synapse-hub 2.2.4 → 2.4.1

package/.agents/skills/security-dast-sentinel/SKILL.md

@@ -1,179 +1,98 @@
 ---
 name: security-dast-sentinel
-description: "Run dynamic security audits: OWASP Top 10, security headers, IDOR, and token leakage."
+description: "Run dynamic security audits: OWASP Top 10, security headers, IDOR, and token leakage. Use when running or planning DAST and security scans against a target app."
 ---
 
 # Security DAST Sentinel (Dynamic Application Security & OWASP Top 10)
 
-> **Purpose:** Automated Dynamic Application Security Testing (DAST) and defensive runtime verification across enterprise web applications and REST/GraphQL APIs. Bridges functional automated testing with OWASP Top 10 defensive compliance gates.
+> **Purpose:** Automated Dynamic Application Security Testing (DAST) and defensive runtime verification across enterprise web applications and APIs. Bridges functional automated testing with OWASP Top 10 compliance gates.
 >
 > [!IMPORTANT] Authorization & Scope of Engagement
 > Dynamic security testing and fuzzing must **ONLY** be conducted against environments, domains, and applications for which explicit written authorization and testing agreements are established. Never direct automated security payloads or fuzzers against third-party production infrastructure.
 
 ---
 
-## 1. Core Defensive Scope & OWASP Top 10 Coverage
-
-```mermaid
-flowchart TD
-    A["<b>Security DAST Sentinel</b><br/>Runtime Defensive Verification"] --> B["<b>1. HTTP Security Headers</b><br/>CSP, HSTS, X-Frame-Options, MIME Sniff"]
-    A --> C["<b>2. Sensitive Data Exposure</b><br/>PII, Secrets, Tokens, Stacktrace Leakage"]
-    A --> D["<b>3. Broken Object Auth (BOLA/IDOR)</b><br/>Horizontal/Vertical Role Token Swapping"]
-    A --> E["<b>4. CORS & Origin Misconfig</b><br/>Origin Reflection, Credentials Wildcard"]
-```
+## 1. Core Defensive Scope & OWASP Top 10
 
 | OWASP Category | Threat Vector | Automated Defensive Check | Assertion Target |
 | :--- | :--- | :--- | :--- |
-| **A01: Broken Access Control** | BOLA / IDOR | Swapping User A's Bearer token into User B's resource URI | HTTP `403 Forbidden` or `404 Not Found` (Never `200 OK`) |
-| **A01: Broken Access Control** | CORS Misconfiguration | Sending unauthorized `Origin` header with `Credentials: include` | Must NOT reflect origin with `Access-Control-Allow-Credentials: true` |
-| **A02: Cryptographic Failures** | Insecure Transport & Missing HSTS | Inspecting headers on HTTPS endpoints | `Strict-Transport-Security: max-age=31536000; includeSubDomains` |
-| **A05: Security Misconfiguration** | Missing Security Headers | Passive audit on all page navigations & API responses | CSP, X-Frame-Options, X-Content-Type-Options: nosniff |
-| **A05: Security Misconfiguration** | Verbose Error Disclosure | Injecting invalid payload to trigger 4xx/5xx | Response must NOT contain `SQLException`, `Traceback`, or internal paths |
-| **A09: Security Logging & Monitoring** | Sensitive Data Leakage | Regex scan on API responses and local storage | Zero plaintext passwords, credit cards, or private keys |
+| **A01: Broken Access Control** | BOLA / IDOR | Swapping User A token into User B resource URI | HTTP `403` or `404` (Never `200`) |
+| **A01: Broken Access Control** | CORS Misconfiguration | Sending untrusted `Origin` with `Credentials: include` | Must NOT reflect origin with `Credentials: true` |
+| **A02: Cryptographic Failures** | Missing HSTS | Inspecting headers on HTTPS endpoints | `Strict-Transport-Security: max-age=...` |
+| **A05: Security Misconfiguration** | Missing Security Headers | Passive audit on page navigations & API responses | CSP, X-Frame-Options, nosniff |
+| **A05: Security Misconfiguration** | Verbose Error Disclosure | Fuzzing invalid inputs to trigger errors | Response must NOT contain `SQLException` or stacktrace |
+| **A09: Logging & Secrets Leak** | Sensitive Data Leakage | Regex scan on responses and local storage | Zero plaintext passwords, API keys, or private keys |
 
 ---
 
-## 2. HTTP Security Response Headers Audit
-
-All production and staging responses must enforce strict defensive headers to prevent Clickjacking, Cross-Site Scripting (XSS), and MIME-sniffing attacks.
-
-### Mandatory Security Header Policy
-1. `Content-Security-Policy`: Must define `default-src 'self'` or restrictive directive; must avoid `'unsafe-eval'` or open wildcards `*` in script sources.
-2. `Strict-Transport-Security`: `max-age=31536000; includeSubDomains` on HTTPS.
-3. `X-Frame-Options`: `DENY` or `SAMEORIGIN` (prevents UI clickjacking in external iframes).
-4. `X-Content-Type-Options`: `nosniff` (prevents browser MIME-type confusion).
-5. `Referrer-Policy`: `strict-origin-when-cross-origin` or `no-referrer`.
-6. `Permissions-Policy`: Restricts camera, microphone, and geolocation APIs.
+## 2. Automated Security Headers Audit (Playwright TypeScript)
 
-### Playwright Automated Headers Fixture (TypeScript)
 ```typescript
 import { test, expect } from '@playwright/test';
 
-test.describe('DAST Security Headers Audit', () => {
-  test('verify mandatory security headers on target application', async ({ page }) => {
-    const response = await page.goto('/dashboard');
-    expect(response).not.toBeNull();
-    const headers = response!.headers();
+test('DAST: Verify mandatory HTTP security headers', async ({ page }) => {
+  const response = await page.goto('/dashboard');
+  expect(response).not.toBeNull();
+  const headers = response!.headers();
 
-    // 1. Clickjacking Protection
-    const xFrame = headers['x-frame-options']?.toUpperCase();
-    expect(['DENY', 'SAMEORIGIN'], 'X-Frame-Options must be DENY or SAMEORIGIN').toContain(xFrame);
+  // 1. Clickjacking & MIME Sniffing
+  expect(['DENY', 'SAMEORIGIN']).toContain(headers['x-frame-options']?.toUpperCase());
+  expect(headers['x-content-type-options']).toBe('nosniff');
 
-    // 2. MIME Sniffing Protection
-    expect(headers['x-content-type-options'], 'Must prevent MIME sniffing').toBe('nosniff');
-
-    // 3. Strict Transport Security
-    if (page.url().startsWith('https://')) {
-      expect(headers['strict-transport-security'], 'HSTS must be enabled on HTTPS').toContain('max-age=');
-    }
-
-    // 4. Content Security Policy
-    const csp = headers['content-security-policy'];
-    expect(csp, 'Content-Security-Policy must be declared').toBeTruthy();
-    expect(csp).not.toContain("default-src *");
-  });
+  // 2. Strict Transport Security & CSP
+  if (page.url().startsWith('https://')) {
+    expect(headers['strict-transport-security']).toContain('max-age=');
+  }
+  expect(headers['content-security-policy']).toBeTruthy();
 });
 ```
 
 ---
 
-## 3. Sensitive Data Exposure (PII, Secrets & Error Leakage)
-
-API responses and client-side storage must never leak internal stack traces, system paths, unmasked PII, or authorization credentials.
-
-### Automated Response Interceptor Linter (Python / Playwright)
-```python
-import re
-from typing import Dict, List
-
-# Patterns matching accidental secret or stacktrace leakage
-SENSITIVE_LEAK_PATTERNS = [
-    (re.compile(r'-----BEGIN (?:RSA )?PRIVATE KEY-----'), "Exposed Private Key"),
-    (re.compile(r'(?i)\b(?:password|passwd|pwd)\b\s*[:=]\s*["\'][^"\']{4,}["\']'), "Exposed Plaintext Password"),
-    (re.compile(r'\b(?:4[0-9]{12}(?:[0-9]{3})?|5[1-5][0-9]{14})\b'), "Raw Credit Card Number (Visa/MC)"),
-    (re.compile(r'(?i)(?:SQLException|HibernateException|org\.postgresql\.util|java\.lang\.NullPointerException)'), "Database Stacktrace Leak"),
-    (re.compile(r'(?i)(?:Traceback \(most recent call last\)|File "[a-zA-Z0-9_\-\\/]+\.py", line \d+)'), "Python Stacktrace Leak"),
-    (re.compile(r'\b[a-zA-Z]:\\[a-zA-Z0-9_.\-\\]+\b'), "Internal Windows File Path Leak"),
-]
-
-def scan_response_for_leaks(body_text: str) -> List[str]:
-    """Inspects API response text for prohibited sensitive data leaks."""
-    violations = []
-    for pattern, description in SENSITIVE_LEAK_PATTERNS:
-        if pattern.search(body_text):
-            violations.append(description)
-    return violations
-```
-
----
-
-## 4. Broken Object-Level Authorization (BOLA / IDOR) Testing
-
-BOLA occurs when an API endpoint uses user-supplied IDs to retrieve object instances without validating user ownership.
-
-### Automated Dual-Role Permutation Protocol
-1. **User A (Victim):** Log in and create Entity `X` (ID: `10042`).
-2. **User B (Attacker):** Log in as an unrelated user or tenant, acquire Token `B`.
-3. **Execute Cross-Tenant Query:** Dispatch `GET /api/v1/entities/10042` with `Authorization: Bearer <Token_B>`.
-4. **Assert Access Barrier:**
-   - `HTTP 403 Forbidden` or `HTTP 404 Not Found` => **PASS** (Zero BOLA).
-   - `HTTP 200 OK` with Entity `X` payload => **CRITICAL DEFECT: BOLA / IDOR VULNERABILITY**.
+## 3. BOLA / IDOR Defense Check
 
 ```typescript
-test('BOLA Defense: Tenant B cannot access Tenant A entity', async ({ request }) => {
-  // Tenant A creates resource
-  const createRes = await request.post('/api/v1/invoices', {
-    headers: { 'Authorization': `Bearer ${tokenTenantA}` },
-    data: { amount: 5000, description: 'Confidential Invoice A' }
-  });
-  const invoiceId = (await createRes.json()).id;
-
-  // Tenant B attempts to read Tenant A's invoice
-  const readAttempt = await request.get(`/api/v1/invoices/${invoiceId}`, {
+test('DAST: Tenant B cannot access Tenant A entity', async ({ request }) => {
+  // Tenant B attempts to read Tenant A resource
+  const readAttempt = await request.get('/api/v1/invoices/10042', {
     headers: { 'Authorization': `Bearer ${tokenTenantB}` }
   });
-
-  // Assertion: System must block cross-tenant read
-  expect([403, 404], 'Tenant B must not access Tenant A invoice').toContain(readAttempt.status());
+  expect([403, 404], 'Cross-tenant resource must be forbidden').toContain(readAttempt.status());
 });
 ```
 
 ---
 
-## 5. CORS Misconfiguration Audit
+## 4. Environment Allowlist Guard
 
-CORS policies must never reflect arbitrary untrusted origins when credentials (cookies/tokens) are supported.
+- Automated security checks, fuzzing (`tools/api_fuzzer.py`), and DB sandboxing (`tools/db_sandbox.py`) enforce non-production allowlists (`localhost`, `staging`, `dev`, `qa`, `sandbox`).
+- Fuzzing production hosts without `SYNAPSE_ALLOW_PROD_FUZZ=1` is automatically blocked.
 
-```typescript
-test('CORS Defense: Server must not reflect arbitrary untrusted Origin with credentials', async ({ request }) => {
-  const untrustedOrigin = 'https://untrusted-attacker.com';
-  const response = await request.get('/api/v1/user/profile', {
-    headers: {
-      'Origin': untrustedOrigin,
-      'Authorization': `Bearer ${validUserToken}`
-    }
-  });
+---
 
-  const allowOrigin = response.headers()['access-control-allow-origin'];
-  const allowCredentials = response.headers()['access-control-allow-credentials'];
+## 5. Passive vs Active Scan Taxonomy & Severity Levels
 
-  // Critical CORS Flaw: Reflecting untrusted origin while allowing credentials
-  if (allowOrigin === untrustedOrigin && allowCredentials === 'true') {
-    throw new Error('CRITICAL CORS VULNERABILITY: Arbitrary origin reflection with credentials enabled');
-  }
+> *Borrowed and adapted from the OWASP ZAP scanning model (Apache-2.0, zaproxy/zaproxy).*
 
-  // Critical CORS Flaw: Wildcard with credentials
-  if (allowOrigin === '*' && allowCredentials === 'true') {
-    throw new Error('CRITICAL CORS VULNERABILITY: Wildcard origin with credentials enabled');
-  }
-});
-```
+Structure every DAST engagement in two phases, and severity-tag every finding
+so CI can gate on risk instead of raw counts:
 
----
-
-## 6. Security DoD Verification Checklist
-- [ ] Mandatory security headers verified on root and core dashboard routes.
-- [ ] No `500 Server Error` response contains raw SQL exceptions or language stacktraces.
-- [ ] All ID-based mutation and query endpoints verified against BOLA/IDOR permutations.
-- [ ] CORS policies enforce whitelist or block `Credentials: true` with arbitrary origins.
-- [ ] All security testing conducted non-destructively in defensive QA test suites.
+| Phase | Traffic | Purpose | Hub Tooling |
+| :--- | :--- | :--- | :--- |
+| **Passive** | Zero traffic | Audit the OpenAPI/Swagger contract pre-flight: mutating endpoints without declared auth, unprotected admin paths, unbounded string props | `agent-qa fuzz-api --mode passive` |
+| **Active** | Controlled attacks | Dispatch fuzz vectors against staging and evaluate the defect oracle | `agent-qa fuzz-api` (allowlist-guarded) |
+
+Severity ladder (fixed mapping): `CRITICAL` (stacktrace/DB leak, auth bypass) →
+`HIGH` (server crash 5xx, unprotected sensitive path) → `MEDIUM` (connection
+errors, unverified targets) → `LOW` (SLA breaches, unbounded input) → `INFO`.
+
+Rules:
+1. **Never skip passive** — a contract that leaks an admin route costs zero
+   requests to find; active scan only after passive findings are triaged.
+2. **Gate on CRITICAL alone** — a run with any CRITICAL alarm fails CI
+   regardless of total counts.
+3. **An untested endpoint must never PASS** — connection failures are
+   `CONNECTION_ERROR` findings, not green results (Truth Anchor).
+4. **OpenAPI-driven breadth** — ingest the spec (JSON) so every path/method is
+   enumerated; combine with authentication scripts from
+   `auth-session-and-cookie-manager` before active scanning.

package/.agents/skills/security-dast-sentinel/examples/dast_scan_config.json

@@ -0,0 +1,10 @@
+{
+  "targetUrl": "https://staging.internal.example.com",
+  "checks": [
+    "OWASP_TOP_10",
+    "HEADER_SECURITY",
+    "TOKEN_EXPOSURE",
+    "SQLI_PROBING"
+  ],
+  "failOnSeverity": "HIGH"
+}

package/.agents/skills/self-healing-locator/SKILL.md

@@ -1,9 +1,9 @@
 ---
 name: self-healing-locator
-description: "Heal broken locators using semantic AOM diffing with Role, Label, and TestId hierarchy."
+description: "Heal broken locators using semantic AOM diffing with Role, Label, and TestId hierarchy. Use when locators break and automated healing strategies are needed."
 ---
 
-# Self-Healing Locator Skill — Token-Efficient AOM Diffing
+# Self-Healing Locator Skill — Token-Efficient AOM Diffing
 
 This skill provides an automated, token-conservative mechanism to diagnose, diff, and repair broken web element locators across web applications without overwhelming the LLM context window with raw HTML dumps.
 
@@ -28,18 +28,18 @@ flowchart LR
 
 When searching for a replacement locator, evaluate candidates in this strict priority order:
 
-1. **Tier 1 — ARIA Role & Accessible Name:**
-   - Playwright: `page.getByRole('button', { name: 'Thêm mới' })`
-   - CSS: `[role="button"][aria-label="Thêm mới"]`
-2. **Tier 2 — Form Control & Business Semantics:**
+1. **Tier 1 — ARIA Role & Accessible Name:**
+   - Playwright: `page.getByRole('button', { name: 'Thêm mới' })`
+   - CSS: `[role="button"][aria-label="Thêm mới"]`
+2. **Tier 2 — Form Control & Business Semantics:**
    - `input[formcontrolname="code"]`
    - `p-dropdown[formcontrolname="categoryId"]`
-3. **Tier 3 — Dedicated Test Identifiers:**
+3. **Tier 3 — Dedicated Test Identifiers:**
    - `[data-testid="btn-create"]`
    - `[data-test="submit"]`
-4. **Tier 4 — Stable Visual Text:**
-   - `button:has-text("Xác nhận")`
-5. **Tier 5 — Scoped Resilient Relative CSS:**
+4. **Tier 4 — Stable Visual Text:**
+   - `button:has-text("Xác nhận")`
+5. **Tier 5 — Scoped Resilient Relative CSS:**
    - `.card.popup-data input.p-inputtext`
 
 ---
@@ -70,3 +70,17 @@ Execute this compact JavaScript probe via Playwright or Chrome DevTools to locat
 1. **Verify Uniqueness:** Ensure the candidate locator matches exactly 1 element on the live DOM.
 2. **Encapsulate in Page Class:** Update the locator constant or private selector inside the relevant Page Class (e.g. `BasePage` or domain Page Class).
 3. **Never Leak to Test Scripts:** Test scripts must remain 100% clean of raw selectors.
+
+---
+
+## 5. Boundary vs `failure-autopsy-and-healing`
+
+- **This skill** = a locator-repair cascade (cache → testid → text-semantic →
+  geometric relative match), used when the diagnosis "stale/broken locator"
+  is ALREADY established. It takes a broken selector plus a DOM snapshot and
+  returns healed candidates with confidence scores.
+- **`failure-autopsy-and-healing`** = the upstream diagnosis that decides WHEN
+  this skill is needed (it also handles every non-locator failure class this
+  skill does not touch).
+- Chain of custody: autopsy RCA → "locator drift" verdict → this skill repairs
+  → autopsy re-runs the healed test to close the loop.

package/.agents/skills/self-healing-locator/examples/aom_diff_sample.json

@@ -0,0 +1,16 @@
+{
+  "brokenLocator": "#old-checkout-btn",
+  "historicalAttributes": {
+    "role": "button",
+    "text": "Confirm Order",
+    "testid": "checkout-submit"
+  },
+  "currentAOMSnapshot": [
+    {
+      "role": "button",
+      "name": "Confirm Order",
+      "testid": "checkout-submit-v2"
+    }
+  ],
+  "healedLocator": "button[data-testid='checkout-submit-v2']"
+}

package/.agents/skills/skillspector-security-guard/SKILL.md

@@ -1,115 +1,57 @@
 ---
 name: skillspector-security-guard
-description: "Audit and verify AI agent skills, prompts, and MCP configurations against 71 vulnerability vectors inspired by NVIDIA SkillSpector."
+description: "Audit and verify AI agent skills, prompts, and MCP configurations against vulnerability vectors inspired by NVIDIA SkillSpector. Use when auditing skills and plugins for prompt-injection and security threats."
 ---
 
 # SkillSpector Security Guard — AI Agent & MCP Security Sentinel
 
-> **Purpose:** Autonomous security auditing, vulnerability vetting, and supply-chain inspection for AI Agent skills, prompt instruction files, Model Context Protocol (MCP) server configurations, and automation scripts.  
-> **Upstream Heritage:** Synthesized and adapted from **[NVIDIA/SkillSpector](https://github.com/NVIDIA/SkillSpector)** (Apache 2.0).
+> **Purpose:** Autonomous security vetting for AI Agent skills, prompt instructions, Model Context Protocol (MCP) servers, and automation tools.  
+> **Heritage:** Inspired by and adapted from **[NVIDIA/SkillSpector](https://github.com/NVIDIA/SkillSpector)** (Apache 2.0).
 
 ---
 
-## 1. The Threat Model for AI Agent Skills
-
-AI agent skills execute with user-level permissions, terminal shell execution rights, and implicit trust. Unvetted third-party skills, instructions, or MCP configs can introduce severe vulnerabilities:
-- **Prompt Injection:** Overriding core system safety rules, steering model logic covertly, or forcing jailbreaks.
-- **Data Exfiltration:** Covertly shipping conversation memory, user secrets, or environment keys to external URLs.
-- **Privilege Escalation:** Running root/sudo commands, mounting `/var/run/docker.sock`, or stealing SSH/AWS keys.
-- **Agent Snooping:** Reading configuration stores (`~/.claude`, `~/.gemini`, `~/.codex`) or parsing `mcp.json` to steal tokens.
-- **MCP Tool Poisoning:** Injecting hidden instructions in tool metadata (HTML comments, Unicode homoglyphs, Base64).
-
-```mermaid
-flowchart TD
-    CandidateSkill["Candidate Skill / MCP Config / Prompt"] --> Scanner["<b>SkillSpector Sentinel</b><br/>(tools/skillspector.py)"]
-    
-    subgraph Vectors["71 Detection Vectors across 17 Categories"]
-        V1["Prompt Injection & Jailbreaks (P1-P4, P9)"]
-        V2["Data Exfiltration & Sinks (E1-E5)"]
-        V3["Privilege Escalation (PE1-PE5)"]
-        V4["Agent Snooping (~/.claude, mcp.json) (AS1-AS3)"]
-        V5["Tool Poisoning & Homoglyphs (TP1-TP4)"]
-        V6["Behavioral AST & Deserialization (AST1-AST10)"]
-    end
-    
-    Scanner --> Vectors
-    Vectors --> ProhibitionGuard["<b>Prohibition Context Guard</b><br/>(Filters defensive documentation & negations)"]
-    ProhibitionGuard --> Score["Risk Scoring Engine (0 - 100)"]
-    Score --> Verdict{"Verdict Assessment"}
-    
-    Verdict -- "Score < 25" --> Pass["✅ SAFE: Permitted to Install"]
-    Verdict -- "25 <= Score < 60" --> Warn["⚠️ CAUTION: Manual Review Required"]
-    Verdict -- "Score >= 60 or CRITICAL" --> Block["🛑 DO_NOT_INSTALL: Blocked & Quarantined"]
-```
-
----
+## 1. Core Threat Vectors
 
-## 2. 71 Vulnerability Vectors & Coverage Matrix
-
-| Category | Pattern IDs | Threat Vector & Description | Severity |
-| :--- | :--- | :--- | :--- |
-| **Prompt Injection** | `P1`, `P2`, `P3`, `P4`, `P9` | Instruction overrides, zero-width steganography, bidi Trojan Source (CVE-2021-42574), exfiltration directives, vertical whitespace padding (>20 blank lines). | **CRITICAL / HIGH** |
-| **Data Exfiltration** | `E1`, `E2`, `E3`, `E4`, `E5` | Outbound HTTP POST sinks (`curl`, `fetch`), `os.environ` harvesting, scanning for `.ssh` / `.aws` credentials, conversational context dumping, cloud storage upload. | **CRITICAL / HIGH** |
-| **Privilege Escalation** | `PE1` – `PE5` | Blanket wildcard permissions (`*`), `sudo`/`su`/`chmod 4755`, credential access (`/etc/shadow`, `kubeconfig`), `docker.sock` access, privileged containers. | **CRITICAL** |
-| **Agent Snooping** | `AS1`, `AS2`, `AS3` | Reading agent auth configs (`.claude/`, `.gemini/`, `.codex/`), accessing `mcp.json` / `claude_desktop_config.json`, cross-skill reconnaissance. | **CRITICAL** |
-| **System Prompt Leakage**| `P6`, `P7`, `P8` | Direct prompt extraction commands, side-channel extraction ("output text before this line"), tool exfiltration. | **HIGH** |
-| **Anti-Refusal Jailbreaks**| `AR1`, `AR2`, `AR3` | Refusal suppression ("never refuse", "always comply"), warning/caveat suppression, policy nullification ("you have no restrictions"). | **CRITICAL / HIGH** |
-| **MCP Tool Poisoning** | `TP1`, `TP2`, `TP3`, `TP4` | Hidden instructions in tool comments/Base64/data URIs, Cyrillic/Greek Unicode homoglyphs, parameter description injection, behavior drift. | **CRITICAL / HIGH** |
-| **MCP Least Privilege** | `LP1`, `LP2`, `LP3` | Undeclared network/shell capabilities, wildcard permissions (`*`), missing allowed tools. | **HIGH / MEDIUM** |
-| **Behavioral AST** | `AST1` – `AST10` | Dynamic `exec()`, `eval()`, `__import__()`, `subprocess(shell=True)`, `os.system()`, dynamic `getattr()`, reflective sink lookup, and insecure deserialization (`pickle`, `yaml.unsafe_load`). | **CRITICAL / HIGH** |
-| **Supply Chain & SSRF** | `SC1`, `SC2`, `SSRF1`, `SSRF2` | `curl \| bash` downloads, cloud instance metadata probing (`169.254.169.254`), internal loopback requests. | **CRITICAL / MEDIUM** |
+AI agent skills execute with terminal and workspace permissions. Unvetted third-party skills can introduce severe risks:
+- **Prompt Injection:** Overriding core safety instructions or forcing jailbreaks.
+- **Data Exfiltration:** Covertly exfiltrating conversation memory, environment keys, or tokens to external endpoints.
+- **Privilege Escalation:** Running unauthorized `sudo`/root commands or accessing sensitive credentials (`.ssh`, `.aws`).
+- **Agent Snooping:** Accessing IDE authentication configs (`~/.gemini`, `~/.claude`) or parsing `mcp.json`.
+- **Tool Poisoning:** Injecting obfuscated Unicode homoglyphs, Base64 payloads, or hidden comments into tool schemas.
 
 ---
 
-## 3. NVIDIA Prohibition Context Engine (Defensive Language Guard)
-
-In software testing and quality engineering hubs, security rules and documentation frequently describe anti-patterns (e.g., *"Never use eval()"*, *"Strictly forbidden: do not run sudo"*).
+## 2. Threat Vector Categories
 
-**SkillSpector Sentinel incorporates the NVIDIA Prohibition Context Engine:**
-1. **Direct Negative Imperatives:** Matches governed by preceding negations (`never`, `do not`, `don't`, `must not`, `strictly forbidden`, `avoid`) are exempted.
-2. **Defensive Callouts:** Patterns appearing inside `> [!CAUTION]`, `> [!WARNING]`, or `> [!IMPORTANT]` documentation blocks do not trigger false alerts.
-3. **Emoji ZWJ Preservation:** Legitimate Zero-Width Joiner emoji sequences (e.g. `👨‍👩‍👧‍👦`, `🏳️‍🌈`) are preserved, while standalone steganographic zero-width bytes are flagged.
-4. **Request-Anchored SSRF:** Localhost references in documentation or comments are ignored; only active request-issuing functions (`fetch('http://localhost...')`, `curl`) trigger SSRF checks.
+| Category | Description | Severity |
+| :--- | :--- | :--- |
+| **Prompt Injection** | Instruction overrides, zero-width steganography, bidi Trojan Source, exfiltration directives. | **CRITICAL** |
+| **Data Exfiltration** | Outbound HTTP POST sinks (`curl`, `fetch`), harvesting `os.environ`, scanning credentials. | **CRITICAL** |
+| **Privilege Escalation** | Wildcard permissions (`*`), `sudo`/`su`, `/etc/shadow`, Docker socket access. | **CRITICAL** |
+| **Agent Snooping** | Reading agent auth configs (`.gemini/`, `.claude/`), extracting `mcp.json` tokens. | **CRITICAL** |
+| **Behavioral AST** | Dynamic `exec()`, `eval()`, `__import__()`, `subprocess(shell=True)`, `os.system()`, insecure deserialization (`pickle`). | **CRITICAL / HIGH** |
+| **Supply Chain & SSRF** | `curl \| bash` downloads, cloud instance metadata probing (`169.254.169.254`). | **CRITICAL** |
 
 ---
 
-## 4. Operational Runbook & CLI Usage
+## 3. Defense Guard & Prohibition Context
 
-### 1. Autonomous Pre-Install Audit
-Before loading or installing any new skill, rule, or MCP tool into the environment, run:
-```bash
-# Scan a single skill file or directory
-python3 tools/skillspector.py path/to/skill/
+To prevent false alarms in educational documentation (e.g. *"Never run sudo"*):
+1. **Negative Imperatives:** Matches preceded by negations (`never`, `do not`, `avoid`, `forbidden`) are recognized as defensive rules.
+2. **Defensive Callouts:** Patterns appearing inside `> [!WARNING]` or `> [!CAUTION]` blocks are evaluated with contextual negative verbs.
+3. **Emoji ZWJ Handling:** Legitimate Zero-Width Joiner sequences are preserved while hidden steganographic bytes are flagged.
 
-# Or using the agent-qa unified CLI:
-agent-qa skillspector path/to/skill/
+---
 
-# Or via npx (zero-install):
-npx synapse-hub skillspector path/to/skill/
-```
+## 4. CLI Audit Commands
 
-### 2. Multi-Format Reporting for CI/CD
 ```bash
-# Generate GitHub Actions SARIF format (Security Tab integration)
-python3 tools/skillspector.py .agents/skills/ --format sarif --output reports/skillspector.sarif
+# Scan a specific candidate skill or file
+synapse skillspector path/to/SKILL.md
 
-# Generate JSON for automated policy gating
-python3 tools/skillspector.py .agents/skills/ --format json --output reports/skillspector.json
+# Scan entire skills directory
+synapse skillspector --scan-skills
 
-# Strict gating: Exit with error code 1 if any CRITICAL or DO_NOT_INSTALL findings exist
-python3 tools/skillspector.py .agents/skills/ --strict
+# Fail CI pipeline if high or critical risks are detected
+synapse skillspector --scan-skills --strict
 ```
-
-### 3. Verdict Interpretation & Action Table
-
-| Risk Score | Verdict | Permitted Action | Mandatory Remediation |
-| :---: | :---: | :---: | :--- |
-| **0 – 24** | **`SAFE`** | ✅ Install & execute freely. | No remediation required; skill is verified clean. |
-| **25 – 59** | **`CAUTION`** | ⚠️ Hold for manual inspection. | Inspect flagged lines; replace unpinned dependencies or wildcards. |
-| **60 – 100** | **`DO_NOT_INSTALL`** | 🛑 Blocked immediately. | Quarantined. Contains active prompt injection, RCE sink, or credential theft. |
-
----
-
-## 5. Acknowledgments & Upstream Attribution
-
-This skill and its underlying inspection engine (`tools/skillspector.py`) are directly based on the research, pattern definitions, and defensive grammar created by the **NVIDIA AI Security Team** in **[NVIDIA/SkillSpector](https://github.com/NVIDIA/SkillSpector)** (Apache License 2.0).

package/.agents/skills/skillspector-security-guard/examples/safe_mcp_config.json

@@ -0,0 +1,12 @@
+{
+  "mcpServers": {
+    "playwright-live": {
+      "command": "npx",
+      "args": [
+        "-y",
+        "@modelcontextprotocol/server-playwright"
+      ],
+      "sandboxPolicy": "HEADLESS_VIRTUAL_DISPLAY"
+    }
+  }
+}

package/.agents/skills/surgical-coding-principles/SKILL.md

@@ -0,0 +1,89 @@
+---
+name: surgical-coding-principles
+description: "Enforce four behavioral principles (Think Before Coding, Simplicity First, Surgical Changes, Goal-Driven Execution) when writing or modifying test automation code. Use when implementing Page Classes, editing test scripts, or changing hub tools to prevent assumption drift and over-engineering."
+---
+
+# Surgical Coding Principles — Enterprise Minimal-Diff Discipline
+
+Specialized skill for reducing the three classic LLM coding failure modes — silent assumptions, over-engineering, and out-of-scope edits — across Page Classes, test scripts, and `tools/*.py` maintenance.
+
+---
+
+## 1. The Four Principles
+
+```mermaid
+flowchart LR
+    A["<b>1. Think Before Coding</b><br/>State assumptions, surface ambiguity"] --> B["<b>2. Simplicity First</b><br/>Minimum code, nothing speculative"]
+    B --> C["<b>3. Surgical Changes</b><br/>Every diff line traces to the request"]
+    C --> D["<b>4. Goal-Driven Execution</b><br/>Success criteria verified before done"]
+```
+
+**Tradeoff:** these principles bias toward caution over speed. For trivial, single-line fixes, apply judgment and do not ritualize.
+
+## 2. Principle 1: Think Before Coding
+
+- **Rule:** Do not assume; do not hide confusion. Before implementing, state assumptions explicitly and ask when uncertain.
+- **Enforcement:**
+  - If multiple interpretations of the request exist, present them — never pick silently.
+  - If a simpler approach exists, say so before writing code; push back when warranted.
+  - If something is unclear, stop, name what is confusing, and ask. Proceeding on a guess converts one clarification into one full rework cycle.
+
+## 3. Principle 2: Simplicity First
+
+- **Rule:** Write the minimum code that solves the stated problem. Nothing speculative.
+- **Forbidden:** features beyond what was asked; abstractions for single-use code; "flexibility" or configurability that was not requested; error handling for impossible scenarios.
+- **Self-test:** if 200 lines were written and 50 would do, rewrite. Ask: "Would a senior engineer call this overcomplicated?" If yes, simplify before continuing.
+
+## 4. Principle 3: Surgical Changes
+
+- **Rule:** Touch only what the request requires. Clean up only the mess your own change created.
+- **When editing existing code (Page Classes, test scripts, hub tools):**
+  - Do not "improve" adjacent code, comments, or formatting.
+  - Do not refactor what is not broken; match the existing style even if you would write it differently.
+  - If unrelated dead code is noticed, mention it in the report — do not delete it.
+- **Orphan rule:** remove imports, variables, or functions that YOUR change made unused; leave pre-existing dead code untouched unless asked.
+- **The test:** every changed line must trace directly to the user's request.
+
+## 5. Principle 4: Goal-Driven Execution
+
+- **Rule:** Transform every task into a verifiable goal with explicit success criteria, then loop until verified.
+- **Rewrites:** "add validation" becomes "write tests for invalid inputs, then make them pass"; "fix the bug" becomes "write a test that reproduces it, then make it pass" (pair with `test-driven-development`).
+- **Multi-step tasks** state a plan where every step carries its own verify action:
+
+| Step | Verify |
+|---|---|
+| 1. Modify the Page Class method | Selector verified live under 200ms (`playwright-live-interaction`) |
+| 2. Update the calling scripts | Affected TCs pass via `tools/test_impact.py` subset |
+| 3. Hub tool change | `python3 tools/verify_all.py --mode hub` reports 9/9 gates |
+
+Strong success criteria allow independent looping; weak criteria ("make it work") force constant clarification.
+
+## 6. Pre-Diff Self-Check
+
+Before handing back any change, verify all boxes:
+
+- [ ] Assumptions were stated before implementation started
+- [ ] No speculative abstraction, option, or config was introduced
+- [ ] Every changed line traces to the request
+- [ ] Orphans created by this change were removed; pre-existing dead code was left alone
+- [ ] Success criteria were defined up front and verified with real command output
+
+These principles are working if diffs shrink, rewrites due to overcomplication disappear, and clarifying questions arrive before implementation instead of after mistakes.
+
+## 7. Boundary vs Sibling Skills (Do Not Confuse)
+
+| Sibling | Owns | Hand-off |
+|---|---|---|
+| `clean-pom-crafter` | Page Class architecture, locator tiers | This skill governs HOW the change is made, not WHAT the POM looks like |
+| `code-refactoring-refactor-clean` | Deliberate debt-elimination refactors | A refactor task still obeys surgical scope: diff lines trace to the refactor request |
+| `lean-code-ladder` | The 7-rung reuse-first decision ladder | Use the ladder to choose the solution; use this skill to keep the diff disciplined |
+
+## 8. Reference Documentation
+
+- `python3 tools/verify_all.py --mode hub` — 9 Quality Gates as the verification anchor for Goal-Driven Execution.
+- `python3 tools/test_impact.py --git-diff` — scope the blast radius of a change before editing.
+- `python3 tools/infer_linter.py` — confirm no fake-pass assertions were introduced by the change.
+
+## 9. Attribution
+
+Adapted from **andrej-karpathy-skills** (https://github.com/multica-ai/andrej-karpathy-skills) — MIT License (declared in repository `plugin.json`), by forrestchang, derived from Andrej Karpathy's published observations on LLM coding pitfalls. Principles re-scoped for enterprise QA automation in Synapse Hub; wording, structure, and examples modified.

package/.agents/skills/surgical-coding-principles/examples/surgical_vs_scope_creep.md

@@ -0,0 +1,46 @@
+# Example: Surgical Change vs Scope Creep
+
+Request: "The `verifyKPI` step in the report test is flaky because it asserts on a live-computed percentage; make it deterministic."
+
+## GOOD — every line traces to the request
+
+```text
+Changed:
+- tests/TC-305_ExportReport: replace live percentage comparison with a
+  fixture-backed expected value passed via test data.
+- Test data: add deterministic expected KPI values for the report fixture.
+
+Removed (orphans of this change):
+- unused import of the random helper previously used for sample values.
+```
+
+Why it passes: two touched files, both directly required by the request; the
+orphan removed was created by this very change.
+
+## BAD — scope creep
+
+```text
+Changed:
+- tests/TC-305_ExportReport: deterministic assertion (requested)
+- tests/TC-118_Login: "improved" waiting strategy while passing by
+- page objects: reformatted indentation and reworded comments
+- tools/distill_log.py: renamed a variable that "looked confusing"
+```
+
+Why it fails the Surgical Changes test:
+- TC-118 was not part of the request — a drive-by change hides risk inside an
+  unrelated diff.
+- Comment/formatting rewrites bloat the diff and bury the actual fix in review.
+- Renaming inside a hub tool was not requested; pre-existing code is left
+  alone and mentioned in the report instead.
+
+## Assumption surfacing (Think Before Coding)
+
+Before implementing, the GOOD flow states:
+
+> "Assumption: the fixture data can express the expected KPI as an exact value.
+> If the report computes values the fixture cannot predict, I will need a
+> fixture extension — confirming before I change the test data schema."
+
+The BAD flow silently assumes the fixture is sufficient and discovers the
+schema gap after the diff is already written.