opencode-skills-collection 4.0.60 → 4.0.62

package/README.md

@@ -9,6 +9,7 @@
 
 [![npm version](https://img.shields.io/npm/v/opencode-skills-collection?style=for-the-badge&color=cb3837&label=npm)](https://www.npmjs.com/package/opencode-skills-collection)
 [![npm downloads](https://img.shields.io/npm/dm/opencode-skills-collection?style=for-the-badge&color=orange)](https://www.npmjs.com/package/opencode-skills-collection)
+[![HOL Guard](https://img.shields.io/endpoint?url=https%3A%2F%2Fhol.org%2Fapi%2Fregistry%2Fbadges%2Fplugin%3Fslug%3Dfrancostino%252Fopencode-skills-collection%26metric%3Dtrust&style=for-the-badge)](https://hol.org/go/guard/rawsar?dest=%2Fguard%2Fbilling%3Fpromo%3DGUARD20-RAWSAR%23upgrade&link_id=02c248f9-50d5-4c60-abf0-ca80d2604a6b&utm_source=insights_share&utm_medium=affiliate_cta&utm_campaign=share20)
 [![license](https://img.shields.io/github/license/FrancoStino/opencode-skills-collection?style=for-the-badge&color=blue)](./LICENSE)
 [![zread](https://img.shields.io/badge/Documentation-_.svg?style=for-the-badge&color=00b0aa&labelColor=000000&logo=data%3Aimage%2Fsvg%2Bxml%3Bbase64%2CPHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZD0iTTQuOTYxNTYgMS42MDAxSDIuMjQxNTZDMS44ODgxIDEuNjAwMSAxLjYwMTU2IDEuODg2NjQgMS42MDE1NiAyLjI0MDFWNC45NjAxQzEuNjAxNTYgNS4zMTM1NiAxLjg4ODEgNS42MDAxIDIuMjQxNTYgNS42MDAxSDQuOTYxNTZDNS4zMTUwMiA1LjYwMDEgNS42MDE1NiA1LjMxMzU2IDUuNjAxNTYgNC45NjAxVjIuMjQwMUM1LjYwMTU2IDEuODg2NjQgNS4zMTUwMiAxLjYwMDEgNC45NjE1NiAxLjYwMDFaIiBmaWxsPSIjZmZmIi8%2BCjxwYXRoIGQ9Ik00Ljk2MTU2IDEwLjM5OTlIMi4yNDE1NkMxLjg4ODEgMTAuMzk5OSAxLjYwMTU2IDEwLjY4NjQgMS42MDE1NiAxMS4wMzk5VjEzLjc1OTlDMS42MDE1NiAxNC4xMTM0IDEuODg4MSAxNC4zOTk5IDIuMjQxNTYgMTQuMzk5OUg0Ljk2MTU2QzUuMzE1MDIgMTQuMzk5OSA1LjYwMTU2IDE0LjExMzQgNS42MDE1NiAxMy43NTk5VjExLjAzOTlDNS42MDE1NiAxMC42ODY0IDUuMzE1MDIgMTAuMzk5OSA0Ljk2MTU2IDEwLjM5OTlaIiBmaWxsPSIjZmZmIi8%2BCjxwYXRoIGQ9Ik0xMy43NTg0IDEuNjAwMUgxMS4wMzg0QzEwLjY4NSAxLjYwMDEgMTAuMzk4NCAxLjg4NjY0IDEwLjM5ODQgMi4yNDAxVjQuOTYwMUMxMC4zOTg0IDUuMzEzNTYgMTAuNjg1IDUuNjAwMSAxMS4wMzg0IDUuNjAwMUgxMy43NTg0QzE0LjExMTkgNS42MDAxIDE0LjM5ODQgNS4zMTM1NiAxNC4zOTg0IDQuOTYwMVYyLjI0MDFDMTQuMzk4NCAxLjg4NjY0IDE0LjExMTkgMS42MDAxIDEzLjc1ODQgMS42MDAxWiIgZmlsbD0iI2ZmZiIvPgo8cGF0aCBkPSJNNCAxMkwxMiA0TDQgMTJaIiBmaWxsPSIjZmZmIi8%2BCjxwYXRoIGQ9Ik00IDEyTDEyIDQiIHN0cm9rZT0iI2ZmZiIgc3Ryb2tlLXdpZHRoPSIxLjUiIHN0cm9rZS1saW5lY2FwPSJyb3VuZCIvPgo8L3N2Zz4K&logoColor=ffffff)](https://zread.ai/FrancoStino/opencode-skills-collection)
 </div>
@@ -20,6 +21,11 @@
 
 ---
 
+## Sponsor
+[![Sponsored by GitAds](https://gitads.dev/v1/ad-serve?source=francostino/opencode-skills-collection@github)](https://gitads.dev/v1/ad-track?source=francostino/opencode-skills-collection@github)
+
+---
+
 ## Overview
 
 **OpenCode Skills Collection** ships a pre-bundled snapshot of 1595+ universal skills for the OpenCode.
@@ -255,9 +261,6 @@ To use the latest beta version, update your `~/.config/opencode/opencode.json`:
 
 [MIT ©](./LICENSE)
 
-## GitAds Sponsored
-[![Sponsored by GitAds](https://gitads.dev/v1/ad-serve?source=francostino/opencode-skills-collection@github)](https://gitads.dev/v1/ad-track?source=francostino/opencode-skills-collection@github)
-
 ## Star History
 
 <a href="https://www.star-history.com/?repos=FrancoStino%2Fopencode-skills-collection&type=date&legend=top-left">

package/bundled-skills/.antigravity-install-manifest.json

@@ -1,6 +1,6 @@
 {
   "schemaVersion": 1,
-  "updatedAt": "2026-09-12T01:53:52.661Z",
+  "updatedAt": "2026-09-14T02:04:32.368Z",
   "entries": [
     "00-andruia-consultant",
     "007",
@@ -64,6 +64,7 @@
     "agents-md",
     "agents-v2-py",
     "agenttrace-session-audit",
+    "agy-auto",
     "agy-delegate",
     "ai-agent-development",
     "ai-agents-architect",
@@ -451,6 +452,7 @@
     "clean-code-guard",
     "clerk-auth",
     "clickup-automation",
+    "client-secret-exposure-audit",
     "cline-delegate",
     "close-automation",
     "closed-loop-delivery",
@@ -952,6 +954,7 @@
     "gitlab-automation",
     "gitlab-ci-patterns",
     "gitops-workflow",
+    "glasser",
     "global-chat-agent-discovery",
     "gmail-automation",
     "go-concurrency-patterns",
@@ -1237,6 +1240,7 @@
     "marketing-ideas",
     "marketing-plan",
     "marketing-psychology",
+    "marketplace-rbac-audit",
     "markstream-angular",
     "markstream-custom-components",
     "markstream-install",
@@ -1255,6 +1259,7 @@
     "mcp-builder",
     "mcp-builder-ms",
     "mcp-tool-developer",
+    "md2video-audio",
     "mdpr-skill",
     "memory-forensics",
     "memory-safety-patterns",
@@ -1514,6 +1519,7 @@
     "product-marketing-context",
     "production-audit",
     "production-code-audit",
+    "production-runtime-certification",
     "production-scheduling",
     "professional-proofreader",
     "programmatic-seo",

package/bundled-skills/agy-auto/SKILL.md

@@ -0,0 +1,137 @@
+---
+name: agy-auto
+description: "Configure agy-auto PreToolUse security gate to run Antigravity CLI (agy) unattended with layered policy controls instead of --dangerously-skip-permissions."
+category: security
+risk: critical
+source: community
+source_repo: onkarbadve/agy-auto
+source_type: community
+date_added: "2026-09-11"
+author: onkarbadve
+tags: [antigravity, agy, security, permissions, sandboxing, guardrails, cli]
+license: "MIT"
+license_source: "https://github.com/onkarbadve/agy-auto/blob/main/LICENSE"
+tools: [antigravity]
+---
+
+# agy-auto — Antigravity Auto-Permission & Security Gate
+
+## Overview
+
+`agy-auto` is a PreToolUse hook and security harness for Google Antigravity CLI (`agy`) that enables safe unattended execution without relying on `--dangerously-skip-permissions`. It passes every pending tool call through a multi-layered policy gate: deterministic hard-deny rules, deterministic fast-allow for workspace-scoped and read-only operations, an LLM classifier fallback (Gemini Flash Lite or local llama.cpp), and single-use scoped token approvals with Zero Ambient Authority.
+
+## When to Use This Skill
+
+- Use when running Antigravity CLI (`agy`) unattended or in background agent loops and you want automated tool permissions without exposing system files or credentials.
+- Use when you need granular, auditable controls over shell commands, file modifications, and network egress during `agy` workflows.
+- Use when setting up a secure pair-programming environment with Antigravity that prevents prompt injection attacks from escaping the workspace.
+
+## How It Works
+
+### Step 1: Review, Pin, and Install agy-auto
+
+> [!IMPORTANT]
+> Because `agy-auto` installs as an active PreToolUse hook on the permission evaluation path, never clone a mutable branch directly into your live plugin directory. Always clone to a temporary staging folder, pin an immutable release tag or commit SHA, and inspect the codebase before making the hook executable.
+
+**Option A: Native Antigravity Plugin (Recommended)**
+```bash
+# 1. Clone into a temporary review directory and checkout an immutable release tag
+git clone https://github.com/onkarbadve/agy-auto.git /tmp/agy-auto-review
+cd /tmp/agy-auto-review
+git checkout v0.2.0-alpha
+
+# 2. Inspect hook.sh and engine/ files before deployment
+less hook.sh
+python3 -m unittest -v tests/test_engine.py
+
+# 3. Once reviewed and verified, copy to the Antigravity plugin directory and set permissions
+mkdir -p ~/.gemini/config/plugins/agy-auto
+cp -r . ~/.gemini/config/plugins/agy-auto/
+chmod +x ~/.gemini/config/plugins/agy-auto/hook.sh
+```
+
+Ensure `toolPermission: "always-proceed"` is configured in `~/.gemini/antigravity-cli/settings.json` so hooks can gate tool calls:
+```json
+{
+  "toolPermission": "always-proceed"
+}
+```
+
+**Option B: Global Hook via Installer**
+```bash
+# 1. Clone to an isolated location and pin release
+git clone https://github.com/onkarbadve/agy-auto.git ~/.local/share/agy-auto
+cd ~/.local/share/agy-auto
+git checkout v0.2.0-alpha
+
+# 2. Review and run the installer
+chmod +x hook.sh
+./install.sh                  # registers hook in hooks.json, sets always-proceed, runs smoke tests
+```
+
+### Step 2: Policy Evaluation Layers
+
+`agy-auto` evaluates each tool invocation through sequential layers (first match wins):
+
+1. **Hard Deny**: Immediately blocks recursive deletes outside workspace, credential reads (`~/.ssh`, `.env`, cloud tokens), git history rewrites (`push --force`, `rebase`), package publishing, system file writes (`/etc`, shell rc), and gate tampering.
+2. **Fast Allow**: Immediately permits parsed read-only commands (`cat`, `grep`, `git status`) and workspace-confined writes without invoking an LLM.
+3. **Classifier**: Ambiguous or grey-area commands fall through to an LLM classifier (Google Gemini 3.5 Flash Lite free tier, or a local `llama.cpp` / Ollama endpoint) that reviews the pending call against conversation context and fail-closes on timeout.
+4. **Scoped Action Approval**: If a command is denied or needs human judgment, the engine issues a single-use 6-character action token bound strictly to `(tool, normalized_cmd, cwd)`. You approve it by replying `> agy-approve <token>` in chat. Conversational phrases like "yes" or "proceed" are ignored to prevent ambient authority leakage.
+
+## Examples
+
+### Example 1: Approving a Blocked Command
+
+When an unclassified command is blocked, `agy-auto` outputs a token:
+```text
+tool call denied by pre-tool hook: [agy-auto/classifier] needs human approval: pip install requests. Reply '> agy-approve a1b2c3' in chat to proceed.
+```
+To authorize this specific command for a single run, reply directly in the chat:
+```text
+> agy-approve a1b2c3
+```
+
+### Example 2: Configuring a Local Model Backend
+
+To run `agy-auto` completely offline using llama.cpp or Ollama instead of cloud APIs, edit `~/.gemini/config/agy-auto/policy.toml`:
+```toml
+[classifier]
+endpoint = "http://127.0.0.1:8080/v1/chat/completions"
+model = "qwen2.5-coder:7b"
+timeout_s = 20
+```
+
+### Example 3: Running Headless Invocations
+
+When invoking `agy` in headless mode (`-p`), always pass `--add-dir` so `agy-auto` recognizes the workspace boundaries:
+```bash
+agy --add-dir . -p "Run test suite and fix failing cases"
+```
+
+## Best Practices
+
+- ✅ Always keep `toolPermission: "always-proceed"` enabled so the pre-tool hook can intercept and gate every tool call.
+- ✅ Add custom repetitive dev tools (e.g. specialized compilers, formatters) to `[fast_allow]` in `~/.gemini/config/agy-auto/policy.toml` for instant sub-millisecond execution.
+- ✅ Pass `--add-dir <path>` when running headless commands (`agy -p`) to prevent false-positive path denials.
+- ❌ Do not use `--dangerously-skip-permissions`; `agy-auto` provides safe autonomous execution without removing safety guardrails.
+- ❌ Do not attempt conversational approval words ("approve", "proceed", "yes"); approvals strictly require the ephemeral action token.
+
+## Common Pitfalls
+
+- **Problem:** Commands fail with `path is outside the workspace` when running `agy -p`.
+  **Solution:** Headless `agy` does not infer workspace roots automatically. Pass `--add-dir .` (e.g. `agy --add-dir . -p "..."`).
+- **Problem:** Classifier fails closed with `policy classifier unavailable (The read operation timed out)`.
+  **Solution:** Increase `timeout_s` in `~/.gemini/config/agy-auto/policy.toml` (especially when running local LLMs on integrated graphics), or verify your `GEMINI_API_KEY`.
+- **Problem:** Changes to `policy.toml` or `hook.sh` are blocked by `[agy-auto/hard_deny]`.
+  **Solution:** `agy-auto` enforces self-protection against agents tampering with the security gate. Edit policy files directly from your own shell.
+
+## Limitations
+
+- `agy-auto` only intercepts actions performed via tool calls (e.g. `run_command`, `write_to_file`); it cannot restrict internal LLM network reasoning or Antigravity's own internal context-gathering file reads.
+- Requires `toolPermission: "always-proceed"` in Antigravity settings to ensure the PreToolUse hook intercepts all tool invocations.
+- Shell parsing is conservative: complex pipelines with computed variable expansions that cannot be statically resolved will fall through to the LLM classifier or require manual token approval.
+
+## Additional Resources
+
+- [agy-auto GitHub Repository](https://github.com/onkarbadve/agy-auto)
+- [Antigravity CLI Documentation](https://github.com/google-gemini/antigravity-cli)

package/bundled-skills/client-secret-exposure-audit/SKILL.md

@@ -0,0 +1,228 @@
+---
+name: client-secret-exposure-audit
+description: "Audit a deployed web app for secrets exposed to the browser: hardcoded API keys/tokens in JS, secrets in HTML meta/attributes/comments, publicly reachable source/config/deploy files, and header/CORS misconfig."
+category: security
+risk: safe
+source: self
+source_type: self
+date_added: "2026-09-10"
+author: siddanta-ar1
+tags: [security, secrets, owasp, reconnaissance, web, headers]
+tools: [claude, cursor, gemini]
+---
+
+# Client-Side Secret & Sensitive-File Exposure Audit
+
+## Overview
+
+Modern web apps ship a lot of code and config to the browser. When credentials
+leak into that client-visible surface — hardcoded in JavaScript, tucked into HTML
+`meta`/`data-*` attributes or comments, or served as raw source/config/deploy
+files that were never meant to be public — anyone can read them with `curl` and a
+browser. This skill is a **defensive, read-only** workflow for finding that class
+of exposure on a web app **you are authorized to assess**.
+
+It maps to OWASP **A02:2021 Cryptographic Failures** (sensitive data exposure),
+**A05:2021 Security Misconfiguration**, and CWE-798 (hardcoded credentials),
+CWE-200 (sensitive information exposure), CWE-540 (source code in a production
+build). It only fetches resources the server already hands to any anonymous
+visitor — it does not exploit, brute-force, or mutate anything.
+
+## When to Use This Skill
+
+- Use when you need to check whether a deployed site leaks API keys, tokens, or
+  passwords in its client-side bundle before shipping or during a review.
+- Use when working with a static/SPA deployment (Vercel, Netlify, Nginx, S3,
+  GitHub Pages) and you want to confirm no source/config/deploy files are
+  publicly reachable.
+- Use when the user asks to "find secrets," "audit exposed files," "check the
+  JS/HTML for credentials," or run a lightweight sensitive-data-exposure pass on
+  a URL they own or are authorized to test.
+- Do **not** use this to attack third-party sites. See *Security & Safety Notes*.
+
+## How It Works
+
+Set the target once. Every command below reads only what the server serves
+publicly.
+
+```bash
+BASE="https://TARGET.example"     # authorized target, no trailing path
+WORK="$(mktemp -d)"; cd "$WORK"
+```
+
+### Step 1: Fetch the page and inspect response headers
+
+```bash
+curl -s -D headers.txt -o body.html "$BASE/"
+cat headers.txt
+```
+
+Flag on the headers:
+
+- `access-control-allow-origin: *` — permissive CORS (worse when paired with
+  credentials).
+- Missing `Content-Security-Policy`, `X-Frame-Options`/`frame-ancestors`,
+  `X-Content-Type-Options: nosniff`, `Referrer-Policy`, `Permissions-Policy`.
+- Missing/weak `Strict-Transport-Security`.
+- `Server`/framework version banners that fingerprint the stack.
+
+### Step 2: Grep the HTML for secrets and sinks
+
+```bash
+grep -inE "secret|passwd|password|api[_-]?key|apikey|token|bearer|authorization|\
+akia|sk_live|sk_test|pk_live|whsec_|ghp_|aiza|private[_-]?key|mongodb(\+srv)?://|\
+data-[a-z-]*(secret|token|key|access)" body.html
+grep -inE "<!--" body.html            # read every HTML comment
+grep -ioE '<meta[^>]+>' body.html     # meta tags often carry keys/ids
+grep -ioE '<script[^>]+src="[^"]+"'   body.html   # enumerate JS bundles
+```
+
+Secrets hide in `data-*` attributes, `<meta>` tags, `hidden` `<div>`s, and
+`<!-- comments -->` at least as often as in scripts.
+
+### Step 3: Pull every JavaScript bundle and scan it
+
+```bash
+# extract script srcs, resolve relative paths against $BASE, fetch and scan
+grep -ioE 'src="[^"]+\.js"' body.html | sed -E 's/^src="//; s/"$//' \
+ | while read -r p; do
+     u="$p"; case "$p" in http*) ;; /*) u="$BASE$p";; *) u="$BASE/$p";; esac
+     f="js_$(echo "$p" | tr '/:' '__')"
+     curl -s "$u" -o "$f" && echo "== $u =="
+   done
+grep -rinE "secret|password|api[_-]?key|token|bearer|sk_(live|test)|pk_(live|test)|\
+whsec_|akia|aiza|jwt|signing[_-]?key|admin[_-]?token|mongodb|redis://" js_* 2>/dev/null
+```
+
+Also scan any sourcemaps (`*.js.map`) — they can rebuild original source with
+comments intact.
+
+### Step 4: Probe for publicly reachable source / config / deploy files
+
+SPAs often have a catch-all rewrite that returns `index.html` for unknown paths,
+so **compare response sizes** — a path whose size differs from the SPA fallback
+is a real, distinct file.
+
+```bash
+FALLBACK=$(curl -s "$BASE/____nope____$RANDOM" | wc -c)   # SPA fallback size
+for p in /.env /.env.local /.env.production /.git/config /.git/HEAD \
+  /package.json /package-lock.json /vercel.json /.vercel/project.json \
+  /Dockerfile /docker-compose.yml /wrangler.toml /.gitignore \
+  /server/index.js /src/config/app.config.js /config.js \
+  /src/services/payment.service.js /webpack.config.js /next.config.js; do
+    read -r code size < <(curl -s -o /dev/null -w "%{http_code} %{size_download}" "$BASE$p")
+    [ "$code" = "200" ] && [ "$size" != "$FALLBACK" ] && echo "REAL FILE  $code $size  $p"
+done
+```
+
+For any real file found, fetch it and re-run the Step 2/3 secret grep. Follow
+`require(...)`/`import` paths inside those files to discover more source files
+(routes, controllers, services, webhooks) and repeat.
+
+### Step 5: Triage and score
+
+Rate each finding by blast radius, not by where it was found:
+
+| Severity | Examples |
+|---|---|
+| **Critical** | Live provider secret keys (`sk_live_`, cloud `AKIA…`+secret, DB URI with password, private signing/JWT secret, admin bearer token) reachable anonymously |
+| **High** | Server-side source/config/deploy files exposed; test-mode secret keys; internal service tokens; webhook signing secrets |
+| **Medium** | CORS `*`, missing CSP/security headers, verbose banners, weak randomness for security values (`Math.random()` for tokens/refs) |
+| **Low / Info** | Public keys correctly client-side, analytics IDs, non-secret config, stack fingerprinting |
+
+A key being "test/demo" does not make it safe if the *pattern* would ship a live
+key the same way — report the pattern.
+
+### Step 6: Report
+
+Write findings as Markdown using the format in
+[references/example-report.md](references/example-report.md): one row/section per finding with
+`Severity · Category (OWASP/CWE) · Location · Evidence (redacted) · Impact ·
+Remediation`. Redact real secret material to a prefix + length. End with
+prioritized remediation and a note on which secrets must be **rotated**, not just
+removed (anything committed/served is already compromised).
+
+## Examples
+
+### Example 1: Secrets in HTML meta and hidden elements
+
+```bash
+BASE="https://demo-for-opensource.vercel.app"; curl -s "$BASE/" -o body.html
+grep -inE "recaptcha-secret|data-aws-secret|data-webhook-secret|mongodb\+srv" body.html
+# -> meta recaptcha-secret=..., data-aws-access=AKIA…/data-aws-secret=…,
+#    data-webhook-secret=whsec_…, and a hidden JSON blob with a mongodb+srv URI
+#    (username:password@cluster). All reachable with a single unauthenticated GET.
+```
+
+### Example 2: Hardcoded credentials in a JS config bundle
+
+```bash
+curl -s "$BASE/public/assets/js/config.js" | \
+  grep -inE "API_SECRET|ADMIN_TOKEN|JWT_SECRET|DATABASE_PASSWORD|PAYMENT_SIGNING_KEY"
+# -> API_SECRET, ADMIN_TOKEN (JWT), JWT_SECRET, DATABASE_PASSWORD, and a payment
+#    signing key, all assigned as plain string constants shipped to every browser.
+```
+
+### Example 3: Server source exposed behind a SPA fallback
+
+```bash
+FALLBACK=$(curl -s "$BASE/__nope__" | wc -c)
+for p in /server/index.js /docker-compose.yml /src/services/payment.service.js; do
+  sz=$(curl -s "$BASE$p" | wc -c); [ "$sz" != "$FALLBACK" ] && echo "REAL $sz $p"
+done
+# -> docker-compose.yml leaks a Redis password; payment.service.js leaks
+#    Stripe/Khalti secret keys + webhook secret. Distinct sizes prove they are
+#    real files, not the SPA catch-all page.
+```
+
+A full worked report for this target is in [references/example-report.md](references/example-report.md).
+
+## Best Practices
+
+- ✅ Confirm written authorization and scope (the exact hostnames) before fetching.
+- ✅ Compare every probed path against the SPA fallback size to avoid false 200s.
+- ✅ Follow `require`/`import` chains in any exposed source file to find more files.
+- ✅ Redact real secret values in the report; record enough to identify, not reuse.
+- ✅ Flag secrets for **rotation** — served/committed secrets are already burned.
+- ❌ Don't use discovered credentials to authenticate, pivot, or access data.
+- ❌ Don't run this against sites you don't own or aren't authorized to test.
+- ❌ Don't treat "it's a test/demo key" as safe — report the shipping pattern.
+
+## Limitations
+
+- Read-only reconnaissance of client-served assets; it does not test injection,
+  auth logic, IDOR, or server-side flaws — pair with `@web-security-testing`.
+- Path probing uses a wordlist; it finds common exposures, not every file.
+- This skill does not replace environment-specific validation, testing, or expert
+  review.
+- Stop and ask for clarification if authorization, scope, or safety boundaries
+  are missing.
+
+## Security & Safety Notes
+
+- **Authorized targets only.** Run exclusively against systems you own or have
+  explicit written permission to assess. Unauthorized scanning may be illegal.
+- Every command here performs only unauthenticated `GET` requests for resources
+  the server already serves publicly — no exploitation, brute force, or mutation.
+- Handle any real secrets you uncover as sensitive: store findings in an access-
+  controlled location, redact them in shared reports, and recommend rotation.
+- Do not exfiltrate data or reuse discovered credentials — locating an exposure is
+  the deliverable; using it is out of scope.
+
+## Common Pitfalls
+
+- **Problem:** Every probed path returns HTTP 200, hiding real files.
+  **Solution:** SPA catch-all rewrite. Baseline the fallback body size and only
+  treat paths with a *different* size as real files.
+- **Problem:** Grep misses secrets stored in `data-*` attributes or comments.
+  **Solution:** Also scan `<meta>`, `data-*`, `hidden` elements, and every
+  `<!-- comment -->`, not just `<script>` bodies.
+- **Problem:** Dismissing a finding because the key is labeled "test/demo."
+  **Solution:** Report the pattern — the same code path would ship a live key.
+
+## Related Skills
+
+- `@web-security-testing` — broader OWASP Top 10 workflow; use for injection,
+  auth, and access-control testing this skill does not cover.
+- `@dependency-management-deps-audit` — pairs well for supply-chain/component risk
+  once client exposure is triaged.

package/bundled-skills/client-secret-exposure-audit/references/example-report.md

@@ -0,0 +1,144 @@
+# Example Audit Report — Client-Side Secret & Sensitive-File Exposure
+
+**Target:** `https://demo-for-opensource.vercel.app/` (a public, intentionally
+vulnerable demonstration app — "Himalayan Vista Hotel")
+**Date:** 2026-09-10
+**Method:** Unauthenticated `GET` requests only (see `SKILL.md`)
+**Scope note:** This is a public demo whose own source states *"All secrets are
+fake demonstration values."* It is used here purely to illustrate the report
+format the skill produces. Values below are redacted to prefix + length.
+
+## Summary
+
+The site is a static/SPA deployment that ships a large amount of server-side
+source, config, and deployment material to the browser, with credentials
+scattered across **every layer** — HTML meta tags, hidden DOM elements, HTML
+comments, JavaScript bundles, and publicly reachable `server/`, `src/`, and
+container files. Additionally, response headers omit the standard security header
+set and use permissive CORS.
+
+| # | Severity | Finding | OWASP / CWE |
+|---|----------|---------|-------------|
+| 1 | Critical | Admin bearer token, JWT secret, DB password & DB URI shipped to the browser | A02 / CWE-798, CWE-522 |
+| 2 | Critical | Cloud + payment provider secrets exposed (AWS, Stripe/Khalti secret keys, webhook signing secret) | A02 / CWE-798, CWE-200 |
+| 3 | High | Server-side source, config & deploy files publicly reachable | A05 / CWE-540, CWE-527 |
+| 4 | High | reCAPTCHA **secret** key placed in an HTML `<meta>` tag | A02 / CWE-798 |
+| 5 | Medium | Missing security headers (CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy) | A05 / CWE-693 |
+| 6 | Medium | Permissive CORS (`Access-Control-Allow-Origin: *`) | A05 / CWE-942 |
+| 7 | Medium | Insecure randomness for booking references (`Math.random()`) | A02 / CWE-338 |
+| 8 | Low/Info | Third-party tokens & analytics IDs in client JS; verbose `console.log` of keys | A09 / CWE-532 |
+
+---
+
+## Findings
+
+### 1 — Critical: Admin token, JWT secret, DB password shipped to the browser
+
+- **Location:** `public/assets/js/config.js` (loaded on every page); mirrored in
+  `src/config/app.config.js`.
+- **Evidence (redacted):** `ADMIN_TOKEN = "eyJhbGciOiJ…" (JWT, role=operations)`,
+  `JWT_SECRET = "eyJhbGciOiJ…"`, `API_SECRET = "hvh_live_s3c37_…" (28 chars)`,
+  `DATABASE_PASSWORD = "Vista#…!" (16 chars)`, plus a hidden `<div>` JSON blob
+  containing `mongodb+srv://hvh-backend:****@cluster0.…/hvh_prod`.
+- **Impact:** Anyone can read an admin bearer token, the JWT signing secret
+  (allowing forged tokens for any role), the API secret, and DB credentials — full
+  data-tier compromise if these were live.
+- **Remediation:** Never place secrets in client bundles. Keep secrets server-side
+  in a secrets manager / env vars; expose only publishable keys to the browser.
+  **Rotate every value** — anything served is already compromised.
+
+### 2 — Critical: Cloud & payment provider secrets exposed
+
+- **Location:** HTML hidden `<div data-aws-access / data-aws-secret>` and
+  `data-webhook-secret`; `src/services/payment.service.js`; `docker-compose.yml`.
+- **Evidence (redacted):** `AKIA…EXAMPLE` + AWS secret; Stripe `sk_test_51Qf4…`;
+  Khalti `live_secret_key_…`; `whsec_a9f4…`; Redis `redis://…:7fK9…@cache:6379`.
+- **Impact:** Server-side payment secret keys and a webhook signing secret in the
+  client allow forging payment intents and spoofing signed webhook events; the
+  Redis password enables cache/session tampering — if live.
+- **Remediation:** Move all provider secret keys server-side; only `pk_*`
+  publishable keys belong in the browser. Rotate all exposed keys and secrets.
+
+### 3 — High: Server-side source, config & deploy files publicly reachable
+
+- **Location (confirmed real via size ≠ SPA fallback):** `/server/index.js`,
+  `/server/routes/{booking,payment,review,webhook}.routes.js`,
+  `/src/config/app.config.js`, `/src/services/{payment,booking}.service.js`,
+  `/docker-compose.yml`, `/Dockerfile`, `/public/assets/js/config.js`.
+- **Evidence:** Each returns a distinct body size from the SPA catch-all page and
+  contains real source/config (route definitions, internal service tokens such as
+  `hvh_svc_…`, container build details).
+- **Impact:** Exposes internal architecture, endpoints, auth/rate-limit middleware
+  names, and embedded credentials — a blueprint for further attack.
+- **Remediation:** Deploy only build output (`public/` + `index.html`). Exclude
+  `server/`, `src/`, and deploy files from the published artifact (`.vercelignore`
+  / correct build root). Serve 404 for non-asset paths instead of leaking files.
+
+### 4 — High: reCAPTCHA secret key in an HTML meta tag
+
+- **Location:** `<meta name="recaptcha-secret" content="6LcVo3kq…">` in `index.html`.
+- **Evidence:** The **secret** (server-verification) key is in page markup
+  alongside the site key.
+- **Impact:** The reCAPTCHA secret is server-only; exposing it lets attackers
+  script verification and undermines bot protection.
+- **Remediation:** Remove the secret from all client output; keep only the site
+  key client-side. Regenerate the reCAPTCHA keypair.
+
+### 5 — Medium: Missing security headers
+
+- **Location:** Main response headers for `/`.
+- **Evidence:** No `Content-Security-Policy`, `X-Frame-Options`/`frame-ancestors`,
+  `X-Content-Type-Options: nosniff`, `Referrer-Policy`, or `Permissions-Policy`.
+  (`Strict-Transport-Security` **is** present — good.)
+- **Impact:** Increased XSS, clickjacking, MIME-sniffing, and referrer-leak risk.
+- **Remediation:** Add a strict CSP, `X-Content-Type-Options: nosniff`,
+  `X-Frame-Options: DENY` (or CSP `frame-ancestors 'none'`), `Referrer-Policy:
+  strict-origin-when-cross-origin`, and a least-privilege `Permissions-Policy`
+  (e.g. via `vercel.json` headers).
+
+### 6 — Medium: Permissive CORS
+
+- **Location:** Response header `Access-Control-Allow-Origin: *`.
+- **Impact:** Any origin can read responses; dangerous if any endpoint returns
+  user/authenticated data.
+- **Remediation:** Restrict `Access-Control-Allow-Origin` to trusted origins;
+  never combine `*` with credentialed requests.
+
+### 7 — Medium: Insecure randomness for booking references
+
+- **Location:** `src/services/booking.service.js` — `randomRef()` uses
+  `Math.random()`; `fetchAvailabilityHold` builds predictable `HOLD-<room>-<date>`
+  ids.
+- **Impact:** Predictable/guessable references enable enumeration of bookings/holds.
+- **Remediation:** Use a CSPRNG (`crypto.randomUUID()` / `crypto.randomBytes`) for
+  any security-relevant identifier.
+
+### 8 — Low/Info: Third-party tokens & noisy logging
+
+- **Location:** `main.js` (Mixpanel/Hotjar/OpenWeather/Freshdesk/Zendesk tokens,
+  `console.log` of keys); `api/client.js` (`console.log` note, static
+  `X-Rate-Limit-Bypass` header value).
+- **Impact:** Some of these (weather/analytics) are lower-risk, but support-desk
+  tokens and a rate-limit-bypass header value are sensitive; logging keys to the
+  console aids attackers.
+- **Remediation:** Remove secret logging; move non-public tokens server-side;
+  never ship a "rate-limit-bypass" value to the client.
+
+---
+
+## Prioritized Remediation
+
+1. **Rotate immediately** (were they live): admin/JWT/API secrets, DB password &
+   URI, AWS keys, Stripe/Khalti secret keys, webhook & payment signing secrets,
+   Redis password, reCAPTCHA secret, internal service tokens.
+2. **Stop shipping server code:** publish only `public/` + `index.html`; exclude
+   `server/`, `src/`, and deploy files from the deployment artifact.
+3. **Remove all secrets from client output** (JS, HTML meta/`data-*`/comments);
+   keep only publishable keys in the browser.
+4. **Add the security-header set** and tighten CORS via `vercel.json`.
+5. **Replace `Math.random()`** with a CSPRNG for any security-relevant value.
+6. **Remove secret `console.log`** statements and client-side bypass headers.
+
+> Reminder: this target is a public teaching demo with intentionally fake
+> secrets. The same findings on a real deployment would be treated as an incident,
+> starting with credential rotation.