opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/report-writing/references/details.md

@@ -0,0 +1,187 @@
+# Details (moved from SKILL.md)
+
+> Extended reference content for `report-writing`, kept under `references/` so the entrypoint stays within the audit budget.
+
+## CVSS 4.0 QUICK REFERENCE (newer programs)
+
+CVSS 4.0 replaced CVSS 3.1 in November 2023. Some newer programs require it.
+
+### Key Differences from CVSS 3.1
+
+| Metric | CVSS 3.1 | CVSS 4.0 |
+|---|---|---|
+| Attack Vector | Network/Adjacent/Local/Physical | Same |
+| Attack Complexity | Low/High | Low/High |
+| **NEW**: Attack Requirements | (didn't exist) | None/Present (replaces some PR/UI) |
+| Privileges Required | None/Low/High | Same |
+| User Interaction | None/Required | None/Passive/Active |
+| Scope | Unchanged/Changed | REMOVED |
+| **NEW**: Sub-Impact metrics | (didn't exist) | Vulnerable/Subsequent system impact |
+
+### CVSS 4.0 Score Examples
+
+| Finding | CVSS 4.0 Score | Vector |
+|---|---|---|
+| Unauthenticated RCE | 10.0 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H |
+| IDOR read PII, auth required | 6.9 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N |
+| Stored XSS, admin views it | 8.2 | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N |
+| SSRF → cloud metadata | 8.7 | CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:N |
+
+### Quick CVSS 4.0 Calculator
+```
+Use: https://www.first.org/cvss/calculator/4.0
+Key fields:
+  VC/VI/VA = Vulnerable System Confidentiality/Integrity/Availability
+  SC/SI/SA = Subsequent System (downstream impact)
+  AT = None (no special condition) | Present (race/specific config needed)
+  UI = None | Passive (victim visits URL) | Active (victim takes explicit action)
+```
+
+**Practical rule**: If program uses CVSS 4.0 and you don't know the vector, use the calculator and include the full string starting with `CVSS:4.0/AV:...`. Programs cannot dispute a valid vector string.
+
+---
+
+
+## HUMAN TONE GUIDELINES
+
+**Write to a person, not a system:**
+- Triagers are tired. Get to the impact in sentence 1.
+- Use "I" not "the researcher" — you found it, own it
+- Short paragraphs, bullet points for steps
+- Hyperlink relevant docs if needed
+
+**Escalation language (when payout is being downgraded):**
+```
+"This vulnerability does not require any special privileges — only a free account."
+"The exposed data includes [PII type], which is subject to GDPR requirements."
+"An attacker can automate this with a simple loop — all [N] records in minutes."
+"This is exploitable externally without network access to any internal system."
+"The impact is equivalent to a full data breach of [feature/data type]."
+```
+
+**Avoid:**
+- Jargon the triager might not know
+- 5-paragraph explanations of what IDOR is (they know)
+- Theoretical chains ("could be combined with X to...")
+- Passive voice ("it was observed that...")
+- Qualifying language ("seems to," "appears to")
+
+---
+
+
+## STEPS TO REPRODUCE FORMAT (triager-optimized)
+
+```markdown
+**Setup:**
+- Account A (attacker): email=attacker@test.com, ID=111
+- Account B (victim): email=victim@test.com, ID=222
+- Both created via normal registration — no special access
+
+**Steps:**
+
+1. Log in as Account A
+2. Send this request (replace `111` with victim ID `222`):
+
+\```
+GET /api/v2/resource/222 HTTP/1.1
+Host: target.com
+Authorization: Bearer ACCOUNT_A_TOKEN
+\```
+
+3. Response contains Account B's private data:
+
+\```json
+{"id": 222, "email": "victim@test.com", "name": "Victim User", "address": "..."}
+\```
+
+**Expected:** 403 Forbidden
+**Actual:** 200 OK with victim's private data
+```
+
+---
+
+
+## Related Skills & Chains
+
+- **`triage-validation`** — When deciding whether to write a report at all. Workflow primitive: NEVER open this skill before `triage-validation`'s 7-Question Gate passes; a finding that fails the gate should be killed, not written up.
+- **`bugcrowd-reporting`** — When the target is a Bugcrowd program. Workflow primitive: this skill's body template is the foundation; `bugcrowd-reporting` overlays VRT selection, severity-request paragraph, OOS-clause rebuttals on top.
+- **`evidence-hygiene`** — When PoC screenshots / HARs are being attached to the report. Workflow primitive: every artifact referenced in the "Supporting Materials" / "Proof of Concept" section gets routed through `evidence-hygiene` for cookie + PII redaction before attachment.
+- **`redteam-report-template`** — When the engagement is an external red team (NOT bug bounty). Workflow primitive: confirm engagement mode via `bb-methodology` PART 0; if red-team, swap this skill out for `redteam-report-template` (different audience, different structure: Subject / Observations / Description / Impact / Recommendation / PoC).
+
+---
+
+
+## Operator Notes (Claude-BugHunter)
+
+> Engagement-derived additions to the vendored foundation. Wisdom from real
+> authorized engagements + Phase 2 verification across this repo's 31+
+> skill-area live tests. The upstream methodology covers the WHAT; this
+> layer covers the WHEN-IT-ACTUALLY-WORKS and the FAILURE-MODES.
+
+### Title formula in practice
+
+`<asset> | <bug class> | <impact>` — three components, no fluff. Triagers read titles in roughly three seconds and use them to order the queue.
+
+- BAD: "Interesting finding on /api/users"
+- BAD: "IDOR vulnerability in API"
+- GOOD: "Authenticated IDOR on /api/users/{uid} -> admin email + role disclosure"
+- GOOD: "Unauthenticated SSRF on /preview?url= -> AWS metadata 169.254.169.254 reachable"
+
+The bad titles get opened last. The good titles get opened first. Same finding, different queue position, different triage day, different payout speed.
+
+### What triagers actually read
+
+Their reading sequence on a fresh report:
+
+1. **Title** (3 seconds)
+2. **First paragraph of impact / summary** (15 seconds)
+3. **The curl command or HTTP request block** (30 seconds)
+4. **Reproduction steps** (only if the first three were convincing)
+5. **Everything else** (only on follow-up review)
+
+Optimize the top of the report ruthlessly. Save narrative for the middle. Triagers who are convinced by step 3 will rubber-stamp the rest; triagers who aren't convinced by step 3 won't read step 5.
+
+### CVSS 3.1 vs Bugcrowd VRT vs H1 default severity
+
+These three systems disagree about 30% of the time. The most common gap: a finding that scores CVSS 7.x (High) maps to Bugcrowd P4 (Low) or H1 Medium-default. When the platform default rates lower than CVSS:
+
+1. **File the severity-request paragraph as the first body section.** Bugcrowd respects this. (See `bugcrowd-reporting` for the canonical template.)
+2. **Anchor the request in CVSS vector string + business impact, not feelings.** "CVSS 3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N = 7.5 High because Confidentiality:High applies to cross-tenant data exposure."
+3. **Cite the platform's own VRT entry** that matches your finding. Don't argue against the platform; route within it.
+
+An authorized bug-bounty engagement saw P4-default findings escalated to P3 via the severity-request paragraph. The escalation isn't automatic — you have to ask, with grounded reasoning, in the first body section.
+
+### Evidence rotation
+
+Everything in the submission body is logged forever by the platform. Operate accordingly:
+
+- Use throwaway test accounts created specifically for the engagement.
+- Rotate cookies / tokens after each submission (don't reuse the cookie that's pasted in the report).
+- Never paste production cookies, real user emails, or real PII into the report body — redact in the PoC step.
+- Screenshots of admin panels: blur the user list, blur the URL bar if it contains tokens.
+
+Cross-link `evidence-hygiene` for the full capture-and-redact protocol.
+
+### Templates by platform — when they differ
+
+| Platform | Tone | Required Structure | Severity Mechanism |
+|---|---|---|---|
+| HackerOne | Narrative | Summary -> Steps -> Impact -> Suggested fix | Triager-set, contestable |
+| Bugcrowd | Structured | Severity request -> VRT category -> Title -> Body -> Remediation | VRT-default + manual override paragraph |
+| Intigriti | Between | Summary -> PoC -> Impact -> Recommendation | Researcher-proposed, triager-confirmed |
+| Immunefi | PoC-first | Working PoC code -> Walkthrough -> Impact -> Severity | Foundry/Hardhat code is the primary deliverable |
+
+Picking the wrong template style costs validity. A narrative-heavy Bugcrowd report misses the VRT mapping the triager needs; a structured H1 report reads as terse and gets follow-up questions that delay payout.
+
+### The single biggest report-writing mistake
+
+Claiming an attack works "in theory" or "could be chained to [bigger impact]" without demonstrating it. Triage-validation Q6 (impact beyond technically possible) kills these on the validation side; report-writing has to mirror it on the writing side.
+
+Two valid paths:
+
+1. **Show concrete impact end-to-end.** Capture the chain on a test account. Paste the full request/response sequence. Done.
+2. **Downgrade the severity claim to match what you actually demonstrated.** "IDOR on /api/users/{uid} reading email + role" is real and reportable; "IDOR chained to potential admin takeover" is not until you demonstrate the takeover.
+
+Pick one. Never split the difference with "could potentially" or "may allow" — those phrases are the triager's signal that the report is theoretical, and theoretical reports get N/A.
+- **`bb-methodology`** — When Phase 5's report-writing step starts. Workflow primitive: Phase 5 calls `/report` which loads this skill for the platform-specific template (H1 / Bugcrowd / Intigriti / Immunefi).
+

package/bundled-skills/reverse-proxy/SKILL.md

@@ -0,0 +1,420 @@
+---
+name: reverse-proxy
+description: Configure nginx and Traefik as reverse proxies. Implement SSL termination
+  and routing. Use when setting up application gateways.
+category: devops
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant OS/platform tooling and privileged access where
+  noted. Docs-only; helper scripts and templates not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# Reverse Proxy
+
+Configure reverse proxies to route traffic, terminate TLS, enforce rate limits, and serve as the gateway between clients and backend services.
+
+## When to Use
+
+- Routing traffic from a public domain to one or more backend services.
+- Terminating TLS at the edge and forwarding plain HTTP to backends.
+- Adding rate limiting, CORS, security headers, and access control.
+- Consolidating multiple services under a single domain with path-based routing.
+- Handling WebSocket upgrades, gRPC proxying, or HTTP/2 passthrough.
+
+## Prerequisites
+
+- Backend service(s) running on known host:port.
+- TLS certificate (Let's Encrypt, ACM, or self-signed for development).
+- nginx 1.25+ or Traefik 3.x installed.
+- DNS record pointing the domain to the proxy server.
+
+## nginx Reverse Proxy
+
+### Basic HTTPS Proxy with Redirect
+
+```nginx
+# /etc/nginx/sites-available/app.example.com
+server {
+    listen 80;
+    server_name app.example.com;
+    return 301 https://$host$request_uri;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name app.example.com;
+
+    # TLS configuration
+    ssl_certificate     /etc/letsencrypt/live/app.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;
+    ssl_protocols       TLSv1.2 TLSv1.3;
+    ssl_ciphers         ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384;
+    ssl_prefer_server_ciphers on;
+    ssl_session_cache   shared:SSL:10m;
+    ssl_session_timeout 10m;
+
+    # Security headers
+    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
+    add_header X-Frame-Options DENY always;
+    add_header X-Content-Type-Options nosniff always;
+    add_header Referrer-Policy strict-origin-when-cross-origin always;
+
+    # Proxy to backend
+    location / {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_http_version 1.1;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+
+        # Timeouts
+        proxy_connect_timeout 5s;
+        proxy_read_timeout 60s;
+        proxy_send_timeout 60s;
+
+        # Buffering
+        proxy_buffering on;
+        proxy_buffer_size 4k;
+        proxy_buffers 8 4k;
+    }
+}
+```
+
+### Path-Based Routing to Multiple Services
+
+```nginx
+server {
+    listen 443 ssl http2;
+    server_name app.example.com;
+
+    ssl_certificate     /etc/letsencrypt/live/app.example.com/fullchain.pem;
+    ssl_certificate_key /etc/letsencrypt/live/app.example.com/privkey.pem;
+
+    # Frontend SPA
+    location / {
+        proxy_pass http://127.0.0.1:3000;
+        proxy_set_header Host $host;
+    }
+
+    # API backend
+    location /api/ {
+        proxy_pass http://127.0.0.1:8080/;
+        proxy_set_header Host $host;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_read_timeout 120s;
+    }
+
+    # WebSocket endpoint
+    location /ws/ {
+        proxy_pass http://127.0.0.1:8080;
+        proxy_http_version 1.1;
+        proxy_set_header Upgrade $http_upgrade;
+        proxy_set_header Connection "upgrade";
+        proxy_set_header Host $host;
+        proxy_read_timeout 86400s;  # 24h for long-lived connections
+    }
+
+    # Static assets with caching
+    location /static/ {
+        alias /var/www/static/;
+        expires 30d;
+        add_header Cache-Control "public, immutable";
+    }
+}
+```
+
+### Rate Limiting
+
+```nginx
+# Define rate limit zones in http block
+http {
+    # 10 requests/second per IP
+    limit_req_zone $binary_remote_addr zone=api_limit:10m rate=10r/s;
+
+    # 1 request/second for login
+    limit_req_zone $binary_remote_addr zone=login_limit:10m rate=1r/s;
+
+    # Connection limit per IP
+    limit_conn_zone $binary_remote_addr zone=conn_limit:10m;
+}
+
+server {
+    listen 443 ssl http2;
+    server_name app.example.com;
+
+    # Apply rate limit to API
+    location /api/ {
+        limit_req zone=api_limit burst=20 nodelay;
+        limit_req_status 429;
+        proxy_pass http://127.0.0.1:8080;
+    }
+
+    # Strict rate limit on auth endpoints
+    location /api/auth/ {
+        limit_req zone=login_limit burst=5;
+        limit_req_status 429;
+        proxy_pass http://127.0.0.1:8080;
+    }
+
+    # Connection limit
+    location / {
+        limit_conn conn_limit 100;
+        proxy_pass http://127.0.0.1:3000;
+    }
+}
+```
+
+### Gzip and Brotli Compression
+
+```nginx
+http {
+    gzip on;
+    gzip_types text/plain text/css application/json application/javascript text/xml application/xml image/svg+xml;
+    gzip_min_length 256;
+    gzip_vary on;
+    gzip_proxied any;
+    gzip_comp_level 5;
+
+    # Brotli (requires ngx_brotli module)
+    # brotli on;
+    # brotli_types text/plain text/css application/json application/javascript text/xml application/xml image/svg+xml;
+    # brotli_comp_level 6;
+}
+```
+
+### Let's Encrypt with Certbot
+
+```bash
+# Install certbot with nginx plugin
+sudo apt install certbot python3-certbot-nginx
+
+# Obtain and install certificate
+sudo certbot --nginx -d app.example.com -d www.example.com
+
+# Auto-renewal is configured via systemd timer
+sudo systemctl status certbot.timer
+
+# Manual renewal test
+sudo certbot renew --dry-run
+```
+
+## Traefik Reverse Proxy
+
+### Static Configuration
+
+```yaml
+# traefik.yml
+entryPoints:
+  web:
+    address: ":80"
+    http:
+      redirections:
+        entryPoint:
+          to: websecure
+          scheme: https
+  websecure:
+    address: ":443"
+
+certificatesResolvers:
+  letsencrypt:
+    acme:
+      email: admin@example.com
+      storage: /letsencrypt/acme.json
+      httpChallenge:
+        entryPoint: web
+
+providers:
+  docker:
+    exposedByDefault: false
+  file:
+    directory: /etc/traefik/dynamic/
+
+api:
+  dashboard: true
+  insecure: false
+
+log:
+  level: INFO
+
+accessLog:
+  filePath: /var/log/traefik/access.log
+```
+
+### Dynamic Configuration (File Provider)
+
+```yaml
+# /etc/traefik/dynamic/services.yml
+http:
+  routers:
+    app:
+      rule: "Host(`app.example.com`)"
+      entryPoints:
+        - websecure
+      service: app
+      tls:
+        certResolver: letsencrypt
+      middlewares:
+        - security-headers
+        - rate-limit
+
+    api:
+      rule: "Host(`app.example.com`) && PathPrefix(`/api`)"
+      entryPoints:
+        - websecure
+      service: api
+      tls:
+        certResolver: letsencrypt
+
+  services:
+    app:
+      loadBalancer:
+        servers:
+          - url: "http://127.0.0.1:3000"
+        healthCheck:
+          path: /health
+          interval: 10s
+          timeout: 3s
+
+    api:
+      loadBalancer:
+        servers:
+          - url: "http://127.0.0.1:8080"
+        healthCheck:
+          path: /api/health
+          interval: 10s
+          timeout: 3s
+
+  middlewares:
+    security-headers:
+      headers:
+        stsSeconds: 63072000
+        stsIncludeSubdomains: true
+        frameDeny: true
+        contentTypeNosniff: true
+        browserXssFilter: true
+        referrerPolicy: strict-origin-when-cross-origin
+
+    rate-limit:
+      rateLimit:
+        average: 100
+        burst: 50
+        period: 1m
+```
+
+### Traefik with Docker Labels
+
+```yaml
+# docker-compose.yml
+version: "3.8"
+
+services:
+  traefik:
+    image: traefik:v3.0
+    ports:
+      - "80:80"
+      - "443:443"
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+      - ./traefik.yml:/etc/traefik/traefik.yml:ro
+      - letsencrypt:/letsencrypt
+
+  frontend:
+    image: my-frontend:latest
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.frontend.rule=Host(`app.example.com`)"
+      - "traefik.http.routers.frontend.tls.certresolver=letsencrypt"
+      - "traefik.http.services.frontend.loadbalancer.server.port=3000"
+
+  api:
+    image: my-api:latest
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.api.rule=Host(`app.example.com`) && PathPrefix(`/api`)"
+      - "traefik.http.routers.api.tls.certresolver=letsencrypt"
+      - "traefik.http.services.api.loadbalancer.server.port=8080"
+      - "traefik.http.routers.api.middlewares=api-ratelimit"
+      - "traefik.http.middlewares.api-ratelimit.ratelimit.average=50"
+      - "traefik.http.middlewares.api-ratelimit.ratelimit.burst=25"
+
+volumes:
+  letsencrypt:
+```
+
+## nginx Testing and Management
+
+```bash
+# Test configuration syntax
+sudo nginx -t
+
+# Reload without downtime
+sudo nginx -s reload
+
+# View active connections
+sudo nginx -s status
+
+# Check which config file is active
+nginx -V 2>&1 | grep -o '\-\-conf-path=[^ ]*'
+
+# Monitor access logs
+tail -f /var/log/nginx/access.log
+
+# Monitor error logs
+tail -f /var/log/nginx/error.log
+```
+
+## IP Allowlisting and Geoblocking
+
+```nginx
+# Allow only specific IPs (admin panel)
+location /admin/ {
+    allow 203.0.113.0/24;
+    allow 198.51.100.5;
+    deny all;
+    proxy_pass http://127.0.0.1:3000;
+}
+
+# Block by country (requires GeoIP2 module)
+# geoip2 /usr/share/GeoIP/GeoLite2-Country.mmdb {
+#     auto_reload 60m;
+#     $geoip2_data_country_iso_code country iso_code;
+# }
+# if ($geoip2_data_country_iso_code = "XX") {
+#     return 403;
+# }
+```
+
+## Troubleshooting
+
+| Symptom | Cause | Fix |
+|---------|-------|-----|
+| 502 Bad Gateway | Backend not running or unreachable | Verify backend is listening; check `proxy_pass` URL |
+| 504 Gateway Timeout | Backend too slow | Increase `proxy_read_timeout`; check backend performance |
+| Mixed content warnings | `X-Forwarded-Proto` not set | Add `proxy_set_header X-Forwarded-Proto $scheme` |
+| WebSocket disconnects after 60s | Default proxy timeout expires | Set `proxy_read_timeout 86400s` for WebSocket locations |
+| Rate limit hits legitimate users | Zone rate too aggressive | Increase `rate` or `burst` values; use different zones per endpoint |
+| Let's Encrypt renewal fails | Port 80 blocked or wrong server block | Ensure `.well-known/acme-challenge/` is accessible |
+| Traefik shows 404 for all routes | Docker labels not detected | Verify Docker socket is mounted; check `exposedByDefault` setting |
+| TLS handshake failure | Certificate chain incomplete | Include intermediate certificates in `ssl_certificate` |
+
+## Related Skills
+
+- load-balancing (`load-balancing`) - Multi-backend traffic distribution
+- cdn-setup (`cdn-setup`) - CDN in front of reverse proxy
+- dns-management (`dns-management`) - DNS records for proxy domains
+- service-mesh (`service-mesh`) - Service-level routing in Kubernetes
+
+## Limitations
+
+- Infrastructure commands can disrupt services: confirm target host/scope and have backups/snapshots before mutating state.
+- Docs-only import: upstream scripts and templates not bundled.
+