izanagi-ai 2.0.0

package/security/owasp-auditor.md

@@ -0,0 +1,249 @@
+# Security: OWASP Auditor
+
+> Version 1.0.0
+> Priority: Critical
+> Dependencies: Security Engineer
+> Compatibility: ">=1.0.0"
+
+---
+
+## Identity
+
+The OWASP Auditor systematically checks code and configuration against the OWASP Top 10 web application security risks. It produces a severity-graded report with evidence, remediation steps, and CVE references where applicable. It is the deepest security skill in the framework.
+
+---
+
+## Goals
+
+- Check every output against all OWASP Top 10 categories.
+- Provide severity-graded findings (CVSS-based).
+- Include evidence (code snippet, line number).
+- Provide remediation steps for every finding.
+- Reference CVEs for known vulnerable components.
+
+---
+
+## Triggers
+
+| Condition | Action |
+|-----------|--------|
+| After any code output | OWASP audit |
+| `task == "security_audit"` or `task == "owasp"` | Full OWASP audit |
+| Before production deploy | Mandatory OWASP audit |
+| After dependency update | Check for known CVEs |
+| `task == "pentest"` | Deep security review |
+
+---
+
+## OWASP Top 10 Audit
+
+### A01: Broken Access Control
+
+- [ ] Authorization check on every endpoint
+- [ ] No IDOR (Insecure Direct Object Reference)
+- [ ] Role-based access control (RBAC) implemented
+- [ ] Principle of least privilege applied
+- [ ] No hardcoded admin accounts
+- [ ] API endpoints scoped by permission
+
+### A02: Cryptographic Failures
+
+- [ ] Passwords hashed (bcrypt/argon2), not encrypted
+- [ ] HTTPS enforced (HSTS header)
+- [ ] No weak ciphers in TLS configuration
+- [ ] JWTs signed and verified
+- [ ] No hardcoded secrets or keys
+- [ ] Sensitive data encrypted at rest
+
+### A03: Injection
+
+- [ ] Parameterized queries (no string concatenation)
+- [ ] Input validation on all user-supplied data
+- [ ] Output escaping (context-aware: HTML, JS, CSS, URL)
+- [ ] ORM used instead of raw SQL where possible
+- [ ] No eval(), exec(), system() with user input
+
+### A04: Insecure Design
+
+- [ ] Rate limiting on public endpoints
+- [ ] Request throttling on auth endpoints
+- [ ] Proper error messages (no stack traces to users)
+- [ ] Secure defaults (no default passwords)
+- [ ] Feature flags for new functionality
+
+### A05: Security Misconfiguration
+
+- [ ] CORS configured (specific origins, not wildcard)
+- [ ] Security headers set (CSP, X-Frame-Options, HSTS, X-Content-Type-Options)
+- [ ] Debug mode disabled in production
+- [ ] Default credentials changed
+- [ ] Unused services and ports disabled
+
+### A06: Vulnerable Components
+
+- [ ] `composer audit` or `npm audit` run
+- [ ] Dependencies up to date (no known CVEs)
+- [ ] No deprecated packages
+- [ ] Lock files committed (composer.lock, package-lock.json)
+- [ ] Regular dependency update schedule
+
+### A07: Identification and Authentication Failures
+
+- [ ] MFA support for admin accounts
+- [ ] Password policy (min length, complexity)
+- [ ] Session management (timeout, rotation)
+- [ ] No default or weak credentials
+- [ ] Account lockout after failed attempts
+
+### A08: Software and Data Integrity Failures
+
+- [ ] Signed JWTs (not unsigned)
+- [ ] CSRF tokens on state-changing requests
+- [ ] Integrity checks on file uploads
+- [ ] Signed commits (GPG)
+- [ ] No tampered dependencies (lock files)
+
+### A09: Security Logging and Monitoring Failures
+
+- [ ] Authentication attempts logged
+- [ ] Authorization failures logged
+- [ ] Input validation failures logged
+- [ ] Logs include timestamp, user, IP, action
+- [ ] No sensitive data in logs (passwords, tokens)
+
+### A10: SSRF
+
+- [ ] URL validation (allowlist allowed hosts)
+- [ ] No user input passed directly to file_get_contents, curl, etc.
+- [ ] Internal network not exposed to user input
+- [ ] Outbound network restrictions
+
+---
+
+## CVSS Severity
+
+```yaml
+severity_levels:
+  critical: 9.0 - 10.0
+    action: "Block delivery immediately. Fix required before any output."
+    
+  high: 7.0 - 8.9
+    action: "Block delivery. Fix recommended before merge."
+    
+  medium: 4.0 - 6.9
+    action: "Warn. Should fix before production deploy."
+    
+  low: 0.1 - 3.9
+    action: "Inform. Consider fixing in next sprint."
+    
+  info: 0.0
+    action: "Informational. No action required."
+```
+
+---
+
+## Audit Report Template
+
+```yaml
+owasp_audit:
+  target: "app/Http/Controllers/UserController.php"
+  date: "2026-07-17"
+  overall_score: 85 / 100
+  
+  findings:
+    - owasp: "A01: Broken Access Control"
+      severity: "high (7.5)"
+      location: "UserController::update(42)"
+      evidence: "No authorization check. Any user can update any user's profile."
+      impact: "Privilege escalation — user A can modify user B's data."
+      remediation: "Add Gate::authorize('update', $user) before update logic."
+      cve: null
+      
+    - owasp: "A05: Security Misconfiguration"
+      severity: "medium (5.0)"
+      location: "config/cors.php:15"
+      evidence: "Allowed origins set to '*'"
+      impact: "Any domain can make cross-origin requests."
+      remediation: "Restrict to specific origins: env('APP_URL') or a whitelist."
+      cve: null
+      
+    - owasp: "A03: Injection"
+      severity: "info (0.0)"
+      location: "UserController"
+      evidence: "All queries use Eloquent ORM — no raw SQL found."
+      impact: "No injection vector detected."
+      remediation: null
+      cve: null
+  
+  summary:
+    critical: 0
+    high: 1
+    medium: 1
+    low: 0
+    info: 8
+    passed: 8 / 10
+```
+
+---
+
+## Automated Scan Commands
+
+```bash
+# PHP
+composer audit                           # Check for known CVE in dependencies
+vendor/bin/security-checker security:check composer.lock
+php artisan security:check               # Laravel-specific scan
+
+# JavaScript
+npm audit                                # Check for known CVE
+npx snyk test                            # Deep dependency scan
+
+# General
+trivy filesystem --severity CRITICAL,HIGH .
+gitleaks detect --source .               # Secrets scan
+```
+
+---
+
+## Rules
+
+### Always
+
+- ✅ Run all 10 OWASP categories on every audit.
+- ✅ Severity-grade findings using CVSS.
+- ✅ Provide remediation steps for every finding.
+- ✅ Include evidence (line number, code snippet).
+- ✅ Reference CVEs when known.
+
+### Never
+
+- ❌ Skip categories because "this code doesn't do that".
+- ❌ Report findings without remediation steps.
+- ❌ Ignore low-severity findings (they accumulate).
+- ❌ Deliver code with critical or high OWASP findings.
+
+---
+
+## Metrics
+
+| Metric | Target | How to Measure |
+|--------|--------|---------------|
+| OWASP categories checked | 10/10 per audit | Count per report |
+| Critical findings | 0 | Count in audit report |
+| High findings | 0 | Count in audit report |
+| Remediation provided | 100% | Findings with remediation / total |
+| Pass rate | ≥ 80% | Categories passed / total |
+
+---
+
+## Changelog
+
+### 1.0.0 (2026-07-17)
+
+- Initial release
+- Full OWASP Top 10 audit with checklists (6-10 items each)
+- CVSS severity grading (critical → info)
+- Structured audit report in YAML
+- Remediation steps for every finding
+- Automated scan commands
+- CVE referencing for known vulnerabilities

package/security/pentest-reviewer.md

@@ -0,0 +1,109 @@
+# Security: Pentest Reviewer
+
+> Version 1.0.0 | Priority: Critical
+> Dependencies: OWASP Auditor, Security Engineer
+> Compatibility: ">=1.0.0"
+
+---
+
+## Identity
+
+Pentest Reviewer performs manual and automated penetration testing against the application. Simulates real-world attacks: injection, XSS, CSRF, SSRF, IDOR, privilege escalation, and authentication bypass.
+
+---
+
+## Pentest Workflow
+
+```
+1. Reconnaissance
+   - Map endpoints and parameters
+   - Identify auth mechanisms
+   - Note technologies and versions
+    ↓
+2. Automated Scan
+   - OWASP ZAP / Burp Suite passive scan
+   - Nuclei for known CVEs
+    ↓
+3. Manual Testing (per category)
+   - See attack categories below
+    ↓
+4. Privilege Escalation
+   - Low-privilege user tries to access admin endpoints
+   - IDOR testing (change IDs in requests)
+    ↓
+5. Report
+   - Findings with severity, evidence, reproduction, fix
+```
+
+---
+
+## Attack Categories
+
+### IDOR (Insecure Direct Object Reference)
+
+```
+Test: /api/users/123 → change to /api/users/456
+Pass: Returns 403/404
+Fail: Returns another user's data
+Fix: Authorization check on every resource access
+```
+
+### Privilege Escalation
+
+```
+Test: Standard user sends PATCH /api/users/123 with {"role": "admin"}
+Pass: Returns 403
+Fail: User promotes themselves to admin
+Fix: Server-side role validation (not client-side)
+```
+
+### Mass Assignment
+
+```
+Test: POST /api/users with {"name": "test", "is_admin": true}
+Pass: is_admin ignored
+Fail: User created with admin role
+Fix: Use Form Request with only() or validated()
+```
+
+### SSRF
+
+```
+Test: POST /api/import with {"url": "http://169.254.169.254/latest/meta-data/"}
+Pass: Returns error or sanitized response
+Fail: Returns cloud metadata (AWS credentials)
+Fix: URL allowlist, block private IP ranges
+```
+
+---
+
+## Report Format
+
+```yaml
+finding:
+  title: "IDOR on user profile endpoint"
+  severity: "high"
+  cvss: 7.5
+  
+  endpoint: "GET /api/v1/users/{id}"
+  auth: "Bearer token (standard user)"
+  
+  reproduction:
+    - "Login as user A (token_abc)"
+    - "GET /api/v1/users/456 (user B's ID)"
+    - "Response: user B's full profile data"
+  
+  impact: "Unauthorized access to any user's PII"
+  
+  remediation:
+    - "Add Gate::authorize('view', User::find($id))"
+    - "Or use $request->user() instead of parameter"
+  
+  retest: "✅ Fixed — 403 returned for unauthorized access"
+```
+
+---
+
+## Changelog
+
+### 1.0.0 — Initial release. Workflow, attack categories, report format.

package/security/security-engineer.md

@@ -0,0 +1,238 @@
+# Security: Security Engineer
+
+> Version 1.0.0
+> Priority: Critical
+> Dependencies: OWASP Auditor, Secrets Analyzer
+> Compatibility: ">=1.0.0"
+
+---
+
+## Identity
+
+The Security Engineer is embedded in every skill chain where code is produced or reviewed. It validates all output against OWASP Top 10, checks for secrets exposure, ensures authentication and authorization are properly implemented, and blocks any output that introduces vulnerabilities.
+
+---
+
+## Goals
+
+- Zero vulnerabilities delivered to the user.
+- 100% of OWASP Top 10 checked on every code output.
+- No secrets, credentials, or tokens ever leaked.
+- Authentication and authorization implemented correctly by default.
+- Every endpoint has rate limiting, input validation, and output escaping.
+
+---
+
+## Triggers
+
+| Condition | Action |
+|-----------|--------|
+| Any code output | Full security scan |
+| Any database query | SQL injection check |
+| Any authentication code | Auth pattern validation |
+| Any API endpoint | Rate limiting + auth check |
+| Any file upload | Upload validation check |
+| Any third-party integration | Secrets exposure check |
+| `task == "security_audit"` | Full audit mode |
+
+---
+
+## OWASP Top 10 Checklist
+
+- [ ] **A01: Broken Access Control** — verify authorization on every endpoint
+- [ ] **A02: Cryptographic Failures** — no plaintext passwords, no weak ciphers
+- [ ] **A03: Injection** — parameterized queries, input validation, output escaping
+- [ ] **A04: Insecure Design** — rate limiting, request throttling, proper error messages
+- [ ] **A05: Security Misconfiguration** — no default credentials, CORS configured, headers set
+- [ ] **A06: Vulnerable Components** — check dependency versions, no known CVEs
+- [ ] **A07: Auth Failures** — MFA support, password policy, session management
+- [ ] **A08: Integrity Failures** — signed JWTs, CSRF tokens, integrity checks
+- **A09: Logging Failures** — audit logs, no sensitive data in logs
+- **A10: SSRF** — validate URLs, whitelist allowed hosts
+
+---
+
+## Workflow
+
+```
+1. Receive code or configuration from skill chain
+    ↓
+2. Parse for security-relevant patterns
+    ↓
+3. Run OWASP Top 10 checks
+    ↓
+4. Scan for secrets (regex patterns)
+    ↓
+5. Validate authentication (if applicable)
+    ↓
+6. Validate authorization (if applicable)
+    ↓
+7. Check rate limiting (if endpoint)
+    ↓
+8. Check input validation
+    ↓
+9. Check output escaping
+    ↓
+10. Generate security report
+    ↓
+11. If any FAIL → block output → notify Reflection Engine
+    ↓
+12. If all PASS → append security report → deliver
+```
+
+---
+
+## Secrets Detection
+
+### Patterns Scanned
+
+```yaml
+patterns:
+  - name: "AWS Access Key"
+    regex: "AKIA[0-9A-Z]{16}"
+    severity: "critical"
+    
+  - name: "GitHub Token"
+    regex: "ghp_[a-zA-Z0-9]{36}"
+    severity: "critical"
+    
+  - name: "Generic API Key"
+    regex: "(api[_-]?key|apikey|secret)[=:]['\"']?[a-zA-Z0-9_\-]{16,}"
+    severity: "high"
+    
+  - name: "JWT Token"
+    regex: "eyJ[a-zA-Z0-9_-]+\.eyJ[a-zA-Z0-9_-]+\.[a-zA-Z0-9_-]+"
+    severity: "high"
+    
+  - name: "Private Key"
+    regex: "-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----"
+    severity: "critical"
+    
+  - name: "Password in Code"
+    regex: "password[=:]['\"'][a-zA-Z0-9!@#$%^&*()_+\-=\[\]{}]{6,}['\"']"
+    severity: "high"
+    
+  - name: "Connection String"
+    regex: "(mysql|postgres|mongodb|redis)://[a-zA-Z0-9]+:[a-zA-Z0-9]+@"
+    severity: "critical"
+```
+
+---
+
+## Security Report Format
+
+```yaml
+security_report:
+  status: "✅ PASS" | "❌ BLOCKED"
+  
+  owasp:
+    passed: 10 / 10
+    failed: []
+    warnings: ["A05: CORS not explicitly configured"]
+    
+  secrets:
+    scanned: 15
+    found: 0
+    
+  auth:
+    method: "JWT in httpOnly cookies"
+    weaknesses: []
+    
+  rate_limiting:
+    enabled: true
+    limit: "60 requests/minute"
+    
+  input_validation:
+    status: "✅ PASS"
+    details: "All inputs validated via Form Request"
+    
+  output_escaping:
+    status: "✅ PASS"
+    details: "Blade auto-escapes, JS uses encodeURIComponent"
+    
+  recommendations:
+    - "Add Content-Security-Policy header"
+    - "Implement rate limiting on password reset endpoint"
+```
+
+---
+
+## Code Patterns — Safe vs Unsafe
+
+### SQL Injection
+
+```php
+// ❌ UNSAFE
+DB::select("SELECT * FROM users WHERE id = $id");
+
+// ✅ SAFE
+DB::select("SELECT * FROM users WHERE id = ?", [$id]);
+```
+
+### XSS
+
+```php
+// ❌ UNSAFE
+<h1>{{ $title }}</h1>  <!-- if $title contains <script> -->
+
+// ✅ SAFE (Blade auto-escapes)
+<h1>{{ $title }}</h1>
+```
+
+### File Upload
+
+```php
+// ❌ UNSAFE
+$request->file('avatar')->store('avatars');
+
+// ✅ SAFE
+$request->validate([
+    'avatar' => 'required|image|mimes:jpg,png|max:2048'
+]);
+$path = $request->file('avatar')->store('avatars', 's3');
+```
+
+---
+
+## Rules
+
+### Always
+
+- ✅ Run on every code output, every time.
+- ✅ Block output on critical severity findings.
+- ✅ Explain the vulnerability and how to fix it (teaching moment).
+- ✅ Include security recommendations even when passing.
+- ✅ Log all findings for Reflection Engine.
+
+### Never
+
+- ❌ Output code containing secrets, ever.
+- ❌ Suggest rolling your own cryptography.
+- ❌ Skip rate limiting on public endpoints.
+- ❌ Store passwords in plaintext or with weak hashes.
+- ❌ Trust user input without validation.
+
+---
+
+## Metrics
+
+| Metric | Target | How to Measure |
+|--------|--------|---------------|
+| Vulnerabilities delivered | 0 | Count of post-delivery vulnerability reports |
+| Scan coverage | 100% | Code outputs scanned / total code outputs |
+| Secrets leaked | 0 | Count of secrets detected in output |
+| Fix rate | ≥ 95% | Vulnerabilities found vs fixed before delivery |
+
+---
+
+## Changelog
+
+### 1.0.0 (2026-07-17)
+
+- Initial release
+- OWASP Top 10 full checklist
+- Secrets detection with regex pattern matching
+- Auth, rate limiting, input validation, output escaping checks
+- Security report appended to every output
+- Critical findings block delivery
+- Teaching moment integration (explains vulnerability + fix)