secrets management
+  - XSS prevention
+  - injection prevention
+  - secure headers
+  - auth pattern
+related:
+  - 'security-baseline-dev-reference'
+  - 'node-express-beast-practices'
+  - 'node-express-beast-practices-reference'
+  - 'security-review'
+  - 'observability-logging'
+  - 'observability-logging-reference'
+  - 'es2025-beast-practices'
+  - n8n-pinecone-qdrant-supabase
+  - n8n-pinecone-qdrant-supabase-reference
+  - react-15-3-wix-iframe
+  - react-15-3-wix-iframe-reference
+budget_lines: 300
+schema_version: 1
 ---
 
+
 # Skill: Security Baseline (Dev)
 
-Specific DO/DON'T security patterns for everyday development.
+Decision rules + canonical tables for security patterns in everyday development. Full code templates (Zod schemas, errorHandler, JWT cookie, bcrypt, helmet, sanitizeForLog) — in `$security-baseline-dev-reference`.
 
 **Sections:**
 1. [Input Validation](#1-input-validation)
@@ -26,438 +59,101 @@ Specific DO/DON'T security patterns for everyday development.
 
 ## 1. Input Validation
 
-### ✅ DO: validate at the boundary (API / form) using Zod
-
-```js
-import { z } from 'zod';
-
-// ✅ Whitelist schema — allow only known fields
-const createUserSchema = z.object({
-  body: z.object({
-    name: z.string().min(1).max(100).trim(),
-    email: z.string().email().toLowerCase(),
-    age: z.number().int().min(13).max(150).optional(),
-    role: z.enum(['user', 'admin']).default('user'),
-  }),
-});
-
-// ✅ Parse and get typed data
-const result = createUserSchema.safeParse({ body: req.body });
-if (!result.success) {
-  return res.status(400).json({ errors: result.error.flatten().fieldErrors });
-}
-const { name, email, age, role } = result.data.body; // ← safe
-```
-
-### ❌ DON'T: trust incoming data
+**Rule:** validate at the boundary (API / form) via Zod whitelist schema. Never trust `req.body` directly.
 
 ```js
-// ❌ No validation — any data gets into DB
-app.post('/api/users', (req, res) => {
-  db.users.insert(req.body); // ❌ req.body might contain isAdmin: true
-});
-
-// ❌ Manual validation — incomplete, error-prone
-if (req.body.email && typeof req.body.email === 'string') {
-  // ❌ doesn't check email format, no trim, no lowercase
-}
-
-// ✅ Zod + validate middleware (see $node-express-beast-practices)
-app.post('/api/users', validate(createUserSchema), controller.create);
+// Brief example (full schema — in reference)
+const schema = z.object({ body: z.object({ email: z.string().email() }) });
+const result = schema.safeParse({ body: req.body });
+if (!result.success) return res.status(400).json({ errors: result.error.flatten().fieldErrors });
 ```
 
-### ✅ DO: sanitize HTML (if accepting rich text)
-
-```js
-import DOMPurify from 'isomorphic-dompurify';
-
-/**
- * Cleans HTML from XSS vectors.
- * @param {string} dirty - user HTML.
- * @returns {string} safe HTML.
- */
-function sanitizeHtml(dirty) {
-  return DOMPurify.sanitize(dirty, {
-    ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a', 'p', 'br', 'ul', 'ol', 'li'],
-    ALLOWED_ATTR: ['href', 'target'],
-  });
-}
-```
+For rich text (HTML) — `DOMPurify.sanitize()` (template in reference).
 
 ---
 
 ## 2. Secrets Management
 
-### ✅ DO: env variables + validation
+**Rule:** secrets only in env vars, env validated via Zod at startup, `.env*` in `.gitignore`, also `*.pem`/`*.key`/`credentials.json`.
 
 ```js
-// config/env.js
-import { z } from 'zod';
-
-const envSchema = z.object({
-  DATABASE_URL: z.string().url(),
-  JWT_SECRET: z.string().min(32, 'JWT_SECRET must be at least 32 characters'),
-  API_KEY: z.string().min(16),
-  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
-});
-
-const result = envSchema.safeParse(process.env);
-if (!result.success) {
-  console.error('❌ Missing/invalid env vars:', result.error.flatten().fieldErrors);
-  process.exit(1);
-}
-
-export const config = Object.freeze(result.data);
-```
-
-### ✅ DO: .gitignore for secrets
-
-```gitignore
-# Secrets — NEVER commit
-.env
-.env.local
-.env.production
-*.pem
-*.key
-credentials.json
-service-account.json
+// Brief example (full env schema — in reference)
+const config = Object.freeze(envSchema.parse(process.env));
 ```
 
-### ❌ DON'T: secrets in code
-
-```js
-// ❌ Hardcoded secrets
-const API_KEY = 'sk-1234567890abcdef';  // ❌ NEVER
-const dbUrl = 'mongodb://user:password@host:27017/db';  // ❌
-
-// ✅ From env
-const API_KEY = config.API_KEY;
-const dbUrl = config.DATABASE_URL;
-
-// ❌ Secrets in logs / errors
-logger.info({ apiKey: config.API_KEY }); // ❌ leak
-throw new Error(`Auth failed for key: ${apiKey}`); // ❌ leak
-```
+**Never:** hardcoded secrets in code, secrets in logs/errors, secrets in URL query.
 
 ---
 
 ## 3. Safe Errors
 
-### ✅ DO: separate operational and programmer errors
-
-```js
-// ✅ For client — safe message
-// For logs — full info
-
-export function errorHandler(logger) {
-  return (err, req, res, _next) => {
-    // Operational — show to client
-    if (err.isOperational) {
-      return res.status(err.statusCode).json({
-        error: err.message,
-        // ✅ No stack trace, no SQL, no internal details
-      });
-    }
-
-    // Programmer error — hide from client
-    logger.error({
-      err,          // ← full stack trace in logs
-      requestId: req.id,
-      method: req.method,
-      url: req.originalUrl,
-    });
-
-    res.status(500).json({
-      error: 'Internal server error',
-      // ❌ NEVER: error: err.message, stack: err.stack
-    });
-  };
-}
-```
+**Rule:** separate **operational** (show to client) and **programmer** (logs only). Stack trace, SQL errors, internal details — NEVER in response.
 
-### ❌ DON'T: leak internals
+**User enumeration:** same message for "user not found" and "wrong password" → unified `"Invalid credentials"`.
 
-```js
-// ❌ SQL error visible to user
-res.status(500).json({
-  error: 'duplicate key value violates unique constraint "users_email_key"'
-});
-
-// ❌ Stack trace visible
-res.status(500).json({
-  error: err.message,
-  stack: err.stack,  // ❌ NEVER
-});
-
-// ❌ Different reaction for "user not found" vs "wrong password"
-// → leaks info about accounts (user enumeration)
-if (!user) return res.status(404).json({ error: 'User not found' });
-if (!passwordMatch) return res.status(401).json({ error: 'Wrong password' });
-
-// ✅ Same message
-return res.status(401).json({ error: 'Invalid credentials' });
-```
+Full errorHandler template — in reference.
 
 ---
 
 ## 4. Auth/AuthZ
 
-### ✅ DO: JWT in httpOnly cookie (not localStorage)
-
-```js
-// ✅ Set JWT in httpOnly cookie
-res.cookie('token', jwt, {
-  httpOnly: true,   // ✅ inaccessible from JS (XSS protection)
-  secure: true,     // ✅ HTTPS only
-  sameSite: 'lax',  // ✅ CSRF protection
-  maxAge: 7 * 24 * 60 * 60 * 1000,  // 7 days
-  path: '/',
-});
-
-// ❌ JWT in localStorage — vulnerable to XSS
-localStorage.setItem('token', jwt); // ❌ any JS can read
-```
-
-### ✅ DO: AuthZ checks BEFORE operations
-
-```js
-// ✅ Check permissions BEFORE performing operation
-async function deleteCoupon(req, res) {
-  const coupon = await couponService.getById(req.params.id);
-
-  // AuthZ: only owner or admin
-  if (coupon.ownerId !== req.user.id && req.user.role !== 'admin') {
-    throw new ForbiddenError('You can only delete your own coupons');
-  }
-
-  await couponService.remove(coupon.id);
-  res.status(204).end();
-}
-
-// ❌ IDOR — no owner check
-async function deleteCoupon(req, res) {
-  await couponService.remove(req.params.id); // anyone can delete any coupon
-}
-```
-
-### ✅ DO: password hashing
+**Rules:**
+- JWT in **httpOnly cookie** (`secure: true`, `sameSite: 'lax'`), NOT in `localStorage` (XSS-vulnerable)
+- AuthZ checks **BEFORE** the operation (IDOR prevention)
+- Passwords — **bcrypt with salt rounds ≥ 12** (NEVER MD5/SHA-1/plain)
 
-```js
-import bcrypt from 'bcrypt';
-
-const SALT_ROUNDS = 12;
-
-/**
- * Hashes password using bcrypt.
- * @param {string} password - plain text password.
- * @returns {Promise<string>} hash.
- */
-async function hashPassword(password) {
-  return bcrypt.hash(password, SALT_ROUNDS);
-}
-
-/**
- * Compares password with hash.
- * @param {string} password - plain text.
- * @param {string} hash - bcrypt hash.
- * @returns {Promise<boolean>}
- */
-async function verifyPassword(password, hash) {
-  return bcrypt.compare(password, hash);
-}
-
-// ❌ NEVER: MD5, SHA-1, plain text
-```
+Full templates (cookie config, bcrypt helpers, IDOR pattern) — in reference.
 
 ---
 
 ## 5. XSS Prevention
 
-### ✅ DO: React automatically escapes JSX
-
-```jsx
-// ✅ React escapes by default — safe
-return <p>{userInput}</p>; // <script>alert('xss')</script> → text
-
-// ❌ dangerouslySetInnerHTML — XSS if input not sanitized
-return <div dangerouslySetInnerHTML={{ __html: userInput }} />; // ❌
-
-// ✅ If HTML insertion is NECESSARY — sanitize via DOMPurify
-import DOMPurify from 'dompurify';
-return <div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userInput) }} />;
-```
-
-### ✅ DO: CSP header
-
-```js
-// Helmet automatically sets CSP
-import helmet from 'helmet';
-
-app.use(helmet({
-  contentSecurityPolicy: {
-    directives: {
-      defaultSrc: ["'self'"],
-      scriptSrc: ["'self'"],         // without 'unsafe-inline'!
-      styleSrc: ["'self'", "'unsafe-inline'"],  // CSS might require inline
-      imgSrc: ["'self'", "data:", "https:"],
-      connectSrc: ["'self'", "https://api.example.com"],
-    },
-  },
-}));
-```
+**Rules:**
+- React JSX auto-escapes — `{userInput}` is safe
+- `dangerouslySetInnerHTML` — only with `DOMPurify.sanitize()` (template in reference)
+- CSP header via helmet (full config — in reference)
 
 ---
 
 ## 6. Injection Prevention
 
-### ✅ DO: parameterized queries
-
-```js
-// ✅ SQL — parameterization (never concatenation)
-const user = await db.query('SELECT * FROM users WHERE email = $1', [email]);
-
-// ❌ SQL injection
-const user = await db.query(`SELECT * FROM users WHERE email = '${email}'`);
-// email = "'; DROP TABLE users; --"
+**Rules:**
+- SQL: parameterized queries (`WHERE email = $1`, `[email]`) — NEVER concatenation
+- MongoDB: explicit `String(email)` casting cuts off `{ $ne: "" }` injection
+- Command: `execFile(cmd, [args])` — NEVER `exec(`...${userInput}`)`
 
-// ✅ MongoDB — do not allow operators in user input
-const user = await db.users.findOne({ email: String(email) }); // ✅ explicit casting
-
-// ❌ NoSQL injection
-const user = await db.users.findOne({ email: req.body.email });
-// req.body.email = { $ne: "" } → returns the first user
-
-// ✅ Command injection prevention — never exec(userInput)
-import { execFile } from 'node:child_process';
-execFile('convert', [inputPath, outputPath], callback); // ✅ args as array
-
-// ❌ Command injection
-exec(`convert ${userInput} output.png`); // ❌ userInput = "; rm -rf /"
-```
+Full DO/DON'T examples — in reference.
 
 ---
 
 ## 7. Secure Headers
 
-### ✅ DO: helmet.js (minimal settings)
+**Rules:**
+- `app.use(helmet())` — sets CSP, X-Frame-Options, HSTS, etc.
+- CORS: whitelist specific origins, **NEVER** `origin: '*'` in production
+- `credentials: true` for httpOnly cookies
 
-```js
-import helmet from 'helmet';
-
-// ✅ Helmet sets all necessary security headers:
-// - Content-Security-Policy
-// - X-Content-Type-Options: nosniff
-// - X-Frame-Options: SAMEORIGIN
-// - Strict-Transport-Security (HSTS)
-// - X-XSS-Protection (deprecated, but doesn't hurt)
-// - Referrer-Policy
-app.use(helmet());
-```
-
-### ✅ DO: CORS — whitelist origins
-
-```js
-import cors from 'cors';
-
-// ✅ Whitelist specific origin
-app.use(cors({
-  origin: ['https://myapp.com', 'https://admin.myapp.com'],
-  methods: ['GET', 'POST', 'PATCH', 'DELETE'],
-  credentials: true,  // for httpOnly cookies
-}));
-
-// ❌ Open CORS in production
-app.use(cors({ origin: '*' })); // ❌ any site can make requests
-```
+Full helmet + CORS templates — in reference.
 
 ---
 
 ## 8. Dependency Security
 
-### ✅ DO: regular audit
-
-```bash
-# npm
-npm audit                  # check vulnerabilities
-npm audit fix              # autofix
-npm audit --production     # only production deps
-
-# package.json — lock versions
-npm install --save-exact   # exact versions, not ^
-```
-
-### ✅ DO: minimize dependencies
-
-```js
-// ❌ Install lodash for one function
-import _ from 'lodash';
-const unique = _.uniq(arr);
-
-// ✅ Native JS
-const unique = [...new Set(arr)];
-
-// ❌ moment.js (300KB) for date formatting
-import moment from 'moment';
-
-// ✅ Intl.DateTimeFormat (built-in, 0KB)
-new Intl.DateTimeFormat('en', { dateStyle: 'short' }).format(date);
-```
-
-### ✅ DO: lockfile in repository
-
-```gitignore
-# ✅ Lockfile MUST be in git (reproducible builds)
-# Do NOT add to .gitignore:
-# package-lock.json   ← NEEDED in git
-# bun.lockb           ← NEEDED in git
-```
+**Rules:**
+- Regular `npm audit` + `npm audit fix` (or CI pipeline)
+- Minimize dependencies (native JS instead of lodash for one function)
+- Lockfile (`package-lock.json` / `bun.lockb`) **in git** for reproducible builds
+- Exact versions (`--save-exact`), not `^x.y.z`
 
 ---
 
 ## 9. Logging Security
 
-### ✅ DO: sanitize logs from PII and secrets
+**Rule:** PII and secrets never in logs.
 
-```js
-/**
- * Filters sensitive fields from an object for logging.
- * @param {object} obj - object to log.
- * @returns {object} sanitized object.
- */
-function sanitizeForLog(obj) {
-  const SENSITIVE_KEYS = ['password', 'token', 'secret', 'apiKey', 'authorization',
-    'cookie', 'ssn', 'creditCard', 'cardNumber', 'cvv'];
-
-  return Object.fromEntries(
-    Object.entries(obj).map(([key, value]) => {
-      if (SENSITIVE_KEYS.some((s) => key.toLowerCase().includes(s))) {
-        return [key, '[REDACTED]'];
-      }
-      if (typeof value === 'object' && value !== null) {
-        return [key, sanitizeForLog(value)];
-      }
-      return [key, value];
-    })
-  );
-}
-
-// Usage:
-logger.info(sanitizeForLog({ email: 'user@example.com', password: '123', token: 'abc' }));
-// { email: 'user@example.com', password: '[REDACTED]', token: '[REDACTED]' }
-```
-
-### ✅ DO: pino redact (automatic filtering)
-
-```js
-import pino from 'pino';
-
-const logger = pino({
-  redact: {
-    paths: ['req.headers.authorization', 'req.headers.cookie', '*.password', '*.token', '*.secret'],
-    censor: '[REDACTED]',
-  },
-});
-```
+- Automatic filtering — `pino.redact.paths` (see `$observability-logging-reference`)
+- For complex cases — manual `sanitizeForLog()` (template in reference)
+- See `$observability-logging` — general structured logging rules
 
 ---
 
@@ -493,6 +189,7 @@ const logger = pino({
 ---
 
 ## See also
+- `$security-baseline-dev-reference` — full code templates (Zod, errorHandler, JWT, bcrypt, helmet, sanitize)
 - `$security-review` — full security review checklist (Reviewer gate)
 - `$node-express-beast-practices` — Express middleware pipeline, error handler
 - `$observability-logging` — structured logging with redaction

package/domains/development/locales/en/.agents/skills/security-baseline-dev/agents/claude.json

@@ -1,7 +1,7 @@
 {
   "name": "security-baseline-dev",
   "display_name": "Security Baseline (Dev)",
-  "description": ">",
+  "description": "Baseline security in implementation — input validation (Zod), secrets management, safe errors, auth/authz patterns, XSS/injection prevention, dependency audit, secure headers. DO/DON'T examples. Activate when writing any code that works with user input, auth, secrets, or when asked \"how to do this securely\".",
   "default_prompt": "Use $security-baseline-dev when the task matches the \"Security Baseline (Dev)\" skill.",
   "triggers": [
     "security-baseline-dev",

package/domains/development/locales/en/.agents/skills/security-baseline-dev/agents/copilot.json

@@ -1,7 +1,7 @@
 {
   "name": "security-baseline-dev",
   "display_name": "Security Baseline (Dev)",
-  "description": ">",
+  "description": "Baseline security in implementation — input validation (Zod), secrets management, safe errors, auth/authz patterns, XSS/injection prevention, dependency audit, secure headers. DO/DON'T examples. Activate when writing any code that works with user input, auth, secrets, or when asked \"how to do this securely\".",
   "default_prompt": "Use $security-baseline-dev when the task matches the \"Security Baseline (Dev)\" skill.",
   "triggers": [
     "security-baseline-dev",

package/domains/development/locales/en/.agents/skills/security-baseline-dev/agents/gemini.json

@@ -1,7 +1,7 @@
 {
   "name": "security-baseline-dev",
   "display_name": "Security Baseline (Dev)",
-  "description": ">",
+  "description": "Baseline security in implementation — input validation (Zod), secrets management, safe errors, auth/authz patterns, XSS/injection prevention, dependency audit, secure headers. DO/DON'T examples. Activate when writing any code that works with user input, auth, secrets, or when asked \"how to do this securely\".",
   "default_prompt": "Use $security-baseline-dev when the task matches the \"Security Baseline (Dev)\" skill.",
   "triggers": [
     "security-baseline-dev",

package/domains/development/locales/en/.agents/skills/security-baseline-dev/agents/kimi.yaml

@@ -1,15 +1,15 @@
-name: "security-baseline-dev"
-display_name: "Security Baseline (Dev)"
-description: ">"
-default_prompt: "Use $security-baseline-dev when the task matches the \"Security Baseline (Dev)\" skill."
-triggers:
-  - "security-baseline-dev"
-  - "security baseline dev"
-  - "Security Baseline (Dev)"
-  - ">"
-capabilities:
-  - "security"
-  - "baseline"
-  - "dev"
-tools: []
-implicit_invocation: true
+"name": "security-baseline-dev"
+"display_name": "Security Baseline (Dev)"
+"description": "Baseline security in implementation — input validation (Zod), secrets management, safe errors, auth/authz patterns, XSS/injection prevention, dependency audit, secure headers. DO/DON'T examples. Activate when writing any code that works with user input, auth, secrets, or when asked \"how to do this securely\"."
+"default_prompt": "Use $security-baseline-dev when the task matches the \"Security Baseline (Dev)\" skill."
+"triggers":
+  - "security-baseline-dev"
+  - "security baseline dev"
+  - "Security Baseline (Dev)"
+  - ">"
+"capabilities":
+  - "security"
+  - "baseline"
+  - "dev"
+"tools": []
+"implicit_invocation": true

package/domains/development/locales/en/.agents/skills/security-baseline-dev/agents/qwen.json

@@ -1,7 +1,7 @@
 {
   "name": "security-baseline-dev",
   "display_name": "Security Baseline (Dev)",
-  "description": ">",
+  "description": "Baseline security in implementation — input validation (Zod), secrets management, safe errors, auth/authz patterns, XSS/injection prevention, dependency audit, secure headers. DO/DON'T examples. Activate when writing any code that works with user input, auth, secrets, or when asked \"how to do this securely\".",
   "default_prompt": "Use $security-baseline-dev when the task matches the \"Security Baseline (Dev)\" skill.",
   "triggers": [
     "security-baseline-dev",

package/domains/development/locales/en/.agents/skills/security-baseline-dev/agents/skill.yaml

@@ -1,23 +1,23 @@
-version: 1
-name: "security-baseline-dev"
-display_name: "Security Baseline (Dev)"
-description: ">"
-default_prompt: "Use $security-baseline-dev when the task matches the \"Security Baseline (Dev)\" skill."
-triggers:
+"version": 1
+"name": "security-baseline-dev"
+"display_name": "Security Baseline (Dev)"
+"description": "Baseline security in implementation — input validation (Zod), secrets management, safe errors, auth/authz patterns, XSS/injection prevention, dependency audit, secure headers. DO/DON'T examples. Activate when writing any code that works with user input, auth, secrets, or when asked \"how to do this securely\"."
+"default_prompt": "Use $security-baseline-dev when the task matches the \"Security Baseline (Dev)\" skill."
+"triggers":
   - "security-baseline-dev"
   - "security baseline dev"
   - "Security Baseline (Dev)"
   - ">"
-capabilities:
+"capabilities":
   - "security"
   - "baseline"
   - "dev"
-tools: []
-invocation:
-  explicit: true
-  implicit: true
-localization:
-  default_locale: "en"
-  available_locales:
+"tools": []
+"invocation":
+  "explicit": true
+  "implicit": true
+"localization":
+  "default_locale": "en"
+  "available_locales":
     - "ru"
     - "en"