cokit-cli 1.2.7 → 1.4.0

package/templates/repo/.github/skills/ck-security/SKILL.md

@@ -0,0 +1,139 @@
+---
+name: ck-security
+description: "STRIDE + OWASP-based security audit with optional auto-fix. Scans code for vulnerabilities, categorizes by severity, and can iteratively fix findings using ck:autoresearch pattern."
+argument-hint: "<scope glob or 'full'> [--fix] [--iterations N]"
+---
+
+# ck:security — Security Audit
+
+Runs a structured STRIDE + OWASP security audit on a given scope. Produces a severity-ranked findings report. With `--fix`, applies fixes iteratively using the ck:autoresearch guard pattern.
+
+## When to Use
+
+- Before a release or major deployment
+- After adding auth, payment, or data-handling features
+- Periodic security review (monthly/quarterly)
+- Compliance check (SOC 2, GDPR, PCI-DSS prep)
+
+## When NOT to Use
+
+- Purely cosmetic changes (CSS, copy edits)
+- No user-facing code or data handling involved
+
+---
+
+## Modes
+
+| Mode | Invocation | Behavior |
+|------|-----------|----------|
+| Audit only | `/ck-security <scope>` | Scan → categorize → report |
+| Audit + Fix | `/ck-security <scope> --fix` | Scan → categorize → fix iteratively |
+| Bounded fix | `/ck-security <scope> --fix --iterations N` | Limit fix iterations to N |
+
+---
+
+## Audit Methodology
+
+### 1. Scope Resolution
+Expand the provided glob or `full` keyword into a file list. Read all in-scope files before analysis.
+
+### 2. STRIDE Analysis
+Evaluate each threat category systematically:
+- **S**poofing — identity/authentication weaknesses
+- **T**ampering — input validation, integrity controls
+- **R**epudiation — audit logging gaps
+- **I**nformation Disclosure — data leakage, secret exposure
+- **D**enial of Service — rate limits, resource exhaustion
+- **E**levation of Privilege — broken access control, RBAC gaps
+
+### 3. OWASP Top 10 Check
+Map findings to OWASP categories (A01–A10). See `references/stride-owasp-checklist.md` for per-category checks.
+
+### 4. Dependency Audit
+Run the appropriate package audit tool for the detected stack:
+- Node.js: `npm audit`
+- Python: `pip-audit`
+- Go: `govulncheck`
+- Ruby: `bundle audit`
+
+### 5. Secret Detection
+Scan for hardcoded API keys, passwords, tokens, and private keys using regex patterns. See `references/stride-owasp-checklist.md` → Secret Patterns.
+
+### 6. Finding Categorization
+Assign each finding a severity level (see Severity Definitions below).
+
+---
+
+## Output Format
+
+```
+## Security Audit Report
+
+### Summary
+- Files scanned: N
+- Findings: X critical, Y high, Z medium, W low, V info
+
+### Findings
+
+| # | Severity | Category | File:Line | Description | Fix Recommendation |
+|---|----------|----------|-----------|-------------|-------------------|
+| 1 | Critical  | Injection | api/users.ts:45 | SQL string concatenation | Use parameterized queries |
+| 2 | High      | Auth      | auth/login.ts:12 | No rate limiting | Add express-rate-limit |
+```
+
+---
+
+## Fix Mode (--fix)
+
+When `--fix` is provided, apply fixes iteratively after the audit:
+
+1. Sort all findings by severity (Critical → High → Medium → Low)
+2. For each finding:
+   a. Apply one targeted fix
+   b. Run guard (tests or lint) to verify no regression
+   c. Commit: `security(fix-N): <short description>`
+   d. Advance to next finding
+3. Stop early if guard fails — report the failure instead of proceeding
+4. Uses `autoresearch` guard pattern for regression prevention
+
+> Tip: Use `--iterations N` to cap total fix iterations when scope is large.
+
+---
+
+## Severity Definitions
+
+| Severity | Description | Fix Priority |
+|----------|-------------|-------------|
+| Critical | Exploitable now, data breach or RCE risk | Immediate — block release |
+| High | Exploitable with moderate effort, significant impact | This sprint |
+| Medium | Limited exploitability or impact | Next sprint |
+| Low | Theoretical risk, defense-in-depth improvement | Backlog |
+| Info | Best practice suggestion, no direct risk | Optional |
+
+---
+
+## Integration with Other Skills
+
+- Run after `predict` when the security persona flags concerns
+- Feed Critical/High findings into `ck:autoresearch --fix` for automated remediation
+- Use `scenario` with `--focus authorization` for deeper auth flow testing
+- Pair with `plan` to schedule Medium/Low findings as sprint tasks
+
+---
+
+## Example Invocations
+
+```bash
+# Audit API layer only
+/ck-security src/api/**/*.ts
+
+# Audit entire src/ and auto-fix, max 15 iterations
+/ck-security src/ --fix --iterations 15
+
+# Full codebase audit (no fix)
+/ck-security full
+```
+
+---
+
+See `references/stride-owasp-checklist.md` for the detailed per-category checklist and secret detection regex patterns.

package/templates/repo/.github/skills/ck-security/references/stride-owasp-checklist.md

@@ -0,0 +1,128 @@
+# STRIDE + OWASP Security Checklist
+
+Reference checklist for `security` audits. Use during Step 2 (STRIDE Analysis) and Step 3 (OWASP Top 10 Check).
+
+---
+
+## STRIDE Checklist
+
+### Spoofing (Authentication)
+- [ ] All endpoints require authentication (unless intentionally public)
+- [ ] Passwords hashed with bcrypt/argon2 — not MD5 or SHA1
+- [ ] JWT tokens have expiration (`exp`) and are validated server-side
+- [ ] Session management uses `Secure`, `HttpOnly`, `SameSite` cookie flags
+- [ ] Multi-factor auth available for sensitive operations
+- [ ] OAuth/OIDC flows use `state` parameter to prevent CSRF
+- [ ] Default credentials removed from all services and dependencies
+
+### Tampering (Integrity)
+- [ ] Input validation on all user-supplied data (type, length, format)
+- [ ] Parameterized queries used — no string concatenation for SQL/NoSQL
+- [ ] CSRF tokens present on all state-changing forms
+- [ ] Request signing for API-to-API calls (HMAC or mTLS)
+- [ ] File uploads validated for type (magic bytes), size, and content
+- [ ] Deserialization of untrusted data avoided or sandboxed
+- [ ] HTTP methods restricted per endpoint (no GET for mutations)
+
+### Repudiation (Logging)
+- [ ] Authentication events logged: login, logout, failures
+- [ ] Authorization failures logged with user/resource context
+- [ ] Data modification events logged with actor and timestamp
+- [ ] Logs do not contain sensitive data (passwords, tokens, PII)
+- [ ] Log integrity protected — append-only storage or centralized sink
+- [ ] Logs retained per compliance requirements (90 days minimum)
+
+### Information Disclosure
+- [ ] Error messages do not leak stack traces in production
+- [ ] API responses exclude internal IDs, system paths, or version strings
+- [ ] Sensitive data encrypted at rest (AES-256 or equivalent)
+- [ ] All transport uses TLS 1.2+ — no HTTP for sensitive endpoints
+- [ ] No hardcoded secrets in source code (see Secret Patterns below)
+- [ ] `.env` files and credential files listed in `.gitignore`
+- [ ] API responses filtered to minimum necessary fields (no over-fetching)
+
+### Denial of Service
+- [ ] Rate limiting on authentication and sensitive endpoints
+- [ ] Request body size limits configured at server/gateway level
+- [ ] Pagination enforced on all list endpoints (no unbounded queries)
+- [ ] Timeouts set on all external API and database calls
+- [ ] Connection pools sized and cleaned up properly
+- [ ] Regex patterns reviewed for catastrophic backtracking (ReDoS)
+- [ ] Background jobs have concurrency limits and dead-letter queues
+
+### Elevation of Privilege
+- [ ] Role-based access control (RBAC) enforced server-side, not client-side
+- [ ] Horizontal privilege checks: user A cannot access user B's resources (IDOR)
+- [ ] Admin endpoints have separate, stricter auth middleware
+- [ ] Privilege escalation paths require re-authentication
+- [ ] Service accounts use principle of least privilege
+- [ ] Third-party integrations scoped to minimum required permissions
+
+---
+
+## OWASP Top 10 Quick Reference
+
+| # | Category | What to Check |
+|---|----------|---------------|
+| A01 | Broken Access Control | Missing auth checks, IDOR vulnerabilities, CORS misconfiguration, path traversal |
+| A02 | Cryptographic Failures | Weak hashing (MD5/SHA1), plaintext storage, missing TLS, weak cipher suites |
+| A03 | Injection | SQL, NoSQL, OS command, LDAP, template injection via unsanitized input |
+| A04 | Insecure Design | Missing threat model, business logic flaws, no abuse-case testing |
+| A05 | Security Misconfiguration | Default credentials, verbose error pages, unnecessary features/ports enabled |
+| A06 | Vulnerable Components | Outdated dependencies, known CVEs, unpatched libraries |
+| A07 | Auth Failures | Brute force possible, credential stuffing, session fixation, weak tokens |
+| A08 | Data Integrity Failures | Unsigned updates, unverified deserialization, CI/CD pipeline compromise |
+| A09 | Logging Failures | Missing security event logs, no alerting, insufficient monitoring coverage |
+| A10 | SSRF | Unvalidated user-supplied URLs, internal service access via fetch/curl |
+
+---
+
+## Secret Patterns to Detect
+
+Scan source files for the following regex patterns. Any match is a Critical finding.
+
+```regex
+# Generic API keys
+(?i)(api[_-]?key|apikey)\s*[:=]\s*['"][A-Za-z0-9\-_]{20,}['"]
+
+# AWS access key IDs
+AKIA[0-9A-Z]{16}
+
+# AWS secret access keys
+(?i)aws[_-]?secret[_-]?access[_-]?key\s*[:=]\s*['"][A-Za-z0-9/+]{40}['"]
+
+# JSON Web Tokens
+eyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+
+
+# Generic passwords in config/code
+(?i)(password|passwd|pwd)\s*[:=]\s*['"][^'"]{8,}['"]
+
+# Private keys (PEM format)
+-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----
+
+# GitHub personal access tokens
+ghp_[A-Za-z0-9]{36}
+
+# Stripe secret keys
+sk_(live|test)_[A-Za-z0-9]{24,}
+
+# Generic bearer tokens
+(?i)bearer\s+[A-Za-z0-9\-._~+/]{20,}
+```
+
+> False positive reduction: skip matches inside `*.test.*`, `*.spec.*`, `*.example`, and `*.md` files when the value is clearly a placeholder (e.g., `YOUR_KEY_HERE`, `<your-token>`).
+
+---
+
+## Dependency Audit Commands
+
+Run the appropriate command for the detected stack and include output in the findings report:
+
+| Stack | Command |
+|-------|---------|
+| Node.js | `npm audit --json` |
+| Python | `pip-audit --format json` |
+| Go | `govulncheck ./...` |
+| Ruby | `bundle audit check --update` |
+| Java/Maven | `mvn dependency-check:check` |
+| Rust | `cargo audit` |

package/templates/repo/.github/skills/ck-sequential-thinking/README.md

@@ -0,0 +1,183 @@
+# Sequential Thinking Agent Skill
+
+Structured, reflective problem-solving methodology converted from the sequential-thinking MCP server into a native Agent Skill.
+
+## Overview
+
+This skill teaches the AI to apply systematic sequential thinking methodology for complex problem-solving, without relying on external MCP tools. It enables:
+- Breaking down complex problems into manageable thought sequences
+- Dynamic adjustment of thought count as understanding evolves
+- Revision of previous thoughts when new insights emerge
+- Branching into alternative reasoning paths
+- Hypothesis generation and verification
+
+## Skill Structure
+
+```
+sequential-thinking/
+├── SKILL.md (105 lines)
+│   Core methodology, when to apply, scripts usage
+│
+├── package.json
+│   Test dependencies (jest)
+│
+├── .env.example
+│   Configuration options
+│
+├── scripts/
+│   ├── process-thought.js (executable)
+│   │   Validate and track thoughts deterministically
+│   │
+│   └── format-thought.js (executable)
+│       Format thoughts for display (box/simple/markdown)
+│
+├── tests/
+│   ├── process-thought.test.js
+│   │   Validation, tracking, history tests
+│   │
+│   └── format-thought.test.js
+│       Formatting tests (all formats)
+│
+└── references/
+    ├── core-patterns.md (95 lines)
+    │   Essential revision & branching patterns
+    │
+    ├── examples-api.md (88 lines)
+    │   API design example walkthrough
+    │
+    ├── examples-debug.md (90 lines)
+    │   Performance debugging example
+    │
+    ├── examples-architecture.md (94 lines)
+    │   Architecture decision example
+    │
+    ├── advanced-techniques.md (76 lines)
+    │   Spiral refinement, hypothesis testing, convergence
+    │
+    └── advanced-strategies.md (79 lines)
+        Uncertainty management, revision cascades, meta-thinking
+```
+
+**Documentation**: 627 lines across 7 files (all under 100 lines)
+**Scripts**: 2 executable Node.js scripts with tests
+
+## Key Features
+
+### Progressive Disclosure Design
+Each file focuses on specific aspects, loaded only when needed:
+- **SKILL.md**: Quick reference with core methodology
+- **core-patterns.md**: Common patterns for everyday use
+- **examples-*.md**: Real-world walkthroughs for learning
+- **advanced-*.md**: Sophisticated techniques for complex scenarios
+
+### Token Efficiency
+- Concise explanations sacrifice grammar for brevity
+- Examples demonstrate patterns without verbose explanation
+- Cross-references between files avoid duplication
+
+### Methodology Conversion
+Extracted from MCP server's approach and converted to instructions:
+- MCP tool provided **interface** for sequential thinking
+- Agent skill provides **methodology** to think sequentially
+- No dependency on external tools—pure instructional approach
+
+## Usage Modes
+
+**Explicit Mode**: Use visible thought markers
+```
+Thought 1/5: [Analysis]
+Thought 2/5: [Further analysis]
+```
+
+**Implicit Mode**: Apply methodology internally without cluttering output
+
+## When AI Should Use This Skill
+
+Automatically activated for:
+- Complex problem decomposition
+- Adaptive planning with potential revisions
+- Debugging and root cause analysis
+- Architecture and design decisions
+- Problems with unclear or emerging scope
+- Multi-step solutions requiring context
+
+## Scripts Usage
+
+### Process Thought (Validation & Tracking)
+
+```bash
+# Process a thought
+node scripts/process-thought.js --thought "Initial analysis" --number 1 --total 5 --next true
+
+# Process with revision
+node scripts/process-thought.js --thought "Corrected analysis" --number 2 --total 5 --next true --revision 1
+
+# Process with branching
+node scripts/process-thought.js --thought "Branch A" --number 2 --total 5 --next true --branch 1 --branchId "branch-a"
+
+# View history
+node scripts/process-thought.js --history
+
+# Reset history
+node scripts/process-thought.js --reset
+```
+
+### Format Thought (Display)
+
+```bash
+# Box format (default)
+node scripts/format-thought.js --thought "Analysis" --number 1 --total 5
+
+# Simple text format
+node scripts/format-thought.js --thought "Analysis" --number 1 --total 5 --format simple
+
+# Markdown format
+node scripts/format-thought.js --thought "Analysis" --number 1 --total 5 --format markdown
+
+# With revision
+node scripts/format-thought.js --thought "Revised" --number 2 --total 5 --revision 1
+
+# With branch
+node scripts/format-thought.js --thought "Branch" --number 2 --total 5 --branch 1 --branchId "a"
+```
+
+### Running Tests
+
+```bash
+# Install dependencies (first time only)
+npm install
+
+# Run all tests
+npm test
+
+# Run tests in watch mode
+npm run test:watch
+
+# Run with coverage
+npm run test:coverage
+```
+
+## When to Use Scripts
+
+**Use scripts when**:
+- Need deterministic validation of thought structure
+- Want persistent thought history tracking
+- Require formatted output for documentation
+- Building tools that integrate with sequential thinking
+
+**Don't use scripts when**:
+- Applying methodology directly in responses
+- Want lightweight, inline thinking
+- No need for validation or tracking
+
+Scripts are **optional tooling** - the methodology can be applied without them.
+
+## Source
+
+Converted from: https://github.com/modelcontextprotocol/servers/tree/main/src/sequentialthinking
+
+Original MCP server by Anthropic (MIT License).
+Skill conversion:
+- Extracts methodology as instructions
+- Adds executable scripts for deterministic validation
+- Makes tool-independent while preserving functionality

package/templates/repo/.github/skills/ck-sequential-thinking/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: ck-sequential-thinking
+description: Apply step-by-step analysis for complex problems with revision capability. Use for multi-step reasoning, hypothesis verification, adaptive planning, problem decomposition, course correction.
+license: MIT
+argument-hint: "[problem to analyze step-by-step]"
+---
+
+# Sequential Thinking
+
+Structured problem-solving via manageable, reflective thought sequences with dynamic adjustment.
+
+## When to Apply
+
+- Complex problem decomposition
+- Adaptive planning with revision capability
+- Analysis needing course correction
+- Problems with unclear/emerging scope
+- Multi-step solutions requiring context maintenance
+- Hypothesis-driven investigation/debugging
+
+## Core Process
+
+### 1. Start with Loose Estimate
+```
+Thought 1/5: [Initial analysis]
+```
+Adjust dynamically as understanding evolves.
+
+### 2. Structure Each Thought
+- Build on previous context explicitly
+- Address one aspect per thought
+- State assumptions, uncertainties, realizations
+- Signal what next thought should address
+
+### 3. Apply Dynamic Adjustment
+- **Expand**: More complexity discovered → increase total
+- **Contract**: Simpler than expected → decrease total
+- **Revise**: New insight invalidates previous → mark revision
+- **Branch**: Multiple approaches → explore alternatives
+
+### 4. Use Revision When Needed
+```
+Thought 5/8 [REVISION of Thought 2]: [Corrected understanding]
+- Original: [What was stated]
+- Why revised: [New insight]
+- Impact: [What changes]
+```
+
+### 5. Branch for Alternatives
+```
+Thought 4/7 [BRANCH A from Thought 2]: [Approach A]
+Thought 4/7 [BRANCH B from Thought 2]: [Approach B]
+```
+Compare explicitly, converge with decision rationale.
+
+### 6. Generate & Verify Hypotheses
+```
+Thought 6/9 [HYPOTHESIS]: [Proposed solution]
+Thought 7/9 [VERIFICATION]: [Test results]
+```
+Iterate until hypothesis verified.
+
+### 7. Complete Only When Ready
+Mark final: `Thought N/N [FINAL]`
+
+Complete when:
+- Solution verified
+- All critical aspects addressed
+- Confidence achieved
+- No outstanding uncertainties
+
+## Application Modes
+
+**Explicit**: Use visible thought markers when complexity warrants visible reasoning or user requests breakdown.
+
+**Implicit**: Apply methodology internally for routine problem-solving where thinking aids accuracy without cluttering response.
+
+## Scripts (Optional)
+
+Optional scripts for deterministic validation/tracking:
+- `scripts/process-thought.js` - Validate & track thoughts with history
+- `scripts/format-thought.js` - Format for display (box/markdown/simple)
+
+See README.md for usage examples. Use when validation/persistence needed; otherwise apply methodology directly.
+
+## References
+
+Load when deeper understanding needed:
+- `references/core-patterns.md` - Revision & branching patterns
+- `references/examples-api.md` - API design example
+- `references/examples-debug.md` - Debugging example
+- `references/examples-architecture.md` - Architecture decision example
+- `references/advanced-techniques.md` - Spiral refinement, hypothesis testing, convergence
+- `references/advanced-strategies.md` - Uncertainty, revision cascades, meta-thinking