devflow-kit 1.8.3 → 2.0.1

package/plugins/devflow-resolve/skills/security-patterns/SKILL.md

@@ -1,156 +0,0 @@
----
-name: security-patterns
-description: This skill should be used when reviewing code for injection flaws, auth bypasses, or hardcoded secrets.
-user-invocable: false
-allowed-tools: Read, Grep, Glob
----
-
-# Security Patterns
-
-Domain expertise for security vulnerability detection. Use alongside `review-methodology` for complete security reviews.
-
-## Iron Law
-
-> **ASSUME ALL INPUT IS MALICIOUS**
->
-> Every user input, URL parameter, header, and cookie is an attack vector. Use parameterized
-> queries always. Escape output always. Validate schemas always. "This field is internal"
-> is not a defense. Defense in depth, not wishful thinking.
-
----
-
-## Vulnerability Categories
-
-### 1. Input Validation & Injection
-
-**SQL Injection**
-```typescript
-// VULNERABLE
-const query = `SELECT * FROM users WHERE email = '${email}'`;
-
-// SECURE
-await db.execute("SELECT * FROM users WHERE email = ?", [email]);
-```
-
-**XSS (Cross-Site Scripting)**
-```typescript
-// VULNERABLE
-element.innerHTML = userInput;
-
-// SECURE
-element.textContent = userInput;
-```
-
-> See `references/injection.md` for NoSQL, command injection, path traversal patterns.
-
-### 2. Authentication & Authorization
-
-**Missing Auth Checks**
-```typescript
-// VULNERABLE
-app.delete('/api/users/:id', async (req, res) => {
-  await deleteUser(req.params.id);  // No auth!
-});
-
-// SECURE
-app.delete('/api/users/:id', requireAuth, requireRole('admin'), handler);
-```
-
-> See `references/auth.md` for password policies, session management, JWT patterns.
-
-### 3. Cryptography & Secrets
-
-**Hardcoded Secrets**
-```typescript
-// VULNERABLE
-const API_KEY = 'sk-abc123xyz789';
-
-// SECURE
-const API_KEY = process.env.API_KEY;
-```
-
-**Insecure Random**
-```typescript
-// VULNERABLE
-const token = Math.random().toString(36);
-
-// SECURE
-const token = crypto.randomBytes(32).toString('hex');
-```
-
-> See `references/crypto.md` for weak crypto detection, encryption patterns.
-
-### 4. Configuration & Headers
-
-```typescript
-// REQUIRED: Use helmet or set manually
-app.use(helmet());
-res.setHeader('Content-Security-Policy', "default-src 'self'");
-res.setHeader('X-Frame-Options', 'DENY');
-res.setHeader('Strict-Transport-Security', 'max-age=31536000');
-
-// CORS: Never use origin: '*'
-app.use(cors({ origin: ['https://myapp.com'], credentials: true }));
-```
-
-### 5. Business Logic
-
-**Race Conditions**
-```typescript
-// VULNERABLE
-if (balance >= amount) await withdraw(userId, amount);
-
-// SECURE: Use transactions with row locks
-await db.transaction(async (tx) => {
-  const balance = await tx.getBalance(userId, { forUpdate: true });
-  if (balance >= amount) await tx.withdraw(userId, amount);
-});
-```
-
-**Mass Assignment**
-```typescript
-// VULNERABLE
-await User.create(req.body);  // All fields accepted!
-
-// SECURE: Explicitly list allowed fields
-await User.create({ email: req.body.email, name: req.body.name });
-```
-
----
-
-## Extended References
-
-| Reference | Content |
-|-----------|---------|
-| `references/injection.md` | NoSQL, command, path traversal, LDAP, template injection |
-| `references/auth.md` | Password policy, session management, JWT, RBAC/ABAC |
-| `references/crypto.md` | Secret management, weak crypto, encryption, timing attacks |
-| `references/detection.md` | All grep patterns for automated scanning |
-
----
-
-## Severity Guidelines
-
-| Level | Criteria | Examples |
-|-------|----------|----------|
-| **CRITICAL** | Immediate exploitation | SQL injection in auth, RCE, hardcoded admin creds |
-| **HIGH** | Significant risk | XSS, broken access control, weak crypto, CSRF |
-| **MEDIUM** | Moderate with conditions | Missing headers, permissive CORS, missing rate limits |
-| **LOW** | Minor improvement | Outdated deps (no CVE), suboptimal CSP |
-
----
-
-## OWASP Reference
-
-| ID | Category | Examples |
-|----|----------|----------|
-| A01 | Broken Access Control | Missing auth, IDOR, privilege escalation |
-| A02 | Cryptographic Failures | Weak hashing, hardcoded secrets |
-| A03 | Injection | SQL, NoSQL, command, XSS |
-| A04 | Insecure Design | Missing rate limits, mass assignment |
-| A05 | Security Misconfiguration | Debug enabled, missing headers |
-| A06 | Vulnerable Components | Outdated deps with known CVEs |
-| A07 | Auth Failures | Weak passwords, session issues |
-| A08 | Data Integrity Failures | Untrusted deserialization |
-| A09 | Logging Failures | Missing security logs |
-| A10 | SSRF | Unvalidated URLs in server requests |

package/plugins/devflow-resolve/skills/security-patterns/references/detection.md

@@ -1,287 +0,0 @@
-# Security Detection Patterns
-
-Comprehensive grep commands and patterns for security vulnerability detection.
-
-## Injection Detection
-
-### SQL Injection
-
-```bash
-# String interpolation in queries
-grep -rn "query.*\${" --include="*.ts" --include="*.js"
-grep -rn "query.*+ " --include="*.ts" --include="*.js"
-grep -rn "execute.*\`" --include="*.ts" --include="*.js"
-
-# Raw SQL with variables
-grep -rn "SELECT.*\${" --include="*.ts" --include="*.js"
-grep -rn "INSERT.*\${" --include="*.ts" --include="*.js"
-grep -rn "UPDATE.*\${" --include="*.ts" --include="*.js"
-grep -rn "DELETE.*\${" --include="*.ts" --include="*.js"
-
-# ORM raw queries
-grep -rn "\.raw\s*\(" --include="*.ts" --include="*.js"
-grep -rn "\.query\s*\(" --include="*.ts" --include="*.js"
-```
-
-### NoSQL Injection
-
-```bash
-# MongoDB queries with user input
-grep -rn "findOne.*req\.\|find.*req\." --include="*.ts" --include="*.js"
-grep -rn "\$where" --include="*.ts" --include="*.js"
-grep -rn "\$regex.*req\." --include="*.ts" --include="*.js"
-```
-
-### Command Injection
-
-```bash
-# Shell execution
-grep -rn "exec\s*\(" --include="*.ts" --include="*.js"
-grep -rn "execSync" --include="*.ts" --include="*.js"
-grep -rn "spawn.*\`" --include="*.ts" --include="*.js"
-grep -rn "child_process" --include="*.ts" --include="*.js"
-
-# Eval and similar
-grep -rn "eval\s*\(" --include="*.ts" --include="*.js"
-grep -rn "Function\s*\(" --include="*.ts" --include="*.js"
-grep -rn "new Function" --include="*.ts" --include="*.js"
-```
-
-### XSS Detection
-
-```bash
-# Dangerous DOM manipulation
-grep -rn "innerHTML" --include="*.ts" --include="*.js" --include="*.tsx" --include="*.jsx"
-grep -rn "document.write" --include="*.ts" --include="*.js"
-grep -rn "dangerouslySetInnerHTML" --include="*.tsx" --include="*.jsx"
-
-# React unescaped rendering
-grep -rn "__html" --include="*.tsx" --include="*.jsx"
-```
-
-### Path Traversal
-
-```bash
-# File operations with user input
-grep -rn "readFile.*req\.\|readFileSync.*req\." --include="*.ts" --include="*.js"
-grep -rn "writeFile.*req\.\|writeFileSync.*req\." --include="*.ts" --include="*.js"
-grep -rn "path\.join.*req\." --include="*.ts" --include="*.js"
-grep -rn "fs\.\|readdir\|unlink" --include="*.ts" --include="*.js"
-```
-
-## Authentication Detection
-
-### Missing Auth Middleware
-
-```bash
-# Endpoints without auth checks
-grep -rn "app\.\(get\|post\|put\|delete\|patch\).*async" --include="*.ts" --include="*.js" | \
-  grep -v "requireAuth\|isAuthenticated\|authorize\|protect"
-
-# Express route handlers
-grep -rn "router\.\(get\|post\|put\|delete\).*\(" --include="*.ts" --include="*.js" | \
-  grep -v "auth\|protect\|verify"
-```
-
-### JWT Issues
-
-```bash
-# JWT without algorithm specification
-grep -rn "jwt\.sign\|jwt\.verify" --include="*.ts" --include="*.js" -A 5 | \
-  grep -v "algorithm"
-
-# JWT without expiration
-grep -rn "jwt\.sign" --include="*.ts" --include="*.js" -A 5 | \
-  grep -v "expiresIn\|exp"
-
-# Weak JWT secrets
-grep -rn "jwt\.sign.*['\"][a-zA-Z0-9]\{1,20\}['\"]" --include="*.ts" --include="*.js"
-```
-
-### Session Issues
-
-```bash
-# Session configuration
-grep -rn "session\|cookie" --include="*.ts" --include="*.js" | \
-  grep -v "httpOnly\|secure\|sameSite"
-
-# Session in URL
-grep -rn "session.*=.*req\.query\|session.*=.*req\.params" --include="*.ts" --include="*.js"
-```
-
-### Password Handling
-
-```bash
-# Weak password requirements
-grep -rn "password.*length" --include="*.ts" --include="*.js" | \
-  grep -v "minLength.*12\|min.*12"
-
-# Plain text password storage
-grep -rn "password.*=.*req\." --include="*.ts" --include="*.js" | \
-  grep -v "hash\|bcrypt\|argon"
-```
-
-## Cryptography Detection
-
-### Hardcoded Secrets
-
-```bash
-# Common secret patterns
-grep -rn "password.*=.*['\"]" --include="*.ts" --include="*.js"
-grep -rn "api.key.*=.*['\"]" --include="*.ts" --include="*.js"
-grep -rn "secret.*=.*['\"]" --include="*.ts" --include="*.js"
-grep -rn "token.*=.*['\"]" --include="*.ts" --include="*.js"
-
-# API key patterns
-grep -rn "sk-\|pk-\|api_" --include="*.ts" --include="*.js" --include="*.json"
-grep -rn "AKIA[0-9A-Z]\{16\}" --include="*.ts" --include="*.js" # AWS keys
-
-# Private keys
-grep -rn "BEGIN.*PRIVATE KEY" --include="*.ts" --include="*.js" --include="*.pem"
-```
-
-### Weak Algorithms
-
-```bash
-# Weak hash functions
-grep -rn "createHash.*md5\|sha1" --include="*.ts" --include="*.js"
-
-# Weak encryption
-grep -rn "DES\|RC4\|Blowfish" --include="*.ts" --include="*.js"
-grep -rn "aes-.*-ecb" --include="*.ts" --include="*.js"
-
-# Non-authenticated encryption
-grep -rn "aes-.*-cbc" --include="*.ts" --include="*.js" | \
-  grep -v "hmac\|auth"
-```
-
-### Insecure Random
-
-```bash
-# Math.random for security
-grep -rn "Math.random" --include="*.ts" --include="*.js"
-
-# Date-based IDs
-grep -rn "Date.now.*id\|Date.now.*token" --include="*.ts" --include="*.js"
-
-# UUID v1 (time-based)
-grep -rn "uuid\.v1\|uuidv1" --include="*.ts" --include="*.js"
-```
-
-## Configuration Detection
-
-### CORS Issues
-
-```bash
-# Permissive CORS
-grep -rn "cors.*origin.*\*\|Access-Control.*\*" --include="*.ts" --include="*.js"
-grep -rn "cors.*credentials.*true" --include="*.ts" --include="*.js"
-```
-
-### Missing Headers
-
-```bash
-# Check for security headers
-grep -rn "Content-Security-Policy\|X-Frame-Options\|X-Content-Type-Options" \
-  --include="*.ts" --include="*.js" -l
-# If no results, headers may be missing
-
-# Check for helmet usage
-grep -rn "helmet" --include="*.ts" --include="*.js"
-```
-
-### Error Exposure
-
-```bash
-# Stack trace exposure
-grep -rn "err\.stack\|error\.stack" --include="*.ts" --include="*.js" | \
-  grep -v "console\|log\|debug"
-
-# Verbose errors to client
-grep -rn "res\.json.*error\|res\.send.*error" --include="*.ts" --include="*.js"
-```
-
-## Business Logic Detection
-
-### Race Conditions
-
-```bash
-# Check-then-act patterns
-grep -rn "if.*balance\|if.*quantity\|if.*available" --include="*.ts" --include="*.js" -A 3 | \
-  grep -v "transaction\|lock"
-
-# Missing transaction blocks
-grep -rn "await.*update\|await.*delete" --include="*.ts" --include="*.js" | \
-  grep -v "transaction\|atomic"
-```
-
-### Mass Assignment
-
-```bash
-# Direct body assignment
-grep -rn "\.create.*req\.body\|\.update.*req\.body" --include="*.ts" --include="*.js"
-grep -rn "Object\.assign.*req\.body\|{.*\.\.\.req\.body" --include="*.ts" --include="*.js"
-```
-
-## Quick Security Audit Script
-
-```bash
-#!/bin/bash
-# security-audit.sh - Run all detection patterns
-
-echo "=== Security Audit ==="
-
-echo -e "\n## Injection Risks"
-echo "SQL Injection:"
-grep -rn "query.*\${" --include="*.ts" --include="*.js" 2>/dev/null | head -5
-
-echo -e "\nXSS:"
-grep -rn "innerHTML\|dangerouslySetInnerHTML" --include="*.ts" --include="*.js" --include="*.tsx" 2>/dev/null | head -5
-
-echo -e "\n## Hardcoded Secrets"
-grep -rn "password.*=.*['\"]" --include="*.ts" --include="*.js" 2>/dev/null | head -5
-grep -rn "api.key.*=.*['\"]" --include="*.ts" --include="*.js" 2>/dev/null | head -5
-
-echo -e "\n## Weak Crypto"
-grep -rn "createHash.*md5\|sha1" --include="*.ts" --include="*.js" 2>/dev/null | head -5
-grep -rn "Math.random" --include="*.ts" --include="*.js" 2>/dev/null | head -5
-
-echo -e "\n## Missing Auth"
-grep -rn "app\.\(get\|post\|put\|delete\).*async" --include="*.ts" --include="*.js" 2>/dev/null | \
-  grep -v "requireAuth\|isAuthenticated" | head -5
-
-echo -e "\n=== End Audit ==="
-```
-
-## Integration with CI/CD
-
-```yaml
-# .github/workflows/security.yml
-name: Security Scan
-on: [push, pull_request]
-
-jobs:
-  security:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - name: Check for hardcoded secrets
-        run: |
-          if grep -rn "password.*=.*['\"]" --include="*.ts" --include="*.js" src/; then
-            echo "::error::Potential hardcoded secrets found"
-            exit 1
-          fi
-
-      - name: Check for weak crypto
-        run: |
-          if grep -rn "createHash.*md5\|sha1" --include="*.ts" --include="*.js" src/; then
-            echo "::warning::Weak hash algorithms detected"
-          fi
-
-      - name: Check for Math.random
-        run: |
-          if grep -rn "Math.random" --include="*.ts" --include="*.js" src/; then
-            echo "::warning::Math.random used - verify not for security"
-          fi
-```