torusguard 0.9.2

package/skills/torusguard-init/SKILL.md

@@ -0,0 +1,52 @@
+---
+name: torusguard-init
+description: Initialize TorusGuard workspace — detect project stack, activate tailored TG-* security rules, and generate SECURITY.md baseline.
+version: 0.9.2
+workflow: .torusguard/workflows/init.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/stack_detect.py
+---
+
+# TorusGuard Init — Project Stack Discovery & Rule Activation
+
+## Objective
+Auto-detect repository technology stack via indicators or `stack_detect.py`, activate framework-tailored `TG-*` security rules into `.torusguard/rules/active/`, and provision `torusguard.json` and `SECURITY.md`.
+
+---
+
+## Pre-Flight Check
+1. Verify `.torusguard/` layout (`config/`, `rules/active/`, `runs/`, `scripts/`, `workflows/`, `templates/`, `schemas/`).
+2. If missing, unpack via `python skills/torusguard/bootstrap.py --target .`.
+3. Check existing `.torusguard/config/torusguard.json` before overwriting.
+
+---
+
+## Execution Steps
+
+1. **Stack Detection:** Run `python .torusguard/scripts/stack_detect.py .` to detect:
+   - Python: Django (`manage.py`), FastAPI (`fastapi`), Flask (`flask`), SQLAlchemy.
+   - Node: Next.js (`"next"`), Express (`"express"`), React/Vite (`"vite"`).
+   - BaaS: Supabase (`@supabase/supabase-js`), Firebase (`firebase-admin`).
+2. **Emit Stack Record:** Log detected language, framework, ORM, and client SDKs.
+3. **Activate Tailored Rules:** Copy matching `TG-*` rules from `.torusguard/rules/` into `.torusguard/rules/active/`.
+4. **Provision Policy:** Create `SECURITY.md` if absent, configuring responsible disclosure contacts.
+5. **Write Configuration:** Persist detected stack and active rules count to `.torusguard/config/torusguard.json`.
+
+---
+
+## Safety Constraints
+- Never overwrite custom rules in `.torusguard/rules/active/` without prompt.
+- Retain existing `SECURITY.md` if already established by repository owners.
+- Strictly read-only detection against source files.
+
+---
+
+## Output Format
+```markdown
+🛡️ [TorusGuard] Workspace Initialized
+- Primary Stack: <Detected Stack> | Components: <Backend/Frontend/DB>
+- Active Rules: <Count> rules enabled in `.torusguard/rules/active/`
+- Configuration: `.torusguard/config/torusguard.json` written
+Next: Run `/torusguard audit` to execute static security scan.
+```

package/skills/torusguard-recheck/SKILL.md

@@ -0,0 +1,53 @@
+---
+name: torusguard-recheck
+description: Execute targeted differential AST re-scan against modified files, verify fix closure, and assert zero regressions.
+version: 0.9.2
+workflow: .torusguard/workflows/recheck.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/run_manager.py
+  - .torusguard/scripts/finding_scorer.py
+---
+
+# TorusGuard Recheck — Targeted Differential Audit & Regression Verification
+
+## Objective
+Re-scan only files modified by remediation patches, confirming that targeted vulnerability sinks have been neutralized and verifying that no new security regressions were introduced.
+
+---
+
+## Execution Steps
+
+1. **Identify Modified Files:** Read `apply-log.json` from active run directory.
+2. **Execute Differential Scan:** Re-run active `TG-*` rules exclusively against the modified files.
+3. **Evaluate Finding Status:** Transition finding state according to transition rules below.
+4. **Assert Regression-Free:** Ensure no new security warnings triggered on altered lines.
+5. **Update State:** Record verified status in `findings.json`.
+6. **Emit Recheck Report:** Save summary in `.torusguard/runs/<run_id>/recheck-report.md`.
+
+---
+
+## State Transition Rules
+- **`Fixed`:** Targeted vulnerable AST pattern is absent and no new issues appear on modified lines.
+- **`Partially Fixed`:** Vulnerability surface was reduced but sanitization remains incomplete.
+- **`Not Fixed`:** Vulnerable AST sink remains present in patched file.
+- **`Regression`:** Patch introduced a new security rule violation on modified lines.
+
+---
+
+## Safety Constraints
+- Restrict AST scan strictly to modified files and direct callers.
+- If regression is detected, halt and recommend immediate rollback via `.bak` snapshot.
+- Read-only differential analysis.
+
+---
+
+## Output Format
+```markdown
+✅ [TorusGuard] Differential Recheck Completed
+- Modified Files Scanned: <Count>
+- Target Finding: <Finding ID> ──► FIXED
+- Regressions Detected: 0
+- Report: `.torusguard/runs/<run_id>/recheck-report.md`
+Next: Run `/torusguard report` to export final SARIF and release summary.
+```

package/skills/torusguard-report/SKILL.md

@@ -0,0 +1,54 @@
+---
+name: torusguard-report
+description: Generate unified security posture reports and export OASIS SARIF v2.1.0 logs for CI/CD integration.
+version: 0.9.2
+workflow: .torusguard/workflows/report.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/sarif_exporter.py
+  - .torusguard/scripts/run_manager.py
+---
+
+# TorusGuard Report — Unified Security Posture Report & SARIF Export
+
+## Objective
+Aggregate findings, verification traces, and recheck results into a signed executive security summary and export schema-compliant OASIS SARIF v2.1.0 logs for CI/CD pipelines.
+
+---
+
+## Execution Steps
+
+1. **Aggregate Run Data:** Read findings, verified evidence, and recheck records from active run.
+2. **Export OASIS SARIF v2.1.0:**
+   ```bash
+   python .torusguard/scripts/sarif_exporter.py --run <run_dir> --output <run_dir>/results.sarif
+   ```
+3. **Compile Executive Markdown Report:** Generate `report.md` with posture score, open/closed finding tables, and risk breakdown.
+4. **Update Run Manifest:** Finalize `manifest.json` status counts.
+5. **Archive Release Artifacts:** Ensure `report.md` and `results.sarif` are serialized to disk.
+
+---
+
+## SARIF v2.1.0 Output Specification
+- **Version:** `$schema: https://docs.oasis-open.org/sarif/sarif/v2.1.0/cos02/schemas/sarif-schema-2.1.0.json`, `version: 2.1.0`.
+- **Tool Driver:** `name: TorusGuard`, `semanticVersion: 0.9.2`, full rules catalog in `driver.rules`.
+- **Category Hygiene:** Set `automationDetails.id: "torusguard/static"` to avoid collisions in multi-analysis CI.
+- **Fingerprinting:** Populate `partialFingerprints.primaryLocationLineHash` with SHA-256 context hash.
+
+---
+
+## Safety Constraints
+- Redact all tokens, passwords, and API keys before saving report.
+- Strictly read-only reporting; no source code modifications.
+- Ensure SARIF passes JSON schema validation.
+
+---
+
+## Output Format
+```markdown
+📊 [TorusGuard] Security Posture Report Emitted
+- Run ID: <Run ID> | Posture Score: <Score>/100
+- Findings: <Total> (<Fixed> Fixed · <Open> Open)
+- SARIF Export: `.torusguard/runs/<run_id>/results.sarif`
+- Executive Report: `.torusguard/runs/<run_id>/report.md`
+```

package/skills/torusguard-status/SKILL.md

@@ -0,0 +1,42 @@
+---
+name: torusguard-status
+description: Display current TorusGuard security posture, active configuration, rules catalog, and run history.
+version: 0.9.2
+workflow: .torusguard/workflows/status.md
+tools: Read, Grep, Glob
+scripts-binding:
+  - .torusguard/scripts/run_manager.py
+---
+
+# TorusGuard Status — Workspace Security Posture & Diagnostic Overview
+
+## Objective
+Provide an instant diagnostic summary of the repository's security state, active framework rules, historical run results, and runtime scope validity.
+
+---
+
+## Execution Steps
+
+1. **Read Configuration:** Parse `.torusguard/config/torusguard.json` to verify initialization state and detected framework stack.
+2. **Enumerate Active Rules:** Count rule files physically present in `.torusguard/rules/active/`.
+3. **Inspect Run History:** List historical run folders in `.torusguard/runs/` via `run_manager.py`.
+4. **Check Authorization Scope:** Check `.torusguard/config/scope.json` for active targets and TTL expiration.
+5. **Render Diagnostic Overview:** Output formatted status card.
+
+---
+
+## Safety Constraints
+- Read-only execution; zero file modifications.
+- Handle uninitialized workspaces gracefully with advice to run `/torusguard init`.
+
+---
+
+## Output Format
+```markdown
+🛡️ [TorusGuard] Workspace Status Overview
+- Version: v0.9.2 | Stack: <Detected Framework>
+- Active Rules: <Count> rules active in `.torusguard/rules/active/`
+- Historical Runs: <Count> runs recorded
+- Scope: <Authorized (TTL Active) / Expired / Unconfigured>
+- Posture: <SECURE / ACTION REQUIRED>
+```

package/skills/torusguard-verify/SKILL.md

@@ -0,0 +1,55 @@
+---
+name: torusguard-verify
+description: Verify finding evidence sufficiency, audit live code line matches, and calibrate 0–100 confidence scores.
+version: 0.9.2
+workflow: .torusguard/workflows/verify.md
+tools: Read, Grep, Glob, Write
+scripts-binding:
+  - .torusguard/scripts/finding_scorer.py
+---
+
+# TorusGuard Verify — Finding Evidence Verification & Calibration
+
+## Objective
+Audit the evidence sufficiency of candidate findings by reading current disk lines, evaluating unbroken taint source-to-sink flow, filtering false alarms, and calibrating final 0–100 confidence scores.
+
+---
+
+## Execution Steps
+
+1. **Locate Target Findings:** Load active findings from `.torusguard/runs/<latest-run>/findings.md`.
+2. **Live Disk Line Match:** Inspect exact cited lines using `view_file` to confirm code presence.
+3. **Audit Evidence Sufficiency:** Verify source-to-sink flow against criteria below.
+4. **Calibrate Confidence Score:**
+   ```bash
+   python .torusguard/scripts/finding_scorer.py --run <run_dir> --verify
+   ```
+5. **Update State:** Mark finding as `Confirmed`, `Needs Review`, or `False Positive`.
+6. **Emit Verified Evidence:** Save report in `.torusguard/runs/<run_id>/verified-evidence.md`.
+
+---
+
+## Evidence Sufficiency
+A finding is verified as sufficient when:
+- **Direct AST Match:** The vulnerable API or sink call exists on disk at the cited location.
+- **Exposed Surface:** The sink is reachable from an external route, view, or public method.
+- **Absence of Sanitizer:** No escaping function, parameterization, or validating middleware neutralizes the input.
+- **Taint Integrity:** Untrusted request data flows into the sink without structural validation.
+
+---
+
+## Safety Constraints
+- Read-only analysis; no files are modified.
+- Never guess line numbers; always verify via active disk read.
+- Downgrade findings with sanitizer presence to `False Positive`.
+
+---
+
+## Output Format
+```markdown
+🧪 [TorusGuard] Finding Verification Complete
+- Findings Audited: <Count> | Confirmed Real: <Count>
+- False Positives Filtered: <Count> | Refined Mean Score: <Score>/100
+- Artifact: `.torusguard/runs/<run_id>/verified-evidence.md`
+Next: Run `/torusguard harden` to formulate surgical fixes for confirmed flaws.
+```

package/skills/torusguard-web-validate/SKILL.md

@@ -0,0 +1,64 @@
+---
+name: torusguard-web-validate
+description: Execute authorized HTTP probing against local/staging web applications — session capture, transparent audit headers, and secret redaction.
+version: 0.9.2
+workflow: .torusguard/workflows/web-validate.md
+tools: Read, Grep, Glob, Bash, Write
+scripts-binding:
+  - .torusguard/scripts/safety_gate.py
+---
+
+# TorusGuard Web Validate — Bounded HTTP Probing & Session Capture
+
+## Objective
+Safely probe live web applications within authorized scope, injecting transparent audit headers, verifying security headers and cookies, redacting sensitive tokens, and recording deterministic replay traces.
+
+---
+
+## Authorization Gate Check
+Before dispatching any HTTP request:
+1. Verify `.torusguard/config/scope.json` exists and contains target URL.
+2. Confirm current timestamp is prior to `expires_at` TTL.
+3. Assert target is local or non-production staging.
+
+---
+
+## Safety Gate
+All requests pass through `.torusguard/scripts/safety_gate.py`:
+- `Auto-Allowed`: Read-only `GET`, `HEAD`, `OPTIONS` on non-sensitive paths.
+- `Approval Required`: Requests touching auth, sessions, or parameters.
+- `Manual Only`: Any destructive method (`DELETE`, `DROP`) is strictly blocked.
+
+---
+
+## Execution Steps
+
+1. **Gate Check:** Validate scope in `scope.json` and query `safety_gate.py`.
+2. **Inject Audit Header:** Attach `X-TorusGuard-AuthID: <auth_id>` to all outbound requests.
+3. **Dispatch Bounded Probe:** Send single non-destructive HTTP request.
+4. **Validate Security Headers:** Check for CSP, HSTS, X-Content-Type-Options, and CORS configurations.
+5. **Audit Cookie Flags:** Verify `HttpOnly`, `Secure`, and `SameSite` on session cookies.
+6. **Capture Replay Trace:** Save sanitized trace in `.torusguard/runs/<run_id>/requests.json`.
+
+---
+
+## Credential Redaction
+All Bearer tokens, cookies, passwords, and API keys are redacted prior to disk serialization (`Bearer [REDACTED]`).
+
+---
+
+## Safety Constraints
+- Max 50 requests per validation session.
+- Never test unauthorized domains or third-party APIs.
+- Zero state-changing destructive operations.
+
+---
+
+## Output Format
+```markdown
+🌐 [TorusGuard] Web Validation Completed
+- Target: <Host URL> | Endpoints Tested: <Count>
+- Header Posture: <CSP/HSTS Status> | Cookies: <Flags Status>
+- Replay Trace: `.torusguard/runs/<run_id>/requests.json`
+Next: Run `/torusguard exploit-check` to confirm exploitability of candidate flaws.
+```