torusguard 1.4.0 → 2.1.0

package/skills/torusguard/payload/agents/validator.md

@@ -1,46 +1,46 @@
----
-name: validator
-role: Authorized Runtime Validation & Exploitability Confirmation Specialist
-lifecycle_phase: Validate (Phase 3)
-version: 0.8.0
-tools: [Read, Curl, Bash, WebFetch]
----
-
-# TorusGuard Validator Agent
-
-The **Validator** executes authorized, bounded runtime probes against running applications to verify practical exploitability. It proves whether static findings can actually be reached and triggered in practice, capturing redacted HTTP/browser evidence and replayable validation traces.
-
----
-
-## Responsibilities
-
-1. **Authorization Gate Enforcement:**
-   - Verify that `.torusguard/config/scope.json` exists, is active, confirmed by the target owner, and includes the requested host and path prefix before dispatching any network probe.
-2. **Safety Gate Classification:**
-   - Classify all prospective probes before execution:
-     - `Auto-Allowed`: Non-state-changing read queries (GET, OPTIONS, HEAD).
-     - `Approval Required`: Canaries with test markers, authenticated probes.
-     - `Manual Only`: Destructive verbs (DELETE, mass writes, admin drops) — strictly blocked from automated execution.
-3. **Bounded Exploitability Probing:**
-   - Confirm practical reachability for approved vulnerability classes (IDOR, auth bypass, header trust injection, reflected sentinels).
-   - Use non-destructive, verifiable canaries (e.g. `torusguard-probe-token-safe`).
-4. **Evidence Capture & Token Redaction:**
-   - Record raw request/response pairs into `requests.json` and `responses.json`.
-   - Automatically redact authorization headers, passwords, bearer tokens, and session cookies.
-5. **Formal Exploitability Status Classification:**
-   - Assign one of 5 formal verdicts:
-     - `Runtime Confirmed` (Indisputable proof with sensitive marker)
-     - `Runtime Likely` (Strong runtime indicators)
-     - `Needs Manual Review` (Inconclusive or complex boundary)
-     - `Not Reproducible in Scope` (Guarded by gateway/middleware)
-     - `Blocked by Environment / Controls` (Safety gate halted probe)
-6. **Replay Trace Construction:**
-   - Generate `replay.json` and `replay.md` for deterministic re-execution.
-
----
-
-## Safety Constraints
-
-- **No Unauthorized Probes:** Probes targeting hosts or paths outside `scope.json` are strictly forbidden.
-- **Zero Destruction Policy:** Never execute payloads that mutate production databases, delete assets, or cause denial of service.
-- **No Cleartext Credentials:** Redact all sensitive tokens before serializing evidence to disk.
+---
+name: validator
+role: Authorized Runtime Validation & Exploitability Confirmation Specialist
+lifecycle_phase: Validate (Phase 3)
+version: 0.8.0
+tools: [Read, Curl, Bash, WebFetch]
+---
+
+# TorusGuard Validator Agent
+
+The **Validator** executes authorized, bounded runtime probes against running applications to verify practical exploitability. It proves whether static findings can actually be reached and triggered in practice, capturing redacted HTTP/browser evidence and replayable validation traces.
+
+---
+
+## Responsibilities
+
+1. **Authorization Gate Enforcement:**
+   - Verify that `.torusguard/config/scope.json` exists, is active, confirmed by the target owner, and includes the requested host and path prefix before dispatching any network probe.
+2. **Safety Gate Classification:**
+   - Classify all prospective probes before execution:
+     - `Auto-Allowed`: Non-state-changing read queries (GET, OPTIONS, HEAD).
+     - `Approval Required`: Canaries with test markers, authenticated probes.
+     - `Manual Only`: Destructive verbs (DELETE, mass writes, admin drops) — strictly blocked from automated execution.
+3. **Bounded Exploitability Probing:**
+   - Confirm practical reachability for approved vulnerability classes (IDOR, auth bypass, header trust injection, reflected sentinels).
+   - Use non-destructive, verifiable canaries (e.g. `torusguard-probe-token-safe`).
+4. **Evidence Capture & Token Redaction:**
+   - Record raw request/response pairs into `requests.json` and `responses.json`.
+   - Automatically redact authorization headers, passwords, bearer tokens, and session cookies.
+5. **Formal Exploitability Status Classification:**
+   - Assign one of 5 formal verdicts:
+     - `Runtime Confirmed` (Indisputable proof with sensitive marker)
+     - `Runtime Likely` (Strong runtime indicators)
+     - `Needs Manual Review` (Inconclusive or complex boundary)
+     - `Not Reproducible in Scope` (Guarded by gateway/middleware)
+     - `Blocked by Environment / Controls` (Safety gate halted probe)
+6. **Replay Trace Construction:**
+   - Generate `replay.json` and `replay.md` for deterministic re-execution.
+
+---
+
+## Safety Constraints
+
+- **No Unauthorized Probes:** Probes targeting hosts or paths outside `scope.json` are strictly forbidden.
+- **Zero Destruction Policy:** Never execute payloads that mutate production databases, delete assets, or cause denial of service.
+- **No Cleartext Credentials:** Redact all sensitive tokens before serializing evidence to disk.

package/skills/torusguard/payload/config/scope.json

@@ -1,24 +1,24 @@
-{
-  "$schema": "../schemas/authorization.schema.json",
-  "authorization": {
-    "target": "localhost",
-    "owner_confirmed": false,
-    "scope_type": "source_code_only",
-    "allowed_hosts": [
-      "localhost",
-      "127.0.0.1"
-    ],
-    "allowed_paths": [
-      "/api/*",
-      "/auth/*"
-    ],
-    "excluded_paths": [
-      "/admin/delete*",
-      "/system/shutdown*"
-    ],
-    "duration_hours": 24,
-    "authorized_at": null,
-    "authorized_by": null,
-    "notes": "Default authorization scope template. Run /torusguard authorize to activate for live targets."
-  }
-}
+{
+  "$schema": "../schemas/authorization.schema.json",
+  "authorization": {
+    "target": "localhost",
+    "owner_confirmed": false,
+    "scope_type": "source_code_only",
+    "allowed_hosts": [
+      "localhost",
+      "127.0.0.1"
+    ],
+    "allowed_paths": [
+      "/api/*",
+      "/auth/*"
+    ],
+    "excluded_paths": [
+      "/admin/delete*",
+      "/system/shutdown*"
+    ],
+    "duration_hours": 24,
+    "authorized_at": null,
+    "authorized_by": null,
+    "notes": "Default authorization scope template. Run /torusguard authorize to activate for live targets."
+  }
+}

package/skills/torusguard/payload/references/csharp-security.md

@@ -1,41 +1,41 @@
-# TorusGuard Skill Reference: C# & ASP.NET Core Security
-
-> **Loaded When:** A project is identified as a C# / .NET application (`*.csproj`, `*.sln`, ASP.NET Core detected).
-
----
-
-## 🛡️ Key Inspection Areas & Rules
-
-### 1. Authentication & Authorization
-* `TG-AUTH-001`: Ensure controllers and endpoints have `[Authorize]` attributes.
-* Prohibit unvetted `[AllowAnonymous]` on sensitive business logic or user data endpoints.
-
-### 2. Entity Framework Core & SQL Injection
-* `TG-INPUT-002`: Use LINQ expressions or `FromSqlInterpolated` with interpolated string syntax (EF Core converts parameters automatically).
-* Prohibit raw `FromSqlRaw` with un-parameterized string concatenations.
-* `TG-DB-004`: Configure Global Query Filters (`HasQueryFilter(e => e.TenantId == _currentTenant)`) for multi-tenant safety.
-
-### 3. Anti-Forgery & TLS
-* `TG-CSRF-001`: Ensure `[ValidateAntiForgeryToken]` or `[AutoValidateAntiforgeryToken]` is applied to POST/PUT/DELETE actions.
-* Prohibit `DangerousAcceptAnyServerCertificateValidator`.
-
----
-
-## 🛠️ Safe Patterns Summary
-
-```csharp
-// Safe Entity Framework Parameterized Query
-var user = await context.Users
-    .Where(u => u.Id == userId && u.TenantId == currentTenantId)
-    .FirstOrDefaultAsync();
-
-// Safe Global Query Filter in DbContext
-modelBuilder.Entity<Invoice>()
-    .HasQueryFilter(i => i.TenantId == _tenantProvider.GetTenantId());
-
-// Safe Controller Security
-[Authorize]
-[ApiController]
-[Route("api/[controller]")]
-public class InvoicesController : ControllerBase { ... }
-```
+# TorusGuard Skill Reference: C# & ASP.NET Core Security
+
+> **Loaded When:** A project is identified as a C# / .NET application (`*.csproj`, `*.sln`, ASP.NET Core detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Authentication & Authorization
+* `TG-AUTH-001`: Ensure controllers and endpoints have `[Authorize]` attributes.
+* Prohibit unvetted `[AllowAnonymous]` on sensitive business logic or user data endpoints.
+
+### 2. Entity Framework Core & SQL Injection
+* `TG-INPUT-002`: Use LINQ expressions or `FromSqlInterpolated` with interpolated string syntax (EF Core converts parameters automatically).
+* Prohibit raw `FromSqlRaw` with un-parameterized string concatenations.
+* `TG-DB-004`: Configure Global Query Filters (`HasQueryFilter(e => e.TenantId == _currentTenant)`) for multi-tenant safety.
+
+### 3. Anti-Forgery & TLS
+* `TG-CSRF-001`: Ensure `[ValidateAntiForgeryToken]` or `[AutoValidateAntiforgeryToken]` is applied to POST/PUT/DELETE actions.
+* Prohibit `DangerousAcceptAnyServerCertificateValidator`.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```csharp
+// Safe Entity Framework Parameterized Query
+var user = await context.Users
+    .Where(u => u.Id == userId && u.TenantId == currentTenantId)
+    .FirstOrDefaultAsync();
+
+// Safe Global Query Filter in DbContext
+modelBuilder.Entity<Invoice>()
+    .HasQueryFilter(i => i.TenantId == _tenantProvider.GetTenantId());
+
+// Safe Controller Security
+[Authorize]
+[ApiController]
+[Route("api/[controller]")]
+public class InvoicesController : ControllerBase { ... }
+```

package/skills/torusguard/payload/references/go-security.md

@@ -1,41 +1,41 @@
-# TorusGuard Skill Reference: Go Security
-
-> **Loaded When:** A project is identified as a Go application (`go.mod`, `go.sum`, or Go source files detected).
-
----
-
-## 🛡️ Key Inspection Areas & Rules
-
-### 1. Database & SQL Injection
-* `TG-INPUT-002`: Ensure raw queries use parameterized placeholders (`?`, `$1`), never `fmt.Sprintf` or string concatenation.
-* `TG-DB-004`: Enforce tenant isolation in GORM queries (`db.Where("tenant_id = ?", tenantID)`).
-
-### 2. TLS & Network Security
-* `TG-DIFF-001`: Prohibit `InsecureSkipVerify: true` in `tls.Config`. Always use valid root CA pools.
-* `TG-SSRF-001`: Validate outbound URLs before issuing `http.Get` or `http.Post`.
-
-### 3. Concurrency & Goroutine Safety
-* `TG-BIZ-001`: Ensure context cancellation propagation (`ctx.Done()`) to prevent goroutine leaks.
-* Use mutexes or channels to prevent data races on shared state.
-
-### 4. Input Validation & Path Traversal
-* `TG-INPUT-006`: Sanitize file paths with `filepath.Clean` and check `strings.HasPrefix(cleanPath, baseDir)`.
-
----
-
-## 🛠️ Safe Patterns Summary
-
-```go
-// Safe Parameterized Query
-row := db.QueryRowContext(ctx, "SELECT id, email FROM users WHERE id = ? AND tenant_id = ?", userID, tenantID)
-
-// Safe GORM Scoping
-var invoice Invoice
-result := db.Where("id = ? AND tenant_id = ?", invoiceID, currentTenantID).First(&invoice)
-
-// Safe TLS Client
-tlsConfig := &tls.Config{
-    MinVersion: tls.VersionTLS13,
-}
-client := &http.Client{Transport: &http.Transport{TLSClientConfig: tlsConfig}}
-```
+# TorusGuard Skill Reference: Go Security
+
+> **Loaded When:** A project is identified as a Go application (`go.mod`, `go.sum`, or Go source files detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Database & SQL Injection
+* `TG-INPUT-002`: Ensure raw queries use parameterized placeholders (`?`, `$1`), never `fmt.Sprintf` or string concatenation.
+* `TG-DB-004`: Enforce tenant isolation in GORM queries (`db.Where("tenant_id = ?", tenantID)`).
+
+### 2. TLS & Network Security
+* `TG-DIFF-001`: Prohibit `InsecureSkipVerify: true` in `tls.Config`. Always use valid root CA pools.
+* `TG-SSRF-001`: Validate outbound URLs before issuing `http.Get` or `http.Post`.
+
+### 3. Concurrency & Goroutine Safety
+* `TG-BIZ-001`: Ensure context cancellation propagation (`ctx.Done()`) to prevent goroutine leaks.
+* Use mutexes or channels to prevent data races on shared state.
+
+### 4. Input Validation & Path Traversal
+* `TG-INPUT-006`: Sanitize file paths with `filepath.Clean` and check `strings.HasPrefix(cleanPath, baseDir)`.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```go
+// Safe Parameterized Query
+row := db.QueryRowContext(ctx, "SELECT id, email FROM users WHERE id = ? AND tenant_id = ?", userID, tenantID)
+
+// Safe GORM Scoping
+var invoice Invoice
+result := db.Where("id = ? AND tenant_id = ?", invoiceID, currentTenantID).First(&invoice)
+
+// Safe TLS Client
+tlsConfig := &tls.Config{
+    MinVersion: tls.VersionTLS13,
+}
+client := &http.Client{Transport: &http.Transport{TLSClientConfig: tlsConfig}}
+```

package/skills/torusguard/payload/references/java-security.md

@@ -1,40 +1,40 @@
-# TorusGuard Skill Reference: Java & Spring Security
-
-> **Loaded When:** A project is identified as a Java/Kotlin application (`pom.xml`, `build.gradle`, Spring Boot detected).
-
----
-
-## 🛡️ Key Inspection Areas & Rules
-
-### 1. Spring Security & CSRF
-* `TG-CSRF-001`: Prohibit `.csrf().disable()` or `AbstractHttpConfigurer::disable` on state-changing browser routes.
-* `TG-PLATFORM-001`: Avoid `@CrossOrigin(origins = "*")` with `allowCredentials = "true"`.
-
-### 2. JPA & Hibernate SQL Injection
-* `TG-INPUT-002`: Use named parameters (`:param`) or `CriteriaBuilder`. Never concatenate strings into JPQL queries.
-* `TG-DB-004`: Enforce tenant isolation via `@Filter` or explicit where clauses.
-
-### 3. Insecure Deserialization & XML
-* Prohibit `ObjectInputStream.readObject()` on untrusted input without look-ahead verification.
-* Disable external entity resolution (`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`).
-
----
-
-## 🛠️ Safe Patterns Summary
-
-```java
-// Safe JPA Query
-@Query("SELECT u FROM User u WHERE u.id = :id AND u.tenantId = :tenantId")
-Optional<User> findByIdAndTenantId(@Param("id") Long id, @Param("tenantId") String tenantId);
-
-// Safe Spring Security Configuration
-@Bean
-public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
-    http
-        .authorizeHttpRequests(auth -> auth
-            .requestMatchers("/public/**").permitAll()
-            .anyRequest().authenticated()
-        );
-    return http.build();
-}
-```
+# TorusGuard Skill Reference: Java & Spring Security
+
+> **Loaded When:** A project is identified as a Java/Kotlin application (`pom.xml`, `build.gradle`, Spring Boot detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Spring Security & CSRF
+* `TG-CSRF-001`: Prohibit `.csrf().disable()` or `AbstractHttpConfigurer::disable` on state-changing browser routes.
+* `TG-PLATFORM-001`: Avoid `@CrossOrigin(origins = "*")` with `allowCredentials = "true"`.
+
+### 2. JPA & Hibernate SQL Injection
+* `TG-INPUT-002`: Use named parameters (`:param`) or `CriteriaBuilder`. Never concatenate strings into JPQL queries.
+* `TG-DB-004`: Enforce tenant isolation via `@Filter` or explicit where clauses.
+
+### 3. Insecure Deserialization & XML
+* Prohibit `ObjectInputStream.readObject()` on untrusted input without look-ahead verification.
+* Disable external entity resolution (`setFeature("http://apache.org/xml/features/disallow-doctype-decl", true)`).
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```java
+// Safe JPA Query
+@Query("SELECT u FROM User u WHERE u.id = :id AND u.tenantId = :tenantId")
+Optional<User> findByIdAndTenantId(@Param("id") Long id, @Param("tenantId") String tenantId);
+
+// Safe Spring Security Configuration
+@Bean
+public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
+    http
+        .authorizeHttpRequests(auth -> auth
+            .requestMatchers("/public/**").permitAll()
+            .anyRequest().authenticated()
+        );
+    return http.build();
+}
+```

package/skills/torusguard/payload/references/polyglot-security-matrix.md

@@ -1,25 +1,25 @@
-# TorusGuard Universal Polyglot Security Matrix
-
-> **Loaded When:** Any language or framework is detected. Maps universal security invariants across major programming language ecosystems.
-
----
-
-## 🛡️ Cross-Language Invariant Mappings
-
-| Rule Family | Python | TypeScript / Node.js | Go | Rust | Java / Kotlin | C# / .NET |
-|---|---|---|---|---|---|---|
-| **TG-SEC (Secrets)** | `os.environ["KEY"]` | `process.env.KEY` | `os.Getenv("KEY")` | `std::env::var("KEY")` | `System.getenv("KEY")` | `Environment.GetEnvironmentVariable()` |
-| **TG-DB (SQL Injection)** | `%s` / ORM bound | `$1` / Prisma / Drizzle | `?` / `$1` / GORM `?` | `sqlx::query!` / Diesel | Named parameters `:param` | `@p0` / `FromSqlInterpolated` |
-| **TG-DB-004 (Tenant Scope)** | `.filter(tenant=...)` | `where: { tenantId }` | `.Where("tenant_id = ?", tid)` | `filter(tenant_id.eq(tid))` | `WHERE e.tenantId = :tid` | `.Where(x => x.TenantId == tid)` |
-| **TG-AUTH (Access Control)** | `@login_required` / Depends | Middleware auth / Guards | Middleware handlers | Tower layer / extractors | `@PreAuthorize` / Spring Sec | `[Authorize]` attributes |
-| **TG-CSRF (Request Forgery)** | CSRF Middleware | SameSite / csurf | Gorilla CSRF | Anti-CSRF token middleware | Spring Security CSRF | `[ValidateAntiForgeryToken]` |
-| **TG-DIFF (Bypass Comments)** | No `# nosec` | No `// nosec` | No `/* nosec */` | No `#![allow(unsafe)]` | No `@SuppressWarnings` | No pragma disable |
-| **TG-DIFF (TLS Verification)** | No `verify=False` | No `rejectUnauthorized:false` | No `InsecureSkipVerify: true` | No `danger_accept_invalid_certs`| No `TrustAllStrategy` | No `DangerousAcceptAny...` |
-
----
-
-## 🚀 Polyglot Hardening Rules of Thumb
-
-1. **Parameterize Everything:** Never concatenate raw user input into SQL, shell commands, LDAP filters, or template strings, regardless of language.
-2. **Fail Closed on Auth:** Default all endpoints to authenticated; explicitly mark public routes rather than remembering to protect private ones.
-3. **Strict Bounds:** Keep remediation diffs minimal ($\le 35$ additions, $\le 25$ deletions) to ensure auditability across all codebases.
+# TorusGuard Universal Polyglot Security Matrix
+
+> **Loaded When:** Any language or framework is detected. Maps universal security invariants across major programming language ecosystems.
+
+---
+
+## 🛡️ Cross-Language Invariant Mappings
+
+| Rule Family | Python | TypeScript / Node.js | Go | Rust | Java / Kotlin | C# / .NET |
+|---|---|---|---|---|---|---|
+| **TG-SEC (Secrets)** | `os.environ["KEY"]` | `process.env.KEY` | `os.Getenv("KEY")` | `std::env::var("KEY")` | `System.getenv("KEY")` | `Environment.GetEnvironmentVariable()` |
+| **TG-DB (SQL Injection)** | `%s` / ORM bound | `$1` / Prisma / Drizzle | `?` / `$1` / GORM `?` | `sqlx::query!` / Diesel | Named parameters `:param` | `@p0` / `FromSqlInterpolated` |
+| **TG-DB-004 (Tenant Scope)** | `.filter(tenant=...)` | `where: { tenantId }` | `.Where("tenant_id = ?", tid)` | `filter(tenant_id.eq(tid))` | `WHERE e.tenantId = :tid` | `.Where(x => x.TenantId == tid)` |
+| **TG-AUTH (Access Control)** | `@login_required` / Depends | Middleware auth / Guards | Middleware handlers | Tower layer / extractors | `@PreAuthorize` / Spring Sec | `[Authorize]` attributes |
+| **TG-CSRF (Request Forgery)** | CSRF Middleware | SameSite / csurf | Gorilla CSRF | Anti-CSRF token middleware | Spring Security CSRF | `[ValidateAntiForgeryToken]` |
+| **TG-DIFF (Bypass Comments)** | No `# nosec` | No `// nosec` | No `/* nosec */` | No `#![allow(unsafe)]` | No `@SuppressWarnings` | No pragma disable |
+| **TG-DIFF (TLS Verification)** | No `verify=False` | No `rejectUnauthorized:false` | No `InsecureSkipVerify: true` | No `danger_accept_invalid_certs`| No `TrustAllStrategy` | No `DangerousAcceptAny...` |
+
+---
+
+## 🚀 Polyglot Hardening Rules of Thumb
+
+1. **Parameterize Everything:** Never concatenate raw user input into SQL, shell commands, LDAP filters, or template strings, regardless of language.
+2. **Fail Closed on Auth:** Default all endpoints to authenticated; explicitly mark public routes rather than remembering to protect private ones.
+3. **Strict Bounds:** Keep remediation diffs minimal ($\le 35$ additions, $\le 25$ deletions) to ensure auditability across all codebases.

package/skills/torusguard/payload/references/rust-security.md

@@ -1,40 +1,40 @@
-# TorusGuard Skill Reference: Rust Security
-
-> **Loaded When:** A project is identified as a Rust application (`Cargo.toml` or `.rs` files detected).
-
----
-
-## 🛡️ Key Inspection Areas & Rules
-
-### 1. Memory Safety & Unsafe Blocks
-* `TG-INPUT-003`: Audit and restrict `unsafe { ... }` blocks. Must include a `// SAFETY:` rationale comment.
-* Never disable standard borrow checker lints via `#![allow(unsafe_code)]`.
-
-### 2. Database & SQL Queries
-* `TG-INPUT-002`: Use compile-time checked `sqlx::query!` or Diesel query builder methods.
-* `TG-DB-004`: Enforce tenant filtering in queries (`filter(tenant_id.eq(current_tenant_id))`).
-
-### 3. Outbound Requests & TLS
-* `TG-DIFF-001`: Prohibit `danger_accept_invalid_certs(true)` in `reqwest::ClientBuilder`.
-* `TG-SSRF-001`: Enforce IP allowlists before dispatching network calls.
-
----
-
-## 🛠️ Safe Patterns Summary
-
-```rust
-// Safe sqlx Parameterized Query
-let user = sqlx::query_as!(
-    User,
-    "SELECT id, email FROM users WHERE id = $1 AND tenant_id = $2",
-    user_id,
-    current_tenant_id
-)
-.fetch_one(&pool)
-.await?;
-
-// Safe reqwest Client (Strict TLS)
-let client = reqwest::Client::builder()
-    .timeout(std::time::Duration::from_secs(10))
-    .build()?;
-```
+# TorusGuard Skill Reference: Rust Security
+
+> **Loaded When:** A project is identified as a Rust application (`Cargo.toml` or `.rs` files detected).
+
+---
+
+## 🛡️ Key Inspection Areas & Rules
+
+### 1. Memory Safety & Unsafe Blocks
+* `TG-INPUT-003`: Audit and restrict `unsafe { ... }` blocks. Must include a `// SAFETY:` rationale comment.
+* Never disable standard borrow checker lints via `#![allow(unsafe_code)]`.
+
+### 2. Database & SQL Queries
+* `TG-INPUT-002`: Use compile-time checked `sqlx::query!` or Diesel query builder methods.
+* `TG-DB-004`: Enforce tenant filtering in queries (`filter(tenant_id.eq(current_tenant_id))`).
+
+### 3. Outbound Requests & TLS
+* `TG-DIFF-001`: Prohibit `danger_accept_invalid_certs(true)` in `reqwest::ClientBuilder`.
+* `TG-SSRF-001`: Enforce IP allowlists before dispatching network calls.
+
+---
+
+## 🛠️ Safe Patterns Summary
+
+```rust
+// Safe sqlx Parameterized Query
+let user = sqlx::query_as!(
+    User,
+    "SELECT id, email FROM users WHERE id = $1 AND tenant_id = $2",
+    user_id,
+    current_tenant_id
+)
+.fetch_one(&pool)
+.await?;
+
+// Safe reqwest Client (Strict TLS)
+let client = reqwest::Client::builder()
+    .timeout(std::time::Duration::from_secs(10))
+    .build()?;
+```

package/skills/torusguard/payload/rules/container/TG-CONT-001-root-user-execution.md

@@ -0,0 +1,50 @@
+# TG-CONT-001: Root User Execution in Container
+
+## Severity
+High. Running container processes as root increases the blast radius of any remote code execution (RCE) flaw, enabling container breakout and host compromise.
+
+## Applies To
+- `Dockerfile`, `Dockerfile.*`, `Containerfile`
+- Docker Compose (`docker-compose.yml`, `compose.yaml`)
+- Kubernetes PodSpecs
+
+## Why It Matters
+By default, Docker executes container entrypoints as the `root` user (UID 0). If an application vulnerability (e.g., path traversal, command injection, or memory corruption) is exploited, the attacker immediately possesses root privileges within the container, facilitating kernel exploits, namespace escapes, and host file access.
+
+## What TorusGuard Looks For
+1. Dockerfiles lacking an explicit non-root `USER <user>` directive.
+2. Explicit `USER root` or `USER 0` declarations without dropping privileges.
+3. Compose services declaring `user: "0"` or `user: "root"`.
+
+## Unsafe Example
+```dockerfile
+# UNSAFE: No USER declared; runs as root
+FROM node:20-alpine
+WORKDIR /app
+COPY package*.json ./
+RUN npm install
+COPY . .
+CMD ["node", "server.js"]
+```
+
+## Safe Example
+```dockerfile
+# SAFE: Dedicated unprivileged non-root user
+FROM node:20-alpine
+WORKDIR /app
+COPY package*.json ./
+RUN npm install
+COPY . .
+RUN addgroup -S appgroup && adduser -S appuser -G appgroup
+USER appuser
+CMD ["node", "server.js"]
+```
+
+## Remediation
+1. Declare a non-privileged user and group (`USER appuser` or `USER 10001:10001`).
+2. Ensure file permissions allow the non-root user to read necessary application files.
+3. In Compose files, set `user: "10001:10001"`.
+
+## Related Rules
+- `TG-CONT-002`: Dangerous Docker Socket Mount
+- `TG-CONT-003`: Privileged Container Mode

package/skills/torusguard/payload/rules/container/TG-CONT-002-docker-socket-mount.md

@@ -0,0 +1,47 @@
+# TG-CONT-002: Dangerous Docker Socket Mount
+
+## Severity
+Critical. Mounting `/var/run/docker.sock` grants the container full root control over the host Docker daemon, enabling trivial container breakout and host root takeover.
+
+## Applies To
+- `docker-compose.yml`, `docker-compose.yaml`, `compose.yml`, `compose.yaml`
+- Kubernetes PodSpecs, Helm charts, Docker run scripts
+
+## Why It Matters
+The Docker UNIX socket (`/var/run/docker.sock`) is the management API for the Docker daemon. Any process that can communicate with this socket can issue API calls to spawn new containers with host root filesystem mounts (`-v /:/host`), inspect all container secrets, and execute code directly on the host machine.
+
+## What TorusGuard Looks For
+1. Volume bindings referencing `/var/run/docker.sock:/var/run/docker.sock`.
+2. Mounting the Docker socket in read-write or read-only mode without a hardening proxy.
+
+## Unsafe Example
+```yaml
+# UNSAFE: Exposes host Docker daemon to the container
+version: '3.8'
+services:
+  app:
+    image: my-app:latest
+    volumes:
+      - /var/run/docker.sock:/var/run/docker.sock
+```
+
+## Safe Example
+```yaml
+# SAFE: Remove Docker socket mount; use dedicated APIs or rootless sidecars
+version: '3.8'
+services:
+  app:
+    image: my-app:latest
+    volumes:
+      - app-data:/data
+volumes:
+  app-data:
+```
+
+## Remediation
+1. Remove `/var/run/docker.sock` volume bindings from application containers.
+2. If Docker commands are required, use unprivileged rootless container tooling (e.g., Kaniko for image builds) or a restricted Docker socket proxy that denies container-creation privileges.
+
+## Related Rules
+- `TG-CONT-001`: Root User Execution in Container
+- `TG-CONT-003`: Privileged Container Mode