mumucc 0.4.4 → 0.4.10

package/defaults/plugin-seed/marketplaces/claude-code-workflows/plugins/security-scanning/commands/security-hardening.md

@@ -0,0 +1,653 @@
+---
+description: "Orchestrate comprehensive security hardening with defense-in-depth strategy across all application layers"
+argument-hint: "<target description> [--depth quick|standard|comprehensive] [--compliance owasp,soc2,gdpr,hipaa,pci-dss]"
+---
+
+# Security Hardening Orchestrator
+
+## CRITICAL BEHAVIORAL RULES
+
+You MUST follow these rules exactly. Violating any of them is a failure.
+
+1. **Execute steps in order.** Do NOT skip ahead, reorder, or merge steps.
+2. **Write output files.** Each step MUST produce its output file in `.security-hardening/` before the next step begins. Read from prior step files — do NOT rely on context window memory.
+3. **Stop at checkpoints.** When you reach a `PHASE CHECKPOINT`, you MUST stop and wait for explicit user approval before continuing. Use the AskUserQuestion tool with clear options.
+4. **Halt on failure.** If any step fails (agent error, test failure, missing dependency), STOP immediately. Present the error and ask the user how to proceed. Do NOT silently continue.
+5. **Use only local agents.** All `subagent_type` references use agents bundled with this plugin or `general-purpose`. No cross-plugin dependencies.
+6. **Never enter plan mode autonomously.** Do NOT use EnterPlanMode. This command IS the plan — execute it.
+
+## Pre-flight Checks
+
+Before starting, perform these checks:
+
+### 1. Check for existing session
+
+Check if `.security-hardening/state.json` exists:
+
+- If it exists and `status` is `"in_progress"`: Read it, display the current step, and ask the user:
+
+  ```
+  Found an in-progress security hardening session:
+  Target: [target from state]
+  Current step: [step from state]
+
+  1. Resume from where we left off
+  2. Start fresh (archives existing session)
+  ```
+
+- If it exists and `status` is `"complete"`: Ask whether to archive and start fresh.
+
+### 2. Initialize state
+
+Create `.security-hardening/` directory and `state.json`:
+
+```json
+{
+  "target": "$ARGUMENTS",
+  "status": "in_progress",
+  "depth": "comprehensive",
+  "compliance_frameworks": ["owasp"],
+  "current_step": 1,
+  "current_phase": 1,
+  "completed_steps": [],
+  "files_created": [],
+  "started_at": "ISO_TIMESTAMP",
+  "last_updated": "ISO_TIMESTAMP"
+}
+```
+
+Parse `$ARGUMENTS` for `--depth` and `--compliance` flags. Use defaults if not specified.
+
+### 3. Parse target description
+
+Extract the target description from `$ARGUMENTS` (everything before the flags). This is referenced as `$TARGET` in prompts below.
+
+---
+
+## Phase 1: Assessment & Threat Modeling (Steps 1–3)
+
+### Step 1: Vulnerability Scanning
+
+Use the Task tool to launch the security auditor agent:
+
+```
+Task:
+  subagent_type: "security-auditor"
+  description: "Comprehensive vulnerability scan of $TARGET"
+  prompt: |
+    Perform a comprehensive security assessment on: $TARGET.
+
+    ## Instructions
+    1. Execute SAST analysis (Semgrep/SonarQube patterns)
+    2. Identify DAST scanning targets (OWASP ZAP patterns)
+    3. Perform dependency audit (Snyk/Trivy patterns)
+    4. Run secrets detection (GitLeaks/TruffleHog patterns)
+    5. Generate SBOM for supply chain analysis
+    6. Identify OWASP Top 10 vulnerabilities, CWE weaknesses, and CVE exposures
+    7. Assign CVSS scores to all findings
+
+    Provide a detailed vulnerability report with: CVSS scores, exploitability analysis,
+    attack surface mapping, secrets exposure report, and SBOM inventory.
+```
+
+Save the agent's output to `.security-hardening/01-vulnerability-scan.md`.
+
+Update `state.json`: set `current_step` to 2, add step 1 to `completed_steps`.
+
+### Step 2: Threat Modeling & Risk Analysis
+
+Read `.security-hardening/01-vulnerability-scan.md` to load vulnerability context.
+
+Use the Task tool to launch the threat modeling expert:
+
+```
+Task:
+  subagent_type: "threat-modeling-expert"
+  description: "Threat modeling and risk analysis for $TARGET"
+  prompt: |
+    Conduct threat modeling using STRIDE methodology for: $TARGET.
+
+    ## Vulnerability Context
+    [Insert full contents of .security-hardening/01-vulnerability-scan.md]
+
+    ## Instructions
+    1. Analyze attack vectors and create attack trees
+    2. Assess business impact of identified vulnerabilities
+    3. Map threats to MITRE ATT&CK framework
+    4. Prioritize risks based on likelihood and impact
+    5. Use vulnerability scan results to inform threat priorities
+
+    Provide: threat model diagrams, risk matrix with prioritized vulnerabilities,
+    attack scenario documentation, and business impact analysis.
+```
+
+Save the agent's output to `.security-hardening/02-threat-model.md`.
+
+Update `state.json`: set `current_step` to 3, add step 2 to `completed_steps`.
+
+### Step 3: Architecture Security Review
+
+Read `.security-hardening/01-vulnerability-scan.md` and `.security-hardening/02-threat-model.md`.
+
+Use the Task tool:
+
+```
+Task:
+  subagent_type: "general-purpose"
+  description: "Architecture security review for $TARGET"
+  prompt: |
+    You are a backend security architect. Review the architecture for security weaknesses in: $TARGET.
+
+    ## Vulnerability Scan Results
+    [Insert contents of .security-hardening/01-vulnerability-scan.md]
+
+    ## Threat Model
+    [Insert contents of .security-hardening/02-threat-model.md]
+
+    ## Instructions
+    1. Evaluate service boundaries, data flow security, authentication/authorization architecture
+    2. Review encryption implementation and network segmentation
+    3. Design zero-trust architecture patterns where applicable
+    4. Create a data classification matrix
+    5. Reference the threat model and vulnerability findings in your recommendations
+
+    Provide: security architecture assessment, zero-trust design recommendations,
+    service mesh security requirements, and data classification matrix.
+```
+
+Save the agent's output to `.security-hardening/03-architecture-review.md`.
+
+Update `state.json`: set `current_step` to "checkpoint-1", add step 3 to `completed_steps`.
+
+---
+
+## PHASE CHECKPOINT 1 — User Approval Required
+
+You MUST stop here and present the assessment results for review.
+
+Display a summary of findings from `.security-hardening/01-vulnerability-scan.md`, `.security-hardening/02-threat-model.md`, and `.security-hardening/03-architecture-review.md` (critical vulnerabilities count, top threats, key architecture concerns) and ask:
+
+```
+Security assessment complete. Please review:
+- .security-hardening/01-vulnerability-scan.md
+- .security-hardening/02-threat-model.md
+- .security-hardening/03-architecture-review.md
+
+Critical vulnerabilities: [count]
+High-risk threats: [count]
+Architecture concerns: [count]
+
+1. Approve — proceed to vulnerability remediation
+2. Request changes — tell me what to adjust
+3. Pause — save progress and stop here
+```
+
+Do NOT proceed to Phase 2 until the user selects option 1. If they select option 2, revise and re-checkpoint. If option 3, update `state.json` status and stop.
+
+---
+
+## Phase 2: Vulnerability Remediation (Steps 4–7)
+
+### Step 4: Critical Vulnerability Fixes
+
+Read `.security-hardening/01-vulnerability-scan.md` and `.security-hardening/02-threat-model.md`.
+
+Use the Task tool:
+
+```
+Task:
+  subagent_type: "security-auditor"
+  description: "Remediate critical vulnerabilities for $TARGET"
+  prompt: |
+    Coordinate immediate remediation of critical vulnerabilities (CVSS 7+) in: $TARGET.
+
+    ## Vulnerability Scan Results
+    [Insert contents of .security-hardening/01-vulnerability-scan.md]
+
+    ## Threat Model
+    [Insert contents of .security-hardening/02-threat-model.md]
+
+    ## Instructions
+    1. Fix SQL injections with parameterized queries
+    2. Fix XSS with output encoding
+    3. Fix authentication bypasses with secure session management
+    4. Fix insecure deserialization with input validation
+    5. Apply security patches for known CVEs
+    6. Document all changes and regression test requirements
+
+    Provide: patched code with vulnerability fixes, security patch documentation,
+    and regression test requirements.
+```
+
+Save the agent's output to `.security-hardening/04-critical-fixes.md`.
+
+Update `state.json`: set `current_step` to 5, add step 4 to `completed_steps`.
+
+### Step 5: Backend Security Hardening
+
+Read `.security-hardening/03-architecture-review.md` and `.security-hardening/04-critical-fixes.md`.
+
+Use the Task tool:
+
+```
+Task:
+  subagent_type: "general-purpose"
+  description: "Backend security hardening for $TARGET"
+  prompt: |
+    You are a backend security engineer. Implement comprehensive backend security controls for: $TARGET.
+
+    ## Architecture Review
+    [Insert contents of .security-hardening/03-architecture-review.md]
+
+    ## Critical Fixes Applied
+    [Insert contents of .security-hardening/04-critical-fixes.md]
+
+    ## Instructions
+    1. Add input validation with OWASP ESAPI patterns
+    2. Implement rate limiting and DDoS protection
+    3. Secure API endpoints with OAuth2/JWT validation
+    4. Add encryption for data at rest/transit using AES-256/TLS 1.3
+    5. Implement secure logging without PII exposure
+    6. Build upon the critical fixes already applied
+
+    Provide: hardened API endpoints, validation middleware, encryption implementation,
+    and secure configuration templates.
+```
+
+Save the agent's output to `.security-hardening/05-backend-hardening.md`.
+
+Update `state.json`: set `current_step` to 6, add step 5 to `completed_steps`.
+
+### Step 6: Frontend Security Implementation
+
+Read `.security-hardening/03-architecture-review.md` and `.security-hardening/05-backend-hardening.md`.
+
+Use the Task tool:
+
+```
+Task:
+  subagent_type: "general-purpose"
+  description: "Frontend security implementation for $TARGET"
+  prompt: |
+    You are a frontend security engineer. Implement frontend security measures for: $TARGET.
+
+    ## Architecture Review
+    [Insert contents of .security-hardening/03-architecture-review.md]
+
+    ## Backend Hardening
+    [Insert contents of .security-hardening/05-backend-hardening.md]
+
+    ## Instructions
+    1. Configure CSP headers with nonce-based policies
+    2. Implement XSS prevention with DOMPurify
+    3. Secure authentication flows with PKCE OAuth2
+    4. Add SRI for external resources
+    5. Implement secure cookie handling with SameSite/HttpOnly/Secure flags
+    6. Complement backend security with client-side protections
+
+    Provide: secure frontend components, CSP policy configuration,
+    authentication flow implementation, and security headers configuration.
+```
+
+Save the agent's output to `.security-hardening/06-frontend-hardening.md`.
+
+**Note:** If the target has no frontend component (pure backend/API), skip this step — write a brief note in `06-frontend-hardening.md` explaining why it was skipped, and continue.
+
+Update `state.json`: set `current_step` to 7, add step 6 to `completed_steps`.
+
+### Step 7: Mobile Security Hardening
+
+Read `.security-hardening/03-architecture-review.md` and `.security-hardening/05-backend-hardening.md`.
+
+Use the Task tool:
+
+```
+Task:
+  subagent_type: "general-purpose"
+  description: "Mobile security hardening for $TARGET"
+  prompt: |
+    You are a mobile security engineer. Implement mobile app security for: $TARGET.
+
+    ## Architecture Review
+    [Insert contents of .security-hardening/03-architecture-review.md]
+
+    ## Backend Hardening
+    [Insert contents of .security-hardening/05-backend-hardening.md]
+
+    ## Instructions
+    1. Add certificate pinning
+    2. Implement biometric authentication
+    3. Secure local storage with encryption
+    4. Obfuscate code with ProGuard/R8
+    5. Implement anti-tampering and root/jailbreak detection
+    6. Secure IPC communications
+
+    Provide: hardened mobile application configuration, security configuration files,
+    obfuscation rules, and certificate pinning implementation.
+```
+
+Save the agent's output to `.security-hardening/07-mobile-hardening.md`.
+
+**Note:** If the target has no mobile component, skip this step — write a brief note in `07-mobile-hardening.md` explaining why it was skipped, and continue.
+
+Update `state.json`: set `current_step` to "checkpoint-2", add step 7 to `completed_steps`.
+
+---
+
+## PHASE CHECKPOINT 2 — User Approval Required
+
+Display a summary of all remediation work from steps 4–7 and ask:
+
+```
+Vulnerability remediation complete. Please review:
+- .security-hardening/04-critical-fixes.md
+- .security-hardening/05-backend-hardening.md
+- .security-hardening/06-frontend-hardening.md
+- .security-hardening/07-mobile-hardening.md
+
+Critical fixes applied: [count]
+Backend controls added: [summary]
+Frontend controls added: [summary]
+Mobile controls added: [summary]
+
+1. Approve — proceed to security controls & validation
+2. Request changes — tell me what to adjust
+3. Pause — save progress and stop here
+```
+
+Do NOT proceed to Phase 3 until the user approves.
+
+---
+
+## Phase 3: Security Controls & Infrastructure (Steps 8–10)
+
+### Step 8: Authentication & Authorization Enhancement
+
+Read `.security-hardening/03-architecture-review.md` and `.security-hardening/05-backend-hardening.md`.
+
+Use the Task tool:
+
+```
+Task:
+  subagent_type: "security-auditor"
+  description: "Enhance authentication and authorization for $TARGET"
+  prompt: |
+    Implement a modern authentication system for: $TARGET.
+
+    ## Architecture Review
+    [Insert contents of .security-hardening/03-architecture-review.md]
+
+    ## Backend Hardening
+    [Insert contents of .security-hardening/05-backend-hardening.md]
+
+    ## Instructions
+    1. Deploy OAuth2/OIDC with PKCE
+    2. Implement MFA with TOTP/WebAuthn/FIDO2
+    3. Add risk-based authentication
+    4. Implement RBAC/ABAC with principle of least privilege
+    5. Add session management with secure token rotation
+    6. Strengthen access controls based on architecture review
+
+    Provide: authentication service configuration, MFA implementation,
+    authorization policies, and session management system.
+```
+
+Save the agent's output to `.security-hardening/08-auth-enhancement.md`.
+
+Update `state.json`: set `current_step` to 9, add step 8 to `completed_steps`.
+
+### Step 9: Infrastructure Security Controls
+
+Read `.security-hardening/03-architecture-review.md` and `.security-hardening/08-auth-enhancement.md`.
+
+Use the Task tool:
+
+```
+Task:
+  subagent_type: "general-purpose"
+  description: "Deploy infrastructure security controls for $TARGET"
+  prompt: |
+    You are an infrastructure security engineer. Deploy infrastructure security controls for: $TARGET.
+
+    ## Architecture Review
+    [Insert contents of .security-hardening/03-architecture-review.md]
+
+    ## Auth Enhancement
+    [Insert contents of .security-hardening/08-auth-enhancement.md]
+
+    ## Instructions
+    1. Configure WAF rules for OWASP protection
+    2. Implement network segmentation with micro-segmentation
+    3. Deploy IDS/IPS systems
+    4. Configure cloud security groups and NACLs
+    5. Implement DDoS protection with rate limiting and geo-blocking
+
+    Provide: WAF configuration, network security policies, IDS/IPS rules,
+    and cloud security configurations.
+```
+
+Save the agent's output to `.security-hardening/09-infra-security.md`.
+
+Update `state.json`: set `current_step` to 10, add step 9 to `completed_steps`.
+
+### Step 10: Secrets Management Implementation
+
+Read `.security-hardening/01-vulnerability-scan.md` and `.security-hardening/09-infra-security.md`.
+
+Use the Task tool:
+
+```
+Task:
+  subagent_type: "general-purpose"
+  description: "Implement secrets management for $TARGET"
+  prompt: |
+    You are a DevOps security engineer. Implement enterprise secrets management for: $TARGET.
+
+    ## Vulnerability Scan Results
+    [Insert contents of .security-hardening/01-vulnerability-scan.md]
+
+    ## Infrastructure Security
+    [Insert contents of .security-hardening/09-infra-security.md]
+
+    ## Instructions
+    1. Deploy HashiCorp Vault or AWS Secrets Manager configuration
+    2. Implement secret rotation policies
+    3. Remove hardcoded secrets
+    4. Configure least-privilege IAM roles
+    5. Implement encryption key management with HSM support
+
+    Provide: secrets management configuration, rotation policies,
+    IAM role definitions, and key management procedures.
+```
+
+Save the agent's output to `.security-hardening/10-secrets-management.md`.
+
+Update `state.json`: set `current_step` to "checkpoint-3", add step 10 to `completed_steps`.
+
+---
+
+## PHASE CHECKPOINT 3 — User Approval Required
+
+Display a summary of security controls from steps 8–10 and ask:
+
+```
+Security controls implementation complete. Please review:
+- .security-hardening/08-auth-enhancement.md
+- .security-hardening/09-infra-security.md
+- .security-hardening/10-secrets-management.md
+
+Auth controls: [summary]
+Infrastructure controls: [summary]
+Secrets management: [summary]
+
+1. Approve — proceed to validation & compliance
+2. Request changes — tell me what to adjust
+3. Pause — save progress and stop here
+```
+
+Do NOT proceed to Phase 4 until the user approves.
+
+---
+
+## Phase 4: Validation & Compliance (Steps 11–13)
+
+### Step 11: Penetration Testing & Validation
+
+Read `.security-hardening/04-critical-fixes.md`, `.security-hardening/05-backend-hardening.md`, and `.security-hardening/08-auth-enhancement.md`.
+
+Use the Task tool:
+
+```
+Task:
+  subagent_type: "security-auditor"
+  description: "Penetration testing and validation for $TARGET"
+  prompt: |
+    Execute comprehensive penetration testing for: $TARGET.
+
+    ## Critical Fixes Applied
+    [Insert contents of .security-hardening/04-critical-fixes.md]
+
+    ## Backend Hardening
+    [Insert contents of .security-hardening/05-backend-hardening.md]
+
+    ## Auth Enhancement
+    [Insert contents of .security-hardening/08-auth-enhancement.md]
+
+    ## Instructions
+    1. Perform authenticated and unauthenticated testing
+    2. Execute API security testing
+    3. Test business logic vulnerabilities
+    4. Attempt privilege escalation
+    5. Validate all security controls effectiveness
+    6. Use Burp Suite, Metasploit, and custom exploit patterns
+
+    Provide: penetration test report, proof-of-concept exploits,
+    remediation validation, and security control effectiveness metrics.
+```
+
+Save the agent's output to `.security-hardening/11-pentest-results.md`.
+
+Update `state.json`: set `current_step` to 12, add step 11 to `completed_steps`.
+
+### Step 12: Compliance & Standards Verification
+
+Read `.security-hardening/11-pentest-results.md`.
+
+Use the Task tool:
+
+```
+Task:
+  subagent_type: "security-auditor"
+  description: "Compliance verification for $TARGET"
+  prompt: |
+    Verify compliance with security frameworks for: $TARGET.
+
+    ## Penetration Test Results
+    [Insert contents of .security-hardening/11-pentest-results.md]
+
+    ## Compliance Frameworks to Validate
+    [Insert compliance_frameworks from state.json — default: OWASP]
+
+    ## Instructions
+    1. Validate against OWASP ASVS Level 2
+    2. Validate against CIS Benchmarks
+    3. Check SOC2 Type II requirements if applicable
+    4. Verify GDPR/CCPA privacy controls if applicable
+    5. Check HIPAA/PCI-DSS requirements if applicable
+    6. Generate compliance attestation reports
+
+    Provide: compliance assessment report, gap analysis,
+    remediation requirements, and audit evidence collection.
+```
+
+Save the agent's output to `.security-hardening/12-compliance-report.md`.
+
+Update `state.json`: set `current_step` to 13, add step 12 to `completed_steps`.
+
+### Step 13: Security Monitoring & SIEM Integration
+
+Read `.security-hardening/09-infra-security.md` and `.security-hardening/12-compliance-report.md`.
+
+Use the Task tool:
+
+```
+Task:
+  subagent_type: "general-purpose"
+  description: "Implement security monitoring and SIEM for $TARGET"
+  prompt: |
+    You are a security operations engineer specializing in SIEM and incident response.
+    Implement security monitoring and SIEM integration for: $TARGET.
+
+    ## Infrastructure Security
+    [Insert contents of .security-hardening/09-infra-security.md]
+
+    ## Compliance Report
+    [Insert contents of .security-hardening/12-compliance-report.md]
+
+    ## Instructions
+    1. Deploy SIEM integration (Splunk/ELK/Sentinel configuration)
+    2. Configure security event correlation rules
+    3. Implement behavioral analytics for anomaly detection
+    4. Set up automated incident response playbooks
+    5. Create security dashboards and alerting
+    6. Ensure monitoring covers compliance requirements
+
+    Provide: SIEM configuration, correlation rules, incident response playbooks,
+    security dashboards, and alert definitions.
+```
+
+Save the agent's output to `.security-hardening/13-monitoring-siem.md`.
+
+Update `state.json`: set `current_step` to "complete", add step 13 to `completed_steps`.
+
+---
+
+## Completion
+
+Update `state.json`:
+
+- Set `status` to `"complete"`
+- Set `last_updated` to current timestamp
+
+Present the final summary:
+
+```
+Security hardening complete: $TARGET
+
+## Output Files
+- .security-hardening/01-vulnerability-scan.md
+- .security-hardening/02-threat-model.md
+- .security-hardening/03-architecture-review.md
+- .security-hardening/04-critical-fixes.md
+- .security-hardening/05-backend-hardening.md
+- .security-hardening/06-frontend-hardening.md
+- .security-hardening/07-mobile-hardening.md
+- .security-hardening/08-auth-enhancement.md
+- .security-hardening/09-infra-security.md
+- .security-hardening/10-secrets-management.md
+- .security-hardening/11-pentest-results.md
+- .security-hardening/12-compliance-report.md
+- .security-hardening/13-monitoring-siem.md
+
+## Summary by Phase
+- **Assessment**: [vulnerability count] vulnerabilities found, [threat count] threats modeled
+- **Remediation**: [fix count] critical fixes applied, backend/frontend/mobile hardened
+- **Controls**: Auth enhanced, infrastructure secured, secrets managed
+- **Validation**: Pentest [pass/fail], compliance [frameworks validated]
+
+## Success Criteria
+- [ ] All critical vulnerabilities (CVSS 7+) remediated
+- [ ] OWASP Top 10 vulnerabilities addressed
+- [ ] Zero high-risk findings in penetration testing
+- [ ] Compliance frameworks validation passed
+- [ ] Security monitoring detecting and alerting on threats
+- [ ] All secrets managed through secure vault
+- [ ] Authentication implements MFA and secure session management
+- [ ] Security tests integrated into CI/CD pipeline
+
+## Next Steps
+1. Review all generated security artifacts
+2. Run the full security test suite to verify controls
+3. Deploy monitoring configuration to production
+4. Schedule regular security reviews
+```