security-mcp 1.1.3 → 1.3.1

package/dist/repo/fs.js

@@ -1,4 +1,4 @@
-import { readFile } from "node:fs/promises";
+import { readFile, realpath } from "node:fs/promises";
 import path from "node:path";
 function getWorkspaceRoot() {
     return process.cwd();
@@ -16,5 +16,28 @@ export async function readFileSafe(relPath) {
     if (p !== root && !p.startsWith(rootPrefix)) {
         throw new Error("Path traversal blocked");
     }
+    // Resolve symlinks and verify the real path is also within the workspace.
+    // This prevents symlink traversal attacks where a symlink inside the workspace
+    // points to a file outside it. CWE-61 / CAPEC-132.
+    try {
+        const realResolved = await realpath(p);
+        const realRoot = await realpath(root);
+        const realRootPrefix = realRoot + path.sep;
+        if (realResolved !== realRoot && !realResolved.startsWith(realRootPrefix)) {
+            throw new Error(`Symlink traversal detected: ${relPath} -> ${realResolved}`);
+        }
+    }
+    catch (e) {
+        if (e.code === "ENOENT") {
+            throw new Error(`File not found: ${relPath}`);
+        }
+        if (e.message.includes("Symlink traversal"))
+            throw e;
+        // SECURITY: Any other realpath error (EACCES, ELOOP, etc.) means we could not
+        // verify the real path is within the workspace. Deny rather than fall through,
+        // because readFile() would follow symlinks using the unverified lexical path,
+        // enabling traversal to out-of-workspace targets. CWE-61 / CAPEC-132.
+        throw new Error(`Cannot verify path safety for ${relPath}: ${e.message}`);
+    }
     return await readFile(p, "utf8");
 }

package/dist/repo/search.js

@@ -2,10 +2,30 @@ import fg from "fast-glob";
 import { readFileSafe } from "./fs.js";
 // Maximum allowed regex pattern length. Longer patterns significantly raise
 // the risk of catastrophic backtracking (ReDoS). CWE-1333.
-const MAX_REGEX_LEN = 256;
-// Detects nested quantifiers — the most common ReDoS trigger — without being
-// overly complex itself. Matches patterns like (a+)+, (a*)*, (\w+)+.
-const NESTED_QUANTIFIER_RE = /\([^)]*[+*][^)]*\)[+*?{]/;
+const MAX_REGEX_LEN = 500;
+/**
+ * Detects regex patterns that risk catastrophic backtracking (ReDoS).
+ * Covers nested quantifiers, ambiguous alternation with outer quantifiers,
+ * counted repetition inside groups, and overlapping wildcard groups.
+ * CWE-1333 / MITRE ATT&CK T1499.
+ */
+function isCatastrophicRegex(pattern) {
+    // Original: nested quantifiers like (a+)+, (a*)*, (\w+)+
+    if (/\([^)]*[+*][^)]*\)[+*?{]/.test(pattern))
+        return true;
+    // Ambiguous alternation with outer quantifier: (a|aa)+ or (a|b)+
+    if (/\([^)]*\|[^)]*\)[+*]/.test(pattern))
+        return true;
+    // Counted repetition with nested group: (a{2,})+ or (a{1,3})+
+    if (/\([^)]*\{[^)]*\}[^)]*\)[+*]/.test(pattern))
+        return true;
+    // Overlapping alternatives: (.+)+ or (\w+)+
+    if (/\(\.[+*][^)]*\)[+*]/.test(pattern))
+        return true;
+    if (/\(\\[wWdDsS][+*][^)]*\)[+*]/.test(pattern))
+        return true;
+    return false;
+}
 /**
  * Validates and compiles a user-supplied regex string.
  * Throws if the pattern is dangerously long, contains known ReDoS signatures,
@@ -16,12 +36,16 @@ function compileUserRegex(pattern) {
     if (pattern.length > MAX_REGEX_LEN) {
         throw new Error(`Regex pattern too long (max ${MAX_REGEX_LEN} chars)`);
     }
-    if (NESTED_QUANTIFIER_RE.test(pattern)) {
+    if (isCatastrophicRegex(pattern)) {
         throw new Error("Regex pattern contains nested quantifiers that risk catastrophic backtracking (ReDoS)");
     }
     return new RegExp(pattern, "i"); // throws SyntaxError on invalid patterns
 }
 const MAX_PREVIEW_LEN = 240;
+const SECRET_REDACT_RE = /\b(?:AKIA[A-Z0-9]{16}|sk-[A-Za-z0-9]{32,}|ghp_[A-Za-z0-9]{36,}|xox[baprs]-[A-Za-z0-9-]{10,}|eyJ[A-Za-z0-9_-]{20,}(?:\.[A-Za-z0-9_-]{20,}){2})\b/g;
+function redactSecrets(s) {
+    return s.replace(SECRET_REDACT_RE, "[REDACTED]");
+}
 function isHit(line, query, re) {
     return re ? re.test(line) : line.includes(query);
 }
@@ -35,13 +59,14 @@ function scanLines(file, lines, opts, re, matches) {
         matches.push({
             file,
             line: i + 1,
-            preview: line.slice(0, MAX_PREVIEW_LEN)
+            preview: redactSecrets(line.slice(0, MAX_PREVIEW_LEN))
         });
     }
 }
 export async function searchRepo(opts) {
     const files = await fg(["**/*.*"], {
         dot: true,
+        followSymbolicLinks: false, // Prevent glob-based symlink traversal outside workspace root.
         ignore: [
             "**/node_modules/**",
             "**/.git/**",

package/dist/review/store.js

@@ -1,4 +1,4 @@
-import { createHash, createHmac, randomUUID } from "node:crypto";
+import { createHash, createHmac, randomUUID, timingSafeEqual } from "node:crypto";
 import { mkdir, readFile, writeFile } from "node:fs/promises";
 import path from "node:path";
 const REVIEW_DIR = path.join(".mcp", "reviews");
@@ -40,6 +40,7 @@ const SAFE_SURFACE_RE = /^[a-z][a-z0-9_-]{0,63}$/;
  * Initialize a checklist for a run from the surface template.
  */
 export async function initChecklist(runId, surface) {
+    assertRunId(runId); // CWE-22: validate UUID format before using as filename component
     if (!SAFE_SURFACE_RE.test(surface)) {
         throw new Error(`Invalid surface name "${surface}"`);
     }
@@ -74,6 +75,7 @@ export async function initChecklist(runId, surface) {
  * Mark a checklist item as completed.
  */
 export async function completeChecklistItem(runId, itemId, completedBy, evidence) {
+    assertRunId(runId); // CWE-22
     const state = await readChecklistRaw(runId);
     if (!state)
         throw new Error(`No checklist found for runId: ${runId}`);
@@ -93,6 +95,7 @@ export async function completeChecklistItem(runId, itemId, completedBy, evidence
  * Mark a checklist item as not applicable.
  */
 export async function markChecklistItemNA(runId, itemId, completedBy, reason) {
+    assertRunId(runId); // CWE-22
     const state = await readChecklistRaw(runId);
     if (!state)
         throw new Error(`No checklist found for runId: ${runId}`);
@@ -111,6 +114,7 @@ export async function markChecklistItemNA(runId, itemId, completedBy, reason) {
  * Mark a checklist item as failed.
  */
 export async function failChecklistItem(runId, itemId, completedBy, reason) {
+    assertRunId(runId); // CWE-22
     const state = await readChecklistRaw(runId);
     if (!state)
         throw new Error(`No checklist found for runId: ${runId}`);
@@ -129,6 +133,7 @@ export async function failChecklistItem(runId, itemId, completedBy, reason) {
  * Sign off on a checklist. Requires all non-NA critical items to be completed.
  */
 export async function signOffChecklist(runId, signedOffBy) {
+    assertRunId(runId); // CWE-22
     const state = await readChecklistRaw(runId);
     if (!state)
         throw new Error(`No checklist found for runId: ${runId}`);
@@ -147,6 +152,7 @@ export async function signOffChecklist(runId, signedOffBy) {
  * Read checklist state for a run.
  */
 export async function readChecklist(runId) {
+    assertRunId(runId); // CWE-22
     return readChecklistRaw(runId);
 }
 export async function createReviewRun(opts) {
@@ -202,7 +208,16 @@ export async function updateReviewStep(runId, step, status, details) {
     await writeJson(reviewPath(run.id), run);
     return run;
 }
+// HMAC-SHA256 requires a key of at least 32 bytes (256 bits) to provide full
+// security. Keys shorter than the hash output degrade HMAC to effectively a
+// keyed hash with reduced security margin (NIST SP 800-107 §5.3.4).
+const HMAC_MIN_KEY_BYTES = 32;
 export async function createReviewAttestation(runId, payload, signatureKey) {
+    if (signatureKey !== undefined && Buffer.byteLength(signatureKey, "utf-8") < HMAC_MIN_KEY_BYTES) {
+        throw new Error(`HMAC signature key is too short (${Buffer.byteLength(signatureKey, "utf-8")} bytes). ` +
+            `Provide a key of at least ${HMAC_MIN_KEY_BYTES} bytes (256 bits) — ` +
+            `generate one with: node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"`);
+    }
     const digestInput = JSON.stringify(payload);
     const sha256 = createHash("sha256").update(digestInput).digest("hex");
     const hmacSha256 = signatureKey
@@ -221,3 +236,39 @@ export async function createReviewAttestation(runId, payload, signatureKey) {
         hmacSha256
     };
 }
+/**
+ * Verify a stored attestation HMAC using a timing-safe comparison.
+ * Returns true only if the stored hmacSha256 matches the recomputed value.
+ * Uses timingSafeEqual to prevent timing oracle attacks on the comparison.
+ */
+export async function verifyAttestationHmac(runId, signatureKey) {
+    if (Buffer.byteLength(signatureKey, "utf-8") < HMAC_MIN_KEY_BYTES) {
+        return { valid: false, reason: "Signature key too short — cannot verify." };
+    }
+    let stored;
+    try {
+        const raw = await readFile(reportPath(runId), "utf-8");
+        stored = JSON.parse(raw);
+    }
+    catch {
+        return { valid: false, reason: "Attestation file not found or unreadable." };
+    }
+    const integrity = stored["integrity"];
+    const storedHmac = typeof integrity?.["hmacSha256"] === "string" ? integrity["hmacSha256"] : null;
+    if (!storedHmac) {
+        return { valid: false, reason: "Attestation was not signed — no hmacSha256 field." };
+    }
+    // Recompute HMAC over payload (everything except the integrity wrapper)
+    const { integrity: _stripped, ...payloadOnly } = stored;
+    const digestInput = JSON.stringify(payloadOnly);
+    const expected = createHmac("sha256", signatureKey).update(digestInput).digest("hex");
+    // Timing-safe comparison — prevents oracle attacks that leak the correct HMAC
+    // byte-by-byte via response timing differences (CWE-208).
+    const storedBuf = Buffer.from(storedHmac, "hex");
+    const expectedBuf = Buffer.from(expected, "hex");
+    if (storedBuf.length !== expectedBuf.length) {
+        return { valid: false, reason: "HMAC length mismatch." };
+    }
+    const match = timingSafeEqual(storedBuf, expectedBuf);
+    return match ? { valid: true } : { valid: false, reason: "HMAC mismatch — attestation may have been tampered." };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "security-mcp",
-  "version": "1.1.3",
+  "version": "1.3.1",
   "description": "AI security MCP server and enforcement gate for Claude Code, Cursor, GitHub Copilot, Codex, Replit, and any MCP-compatible editor. Applies OWASP, MITRE ATT&CK, NIST, Zero Trust, PCI DSS, SOC 2, and ISO 27001.",
   "type": "module",
   "license": "MIT",
@@ -61,24 +61,24 @@
     "test": "npm run build && node dist/tests/run.js"
   },
   "dependencies": {
-    "@modelcontextprotocol/sdk": "^1.27.1",
+    "@modelcontextprotocol/sdk": "^1.29.0",
     "execa": "^9.5.2",
     "fast-glob": "^3.3.3",
     "picomatch": "^4.0.4",
     "zod": "^3.24.1"
   },
   "overrides": {
-    "express-rate-limit": "^8.2.2",
-    "hono": "^4.12.7"
+    "express-rate-limit": "8.5.2",
+    "hono": "4.12.23"
   },
   "devDependencies": {
     "@eslint/js": "^9.22.0",
-    "@types/node": "^22.13.5",
-    "@types/picomatch": "^4.0.2",
+    "@types/node": "^24.12.4",
+    "@types/picomatch": "^4.0.3",
     "eslint": "^9.22.0",
     "globals": "^16.0.0",
     "typescript": "^5.7.3",
-    "typescript-eslint": "^8.26.0"
+    "typescript-eslint": "^8.60.0"
   },
   "engines": {
     "node": ">=20"

package/prompts/SECURITY_PROMPT.md

@@ -32,6 +32,79 @@ When you find a vulnerability, you do exactly this:
 
 ---
 
+## §0 COVERAGE COMPLETENESS PROTOCOL — THIS RUNS BEFORE EVERYTHING ELSE
+
+You cannot declare a codebase clean without proving you checked every file.
+You cannot close a finding without proving your fix eliminates it.
+
+### Step 1 — Complete File Inventory (NO EXCEPTIONS)
+
+Before any analysis begins:
+
+1. Run `repo.search` with `.*` pattern or use Glob to enumerate ALL source files.
+2. Write the complete file list to `.mcp/agent-runs/{runId}/coverage-manifest.json`:
+   `{ "totalFiles": N, "files": [{"path": "...", "status": "pending"}] }`
+3. You CANNOT start analysis until every source file appears in the manifest as "pending".
+4. As you review each file: update its status to "reviewed" with attack classes checked.
+5. You CANNOT call any completion step until every file is "reviewed".
+
+### Step 2 — Taint Tracking (MANDATORY FOR EVERY USER-CONTROLLED INPUT)
+
+For every source of untrusted data found in the codebase, trace ALL downstream paths:
+
+- `req.body`, `req.query`, `req.params`, `req.headers` (HTTP)
+- `event.data`, `socket.message` (WebSocket/event-driven)
+- `process.env[variable]` passed through to functions (env injection)
+- Database results that originated from user input
+- External API responses used in downstream processing
+- File contents read from user-uploaded files
+- URL fragments / hash passed via JavaScript
+
+Classify each sink as:
+
+- **SAFE**: parameterized query, schema-validated output, sanitized before use
+- **UNSAFE**: raw SQL concat, eval, shell exec, unvalidated redirect, unencoded output
+- **UNRESOLVED**: tracing blocked (e.g., function in a third-party module)
+
+Any UNRESOLVED path is treated as UNSAFE until proven otherwise.
+Write the taint map to `.mcp/agent-runs/{runId}/taint-map.json`.
+
+### Step 3 — Negative Assertion Protocol (MANDATORY PER ATTACK CLASS)
+
+After reviewing each attack class, you MUST write one of these statements:
+
+**FORMAT:** `ATTACK CLASS: {name} | FILES CHECKED: {n}/{total} | PATTERNS SEARCHED: {list} | RESULT: {CLEAN | N findings (N/N fixed)}`
+
+**Example (clean):** `ATTACK CLASS: SQL Injection | FILES CHECKED: 47/47 | PATTERNS SEARCHED: queryRaw, executeRaw, string concat in query context | RESULT: CLEAN`
+
+**Example (fixed):** `ATTACK CLASS: JWT Algorithm Confusion | FILES CHECKED: 47/47 | PATTERNS SEARCHED: jwt.verify without algorithms pin | RESULT: 2 findings (2/2 fixed)`
+
+You CANNOT report a class as CLEAN without examining every file in the manifest.
+
+### Step 4 — Fix Verification Loop (MANDATORY FOR EVERY FINDING)
+
+After writing a fix:
+
+1. Re-run the SAME pattern search or gate check that triggered the finding.
+2. Confirm the finding no longer fires.
+3. If the finding still fires: fix again. Do NOT proceed to the next finding.
+4. Write to the coverage manifest: `{ "finding": "ID", "fixedAt": "path:line", "verifiedClean": true }`
+
+You CANNOT mark a finding "resolved" without a verified-clean gate re-run.
+
+### Step 5 — All-or-Nothing Fix Mandate
+
+If a finding CANNOT be fixed in this session (architectural change required):
+
+- The gate check for that attack class MUST remain failing (do NOT suppress).
+- Write a detailed remediation plan to `.mcp/agent-runs/{runId}/deferred-fixes.json`.
+- Create a risk-acceptance record: `{ "finding": "ID", "owner": "...", "ticket": "...", "dueDate": "...", "compensatingControl": "..." }`
+- The merge gate MUST block on this finding until the ticket is closed.
+
+**No finding is ever "noted and moved on." It is either FIXED or BLOCKED.**
+
+---
+
 ## ROLE
 
 You are a **Senior Security Engineer**. Your operating ratio is **90% fixing, 10% advisory**.

package/skills/_TEMPLATE/SKILL.md

@@ -97,3 +97,102 @@ Every finding must include:
 - `requiredActions`: ordered list of actions if not auto-remediated
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true if this finding goes beyond the SKILL.md mandate
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+List 6-8 specific edge cases and emerging threats beyond the standard SKILL.md mandate. Pattern:
+- **[Topic]:** [Specific scenario with concrete test or detection method]
+- Each expansion must name a specific CVE, framework, attack technique, or research paper
+- Must include at least 2 post-quantum or AI-era threats
+
+- **Prototype Pollution via Merge Utilities (CVE-2019-10744 class):** Attacker-controlled JSON reaching `_.merge`, `Object.assign`, or `structuredClone` can poison `Object.prototype`. Test: send `{"__proto__":{"isAdmin":true}}` to every JSON ingestion endpoint; verify `{}.isAdmin` remains `undefined` after processing.
+- **HTTP Request Smuggling (CL.TE / TE.CL — CVE-2019-18277 class):** Reverse proxies and origin servers disagree on body length, allowing prefix injection into the next victim's request. Test with Burp HTTP Request Smuggler; look for mismatched `Transfer-Encoding` and `Content-Length` handling across load-balancer and app-server pairs.
+- **Server-Side Template Injection via User-Supplied Filenames (T1059.007):** Template engines (Jinja2, Pebble, Handlebars) resolve partials from user input. Inject `{{7*7}}` or `${7*7}` in filename fields; a `49` in the response confirms SSTI without alerting WAFs tuned for URL parameters.
+- **SAML Signature Wrapping (XSW — research: "Bursting the Bubble" 2012, still unpatched in many IdPs):** Duplicate the signed `Assertion` node; place a malicious unsigned assertion where the SP validates. Test by cloning the signed element, modifying `NameID`, and inserting both into the `Response` doc. Libraries using XPath position (not ID) are vulnerable.
+- **Post-Quantum Harvest-Now-Decrypt-Later (NIST IR 8413):** Adversaries archive TLS sessions today to decrypt once a cryptographically relevant quantum computer (CRQC) exists. Any RSA-2048/ECDH key exchange protects data only until ~2030. Detect by inventorying all TLS handshakes that do not negotiate a hybrid ML-KEM (X25519Kyber768) key exchange using `openssl s_client` captures.
+- **LLM-Powered Automated Exploit Generation (AI-era threat — "LLM Agents for Offensive Security", arXiv 2405.02929):** Attackers use fine-tuned LLMs to generate working PoC exploits from CVE descriptions in under 60 seconds. This means the window between patch release and weaponised exploit is collapsing toward hours. Detect exposure: check `npm audit` / `trivy` outputs for any CVE older than 48 hours that lacks a patch applied to the running container image.
+- **Subdomain Takeover via Dangling CNAME (T1584.001):** DNS CNAME records pointing to deprovisioned cloud resources (S3, Heroku, Azure Static Web Apps) can be claimed by an attacker. Enumerate all CNAME records in DNS; resolve each; flag any that return NXDOMAIN or provider-specific "not found" pages. Automate with `subjack` or `nuclei -t takeovers/`.
+- **OAuth 2.0 Authorization Code Injection via State Parameter Fixation (CVE-2022-24442 class):** If `state` is not bound to the user session before the redirect, an attacker can inject a valid `code` from their own flow into the victim's session. Test: complete an OAuth flow as attacker, capture the `code`, reset the victim session, replay the `code` in the victim's callback URL — authentication should fail if `state` is properly validated.
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "SQL Injection", "filesReviewed": 47, "patterns": ["queryRaw", "string concat"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["SQL Injection: queryRaw pattern searched across 47 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{
+  "findingId": "FINDING_ID",
+  "agentName": "AGENT_NAME",
+  "resolved": true,
+  "remediationTemplate": "one-line description of what was done",
+  "falsePositive": false
+}
+```
+Call `security.record_outcome` with this payload so the routing engine learns which agent resolves each finding class most successfully. If a finding is a false positive, set `falsePositive: true` — this prevents the false-positive pattern from being routed here again.
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```

package/skills/advanced-dos-tester/SKILL.md

@@ -223,3 +223,112 @@ export async function getOrCompute<T>(key: string, compute: () => Promise<T>): P
 - `requiredActions`: ordered action list
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true if finding goes beyond the SKILL.md mandate
+- `intelligenceForOtherAgents`: structured hints for downstream specialist agents (schema below)
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "Endpoint with no connection limit is trivially Slowlorisable", "exploitHint": "Open 1000 connections sending 1 byte/10s; monitor for 503s" }],
+    "forCloudSpecialist": [{ "type": "COST_AMPLIFICATION_CHAIN", "lambdaLocation": "src/handlers/process.ts", "escalationPath": "Unauthenticated POST triggers cold-start flood → unbounded concurrency → $k/min bill" }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["SOC2-A1.1", "PCI-DSS-Req6.4.1"], "releaseBlock": true }],
+    "forNetworkSpecialist": [{ "type": "AMPLIFICATION_VECTOR", "protocol": "QUIC/UDP", "description": "Server reflects 30× amplified responses to spoofed source IPs" }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+- **HTTP/2 Rapid Reset Mass Exploitation (CVE-2023-44487 / ATT&CK T1499.003):** The Cloudflare/AWS/Google coordinated disclosure confirmed single-client 390M rps via pipelined HEADERS+RST_STREAM frames, bypassing all traditional volumetric thresholds. Test by: run `h2load -n 5000000 -c 100 -m 1000 --rps=500000 <target>` and monitor nginx `reset_timedout_connection` counters; if `RST_STREAM` rate exceeds 1000/s per IP without session teardown, the server is vulnerable. Finding threshold: any HTTP/2 server lacking `http2_max_concurrent_streams ≤ 128` AND per-session RST rate enforcement is CRITICAL.
+
+- **AI-Assisted Adaptive Traffic Shape Evasion (ATT&CK T1499.002):** Threat actors (documented in Cloudflare 2024 DDoS Threat Report Q3) now deploy LLM-generated request sequences that mutate User-Agent, header order, TLS fingerprint (JA3), and inter-arrival timing every 30 seconds to evade ML-based rate limiters trained on static historical baselines. Test by: record a 5-minute baseline of normal traffic, then replay with `mitmproxy` + a GPT-4o script that randomises JA3/ALPN per request while maintaining target RPS; verify the WAF blocks it. Finding threshold: if the WAF's block rate drops below 80% within 2 minutes of mutation, the detection is insufficient.
+
+- **QUIC/UDP Amplification via Initial Packet Reflection (IETF RFC 9000 §8 / CVE-2024-45322):** QUIC servers that do not enforce address validation tokens reflect server Initial packets (~1200 bytes) in response to spoofed client Initials (~300 bytes), yielding a 4× amplification factor. Cloudflare disclosed active exploitation of misconfigured QUIC endpoints in 2024. Test by: use `quic-go`'s `quic-client` tool with a spoofed source IP on a controlled test network; measure outbound bytes vs. inbound bytes at the server; a ratio > 2× without token enforcement is a HIGH finding. Finding threshold: any QUIC listener without `quic.Config{RequireAddressValidation: func(net.Addr) bool { return true }}` or equivalent nginx `quic_gso on; quic_retry on` is flagged.
+
+- **Serverless Cold-Start Cost Amplification via Unauthenticated Fan-Out (ATT&CK T1496 — Resource Hijacking):** Breaches at Codecov (2021) and the Twilio supply chain incident demonstrated that a single unauthenticated POST to an event ingestion webhook can fan out to dozens of Lambda handlers simultaneously. With no reserved concurrency, $1 of attacker egress can generate $2 000+ in Lambda invocation costs within 60 seconds (documented in Datadog's 2024 State of Serverless report). Test by: identify all unauthenticated or weakly authenticated event endpoints (`POST /webhook`, `/events`, `/ingest`); send 500 concurrent requests and observe CloudWatch `ConcurrentExecutions` across downstream handlers. Finding threshold: any unauthenticated endpoint triggering > 3 downstream Lambda invocations per request, without reserved concurrency caps on all handlers, is CRITICAL.
+
+- **Post-Quantum TLS Handshake Size DoS (NIST FIPS 203/204 — Kyber/Dilithium transition):** Kyber-1024 public keys are 1568 bytes vs. 65 bytes for P-256; Dilithium3 signatures are 3293 bytes. A TLS 1.3 handshake with post-quantum hybrid key exchange (X25519Kyber768) inflates ClientHello to ~2 KB, requiring TCP fragmentation. Servers processing thousands of incomplete PQ handshakes simultaneously face 10–20× memory amplification compared to classical TLS — a vector Cloudflare Research documented in their PQ migration analysis (2024). Test by: configure `openssl s_client -curves X25519MLKEM768` against the target and flood with 10 000 concurrent half-open TLS handshakes (send ClientHello, then stall); monitor server TLS session table memory. Finding threshold: if server memory grows > 500 MB from 10 000 half-open PQ handshakes without a handshake timeout of ≤ 10 s, flag as HIGH.
+
+- **Supply Chain DoS via Malicious npm Dependency Introducing Unbounded Recursion (ATT&CK T1195.001):** The `event-stream` (2018) and `node-ipc` (2022) supply chain incidents demonstrated that widely-used packages can inject deliberate resource exhaustion. A dependency that introduces unbounded synchronous recursion or a `while(true)` on a hot path can cause 100% CPU saturation without any external traffic. Test by: run `npm audit --json | jq '[.vulnerabilities[] | select(.severity == "high" or .severity == "critical")]'` and cross-reference each HIGH/CRITICAL dependency against OSV.dev for DoS-class CVEs; additionally run `node --prof` during a load test and inspect the flamegraph for unexpectedly deep call stacks (> 500 frames) in third-party modules. Finding threshold: any production dependency with an open DoS-class CVE (CWE-400, CWE-674, CWE-835) that has a patched version available is CRITICAL; unpatched with no available fix is HIGH with mandatory vendor notification.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 DoS attack cases that automated scanners and naive manual review universally miss.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | HTTP/2 Rapid Reset with RST_STREAM pipelining | Scanners send sequential requests; rapid reset requires simultaneous HEADERS+RST_STREAM at volume | Use `h2load -n 1000000 -c 10 -m 200 --rps=100000 --header=":method: POST"` then monitor RST_STREAM counters; server should kill the session before 390M rps is reached |
+| 2 | Application-layer amplification via authenticated cache endpoint | Auth gates are assumed to prevent DoS; once past auth, a single request may populate cache with a 10 MB object served to 100k concurrent readers | Log in once, hit `GET /api/report/generate` with a large `?range=` parameter; measure egress multiplier vs. one request's compute cost |
+| 3 | Slow POST / R.U.D.Y. body trickle bypassing header timeouts | `client_header_timeout` fires on missing headers, NOT on a valid header with body sent at 1 byte/10s | Open connection, send valid headers + `Content-Length: 100000`, then drip body at 1 byte per 15 seconds; count threads consumed in 60 seconds |
+| 4 | WebSocket per-frame fragmentation flood | Rate limiters count messages, not frames; WS spec allows a single message split into thousands of frames | Send a single logical message as 50 000 continuation frames with `FIN=0`; verify server enforces a max-frames-per-message or max-message-size limit |
+| 5 | Cloud Function cold-start storm via unauthenticated event fan-out | Concurrency limits protect individual functions; fan-out triggers N distinct functions simultaneously | POST to an event ingestion endpoint that fans out to 20 Lambda downstream handlers, each without reserved concurrency; verify total concurrent invocations stay within budget |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that DoS defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to DoS Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| AI-assisted L7 DoS (LLM-generated adaptive traffic shapes) | 2025–2027 (active) | Attackers use LLMs to generate request patterns that evade rate-limit signatures tuned on historical traffic | Move from signature-based rate limits to behavioural anomaly baselines; per-endpoint p99 latency is a leading indicator |
+| HTTP/3 + QUIC amplification at scale | 2025–2026 | QUIC's UDP base enables spoofed-source amplification; server initial packets can be 3–8× larger than client hellos | Enable QUIC address validation tokens; set `max_udp_payload_size` conservatively; test with `quic-go` amplification tooling |
+| Serverless / edge cold-start as a cost weapon | 2025 (active) | Attacker spends $1 on egress; victim pays $500–$5 000 in Lambda/Cloudflare Worker cold-starts and invocations | Enforce reserved concurrency on every Lambda; set Cloudflare Workers CPU limits; configure spend alerts at 50%/80%/100% of monthly budget |
+| gRPC server streaming without deadline propagation | 2025–2026 | As gRPC adoption rises, deadline-less streams let attackers hold server goroutines/threads indefinitely | Audit every `grpc.ServerStream` handler for `ctx.Deadline()` enforcement; add integration test that cancels client after 5 s and asserts server stream terminates within 1 s |
+| Mandatory cloud spend controls (FinOps / CSP policy enforcement) | 2026 | Cloud providers will enforce organisation-level spend caps that can DoS the victim's own service if triggered by an attacker | Architect spend caps with auto-scaling floors to prevent self-inflicted outage; use AWS Cost Anomaly Detection + SNS, not hard cutoffs |
+
+---
+
+## §DETECTION-GAP
+
+What current monitoring CANNOT detect in the DoS domain, and what to build to close each gap.
+
+- **Slow-body / R.U.D.Y. attacks**: Standard connection count metrics are flat — attacker holds one connection per thread, which is "normal." Need: per-connection bytes-received-per-second histogram; alert when p50 drops below 100 bytes/s across more than 5% of active connections.
+- **HTTP/2 RST_STREAM abuse before session teardown**: Request-per-second dashboards never see the requests — they are opened and immediately reset. Need: instrument the `session.on("stream")` and `stream.on("close")` events separately; alert when `RST_without_response_rate > 20%` per IP.
+- **Cache stampede cascade**: Individual cache-miss latency looks like a normal spike. The signal is N identical cache misses at the exact same millisecond after a TTL expiry. Need: correlate cache-miss events by key in a 100 ms window; alert when the same key misses > 10 times simultaneously.
+- **Lambda cold-start cost amplification**: CloudWatch shows invocation count but not cost velocity. By the time the monthly budget alert fires, the damage is done. Need: real-time spend rate alarm (`EstimatedCharges` metric, 1-minute period, alert at 2× daily average) with an SNS-to-Lambda circuit breaker that drops reserved concurrency to 0 for compromised functions.
+- **Cross-protocol amplification (UDP reflection)**: TCP-based IDS/WAF is blind to UDP amplification sourced through the application's QUIC or DNS endpoints. Need: netflow analysis at the edge with a source-IP fan-out ratio alert (flag any IP receiving > 10× the bytes it sent in a 30-second window).
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any DoS attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+**Required coverage classes for advanced-dos-tester:**
+
+| Attack Class | Minimum Grep / Config Check |
+|---|---|
+| HTTP/2 Rapid Reset | `http2Settings`, `maxConcurrentStreams`, nginx `http2_max_concurrent_streams` |
+| Slowloris / Slow Headers | `keepalive_timeout`, `client_header_timeout`, `headersTimeout` |
+| Slow POST / R.U.D.Y. | `client_body_timeout`, `bodyTimeout`, `requestTimeout` |
+| WebSocket flood | `ws`, `socket.io` + per-connection rate limit present |
+| gRPC streaming DoS | `grpc.ServerStream`, `ctx.Deadline`, `grpc.MaxConcurrentStreams` |
+| Cache stampede | `redis.get`/`set` near expensive compute + mutex/lock present |
+| Lambda/Function cost amplification | `reserved_concurrent_executions`, `maxInstances`, budget alert resource |
+| QUIC/UDP amplification | QUIC config with address validation token enabled |
+| Cloud budget alerting | `aws_budgets_budget`, `google_billing_budget`, or equivalent IaC resource |
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [
+      { "class": "HTTP/2 Rapid Reset", "filesReviewed": 12, "patterns": ["maxConcurrentStreams", "http2_max_concurrent_streams"], "result": "CLEAN" },
+      { "class": "Lambda Cost Amplification", "filesReviewed": 8, "patterns": ["reserved_concurrent_executions", "aws_budgets_budget"], "result": "2 findings, both fixed" }
+    ],
+    "filesReviewed": 47,
+    "negativeAssertions": ["Slowloris: client_header_timeout present in all 3 Nginx configs — 0 gaps"],
+    "uncoveredReason": {}
+  }
+}
+```