devflow-kit 1.8.3 → 2.0.0

package/shared/skills/input-validation/references/violations.md

@@ -1,224 +0,0 @@
-# Input Validation Violations
-
-Extended examples of validation violations to detect and fix.
-
-## Manual Validation Anti-Pattern
-
-```typescript
-// VIOLATION: Manual validation scatters checks
-function createUser(data: any): User {
-  if (!data.email || typeof data.email !== 'string') {
-    throw new Error('Invalid email');
-  }
-  if (!data.age || typeof data.age !== 'number' || data.age < 0) {
-    throw new Error('Invalid age');
-  }
-  if (!data.name || data.name.length > 100) {
-    throw new Error('Invalid name');
-  }
-  // ... more manual checks
-
-  return { email: data.email, age: data.age, name: data.name };
-}
-```
-
-**Problems**:
-- Scattered validation logic
-- Easy to miss edge cases
-- No type inference
-- Inconsistent error handling
-- Hard to maintain
-
----
-
-## Missing API Boundary Validation
-
-```typescript
-// VIOLATION: No validation at API boundary
-app.post('/api/users', async (req, res) => {
-  const user = await createUser(req.body); // Trusting external data!
-  res.json(user);
-});
-```
-
-**Security Risk**: HIGH - Injection attacks, data corruption possible
-
----
-
-## Trusting External API Responses
-
-```typescript
-// VIOLATION: Trusting external API response
-async function fetchUserData(userId: string): Promise<UserData> {
-  const response = await fetch(`https://api.example.com/users/${userId}`);
-  const data = await response.json();
-  return data; // No validation!
-}
-```
-
-**Risk**: Application crash if API changes structure, type safety lost
-
----
-
-## Unvalidated Environment Variables
-
-```typescript
-// VIOLATION: Trusting environment variables
-const config = {
-  port: process.env.PORT,           // Could be undefined or invalid
-  dbUrl: process.env.DATABASE_URL,  // No validation
-  apiKey: process.env.API_KEY       // Could be empty or malformed
-};
-```
-
-**Risk**: Runtime crashes, security issues from malformed config
-
----
-
-## SQL Injection Vulnerabilities
-
-```typescript
-// VIOLATION: Direct string interpolation (SQL injection risk)
-async function getUserByEmail(email: string): Promise<User> {
-  const query = `SELECT * FROM users WHERE email = '${email}'`;
-  return db.query(query);
-}
-
-// VIOLATION: No input validation before query
-async function searchUsers(searchTerm: string): Promise<User[]> {
-  return db.query('SELECT * FROM users WHERE name LIKE $1', [`%${searchTerm}%`]);
-}
-```
-
-**Security Risk**: CRITICAL - SQL injection allows data theft, modification, deletion
-
----
-
-## File Upload Without Validation
-
-```typescript
-// VIOLATION: Accepting any file upload
-app.post('/upload', async (req, res) => {
-  const file = req.files.document;
-  await file.mv(`./uploads/${file.name}`);  // No validation!
-  res.send('Uploaded');
-});
-```
-
-**Risks**:
-- Arbitrary file execution
-- Path traversal attacks
-- Storage exhaustion
-- Malware upload
-
----
-
-## URL Parameter Injection
-
-```typescript
-// VIOLATION: Unvalidated path parameters
-app.get('/users/:id', async (req, res) => {
-  const user = await db.users.findById(req.params.id);  // No validation!
-  res.json(user);
-});
-
-// VIOLATION: Unvalidated query parameters
-app.get('/search', async (req, res) => {
-  const results = await db.search(req.query.q);  // No validation!
-  res.json(results);
-});
-```
-
-**Risks**: NoSQL injection, type coercion attacks, DoS via crafted input
-
----
-
-## Header-Based Logic Without Validation
-
-```typescript
-// VIOLATION: Trusting request headers
-app.use((req, res, next) => {
-  const userId = req.headers['x-user-id'];
-  req.userId = userId;  // No validation!
-  next();
-});
-
-// VIOLATION: Trusting JWT without proper validation
-app.use((req, res, next) => {
-  const token = req.headers.authorization?.split(' ')[1];
-  const decoded = jwt.decode(token);  // decode != verify!
-  req.user = decoded;
-  next();
-});
-```
-
-**Risks**: Authentication bypass, privilege escalation
-
----
-
-## Webhook Payload Vulnerabilities
-
-```typescript
-// VIOLATION: Trusting webhook payloads
-app.post('/webhook', async (req, res) => {
-  const event = req.body;
-  await processPaymentEvent(event);  // No signature verification!
-  res.sendStatus(200);
-});
-```
-
-**Risks**: Spoofed events, unauthorized actions, data manipulation
-
----
-
-## GraphQL Input Vulnerabilities
-
-```typescript
-// VIOLATION: No depth/complexity limits
-const schema = buildSchema(`
-  type Query {
-    users(filter: UserFilter): [User]
-  }
-`);
-
-// No validation on nested input
-resolvers.Query.users = (_, { filter }) => {
-  return db.users.find(filter);  // filter passed directly to DB!
-};
-```
-
-**Risks**: Query complexity attacks, injection through nested objects
-
----
-
-## Form Data Without Sanitization
-
-```typescript
-// VIOLATION: Rendering user input without sanitization
-app.post('/profile', async (req, res) => {
-  const bio = req.body.bio;
-  await db.users.update({ bio });  // Stored XSS!
-  res.send(`Profile updated: ${bio}`);  // Reflected XSS!
-});
-```
-
-**Risks**: Cross-site scripting (XSS), stored attacks
-
----
-
-## Detection Patterns
-
-When reviewing code, look for these red flags:
-
-| Pattern | Risk Level |
-|---------|------------|
-| `req.body` without schema validation | HIGH |
-| `req.params` used directly | MEDIUM |
-| `req.query` used directly | MEDIUM |
-| `process.env` without validation | MEDIUM |
-| String interpolation in SQL | CRITICAL |
-| `JSON.parse` without schema | HIGH |
-| `eval()` or `Function()` with user input | CRITICAL |
-| File operations with user-provided paths | CRITICAL |
-| `jwt.decode` instead of `jwt.verify` | CRITICAL |
-| Missing webhook signature verification | HIGH |

package/shared/skills/java/SKILL.md

@@ -1,183 +0,0 @@
----
-name: java
-description: This skill should be used when the user works with Java files (.java), asks about "records", "sealed classes", "Optional", "streams", "composition over inheritance", or discusses modern Java patterns and API design. Provides patterns for type system usage, error handling, immutability, and concurrency.
-user-invocable: false
-allowed-tools: Read, Grep, Glob
-activation:
-  file-patterns:
-    - "**/*.java"
-  exclude:
-    - "**/build/**"
-    - "**/target/**"
----
-
-# Java Patterns
-
-Reference for modern Java patterns, type system, and best practices.
-
-## Iron Law
-
-> **FAVOR COMPOSITION OVER INHERITANCE**
->
-> Delegation and interfaces over class hierarchies. Inheritance creates tight coupling,
-> breaks encapsulation, and makes refactoring dangerous. Use interfaces for polymorphism,
-> records for data, and sealed classes for restricted hierarchies. Extend only when the
-> "is-a" relationship is genuinely invariant.
-
-## When This Skill Activates
-
-- Working with Java codebases
-- Designing APIs with modern Java features
-- Using records, sealed classes, Optional
-- Implementing concurrent code
-- Structuring Java packages
-
----
-
-## Type System (Modern Java)
-
-### Records for Data
-
-```java
-// BAD: Mutable POJO with getters/setters
-// GOOD: Immutable record
-public record User(String name, String email, Instant createdAt) {
-    public User {
-        Objects.requireNonNull(name, "name must not be null");
-        Objects.requireNonNull(email, "email must not be null");
-    }
-}
-```
-
-### Sealed Classes for Restricted Hierarchies
-
-```java
-public sealed interface Result<T> permits Success, Failure {
-    record Success<T>(T value) implements Result<T> {}
-    record Failure<T>(String error) implements Result<T> {}
-}
-
-// Exhaustive pattern matching (Java 21+)
-switch (result) {
-    case Success<User> s -> handleSuccess(s.value());
-    case Failure<User> f -> handleError(f.error());
-}
-```
-
-### Optional for Absent Values
-
-```java
-// BAD: return null;
-// GOOD:
-public Optional<User> findById(String id) {
-    return Optional.ofNullable(userMap.get(id));
-}
-
-// BAD: if (optional.isPresent()) optional.get()
-// GOOD:
-optional.map(User::name).orElse("Anonymous");
-```
-
----
-
-## Error Handling
-
-### Custom Exceptions with Context
-
-```java
-public class EntityNotFoundException extends RuntimeException {
-    private final String entityType;
-    private final String entityId;
-
-    public EntityNotFoundException(String entityType, String entityId) {
-        super("%s with id %s not found".formatted(entityType, entityId));
-        this.entityType = entityType;
-        this.entityId = entityId;
-    }
-}
-```
-
-### Try-with-Resources
-
-```java
-// Always use try-with-resources for AutoCloseable
-try (var conn = dataSource.getConnection();
-     var stmt = conn.prepareStatement(sql)) {
-    stmt.setString(1, id);
-    return mapResult(stmt.executeQuery());
-}
-```
-
----
-
-## Immutability
-
-```java
-// Prefer unmodifiable collections
-List<String> names = List.of("Alice", "Bob");
-Map<String, Integer> scores = Map.of("Alice", 100, "Bob", 95);
-
-// Defensive copies in constructors
-public final class Team {
-    private final List<String> members;
-    public Team(List<String> members) {
-        this.members = List.copyOf(members);
-    }
-    public List<String> members() { return members; }
-}
-```
-
----
-
-## Composition Over Inheritance
-
-```java
-// BAD: class UserService extends BaseService extends AbstractDAO
-// GOOD: compose via constructor injection
-public class UserService {
-    private final UserRepository repository;
-    private final EventPublisher events;
-
-    public UserService(UserRepository repository, EventPublisher events) {
-        this.repository = repository;
-        this.events = events;
-    }
-}
-```
-
----
-
-## Anti-Patterns
-
-| Pattern | Bad | Good |
-|---------|-----|------|
-| Returning null | `return null` | `return Optional.empty()` |
-| Checked exception abuse | `throws Exception` | Specific exceptions or unchecked |
-| Raw types | `List list` | `List<User> list` |
-| Deep inheritance | 4+ level hierarchy | Interfaces + composition |
-| Mutable data objects | `setName()/getName()` | Records or immutable classes |
-
----
-
-## Extended References
-
-For additional patterns and examples:
-- `references/violations.md` - Common Java violations
-- `references/patterns.md` - Extended Java patterns
-- `references/detection.md` - Detection patterns for Java issues
-- `references/modern-java.md` - Modern Java features (17-21+)
-
----
-
-## Checklist
-
-- [ ] Records for pure data types
-- [ ] Sealed interfaces for type hierarchies
-- [ ] Optional instead of null returns
-- [ ] Composition over inheritance
-- [ ] Try-with-resources for all AutoCloseable
-- [ ] Immutable collections (List.of, Map.of)
-- [ ] No raw generic types
-- [ ] Custom exceptions with context
-- [ ] Streams for collection transforms
-- [ ] Constructor injection for dependencies

package/shared/skills/java/references/detection.md

@@ -1,120 +0,0 @@
-# Detection Patterns for Java Issues
-
-Grep and regex patterns for automated detection of Java violations. Reference from main SKILL.md.
-
----
-
-## Null Returns
-
-```bash
-# Methods returning null instead of Optional
-rg 'return\s+null\s*;' --type java
-
-# Nullable method parameters without validation
-rg 'public\s+\w+\s+\w+\((?!.*@NonNull).*\)' --type java
-```
-
----
-
-## Raw Types
-
-```bash
-# Raw List, Map, Set, Collection usage
-rg '\b(List|Map|Set|Collection|Iterator|Iterable)\b(?!\s*<)' --type java
-
-# Raw Comparable implementation
-rg 'implements\s+Comparable\b(?!\s*<)' --type java
-
-# Unsafe casts from Object
-rg '\(\s*(String|Integer|Long|Double)\s*\)\s*\w+\.get' --type java
-```
-
----
-
-## Deep Inheritance
-
-```bash
-# Classes extending non-Object/non-interface classes (potential deep hierarchy)
-rg 'class\s+\w+\s+extends\s+(?!Object\b)\w+' --type java
-
-# Abstract class chains (look for multiple levels)
-rg 'abstract\s+class\s+\w+\s+extends\s+Abstract' --type java
-
-# Count inheritance depth per file
-rg 'extends\s+\w+' --type java --count
-```
-
----
-
-## Missing Try-with-Resources
-
-```bash
-# Manual close() calls (should use try-with-resources)
-rg '\.close\(\)\s*;' --type java
-
-# InputStream/OutputStream/Connection created outside try-with-resources
-rg 'new\s+(FileInputStream|FileOutputStream|BufferedReader|BufferedWriter|Socket)\(' --type java
-
-# getConnection() without try-with-resources context
-rg '\.getConnection\(\)' --type java
-```
-
----
-
-## Checked Exception Abuse
-
-```bash
-# Broad throws declarations
-rg 'throws\s+Exception\b' --type java
-
-# Empty catch blocks
-rg -U 'catch\s*\([^)]+\)\s*\{\s*\}' --type java --multiline
-
-# Catch-and-ignore (catch with only a comment or log)
-rg -U 'catch\s*\([^)]+\)\s*\{\s*(//|/\*|logger\.(debug|trace))' --type java --multiline
-```
-
----
-
-## Mutable Data Objects
-
-```bash
-# Setter methods (JavaBean anti-pattern for data objects)
-rg 'public\s+void\s+set[A-Z]\w*\(' --type java
-
-# Mutable collections returned from getters
-rg 'return\s+(this\.)?(list|map|set|collection)\s*;' --type java -i
-
-# Missing defensive copies in constructors
-rg 'this\.\w+\s*=\s*\w+\s*;' --type java
-```
-
----
-
-## Concurrency Issues
-
-```bash
-# HashMap in concurrent context (should be ConcurrentHashMap)
-rg 'new\s+HashMap\b' --type java
-
-# Missing volatile on shared fields
-rg 'private\s+(?!volatile\s)(?!final\s)\w+\s+\w+\s*=' --type java
-
-# Synchronized on non-private lock object
-rg 'synchronized\s*\(\s*this\s*\)' --type java
-```
-
----
-
-## Streams Anti-Patterns
-
-```bash
-# Stream.forEach with side effects (should use for-loop or collect)
-rg '\.stream\(\).*\.forEach\(' --type java
-
-# Nested streams (performance concern)
-rg '\.stream\(\).*\.stream\(\)' --type java
-
-# collect(Collectors.toList()) instead of .toList() (Java 16+)
-rg 'collect\(Collectors\.toList\(\)\)' --type java
-```