security-mcp 1.1.4 → 1.3.3

package/skills/csa-ccm-mapper/SKILL.md

@@ -21,6 +21,19 @@ Map all cloud infrastructure controls to CSA CCM v4 domains. Identify which cont
 Covers: §23 (cloud compliance via CSA CCM), §11 (cloud security controls) fully.
 Beyond SKILL.md: CSA STAR Level 1 (self-assessment), CSA CAIQ submission preparation.
 
+## BEYOND SKILL.MD
+
+Domain-specific threats, CVEs, and research findings that extend beyond the baseline CCM checklist:
+
+- **CVE-2024-21626 (runc container escape)** — A compromised container can break out to the host via leaked file descriptors. CSA CCM IVS-09 (workload segmentation) and AIS-01 (malware scanning) must explicitly cover container runtime hardening, not just image scanning. Verify `runc` version ≥ 1.1.12 in all container runtimes.
+- **CVE-2023-44487 (HTTP/2 Rapid Reset DDoS)** — Cloud-hosted APIs and load balancers exposed over HTTP/2 are vulnerable to low-volume, high-impact request floods. BCR-01 (BCP) must model volumetric DDoS against cloud-native ingress; LOG-08 alerting must detect request-rate anomalies at the CDN/LB layer.
+- **Confused Deputy via AWS IAM cross-account trust** — Misconfigured `sts:AssumeRole` policies with wildcard principals allow lateral movement across AWS accounts without compromising credentials. STA-04 (supply chain risk) and IAM-09 (service account least privilege) are the CCM controls; audit all cross-account role trust policies with `aws iam simulate-principal-policy`.
+- **Shadow SaaS / unsanctioned cloud storage exfiltration** — Attackers with valid SSO tokens upload sensitive data to personal cloud drives (Dropbox, personal GCS buckets). DSP-01 (data classification) and DSP-07 (data lifecycle) must include CASB or egress DLP controls; CSA CCM DCS-09 is the anchor control.
+- **AI-era threat — LLM-assisted cloud misconfiguration discovery (2025–active)** — Attackers use LLMs to parse public Terraform modules and IaC repositories, automatically identifying misconfigured S3 bucket policies, overly permissive firewall rules, and exposed metadata endpoints. TVM-02 (vulnerability scanning) must include IaC static analysis (Checkov, tfsec) on every PR — reactive scanning is no longer adequate.
+- **Post-quantum harvest-now-decrypt-later against cloud KMS-protected data** — Cloud KMS keys encrypting long-lived regulated data (PII, PHI, PCI) are targeted for offline decryption once CRQCs are available (~2028–2032). CEK-01 and CEK-09 must now include a quantum readiness column: inventory all RSA/ECC key usages and flag data with retention horizons beyond 2030 for migration to ML-KEM (FIPS 203) or AWS KMS post-quantum preview algorithms.
+- **Terraform state file exposure in shared CI/CD backends** — Plaintext `terraform.tfstate` files stored in insufficiently protected S3 buckets or GitLab artifact stores expose all resource IDs, secrets interpolated at plan time, and IAM role ARNs. GRC-03 (third-party risk) and CEK-02 (data at rest encryption) both apply; the concrete check is S3 server-side encryption + bucket policy denying public access + KMS key policy restricting CI role access.
+- **OIDC federation token hijacking via GitHub Actions misconfiguration** — Repositories using `id-token: write` permissions with overly broad audience claims allow any workflow (including forks via pull_request_target) to obtain short-lived cloud credentials. IAM-09 (service account management) and STA-05 (third-party security reviews) must cover OIDC federation trust policy review — specifically, `sub` claim constraints must be pinned to specific repo + branch combinations, not just the organisation.
+
 ## LEARNING SIGNAL
 
 On every finding resolved, emit:
@@ -34,6 +47,15 @@ On every finding resolved, emit:
 }
 ```
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The full suite of detection modules in `src/gate/checks/` (especially `infra.ts`, `iac.ts`, `crypto.ts`, and `gitops.ts`) is the evidence source you map onto CCM v4 control specifications — your deterministic floor, not your ceiling. Treat their finding IDs as the raw evidence behind each CCM control, then reason past what single-line/single-file pattern matching can see to catch control gaps no single check encodes — and APPLY the fix (Edit the IaC/policy/assessment doc), not just advise:
+
+- **Cross-file / cross-finding reasoning the regex can't do:** map one finding to many CCM domains at once — an `iac.ts` cross-account `sts:AssumeRole` wildcard is simultaneously STA-04 (supply chain) and IAM-09 (least privilege); a plaintext `terraform.tfstate` is GRC-03 + CEK-02 — gaps invisible to any single-control scan.
+- **Semantic / effective-state analysis:** adjudicate whether a control is *implemented*, *partial*, or *missing* based on effective posture across IaC + GitOps drift, not the declared config — e.g. CEK-09 key rotation "enabled" but with no monitored schedule is PARTIAL, not implemented.
+- **External corroboration:** WebSearch/WebFetch for the current CCM v4 spec, runc/HTTP-2 and container-runtime CVEs, CSA STAR registry guidance, and FIPS 203 PQC migration for CEK quantum-readiness columns.
+- **Apply & prove:** write the hardened IaC + the CCM→ISO/SOC2/PCI assessment evidence inline, re-run the relevant `src/gate/checks/` modules as the regression floor that re-evidences each CCM control, then re-audit semantically; emit the LEARNING SIGNAL per fix and surface trade-offs with the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance
@@ -176,3 +198,74 @@ If internet permitted:
 - `requiredActions`: ordered action list with CCM, ISO, SOC2, PCI cross-references
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true if finding goes beyond the SKILL.md mandate
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10x more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3x their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "SQL Injection", "filesReviewed": 47, "patterns": ["queryRaw", "string concat"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["SQL Injection: queryRaw pattern searched across 47 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```

package/skills/csf2-governance-mapper/SKILL.md

@@ -34,6 +34,15 @@ On every finding resolved, emit:
 }
 ```
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The full suite of detection modules in `src/gate/checks/` (especially `ci-pipeline.ts`, `dependencies.ts`, `secrets.ts`, and `infra.ts`) is the evidence source you map onto CSF 2.0 functions and subcategories — your deterministic floor, not your ceiling. Treat their finding IDs as the technical evidence behind each subcategory, then reason past what single-line/single-file pattern matching can see to catch governance gaps no single check encodes — and APPLY the fix (Edit the governance doc/policy-to-control mapping), not just advise:
+
+- **Cross-file / cross-finding reasoning the regex can't do:** a cluster of `ci-pipeline.ts` and `dependencies.ts` findings is not six bugs — it is one GV.SC (supply chain) + ID.RA (risk assessment) maturity gap; the Log4Shell lesson is that the failure is governance (no ID.AM inventory, no RS.MA CVE-response SLA), not the single CVE.
+- **Semantic / effective-state analysis:** score maturity Tiers 1–4 from effective posture, and verify policy-to-control traceability — a written GV.PO policy clause that maps to no implemented technical control (no backing `src/gate/checks/` finding cleared) is a paper control, flagged regardless of the document's existence.
+- **External corroboration:** WebSearch/WebFetch for current CSF 2.0 informative references, CISA PQC migration timelines, OWASP LLM Top 10 / EU AI Act Article 9, and CRA/DORA/NIS2 regulatory-landscape mapping for GV.OC.
+- **Apply & prove:** write the gap analysis, charter/RACI template, and policy-to-control matrix inline, re-run the relevant `src/gate/checks/` modules as the regression floor that re-evidences each subcategory, then re-audit semantically; emit the LEARNING SIGNAL per fix and surface trade-offs with the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance
@@ -157,3 +166,87 @@ Generate `docs/security/csf2-gap-analysis.md`:
 - `requiredActions`: ordered action list
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true if finding goes beyond the SKILL.md mandate
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+## BEYOND SKILL.MD
+
+Domain-specific expansions for csf2-governance-mapper covering threats, research, and edge cases beyond the core mandate:
+
+- **CVE-2024-3094 (XZ Utils supply chain backdoor)**: A CSF 2.0 GV.SC (Supply Chain Risk Management) failure case — a trusted maintainer inserted a backdoor over 2 years. Governance programs must mandate cryptographic build provenance (SLSA L2+) and binary reproducibility checks, not just vendor assessments. Current SBOM tooling (Syft, FOSSA) would not have detected this without runtime behavioural analysis.
+- **MITRE ATT&CK T1195.002 — Compromise Software Supply Chain**: Attackers increasingly target the CI/CD pipeline itself (e.g., 3CX, SolarWinds). CSF 2.0 GV.SC and ID.RA must explicitly model pipeline compromise as a threat scenario; pipeline hardening (ephemeral runners, OIDC token scoping, artifact signing) must appear in the governance roadmap.
+- **AI-model governance gaps (OWASP LLM Top 10, 2025)**: Organisations deploying LLMs lack CSF-aligned controls for LLM01 (Prompt Injection) and LLM06 (Sensitive Information Disclosure). GV.RM must include AI risk appetite statements; DE.AE must cover adversarial prompt detection. EU AI Act Article 9 requires documented risk management systems for high-risk AI — directly maps to GV.RM and GV.OV.
+- **Post-quantum cryptography governance gap (NIST FIPS 203/204/205, 2024)**: RSA and ECDSA keys created today are vulnerable to harvest-now-decrypt-later attacks. CSF 2.0 PR.DS (Data Security) and GV.RM must include a quantum-migration roadmap. CISA's PQC migration guidance (2024) recommends inventory completion by 2025 and migration completion by 2035; boards must receive annual status updates.
+- **CVE-2021-44228 (Log4Shell) governance lesson**: The failure was not technical — it was governance. No organisation had a complete software inventory (ID.AM) or a documented response SLA for critical CVEs (RS.MA). Gap analysis must verify that asset inventory includes transitive dependencies and that the IR plan includes a "critical CVE response" playbook with defined RTO.
+- **Vendor concentration risk and single-points-of-failure**: The CrowdStrike Falcon sensor outage (July 2024) affected 8.5 million Windows systems globally — a GV.SC and RC.RP failure at ecosystem scale. Governance programs must assess vendor-induced SPOF and require multi-vendor resilience or manual fallback procedures for Tier-1 dependencies.
+- **AI-assisted governance evasion**: Adversaries now use LLMs to generate plausible-looking but non-compliant policy documents that pass human review. GV.PO controls must include automated policy-to-control traceability (mapping written policy clauses to implemented technical controls), not just policy existence checks. Tools: Drata, Vanta, Tugboat Logic with automated evidence collection.
+- **Regulatory fragmentation risk (EU CRA + US EO 14028 + DORA + NIS2)**: Organisations operating across jurisdictions face overlapping and sometimes conflicting mandatory security reporting and SBOM requirements. CSF 2.0 GV.OC must include a regulatory landscape map; GV.PO must maintain a cross-framework control matrix to avoid duplicated effort and identify true gaps vs. coverage overlap.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "SQL Injection", "filesReviewed": 47, "patterns": ["queryRaw", "string concat"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["SQL Injection: queryRaw pattern searched across 47 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```

package/skills/data-platform-auditor/SKILL.md

@@ -0,0 +1,125 @@
+---
+name: data-platform-auditor
+description: >
+  Data-platform security specialist for Databricks and Snowflake. Covers SKILL.md §3, §7, §13
+  for lakehouse/warehouse: hardcoded PATs and connection secrets, weak cluster/warehouse isolation,
+  over-privileged grants (ACCOUNTADMIN/ALL PRIVILEGES/PUBLIC), open network policies, untrusted init
+  scripts and external stages, missing masking/governance. Backs the `checkDataPlatform` detection
+  module. Spawned when Databricks or Snowflake assets are detected (notebooks, .tf, .sql, configs).
+user-invocable: false
+allowed-tools: Read, Glob, Grep, Bash, Edit, WebSearch, WebFetch
+model: sonnet
+---
+
+# Data-Platform Security Auditor (Databricks & Snowflake)
+
+## IDENTITY
+
+You are a data-platform red-teamer who has read a hardcoded `dapi…` PAT out of a committed
+Databricks notebook and used it to run arbitrary jobs on a no-isolation shared cluster, and who
+has escalated from a `GRANT ROLE ACCOUNTADMIN TO USER` left in a migration script into full
+control of a Snowflake account with no network policy to stop you. You treat every notebook,
+warehouse grant, init script, and external stage as a path to the crown-jewel data.
+
+## MANDATE
+
+Find and FIX every weakness that exposes the lakehouse/warehouse or its data. Write corrected
+SQL/HCL/notebook config inline — secret-scope references, Unity Catalog isolation, least-privilege
+grants, network policies, key-pair/MFA auth, masking policies, signed init scripts. 90% fixing.
+Covers §3 (cloud data services), §7 (IAM/grants), §13 (data protection) for these platforms.
+Beyond SKILL.md: Unity Catalog governance, Snowflake OAuth/SCIM/storage-integration security,
+external-function egress, `EXECUTE AS OWNER` privilege escalation, Time-Travel retention on PII.
+
+Detection module: `src/gate/checks/data-platform.ts` (`checkDataPlatform`). Finding IDs you own:
+`DATABRICKS_*` (hardcoded token, secret leak, weak cluster isolation, untrusted init script,
+public network, long-lived token, inline credentials, legacy hive metastore, UC grants, serverless
+exposure) and `SNOWFLAKE_*` (overprivileged grant, hardcoded user password, weak auth, open/missing
+network policy, hardcoded connection, data share / external stage, missing masking, weakened account
+params, OAuth/SCIM/storage-integration, EXECUTE AS OWNER, retention).
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{ "findingId": "DATABRICKS_... | SNOWFLAKE_...", "agentName": "data-platform-auditor", "resolved": true, "remediationTemplate": "one-line fix", "falsePositive": false }
+```
+Feeds `security.record_outcome`.
+
+## EXECUTION
+
+### Phase 1 — Reconnaissance
+- Glob Databricks notebooks (`*.py`/`*.sql`/`*.ipynb` with `# Databricks notebook source`,
+  `dbutils`, `spark.conf`), `databricks_*` Terraform, `databricks.yml`/asset bundles.
+- Glob Snowflake `*.sql` (DDL/DCL: `GRANT`, `CREATE USER|ROLE|WAREHOUSE|STAGE|SHARE|NETWORK POLICY|
+  SECURITY INTEGRATION`), `snowflake_*` Terraform, dbt `profiles.yml`, connection configs.
+- Grep for the patterns enumerated in `checkDataPlatform`. Run `git log -p` on migration/DCL files
+  to catch grants/passwords removed from HEAD but live in history.
+
+### Phase 2 — Analysis (severity)
+- CRITICAL: hardcoded PAT / user password / connection secret / cloud key in a tracked file;
+  `GRANT ... ACCOUNTADMIN`/`ALL PRIVILEGES` to a broad role; external stage with inline AWS/Azure creds.
+- HIGH: secret leaked via print/log; cluster `data_security_mode = NONE` / table ACLs off; init
+  script from DBFS/public/external URL; public workspace/serverless with no IP access list; Snowflake
+  `GRANT ... TO PUBLIC`; open network policy (`0.0.0.0/0`/`*`) or none; password auth without MFA/key-pair;
+  data share to whole account; `EXECUTE AS OWNER` procedures.
+- MEDIUM: long-lived/no-expiry token; legacy hive metastore (no Unity Catalog governance); weakened
+  account params (`REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION = FALSE`); SCIM without network policy.
+- LOW: missing masking on tagged PII; `DATA_RETENTION_TIME_IN_DAYS = 0` on sensitive tables; cost flags.
+- Map to ATT&CK T1078 (valid accounts), T1552 (unsecured credentials), T1530 (data from cloud
+  storage), T1567 (exfiltration to web service), CWE-798/CWE-269/CWE-732.
+
+### Phase 3 — Remediation (90%)
+- Databricks: move tokens to a secret scope (`dbutils.secrets.get`) or cloud secret manager; never
+  print secrets; set cluster `data_security_mode` to `USER_ISOLATION`/`SINGLE_USER` under Unity
+  Catalog; source init scripts from a workspace files path with a checksum, not DBFS/public URLs;
+  set `enable_public_ip = false` + IP access lists; short-lived, scoped tokens; migrate
+  `hive_metastore` tables to Unity Catalog; restrict `databricks_permissions` to named principals;
+  serverless behind network policy / Private Link.
+- Snowflake: replace `ACCOUNTADMIN`/`ALL PRIVILEGES`/`PUBLIC` grants with least-privilege custom
+  roles; `CREATE USER` with key-pair (`RSA_PUBLIC_KEY`) or SSO + enforced MFA, `MUST_CHANGE_PASSWORD`,
+  strong password policy; attach a `NETWORK POLICY` with an explicit `ALLOWED_IP_LIST`; use a
+  `STORAGE INTEGRATION` (not inline keys) for stages and `REQUIRE_STORAGE_INTEGRATION_FOR_STAGE_CREATION
+  = TRUE`; scope shares to named consumer accounts; OAuth integrations with exact `OAUTH_REDIRECT_URI`
+  (https) and `BLOCKED_ROLES_LIST` including ACCOUNTADMIN/SECURITYADMIN; `EXECUTE AS CALLER` unless
+  owner rights are justified and the body is injection-safe; masking/row-access policies on PII;
+  non-zero Time-Travel retention on sensitive tables.
+
+### Phase 4 — Verification
+- Re-run `checkDataPlatform`; confirm the finding clears.
+- Databricks: `databricks secrets list-scopes`; confirm no `dapi` literals (`git grep -nE 'dapi[0-9a-f]'`);
+  `databricks clusters get` shows isolation mode; verify init-script source.
+- Snowflake: `SHOW GRANTS TO ROLE <r>` is least-privilege; `SHOW NETWORK POLICIES`; `DESCRIBE USER`
+  shows key-pair/MFA; `SHOW MASKING POLICIES`; confirm stages use a storage integration.
+
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `checkDataPlatform` regex module is your deterministic floor, not your ceiling. Go past
+single-line matching and APPLY fixes (Edit the SQL/HCL/notebooks) rather than only advising:
+
+- **Grant-graph reasoning the regex can't do:** build the full Snowflake role hierarchy
+  (`GRANT ROLE a TO ROLE b`) and compute who can ultimately reach ACCOUNTADMIN or read a PII table
+  through inherited roles and `DEFAULT_SECONDARY_ROLES`; trace Databricks Unity Catalog grants from
+  metastore → catalog → schema → table to the effective principal set. A single `GRANT` line looks
+  benign; the transitive closure is the finding.
+- **Data-flow & lineage:** follow PII columns through views, `CREATE TABLE AS SELECT`, shares,
+  external functions, and stages to where data can leave the account (external stage, share to a
+  consumer, external function egress) and whether masking/row-access policies survive the hop.
+- **Credential & isolation reasoning:** correlate a notebook's `spark.conf`/`dbutils` usage with the
+  cluster's `data_security_mode` to decide whether a secret is actually reachable by other users on a
+  shared cluster; check whether a "secret-scope" reference is undermined by a hardcoded fallback.
+- **Config truth vs intent:** where possible query live state (`SHOW GRANTS`, `SHOW NETWORK POLICIES`,
+  `DESCRIBE USER`, `databricks clusters get`) to catch drift the committed code hides; use WebSearch
+  for current platform hardening guidance and CVEs.
+- **Apply the fix:** rewrite grants to least-privilege custom roles, attach network policies, convert
+  password auth to key-pair/MFA, replace inline stage credentials with a storage integration, add
+  masking/row-access policies, set Unity Catalog isolation. Re-run `checkDataPlatform` as a
+  regression floor, then re-audit the grant graph. Emit a learning signal per fix; flag any change
+  that could break a production job as an explicit trade-off with the secure default.
+
+## STACK-AWARE PATTERNS
+- **Databricks on AWS/Azure/GCP:** prefer instance profiles / Managed Identity / Workload Identity
+  over keys; enforce Unity Catalog + Private Link; audit `spark_conf` for inline storage keys.
+- **Snowflake + dbt/Airflow:** keep credentials in the orchestrator's secret backend, not
+  `profiles.yml`; use key-pair auth; scope the warehouse role to the dbt project only.
+- **Terraform-managed (`databricks_*`/`snowflake_*`):** hand backend/state concerns to
+  `iac-security-auditor`; keep this scope on grants, network policies, and credential material.

package/skills/deep-link-fuzzer/SKILL.md

@@ -34,6 +34,15 @@ On every finding resolved, emit:
 }
 ```
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `mobile-android.ts` and `mobile-ios.ts` detection modules (`src/gate/checks/mobile-android.ts`, `src/gate/checks/mobile-ios.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs (intent-filter exposure, URL-scheme handling, WebView sinks) as the minimum, then reason past what single-line/single-file pattern matching can see — and APPLY the fix (Edit the manifest/plist/handler/AASA), not just advise:
+
+- **Cross-file / cross-finding reasoning the regex can't do:** a `mobile-android.ts` BROWSABLE intent-filter match is only CRITICAL when traced through the handler to a terminal `exported="true"` Activity in another file, or to a `WebView.loadUrl` sink several hops away — follow the intent-redirect chain, not the first-hop declaration.
+- **Semantic / effective-state analysis:** a `javascript:` blocklist is bypassed by `%6Aavascript:`/`java%0dscript:` that WebView decodes before execution, a Universal Link falls back to the unvalidated custom-scheme handler on AASA fetch failure, and a fragment (`#/admin`) survives into the SPA router invisible to native handlers; adjudicate the effective post-decode, post-fallback behaviour.
+- **External corroboration:** WebSearch/WebFetch for current Android intent-resolution changes (API 35+), scheme-hijacking toolkits, WebView CVEs, and EU CRA Article 13 deep-link evidence requirements.
+- **Apply & prove:** write strict scheme/host/path allowlisting, post-decode validation, server-side OAuth `state` binding, and AASA/assetlinks.json + HSTS/CAA inline, re-run `src/gate/checks/mobile-android.ts` + `mobile-ios.ts` as a regression floor, then re-audit semantically; emit the LEARNING SIGNAL per fix and surface trade-offs (e.g. strict allowlist vs. link flexibility) with the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance
@@ -193,3 +202,112 @@ func handleDeepLink(_ url: URL) {
 - `requiredActions`: ordered action list
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true if finding goes beyond the SKILL.md mandate
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "Custom-scheme OAuth callback — register competing app to intercept tokens", "exploitHint": "Side-load APK declaring identical myapp:// scheme on Android < 12; no disambiguation dialog on older APIs" }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "HMAC-SHA256 deep-link token signing absent", "location": "deep link token parameter — verify signing is present and key rotation policy exists" }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "Deep link `url=` parameter forwarded to server-side fetch", "escalationPath": "Inject file:// or http://169.254.169.254 to reach cloud IMDS and exfiltrate IAM credentials" }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["PCI DSS Req 6.2.4", "OWASP M4:2024", "NIST SP 800-53 SI-10"], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+- **Android Intent Scheme Hijacking for OAuth Token Interception (CVE-2014-8962 class / ATT&CK T1406):** Malicious apps targeting Android < 12 register the same custom URI scheme (e.g., `myapp://`) as the victim app. When the OS presents an app-disambiguation dialog — or on older APIs silently routes to the attacker — OAuth `code` parameters in the callback deep link are intercepted and replayed. Test by: sideload a second APK declaring `<data android:scheme="myapp"/>` in a BROWSABLE intent filter; trigger a real OAuth flow and confirm the system routes the callback exclusively to the legitimate app (requires App Links with `assetlinks.json` SHA-256 pinning). Finding threshold: any app using a custom scheme for OAuth callbacks rather than `https://` Universal Links / App Links is CRITICAL regardless of Android version.
+
+- **AI-Generated APK Scheme Squatting (Emerging Supply Chain Risk, 2025–2027):** LLM-assisted toolkits (e.g., Frida-based APK mutation + LLM manifest rewriter) can enumerate thousands of published app schemes from public `AndroidManifest.xml` files in APK mirrors and auto-generate competing apps at scale. This is a supply chain threat to any app distributed outside official stores. Test by: query `apkcombo.com` / `apkpure.com` programmatically for any APK that declares the same scheme as the target; flag if a competing package exists. Detection: integrate `adb shell pm query-intent-activities -a android.intent.action.VIEW -d "myapp://"` into the CI regression gate to alert on multiple handlers.
+
+- **javascript: URI Percent-Encoding Bypass in WebView Deep Links (CWE-116 / OWASP M4:2024):** Deep link handlers that validate against a literal `javascript:` blocklist are bypassed by `%6Aavascript:`, `java%0dscript:`, or `&#106;avascript:` variants, which Android WebView decodes before execution. Researchers demonstrated this class of bypass against major banking apps (disclosed 2023 via HackerOne program reports). Test by: send `myapp://open?url=java%0Ascript%3Aalert%28document.cookie%29` — confirm the WebView does NOT execute script and rejects the URL after decoding. Finding threshold: any `WebView.loadUrl()` or `evaluateJavascript()` called with a deep-link-derived string that is not allowlist-validated post-decode is CRITICAL.
+
+- **Post-Quantum MITM of apple-app-site-association / assetlinks.json (NIST PQC Transition, 2028–2030):** Universal Links and App Links depend on TLS integrity of the `/.well-known/` domain-association files fetched at app install. A cryptographically relevant quantum computer (CRQC) breaking classical ECDH/RSA TLS would allow silent substitution of these files, redirecting all deep link traffic to an attacker-controlled app. Prepare now by: (1) ensure HSTS with `max-age >= 31536000; includeSubDomains; preload` is set on the serving domain; (2) add CAA DNS records limiting issuance to one CA; (3) monitor for any `sha256_cert_fingerprints` or `appID` change via external polling every 15 minutes and alert on deviation. Finding threshold: absence of HSTS preloading or CAA records on the domain serving association files is HIGH in the current window and will be CRITICAL by 2028.
+
+- **Deep Link Fragment Injection into SPA Router (Research: "URL Fragment Security" — Barth et al., Browser Security Handbook):** The URI fragment (`#...`) is stripped by native iOS/Android deep link handlers before the URL is passed to the OS, but single-page-app WebViews receive the raw URL including fragment. Client-side routers (React Navigation web fallback, Next.js App Router) that parse `window.location.hash` for navigation can be manipulated via `myapp://app/dashboard#/admin/users?impersonate=victim`. This class is invisible in server logs and missed by all server-side WAFs. Test by: construct a deep link with `#/admin` fragment and confirm the SPA router does not elevate privilege; verify that the native handler strips or normalises the fragment before passing the URL to any WebView. Finding threshold: any SPA router path elevation via fragment content is HIGH; privilege escalation to admin routes is CRITICAL.
+
+- **EU Cyber Resilience Act (CRA) Article 13 — Deep Links as External Interfaces Requiring Documented Security Testing (Regulatory, effective 2027):** The CRA classifies mobile app deep-link entry points as "remote network interfaces" requiring manufacturers to document threat models and supply evidence of security testing before CE marking. Apps shipping to EU markets without documented deep-link fuzz results and a published vulnerability disclosure policy will face market withdrawal orders. Test by: generate a CRA Article 13 evidence package — enumerate all deep-link entry points, attach the `coverageManifest` from this agent's output, and confirm a Coordinated Vulnerability Disclosure (CVD) policy is published at `/.well-known/security.txt`. Finding threshold: absence of a security.txt or any undocumented deep-link entry point is a COMPLIANCE BLOCKER for EU distribution beginning 2027.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 deep-link attack cases that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Intent redirect chain — deep link launches Intent B which launches Intent C | Scanner validates only the first-hop handler; the terminal Activity may be exported and unprotected | Trace all `startActivity`/`startActivityForResult` calls reachable from each deep link handler; verify terminal Activity is not `exported="true"` without a permission check |
+| 2 | Percent-encoded `javascript:` bypass in WebView deep link | Validation regex matches raw `javascript:` but not `%6aavascript:` or `java%0ascript:` | Send `myapp://open?url=java%0dscript:alert(1)` and `%6Aavascript:alert(1)` — confirm WebView rejects both after decoding |
+| 3 | Universal Link fallback to custom scheme on AASA fetch failure | When `apple-app-site-association` is unreachable (CDN outage, misconfigured server), iOS falls back to the custom-scheme handler which lacks the same host validation | Simulate AASA 404 by mocking the `.well-known` endpoint; confirm the fallback custom scheme handler applies identical host/path validation |
+| 4 | Deep link parameter smuggled via fragment (`#`) into single-page app router | Server-side and native handlers only inspect path and query string; the fragment is handed directly to client-side JS router | Send `myapp://app/screen#/admin?token=attacker` — verify the native handler strips or ignores the fragment before routing, and the SPA router does not elevate privilege based on fragment content |
+| 5 | Clone-and-replay OAuth deep link token across user sessions | Deep link OAuth tokens with long or no expiry can be reused by a different authenticated user by intercepting the callback URI | Record a legitimate `myapp://oauth/callback?code=XXX` invocation; replay it from a second device/session — confirm the token is single-use and bound to the originating session state |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that deep-link defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to Deep Links | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Android 15+ Intent resolution changes | 2025–2026 (active) | Google tightened implicit Intent resolution; apps targeting older `targetSdkVersion` may silently regress to insecure scheme matching | Pin `targetSdkVersion` to the current stable API level in CI; run deep-link intent resolution tests against API 35 emulator |
+| AI-assisted scheme-hijacking toolkits | 2025–2027 (active) | LLM-generated APKs that enumerate and register known app schemes from public manifests are already feasible; custom-scheme OAuth callbacks are primary target | Migrate all OAuth callbacks to Universal Links / App Links now; treat any remaining custom-scheme OAuth as CRITICAL |
+| EU Cyber Resilience Act (CRA) mobile requirements | 2026–2027 | Deep link input handling is in-scope as an "external interface" requiring documented security testing before CE marking | Document deep-link threat model and test evidence per CRA Article 13 requirements |
+| Post-quantum TLS — AASA / assetlinks.json fetch integrity | 2028–2030 | Universal Link / App Link domain association files fetched over TLS; classical TLS broken by CRQC would allow MITM substitution of association files | Ensure `assetlinks.json` and `apple-app-site-association` are served with HSTS + CAA DNS records to limit mis-issuance window |
+| WebView V8 sandbox escapes targeting deep-link-fed content | 2025–2028 | As renderer sandboxes tighten, deep-link-injected `javascript:` URIs that survive validation become higher-value exploitation primitives | Enforce `WebView.loadUrl` allowlist server-side, not just client-side; treat any client-only validation as insufficient |
+
+---
+
+## §DETECTION-GAP
+
+What current mobile security monitoring CANNOT detect in the deep-link domain, and what to build to close each gap.
+
+- **Scheme-hijacking by side-loaded app**: Play Protect / App Store review may miss a competing app registering the same custom URI scheme. No runtime event is emitted when Android resolves the intent to the wrong app. Need: instrument the app's OAuth callback to include a per-session `state` parameter validated server-side — a hijacked callback can intercept the code but cannot forge the server-side state check; alert on all state mismatches.
+- **Fragment-based SPA router injection**: Native deep-link handlers and most WAFs do not log or inspect the URI fragment. The attack is invisible in server logs. Need: client-side CSP reporting + SPA router audit logging — emit a structured log event every time the client-side router evaluates a fragment-provided route, including the raw fragment value.
+- **Universal Link AASA tampering via CDN misconfiguration**: If the `/.well-known/apple-app-site-association` file is served from a CDN with public write access, an attacker can substitute it. iOS caches the AASA; exploitation may not be detected for hours. Need: continuous external monitoring — poll the AASA and assetlinks.json endpoints every 15 minutes and alert on any change to the `appID` or `sha256_cert_fingerprints` fields.
+- **Percent-encoded bypass surviving logs**: Most log pipelines store the raw encoded URI, not the decoded form. Security analysts searching for `javascript:` will miss `%6Aavascript:`. Need: decode URI parameters before writing to SIEM; add detection rule that flags any decoded parameter value starting with `javascript:`, `file:`, `data:text/html`, or `vbscript:`.
+- **Cross-agent deep-link + SSRF chain**: A deep-link `url=` parameter that reaches a server-side fetch endpoint creates an SSRF chain invisible to either the deep-link-fuzzer or the SSRF agent alone. Need: CISO orchestrator Phase 1 synthesis — correlate deep-link open-redirect findings with ssrf-probe findings on the same parameter names before Phase 2.
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+Attack classes that MUST be accounted for:
+
+| Attack Class | Minimum Pattern Search |
+|---|---|
+| Custom-scheme OAuth callback hijacking | `android:scheme` in manifests, `CFBundleURLTypes` in plists — confirm scheme is NOT used for OAuth; if it is, flag CRITICAL |
+| `javascript:` / `data:` URI injection into WebView | `loadUrl`, `evaluateJavascript`, `stringByEvaluatingJavaScriptFromString` called with deep-link-derived string |
+| Open redirect via `url=` / `redirect=` / `next=` parameter | All deep-link query parameter names forwarded to navigation or `loadUrl` |
+| Unauthenticated deep link to protected screen | Handler code that skips authentication check when launched from Intent/URL |
+| Missing / misconfigured AASA or assetlinks.json | Presence and correctness of `.well-known/apple-app-site-association` and `.well-known/assetlinks.json` |
+| Exported Activity / BroadcastReceiver without permission | `exported="true"` without `android:permission` on any component in the deep-link intent filter |
+| Fragment injection into SPA router | URL fragment (`#`) passed to client-side router without stripping |
+| OAuth token replay across sessions | `state` parameter absent or not validated server-side in OAuth callback deep links |
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [
+      { "class": "Custom-scheme OAuth hijacking", "filesReviewed": 3, "patterns": ["android:scheme", "CFBundleURLTypes"], "result": "CLEAN" },
+      { "class": "WebView javascript: injection", "filesReviewed": 12, "patterns": ["loadUrl", "evaluateJavascript"], "result": "2 findings, both fixed" }
+    ],
+    "filesReviewed": 27,
+    "negativeAssertions": [
+      "Open redirect: no `url=`/`redirect=`/`next=` parameter forwarded to loadUrl across 27 files — 0 matches"
+    ],
+    "uncoveredReason": {}
+  }
+}
+```