security · diff
git:20261025.debe22c to git:20261025.ada6d1d
75 added, 19 removed. Audit A to A.
---
name: security
description: Security hardening and vulnerability defense skill. Enforces OWASP Top 10 mitigations, zero hardcoded secrets, input sanitization, and SQL parameterization.
---
# Security Hardening & Vulnerability Defense (`/security`)
- > **Philosophy**: *Assume breach. Defense in depth. Never trust client input. Never interpolate variables into queries or commands. Never hardcode credentials.*
+ > **Philosophy**: *Assume breach. Defense in depth. Never trust client input. Never interpolate variables into queries or shell commands. Never commit credentials. Hash passwords with Argon2id.*
- This skill establishes defensive security standards across web applications, APIs, databases, and container environments.
+ This skill establishes defensive security standards across web applications, APIs, databases, container environments, and secret management lifecycles.
---
## 1. The Core Security Gates
```mermaid
flowchart TD
- A["Untrusted Request"] --> B["Boundary Validation (Zod / Pydantic)"]
- B --> C["Strict Authentication & RBAC"]
- C --> D["Parameterized Queries (ORM / Prepared Statements)"]
- D --> E["Contextual Output Encoding (XSS Defense)"]
- E --> F["Audited Telemetry (No PII / Secrets in Logs)"]
+ A["Untrusted Request"] --> B["Gate 1: Boundary Validation & Schema Sanitization"]
+ B --> C["Gate 2: Authentication & RBAC Authorization"]
+ C --> D["Gate 3: Parameterized SQL & Safe Executables"]
+ D --> E["Gate 4: Contextual Output Encoding (XSS Defense)"]
+ E --> F["Gate 5: Audited Telemetry (Zero PII or Token Leaks)"]
```
- ### Gate 1: SQL Injection & Command Injection Prevention
- - **Strict Rule**: Never use string interpolation (`f"SELECT... {id}"`, `query = "..." + val`) to construct SQL queries or shell commands (`exec`, `eval`, `shell=True`).
- - **Standard**: Always use prepared statements, parameterized query arguments, or schema-validated ORMs.
+ ---
- ### Gate 2: Zero Hardcoded Secrets & Credential Hygiene
- - **Strict Rule**: Never commit API keys, JWT secrets, database passwords, or private keys to source code or Dockerfiles.
- - **Standard**: Load from environment variables (`process.env`, `os.environ`) with fallback to local uncommitted `.env` files guarded by `.gitignore` and `.env.example`.
+ ## 2. OWASP Top 10 Hardening Standards
- ### Gate 3: Modern OWASP Defense Checklist
- 1. **XSS Defense**: Use framework-native auto-escaping (React JSX, Angular templates); never use `dangerouslySetInnerHTML` without DOMPurify.
- 2. **CSRF & SameSite**: Set `SameSite=Lax` or `Strict` on all authentication cookies with `HttpOnly` and `Secure`.
- 3. **CORS Hardening**: Never use `Access-Control-Allow-Origin: *` alongside `credentials: true`. Explicitly whitelist production origins.
- 4. **Rate Limiting**: Protect authentication endpoints (`/login`, `/signup`, `/reset-password`) with token bucket or sliding window rate limiting.
+ ### 2.1 Injection Prevention (SQL, Command, LDAP)
+ - **Zero SQL String Interpolation**:
+ ```typescript
+ // ❌ VULNERABLE: Direct SQL injection risk
+ const user = await db.query(`SELECT * FROM users WHERE email = '${email}'`);
+ // ✅ DEFENSIVE: Parameterized prepared statement
+ const user = await db.query("SELECT * FROM users WHERE email = $1", [email]);
+ ```
+ - **Zero Shell Interpolation**: Never pass user input to `child_process.exec()` or Python `subprocess.run(..., shell=True)`. Use array form: `subprocess.run(["git", "checkout", branch], check=True)`.
+
+ ### 2.2 Broken Access Control & IDOR Defense
+ Never rely on client-supplied IDs without verifying ownership in the same transaction:
+ ```sql
+ -- Always scope mutations to the authenticated tenant/user ID
+ UPDATE documents
+ SET title = $1
+ WHERE id = $2 AND tenant_id = $3;
+ ```
+
+ ### 2.3 Cryptographic Hygiene & Password Hashing
+ - **Password Storage**: Use **Argon2id** (memory cost 64MB, time cost 3 iterations) or **bcrypt** with work factor >= 12. Never use SHA-256 or MD5 for passwords.
+ - **Tokens**: Generate high-entropy cryptographically secure random bytes via `crypto.randomBytes(32)` or `secrets.token_urlsafe(32)`.
+
+ ### 2.4 Cookie & Session Security
+ All authentication cookies must specify strict flags:
+ ```
+ Set-Cookie: session_id=...; Secure; HttpOnly; SameSite=Lax; Path=/; Max-Age=86400
+ ```
+ - `HttpOnly`: Blocks JavaScript `document.cookie` access (XSS token theft mitigation).
+ - `Secure`: Transmits cookies only over HTTPS.
+ - `SameSite=Lax` / `Strict`: Prevents Cross-Site Request Forgery (CSRF).
+
---
- ## 2. Security Hygiene Auditor CLI
+ ## 3. Path Traversal & File Handling
+ Always normalize and verify file paths to prevent directory traversal (`../../etc/passwd`):
+
+ ```typescript
+ import path from "node:path";
+
+ export function resolveSafePath(rootDir: string, userPath: string): string {
+ const safeRoot = path.resolve(rootDir);
+ const targetPath = path.resolve(safeRoot, userPath);
+
+ if (!targetPath.startsWith(safeRoot)) {
+ throw new SecurityException("Directory traversal attempt detected");
+ }
+ return targetPath;
+ }
+ ```
+
+ ---
+
+ ## 4. Secret Hygiene & Environment Variable Rules
+
+ 1. **Never commit `.env` files**: Ensure `.gitignore` explicitly ignores `.env`, `.env.local`, `.env.*.local`, and `*.pem` keys.
+ 2. **Provide `.env.example`**: Maintain an up-to-date `.env.example` containing dummy template keys and setup instructions.
+ 3. **Scan with Pre-Commit Hooks**: Integrate `gitleaks` or `git-secrets` in local dev and CI pipelines.
+
+ ---
+
+ ## 5. Security Hygiene Auditor CLI
+
Scan your repository for hardcoded secrets, unsafe shell executions, and query interpolations:
```bash
python3 skills/security/scripts/audit_security_hygiene.py --path .
```
+ Audits:
+ - Unsafe `exec`, `eval`, or `shell=True` calls.
+ - SQL queries constructed with string concatenation or f-strings.
+ - Exposed API keys, private keys, or passwords.
+ - Cookie headers missing `Secure`, `HttpOnly`, or `SameSite`.