code-ai-installer 3.0.0 → 4.0.1-a

package/domains/development/locales/en/.agents/skills/security-baseline-dev-reference/SKILL.md

@@ -0,0 +1,391 @@
+---
+name: 'security-baseline-dev-reference'
+description: 'Canonical reference of security baseline templates — Zod whitelist schema, DOMPurify sanitizer, env validation, errorHandler, JWT cookie config, bcrypt helpers, AuthZ + IDOR pattern, CSP directives, helmet + CORS config, sanitizeForLog, pino redact, SQL/Mongo/command injection prevention. Activate when searching for a specific security template.'
+type: 'reference'
+domain: 'development'
+owners:
+  - 'devops'
+  - 'senior_full_stack'
+gates:
+  - 'OPS'
+  - 'DEV'
+tech: []
+topic:
+  - 'general'
+  - 'ops'
+  - 'security'
+triggers:
+  - Zod schema example
+  - DOMPurify sanitizer
+  - env validation template
+  - errorHandler implementation
+  - JWT cookie config
+  - bcrypt helpers
+  - helmet CSP config
+  - CORS whitelist
+  - sanitizeForLog template
+  - SQL parameterization
+  - Mongo String casting
+  - execFile injection prevention
+related:
+  - 'security-baseline-dev'
+  - 'node-express-beast-practices-reference'
+  - 'security-review'
+  - 'observability-logging-reference'
+  - 'es2025-beast-practices'
+budget_lines: 450
+schema_version: 1
+---
+
+
+# Skill: Security Baseline Reference
+
+Canonical code templates for security patterns — copy and adapt. Decision rules "when / why" — in `$security-baseline-dev`.
+
+**Sections:**
+1. [Input Validation Templates](#1-input-validation-templates)
+2. [Secrets Management Templates](#2-secrets-management-templates)
+3. [Error Handler](#3-error-handler)
+4. [Auth/AuthZ Templates](#4-authauthz-templates)
+5. [XSS / CSP Templates](#5-xss-csp-templates)
+6. [Injection Prevention Examples](#6-injection-prevention-examples)
+7. [Helmet & CORS](#7-helmet--cors)
+8. [Logging Sanitization](#8-logging-sanitization)
+
+---
+
+## 1. Input Validation Templates
+
+### Zod whitelist schema (full)
+
+```js
+import { z } from 'zod';
+
+// ✅ Whitelist schema — allow only known fields
+const createUserSchema = z.object({
+  body: z.object({
+    name: z.string().min(1).max(100).trim(),
+    email: z.string().email().toLowerCase(),
+    age: z.number().int().min(13).max(150).optional(),
+    role: z.enum(['user', 'admin']).default('user'),
+  }),
+});
+
+// ✅ Parse and get typed data
+const result = createUserSchema.safeParse({ body: req.body });
+if (!result.success) {
+  return res.status(400).json({ errors: result.error.flatten().fieldErrors });
+}
+const { name, email, age, role } = result.data.body; // ← safe
+```
+
+### DOMPurify sanitizer (rich text HTML)
+
+```js
+import DOMPurify from 'isomorphic-dompurify';
+
+/**
+ * Cleans HTML from XSS vectors.
+ * @param {string} dirty - user HTML.
+ * @returns {string} safe HTML.
+ */
+function sanitizeHtml(dirty) {
+  return DOMPurify.sanitize(dirty, {
+    ALLOWED_TAGS: ['b', 'i', 'em', 'strong', 'a', 'p', 'br', 'ul', 'ol', 'li'],
+    ALLOWED_ATTR: ['href', 'target'],
+  });
+}
+```
+
+---
+
+## 2. Secrets Management Templates
+
+### env validation (Zod)
+
+```js
+// config/env.js
+import { z } from 'zod';
+
+const envSchema = z.object({
+  DATABASE_URL: z.string().url(),
+  JWT_SECRET: z.string().min(32, 'JWT_SECRET must be at least 32 characters'),
+  API_KEY: z.string().min(16),
+  NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
+});
+
+const result = envSchema.safeParse(process.env);
+if (!result.success) {
+  console.error('❌ Missing/invalid env vars:', result.error.flatten().fieldErrors);
+  process.exit(1);
+}
+
+export const config = Object.freeze(result.data);
+```
+
+### .gitignore (secrets)
+
+```gitignore
+# Secrets — NEVER commit
+.env
+.env.local
+.env.production
+*.pem
+*.key
+credentials.json
+service-account.json
+```
+
+---
+
+## 3. Error Handler
+
+```js
+// ✅ For client — safe message
+// For logs — full info
+
+export function errorHandler(logger) {
+  return (err, req, res, _next) => {
+    // Operational — show to client
+    if (err.isOperational) {
+      return res.status(err.statusCode).json({
+        error: err.message,
+        // ✅ No stack trace, no SQL, no internal details
+      });
+    }
+
+    // Programmer error — hide from client
+    logger.error({
+      err,          // ← full stack trace in logs
+      requestId: req.id,
+      method: req.method,
+      url: req.originalUrl,
+    });
+
+    res.status(500).json({
+      error: 'Internal server error',
+      // ❌ NEVER: error: err.message, stack: err.stack
+    });
+  };
+}
+```
+
+**Anti-patterns** (what NOT to do):
+- `res.status(500).json({ error: 'duplicate key value violates ... users_email_key' })` — SQL details leak
+- `res.status(500).json({ error: err.message, stack: err.stack })` — stack trace
+- Different responses for "user not found" vs "wrong password" — user enumeration. Unified `'Invalid credentials'`.
+
+---
+
+## 4. Auth/AuthZ Templates
+
+### JWT in httpOnly cookie
+
+```js
+res.cookie('token', jwt, {
+  httpOnly: true,   // ✅ inaccessible from JS (XSS protection)
+  secure: true,     // ✅ HTTPS only
+  sameSite: 'lax',  // ✅ CSRF protection
+  maxAge: 7 * 24 * 60 * 60 * 1000,  // 7 days
+  path: '/',
+});
+
+// ❌ JWT in localStorage — vulnerable to XSS
+// localStorage.setItem('token', jwt);
+```
+
+### AuthZ check + IDOR prevention
+
+```js
+// ✅ Check permissions BEFORE performing operation
+async function deleteCoupon(req, res) {
+  const coupon = await couponService.getById(req.params.id);
+
+  // AuthZ: only owner or admin
+  if (coupon.ownerId !== req.user.id && req.user.role !== 'admin') {
+    throw new ForbiddenError('You can only delete your own coupons');
+  }
+
+  await couponService.remove(coupon.id);
+  res.status(204).end();
+}
+```
+
+### bcrypt password hashing
+
+```js
+import bcrypt from 'bcrypt';
+
+const SALT_ROUNDS = 12;
+
+async function hashPassword(password) {
+  return bcrypt.hash(password, SALT_ROUNDS);
+}
+
+async function verifyPassword(password, hash) {
+  return bcrypt.compare(password, hash);
+}
+
+// ❌ NEVER: MD5, SHA-1, plain text
+```
+
+---
+
+## 5. XSS / CSP Templates
+
+### React safe rendering
+
+```jsx
+// ✅ React escapes by default — safe
+return <p>{userInput}</p>;
+
+// ✅ If HTML insertion is NECESSARY — sanitize via DOMPurify
+import DOMPurify from 'dompurify';
+return <div dangerouslySetInnerHTML={{ __html: DOMPurify.sanitize(userInput) }} />;
+```
+
+### CSP via helmet
+
+```js
+import helmet from 'helmet';
+
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'"],         // without 'unsafe-inline'!
+      styleSrc: ["'self'", "'unsafe-inline'"],  // CSS might require inline
+      imgSrc: ["'self'", "data:", "https:"],
+      connectSrc: ["'self'", "https://api.example.com"],
+    },
+  },
+}));
+```
+
+---
+
+## 6. Injection Prevention Examples
+
+### SQL — parameterization
+
+```js
+// ✅ Parameterization
+const user = await db.query('SELECT * FROM users WHERE email = $1', [email]);
+
+// ❌ SQL injection — concatenation
+// const user = await db.query(`SELECT * FROM users WHERE email = '${email}'`);
+// email = "'; DROP TABLE users; --"
+```
+
+### MongoDB — explicit String casting
+
+```js
+// ✅ Explicit casting cuts off operator injection
+const user = await db.users.findOne({ email: String(email) });
+
+// ❌ NoSQL injection
+// const user = await db.users.findOne({ email: req.body.email });
+// req.body.email = { $ne: "" } → returns the first user
+```
+
+### Command — execFile instead of exec
+
+```js
+import { execFile } from 'node:child_process';
+execFile('convert', [inputPath, outputPath], callback); // ✅ args as array
+
+// ❌ Command injection
+// exec(`convert ${userInput} output.png`);
+// userInput = "; rm -rf /"
+```
+
+---
+
+## 7. Helmet & CORS
+
+### helmet (minimal settings)
+
+```js
+import helmet from 'helmet';
+
+// ✅ Helmet sets all necessary security headers:
+// - Content-Security-Policy
+// - X-Content-Type-Options: nosniff
+// - X-Frame-Options: SAMEORIGIN
+// - Strict-Transport-Security (HSTS)
+// - Referrer-Policy
+app.use(helmet());
+```
+
+### CORS whitelist
+
+```js
+import cors from 'cors';
+
+app.use(cors({
+  origin: ['https://myapp.com', 'https://admin.myapp.com'],
+  methods: ['GET', 'POST', 'PATCH', 'DELETE'],
+  credentials: true,  // for httpOnly cookies
+}));
+
+// ❌ Open CORS in production
+// app.use(cors({ origin: '*' }));
+```
+
+---
+
+## 8. Logging Sanitization
+
+### Manual sanitizeForLog
+
+```js
+/**
+ * Filters sensitive fields from an object for logging.
+ * @param {object} obj - object to log.
+ * @returns {object} sanitized object.
+ */
+function sanitizeForLog(obj) {
+  const SENSITIVE_KEYS = ['password', 'token', 'secret', 'apiKey', 'authorization',
+    'cookie', 'ssn', 'creditCard', 'cardNumber', 'cvv'];
+
+  return Object.fromEntries(
+    Object.entries(obj).map(([key, value]) => {
+      if (SENSITIVE_KEYS.some((s) => key.toLowerCase().includes(s))) {
+        return [key, '[REDACTED]'];
+      }
+      if (typeof value === 'object' && value !== null) {
+        return [key, sanitizeForLog(value)];
+      }
+      return [key, value];
+    })
+  );
+}
+
+// Usage:
+logger.info(sanitizeForLog({ email: 'user@example.com', password: '123', token: 'abc' }));
+// { email: 'user@example.com', password: '[REDACTED]', token: '[REDACTED]' }
+```
+
+### pino redact (automatic)
+
+```js
+import pino from 'pino';
+
+const logger = pino({
+  redact: {
+    paths: ['req.headers.authorization', 'req.headers.cookie', '*.password', '*.token', '*.secret'],
+    censor: '[REDACTED]',
+  },
+});
+```
+
+Full `redact.paths` set (including ssn, creditCard, cardNumber, cvv) — in `$observability-logging-reference`.
+
+---
+
+## See also
+- `$security-baseline-dev` — decision rules, anti-patterns, PR checklist
+- `$node-express-beast-practices-reference` — Express middleware pipeline templates
+- `$security-review` — security review checklist (Reviewer gate)
+- `$observability-logging-reference` — pino redact full paths
+- `$es2025-beast-practices` — safe data handling

package/domains/development/locales/en/.agents/skills/security-baseline-dev-reference/agents/claude.json

@@ -0,0 +1,20 @@
+{
+  "name": "security-baseline-dev-reference",
+  "display_name": "Security Baseline Reference (Templates)",
+  "description": "Canonical reference of security templates — Zod, DOMPurify, env validation, errorHandler, JWT, bcrypt, helmet, CORS, sanitizeForLog, injection prevention. DO/DON'T examples. Activate when writing any code that works with user input, auth, secrets, or when asked \"how to do this securely\".",
+  "default_prompt": "Use $security-baseline-dev-reference when the task matches the \"Security Baseline Reference (Templates)\" skill.",
+  "triggers": [
+    "security-baseline-dev-reference",
+    "security baseline dev reference",
+    "Security Baseline Reference (Templates)",
+    ">"
+  ],
+  "capabilities": [
+    "security",
+    "baseline",
+    "reference",
+    "dev"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/security-baseline-dev-reference/agents/copilot.json

@@ -0,0 +1,20 @@
+{
+  "name": "security-baseline-dev-reference",
+  "display_name": "Security Baseline Reference (Templates)",
+  "description": "Canonical reference of security templates — Zod, DOMPurify, env validation, errorHandler, JWT, bcrypt, helmet, CORS, sanitizeForLog, injection prevention. DO/DON'T examples. Activate when writing any code that works with user input, auth, secrets, or when asked \"how to do this securely\".",
+  "default_prompt": "Use $security-baseline-dev-reference when the task matches the \"Security Baseline Reference (Templates)\" skill.",
+  "triggers": [
+    "security-baseline-dev-reference",
+    "security baseline dev reference",
+    "Security Baseline Reference (Templates)",
+    ">"
+  ],
+  "capabilities": [
+    "security",
+    "baseline",
+    "reference",
+    "dev"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/security-baseline-dev-reference/agents/gemini.json

@@ -0,0 +1,20 @@
+{
+  "name": "security-baseline-dev-reference",
+  "display_name": "Security Baseline Reference (Templates)",
+  "description": "Canonical reference of security templates — Zod, DOMPurify, env validation, errorHandler, JWT, bcrypt, helmet, CORS, sanitizeForLog, injection prevention. DO/DON'T examples. Activate when writing any code that works with user input, auth, secrets, or when asked \"how to do this securely\".",
+  "default_prompt": "Use $security-baseline-dev-reference when the task matches the \"Security Baseline Reference (Templates)\" skill.",
+  "triggers": [
+    "security-baseline-dev-reference",
+    "security baseline dev reference",
+    "Security Baseline Reference (Templates)",
+    ">"
+  ],
+  "capabilities": [
+    "security",
+    "baseline",
+    "reference",
+    "dev"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/security-baseline-dev-reference/agents/kimi.yaml

@@ -0,0 +1,16 @@
+"name": "security-baseline-dev-reference"
+"display_name": "Security Baseline Reference (Templates)"
+"description": "Canonical reference of security templates — Zod, DOMPurify, env validation, errorHandler, JWT, bcrypt, helmet, CORS, sanitizeForLog, injection prevention. DO/DON'T examples. Activate when writing any code that works with user input, auth, secrets, or when asked \"how to do this securely\"."
+"default_prompt": "Use $security-baseline-dev-reference when the task matches the \"Security Baseline Reference (Templates)\" skill."
+"triggers":
+  - "security-baseline-dev-reference"
+  - "security baseline dev reference"
+  - "Security Baseline Reference (Templates)"
+  - ">"
+"capabilities":
+  - "security"
+  - "baseline"
+  - "reference"
+  - "dev"
+"tools": []
+"implicit_invocation": true

package/domains/development/locales/en/.agents/skills/security-baseline-dev-reference/agents/openai.yaml

@@ -0,0 +1,8 @@
+interface:
+  display_name: "Security Baseline Reference (Templates)"
+  short_description: ">"
+  default_prompt: "Use $security-baseline-dev-reference when the task matches the \"Security Baseline Reference (Templates)\" skill."
+dependencies:
+  tools: []
+policy:
+  allow_implicit_invocation: true

package/domains/development/locales/en/.agents/skills/security-baseline-dev-reference/agents/qwen.json

@@ -0,0 +1,20 @@
+{
+  "name": "security-baseline-dev-reference",
+  "display_name": "Security Baseline Reference (Templates)",
+  "description": "Canonical reference of security templates — Zod, DOMPurify, env validation, errorHandler, JWT, bcrypt, helmet, CORS, sanitizeForLog, injection prevention. DO/DON'T examples. Activate when writing any code that works with user input, auth, secrets, or when asked \"how to do this securely\".",
+  "default_prompt": "Use $security-baseline-dev-reference when the task matches the \"Security Baseline Reference (Templates)\" skill.",
+  "triggers": [
+    "security-baseline-dev-reference",
+    "security baseline dev reference",
+    "Security Baseline Reference (Templates)",
+    ">"
+  ],
+  "capabilities": [
+    "security",
+    "baseline",
+    "reference",
+    "dev"
+  ],
+  "tools": [],
+  "implicit_invocation": true
+}

package/domains/development/locales/en/.agents/skills/security-baseline-dev-reference/agents/skill.yaml

@@ -0,0 +1,24 @@
+"version": 1
+"name": "security-baseline-dev-reference"
+"display_name": "Security Baseline Reference (Templates)"
+"description": "Canonical reference of security templates — Zod, DOMPurify, env validation, errorHandler, JWT, bcrypt, helmet, CORS, sanitizeForLog, injection prevention. DO/DON'T examples. Activate when writing any code that works with user input, auth, secrets, or when asked \"how to do this securely\"."
+"default_prompt": "Use $security-baseline-dev-reference when the task matches the \"Security Baseline Reference (Templates)\" skill."
+"triggers":
+  - "security-baseline-dev-reference"
+  - "security baseline dev reference"
+  - "Security Baseline Reference (Templates)"
+  - ">"
+"capabilities":
+  - "security"
+  - "baseline"
+  - "reference"
+  - "dev"
+"tools": []
+"invocation":
+  "explicit": true
+  "implicit": true
+"localization":
+  "default_locale": "en"
+  "available_locales":
+    - "ru"
+    - "en"

package/domains/development/locales/en/.agents/skills/security-review/SKILL.md

@@ -1,8 +1,35 @@
 ---
 name: security-review
 description: AppSec review for endpoints/authorization/input/secrets/sensitive features. Checklist + patterns (OWASP baseline).
+type: triggered
+domain: development
+owners:
+  - reviewer
+gates:
+  - REV
+tech: []
+topic:
+  - review
+  - security
+triggers:
+  - AppSec review
+  - endpoint review
+  - check authorization
+  - sensitive feature
+  - OWASP baseline
+  - validation review
+related:
+  - api-contract-compliance-review
+  - code-review-checklist
+  - review-reference-snippets
+  - security-baseline-dev
+  - security-baseline-dev-reference
+  - threat-model-baseline
+budget_lines: 400
+schema_version: 1
 ---
 
+
 # Skill: Security Review (AppSec)
 
 Deep code security review: from secrets to injection.
@@ -16,7 +43,7 @@ Deep code security review: from secrets to injection.
 
 ---
 
-## 1. When to activate
+## 1. When to activate <a id="1-when"></a>
 
 | Trigger | Depth |
 |---------|-------|
@@ -103,7 +130,7 @@ Deep code security review: from secrets to injection.
 
 ---
 
-## 3. DO / DON'T Examples
+## 3. DO / DON'T Examples <a id="3-examples"></a>
 
 ### Input Validation
 
@@ -189,7 +216,7 @@ logger.info({ userId: user.id }, 'User authenticated'); // No token
 
 ---
 
-## 4. Automated Scans
+## 4. Automated Scans <a id="4-automated"></a>
 
 ### Grep patterns
 
@@ -225,7 +252,7 @@ npm outdated
 
 ---
 
-## 5. Output Template
+## 5. Output Template <a id="5-output"></a>
 
 ```markdown
 # Security Review Report
@@ -267,11 +294,8 @@ npm outdated
 - ⚠️ CONDITIONAL — fix P0 before merge
 - ❌ BLOCKED — critical vulnerabilities found
 ```
-
----
-
 ## See also
 - `$security-baseline-dev` — implementation patterns (Zod, Helmet, safe filter)
 - `$threat-model-baseline` — architecture-level threat model
 - `$code-review-checklist` — general code review
-- `$review-reference-snippets` — more DO/DON'T examples
+- `$review-reference-snippets` — more DO/DON'T examples

package/domains/development/locales/en/.agents/skills/security-review/agents/kimi.yaml

@@ -1,14 +1,14 @@
-name: "security-review"
-display_name: "Security Review (AppSec)"
-description: "AppSec review for endpoints/authorization/input/secrets/sensitive features. Checklist + patterns (OWASP baseline)."
-default_prompt: "Use $security-review when the task matches the \"Security Review (AppSec)\" skill."
-triggers:
-  - "security-review"
-  - "security review"
-  - "Security Review (AppSec)"
-  - "AppSec review for endpoints/authorization/input/secrets/sensitive features"
-capabilities:
-  - "security"
-  - "review"
-tools: []
-implicit_invocation: true
+name: "security-review"
+display_name: "Security Review (AppSec)"
+description: "AppSec review for endpoints/authorization/input/secrets/sensitive features. Checklist + patterns (OWASP baseline)."
+default_prompt: "Use $security-review when the task matches the \"Security Review (AppSec)\" skill."
+triggers:
+  - "security-review"
+  - "security review"
+  - "Security Review (AppSec)"
+  - "AppSec review for endpoints/authorization/input/secrets/sensitive features"
+capabilities:
+  - "security"
+  - "review"
+tools: []
+implicit_invocation: true