security-mcp 1.1.4 → 1.3.3

package/skills/incident-responder/SKILL.md

@@ -35,6 +35,15 @@ On every finding resolved, emit:
 ```
 This feeds `security.record_outcome` so the routing engine improves over time.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The full suite of detection modules in `src/gate/checks/` (especially `runtime.ts`, `secrets.ts`, and `ci-pipeline.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum incident surface, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** correlate a `secrets.ts` leaked-credential hit with the `runtime.ts` egress allowlist and the `ci-pipeline.ts` build logs to reconstruct the full kill-chain — a single rotated key in one file is meaningless if the same value is reused in three other services or baked into a cached CI artifact.
+- **Semantic / effective-state analysis:** a kill-switch may exist in `src/lib/kill-switch.ts` yet be read once at startup into a module constant, so the *effective* runtime state is "always on" — prove the toggle actually fires under live traffic, don't trust the literal presence of the guard.
+- **External corroboration:** WebSearch/WebFetch current CISA KEV entries, vendor advisories, and breach-notification SLA changes (GDPR Art.33 72h, EU AI Act Art.73) for the detected stack before declaring containment complete.
+- **Apply & prove:** write the playbook, rotation script, and kill-switch wiring inline, re-run the `src/gate/checks/` suite plus `cosign verify-blob` / Volatility3 memory-dump scans as a regression floor, then re-audit for surviving persistence (OAuth grants, cron, Lambda). Emit the LEARNING SIGNAL per fix; surface trade-offs (e.g. fail-closed kill switch causing a planned outage) against the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance
@@ -190,3 +199,114 @@ Every finding must include:
 - `requiredActions`: ordered action list if not auto-remediated
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true if finding goes beyond the SKILL.md mandate
+
+Every findings JSON MUST also include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "Active attacker foothold or unpatched vector discovered during IR", "exploitHint": "Lateral movement path still open; pivot point identified in auth service" }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "RSA-2048 signing key exposed in breach", "location": "config/signing-keys/" }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "Internal metadata endpoint accessed during incident", "escalationPath": "IMDSv1 → IAM role credential theft → S3 bucket exfiltration" }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["GDPR Art.33", "HIPAA §164.408", "PCI DSS 12.10.5"], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+- **AI-Driven C2 Beaconing via LLM APIs (ATT&CK T1071.001 / T1102):** Threat actors in 2024–2025 (e.g., SCATTERED SPIDER, FIN7 derivatives) have used legitimate LLM API endpoints (OpenAI, Anthropic) as covert C2 channels — instructions embedded in prompts, exfiltration in completions — bypassing DLP tools that whitelist AI provider domains. Test by: run `grep -r "openai.com\|api.anthropic.com\|generativelanguage.googleapis.com" /var/log/proxy* /var/log/dns*` and flag any process not in the approved AI-consumer list making outbound calls to these endpoints; correlate with unexpected data volumes. Finding threshold: any non-approved process beaconing to LLM APIs at intervals consistent with C2 (60–300s).
+
+- **Harvest-Now-Decrypt-Later against TLS Sessions (NIST PQC / CRQC Timeline):** Intercepted TLS 1.2/1.3 sessions using RSA or ECDHE key exchange are being archived by nation-state actors for future decryption once a Cryptographically Relevant Quantum Computer arrives (estimated 2028–2032). Long-retention data (PII, financial records, health data) exfiltrated today becomes plaintext then. Test by: audit TLS cipher suite negotiation in production — `openssl s_client -connect host:443 2>/dev/null | grep "Cipher is"` — and flag any non-PQC-hybrid suite for data classified as sensitive beyond 2030. Finding threshold: any service transmitting regulated data using only classical key exchange without a hybrid ML-KEM (FIPS 203) wrapper.
+
+- **SolarWinds-Style Build Pipeline Injection (ATT&CK T1195.002 / SLSA Level 0):** The SolarWinds SUNBURST incident (CVE-2020-10148) demonstrated that unsigned build artifacts and compromised CI runners allow attackers to inject malicious code that survives eradication of the application layer. During IR, analysts focus on app servers and miss the CI/CD plane entirely. Test by: compare SHA-256 hashes of deployed binaries against the artifact registry's signed provenance (`cosign verify-blob --bundle <bundle> <artifact>`); enumerate all GitHub Actions runners and self-hosted agents for unexpected processes (`ps aux` snapshot vs. baseline). Finding threshold: any deployed artifact whose hash cannot be verified against a signed SLSA provenance attestation.
+
+- **OAuth Consent Grant Persistence Post-Credential-Rotation (ATT&CK T1550.001):** Documented in the Lapsus$ compromise of Microsoft (2022) and Okta (2022) — after password rotation and MFA reset, attacker-created OAuth app consent grants remained active, giving persistent read/write access to email, files, and calendar. Test by: during eradication, run `az ad app list --filter "startswith(displayName,'<unknown>')"` (Azure), `gcloud auth application-default print-access-token` scope audit (GCP), or GitHub `GET /user/installations` to enumerate all OAuth app grants on affected accounts; revoke any grant not in the approved app inventory. Finding threshold: any OAuth app grant to an account involved in the incident that is not in the approved third-party app registry.
+
+- **EU AI Act Art. 73 Mandatory Incident Reporting for High-Risk AI (Regulatory — enforcement 2026):** Under the EU AI Act (Regulation 2024/1689), providers of high-risk AI systems (credit scoring, HR, critical infrastructure, biometrics) must report serious incidents to national supervisory authorities within defined timelines analogous to GDPR Art. 33. IR playbooks built today that lack an AI-system-failure scenario will miss this obligation when enforcement begins. Test by: check whether the IR severity matrix contains an entry for "AI system output causing harm or fundamental rights violation"; verify the playbook names the applicable national market surveillance authority for AI. Finding threshold: any product classified as a high-risk AI system whose IR playbook contains no AI-Act-specific notification step.
+
+- **Memory-Only Ransomware Evading EDR (CVE-2024-21412 / ATT&CK T1620, T1486):** Akira, Black Basta, and LockBit 3.0 affiliates have deployed fileless ransomware variants that load entirely into memory via process hollowing or DLL injection, bypassing file-based EDR detection (documented in CISA AA24-131A). Traditional eradication (remove malicious files, reimaging) leaves no artefact to remove if encryption has already completed. Test by: during containment, capture a full memory dump of affected hosts before any shutdown (`winpmem_mini_x64.exe <output.raw>` on Windows, `LiME` on Linux) — scan the dump with Volatility3 `vol -f dump.raw windows.malfind` to identify injected regions; do not reboot before dump capture or forensic evidence is lost. Finding threshold: any P0 ransomware incident where a memory dump was not captured before system shutdown, constituting an evidence preservation gap.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 incident-response scenarios that automated detection and naive triage universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners/Analysts Miss It | Concrete Test |
+|---|-----------|-------------------------------|---------------|
+| 1 | Attacker-planted persistence surviving eradication | Eradication checklist targets known IOCs; novel persistence (cloud function, scheduled Lambda, OAuth app grant, cron injected via supply chain) is left behind | After "eradication complete", enumerate ALL: cron jobs, cloud scheduled tasks, OAuth app authorisations, startup scripts, and container entry points — compare against pre-incident baseline |
+| 2 | Credential re-use across services after rotation | Rotation remediates the compromised service but the same credential was reused elsewhere; attacker pivots to unrotated service | After any credential rotation, grep all secrets stores and CI/CD env vars for the rotated value; run `grep -r "<rotated-secret-prefix>" .env* .github/ infra/` across the full monorepo |
+| 3 | Log tampering / gap during dwell period | Attacker cleared or rate-limited logs; analyst sees a clean window and concludes no activity occurred | Verify log continuity — check for gaps in sequence numbers or timestamp skips >30s in authentication and audit logs; absence of logs during an active session IS evidence |
+| 4 | Insider-assisted incident where the "responder" is the threat actor | Standard IR assumes the responder is trusted; if an insider is involved, they may observe the investigation and destroy remaining evidence | Restrict IR war-room access to a need-to-know list verified by HR; treat all digital evidence as potentially tampered until chain-of-custody is established externally |
+| 5 | Notification clock triggered by discovery, not by breach date | GDPR Art.33 (72h) and most US state laws clock from when the organisation "becomes aware" — not when the breach occurred; delayed triage can inadvertently blow the legal deadline | Document the exact timestamp of first awareness (alert, ticket, internal report) at the start of triage; this timestamp is the legal T₀ regardless of when the breach actually happened |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that IR programmes designed today must account for.
+
+| Threat | Est. Timeline | Relevance to IR | Prepare Now By |
+|--------|--------------|-----------------|----------------|
+| AI-automated adversary post-exploitation | 2025–2027 (active) | LLM-driven C2 can enumerate, pivot, and exfiltrate faster than human responders can triage; dwell time measured in minutes, not days | Reduce MTTD target to <5 min via UEBA; pre-authorise automated network isolation for P0 severity without human approval gate |
+| Cryptographically Relevant Quantum Computer (CRQC) — harvest-now attacks | 2028–2032 (harvest active now) | Encrypted exfiltration captured today will be decrypted when CRQC arrives; long-lived PII, IP, and state secrets are at risk | Inventory all RSA/ECDSA-encrypted data at rest and in transit; prioritise migration of long-retention data to ML-KEM (FIPS 203) |
+| EU AI Act mandatory incident reporting for high-risk AI | 2026 (enforcement) | AI system failures causing harm become reportable incidents with their own 72h-style notification obligations | Classify all AI features against AI Act tiers; add AI-system-failure scenarios to the IR severity matrix and escalation chain |
+| Mandatory SBOM + SLSA provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | Supply chain compromise incidents will require SBOM-based blast-radius analysis; without SBOM, determining affected dependencies during an incident is days of manual work | Generate CycloneDX SBOM per release; include SBOM-diff step in the incident triage playbook to immediately scope supply chain exposure |
+| Ransomware-as-a-Service with data auction (double extortion) | 2025+ (escalating) | Threat actors exfiltrate before encrypting; containment alone is insufficient — data is already staged for auction | Add pre-encryption exfiltration detection to the P0 playbook: monitor for large outbound data transfers (>1GB in 10 min) and DNS exfiltration patterns alongside ransomware IOCs |
+
+---
+
+## §DETECTION-GAP
+
+What current IR monitoring and tooling CANNOT detect in this domain, and what to build to close each gap.
+
+**Gaps that MUST be checked in every IR engagement:**
+
+- **Attacker persistence in cloud control-plane**: CloudTrail/Audit Log shows API calls but not all persistence vectors (e.g., Service Account key generation, Lambda layer injection, ECR image replacement). Need: dedicated control-plane drift detection — baseline all IAM bindings, service account keys, and function configurations; alert on any delta not matching a recent deployment.
+- **Credential theft via memory scraping**: No file-system or network event is generated when credentials are read from process memory (e.g., LSASS dump, Kubernetes secret mounted in pod memory). Need: kernel-level process injection detection (eBPF-based); flag any process reading memory of another process outside known debug relationships.
+- **Log integrity during incident**: Logs may have been tampered with before IR begins; standard SIEM analysis assumes log fidelity. Need: cryptographic log signing (AWS CloudTrail log file validation, GCP CMEK-signed audit logs); during triage, verify log signatures before treating any log evidence as authoritative.
+- **OAuth app persistence post-account compromise**: An attacker who obtains OAuth consent grants retains access even after password rotation. Need: OAuth app audit as a standard eradication checklist item — enumerate and revoke all third-party OAuth grants for affected accounts, not just credentials.
+- **Cross-agent attack chains invisible to single-agent triage**: A P2 misconfiguration finding (Phase 1) plus a P2 anomalous access finding (Phase 2) may combine into a P0 chain invisible to either finding alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2 to surface multi-hop chains.
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any IR domain area clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [artifact or log source] | [method used] | CLEAN`
+- `CHECKED: [artifact or log source] | [method used] | [N findings, all addressed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+IR domains that MUST be attested:
+
+| Domain | Minimum Check |
+|--------|--------------|
+| Playbook existence | Glob for `runbook*`, `playbook*`, `incident*` in docs and repo root |
+| Kill-switch mechanism | Grep for `killSwitch`, `featureFlag`, `circuit.*breaker` across src |
+| Evidence preservation procedure | Check playbook for log-snapshot and chain-of-custody steps |
+| SIEM/alerting integration | Grep for monitoring provider SDKs and webhook configs |
+| Regulatory notification SLAs | Confirm playbook includes GDPR 72h, HIPAA 60d, state-law timelines |
+| Post-incident review template | Confirm 5 Whys / root-cause template exists |
+| Eradication persistence checklist | Confirm checklist covers cron, cloud functions, OAuth grants, startup scripts |
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [
+      { "class": "IR Playbook Gap", "filesReviewed": 12, "patterns": ["runbook*", "playbook*", "incident*"], "result": "CLEAN" },
+      { "class": "Kill-Switch Absence", "filesReviewed": 84, "patterns": ["killSwitch", "featureFlag", "circuit.?breaker"], "result": "1 finding, remediated" }
+    ],
+    "filesReviewed": 84,
+    "negativeAssertions": [
+      "Evidence preservation: playbook contains log-snapshot step — confirmed present",
+      "Regulatory SLAs: GDPR 72h and HIPAA 60d both present in playbook Phase 5"
+    ],
+    "uncoveredReason": {}
+  }
+}
+```

package/skills/injection-specialist/SKILL.md

@@ -22,6 +22,15 @@ Find and fix every injection vulnerability in the codebase.
 Three-layer defense on every route: input validation → sanitization → parameterized query/safe API.
 Cover §13 input validation and §17 file handling completely.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `injection-deep.ts` detection module (`src/gate/checks/injection-deep.ts`) — SQL/NoSQL/command/SSTI/path/JSON — is your deterministic floor, not your ceiling. Treat its finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** trace a tainted `req.body` field through a Zod parse, into a service-layer helper, and only there into a `prisma.$queryRawUnsafe()` sink three files away — the regex sees a "validated" input at the route and a "constant" query at the sink and misses the join. Confirm second-order paths where input is stored, then later read into a query in an admin context.
+- **Semantic / effective-state analysis:** a tagged-template `$queryRaw` is parameterized, but the same call with a string built by `+` is not; an allowlist that compares against a user-supplied `req.query.table` is still injection. Judge the *effective* parameterization, not the API name.
+- **External corroboration:** WebSearch/WebFetch current CVEs/advisories for the detected ORM/template engine (e.g. Prisma, Handlebars, gRPC metadata injection) and confirm version ranges before scoring.
+- **Apply & prove:** rewrite to parameterized/allowlisted form inline, then re-run `src/gate/checks/injection-deep.ts` plus `semgrep --config p/sql-injection` and a `sqlmap`/Burp polyglot pass as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs (e.g. strict allowlist breaking a legitimate dynamic-column feature) against the secure default.
+
 ## EXECUTION
 
 1. Enumerate all routes and endpoints
@@ -61,6 +70,18 @@ Cover §13 input validation and §17 file handling completely.
 - Fixed code written inline
 - §13/§17 section covered
 
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
 ---
 
 ## §POLYGLOT — Single Payload, Multiple Sinks
@@ -89,3 +110,93 @@ For each input: run ALL injection classes, not just the obvious one. A form fiel
 4. Confirm: does a subsequent `GET /admin` return 200 instead of 403?
 5. **Client-side variant**: URL hash → `JSON.parse` → unsafe assign → `if (config.admin)` → privilege escalation in SPA
 6. **Required fix**: use `Object.create(null)` + Zod schema parse before every merge
+
+---
+
+## BEYOND SKILL.MD
+
+Domain-specific threats, techniques, and research that go beyond the standard injection checklist:
+
+- **CVE-2023-32731 (gRPC metadata injection)**: Attacker-controlled gRPC metadata headers are passed unsanitised to backend services, enabling header injection and SSRF via internal routing metadata — scanners only check HTTP/1.1 headers.
+- **CVE-2024-23897 (Jenkins arbitrary file read via CLI)**: The Jenkins CLI argument parser allows `@file` syntax in command arguments; combined with a crafted injection payload, attackers can read `/etc/passwd` or SSH private keys from the controller — path traversal disguised as CLI argument parsing.
+- **GraphQL batch query amplification + injection chain**: Batching `{"query":"..."}` arrays is rarely rate-limited; combine with SSTI payloads in fragment names or variable values to achieve RCE at GraphQL resolvers that call `eval()` or template-render user-supplied strings.
+- **Second-order SQL injection via ORM audit logs**: Many ORMs write SQL error messages (including malformed user input) to an audit table; if that table is later queried and displayed without sanitisation, the injection executes in a privileged admin context invisible to the original scanner.
+- **AI-generated code introducing `eval()` injection**: LLM-assisted development (Copilot, Cursor) frequently suggests `eval(userInput)` or `new Function(userInput)` patterns when building dynamic rule engines or formula parsers — audit every file touched by AI pair-programming tools for dynamic code execution sinks.
+- **LLM prompt injection via database content (indirect injection)**: An attacker stores a crafted prompt in a database field (e.g., user bio, product description); the application's AI assistant later retrieves and injects that field directly into a system prompt, causing the LLM to exfiltrate data or take unauthorised tool actions — the injection never touches HTTP input validation.
+- **Post-quantum harvest-now-decrypt-later targeting injection payloads**: Injection payloads in encrypted TLS sessions are being archived by nation-state adversaries for future decryption once CRQCs arrive (est. 2028–2032); injection findings in high-sensitivity contexts (auth tokens, PII fields) should be treated as already-compromised if RSA/ECDH is in use without hybrid ML-KEM.
+- **CRLF injection in HTTP/2 pseudo-headers**: HTTP/2 forbids CRLF in header values, but some reverse proxies (nginx < 1.25.3, HAProxy < 2.8) incorrectly forward CR-only (`\r`) sequences when downgrading to HTTP/1.1, enabling response splitting in contexts that appear safe under HTTP/2-only testing.
+
+---
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{
+  "findingId": "FINDING_ID",
+  "agentName": "injection-specialist",
+  "resolved": true,
+  "remediationTemplate": "one-line description of what was done",
+  "falsePositive": false
+}
+```
+Call `security.record_outcome` with this payload so the routing engine learns which agent resolves each finding class most successfully. If a finding is a false positive, set `falsePositive: true` — this prevents the false-positive pattern from being routed here again.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "SQL Injection", "filesReviewed": 47, "patterns": ["queryRaw", "string concat"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["SQL Injection: queryRaw pattern searched across 47 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```

package/skills/ios-security-auditor/SKILL.md

@@ -21,6 +21,15 @@ way developers accidentally undermine it.
 Audit all iOS security controls against OWASP MASVS. Write Swift/ObjC fixes inline.
 Only activated if iOS or cross-platform mobile is detected.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `mobile-ios` detection module (`src/gate/checks/mobile-ios.ts`) is your deterministic floor, not your ceiling. Treat its finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** a token written to the Keychain in `AuthStore.swift` with a correct `kSecAttrAccessible` value is still exposed if a different file copies it into `UserDefaults` or a `WKScriptMessageHandler` reply — follow the value across files, not just the `SecItemAdd` call site.
+- **Semantic / effective-state analysis:** an `apple-app-site-association` with `"paths": ["*"]`, or a pinning delegate that validates only the hostname and not the SPKI hash, *looks* present but is effectively bypassable. Judge the real trust decision (e.g. `LAContext.evaluatePolicy` result actually gating the sensitive action) over the literal presence of an API call.
+- **External corroboration:** WebSearch/WebFetch current iOS CVEs and advisories (NSPredicate injection on iOS < 16.3.2, ATS bypasses, Apple Intelligence/Core ML prompt-injection notes) for the targeted SDK and OS range.
+- **Apply & prove:** write the Swift/ObjC fix inline, then re-run `src/gate/checks/mobile-ios.ts` plus a `mobsf` static scan and a `frida`/`objection` runtime check (`ios sslpinning disable`, IMP-integrity probe near biometric eval) as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs (e.g. `ThisDeviceOnly` Keychain breaking multi-device restore) against the secure default.
+
 ## EXECUTION
 
 1. **Data Storage (MASVS-STORAGE):**
@@ -75,3 +84,285 @@ Only activated if iOS or cross-platform mobile is detected.
 - MASVS control ID violated
 - Swift/ObjC code fix written inline
 - CVSSv4, CWE
+- `intelligenceForOtherAgents` block (see schema below)
+- `coverageManifest` (see §ZERO-MISS-MANDATE)
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+These expansions cover attack surfaces that OWASP MASVS alone does not fully address. Each
+check is mandatory — do not skip without documented justification.
+
+1. **CVE-2023-23530 / CVE-2023-23531 — NSPredicate Injection via SpringBoard:**
+   Any app that constructs `NSPredicate` strings from user input is vulnerable to sandbox
+   escape on unpatched iOS 16.3 and below. Test: grep codebase for `NSPredicate(format:` with
+   non-literal format strings. Finding: any variable interpolated into the format string without
+   `SELF == %@` substitution. Fix: only use `NSPredicate(format:)` with `%@`, `%d`, `%K`
+   substitution — never string concatenation.
+
+2. **Frida / Objection Dynamic Instrumentation Bypass Detection:**
+   Attackers attach Frida to a running app via `frida-server` on jailbroken devices to hook
+   `LAContext.evaluatePolicy` and return `true` unconditionally. Test: check for
+   `MSHookFunction` / `fishhook` resistance and integrity checks around auth decision points.
+   Concrete detection: compute a runtime hash of `LAContext`'s method IMP; compare against a
+   compile-time constant. Finding: absence of any IMP integrity check near biometric evaluation.
+
+3. **iOS Backup Keychain Extraction (CVE class: MASVS-STORAGE-2):**
+   Items stored with `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly` are excluded from
+   iTunes/iCloud backup, but items with the non-`ThisDeviceOnly` variants ARE included in
+   unencrypted backups. Test: enumerate all `SecItemAdd`/`SecItemUpdate` calls; flag any
+   `kSecAttrAccessible` value without `ThisDeviceOnly` suffix for sensitive item classes
+   (`kSecClassGenericPassword`, `kSecClassInternetPassword`). Tool: `idevicebackup2` +
+   `KeychainDumper` on a backup image. Finding: auth tokens or PII in backup-eligible
+   Keychain slots.
+
+4. **Universal Link Hijacking via Misconfigured AASA (apple-app-site-association):**
+   If `apple-app-site-association` specifies an overly broad path (`"paths": ["*"]`) or is
+   served from an HTTP endpoint, an attacker-controlled domain can intercept OAuth redirects.
+   Test: fetch `https://<domain>/.well-known/apple-app-site-association`; validate JSON
+   structure, HTTPS enforcement, and path specificity. Script: `curl -s
+   https://TARGET/.well-known/apple-app-site-association | jq '.applinks.details[].paths'`.
+   Finding: wildcard `*` path or missing HTTPS redirect.
+
+5. **Swift Concurrency Race on Authentication State (`async`/`await` TOCTOU):**
+   Post-iOS 15 Swift async/await patterns introduce new TOCTOU windows: an `actor`-isolated
+   authentication state may be read by one task while a concurrent task is resetting it.
+   Test: search for `actor` definitions that guard auth state; verify that all mutations and
+   reads use the same actor isolation. Grep: `nonisolated` adjacent to auth-state-bearing
+   actors. Finding: `nonisolated` method on an auth actor that reads sensitive state without
+   re-entering the actor.
+
+6. **AI-Assisted Reverse Engineering of Obfuscated Swift Binaries (Post-2024 Threat):**
+   LLM-powered tools (e.g., IDA + GPT-4 plugins, BinaryNinja Sidekick) can reconstruct
+   business logic from stripped Swift binaries in under an hour — vastly reducing the time
+   to extract hardcoded secrets or forge authentication tokens. Test: run `strings` + `nm` on
+   the release `.ipa`; confirm no API keys, JWT secrets, or internal hostnames appear in
+   plain text. Additionally, verify that certificate pinning logic is not trivially identified
+   by pattern-matching on `SecCertificateCopyData` call sites alone. Finding: any secret
+   detectable by automated string extraction from the binary.
+
+7. **LLM Prompt-Injection via On-Device AI Features (Post-2024 Threat — Apple Intelligence):**
+   Apps integrating Apple Intelligence / Core ML LLM features that pass user-controlled text
+   directly to an on-device model without sanitisation are vulnerable to prompt injection
+   resulting in privilege escalation within the app's own data scope. Test: identify
+   `MLModel`, `NaturalLanguage`, or `CreateML` usage where user text is interpolated into a
+   system prompt. Finding: system prompt concatenation with unsanitised `UITextField` or
+   clipboard content that can redirect model output to exfiltrate in-app data.
+
+8. **WebView JavaScript Bridge Exposure (`WKScriptMessageHandler`):**
+   `WKScriptMessageHandler` creates a named bridge callable from JavaScript inside a
+   `WKWebView`. If the WebView loads remote or user-controlled content, any registered message
+   handler becomes an RCE or data-exfiltration surface. Test: grep for
+   `add(_:name:)` on `userContentController`; for each handler, verify the loaded URL origin
+   is pinned to an allowlist. Script: `grep -rn "add.*name:" --include="*.swift"`. Finding:
+   handler registered without origin validation, or WebView loads `http://` or a
+   user-supplied URL.
+
+---
+
+## §IOS_SECURITY_AUDITOR-CHECKLIST
+
+1. **Keychain accessibility class audit** — Search all `SecItemAdd` calls; verify
+   `kSecAttrAccessible` is `WhenUnlockedThisDeviceOnly` or `WhenPasscodeSetThisDeviceOnly`
+   for auth tokens and PII. Finding: any non-`ThisDeviceOnly` or `Always*` value for
+   sensitive data.
+
+2. **ATS exception audit** — Parse `Info.plist`; flag `NSAllowsArbitraryLoads`, any
+   `NSExceptionDomains` entry with `NSExceptionAllowsInsecureHTTPLoads: true`, or
+   `NSAllowsLocalNetworking: true` in production builds. Finding: any ATS exception not
+   accompanied by a documented compliance reason.
+
+3. **Certificate pinning implementation review** — Locate `URLSession` delegate
+   `urlSession(_:didReceive:completionHandler:)`; verify leaf or intermediate certificate
+   hash is pinned (not just hostname); verify backup pin exists. Finding: absent pinning,
+   hostname-only validation, or pinned only to a single certificate with no fallback.
+
+4. **Biometric auth enrollment-change invalidation** — After `LAContext.evaluatePolicy`
+   success, check that `evaluatedPolicyDomainState` is compared against a stored baseline.
+   Finding: no `evaluatedPolicyDomainState` persistence between app launches — biometric
+   re-enrollment is not detected.
+
+5. **Universal Link / AASA integrity check** — Fetch the AASA file over HTTPS; validate
+   the JSON schema against Apple's spec; confirm paths are not `*`; confirm the file is
+   served with `Content-Type: application/json`. Finding: any deviation from spec, wildcard
+   path, or HTTP delivery.
+
+6. **Pasteboard sensitive-data leak** — Grep for `UIPasteboard.general.string =` and
+   `UIPasteboard.general.setValue`; verify no auth tokens, card numbers, or PII are written.
+   Finding: any sensitive value written to the general pasteboard (accessible by all apps).
+
+7. **NSUserDefaults / UserDefaults PII audit** — Grep for `UserDefaults.standard.set` and
+   `UserDefaults.standard.setValue`; verify keys do not store credentials, tokens, or PII.
+   Finding: any token or PII key in `UserDefaults` (unencrypted, included in iCloud backup
+   by default).
+
+8. **WKWebView JavaScript bridge origin validation** — For each `WKScriptMessageHandler`
+   registration, verify the WebView's navigation delegate `decidePolicyFor` restricts origins
+   to a hardcoded allowlist. Finding: handler accessible from arbitrary or remote URLs.
+
+9. **Binary hardening flags** — Run `otool -hv <binary>` and `otool -l <binary> | grep
+   stack_chk`; verify PIE flag set, stack canaries present, ARC enabled. Finding: missing
+   PIE or stack canary in any framework or main binary.
+
+10. **Info.plist secrets scan** — Search `Info.plist` for keys containing `key`, `secret`,
+    `token`, `password`, `apiKey` (case-insensitive). Run `plutil -convert json -o - Info.plist
+    | jq 'keys[] | ascii_downcase | select(contains("key","secret","token","password"))'`.
+    Finding: any non-empty value for a matched key.
+
+11. **NSPredicate injection audit** — Grep for `NSPredicate(format:` with string interpolation
+    or concatenation (not solely `%@`/`%K`/`%d` substitution). Finding: user-controlled data
+    in predicate format string (arbitrary property access or sandbox escape on iOS < 16.3.2).
+
+12. **Secure Enclave key usage for authentication** — Verify that private keys used in
+    authentication flows are generated with `kSecAttrTokenIDSecureEnclave`. Finding: auth
+    private key stored in software Keychain rather than Secure Enclave — extractable via
+    Keychain dump on jailbroken device.
+
+---
+
+## §POC-REQUIREMENT
+
+Every CRITICAL or HIGH finding MUST follow this exact sequence before being recorded:
+
+1. **Write working PoC FIRST** — exact payload, request sequence, or tool command that
+   reproduces the vulnerability. For iOS findings this means: the exact `security
+   dump-keychain` command, `frida` script, or `curl` invocation that demonstrates impact.
+2. **Confirm reproduction** — execute the PoC and capture output proving the finding is real.
+3. **Write fix** — provide inline Swift/ObjC code that remediates the root cause.
+4. **Verify PoC fails against fix** — re-run the identical PoC against the fixed code; confirm
+   it no longer succeeds.
+5. **Record in findings JSON** — include `exploitPoC` key with the exact reproduction steps
+   and the verification output showing the fix is effective.
+
+**PoC skipping = severity automatically downgraded to MEDIUM.** If runtime access is
+unavailable (e.g., CI-only environment), document the limitation in `exploitPoC` and flag
+for manual validation before release.
+
+---
+
+## §PROJECT-ESCALATION
+
+Immediately alert the CISO orchestrator and reprioritise the run if ANY of the following
+conditions are detected:
+
+1. **Keychain data accessible without device unlock** — any item found with
+   `kSecAttrAccessibleAlways` or `kSecAttrAccessibleAlwaysThisDeviceOnly` containing
+   authentication credentials or cryptographic key material.
+
+2. **ATS fully disabled in production build** — `NSAllowsArbitraryLoads: true` confirmed
+   in a non-debug `Info.plist`; all network traffic is cleartext-eligible.
+
+3. **Hardcoded private key or JWT secret in binary or plist** — `strings` / `grep` confirms
+   a PEM block, base64 key, or JWT `HS256`/`RS256` secret appears verbatim in a shipped
+   artifact.
+
+4. **NSPredicate injection on iOS < 16.3.2 confirmed** — user-controlled input reaches
+   an `NSPredicate(format:)` call; SpringBoard sandbox escape is within attacker reach.
+
+5. **WKWebView bridge with no origin check loading remote URL** — any `WKScriptMessageHandler`
+   accessible from a remotely loaded page; classified as RCE-class vulnerability on the
+   app's data scope.
+
+6. **Apple Wallet / PassKit credential stored outside Secure Enclave** — payment or transit
+   pass private key material found in software Keychain rather than Secure Enclave.
+
+7. **LLM prompt injection confirmed in Apple Intelligence integration** — attacker-controlled
+   clipboard or text field content demonstrably redirects on-device model output to access
+   app-internal data or bypass app-level access controls.
+
+8. **Certificate pinning absent on a financial or health data endpoint** — MitM is trivially
+   possible on endpoints transmitting PCI-DSS or HIPAA-regulated data.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+---
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "SQL Injection", "filesReviewed": 47, "patterns": ["queryRaw", "string concat"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["SQL Injection: queryRaw pattern searched across 47 files — 0 matches"],
+    "uncoveredReason": {}
+  }
+}
+```
+
+---
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{
+  "findingId": "FINDING_ID",
+  "agentName": "ios-security-auditor",
+  "resolved": true,
+  "remediationTemplate": "one-line description of what was done",
+  "falsePositive": false
+}
+```
+Call `security.record_outcome` with this payload so the routing engine learns which agent resolves each finding class most successfully. If a finding is a false positive, set `falsePositive: true` — this prevents the false-positive pattern from being routed here again.