torusguard 1.3.6 → 2.0.0-alpha

package/skills/torusguard/payload/workflows/torusguard-web-validate.md

@@ -0,0 +1,96 @@
+---
+description: Authorized HTTP probing, token redaction, transparent audit header injection, and replay trace capture.
+tools: Read, Grep, Glob, Bash, Write
+version: 1.3.6
+agent: validator
+lifecycle-phase: Phase 3b (Runtime Web Validation)
+required-skills:
+  - torusguard-web-validate
+scripts-binding:
+  - .torusguard/scripts/report_sync.py
+  - .torusguard/scripts/safety_gate.py
+---
+
+# /torusguard web-validate — Bounded HTTP Probing & Session Capture
+
+$ARGUMENTS
+
+---
+
+## Objective
+Authorized HTTP probing, token redaction, transparent audit header injection, and replay capture.
+
+---
+
+## Mandatory Pre-Flight Context Inspection
+
+Inspect authorization parameters and safety limits before sending HTTP requests:
+1. **Active Scope (`.torusguard/config/scope.json`):** Assert target host and path are authorized with valid TTL.
+2. **Safety Gate Classification:** Test proposed endpoint against `.torusguard/scripts/safety_gate.py`.
+3. **Sensitive Route Guard:** Ensure destructive endpoints (`DELETE`, account drops) are never called automatically.
+4. **Token Redaction Pipeline:** Ensure bearer tokens and session cookies are masked (`Bearer [REDACTED]`).
+5. **Request Budget:** Enforce maximum cap of 50 requests per validation session.
+
+---
+
+## When to Use /torusguard web-validate
+
+| Trigger Scenario | Recommended Action |
+| :--- | :--- |
+| Testing live route accessibility and security headers | Run `/torusguard web-validate` |
+| Verifying cookie security flags (`HttpOnly`, `Secure`, `SameSite`) | Run `/torusguard web-validate` |
+| Checking CORS headers and authentication barriers | Run `/torusguard web-validate` |
+| Pure static source code analysis | Run `/torusguard audit` |
+| Confirming exploitable attack vectors | Run `/torusguard exploit-check` |
+
+---
+
+## Execution Steps
+
+1. **Verify Legal Scope:** Check target URL against `.torusguard/config/scope.json`.
+2. **Invoke Safety Gate:**
+   ```bash
+   python .torusguard/scripts/safety_gate.py check --url <target_url> --method GET
+   ```
+3. **Dispatch Non-Destructive Probe:** Send bounded HTTP request with audit header `X-TorusGuard-AuthID`.
+4. **Redact Sensitive Headers:** Sanitize auth tokens and credentials in request and response objects.
+5. **Write Replay Artifacts:**
+   Record sanitized trace in `.torusguard/runs/<run_id>/requests.json` and emit `web-validation.md`.
+
+---
+
+## Failure Recovery
+
+- **Target Offline:** Verify local dev server is active and accessible on designated host port.
+- **Safety Gate Rejection (Manual Only):** Halt probe immediately; report endpoint requires human manual test.
+- **Rate Limit / 429:** Back off exponentially (1s, 2s, 4s); stop session if 429 persists.
+- **Halt Trigger:** Abort if target domain deviates from authorized allowlist in `scope.json`.
+
+---
+
+## Hallucination Guard
+
+- ❌ Never dispatch HTTP requests outside domains explicitly listed in `.torusguard/config/scope.json`.
+- ❌ Never write raw Authorization headers or plaintext secrets to disk.
+- ✅ Always include transparent audit headers (`X-TorusGuard-AuthID`).
+
+---
+
+## Output Card Format
+
+```markdown
+### 🌐 TorusGuard Web Validation
+- **Target Host:** [Host URL]
+- **Endpoints Probed:** [Count] routes tested
+- **Security Headers:** [CSP / HSTS / CORS status]
+- **Cookie Security:** [HttpOnly / Secure / SameSite status]
+- **Replay Trace:** `.torusguard/runs/<run_id>/replay.json`
+- **Status:** COMPLETED — non-destructive probe finished
+```
+
+---
+
+## Next Steps
+
+1. Run `/torusguard exploit-check` to confirm if reachable flaws constitute verified exploits.
+2. Run `/torusguard harden` to build surgical remediation diffs.

package/skills/torusguard/payload/workflows/torusguard.md

@@ -0,0 +1,19 @@
+---
+description: TorusGuard Autonomous Security Command Engine — run static security audits, authorized runtime web validation, governed remediation, and SARIF exports.
+version: 1.3.6
+tools: Read, Grep, Glob, Bash, Edit, Write
+agent: auditor
+---
+
+# /torusguard — Autonomous Application Security Guardrails
+
+$ARGUMENTS
+
+## Objective
+Execute TorusGuard security workflows across polyglot codebases (Python, TypeScript, Go, Rust, Java, C#, PHP, and 16+ ecosystems) using either AI chat slash commands or dedicated terminal CLI commands.
+
+## Execution
+Parse the requested action from `$ARGUMENTS` (e.g. `audit`, `verify`, `web-validate`, `exploit-check`, `harden`, `apply`, `rollback`, `recheck`, `recipes`, `report`, `status`, `init`):
+1. **If action is omitted or 'status':** View `.torusguard/workflows/status.md` and report posture (or run `npx torusguard status`).
+2. **If action is specified:** Load the dedicated workflow from `.torusguard/workflows/<action>.md` and matching skill from `skills/torusguard-<action>/SKILL.md` (or run equivalent CLI command: `npx torusguard <action>`).
+3. Follow the phase execution steps defined in the workflow.