reauth 0.1.0__tar.gz
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- reauth-0.1.0/.agents/skills/.gitkeep +0 -0
- reauth-0.1.0/.agents/skills/authentication-terminology/SKILL.md +87 -0
- reauth-0.1.0/.agents/skills/owasp-cheatsheets/SKILL.md +308 -0
- reauth-0.1.0/.agents/skills/rfc-spec/SKILL.md +42 -0
- reauth-0.1.0/.agents/skills/rfc-spec/scripts/create-rfc-skill.sh +81 -0
- reauth-0.1.0/.agents/skills/rfc4226/SKILL.md +118 -0
- reauth-0.1.0/.agents/skills/rfc4226/references/RFC4226.txt +2075 -0
- reauth-0.1.0/.agents/skills/rfc6238/SKILL.md +145 -0
- reauth-0.1.0/.agents/skills/rfc6238/references/RFC6238.txt +899 -0
- reauth-0.1.0/.agents/skills/rfc8176/SKILL.md +69 -0
- reauth-0.1.0/.agents/skills/rfc8176/references/RFC8176.txt +843 -0
- reauth-0.1.0/.agents/skills/webauthn-2/SKILL.md +340 -0
- reauth-0.1.0/.agents/skills/webauthn-2/references/webauthn-2.html +13018 -0
- reauth-0.1.0/.editorconfig +11 -0
- reauth-0.1.0/.github/workflows/build.yml +71 -0
- reauth-0.1.0/.github/workflows/copilot-setup-steps.yml +31 -0
- reauth-0.1.0/.github/workflows/documentation.yml +58 -0
- reauth-0.1.0/.gitignore +108 -0
- reauth-0.1.0/.zed/settings.json +32 -0
- reauth-0.1.0/AGENTS.md +33 -0
- reauth-0.1.0/LICENSE +22 -0
- reauth-0.1.0/PKG-INFO +118 -0
- reauth-0.1.0/README.md +103 -0
- reauth-0.1.0/docs/index.md +1 -0
- reauth-0.1.0/docs/reference/reauth.md +6 -0
- reauth-0.1.0/justfile +29 -0
- reauth-0.1.0/mkdocs.yml +64 -0
- reauth-0.1.0/pyproject.toml +68 -0
- reauth-0.1.0/reauth/__init__.py +3 -0
- reauth-0.1.0/reauth/amr.py +96 -0
- reauth-0.1.0/reauth/authentication_session.py +217 -0
- reauth-0.1.0/reauth/crypto.py +112 -0
- reauth-0.1.0/reauth/exceptions.py +9 -0
- reauth-0.1.0/reauth/factors/__init__.py +3 -0
- reauth-0.1.0/reauth/factors/base.py +44 -0
- reauth-0.1.0/reauth/factors/email_otp.py +198 -0
- reauth-0.1.0/reauth/factors/hotp.py +164 -0
- reauth-0.1.0/reauth/factors/totp.py +174 -0
- reauth-0.1.0/reauth/py.typed +0 -0
- reauth-0.1.0/reauth/timestamp.py +8 -0
- reauth-0.1.0/solo.yml +18 -0
- reauth-0.1.0/tests/__init__.py +0 -0
- reauth-0.1.0/tests/conftest.py +14 -0
- reauth-0.1.0/tests/factors/test_email_otp.py +262 -0
- reauth-0.1.0/tests/factors/test_hotp.py +158 -0
- reauth-0.1.0/tests/factors/test_totp.py +215 -0
- reauth-0.1.0/tests/test_authentication_session.py +364 -0
- reauth-0.1.0/tests/test_crypto.py +158 -0
- reauth-0.1.0/uv.lock +912 -0
|
File without changes
|
|
@@ -0,0 +1,87 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: authentication-terminology
|
|
3
|
+
description: Provides clear definitions of core authentication and security terms such as identity, principal, subject, authentication, authorization, and common attack vectors. Use when clarifying terminology in authentication, security, or access control contexts.
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# Authentication and Security Terminology
|
|
7
|
+
|
|
8
|
+
## Core Concepts
|
|
9
|
+
|
|
10
|
+
- **Identity**
|
|
11
|
+
The set of attributes (e.g., username, email, unique ID) that define a digital entity (user, device, service). It is what is being claimed during authentication. When implementing functions, use "identity" to refer to the attributes of a user or entity (e.g., `get_identity_by_email`).
|
|
12
|
+
- **Principal**
|
|
13
|
+
A specific, unique digital entity (user, service, device) that can be authenticated. It is the active participant in an authentication process.
|
|
14
|
+
- **Subject**
|
|
15
|
+
A generic term for any entity (user, process, device) whose identity can be authenticated. It is a broader category that includes principals and other entities that may not always be uniquely identifiable. "Subject" is less precise than "identity" in most authentication contexts and is rarely used in function or variable naming.
|
|
16
|
+
- **Authentication**
|
|
17
|
+
The process of verifying the claimed identity of a principal or subject.
|
|
18
|
+
- **Authorization**
|
|
19
|
+
The process of determining what an authenticated identity is allowed to do, i.e., granting or denying access to resources.
|
|
20
|
+
|
|
21
|
+
### Clarifications
|
|
22
|
+
|
|
23
|
+
- **Identity vs. Subject**
|
|
24
|
+
"Identity" refers to the actual attributes (e.g., email, username) of a digital entity. "Subject" is a more abstract, generic term for any entity that can be authenticated. In practice, "identity" is preferred when referring to the attributes of a user or entity, especially in code (e.g., `get_identity_by_email` rather than `get_subject_by_email`).
|
|
25
|
+
|
|
26
|
+
## Authentication Methods
|
|
27
|
+
|
|
28
|
+
- **Factor**
|
|
29
|
+
A category of authentication credentials, such as something you know (password), something you have (token, smart card), or something you are (biometric).
|
|
30
|
+
- **Multi-Factor Authentication (MFA)**
|
|
31
|
+
Using two or more factors from different categories for authentication.
|
|
32
|
+
- **Single Sign-On (SSO)**
|
|
33
|
+
A mechanism that allows a user to log in once and gain access to multiple related but independent software systems without being prompted to log in again.
|
|
34
|
+
- **Credentials**
|
|
35
|
+
Information or objects used to verify identity, such as passwords, tokens, certificates, or biometric data.
|
|
36
|
+
|
|
37
|
+
## Tokens and Protocols
|
|
38
|
+
|
|
39
|
+
- **Token**
|
|
40
|
+
A piece of data that represents the identity and permissions of a user, often used in token-based authentication (e.g., JWT, OAuth token).
|
|
41
|
+
- **Session**
|
|
42
|
+
A temporary and interactive information interchange between two or more communicating devices or between a computer and user.
|
|
43
|
+
- **OAuth 2.0**
|
|
44
|
+
An open standard for authorization, commonly used to grant limited access to a user's information on another website without exposing passwords.
|
|
45
|
+
- **OpenID Connect (OIDC)**
|
|
46
|
+
A simple identity layer on top of the OAuth 2.0 protocol, enabling clients to verify the identity of an end-user based on authentication performed by an authorization server.
|
|
47
|
+
- **SAML**
|
|
48
|
+
Security Assertion Markup Language, an XML-based open standard for exchanging authentication and authorization data between parties, often used for SSO.
|
|
49
|
+
|
|
50
|
+
## Identity Management
|
|
51
|
+
|
|
52
|
+
- **Identity Provider (IdP)**
|
|
53
|
+
A system entity that creates, maintains, and manages identity information for principals and provides authentication services to relying applications.
|
|
54
|
+
- **Service Provider (SP)**
|
|
55
|
+
An entity that provides services to end users, often relying on an IdP for authentication.
|
|
56
|
+
- **Directory Service**
|
|
57
|
+
A shared information infrastructure for locating, managing, and administering networked resources (e.g., LDAP, Active Directory).
|
|
58
|
+
|
|
59
|
+
## Security Concepts
|
|
60
|
+
|
|
61
|
+
- **Confidentiality**
|
|
62
|
+
Ensuring that information is accessible only to those authorized to have access.
|
|
63
|
+
- **Integrity**
|
|
64
|
+
Ensuring the accuracy and consistency of data over its lifecycle.
|
|
65
|
+
- **Availability**
|
|
66
|
+
Ensuring that systems and data are accessible when needed.
|
|
67
|
+
- **Non-repudiation**
|
|
68
|
+
Ensuring that a party cannot deny the authenticity of their signature on a document or a message they sent.
|
|
69
|
+
- **Threat**
|
|
70
|
+
Any potential danger to information or systems.
|
|
71
|
+
- **Vulnerability**
|
|
72
|
+
A weakness that can be exploited by a threat to cause harm.
|
|
73
|
+
- **Risk**
|
|
74
|
+
The potential for loss, damage, or destruction of an asset as a result of a threat exploiting a vulnerability.
|
|
75
|
+
|
|
76
|
+
## Common Attacks
|
|
77
|
+
|
|
78
|
+
- **Phishing**
|
|
79
|
+
Attempting to obtain sensitive information by pretending to be a trustworthy entity.
|
|
80
|
+
- **Brute Force**
|
|
81
|
+
Trying all possible combinations to guess a password or key.
|
|
82
|
+
- **Man-in-the-Middle (MitM)**
|
|
83
|
+
Intercepting and possibly altering messages between two parties who believe they are directly communicating with each other.
|
|
84
|
+
- **Credential Stuffing**
|
|
85
|
+
Using lists of user name and password pairs to gain unauthorized access to user accounts.
|
|
86
|
+
- **Replay Attack**
|
|
87
|
+
Capturing a valid data transmission and fraudulently or maliciously repeating or delaying it.
|
|
@@ -0,0 +1,308 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: owasp-cheatsheets
|
|
3
|
+
description: Comprehensive OWASP Cheat Sheet Series skill providing direct access to all OWASP cheat sheets for web application security, secure coding practices, and vulnerability prevention. Use when working on authentication, authorization, injection prevention, cryptography, or any OWASP-related security guidance.
|
|
4
|
+
license: CC-BY-SA-4.0
|
|
5
|
+
metadata:
|
|
6
|
+
author: OWASP
|
|
7
|
+
version: "1.0"
|
|
8
|
+
source: https://github.com/OWASP/CheatSheetSeries
|
|
9
|
+
categories: "authentication, authorization, injection, xss, csrf, cryptography, security, owasp"
|
|
10
|
+
compatibility: Works with any agent or LLM. No special tools required. Requires internet access to fetch remote cheat sheets.
|
|
11
|
+
---
|
|
12
|
+
|
|
13
|
+
# OWASP Cheat Sheet Series
|
|
14
|
+
|
|
15
|
+
This skill provides direct access to the **OWASP Cheat Sheet Series**, a collection of concise, actionable security guidance for developers, architects, and security professionals. All content is fetched from the official OWASP repository.
|
|
16
|
+
|
|
17
|
+
## When to Use This Skill
|
|
18
|
+
|
|
19
|
+
Use this skill when:
|
|
20
|
+
|
|
21
|
+
- Developing secure web applications
|
|
22
|
+
- Reviewing code for security vulnerabilities
|
|
23
|
+
- Implementing authentication and authorization systems
|
|
24
|
+
- Preventing injection attacks (SQL, XSS, CSRF, etc.)
|
|
25
|
+
- Securing data storage and transmission
|
|
26
|
+
- Configuring secure infrastructure
|
|
27
|
+
- Working with emerging technologies (AI, cloud, containers, etc.)
|
|
28
|
+
- Following OWASP best practices
|
|
29
|
+
|
|
30
|
+
## Quick Start
|
|
31
|
+
|
|
32
|
+
### Most Common Security Tasks
|
|
33
|
+
|
|
34
|
+
| Task | Cheat Sheet |
|
|
35
|
+
| ------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
36
|
+
| Secure authentication implementation | [Authentication Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md) |
|
|
37
|
+
| Password storage best practices | [Password Storage Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md) |
|
|
38
|
+
| Session management security | [Session Management Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Session_Management_Cheat_Sheet.md) |
|
|
39
|
+
| SQL injection prevention | [SQL Injection Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.md) |
|
|
40
|
+
| Cross-site scripting (XSS) prevention | [XSS Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md) |
|
|
41
|
+
| CSRF prevention | [CSRF Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.md) |
|
|
42
|
+
| Input validation | [Input Validation Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Input_Validation_Cheat_Sheet.md) |
|
|
43
|
+
| Cryptographic storage | [Cryptographic Storage Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cryptographic_Storage_Cheat_Sheet.md) |
|
|
44
|
+
|
|
45
|
+
## Category Overview
|
|
46
|
+
|
|
47
|
+
The OWASP Cheat Sheet Series is organized into the following categories:
|
|
48
|
+
|
|
49
|
+
### 1. Authentication & Authorization
|
|
50
|
+
|
|
51
|
+
All aspects of user identity verification, access control, and session management.
|
|
52
|
+
|
|
53
|
+
**Cheat Sheets:**
|
|
54
|
+
|
|
55
|
+
- [Authentication Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md)
|
|
56
|
+
- [Password Storage Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md)
|
|
57
|
+
- [Session Management Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Session_Management_Cheat_Sheet.md)
|
|
58
|
+
- [Authorization Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authorization_Cheat_Sheet.md)
|
|
59
|
+
- [Access Control Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Access_Control_Cheat_Sheet.md)
|
|
60
|
+
- [Forgot Password Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Forgot_Password_Cheat_Sheet.md)
|
|
61
|
+
- [Multifactor Authentication Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Multifactor_Authentication_Cheat_Sheet.md)
|
|
62
|
+
- [Choosing and Using Security Questions Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Choosing_and_Using_Security_Questions_Cheat_Sheet.md)
|
|
63
|
+
- [Credential Stuffing Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Credential_Stuffing_Prevention_Cheat_Sheet.md)
|
|
64
|
+
- [JAAS Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/JAAS_Cheat_Sheet.md)
|
|
65
|
+
|
|
66
|
+
### 2. Injection Prevention
|
|
67
|
+
|
|
68
|
+
Preventing all forms of injection attacks across different technologies.
|
|
69
|
+
|
|
70
|
+
**Cheat Sheets:**
|
|
71
|
+
|
|
72
|
+
- [SQL Injection Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.md)
|
|
73
|
+
- [Cross-Site Scripting (XSS) Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md)
|
|
74
|
+
- [DOM-based XSS Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.md)
|
|
75
|
+
- [XSS Filter Evasion Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/XSS_Filter_Evasion_Cheat_Sheet.md)
|
|
76
|
+
- [Cross-Site Request Forgery (CSRF) Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross-Site_Request_Forgery_Prevention_Cheat_Sheet.md)
|
|
77
|
+
- [OS Command Injection Defense Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.md)
|
|
78
|
+
- [LDAP Injection Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.md)
|
|
79
|
+
- [Deserialization Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md)
|
|
80
|
+
- [Server Side Request Forgery Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.md)
|
|
81
|
+
- [Prototype Pollution Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Prototype_Pollution_Prevention_Cheat_Sheet.md)
|
|
82
|
+
- [Mass Assignment Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Mass_Assignment_Cheat_Sheet.md)
|
|
83
|
+
- [Insecure Direct Object Reference Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.md)
|
|
84
|
+
- [Query Parameterization Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Query_Parameterization_Cheat_Sheet.md)
|
|
85
|
+
- [Injection Prevention in Java Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Injection_Prevention_in_Java_Cheat_Sheet.md)
|
|
86
|
+
|
|
87
|
+
### 3. Data Protection
|
|
88
|
+
|
|
89
|
+
Securing data at rest, in transit, and during processing.
|
|
90
|
+
|
|
91
|
+
**Cheat Sheets:**
|
|
92
|
+
|
|
93
|
+
- [Cryptographic Storage Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cryptographic_Storage_Cheat_Sheet.md)
|
|
94
|
+
- [Key Management Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Key_Management_Cheat_Sheet.md)
|
|
95
|
+
- [Secrets Management Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Secrets_Management_Cheat_Sheet.md)
|
|
96
|
+
- [TLS Cipher String Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/TLS_Cipher_String_Cheat_Sheet.md)
|
|
97
|
+
- [HTTP Strict Transport Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/HTTP_Strict_Transport_Security_Cheat_Sheet.md)
|
|
98
|
+
- [HTTP Headers Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/HTTP_Headers_Cheat_Sheet.md)
|
|
99
|
+
- [Content Security Policy Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Content_Security_Policy_Cheat_Sheet.md)
|
|
100
|
+
- [Cookie Theft Mitigation Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cookie_Theft_Mitigation_Cheat_Sheet.md)
|
|
101
|
+
- [Pinning Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Pinning_Cheat_Sheet.md)
|
|
102
|
+
|
|
103
|
+
### 4. Application Security
|
|
104
|
+
|
|
105
|
+
General application security principles and practices.
|
|
106
|
+
|
|
107
|
+
**Cheat Sheets:**
|
|
108
|
+
|
|
109
|
+
- [Input Validation Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Input_Validation_Cheat_Sheet.md)
|
|
110
|
+
- [Error Handling Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Error_Handling_Cheat_Sheet.md)
|
|
111
|
+
- [Logging Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Logging_Cheat_Sheet.md)
|
|
112
|
+
- [Logging Vocabulary Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Logging_Vocabulary_Cheat_Sheet.md)
|
|
113
|
+
- [Secure Code Review Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Secure_Code_Review_Cheat_Sheet.md)
|
|
114
|
+
- [Secure Product Design Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Secure_Product_Design_Cheat_Sheet.md)
|
|
115
|
+
- [Business Logic Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Business_Logic_Security_Cheat_Sheet.md)
|
|
116
|
+
- [Attack Surface Analysis Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Attack_Surface_Analysis_Cheat_Sheet.md)
|
|
117
|
+
- [Abuse Case Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Abuse_Case_Cheat_Sheet.md)
|
|
118
|
+
- [Denial of Service Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Denial_of_Service_Cheat_Sheet.md)
|
|
119
|
+
- [File Upload Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/File_Upload_Cheat_Sheet.md)
|
|
120
|
+
- [Email Validation and Verification Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Email_Validation_and_Verification_Cheat_Sheet.md)
|
|
121
|
+
- [Security Terminology Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Security_Terminology_Cheat_Sheet.md)
|
|
122
|
+
- [Bean Validation Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Bean_Validation_Cheat_Sheet.md)
|
|
123
|
+
|
|
124
|
+
### 5. Infrastructure & Deployment Security
|
|
125
|
+
|
|
126
|
+
Securing the infrastructure and deployment pipeline.
|
|
127
|
+
|
|
128
|
+
**Cheat Sheets:**
|
|
129
|
+
|
|
130
|
+
- [Docker Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Docker_Security_Cheat_Sheet.md)
|
|
131
|
+
- [Kubernetes Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Kubernetes_Security_Cheat_Sheet.md)
|
|
132
|
+
- [CI/CD Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/CI_CD_Security_Cheat_Sheet.md)
|
|
133
|
+
- [GitHub Actions Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/GitHub_Actions_Security_Cheat_Sheet.md)
|
|
134
|
+
- [Infrastructure as Code Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Infrastructure_as_Code_Security_Cheat_Sheet.md)
|
|
135
|
+
- [Serverless FaaS Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Serverless_FaaS_Security_Cheat_Sheet.md)
|
|
136
|
+
- [Secure Cloud Architecture Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Secure_Cloud_Architecture_Cheat_Sheet.md)
|
|
137
|
+
- [Network Segmentation Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Network_Segmentation_Cheat_Sheet.md)
|
|
138
|
+
- [Dependency Graph SBOM Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Dependency_Graph_SBOM_Cheat_Sheet.md)
|
|
139
|
+
- [Software Supply Chain Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Software_Supply_Chain_Security_Cheat_Sheet.md)
|
|
140
|
+
- [Database Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Database_Security_Cheat_Sheet.md)
|
|
141
|
+
- [NoSQL Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/NoSQL_Security_Cheat_Sheet.md)
|
|
142
|
+
|
|
143
|
+
### 6. Framework & Language-Specific
|
|
144
|
+
|
|
145
|
+
Security guidance for specific frameworks and languages.
|
|
146
|
+
|
|
147
|
+
**Cheat Sheets:**
|
|
148
|
+
|
|
149
|
+
- [Java Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Java_Security_Cheat_Sheet.md)
|
|
150
|
+
- [DotNet Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/DotNet_Security_Cheat_Sheet.md)
|
|
151
|
+
- [Nodejs Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Nodejs_Security_Cheat_Sheet.md)
|
|
152
|
+
- [NodeJS Docker Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/NodeJS_Docker_Cheat_Sheet.md)
|
|
153
|
+
- [PHP Configuration Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/PHP_Configuration_Cheat_Sheet.md)
|
|
154
|
+
- [Django Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Django_Security_Cheat_Sheet.md)
|
|
155
|
+
- [Django REST Framework Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Django_REST_Framework_Cheat_Sheet.md)
|
|
156
|
+
- [Ruby on Rails Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Ruby_on_Rails_Cheat_Sheet.md)
|
|
157
|
+
- [Laravel Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Laravel_Cheat_Sheet.md)
|
|
158
|
+
- [Symfony Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Symfony_Cheat_Sheet.md)
|
|
159
|
+
- [C-Based Toolchain Hardening Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/C-Based_Toolchain_Hardening_Cheat_Sheet.md)
|
|
160
|
+
|
|
161
|
+
### 7. Emerging Technologies
|
|
162
|
+
|
|
163
|
+
Security for modern and emerging technologies.
|
|
164
|
+
|
|
165
|
+
**Cheat Sheets:**
|
|
166
|
+
|
|
167
|
+
- [AI Agent Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/AI_Agent_Security_Cheat_Sheet.md)
|
|
168
|
+
- [LLM Prompt Injection Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.md)
|
|
169
|
+
- [RAG Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/RAG_Security_Cheat_Sheet.md)
|
|
170
|
+
- [Secure AI Model Ops Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Secure_AI_Model_Ops_Cheat_Sheet.md)
|
|
171
|
+
- [Secure Coding with AI Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Secure_Coding_with_AI_Cheat_Sheet.md)
|
|
172
|
+
- [MCP Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/MCP_Security_Cheat_Sheet.md)
|
|
173
|
+
- [Drone Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Drone_Security_Cheat_Sheet.md)
|
|
174
|
+
- [Automotive Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Automotive_Security_Cheat_Sheet.md)
|
|
175
|
+
- [Mobile Application Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Mobile_Application_Security_Cheat_Sheet.md)
|
|
176
|
+
- [Microservices Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Microservices_Security_Cheat_Sheet.md)
|
|
177
|
+
- [Microservices based Security Arch Doc Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Microservices_based_Security_Arch_Doc_Cheat_Sheet.md)
|
|
178
|
+
- [GraphQL Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/GraphQL_Cheat_Sheet.md)
|
|
179
|
+
- [REST Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/REST_Security_Cheat_Sheet.md)
|
|
180
|
+
- [REST Assessment Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/REST_Assessment_Cheat_Sheet.md)
|
|
181
|
+
|
|
182
|
+
### 8. Specialized Topics
|
|
183
|
+
|
|
184
|
+
Niche but important security areas.
|
|
185
|
+
|
|
186
|
+
**Cheat Sheets:**
|
|
187
|
+
|
|
188
|
+
- [Browser Extension Vulnerabilities Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Browser_Extension_Vulnerabilities_Cheat_Sheet.md)
|
|
189
|
+
- [Third Party Javascript Management Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Third_Party_Javascript_Management_Cheat_Sheet.md)
|
|
190
|
+
- [Securing Cascading Style Sheets Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Securing_Cascading_Style_Sheets_Cheat_Sheet.md)
|
|
191
|
+
- [Clickjacking Defense Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Clickjacking_Defense_Cheat_Sheet.md)
|
|
192
|
+
- [DOM Clobbering Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/DOM_Clobbering_Prevention_Cheat_Sheet.md)
|
|
193
|
+
- [Subdomain Takeover Prevention Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Subdomain_Takeover_Prevention_Cheat_Sheet.md)
|
|
194
|
+
- [OAuth2 Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/OAuth2_Cheat_Sheet.md)
|
|
195
|
+
- [SAML Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SAML_Security_Cheat_Sheet.md)
|
|
196
|
+
- [JSON Web Token for Java Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/JSON_Web_Token_for_Java_Cheat_Sheet.md)
|
|
197
|
+
- [Legacy Application Management Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Legacy_Application_Management_Cheat_Sheet.md)
|
|
198
|
+
- [Multi Tenant Security Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Multi_Tenant_Security_Cheat_Sheet.md)
|
|
199
|
+
- [Bot Management and Anti-Automation Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Bot_Management_and_Anti-Automation_Cheat_Sheet.md)
|
|
200
|
+
- [Authorization Testing Automation Cheat Sheet](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authorization_Testing_Automation_Cheat_Sheet.md)
|
|
201
|
+
|
|
202
|
+
## How to Use This Skill
|
|
203
|
+
|
|
204
|
+
### For Developers
|
|
205
|
+
|
|
206
|
+
1. **Identify the security concern** (e.g., "I need to prevent SQL injection")
|
|
207
|
+
2. **Navigate to the relevant category** (Injection Prevention)
|
|
208
|
+
3. **Click the specific cheat sheet link** (SQL Injection Prevention)
|
|
209
|
+
4. **Follow the actionable guidance** provided in the official OWASP documentation
|
|
210
|
+
|
|
211
|
+
### For Security Reviewers
|
|
212
|
+
|
|
213
|
+
1. **Use the Attack Surface Analysis Cheat Sheet** to identify potential vulnerabilities
|
|
214
|
+
2. **Cross-reference with relevant prevention cheat sheets**
|
|
215
|
+
3. **Apply the Secure Code Review Cheat Sheet** principles
|
|
216
|
+
4. **Document findings using the Logging Cheat Sheet** guidance
|
|
217
|
+
|
|
218
|
+
### For Architects
|
|
219
|
+
|
|
220
|
+
1. **Start with Secure Product Design Cheat Sheet**
|
|
221
|
+
2. **Apply Secure Cloud Architecture principles**
|
|
222
|
+
3. **Use Microservices Security Cheat Sheet** for distributed systems
|
|
223
|
+
4. **Implement Infrastructure as Code Security** best practices
|
|
224
|
+
|
|
225
|
+
## Common Security Patterns
|
|
226
|
+
|
|
227
|
+
### Authentication Flow
|
|
228
|
+
|
|
229
|
+
```
|
|
230
|
+
1. User provides credentials (username/password)
|
|
231
|
+
2. Validate input (Input Validation Cheat Sheet)
|
|
232
|
+
3. Verify password securely (Password Storage Cheat Sheet)
|
|
233
|
+
4. Create session (Session Management Cheat Sheet)
|
|
234
|
+
5. Set secure cookies (Cookie Theft Mitigation Cheat Sheet)
|
|
235
|
+
6. Implement MFA if required (Multifactor Authentication Cheat Sheet)
|
|
236
|
+
```
|
|
237
|
+
|
|
238
|
+
### Secure Data Access
|
|
239
|
+
|
|
240
|
+
```
|
|
241
|
+
1. Receive user input
|
|
242
|
+
2. Validate all input (Input Validation Cheat Sheet)
|
|
243
|
+
3. Use parameterized queries (SQL Injection Prevention Cheat Sheet)
|
|
244
|
+
4. Encode output (XSS Prevention Cheat Sheet)
|
|
245
|
+
5. Log access appropriately (Logging Cheat Sheet)
|
|
246
|
+
```
|
|
247
|
+
|
|
248
|
+
### API Security Checklist
|
|
249
|
+
|
|
250
|
+
- [ ] Input validation on all endpoints (Input Validation)
|
|
251
|
+
- [ ] Authentication and authorization (Authentication, Authorization)
|
|
252
|
+
- [ ] Rate limiting (Denial of Service)
|
|
253
|
+
- [ ] Secure headers (HTTP Headers)
|
|
254
|
+
- [ ] CORS configuration
|
|
255
|
+
- [ ] Error handling without information leakage (Error Handling)
|
|
256
|
+
|
|
257
|
+
## OWASP Top 10 Mapping
|
|
258
|
+
|
|
259
|
+
The cheat sheets align with the OWASP Top 10 vulnerabilities:
|
|
260
|
+
|
|
261
|
+
| OWASP Top 10 | Relevant Cheat Sheets |
|
|
262
|
+
| ----------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
263
|
+
| A01:2021 - Broken Access Control | [Access Control](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Access_Control_Cheat_Sheet.md), [Authorization](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authorization_Cheat_Sheet.md), [Insecure Direct Object Reference Prevention](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Insecure_Direct_Object_Reference_Prevention_Cheat_Sheet.md) |
|
|
264
|
+
| A02:2021 - Cryptographic Failures | [Cryptographic Storage](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cryptographic_Storage_Cheat_Sheet.md), [Password Storage](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md), [TLS Cipher String](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/TLS_Cipher_String_Cheat_Sheet.md) |
|
|
265
|
+
| A03:2021 - Injection | [SQL Injection Prevention](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.md), [XSS Prevention](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.md), [OS Command Injection](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/OS_Command_Injection_Defense_Cheat_Sheet.md), [LDAP Injection](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/LDAP_Injection_Prevention_Cheat_Sheet.md), [Deserialization](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md) |
|
|
266
|
+
| A04:2021 - Insecure Design | [Secure Product Design](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Secure_Product_Design_Cheat_Sheet.md), [Business Logic Security](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Business_Logic_Security_Cheat_Sheet.md), [Attack Surface Analysis](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Attack_Surface_Analysis_Cheat_Sheet.md) |
|
|
267
|
+
| A05:2021 - Security Misconfiguration | [HTTP Headers](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/HTTP_Headers_Cheat_Sheet.md), [Content Security Policy](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Content_Security_Policy_Cheat_Sheet.md), [Secure Cloud Architecture](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Secure_Cloud_Architecture_Cheat_Sheet.md) |
|
|
268
|
+
| A06:2021 - Vulnerable and Outdated Components | [Dependency Graph SBOM](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Dependency_Graph_SBOM_Cheat_Sheet.md), [Software Supply Chain Security](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Software_Supply_Chain_Security_Cheat_Sheet.md) |
|
|
269
|
+
| A07:2021 - Identification and Authentication Failures | [Authentication](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Authentication_Cheat_Sheet.md), [Password Storage](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Password_Storage_Cheat_Sheet.md), [Session Management](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Session_Management_Cheat_Sheet.md), [Multifactor Authentication](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Multifactor_Authentication_Cheat_Sheet.md) |
|
|
270
|
+
| A08:2021 - Software and Data Integrity Failures | [Input Validation](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Input_Validation_Cheat_Sheet.md), [File Upload](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/File_Upload_Cheat_Sheet.md), [Deserialization](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Deserialization_Cheat_Sheet.md) |
|
|
271
|
+
| A09:2021 - Security Logging and Monitoring Failures | [Logging](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Logging_Cheat_Sheet.md), [Logging Vocabulary](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Logging_Vocabulary_Cheat_Sheet.md) |
|
|
272
|
+
| A10:2021 - Server-Side Request Forgery | [SSRF Prevention](https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/Server_Side_Request_Forgery_Prevention_Cheat_Sheet.md) |
|
|
273
|
+
|
|
274
|
+
## Best Practices Summary
|
|
275
|
+
|
|
276
|
+
### Always Do
|
|
277
|
+
|
|
278
|
+
- Use parameterized queries for all database access
|
|
279
|
+
- Validate all input on the server side
|
|
280
|
+
- Encode all output based on context
|
|
281
|
+
- Store passwords using strong hashing (bcrypt, Argon2, PBKDF2)
|
|
282
|
+
- Use HTTPS for all communications
|
|
283
|
+
- Implement proper session management
|
|
284
|
+
- Apply the principle of least privilege
|
|
285
|
+
- Log security-relevant events
|
|
286
|
+
|
|
287
|
+
### Never Do
|
|
288
|
+
|
|
289
|
+
- Use string concatenation for SQL queries
|
|
290
|
+
- Store passwords in plaintext or using weak hashing (MD5, SHA1)
|
|
291
|
+
- Trust client-side validation alone
|
|
292
|
+
- Expose sensitive information in error messages
|
|
293
|
+
- Use predictable session IDs
|
|
294
|
+
- Disable security headers
|
|
295
|
+
- Ignore security in the design phase
|
|
296
|
+
|
|
297
|
+
## Complete Cheat Sheet Index
|
|
298
|
+
|
|
299
|
+
For a complete, searchable list of all cheat sheets, visit:
|
|
300
|
+
|
|
301
|
+
- [OWASP Cheat Sheet Series Repository](https://github.com/OWASP/CheatSheetSeries/tree/master/cheatsheets)
|
|
302
|
+
- [OWASP Cheat Sheet Series Website](https://cheatsheetseries.owasp.org/)
|
|
303
|
+
|
|
304
|
+
## Original Source
|
|
305
|
+
|
|
306
|
+
All content is sourced from the [OWASP Cheat Sheet Series](https://github.com/OWASP/CheatSheetSeries) repository, licensed under [CC-BY-SA-4.0](https://creativecommons.org/licenses/by-sa/4.0/).
|
|
307
|
+
|
|
308
|
+
For the most up-to-date information, always refer to the official OWASP repository.
|
|
@@ -0,0 +1,42 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: rfc-spec
|
|
3
|
+
description: Creates an Agent Skill from an RFC URL. Downloads the RFC text and creates a skeleton SKILL.md. The LLM should then read the RFC and enhance the skeleton with proper description, title, and key information. Use when you need to create a skill from an IETF RFC document.
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# RFC Skill Creator
|
|
7
|
+
|
|
8
|
+
This skill provides a script to create a skeleton Agent Skill from an IETF RFC URL. The LLM must then read the downloaded RFC and enhance the generated SKILL.md.
|
|
9
|
+
|
|
10
|
+
## Usage
|
|
11
|
+
|
|
12
|
+
Run the script with an RFC URL:
|
|
13
|
+
|
|
14
|
+
```bash
|
|
15
|
+
scripts/create-rfc-skill.sh https://www.rfc-editor.org/rfc/rfc4226.txt
|
|
16
|
+
```
|
|
17
|
+
|
|
18
|
+
## What It Creates
|
|
19
|
+
|
|
20
|
+
```
|
|
21
|
+
rfc4226/
|
|
22
|
+
├── SKILL.md # Skeleton - LLM must enhance this
|
|
23
|
+
└── references/
|
|
24
|
+
└── RFCXXXX.txt # Full RFC text for LLM to read
|
|
25
|
+
```
|
|
26
|
+
|
|
27
|
+
## LLM Workflow
|
|
28
|
+
|
|
29
|
+
1. Run the script to create the skeleton
|
|
30
|
+
2. Read the RFC from `references/RFCXXXX.txt`
|
|
31
|
+
3. Edit `SKILL.md` to:
|
|
32
|
+
- Replace TODO placeholders with actual content
|
|
33
|
+
- Add proper description (max 1024 chars)
|
|
34
|
+
- **Quote the description in YAML frontmatter** if it contains colons or special characters to avoid parsing errors
|
|
35
|
+
- Add relevant sections (Quick Reference, Key Concepts, etc.)
|
|
36
|
+
- Ensure frontmatter follows Agent Skills spec
|
|
37
|
+
|
|
38
|
+
## Requirements
|
|
39
|
+
|
|
40
|
+
- `curl` for downloading RFC content
|
|
41
|
+
- `bash` for execution
|
|
42
|
+
- Write access to the target skills directory
|
|
@@ -0,0 +1,81 @@
|
|
|
1
|
+
#!/bin/bash
|
|
2
|
+
set -euo pipefail
|
|
3
|
+
|
|
4
|
+
# RFC Skill Creator
|
|
5
|
+
# Creates an Agent Skill from an RFC URL following the Agent Skills specification
|
|
6
|
+
# Usage: ./create-rfc-skill.sh <rfc-url> [skills-base-dir]
|
|
7
|
+
|
|
8
|
+
if [ $# -lt 1 ] || [ $# -gt 3 ]; then
|
|
9
|
+
echo "Usage: $0 <rfc-url> [skills-base-dir]"
|
|
10
|
+
echo "Example: $0 https://www.rfc-editor.org/rfc/rfc8176.txt"
|
|
11
|
+
echo "Example: $0 https://www.rfc-editor.org/rfc/rfc8176.txt /path/to/skills"
|
|
12
|
+
exit 1
|
|
13
|
+
fi
|
|
14
|
+
|
|
15
|
+
RFC_URL="$1"
|
|
16
|
+
SKILLS_BASE="${2:-}"
|
|
17
|
+
|
|
18
|
+
# Extract RFC number from URL
|
|
19
|
+
RFC_NUMBER=$(basename "$RFC_URL" | sed 's/rfc\([0-9]*\).txt/\1/')
|
|
20
|
+
|
|
21
|
+
if [ -z "$RFC_NUMBER" ]; then
|
|
22
|
+
echo "Error: Could not extract RFC number from URL: $RFC_URL"
|
|
23
|
+
exit 1
|
|
24
|
+
fi
|
|
25
|
+
|
|
26
|
+
SKILL_NAME="rfc${RFC_NUMBER}"
|
|
27
|
+
|
|
28
|
+
# Validate skill name per Agent Skills spec
|
|
29
|
+
if ! [[ "$SKILL_NAME" =~ ^[a-z0-9-]+$ ]] || [[ "$SKILL_NAME" =~ ^- ]] || [[ "$SKILL_NAME" =~ -$ ]] || [[ "$SKILL_NAME" == *--* ]]; then
|
|
30
|
+
echo "Error: Skill name '$SKILL_NAME' is invalid. Use lowercase letters, numbers, and hyphens only. Cannot start/end with hyphen or contain consecutive hyphens."
|
|
31
|
+
exit 1
|
|
32
|
+
fi
|
|
33
|
+
|
|
34
|
+
# Determine skills directory
|
|
35
|
+
if [ -z "$SKILLS_BASE" ]; then
|
|
36
|
+
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
37
|
+
SKILLS_BASE="$(dirname "$(dirname "$SCRIPT_DIR")")"
|
|
38
|
+
fi
|
|
39
|
+
|
|
40
|
+
SKILLS_BASE="${SKILLS_BASE%/}/"
|
|
41
|
+
SKILL_DIR="${SKILLS_BASE}${SKILL_NAME}"
|
|
42
|
+
|
|
43
|
+
if [ -d "$SKILL_DIR" ]; then
|
|
44
|
+
echo "Error: Skill directory already exists: $SKILL_DIR"
|
|
45
|
+
exit 1
|
|
46
|
+
fi
|
|
47
|
+
|
|
48
|
+
mkdir -p "$SKILL_DIR/references"
|
|
49
|
+
|
|
50
|
+
echo "Downloading RFC $RFC_NUMBER..."
|
|
51
|
+
curl -sS -o "$SKILL_DIR/references/RFC${RFC_NUMBER}.txt" "$RFC_URL"
|
|
52
|
+
|
|
53
|
+
if [ ! -s "$SKILL_DIR/references/RFC${RFC_NUMBER}.txt" ]; then
|
|
54
|
+
echo "Error: Failed to download RFC"
|
|
55
|
+
rm -rf "$SKILL_DIR"
|
|
56
|
+
exit 1
|
|
57
|
+
fi
|
|
58
|
+
|
|
59
|
+
# Create skeleton SKILL.md - LLM should enhance this based on RFC content
|
|
60
|
+
cat > "$SKILL_DIR/SKILL.md" <<EOF
|
|
61
|
+
---
|
|
62
|
+
name: $SKILL_NAME
|
|
63
|
+
description: "RFC $RFC_NUMBER. TODO: Add description based on RFC content. Use when working with this RFC."
|
|
64
|
+
---
|
|
65
|
+
|
|
66
|
+
# RFC $RFC_NUMBER
|
|
67
|
+
|
|
68
|
+
TODO: Add summary and key information from the RFC.
|
|
69
|
+
|
|
70
|
+
## When to Use This Skill
|
|
71
|
+
|
|
72
|
+
TODO: Specify use cases.
|
|
73
|
+
|
|
74
|
+
## Full RFC Text
|
|
75
|
+
|
|
76
|
+
See [references/RFC${RFC_NUMBER}.txt](references/RFC${RFC_NUMBER}.txt) for the complete document.
|
|
77
|
+
EOF
|
|
78
|
+
|
|
79
|
+
echo "Created skill skeleton: $SKILL_DIR"
|
|
80
|
+
echo " - SKILL.md (edit based on RFC content)"
|
|
81
|
+
echo " - references/RFC${RFC_NUMBER}.txt"
|