gkt-node 3.3.0

package/assets/.agent/skills/salesforce-automation/SKILL.md

@@ -0,0 +1,190 @@
+---
+name: salesforce-automation
+description: "Automate Salesforce tasks via Rube MCP (Composio): leads, contacts, accounts, opportunities, SOQL queries. Always search tools first for current schemas."
+requires:
+  mcp: [rube]
+---
+
+# Salesforce Automation via Rube MCP
+
+Automate Salesforce CRM operations through Composio's Salesforce toolkit via Rube MCP.
+
+## Prerequisites
+
+- Rube MCP must be connected (RUBE_SEARCH_TOOLS available)
+- Active Salesforce connection via `RUBE_MANAGE_CONNECTIONS` with toolkit `salesforce`
+- Always call `RUBE_SEARCH_TOOLS` first to get current tool schemas
+
+## Setup
+
+**Get Rube MCP**: Add `https://rube.app/mcp` as an MCP server in your client configuration. No API keys needed — just add the endpoint and it works.
+
+
+1. Verify Rube MCP is available by confirming `RUBE_SEARCH_TOOLS` responds
+2. Call `RUBE_MANAGE_CONNECTIONS` with toolkit `salesforce`
+3. If connection is not ACTIVE, follow the returned auth link to complete Salesforce OAuth
+4. Confirm connection status shows ACTIVE before running any workflows
+
+## Core Workflows
+
+### 1. Manage Leads
+
+**When to use**: User wants to create, search, update, or list leads
+
+**Tool sequence**:
+1. `SALESFORCE_SEARCH_LEADS` - Search leads by criteria [Optional]
+2. `SALESFORCE_LIST_LEADS` - List all leads [Optional]
+3. `SALESFORCE_CREATE_LEAD` - Create a new lead [Optional]
+4. `SALESFORCE_UPDATE_LEAD` - Update lead fields [Optional]
+5. `SALESFORCE_ADD_LEAD_TO_CAMPAIGN` - Add lead to campaign [Optional]
+6. `SALESFORCE_APPLY_LEAD_ASSIGNMENT_RULES` - Apply assignment rules [Optional]
+
+**Key parameters**:
+- `LastName`: Required for lead creation
+- `Company`: Required for lead creation
+- `Email`, `Phone`, `Title`: Common lead fields
+- `lead_id`: Lead ID for updates
+- `campaign_id`: Campaign ID for campaign operations
+
+**Pitfalls**:
+- LastName and Company are required fields for lead creation
+- Lead IDs are 15 or 18 character Salesforce IDs
+
+### 2. Manage Contacts and Accounts
+
+**When to use**: User wants to manage contacts and their associated accounts
+
+**Tool sequence**:
+1. `SALESFORCE_SEARCH_CONTACTS` - Search contacts [Optional]
+2. `SALESFORCE_LIST_CONTACTS` - List contacts [Optional]
+3. `SALESFORCE_CREATE_CONTACT` - Create a new contact [Optional]
+4. `SALESFORCE_SEARCH_ACCOUNTS` - Search accounts [Optional]
+5. `SALESFORCE_CREATE_ACCOUNT` - Create a new account [Optional]
+6. `SALESFORCE_ASSOCIATE_CONTACT_TO_ACCOUNT` - Link contact to account [Optional]
+
+**Key parameters**:
+- `LastName`: Required for contact creation
+- `Name`: Account name for creation
+- `AccountId`: Account ID to associate with contact
+- `contact_id`, `account_id`: IDs for association
+
+**Pitfalls**:
+- Contact requires at least LastName
+- Account association requires both valid contact and account IDs
+
+### 3. Manage Opportunities
+
+**When to use**: User wants to track and manage sales opportunities
+
+**Tool sequence**:
+1. `SALESFORCE_SEARCH_OPPORTUNITIES` - Search opportunities [Optional]
+2. `SALESFORCE_LIST_OPPORTUNITIES` - List all opportunities [Optional]
+3. `SALESFORCE_GET_OPPORTUNITY` - Get opportunity details [Optional]
+4. `SALESFORCE_CREATE_OPPORTUNITY` - Create new opportunity [Optional]
+5. `SALESFORCE_RETRIEVE_OPPORTUNITIES_DATA` - Retrieve opportunity data [Optional]
+
+**Key parameters**:
+- `Name`: Opportunity name (required)
+- `StageName`: Sales stage (required)
+- `CloseDate`: Expected close date (required)
+- `Amount`: Deal value
+- `AccountId`: Associated account
+
+**Pitfalls**:
+- Name, StageName, and CloseDate are required for creation
+- Stage names must match exactly what is configured in Salesforce
+
+### 4. Run SOQL Queries
+
+**When to use**: User wants to query Salesforce data with custom SOQL
+
+**Tool sequence**:
+1. `SALESFORCE_RUN_SOQL_QUERY` / `SALESFORCE_QUERY` - Execute SOQL [Required]
+
+**Key parameters**:
+- `query`: SOQL query string
+
+**Pitfalls**:
+- SOQL syntax differs from SQL; uses Salesforce object and field API names
+- Field API names may differ from display labels (e.g., `Account.Name` not `Account Name`)
+- Results are paginated for large datasets
+
+### 5. Manage Tasks
+
+**When to use**: User wants to create, search, update, or complete tasks
+
+**Tool sequence**:
+1. `SALESFORCE_SEARCH_TASKS` - Search tasks [Optional]
+2. `SALESFORCE_UPDATE_TASK` - Update task fields [Optional]
+3. `SALESFORCE_COMPLETE_TASK` - Mark task as complete [Optional]
+
+**Key parameters**:
+- `task_id`: Task ID for updates
+- `Status`: Task status value
+- `Subject`: Task subject
+
+**Pitfalls**:
+- Task status values must match picklist options in Salesforce
+
+## Common Patterns
+
+### SOQL Syntax
+
+**Basic query**:
+```
+SELECT Id, Name, Email FROM Contact WHERE LastName = 'Smith'
+```
+
+**With relationships**:
+```
+SELECT Id, Name, Account.Name FROM Contact WHERE Account.Industry = 'Technology'
+```
+
+**Date filtering**:
+```
+SELECT Id, Name FROM Lead WHERE CreatedDate = TODAY
+SELECT Id, Name FROM Opportunity WHERE CloseDate = NEXT_MONTH
+```
+
+### Pagination
+
+- SOQL queries with large results return pagination tokens
+- Use `SALESFORCE_QUERY` with nextRecordsUrl for pagination
+- Check `done` field in response; if false, continue paging
+
+## Known Pitfalls
+
+**Field API Names**:
+- Always use API names, not display labels
+- Custom fields end with `__c` suffix
+- Use SALESFORCE_GET_ALL_CUSTOM_OBJECTS to discover custom objects
+
+**ID Formats**:
+- Salesforce IDs are 15 (case-sensitive) or 18 (case-insensitive) characters
+- Both formats are accepted in most operations
+
+## Quick Reference
+
+| Task | Tool Slug | Key Params |
+|------|-----------|------------|
+| Create lead | SALESFORCE_CREATE_LEAD | LastName, Company |
+| Search leads | SALESFORCE_SEARCH_LEADS | query |
+| List leads | SALESFORCE_LIST_LEADS | (filters) |
+| Update lead | SALESFORCE_UPDATE_LEAD | lead_id, fields |
+| Create contact | SALESFORCE_CREATE_CONTACT | LastName |
+| Search contacts | SALESFORCE_SEARCH_CONTACTS | query |
+| Create account | SALESFORCE_CREATE_ACCOUNT | Name |
+| Search accounts | SALESFORCE_SEARCH_ACCOUNTS | query |
+| Link contact | SALESFORCE_ASSOCIATE_CONTACT_TO_ACCOUNT | contact_id, account_id |
+| Create opportunity | SALESFORCE_CREATE_OPPORTUNITY | Name, StageName, CloseDate |
+| Get opportunity | SALESFORCE_GET_OPPORTUNITY | opportunity_id |
+| Search opportunities | SALESFORCE_SEARCH_OPPORTUNITIES | query |
+| Run SOQL | SALESFORCE_RUN_SOQL_QUERY | query |
+| Query | SALESFORCE_QUERY | query |
+| Search tasks | SALESFORCE_SEARCH_TASKS | query |
+| Update task | SALESFORCE_UPDATE_TASK | task_id, fields |
+| Complete task | SALESFORCE_COMPLETE_TASK | task_id |
+| Get user info | SALESFORCE_GET_USER_INFO | (none) |
+| Custom objects | SALESFORCE_GET_ALL_CUSTOM_OBJECTS | (none) |
+| Create record | SALESFORCE_CREATE_A_RECORD | object_type, fields |
+| Transfer ownership | SALESFORCE_MASS_TRANSFER_OWNERSHIP | records, new_owner |

package/assets/.agent/skills/sast-configuration/SKILL.md

@@ -0,0 +1,212 @@
+---
+name: sast-configuration
+description: Configure Static Application Security Testing (SAST) tools for automated vulnerability detection in application code. Use when setting up security scanning, implementing DevSecOps practices, or automating code vulnerability detection.
+---
+
+# SAST Configuration
+
+Static Application Security Testing (SAST) tool setup, configuration, and custom rule creation for comprehensive security scanning across multiple programming languages.
+
+## Use this skill when
+
+- Set up SAST scanning in CI/CD pipelines
+- Create custom security rules for your codebase
+- Configure quality gates and compliance policies
+- Optimize scan performance and reduce false positives
+- Integrate multiple SAST tools for defense-in-depth
+
+## Do not use this skill when
+
+- You only need DAST or manual penetration testing guidance
+- You cannot access source code or CI/CD pipelines
+- You need organizational policy decisions rather than tooling setup
+
+## Instructions
+
+1. Identify languages, repos, and compliance requirements.
+2. Choose tools and define a baseline policy.
+3. Integrate scans into CI/CD with gating thresholds.
+4. Tune rules and suppressions based on false positives.
+5. Track remediation and verify fixes.
+
+## Safety
+
+- Avoid scanning sensitive repos with third-party services without approval.
+- Prevent leaks of secrets in scan artifacts and logs.
+
+## Overview
+
+This skill provides comprehensive guidance for setting up and configuring SAST tools including Semgrep, SonarQube, and CodeQL.
+
+## Core Capabilities
+
+### 1. Semgrep Configuration
+- Custom rule creation with pattern matching
+- Language-specific security rules (Python, JavaScript, Go, Java, etc.)
+- CI/CD integration (GitHub Actions, GitLab CI, Jenkins)
+- False positive tuning and rule optimization
+- Organizational policy enforcement
+
+### 2. SonarQube Setup
+- Quality gate configuration
+- Security hotspot analysis
+- Code coverage and technical debt tracking
+- Custom quality profiles for languages
+- Enterprise integration with LDAP/SAML
+
+### 3. CodeQL Analysis
+- GitHub Advanced Security integration
+- Custom query development
+- Vulnerability variant analysis
+- Security research workflows
+- SARIF result processing
+
+## Quick Start
+
+### Initial Assessment
+1. Identify primary programming languages in your codebase
+2. Determine compliance requirements (PCI-DSS, SOC 2, etc.)
+3. Choose SAST tool based on language support and integration needs
+4. Review baseline scan to understand current security posture
+
+### Basic Setup
+```bash
+# Semgrep quick start
+pip install semgrep
+semgrep --config=auto --error
+
+# SonarQube with Docker
+docker run -d --name sonarqube -p 9000:9000 sonarqube:latest
+
+# CodeQL CLI setup
+gh extension install github/gh-codeql
+codeql database create mydb --language=python
+```
+
+## Reference Documentation
+
+- [Semgrep Rule Creation](references/semgrep-rules.md) - Pattern-based security rule development
+- [SonarQube Configuration](references/sonarqube-config.md) - Quality gates and profiles
+- [CodeQL Setup Guide](references/codeql-setup.md) - Query development and workflows
+
+## Templates & Assets
+
+- [semgrep-config.yml](assets/semgrep-config.yml) - Production-ready Semgrep configuration
+- [sonarqube-settings.xml](assets/sonarqube-settings.xml) - SonarQube quality profile template
+- [run-sast.sh](scripts/run-sast.sh) - Automated SAST execution script
+
+## Integration Patterns
+
+### CI/CD Pipeline Integration
+```yaml
+# GitHub Actions example
+- name: Run Semgrep
+  uses: returntocorp/semgrep-action@v1
+  with:
+    config: >-
+      p/security-audit
+      p/owasp-top-ten
+```
+
+### Pre-commit Hook
+```bash
+# .pre-commit-config.yaml
+- repo: https://github.com/returntocorp/semgrep
+  rev: v1.45.0
+  hooks:
+    - id: semgrep
+      args: ['--config=auto', '--error']
+```
+
+## Best Practices
+
+1. **Start with Baseline**
+   - Run initial scan to establish security baseline
+   - Prioritize critical and high severity findings
+   - Create remediation roadmap
+
+2. **Incremental Adoption**
+   - Begin with security-focused rules
+   - Gradually add code quality rules
+   - Implement blocking only for critical issues
+
+3. **False Positive Management**
+   - Document legitimate suppressions
+   - Create allow lists for known safe patterns
+   - Regularly review suppressed findings
+
+4. **Performance Optimization**
+   - Exclude test files and generated code
+   - Use incremental scanning for large codebases
+   - Cache scan results in CI/CD
+
+5. **Team Enablement**
+   - Provide security training for developers
+   - Create internal documentation for common patterns
+   - Establish security champions program
+
+## Common Use Cases
+
+### New Project Setup
+```bash
+./scripts/run-sast.sh --setup --language python --tools semgrep,sonarqube
+```
+
+### Custom Rule Development
+```yaml
+# See references/semgrep-rules.md for detailed examples
+rules:
+  - id: hardcoded-jwt-secret
+    pattern: jwt.encode($DATA, "...", ...)
+    message: JWT secret should not be hardcoded
+    severity: ERROR
+```
+
+### Compliance Scanning
+```bash
+# PCI-DSS focused scan
+semgrep --config p/pci-dss --json -o pci-scan-results.json
+```
+
+## Troubleshooting
+
+### High False Positive Rate
+- Review and tune rule sensitivity
+- Add path filters to exclude test files
+- Use nostmt metadata for noisy patterns
+- Create organization-specific rule exceptions
+
+### Performance Issues
+- Enable incremental scanning
+- Parallelize scans across modules
+- Optimize rule patterns for efficiency
+- Cache dependencies and scan results
+
+### Integration Failures
+- Verify API tokens and credentials
+- Check network connectivity and proxy settings
+- Review SARIF output format compatibility
+- Validate CI/CD runner permissions
+
+## Related Skills
+
+- [OWASP Top 10 Checklist](../owasp-top10-checklist/SKILL.md)
+- [Container Security](../container-security/SKILL.md)
+- [Dependency Scanning](../dependency-scanning/SKILL.md)
+
+## Tool Comparison
+
+| Tool | Best For | Language Support | Cost | Integration |
+|------|----------|------------------|------|-------------|
+| Semgrep | Custom rules, fast scans | 30+ languages | Free/Enterprise | Excellent |
+| SonarQube | Code quality + security | 25+ languages | Free/Commercial | Good |
+| CodeQL | Deep analysis, research | 10+ languages | Free (OSS) | GitHub native |
+
+## Next Steps
+
+1. Complete initial SAST tool setup
+2. Run baseline security scan
+3. Create custom rules for organization-specific patterns
+4. Integrate into CI/CD pipeline
+5. Establish security gate policies
+6. Train development team on findings and remediation