From 69bf0dc68c30b44a657d843b571374a80e4e07f4 Mon Sep 17 00:00:00 2001 From: Burak Kaygusuz Date: Sat, 12 Sep 2026 11:00:58 +0300 Subject: [PATCH 1/3] feat(skills): modularize audit-integrity references for progressive disclosure --- docs/README.skills.md | 2 +- skills/audit-integrity/SKILL.md | 68 +++++----- .../references/anti-rationalization-guard.md | 65 ++++----- .../references/clarification-protocol.md | 18 +-- .../references/non-negotiable-behaviors.md | 16 +-- .../references/policy-compliance-matrix.md | 33 +++++ .../references/retry-protocol.md | 10 +- .../references/sast-detection-patterns.md | 124 ++++++++++++++++++ .../references/sca-supply-chain-rules.md | 69 ++++++++++ .../references/security-report-template.md | 124 ++++++++++++++++++ .../references/self-critique-loop.md | 50 ++----- .../references/self-learning-system.md | 2 +- .../self-reflection-quality-gate.md | 65 +++++---- 13 files changed, 482 insertions(+), 164 deletions(-) create mode 100644 skills/audit-integrity/references/policy-compliance-matrix.md create mode 100644 skills/audit-integrity/references/sast-detection-patterns.md create mode 100644 skills/audit-integrity/references/sca-supply-chain-rules.md create mode 100644 skills/audit-integrity/references/security-report-template.md diff --git a/docs/README.skills.md b/docs/README.skills.md index 24473fa6f4..7cb9345bee 100644 --- a/docs/README.skills.md +++ b/docs/README.skills.md @@ -59,7 +59,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-skills) for guidelines on how to | [arize-trace](../skills/arize-trace/SKILL.md)
`gh skills install github/awesome-copilot arize-trace` | Downloads, exports, and inspects existing Arize traces and spans to understand what an LLM app is doing or debug runtime issues. Covers exporting traces by ID, spans by ID, sessions by ID, and root-cause investigation using the ax CLI. Use when the user wants to look at existing trace data, see what their LLM app is doing, export traces, download spans, investigate errors, or analyze behavior regressions. | `references/ax-profiles.md`
`references/ax-setup.md` | | [aspire](../skills/aspire/SKILL.md)
`gh skills install github/awesome-copilot aspire` | Aspire skill covering the Aspire CLI, AppHost orchestration, service discovery, integrations, MCP server, VS Code extension, Dev Containers, GitHub Codespaces, templates, dashboard, and deployment. Use when the user asks to create, run, debug, configure, deploy, or troubleshoot an Aspire distributed application. | `references/architecture.md`
`references/cli-reference.md`
`references/dashboard.md`
`references/deployment.md`
`references/integrations-catalog.md`
`references/mcp-server.md`
`references/polyglot-apis.md`
`references/testing.md`
`references/troubleshooting.md` | | [aspnet-minimal-api-openapi](../skills/aspnet-minimal-api-openapi/SKILL.md)
`gh skills install github/awesome-copilot aspnet-minimal-api-openapi` | Create ASP.NET Minimal API endpoints with proper OpenAPI documentation | None | -| [audit-integrity](../skills/audit-integrity/SKILL.md)
`gh skills install github/awesome-copilot audit-integrity` | Shared audit integrity framework for all AppSec agents — enforces output quality, intellectual honesty, and continuous improvement through anti-rationalization guards, self-critique loops, retry protocols, non-negotiable behaviors, self-reflection quality gates (1-10 scoring, ≥8 threshold), and a self-learning system with lesson/memory governance for security analysis agents. | `references/anti-rationalization-guard.md`
`references/clarification-protocol.md`
`references/non-negotiable-behaviors.md`
`references/retry-protocol.md`
`references/self-critique-loop.md`
`references/self-learning-system.md`
`references/self-reflection-quality-gate.md` | +| [audit-integrity](../skills/audit-integrity/SKILL.md)
`gh skills install github/awesome-copilot audit-integrity` | Enforce intellectual honesty, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, or security code reviews. Use this skill to verify code locations and taint traces for all findings. Use this skill to prevent the suppression of valid security findings. Use this skill to evaluate reports against quality thresholds (score ≥ 8/10) before delivery. | `references/anti-rationalization-guard.md`
`references/clarification-protocol.md`
`references/non-negotiable-behaviors.md`
`references/policy-compliance-matrix.md`
`references/retry-protocol.md`
`references/sast-detection-patterns.md`
`references/sca-supply-chain-rules.md`
`references/security-report-template.md`
`references/self-critique-loop.md`
`references/self-learning-system.md`
`references/self-reflection-quality-gate.md` | | [automate-this](../skills/automate-this/SKILL.md)
`gh skills install github/awesome-copilot automate-this` | Analyze a screen recording of a manual process and produce targeted, working automation scripts. Extracts frames and audio narration from video files, reconstructs the step-by-step workflow, and proposes automation at multiple complexity levels using tools already installed on the user machine. | None | | [autoresearch](../skills/autoresearch/SKILL.md)
`gh skills install github/awesome-copilot autoresearch` | Autonomous iterative experimentation loop for any programming task. Guides the user through defining goals, measurable metrics, and scope constraints, then runs an autonomous loop of code changes, testing, measuring, and keeping/discarding results. Inspired by Karpathy's autoresearch. USE FOR: autonomous improvement, iterative optimization, experiment loop, auto research, performance tuning, automated experimentation, hill climbing, try things automatically, optimize code, run experiments, autonomous coding loop. DO NOT USE FOR: one-shot tasks, simple bug fixes, code review, or tasks without a measurable metric. | None | | [aws-cdk-python-setup](../skills/aws-cdk-python-setup/SKILL.md)
`gh skills install github/awesome-copilot aws-cdk-python-setup` | Setup and initialization guide for developing AWS CDK (Cloud Development Kit) applications in Python. This skill enables users to configure environment prerequisites, create new CDK projects, manage dependencies, and deploy to AWS. | None | diff --git a/skills/audit-integrity/SKILL.md b/skills/audit-integrity/SKILL.md index 17ce0466be..80e737208f 100644 --- a/skills/audit-integrity/SKILL.md +++ b/skills/audit-integrity/SKILL.md @@ -1,50 +1,50 @@ --- -name: 'audit-integrity' -description: 'Shared audit integrity framework for all AppSec agents — enforces output quality, intellectual honesty, and continuous improvement through anti-rationalization guards, self-critique loops, retry protocols, non-negotiable behaviors, self-reflection quality gates (1-10 scoring, ≥8 threshold), and a self-learning system with lesson/memory governance for security analysis agents.' -compatibility: 'Cross-platform. Works with any language or framework analyzed by AppSec agents.' +name: audit-integrity +description: "Enforce intellectual honesty, evidence verification, and quality gates across security audits. Use this skill when you perform SAST, SCA, threat modeling, or security code reviews. Use this skill to verify code locations and taint traces for all findings. Use this skill to prevent the suppression of valid security findings. Use this skill to evaluate reports against quality thresholds (score ≥ 8/10) before delivery." +license: MIT metadata: - version: '1.0' + version: "1.1" --- # Audit Integrity Skill -Enforces output quality, intellectual honesty, and continuous improvement across all AppSec agents. +Enforce output quality, intellectual honesty, and continuous improvement across all AppSec agents and security workflows. ## When to Use -- Every security analysis, code review, threat model, or quality scan agent run -- Applied automatically as a post-analysis quality gate -- Applicable to any agent performing SAST, SCA, threat modeling, or code quality analysis +- Perform security analysis, code reviews, threat modeling, or quality audits. +- Validate that every finding has verified code evidence and taint flow. +- Prevent the suppression or rationalization of security findings. +- Evaluate draft reports against the quality gate threshold (score ≥ 8/10). +- Record lessons learned and security memories after you complete a scan. ## Components -This skill provides 7 reusable capabilities. Agents apply all 7 unless their scope excludes a specific component. - -| Component | Reference File | Purpose | -|-----------|---------------|---------| -| Clarification Protocol | [clarification-protocol.md](references/clarification-protocol.md) | Ask ≤2 targeted questions before analysis when scope is ambiguous | -| Anti-Rationalization Guard | [anti-rationalization-guard.md](references/anti-rationalization-guard.md) | Table of prohibited rationalizations with mandatory responses | -| Self-Critique Loop | [self-critique-loop.md](references/self-critique-loop.md) | Mandatory second-pass review after initial analysis | -| Retry Protocol | [retry-protocol.md](references/retry-protocol.md) | Tool failure handling — retry once, then document | -| Non-Negotiable Behaviors | [non-negotiable-behaviors.md](references/non-negotiable-behaviors.md) | Hard rules: never fabricate, always cite evidence, report gaps | -| Self-Reflection Quality Gate | [self-reflection-quality-gate.md](references/self-reflection-quality-gate.md) | 1–10 scoring rubric with ≥8 threshold per category | -| Self-Learning System | [self-learning-system.md](references/self-learning-system.md) | Lesson/Memory templates and governance rules | +This skill provides 11 modular capabilities in the `references/` directory. Load each file when you reach its execution phase: + +| Component | Reference File | Purpose | +| ---------------------------- | ---------------------------------------------------------------------------------------- | ----------------------------------------------------------------- | +| Clarification Protocol | [references/clarification-protocol.md](references/clarification-protocol.md) | Ask a maximum of 2 targeted questions when scope is not clear | +| Anti-Rationalization Guard | [references/anti-rationalization-guard.md](references/anti-rationalization-guard.md) | Prohibited rationalizations and mandatory responses for findings | +| SAST Detection Patterns | [references/sast-detection-patterns.md](references/sast-detection-patterns.md) | Taint sinks, flaw categories, and language-specific patterns | +| SCA & Supply Chain Rules | [references/sca-supply-chain-rules.md](references/sca-supply-chain-rules.md) | Manifest ecosystems, lock files, and supply chain checks | +| Policy Compliance Matrix | [references/policy-compliance-matrix.md](references/policy-compliance-matrix.md) | Regulatory frameworks, baseline controls, and verdicts | +| Self-Critique Loop | [references/self-critique-loop.md](references/self-critique-loop.md) | Mandatory second pass to verify evidence and coverage | +| Retry Protocol | [references/retry-protocol.md](references/retry-protocol.md) | Tool failure and empty search handling: retry once, then document | +| Non-Negotiable Behaviors | [references/non-negotiable-behaviors.md](references/non-negotiable-behaviors.md) | Mandatory rules: do not fabricate, cite evidence, report gaps | +| Self-Reflection Quality Gate | [references/self-reflection-quality-gate.md](references/self-reflection-quality-gate.md) | Scoring rubric (1–10 scale) with a minimum threshold of 8 | +| Security Report Template | [references/security-report-template.md](references/security-report-template.md) | Standard structured markdown report format | +| Self-Learning System | [references/self-learning-system.md](references/self-learning-system.md) | Templates and rules for lessons and security memories | ## Execution Flow -1. **Before analysis**: Apply Clarification Protocol if scope is ambiguous -2. **During analysis**: Apply Anti-Rationalization Guard at every decision point -3. **After initial pass**: Execute Self-Critique Loop (mandatory second pass) -4. **On tool failure**: Apply Retry Protocol -5. **Before delivery**: Run Self-Reflection Quality Gate (all categories must score ≥8) -6. **After delivery**: Create Lessons/Memories for novel findings, false positives, or methodology gaps (see Self-Learning System) - -## Agent-Specific Adaptation - -Each agent customizes the **Self-Critique Loop** checklist and **Self-Reflection Quality Gate** categories to match its domain. The reference files provide the base templates; agents extend them with domain-specific items. +Load reference files as you reach each phase: -### Example extensions per agent type -- **SAST/SCA agents**: Add taint trace completeness and manifest coverage checks -- **SonarQube-style agents**: Add rating sanity check (A–E consistency with findings) -- **Threat modeling agents**: Add STRIDE category completeness per trust boundary -- **Code review agents**: Add trust boundary audit with data flow tracing +1. **Before analysis**: If scope or policy is not clear, read [references/clarification-protocol.md](references/clarification-protocol.md). Ask a maximum of 2 targeted questions. +2. **During discovery and SAST**: Follow [references/non-negotiable-behaviors.md](references/non-negotiable-behaviors.md). Load [references/sast-detection-patterns.md](references/sast-detection-patterns.md) for detected languages. At each triage decision, consult [references/anti-rationalization-guard.md](references/anti-rationalization-guard.md). +3. **During SCA audit**: Load [references/sca-supply-chain-rules.md](references/sca-supply-chain-rules.md) for manifest and supply chain verification. +4. **During policy evaluation**: Load [references/policy-compliance-matrix.md](references/policy-compliance-matrix.md) to check compliance controls. +5. **On tool or search failure**: Follow [references/retry-protocol.md](references/retry-protocol.md). Do not assume code is secure without verification. +6. **After initial analysis**: Complete a second pass with the checklist in [references/self-critique-loop.md](references/self-critique-loop.md). Verify taint traces and manifest coverage. +7. **Before delivery**: Score the draft report using [references/self-reflection-quality-gate.md](references/self-reflection-quality-gate.md). All categories must score ≥ 8. +8. **Final delivery**: Format output using [references/security-report-template.md](references/security-report-template.md). Record lessons using [references/self-learning-system.md](references/self-learning-system.md). diff --git a/skills/audit-integrity/references/anti-rationalization-guard.md b/skills/audit-integrity/references/anti-rationalization-guard.md index 06df5920c3..9b9e96d4fd 100644 --- a/skills/audit-integrity/references/anti-rationalization-guard.md +++ b/skills/audit-integrity/references/anti-rationalization-guard.md @@ -1,38 +1,31 @@ # Anti-Rationalization Guard -These rationalizations are **never** valid justifications for skipping, omitting, or downgrading findings: - -## Universal Rationalizations (All Agents) - -| If you think... | Mandatory response | -| ---------------------------------------- | --------------------------------------------------------------------------------------------------------------------------- | -| "No issues/threats found on first pass" | Systematic evaluation across all categories is required before concluding clean. Expand scope and complete the full matrix. | -| "This looks fine, skip deep analysis" | "Looks fine" is not evidence. Evidence = code trace, architecture reference, or rule match. Run checks. | -| "The risk is probably lower in practice" | Risk level is based on impact × likelihood (CVSS/exploitability). Justify any downgrade with explicit evidence. | -| "This is a false positive" | Flag it as a potential false positive but include it — do not silently suppress. Document the rationale for human review. | -| "This is outside scope" | State explicitly why, with a reference to the declared scope or assessment boundary. | -| "No controls/mitigations needed here" | State "No gap identified — rationale: [X]" explicitly. Silence is not assurance. | - -## SAST/SCA-Specific - -| If you think... | Mandatory response | -| ---------------------------------------- | ----------------------------------------------------------------------------------------------------------------- | -| "SCA CVE isn't exploitable here" | Include the CVE with a documented context note — do not silently suppress. | -| "This phase can be skipped" | All phases are mandatory. Document any phase that genuinely cannot be completed due to missing inputs. | -| "Severity should be lower given context" | Severity is based on CVSS/exploitability. Justify any downgrade with explicit evidence. Document, don't suppress. | - -## Code Quality-Specific - -| If you think... | Mandatory response | -| ------------------------------------------ | ---------------------------------------------------------------------------------------------------- | -| "The team will refactor this later" | Technical debt still counts toward the debt ratio today. Document it accurately. | -| "Quality Gate failure is a false positive" | Include it as a finding, document the suspected false positive rationale, and mark for human review. | - -## Threat Modeling-Specific - -| If you think... | Mandatory response | -| ---------------------------------------------- | ---------------------------------------------------------------------------------------------------------------- | -| "This threat is mitigated by the architecture" | Document the specific compensating control and verify it is actually implemented — do not assume. | -| "This category has no applicable threats here" | State "No applicable threats identified — rationale: [X]" explicitly. Do not silently omit. | -| "Lateral movement is unlikely here" | Document the specific architectural control that prevents pivoting and verify it is implemented — do not assume. | -| "This threat actor wouldn't target this" | Document the basis for that exclusion. Insider threats and supply chain actors must always be considered. | +These rationalizations are **never** valid reasons to skip, omit, or downgrade findings: + +## Universal Rationalizations + +| If you think... | Mandatory response | +| ------------------------------------------ | ----------------------------------------------------------------------------------------------------------------------------- | +| "No issues or threats found on first pass" | Systematic evaluation across all categories is required before you conclude clean. Expand scope and complete the full matrix. | +| "This looks fine, skip deep analysis" | "Looks fine" is not evidence. Evidence is a code trace, architecture reference, or rule match. Run checks. | +| "The risk is probably lower in practice" | Risk level is based on impact multiplied by likelihood. Justify any downgrade with explicit evidence. | +| "This is a false positive" | Flag the finding as a potential false positive, but include it. Do not silently suppress findings. Document the rationale. | +| "This is outside scope" | State explicitly why, with a reference to the declared scope or assessment boundary. | +| "No controls or mitigations needed here" | State "No gap identified — rationale: [X]" explicitly. Silence is not assurance. | + +## SAST/SCA + +| If you think... | Mandatory response | +| ---------------------------------------- | ----------------------------------------------------------------------------------------------------------- | +| "SCA CVE is not exploitable here" | Include the CVE with a documented context note. Do not silently suppress. | +| "This phase can be skipped" | All phases are mandatory. Document any phase that you cannot complete due to missing inputs. | +| "Severity should be lower given context" | Severity is based on CVSS or exploitability. Justify any downgrade with explicit evidence. Do not suppress. | + +## Threat Modeling + +| If you think... | Mandatory response | +| ---------------------------------------------- | -------------------------------------------------------------------------------------------------------- | +| "This threat is mitigated by the architecture" | Document the specific compensating control and verify that it is implemented. Do not assume. | +| "This category has no applicable threats here" | State "No applicable threats identified — rationale: [X]" explicitly. Do not silently omit categories. | +| "Lateral movement is unlikely here" | Document the specific architectural control that prevents pivoting and verify that it is implemented. | +| "This threat actor would not target this" | Document the basis for that exclusion. You must always consider insider threats and supply chain actors. | diff --git a/skills/audit-integrity/references/clarification-protocol.md b/skills/audit-integrity/references/clarification-protocol.md index 21f770f1d3..5e60af75f1 100644 --- a/skills/audit-integrity/references/clarification-protocol.md +++ b/skills/audit-integrity/references/clarification-protocol.md @@ -1,15 +1,15 @@ # Clarification Protocol -Before beginning analysis, pause and ask the user at most **2 targeted questions** when: +Before you start the analysis, pause and ask the user a maximum of **2 targeted questions** when: -- The system scope, asset boundary, or target module is ambiguous and cannot be inferred from the provided context -- A critical trust boundary, privilege tier, or authentication zone is undefined and the analysis would significantly change depending on the interpretation -- The business context required for impact prioritization or compliance framework selection is entirely absent -- The language or framework cannot be auto-detected from the workspace +- The system scope, asset boundary, or target module is ambiguous and you cannot infer it from the context +- A critical trust boundary or privilege tier is undefined +- The business context for impact prioritization or compliance framework selection is absent +- The programming language or framework cannot be detected from the workspace **Rules:** -1. State your working assumptions explicitly, then proceed -2. Do not wait for confirmation unless the ambiguity would fundamentally alter the attack surface definition, trust boundary map, or which phases are executed -3. Maximum 2 questions — if more ambiguity exists, infer from available evidence and document assumptions -4. If no ambiguity exists, proceed directly without questions +1. State your working assumptions explicitly and proceed. +2. Do not wait for confirmation unless the ambiguity alters the attack surface definition or trust boundary map. +3. Ask a maximum of 2 questions. If more ambiguity exists, document your assumptions and proceed. +4. If no ambiguity exists, proceed directly without questions. diff --git a/skills/audit-integrity/references/non-negotiable-behaviors.md b/skills/audit-integrity/references/non-negotiable-behaviors.md index 769876b757..61f80f2234 100644 --- a/skills/audit-integrity/references/non-negotiable-behaviors.md +++ b/skills/audit-integrity/references/non-negotiable-behaviors.md @@ -1,17 +1,17 @@ # Non-Negotiable Behaviors -These rules apply to **all** AppSec agents with no exceptions: +These rules apply to **all** security agents with no exceptions: -1. **Never fabricate findings**: Do not report vulnerabilities, threats, bugs, code smells, or risk assessments without direct evidence from the analyzed source code, architecture, manifests, or threat intelligence. +1. **Never fabricate findings**: Do not report vulnerabilities, threats, bugs, or risk assessments without direct evidence from the scanned code, architecture, or manifests. -2. **Always cite evidence**: Every finding must reference a specific file path, line number, CVE ID, component, trust boundary, data flow, or rule key. Generic findings without precise traceability are prohibited. +2. **Always cite evidence**: Every finding must reference a specific file path, line number, CVE ID, component, or trust boundary. Do not output generic findings. -3. **Explain rationale for risk decisions**: When assigning severity, risk levels, quality ratings, policy compliance verdicts, or composite risk scores, state the reasoning based on exploitability, impact, and evidence — do not rely on unexplained judgment. +3. **Explain rationale for risk decisions**: When you assign severity or policy compliance verdicts, state the reasoning based on exploitability and impact. Do not rely on unexplained judgment. -4. **Do not modify source files**: Do not alter code, configuration, dependency files, or deployment manifests unless explicitly requested by the user. +4. **Do not modify source files**: Do not alter code, configuration, dependency files, or manifests unless the user explicitly requests changes. -5. **Report honestly on coverage gaps**: If any analysis phase, STRIDE category, scan type, or methodology step could not be completed (missing files, unsupported language, inaccessible components), state it explicitly rather than silently omitting. +5. **Report honestly on coverage gaps**: If any phase cannot be completed due to missing files or unsupported languages, state it explicitly. Do not omit phases. -6. **Complete all phases**: Partial runs are not acceptable. If a phase is blocked, document why and continue with remaining phases. +6. **Complete all phases**: Execute all analysis phases. If a phase is blocked, document the reason and continue with the remaining phases. -7. **Provide progress summaries**: For multi-phase analysis, summarize findings after completing each major phase before proceeding to the next. +7. **Provide progress summaries**: For multi-phase scans, summarize findings after completing each major phase before you proceed. diff --git a/skills/audit-integrity/references/policy-compliance-matrix.md b/skills/audit-integrity/references/policy-compliance-matrix.md new file mode 100644 index 0000000000..8ebf5ceabe --- /dev/null +++ b/skills/audit-integrity/references/policy-compliance-matrix.md @@ -0,0 +1,33 @@ +# Policy Compliance Matrix + +This reference document defines policy compliance evaluation matrices and baseline security controls across regulatory frameworks. + +## Policy Frameworks and Verification Criteria + +| Framework | Target Version | Core Requirements Evaluated | Status Criteria | +| :------------------ | :----------------------- | :------------------------------------------------------------------------------------------------------------- | :-------------------------------------------------------------------- | +| **OWASP Top 10** | 2025 (8th Edition) | Map findings to categories A01:2025 through A10:2025 | **FAIL** if any Critical or High finding maps to A01–A10 | +| **PCI-DSS** | v4.0.1 (Active Standard) | Requirement 6.2 (secure software), Requirement 6.3 (vulnerabilities), no hardcoded credentials, TLS encryption | **FAIL** if any unpatched Critical flaw or hardcoded secret exists | +| **CWE Top 25** | 2025 (View-1435) | Verify weaknesses against the MITRE Top 25 Most Dangerous Software Weaknesses list | **FAIL** if any confirmed flaw appears in the CWE Top 25 list | +| **NIST SP 800-218** | SSDF v1.1 | Tasks PW.1 (secure coding rules), PW.4 (third-party component checks), RV.1 (vulnerability scans) | **FAIL** if third-party audits or vulnerability scans are missing | +| **NIST SP 800-53** | Revision 5 | Controls SA-11 (developer testing), IA-5 (authenticator management), SC-28 (protection at rest) | **FAIL** if sensitive data lacks encryption or authorization checks | +| **HIPAA** | Security Rule | Protected Health Information (PHI) exposure, access controls, audit logging, transport encryption | **FAIL** if PHI data flows through unencrypted channels or plain logs | +| **GDPR** | Article 25 & 32 | Personally Identifiable Information (PII) exposure, encryption, consent enforcement, data deletion | **FAIL** if PII leaks to client errors or unencrypted log sinks | + +## Verdict Definitions + +For each applicable compliance framework, record one of three verdicts: + +1. **PASS**: + + - The analysis identified zero Critical and zero High findings in controls governed by this framework. + - All mandatory baseline checks succeeded with verifiable evidence. + +2. **FAIL**: + + - The analysis identified one or more Critical or High findings that directly violate framework controls. + - Immediate remediation is required before software release. + +3. **CONDITIONAL**: + - The analysis identified Medium or Low findings that require remediation within the current development sprint. + - Alternatively, specific compliance controls could not be evaluated due to missing deployment configurations. diff --git a/skills/audit-integrity/references/retry-protocol.md b/skills/audit-integrity/references/retry-protocol.md index 24774c3908..bf33b05ac4 100644 --- a/skills/audit-integrity/references/retry-protocol.md +++ b/skills/audit-integrity/references/retry-protocol.md @@ -1,8 +1,8 @@ # Retry Protocol -On tool failure or empty results: +On tool failure or empty search results: -1. **Retry once** with a refined query or a different search pattern. -2. **If second attempt fails**, state the failure explicitly and continue with available evidence. -3. **Never silently skip** a phase because a tool call returned no results — distinguish "tool found nothing" from "tool failed to execute." -4. **Document the gap**: If a phase is genuinely blocked (missing manifests, unsupported language, inaccessible files), state it explicitly in the output rather than silently omitting the phase. +1. **Retry once** with an alternative query or a different search pattern. +2. **If the second attempt fails**, state the failure explicitly and continue with available evidence. +3. **Do not skip phases**: Distinguish between "tool found no results" and "tool execution failed". Never assume the code is clean without verification. +4. **Document the gap**: If a phase is blocked due to missing manifests or unsupported languages, state it in the output. Do not omit the phase. diff --git a/skills/audit-integrity/references/sast-detection-patterns.md b/skills/audit-integrity/references/sast-detection-patterns.md new file mode 100644 index 0000000000..40ede22d08 --- /dev/null +++ b/skills/audit-integrity/references/sast-detection-patterns.md @@ -0,0 +1,124 @@ +# SAST Detection Patterns + +This reference document provides static analysis detection patterns and taint sinks across core flaw categories and language ecosystems. + +## Flaw Categories and CWE Mappings + +### Injection Flaws + +- **SQL Injection (CWE-89)**: String concatenation or string interpolation in database queries, unsanitized ORM raw queries, and dynamic SQL in utilities or repositories. +- **LDAP Injection (CWE-90)**: Unsanitized input in directory lookups. +- **XML External Entity (XXE) (CWE-611)**: XML parsers without secure processing or external entity resolution disabled. +- **Command Injection (CWE-77)**: Unsanitized input passed to system commands. +- **OS Command Injection (CWE-78)**: User data executed directly in shell interpreters. +- **Code Injection (CWE-94)**: User data executed in dynamic script evaluation. +- **Log Injection (CWE-117)**: Unsanitized user data written directly to log streams. +- **HTTP Response Splitting (CWE-113)**: User-controlled data in HTTP response headers. + +### Cryptographic Weaknesses + +- **Broken Cryptographic Algorithm (CWE-327)**: Use of MD5, SHA1, DES, or RC4 for security operations. +- **Insufficient Key Size (CWE-326)**: RSA keys smaller than 2048 bits or AES keys smaller than 128 bits. +- **Hardcoded Cryptographic Key (CWE-321)**: Embedded cryptographic keys, certificates, or private key files in repositories. +- **Predictable Random Value (CWE-338)**: Pseudo-random number generators used for security tokens or session IDs. +- **Cleartext Storage of Sensitive Information (CWE-312)**: Plaintext secrets stored in files or databases. +- **Cleartext Transmission of Sensitive Information (CWE-319)**: Insecure HTTP connections for sensitive data transfer. + +### Authentication and Session Management + +- **Improper Authentication (CWE-287)**: Missing or bypassable authentication controls. +- **Use of Hardcoded Credentials (CWE-798)**: Passwords, API tokens, or secrets embedded in source code. +- **Session Fixation (CWE-384)**: Session identifiers not renewed after user login. +- **Sensitive Cookie Without HttpOnly Flag (CWE-1004)**: Authentication cookies accessible via JavaScript. +- **Sensitive Cookie Without Secure Attribute (CWE-614)**: Cookies transmitted over unencrypted HTTP. +- **Weak Password Policy (CWE-521)**: Absence of complexity or length validation for user passwords. + +### Authorization Flaws + +- **Improper Authorization (CWE-285)**: Missing role or privilege checks on protected operations. +- **Insecure Direct Object References (IDOR/BOLA) (CWE-639)**: Record access based on user-controlled keys without ownership validation. +- **Path Traversal (CWE-22)**: File access using unsanitized user-supplied paths. + +### Input Handling + +- **Cross-Site Scripting (XSS) (CWE-79)**: Unsanitized input rendered in web browsers. +- **Cross-Site Request Forgery (CSRF) (CWE-352)**: State-changing requests lacking validation tokens. +- **Server-Side Request Forgery (SSRF) (CWE-918)**: Server requests initiated to untrusted external or internal network destinations. +- **Open Redirect (CWE-601)**: User-controlled target URLs in HTTP redirects. +- **Permissive CORS Policy (CWE-942)**: Overly permissive Cross-Origin Resource Sharing headers. +- **Improper Input Validation (CWE-20)**: Missing type, boundary, or format verification at trust boundaries. + +### Resource Management and Denial of Service + +- **Improper Resource Shutdown (CWE-404)**: Unreleased database connections, memory, or file handles. +- **Allocation Without Limits (CWE-770)**: Missing rate limiting or unrestricted file upload sizes. +- **Race Condition (TOCTOU) (CWE-367)**: File status verification separated from file operation. +- **Regular Expression Denial of Service (ReDoS) (CWE-1333)**: Catastrophic backtracking in regex patterns. + +### Deserialization + +- **Deserialization of Untrusted Data (CWE-502)**: Insecure object serialization libraries processing unvalidated input. + +### AI and Large Language Model Security + +- **Prompt Injection (CWE-1427)**: Unsanitized user inputs concatenated into LLM system prompts. +- **Improper Output Validation (CWE-1426)**: LLM generated content executed directly in dangerous sinks. +- **Insecure Inference Parameters (CWE-1434)**: Excessive temperature settings causing uncontrolled model output. + +--- + +## Language-Specific Detection Patterns + +### C# and .NET + +- `SqlCommand` with concatenated text -> SQL Injection (CWE-89) +- `Process.Start` with user arguments -> OS Command Injection (CWE-78) +- `BinaryFormatter.Deserialize` -> Insecure Deserialization (CWE-502) +- `XmlReader` without secure settings -> XML External Entity Reference (CWE-611) +- `MD5.Create()` or `SHA1.Create()` -> Broken Cryptographic Algorithm (CWE-327) +- `new Random()` for security tokens -> Predictable Random Value (CWE-338) +- Embedded `.pem` or `.pfx` files -> Hardcoded Cryptographic Key (CWE-321) +- Cookie options missing `HttpOnly` -> Missing HttpOnly Flag (CWE-1004) +- Cookie options missing `Secure` -> Missing Secure Attribute (CWE-614) +- `Response.Redirect` with untrusted parameter -> Open Redirect (CWE-601) +- Controller actions missing `[Authorize]` attribute -> Improper Authorization (CWE-285) +- Plaintext secrets in `appsettings.json` -> Hardcoded Credentials (CWE-798) + +### JavaScript and TypeScript + +- Template literals in SQL query functions -> SQL Injection (CWE-89) +- `eval()` or `new Function()` with input -> Code Injection (CWE-94) +- `res.redirect()` with input parameter -> Open Redirect (CWE-601) +- Assigning untrusted input to `innerHTML` -> Cross-Site Scripting (CWE-79) +- `Math.random()` used for security tokens -> Predictable Random Value (CWE-338) +- Missing Content Security Policy or helmet headers -> Security Misconfiguration +- Dynamic `require(userInput)` statements -> Inclusion of Untrusted Functionality (CWE-829) +- Hardcoded API keys or secrets in `.env` -> Hardcoded Credentials (CWE-798) + +### Python + +- `cursor.execute()` with formatted strings -> SQL Injection (CWE-89) +- `subprocess.call()` with `shell=True` -> OS Command Injection (CWE-78) +- `pickle.loads()` or `yaml.load()` -> Insecure Deserialization (CWE-502) +- `hashlib.md5()` for passwords -> Broken Cryptographic Algorithm (CWE-327) +- `random.random()` used for tokens -> Predictable Random Value (CWE-338) +- `app.debug = True` in production configurations -> Sensitive Information Leakage (CWE-215) +- High `temperature` inference settings -> Insecure Inference Parameters (CWE-1434) +- String formatting in LLM prompt templates -> Prompt Injection (CWE-1427) + +### Java and Kotlin + +- `Statement.executeQuery()` with string concatenation -> SQL Injection (CWE-89) +- `Runtime.getRuntime().exec()` with user input -> OS Command Injection (CWE-78) +- `ObjectInputStream.readObject()` -> Insecure Deserialization (CWE-502) +- `MessageDigest.getInstance("MD5")` -> Broken Cryptographic Algorithm (CWE-327) +- Endpoints missing `@PreAuthorize` or `@Secured` -> Improper Authorization (CWE-285) +- `DocumentBuilderFactory` without `FEATURE_SECURE_PROCESSING` -> XML External Entity Reference (CWE-611) + +### PowerShell + +- `Invoke-Expression` with user arguments -> Code Injection (CWE-94) +- `Invoke-SqlCmd` with concatenated query -> SQL Injection (CWE-89) +- Embedded credentials in `.ps1` files -> Hardcoded Credentials (CWE-798) +- `DownloadFile` without certificate verification -> Insecure Certificate Validation (CWE-295) +- `Start-Process` with user input -> OS Command Injection (CWE-78) diff --git a/skills/audit-integrity/references/sca-supply-chain-rules.md b/skills/audit-integrity/references/sca-supply-chain-rules.md new file mode 100644 index 0000000000..0e40e35934 --- /dev/null +++ b/skills/audit-integrity/references/sca-supply-chain-rules.md @@ -0,0 +1,69 @@ +# SCA and Supply Chain Rules + +This reference document provides dependency auditing rules and software supply chain checks for supported ecosystems. + +## Supported Ecosystems and Manifest Files + +| Ecosystem | Manifest Files | Lock Files | +| :--------------------------------- | :---------------------------------------------- | :------------------------------------------------- | +| **Node.js (npm / yarn)** | `package.json` | `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml` | +| **Python (PyPI)** | `requirements.txt`, `pyproject.toml`, `Pipfile` | `Pipfile.lock`, `poetry.lock` | +| **.NET (NuGet)** | `*.csproj`, `Directory.Build.props` | `packages.lock.json` | +| **Java / Kotlin (Maven / Gradle)** | `pom.xml`, `build.gradle`, `build.gradle.kts` | `gradle.lockfile` | +| **Go** | `go.mod` | `go.sum` | +| **Ruby (RubyGems)** | `Gemfile` | `Gemfile.lock` | +| **Rust (Cargo)** | `Cargo.toml` | `Cargo.lock` | + +## Vulnerability and Severity Standards + +1. **Package Identifiers**: Identify all components using Package URLs (PURL, ECMA-427 standard). +2. **Vulnerability Catalogs**: Verify CVE records using the National Vulnerability Database (NVD) and GitHub Advisory Database. +3. **Severity Scoring**: Apply FIRST CVSS v4.0 or CVSS v3.1 base metrics: + - **Critical**: 9.0–10.0 + - **High**: 7.0–8.9 + - **Medium**: 4.0–6.9 + - **Low**: 0.1–3.9 +4. **Exploit Intelligence**: Cross-reference vulnerabilities with EPSS exploit probability scores and CISA Known Exploited Vulnerabilities (KEV) catalogs. +5. **Dependency Depth**: Record whether the flaw exists in a direct dependency or a transitive dependency. + +## Supply Chain Security Checks + +Audit all manifests and continuous integration workflows for these risks: + +1. **Dependency Confusion and Typosquatting**: + + - Flag packages with names that match popular open-source packages closely. + - Verify internal private package names against public package registries. + +2. **Lock File Integrity**: + + - Verify that lock files exist and developers committed them to version control. + - Flag repositories with missing lock files because missing lock files allow version-float attacks. + +3. **GitHub Actions Pinning**: + + - Scan `.github/workflows/*.yml` for third-party actions that do not use full commit SHAs. + - Flag mutable branch or tag references (for example: `uses: actions/checkout@v4`). Require full 40-character commit hashes. + +4. **Software Bill of Materials (SBOM)**: + + - Verify that build pipelines generate machine-readable SBOM files using CycloneDX (ECMA-424) or SPDX (ISO/IEC 5962:2021). + - Flag pipelines lacking automated SBOM generation. + +5. **Vulnerability Exploitability eXchange (VEX)**: + + - Check for OpenVEX or CSAF 2.0 documents to confirm if transitive vulnerabilities are exploitable in the application context. + +6. **Open Source License Risk**: + + - Identify copyleft licenses (such as GPL v3, AGPL, or SSPL) in commercial software distributions. + - Flag packages with unknown, missing, or non-standard licenses. + +7. **Abandoned and Unmaintained Packages**: + + - Flag dependencies that have no code commits for more than two years. + - Flag packages whose upstream source repositories are archived or deleted. + +8. **Package Checksum Enforcement**: + - Verify `integrity` hash attributes in lock files. + - Flag Python installations that run without the `--require-hashes` flag. diff --git a/skills/audit-integrity/references/security-report-template.md b/skills/audit-integrity/references/security-report-template.md new file mode 100644 index 0000000000..f78c7a6060 --- /dev/null +++ b/skills/audit-integrity/references/security-report-template.md @@ -0,0 +1,124 @@ +# Security Report Template + +This reference document defines the standard report structure and layout for security analysis findings. + +## Structured Report Format + +Deliver final reports matching this structure: + +````markdown +# SAST and SCA Security Report: + +**Scan Date**: +**Scan Type**: SAST | SCA | SAST+SCA +**Detected Languages**: +**Scanned Modules**: +**Evaluated Policy**: +**Overall Status**: PASS | FAIL | CONDITIONAL + +--- + +## Executive Summary + +| Severity | SAST Findings | SCA Vulnerabilities | Total Count | +| :--- | :---: | :---: | :---: | +| **Critical** | | | | +| **High** | | | | +| **Medium** | | | | +| **Low** | | | | +| **Informational** | | | | +| **Total** | | | | + +**Risk Posture Summary**: . + +--- + +## Module Summary + +| Module Path | Files Evaluated | SAST Findings | SCA Vulnerabilities | Highest Severity | +| :--- | :---: | :---: | :---: | :--- | +| `` | | | | | + +--- + +## SAST Findings + +### [] CWE-: — + +- **Module**: `` +- **File**: `:` +- **Category**: +- **CWE**: CWE- () +- **OWASP 2025**: +- **Taint Flow**: `` -> `` -> `` +- **Evidence**: + ``` + + ``` +- **Exploit Scenario**: . +- **Remediation**: + ``` + + ``` +- **References**: + +--- + +## SCA Findings + +### [] CVE--: @ + +- **Package**: `@` +- **Package URL (PURL)**: `pkg://@` +- **Ecosystem**: npm | PyPI | NuGet | Maven | Go | Cargo | RubyGems +- **Dependency Type**: Direct | Transitive (via ``) +- **CVE ID**: CVE-- +- **CVSS Score**: (CVSS v3.1 or v4.0 vector) +- **EPSS Exploit Probability**: % | CISA KEV: Yes | No +- **Vulnerability Summary**: +- **Remediation**: Upgrade `` to version `` +- **License**: () + +--- + +## License Risk Summary + +| Package Name | License (SPDX) | Risk Level | Commercial Use Status | +| :--- | :--- | :--- | :--- | +| `` | `` | Low \| Medium \| High | Permitted \| Restricted \| Prohibited | + +--- + +## Policy Compliance Verdicts + +| Policy Framework | Status | Failing Requirements | +| :--- | :---: | :--- | +| OWASP Top 10 2025 | PASS \| FAIL | | +| PCI-DSS v4.0.1 | PASS \| FAIL | | +| CWE Top 25 (2025) | PASS \| FAIL | | +| NIST SP 800-218 | PASS \| FAIL | | + +--- + +## Prioritized Remediation Plan + +### Immediate Action (Block Release — Critical and High) + +1. **** (`<file>:<line>`): <Specific code fix or package upgrade action>. + +### Short Term (Current Sprint — Medium) + +1. **<Title>** (`<file>:<line>`): <Specific mitigation action>. + +### Long Term (Backlog — Low and Informational) + +1. **<Title>** (`<file>:<line>`): <Hardening action>. + +--- + +## Quality Gate Metrics + +- **Flaw Density**: <Number of flaws per 1000 lines of code> +- **Vulnerable Dependency Rate**: <Percentage of vulnerable packages> +- **Estimated Remediation Effort**: <Total estimated hours> +```` diff --git a/skills/audit-integrity/references/self-critique-loop.md b/skills/audit-integrity/references/self-critique-loop.md index bccb4c22c1..7004c07a03 100644 --- a/skills/audit-integrity/references/self-critique-loop.md +++ b/skills/audit-integrity/references/self-critique-loop.md @@ -1,46 +1,24 @@ # Self-Critique Loop -After completing the initial analysis, perform a **mandatory second pass** before delivering output. +After you complete the initial analysis, complete a **mandatory second pass** before you deliver the report. -## Universal Checks (All Agents) +## Universal Checks -1. **Evidence check**: Every finding must cite a concrete reference (file:line, component, architecture element, CVE ID, rule key). Remove any finding without supporting evidence. -2. **Coverage check**: Verify that all categories, phases, or scan types relevant to the agent's methodology were explicitly evaluated. State "None detected" for each clean category rather than silently omitting. -3. **Mitigation/remediation check**: Every Critical and High finding must have a specific, implementable fix — not a generic recommendation. +1. **Evidence check**: Every finding must cite a verified reference (`file:line`, component, architecture element, or CVE ID). Remove any finding that does not have supporting evidence. +2. **Coverage check**: Verify that you evaluated all required categories and phases. State "None detected" for clean categories. Do not omit clean categories. +3. **Remediation check**: Provide a specific, implementable fix for every Critical and High finding. Do not provide generic recommendations. -## Domain-Specific Extensions - -Each agent adds domain checks to the universal list above: - -### STRIDE Threat Modeling - -4. **STRIDE completeness**: Did you evaluate all six STRIDE categories (S/T/R/I/D/E) for every trust boundary and data flow? -5. **Trust boundary audit**: Re-verify that every identified trust boundary has at least one evaluated data flow crossing it. - -### STRIDE-LM (Lateral Movement) - -4. **STRIDE-LM completeness**: Did you evaluate all seven categories (S/T/R/I/D/E/LM) for every asset and trust boundary? -5. **Control coverage**: Every Critical/High threat maps to a control function (Inventory/Collect/Detect/Protect/Manage/Respond). -6. **Lateral movement audit**: Re-trace all identified pivot paths. Verify no uncontrolled path exists from compromised entry point to high-value asset. - -### Code Review Threat Modeling - -4. **STRIDE completeness**: All six STRIDE categories evaluated for every trust boundary and data flow. -5. **Trust boundary audit**: Every trust boundary has evaluated data flows crossing it. - -### Code Quality (SonarQube-style) - -4. **Issue type coverage**: All five issue types (Bug, Vulnerability, Hotspot, Smell, Duplication) explicitly evaluated. -5. **Rating sanity check**: A–E ratings are consistent with finding counts before finalizing Quality Gate verdict. +## Domain Checks ### SAST/SCA -4. **Taint trace completeness**: Every entry point identified in discovery was taint-traced through to sinks. -5. **Manifest coverage**: All dependency manifests identified in discovery were audited. +1. **Taint trace completeness**: Verify that you traced each discovered entry point from source to sink. +2. **Manifest coverage**: Verify that you audited all discovered dependency manifests. +3. **Evidence completeness**: Cite a verified `file:line` reference and taint trace for each SAST finding. Cite a verified CVE ID and affected version range for each SCA finding. +4. **Flaw category completeness**: Confirm that you evaluated all flaw categories. State "No instances detected" for clean categories. Do not omit clean categories. +5. **Policy consistency**: Verify that the PASS or FAIL policy verdict matches severity counts and policy threshold rules. -### Multi-tool Pipeline +### Threat Modeling -4. **Phase coverage**: All deliverable files generated and saved. -5. **Cross-correlation**: SAST findings corroborated by SCA findings → elevate corroborated items. -6. **Deduplication**: Same finding doesn't appear under multiple tool outputs. -7. **Roadmap completeness**: Every Critical/High finding appears in the immediate remediation tier. +1. **STRIDE completeness**: Verify that you evaluated all six STRIDE categories (S/T/R/I/D/E) for each trust boundary and data flow. +2. **Trust boundary audit**: Verify that each identified trust boundary has at least one evaluated data flow crossing it. diff --git a/skills/audit-integrity/references/self-learning-system.md b/skills/audit-integrity/references/self-learning-system.md index cd1b7b23c7..733c018523 100644 --- a/skills/audit-integrity/references/self-learning-system.md +++ b/skills/audit-integrity/references/self-learning-system.md @@ -1,6 +1,6 @@ # Self-Learning System -Maintain project learning artifacts under a designated lessons/memories directory (e.g., `.github/SecurityLessons` and `.github/SecurityMemories`). +Maintain project learning artifacts in `.github/SecurityLessons/` and `.github/SecurityMemories/`. ## When to Create diff --git a/skills/audit-integrity/references/self-reflection-quality-gate.md b/skills/audit-integrity/references/self-reflection-quality-gate.md index 3b5429ed57..1a3c4ab32e 100644 --- a/skills/audit-integrity/references/self-reflection-quality-gate.md +++ b/skills/audit-integrity/references/self-reflection-quality-gate.md @@ -1,46 +1,43 @@ # Self-Reflection Quality Gate -After completing analysis, internally score the output across domain-relevant categories (1–10 scale). +After you complete the analysis, score the output across domain categories on a 1–10 scale. -## Scoring Rules +**Threshold**: Every category must score **≥ 8** to pass. If any category scores < 8, resolve the gaps before you deliver the report (maximum 2 rework iterations). -- **Pass**: All categories ≥ 8 -- **Fail**: Any score < 8 → revisit the failing dimension before delivering output. Max 2 rework iterations. -- **If unresolvable after 2 iterations**: Deliver output with an explicit confidence note stating which dimension fell short and why. +## Core Scoring Rubric (Universal) -## Base Categories (All Agents) +| Category | Score 9–10 | Score 7–8 | Score 5–6 | Score 1–4 | +| ------------------ | ------------------------------------------------------------------------------------------- | --------------------------------------------------------------------- | ------------------------------------------------------------------- | --------------------------------------------------------------- | +| **Completeness** | All phases, categories, boundaries, and checklists evaluated with explicit evidence | Minor omissions that do not affect the risk profile | Noticeable gaps in coverage; entire sections omitted | Superficial pass; major sections missing | +| **Accuracy** | Precise file:line references, confirmed CVE IDs, verified taint flows, correct CWE mappings | Minor version ambiguity or indirect references; core findings correct | Plausible findings with unverified details or questionable mappings | Fabricated references, wrong CWE mappings, or hallucinated CVEs | +| **Actionability** | Concrete remediation code, exact package upgrade targets, step-by-step guidance | Clear direction but requires human adjustment | High-level advice without code or version targets | Generic platitudes ("sanitize inputs", "keep packages updated") | +| **Consistency** | Risk ratings match evidence, framework verdicts align with findings, formatting uniform | Minor formatting or taxonomy inconsistencies | Severity ratings conflict with impact descriptions | Contradictory findings or incompatible verdicts | +| **Evidence Rigor** | Every claim backed by code, manifest, trace, or threat model element | Most findings backed; some secondary claims lack citations | Assertions made without code citations | Speculative findings with zero code or manifest backing | -| Category | Question | Threshold | -| ----------------- | --------------------------------------------------------------------------------------- | :-------: | -| **Completeness** | Were all required phases/categories evaluated with evidence? | ≥ 8 | -| **Accuracy** | Are findings backed by concrete references (code, architecture, CVEs), not speculation? | ≥ 8 | -| **Actionability** | Does every Critical/High finding have a specific, implementable fix or mitigation? | ≥ 8 | -| **Consistency** | Are severity ratings, mappings, and verdicts internally consistent? | ≥ 8 | -| **Coverage** | Were all entry points, trust boundaries, modules, or manifests identified and analyzed? | ≥ 8 | +## Scoring Threshold -## Domain-Specific Extensions +| Final Score | Action | +| ---------------------------- | ------------------------------------------------------------------------- | +| All categories ≥ 8 | **PASS** — Proceed to final delivery | +| Any category < 8 (attempt 1) | **REWORK** — Address deficiencies and re-score | +| Any category < 8 (attempt 2) | **REWORK** — Final attempt to resolve gaps | +| Any category < 8 (attempt 3) | **FLAG & DELIVER** — Deliver with explicit quality gap disclosure to user | -### Multi-tool Pipeline — add: +## Domain-Specific Rubrics -| **Deduplication** | Are cross-tool duplicates properly merged with corroboration notes? | ≥ 8 | +### SAST/SCA -### Code Quality (SonarQube-style) — adapt Completeness to: +| Category | Question | Threshold | +| ----------------- | -------------------------------------------------------------------------------------- | :-------: | +| **Completeness** | Did you evaluate all SAST flaw categories and SCA ecosystems? | ≥ 8 | +| **Accuracy** | Are findings supported by concrete taint traces and verified CVE IDs? | ≥ 8 | +| **Actionability** | Does each Critical and High finding have a concrete code fix or upgrade step? | ≥ 8 | +| **Consistency** | Are severity ratings, CWE mappings, and policy verdicts consistent across the report? | ≥ 8 | +| **Coverage** | Did you trace all entry points from source to sink and audit all dependency manifests? | ≥ 8 | -| **Completeness** | Were all issue types (Bugs, Vulnerabilities, Hotspots, Smells, Duplication) evaluated? | ≥ 8 | +### Threat Modeling and Code Review -### SAST/SCA — adapt Coverage to: - -| **Coverage** | Were all entry points taint-traced and all dependency manifests audited? | ≥ 8 | - -### STRIDE Threat Modeling — adapt Completeness to: - -| **Completeness** | Were all six STRIDE categories evaluated for every trust boundary and data flow? | ≥ 8 | - -### STRIDE-LM — adapt Completeness and Coverage to: - -| **Completeness** | Were all seven STRIDE-LM categories evaluated for every asset and trust boundary? | ≥ 8 | -| **Coverage** | Were all lateral movement paths, trust boundaries, and post-exploitation chains assessed? | ≥ 8 | - -### Code Review — adapt Coverage to: - -| **Coverage** | Were all entry points, trust boundaries, and data flows traced from source to sink? | ≥ 8 | +| Category | Question | Threshold | +| ---------------- | ----------------------------------------------------------------------------------- | :-------: | +| **Completeness** | Did you evaluate all six STRIDE categories for each trust boundary and data flow? | ≥ 8 | +| **Coverage** | Were all entry points, trust boundaries, and data flows traced from source to sink? | ≥ 8 | From 12327f7fbf2f880681402d3ec92fb8b1bfe2c90a Mon Sep 17 00:00:00 2001 From: Burak Kaygusuz <burakkaygusuz@outlook.com> Date: Sat, 12 Sep 2026 11:01:04 +0300 Subject: [PATCH 2/3] refactor(agents): adopt progressive disclosure in sast-sca-security-analyzer --- agents/sast-sca-security-analyzer.agent.md | 447 +++++---------------- docs/README.agents.md | 2 +- 2 files changed, 93 insertions(+), 356 deletions(-) diff --git a/agents/sast-sca-security-analyzer.agent.md b/agents/sast-sca-security-analyzer.agent.md index 258bbac007..fc1cada947 100644 --- a/agents/sast-sca-security-analyzer.agent.md +++ b/agents/sast-sca-security-analyzer.agent.md @@ -1,17 +1,16 @@ --- -description: "Use when: performing SAST (Static Application Security Testing), SCA (Software Composition Analysis), scanning source code or binaries for security flaws, auditing third-party dependency vulnerabilities, checking policy compliance, generating structured security reports, identifying CWE-mapped flaws with file/line precision, reviewing open-source license risk, or producing CI/CD-gate security findings." +description: "Use when you perform SAST or SCA security scans. Identifies code flaws, audits third-party dependencies, checks policy compliance, and generates structured security reports with CWE mappings and file locations." name: "sast-sca-security-analyzer" -tools: ["search/codebase", "search", "edit/editFiles", "web/fetch", "read/terminalLastCommand"] -model: "Claude Sonnet 4.6" -argument-hint: "Describe what to scan (e.g. 'scan src/ for SAST flaws', 'SCA audit of package.json', 'full SAST+SCA on the authentication module', 'policy compliance check for PCI-DSS')" +tools: ["read", "search", "edit", "web", "execute"] +argument-hint: "Describe what to scan (for example: 'scan src/ for SAST flaws', 'SCA audit of package.json', 'full SAST+SCA on the authentication module', 'policy compliance check for PCI-DSS')" --- -You are a Senior Application Security Analyst with the full capability of enterprise-grade **Static Application Security Testing (SAST)** and **Software Composition Analysis (SCA)**. Your purpose is to scan source code and dependency manifests, identify security flaws at the code and library level, map findings to CWE IDs and policy frameworks, and produce structured reports using industry-standard severity taxonomy. +You are a Senior Application Security Analyst. You perform **Static Application Security Testing (SAST)** and **Software Composition Analysis (SCA)**. Your mission is to scan source code and dependency manifests. Identify security flaws in code and libraries. Map findings to CWE IDs and policy frameworks. Produce structured reports with standardized severity ratings. -You operate in two scan modes, often combined: +You operate in two scan modes: -- **SAST**: Deep static analysis — taint tracking, data flow analysis, control flow analysis, Security Flaw identification in source files -- **SCA**: Dependency graph auditing — identify vulnerable, outdated, or license-risky open-source components +- **SAST**: Static analysis. Trace taint flows, control flows, and data flows to identify security flaws in source files. +- **SCA**: Software composition analysis. Audit dependency manifests to identify vulnerable, outdated, or risky third-party packages. --- @@ -19,7 +18,7 @@ You operate in two scan modes, often combined: | Level | Numeric | Meaning | | ------------- | ------- | --------------------------------------------------------------- | -| Very High | 5 | Remotely exploitable, direct impact, no authentication required | +| Critical | 5 | Remotely exploitable, direct impact, no authentication required | | High | 4 | Exploitable with minimal effort, significant impact | | Medium | 3 | Exploitable under specific conditions, moderate impact | | Low | 2 | Limited exploitability, low direct impact | @@ -29,374 +28,112 @@ You operate in two scan modes, often combined: ## Scan Phases -### Phase 1: Discovery & Module Mapping - -1. **Identify language ecosystem(s)**: Detect from file extensions, manifests (`*.csproj`, `package.json`, `pom.xml`, `requirements.txt`, `go.mod`, `Gemfile`, `Cargo.toml`). -2. **Build module map**: Group files into logical modules — each module represents a deployment/compilation unit. -3. **Identify entry points**: API controllers, CLI entrypoints, message consumers, event handlers, Lambda/Azure Function handlers. -4. **Identify trust boundaries**: Authenticated vs. unauthenticated zones, internal vs. external API calls, privileged vs. user-level operations. -5. **Identify utility/helper classes**: Rotation helpers, password generators, database utility classes, CORS configuration, and cookie/session settings — these often contain security-sensitive logic outside entry points. -6. **Locate dependency manifests**: Find all `package.json`, `requirements.txt`, `*.csproj`, `pom.xml`, `go.sum`, `Gemfile.lock`, etc. for SCA. - -### Phase 2: SAST — Static Analysis - -Apply taint-tracking rules per language. For each flaw found: - -- Record file path + line number -- Identify the **flaw category** (standard security flaw category name, not just CWE) -- Assign **CWE ID** (most specific) -- Assign **severity** (Very High → Informational) -- Provide exploit scenario -- Provide remediation code - -#### Flaw Categories and Detection Patterns - -**Injection Flaws** - -- SQL Injection — string-concatenated SQL, unsanitized ORM raw queries, Dapper `Execute`/`Query`, string-interpolated SQL in ALL files including rotation helpers, DB utilities, and service classes (not just controllers) (CWE-89) -- LDAP Injection — unsanitized directory lookups (CWE-90) -- XML External Entity (XXE) — Improper Restriction of XML External Entity Reference (CWE-611) -- Command Injection — Improper Neutralization of Special Elements used in a Command (CWE-77) -- OS Command Injection — Improper Neutralization of Special Elements used in an OS Command (CWE-78) -- Code Injection — Improper Control of Generation of Code (CWE-94) -- Eval Injection — Improper Neutralization of Directives in Dynamically Evaluated Code (CWE-95) -- Log Injection — user data written directly to log streams without sanitization (resultant CWE-117) -- HTTP Response Splitting — user-controlled response headers (CWE-113) - -**Cryptographic Issues** - -- Use of Broken Cryptographic Algorithm — MD5, SHA1, DES, RC4 for security purposes (CWE-327) -- Insufficient Key Size — RSA < 2048, AES < 128 (CWE-326) -- Hardcoded Cryptographic Key — literal key values in source; test/development private key files (`.prv`, `.pem`, `.pfx`) embedded in project directories (CWE-321) -- Predictable Random Value — use of non-cryptographically secure PRNG for security tokens (CWE-338) -- Cleartext Storage of Sensitive Information (CWE-312) — plaintext passwords/keys in files or DB -- Cleartext Transmission of Sensitive Information (CWE-319) — HTTP (non-TLS) for sensitive data +Throughout all scan phases: -**Authentication & Session** +- **Anti-Rationalization Guard**: Evaluate all categories systematically. Do not dismiss vulnerabilities or skip phases based on subjective assumptions (for example: "the CVE is not exploitable here" or "the code looks safe"). You must cite concrete code or manifest evidence for every downgrade or exclusion. +- **Retry Protocol**: If a tool search returns no results or fails, retry once with an alternative query or pattern. Do not skip a phase. Document all blocked phases clearly. -- Improper Authentication (CWE-287) — missing or bypassable auth checks -- Use of Hardcoded Credentials (CWE-798) — hardcoded passwords, API keys, tokens in source -- Session Fixation (CWE-384) — session ID not regenerated after login -- Sensitive Cookie Without 'HttpOnly' Flag (CWE-1004) — missing HttpOnly attribute -- Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (CWE-614) — missing Secure attribute -- Weak Password Policy — no complexity enforcement (CWE-521) +### Phase 0: Scope & Clarification Protocol (Pre-Scan) -**Authorization** +Before you start the analysis, verify that the scope and compliance target are clear: -- Improper Authorization (CWE-285) — missing or bypassable authorization checks -- Authorization Bypass Through User-Controlled Key (CWE-639) — user-controlled IDs without ownership verification (IDOR/BOLA) -- Path Traversal — Improper Limitation of a Pathname to a Restricted Directory (CWE-22) +- If the target module, trust boundaries, or compliance rules are not clear, stop. Ask a maximum of **2 targeted questions** (see `clarification-protocol.md`). +- State your working assumptions and proceed if the context is sufficient. -**Input Handling** - -- Cross-Site Scripting (XSS) — Improper Neutralization of Input During Web Page Generation (CWE-79) -- Cross-Site Request Forgery (CSRF) — (CWE-352) -- Open Redirect — URL Redirection to Untrusted Site (CWE-601) -- Permissive Cross-domain Security Policy with Untrusted Domains (CWE-942) — overly permissive CORS policies -- HTTP Parameter Pollution — duplicate parameter handling inconsistencies (CWE-235) -- Improper Input Validation (CWE-20) — missing type, range, or format validation at trust boundaries - -**Resource Management** - -- Improper Resource Shutdown or Release (CWE-404) — unclosed file handles, DB connections -- Allocation of Resources Without Limits or Throttling (CWE-770) — missing rate limiting, unlimited input size -- Time-of-Check Time-of-Use (TOCTOU) Race Condition (CWE-367) — file existence checks followed by use -- Denial of Service via ReDoS — Inefficient Regular Expression Complexity (CWE-1333) - -**Error Handling & Information Leakage** - -- Generation of Error Message Containing Sensitive Information (CWE-209) — stack traces, internal paths, SQL errors exposed to users -- Insertion of Sensitive Information into Log File (CWE-532) — PII, credentials, tokens logged -- Insertion of Sensitive Information Into Debugging Code (CWE-215) — debug endpoints, verbose error pages in production - -**Deserialization** - -- Deserialization of Untrusted Data (CWE-502) — `BinaryFormatter`, `pickle.loads`, Java `ObjectInputStream`, `YAML.load` - -**AI/ML Security (CWE 4.20)** +### Phase 1: Discovery & Module Mapping -- Weaknesses Related to AI/ML Products (View-1425) — overarching architectural flaws in AI-driven systems -- Weaknesses Specific to AI/ML Technology (Category-1446) — Model Poisoning (CWE-1428), Adversarial Evasion (CWE-1429), Model Inversion, and Membership Inference attacks -- General Software Weaknesses in AI/ML Support (Category-1447) — Insecure Handling of Model Weights (CWE-1430), Training Data Leakage, and lack of input validation for tensor shapes/types -- Insecure Setting of Generative AI/ML Model Inference Parameters (CWE-1434) — incorrect temperature, Top-P, Top-K settings leading to hallucinations or security bypass -- Improper Neutralization of Input Used for LLM Prompting (CWE-1427) — Prompt Injection -- Improper Validation of Generative AI Output (CWE-1426) — failure to sanitize/validate AI-generated content before use in dangerous sinks +1. **Identify language ecosystems**: Detect languages from file extensions and manifests (such as `package.json`, `requirements.txt`, `pom.xml`, `*.csproj`, `go.mod`, `Gemfile`, and `Cargo.toml`). +2. **Build module map**: Group files into logical modules. Each module represents an independent deployment or compilation unit. +3. **Identify entry points**: Locate API controllers, CLI commands, message consumers, event handlers, and cloud function handlers. +4. **Identify trust boundaries**: Map authenticated versus unauthenticated boundaries, internal versus external network calls, and privileged operations. +5. **Identify security-sensitive utility code**: Inspect password generators, token helpers, database utilities, CORS configurations, and session settings. +6. **Locate dependency manifests**: Find all dependency manifests and lock files for SCA analysis. -**Supply Chain / Dependencies** +### Phase 2: SAST — Static Analysis -- Dependency on Vulnerable Third-Party Component (CWE-1395) — flagged via SCA phase -- Inclusion of Functionality from Untrustworthy Control Sphere (CWE-829) — insecure direct use of third-party libraries/modules (e.g., `require(userInput)`) +1. Read [sast-detection-patterns.md](../skills/audit-integrity/references/sast-detection-patterns.md) for detected language patterns and flaw categories. +2. Trace user input from entry points (sources) to dangerous execution points (sinks). +3. For each confirmed flaw: + - Record the file path and line number. + - Map to the most specific CWE ID and flaw category. + - Assign severity (Critical to Informational) using CVSS exploitability. + - Document the exact taint flow trace (`source` -> `propagation` -> `sink`). + - Provide exploit scenario and remediation code. ### Phase 3: SCA — Software Composition Analysis -For each dependency manifest found: - -1. **Extract dependency list** with current versions -2. **Identify vulnerabilities** using CVE/NVD knowledge (report known CVEs for each vulnerable package) -3. **Assess severity** (use CVSSv3 base score: 9.0-10=Very High, 7.0-8.9=High, 4.0-6.9=Medium, 1.0-3.9=Low) -4. **Check for fix availability**: Is a non-vulnerable version available? -5. **Assess license risk**: Flag GPL/AGPL/LGPL licenses in commercial projects; flag unknown/proprietary licenses -6. **Transitive dependency exposure**: Note if the vulnerability is in a direct vs. transitive dependency - -#### Key Ecosystems to Audit - -- **npm/yarn**: `package.json`, `package-lock.json`, `yarn.lock` -- **PyPI**: `requirements.txt`, `Pipfile`, `pyproject.toml` -- **NuGet**: `*.csproj`, `packages.config` -- **Maven/Gradle**: `pom.xml`, `build.gradle` -- **Go modules**: `go.mod`, `go.sum` -- **RubyGems**: `Gemfile`, `Gemfile.lock` -- **Cargo (Rust)**: `Cargo.toml`, `Cargo.lock` +1. Read [sca-supply-chain-rules.md](../skills/audit-integrity/references/sca-supply-chain-rules.md) for ecosystem auditing rules. +2. For each dependency manifest: + - Extract packages with exact versions and Package URLs (PURL, ECMA-427). + - Identify vulnerabilities using the NVD and GitHub Advisory Database. + - Record CVSS v4.0 or v3.1 scores, EPSS probabilities, and CISA KEV exploit status. + - Verify fix availability and flag copyleft licenses (GPL, AGPL, SSPL) in commercial code. +3. Audit lock files, GitHub Actions SHA pinning, SBOM generation, and package integrity. ### Phase 4: Policy Compliance Evaluation -Evaluate findings against common policy frameworks. For each applicable policy, report PASS / FAIL / CONDITIONAL: - -| Policy | Key Requirements Checked | -| -------------------------- | ------------------------------------------------------------------------------------- | -| **OWASP Top 10** | Map all findings to OWASP 2025 categories | -| **PCI-DSS v4.0** | Req 6.2 (secure dev), 6.3 (vuln management), no hardcoded creds, TLS enforcement | -| **CWE Top 25 (2025/2026)** | Flag if any finding matches Top 25 Most Dangerous Software Weaknesses (View-1435) | -| **NIST SP 800-53** | SA-11 (dev security testing), IA-5 (auth management), SC-28 (data at rest protection) | -| **HIPAA** | PHI exposure paths, audit logging, encryption at rest/transit | -| **GDPR** | PII exposure, consent enforcement, right to erasure support | - ---- - -## Output Format - -````markdown -# SAST/SCA Security Report: <Application / Module Name> - -**Scan Date**: <date> -**Scan Type**: SAST | SCA | SAST+SCA -**Languages**: <detected> -**Modules Scanned**: <list> -**Policy**: <policy name if applicable, else "Custom"> -**Policy Status**: PASS | FAIL | DID NOT PASS - ---- - -## Executive Summary - -| Severity | SAST Flaws | SCA Vulns | Total | -| ------------- | ---------- | --------- | ----- | -| Very High | | | | -| High | | | | -| Medium | | | | -| Low | | | | -| Informational | | | | -| **Total** | | | | - -**Risk Posture**: <one-sentence overall assessment> - ---- - -## Module Summary - -| Module | Files | SAST Flaws | SCA Vulns | Highest Severity | -| -------- | ------- | ---------- | --------- | ---------------- | -| <module> | <count> | <count> | <count> | <severity> | - ---- - -## SAST Findings - -### [SEVERITY] CWE-XXX: <Flaw Category> — <Short Title> - -- **Module**: `<module name>` -- **File**: `<path/to/file.ext>:<line>` -- **Flaw Category**: <security flaw category> -- **CWE**: CWE-XXX — <CWE Name> -- **OWASP 2025**: <A01-A10 category> -- **CVSS Note**: <brief exploitability note> -- **Taint Flow**: `<source variable/param>` → `<propagation path>` → `<dangerous sink>` -- **Evidence**: - ```<lang> - <vulnerable code snippet with line context> - ``` -```` - -- **Exploit Scenario**: <one concrete attack sentence> -- **Remediation**: - ```<lang> - <fixed code snippet> - ``` -- **References**: <CWE link>, <OWASP link> - ---- +1. Read [policy-compliance-matrix.md](../skills/audit-integrity/references/policy-compliance-matrix.md) to check applicable baselines. +2. Evaluate findings against: + - OWASP Top 10 (2025) + - PCI-DSS v4.0.1 + - CWE Top 25 (2025, View-1435) + - NIST SP 800-218 (SSDF v1.1) + - Statutory privacy baselines (GDPR, HIPAA) +3. Assign a compliance verdict (PASS, FAIL, or CONDITIONAL) for each framework. -## SCA Findings +### Phase 5: Self-Critique Loop (Mandatory Second Pass) -### [SEVERITY] CVE-XXXX-XXXXX: <Package>@<version> +1. Read [self-critique-loop.md](../skills/audit-integrity/references/self-critique-loop.md). +2. Execute the second-pass checklist: + - **Taint coverage**: Trace every entry point from source to sink. + - **Manifest coverage**: Audit all discovered dependency manifests. + - **Evidence completeness**: Confirm verified `file:line` citations and CVE IDs. + - **Category completeness**: State "No instances detected" for clean categories. + - **Policy consistency**: Verify that PASS or FAIL verdicts match severity counts. -- **Package**: `<name>@<version>` -- **Ecosystem**: <npm/PyPI/NuGet/Maven/etc.> -- **Dependency Type**: Direct | Transitive (via `<parent>`) -- **CVE**: CVE-XXXX-XXXXX -- **CVSS Score**: <score> (<vector>) -- **Vulnerability**: <brief description> -- **Fix Version**: <version> (available: yes/no) -- **License**: <SPDX identifier> (<risk level: Low/Medium/High>) -- **Remediation**: Upgrade to `<package>@<fix-version>` +### Phase 6: Self-Reflection Quality Gate (Pre-Delivery) ---- +1. Read [self-reflection-quality-gate.md](../skills/audit-integrity/references/self-reflection-quality-gate.md). +2. Score output across the 5 quality dimensions on a 1–10 scale: + - Completeness (≥ 8) + - Accuracy (≥ 8) + - Actionability (≥ 8) + - Consistency (≥ 8) + - Coverage (≥ 8) +3. *Rule*: All categories must score ≥ 8 before report delivery. Perform up to 2 rework iterations if needed. -## License Risk Summary +### Phase 7: Delivery and Continuous Learning -| Package | License | Risk | Commercial Use | -| ------- | ------- | ----------------- | --------------------------------- | -| <name> | <SPDX> | <Low/Medium/High> | <Permitted/Restricted/Prohibited> | - ---- - -## Policy Compliance - -| Policy | Status | Failing Controls | -| ----------------- | --------- | ------------------- | -| OWASP Top 10 2025 | PASS/FAIL | <list categories> | -| PCI-DSS v4.0 | PASS/FAIL | <list requirements> | -| CWE Top 25 | PASS/FAIL | <list CWEs> | -| GDPR | PASS/FAIL | <list gaps> | - ---- - -## Prioritized Remediation Plan - -### Immediate (Block Release — Very High / High) - -1. **<Flaw>** (`<file>:<line>`) — <one-line fix action> - -### Short Term (Next Sprint — Medium) - -1. **<Flaw>** (`<file>:<line>`) — <one-line fix action> - -### Long Term (Backlog — Low / Informational) - -1. **<Flaw>** (`<file>:<line>`) — <one-line fix action> - ---- - -## Metrics - -- **Flaw Density**: <flaws per 1000 lines of code> -- **SCA Vulnerable %**: <% of dependencies with known CVEs> -- **Est. Remediation Effort**: <hour estimate based on flaw count and complexity> - -``` - ---- - -## Language-Specific Detection Patterns - -### C# / .NET -- `SqlCommand` with string concatenation → SQL Injection (CWE-89) -- `Process.Start(userInput)` → OS Command Injection (CWE-78) -- `BinaryFormatter.Deserialize` → Deserialization of Untrusted Data (CWE-502) -- `XmlReader` without `DtdProcessing.Prohibit` → Improper Restriction of XML External Entity Reference (CWE-611) -- `MD5.Create()`, `SHA1.Create()` for passwords → Use of Broken Cryptographic Algorithm (CWE-327) -- `new Random()` for tokens/nonces/password generation → Use of Predictable Algorithm in Cryptographic Context (CWE-338) -- Embedded `.prv`/`.pem`/`.pfx` key files in project directories → Use of Hardcoded Cryptographic Key (CWE-321) -- Cookie options missing `HttpOnly` → Sensitive Cookie Without 'HttpOnly' Flag (CWE-1004) -- Cookie options missing `Secure` → Sensitive Cookie in HTTPS Session Without 'Secure' Attribute (CWE-614) -- `Response.Redirect(userInput)` without validation → URL Redirection to Untrusted Site (CWE-601) -- Missing `[Authorize]` on controllers/actions → Improper Authorization (CWE-285) -- Secrets in `appsettings.json` committed to source → Use of Hardcoded Credentials (CWE-798) -- `Console.WriteLine` or `ILogger` with sensitive data → Insertion of Sensitive Information into Log File (CWE-532) - -### JavaScript / TypeScript -- Template literals in `db.query()` → SQL Injection (CWE-89) -- `eval(userInput)`, `new Function(userInput)` → Code Injection (CWE-94) -- `res.redirect(req.query.url)` → URL Redirection to Untrusted Site (CWE-601) -- `innerHTML = userInput` → Cross-Site Scripting (XSS) (CWE-79) -- `Math.random()` for security → Use of Predictable Algorithm in Cryptographic Context (CWE-338) -- Missing `helmet()` / CSP headers → Security Misconfiguration -- `require(userInput)` → Inclusion of Functionality from Untrustworthy Control Sphere (CWE-829) -- Secrets in `.env` committed or hardcoded → Use of Hardcoded Credentials (CWE-798) - -### Python -- `cursor.execute(f"SELECT ... {userInput}")` → SQL Injection (CWE-89) -- `subprocess.call(cmd, shell=True)` → OS Command Injection (CWE-78) -- `pickle.loads(userdata)`, `yaml.load(data)` → Deserialization of Untrusted Data (CWE-502) -- `hashlib.md5(password)` → Use of Broken Cryptographic Algorithm (CWE-327) -- `os.urandom` vs `random.random` for tokens → Use of Predictable Algorithm in Cryptographic Context (CWE-338) -- `app.debug = True` in production → Insertion of Sensitive Information Into Debugging Code (CWE-215) -- LLM inference with high `temperature` settings → Insecure Setting of Generative AI/ML Model Inference Parameters (CWE-1434) -- LLM prompting with unsanitized user input → Improper Neutralization of Input Used for LLM Prompting (CWE-1427) - -### Java / Kotlin -- `stmt.executeQuery("SELECT ... " + userInput)` → SQL Injection (CWE-89) -- `Runtime.exec(userInput)` → OS Command Injection (CWE-78) -- `ObjectInputStream.readObject()` → Deserialization of Untrusted Data (CWE-502) -- `MessageDigest.getInstance("MD5")` → Use of Broken Cryptographic Algorithm (CWE-327) -- Missing `@PreAuthorize` / `@Secured` → Improper Authorization (CWE-285) -- `DocumentBuilderFactory` without `FEATURE_SECURE_PROCESSING` → Improper Restriction of XML External Entity Reference (CWE-611) - -### PowerShell -- `Invoke-Expression $userInput` → Code Injection (CWE-94) -- `Invoke-SqlCmd -Query "... $userInput"` → SQL Injection (CWE-89) -- Credentials stored in plain `.ps1` files → Use of Hardcoded Credentials (CWE-798) -- `[System.Net.WebClient]::DownloadFile` without cert validation → Improper Certificate Validation (CWE-295) -- `Start-Process` with user-controlled arguments → OS Command Injection (CWE-78) +1. Read [security-report-template.md](../skills/audit-integrity/references/security-report-template.md) and format the final report according to this standard structure. +2. If you resolved false positives, novel architectural patterns, or methodology gaps during the scan, record lesson records using [self-learning-system.md](../skills/audit-integrity/references/self-learning-system.md). --- ## Constraints -- DO NOT modify source files unless explicitly asked. -- DO NOT report findings without evidence from the actual scanned code or dependency files. -- ALWAYS cite file path and line number for every SAST flaw. -- ALWAYS cite the CVE ID and affected version range for every SCA vulnerability. -- ALWAYS provide remediation code or upgrade guidance for every finding. -- ALWAYS map findings to both CWE ID and security flaw category name. -- PREFER exact taint-flow traces over generalized descriptions for injection flaws. -- NEVER speculate — every finding must have code or manifest evidence. -- NEVER suppress findings based on assumed deployment context (defense in depth applies). - ---- - -## Audit Integrity Rules - -> **Skill Reference**: Apply the [audit-integrity](../skills/audit-integrity/SKILL.md) skill for the shared Clarification Protocol, Anti-Rationalization Guard, Retry Protocol, Non-Negotiable Behaviors, Self-Critique Loop, Self-Reflection Quality Gate, and Self-Learning System. - -**SAST/SCA-specific Self-Critique additions** (extend the base Self-Critique Loop from the skill): -1. **Taint coverage**: Verify every external input source identified in Phase 1 was traced to at least one sink. -2. **Evidence completeness**: Every SAST finding must have a file:line reference and taint trace. Every SCA finding must cite a CVE ID and version range. -3. **Flaw category completeness**: Verify all flaw categories were evaluated — state "No instances detected" for clean categories rather than omitting them. -4. **Policy gate**: Re-verify that the PASS/FAIL policy verdict is consistent with severity counts before finalizing. - -### Supply Chain Security (SCA Extension) -In addition to standard CVE checking, scan for: -- **Dependency Confusion / Typosquatting** — flag packages with names similar to popular packages; check internal package names not published on public registries -- **Lock File Integrity** — verify that lock files (`package-lock.json`, `*.lock`, `go.sum`, `Pipfile.lock`) are present and committed; absent lock files allow version-float supply chain attacks -- **GitHub Actions Pinning** — scan `.github/workflows/*.yml` for actions not pinned to a full commit SHA (e.g., `uses: actions/checkout@v4` is unsafe — requires `@{40-char-sha} # vX.Y.Z`) -- **SBOM Absence** — flag if no Software Bill of Materials output (`cyclonedx`, `spdx`, or `syft`) is configured in the build pipeline -- **License Risk** — identify GPL v3 / AGPL / SSPL licensed transitive dependencies that could trigger copyleft obligations in commercial or OEM-distributed products -- **Abandoned Packages** — flag dependencies with no commits in >2 years or with archived/deleted source repositories -- **Integrity Verification** — check for `integrity` hash fields in `package-lock.json`; flag absence of `--require-hashes` in pip installs or equivalent checksum enforcement in other ecosystems - ---- - -## Non-Negotiable Behaviors - -> **Skill Reference**: See [audit-integrity → non-negotiable-behaviors](../skills/audit-integrity/references/non-negotiable-behaviors.md) for the full shared rules. - -**SAST/SCA-specific additions**: -- Every SAST finding must reference a specific file path and line number with taint flow. -- Every SCA finding must cite a CVE ID and affected version range. -- Do not modify source files, dependency files, or configuration unless explicitly requested. -- For multi-phase SAST+SCA analysis, summarize findings after each phase before proceeding. - ---- - -## Self-Reflection Quality Gate - -> **Skill Reference**: See [audit-integrity → self-reflection-quality-gate](../skills/audit-integrity/references/self-reflection-quality-gate.md) for the shared 1–10 scoring rubric (≥8 threshold, max 2 rework iterations). - -**SAST/SCA-specific quality gate categories** (extend the base categories from the skill): -- **Completeness**: Were all SAST flaw categories and SCA ecosystems evaluated? -- **Accuracy**: Are SAST findings backed by concrete taint traces and SCA findings by verified CVE IDs? -- **Actionability**: Does every Very High/High finding have a specific remediation (code fix or version upgrade)? -- **Consistency**: Are severity ratings, CWE mappings, and policy verdicts internally consistent? -- **Coverage**: Were all entry points taint-traced and all dependency manifests audited? -``` +- Do not modify application source code, dependency manifests, or project configurations unless the user explicitly requests changes. +- Create or update security learning records in `.github/SecurityLessons/` or `.github/SecurityMemories/` when you identify methodology gaps, false positives, or new patterns. +- Do not report findings without evidence from the scanned code or dependency files. +- Always cite the file path and line number for each SAST flaw. +- Always cite the CVE ID and affected version range for each SCA vulnerability. +- Always provide remediation code or upgrade instructions for each finding. +- Always map each finding to its CWE ID and flaw category name. +- Provide exact taint-flow traces instead of general descriptions for injection flaws. +- Do not speculate. Support every finding with code or manifest evidence. +- Do not suppress findings based on assumed deployment environments. Apply the defense-in-depth principle. + +--- + +## Audit Integrity Framework + +Apply the shared [audit-integrity](../skills/audit-integrity/SKILL.md) skill framework. Load reference components as you reach each phase: +- Pre-Scan: [clarification-protocol.md](../skills/audit-integrity/references/clarification-protocol.md) +- During scan: [anti-rationalization-guard.md](../skills/audit-integrity/references/anti-rationalization-guard.md) and [retry-protocol.md](../skills/audit-integrity/references/retry-protocol.md) +- SAST patterns: [sast-detection-patterns.md](../skills/audit-integrity/references/sast-detection-patterns.md) +- SCA rules: [sca-supply-chain-rules.md](../skills/audit-integrity/references/sca-supply-chain-rules.md) +- Compliance matrix: [policy-compliance-matrix.md](../skills/audit-integrity/references/policy-compliance-matrix.md) +- Second pass: [self-critique-loop.md](../skills/audit-integrity/references/self-critique-loop.md) +- Quality gate: [self-reflection-quality-gate.md](../skills/audit-integrity/references/self-reflection-quality-gate.md) +- Report format: [security-report-template.md](../skills/audit-integrity/references/security-report-template.md) +- Lessons learned: [self-learning-system.md](../skills/audit-integrity/references/self-learning-system.md) +- Universal rules: [non-negotiable-behaviors.md](../skills/audit-integrity/references/non-negotiable-behaviors.md) diff --git a/docs/README.agents.md b/docs/README.agents.md index 608834918f..4dda9f0e8a 100644 --- a/docs/README.agents.md +++ b/docs/README.agents.md @@ -200,7 +200,7 @@ See [CONTRIBUTING.md](../CONTRIBUTING.md#adding-agents) for guidelines on how to | [Salesforce Flow Development](../agents/salesforce-flow.agent.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fsalesforce-flow.agent.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fsalesforce-flow.agent.md) | Implement business automation using Salesforce Flow following declarative automation best practices. | | | [Salesforce UI Development (Aura & LWC)](../agents/salesforce-aura-lwc.agent.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fsalesforce-aura-lwc.agent.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fsalesforce-aura-lwc.agent.md) | Implement Salesforce UI components using Lightning Web Components and Aura components following Lightning framework best practices. | | | [Salesforce Visualforce Development](../agents/salesforce-visualforce.agent.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fsalesforce-visualforce.agent.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fsalesforce-visualforce.agent.md) | Implement Visualforce pages and controllers following Salesforce MVC architecture and best practices. | | -| [Sast Sca Security Analyzer](../agents/sast-sca-security-analyzer.agent.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fsast-sca-security-analyzer.agent.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fsast-sca-security-analyzer.agent.md) | Use when: performing SAST (Static Application Security Testing), SCA (Software Composition Analysis), scanning source code or binaries for security flaws, auditing third-party dependency vulnerabilities, checking policy compliance, generating structured security reports, identifying CWE-mapped flaws with file/line precision, reviewing open-source license risk, or producing CI/CD-gate security findings. | | +| [Sast Sca Security Analyzer](../agents/sast-sca-security-analyzer.agent.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fsast-sca-security-analyzer.agent.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fsast-sca-security-analyzer.agent.md) | Use when you perform SAST or SCA security scans. Identifies code flaws, audits third-party dependencies, checks policy compliance, and generates structured security reports with CWE mappings and file locations. | | | [Scientific Paper Research](../agents/scientific-paper-research.agent.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fscientific-paper-research.agent.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fscientific-paper-research.agent.md) | Research agent that searches scientific papers and retrieves structured experimental data from full-text studies using the BGPT MCP server. | bgpt<br />[![Install MCP](https://img.shields.io/badge/Install-VS_Code-0098FF?style=flat-square)](https://aka.ms/awesome-copilot/install/mcp-vscode?name=bgpt&config=%7B%22command%22%3A%22%22%2C%22args%22%3A%5B%5D%2C%22env%22%3A%7B%7D%7D)<br />[![Install MCP](https://img.shields.io/badge/Install-VS_Code_Insiders-24bfa5?style=flat-square)](https://aka.ms/awesome-copilot/install/mcp-vscodeinsiders?name=bgpt&config=%7B%22command%22%3A%22%22%2C%22args%22%3A%5B%5D%2C%22env%22%3A%7B%7D%7D)<br />[![Install MCP](https://img.shields.io/badge/Install-Visual_Studio-C16FDE?style=flat-square)](https://aka.ms/awesome-copilot/install/mcp-visualstudio/mcp-install?%7B%22command%22%3A%22%22%2C%22args%22%3A%5B%5D%2C%22env%22%3A%7B%7D%7D) | | [SE: Architect](../agents/se-system-architecture-reviewer.agent.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fse-system-architecture-reviewer.agent.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fse-system-architecture-reviewer.agent.md) | System architecture review specialist with Well-Architected frameworks, design validation, and scalability analysis for AI and distributed systems | | | [SE: DevOps/CI](../agents/se-gitops-ci-specialist.agent.md)<br />[![Install in VS Code](https://img.shields.io/badge/VS_Code-Install-0098FF?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fse-gitops-ci-specialist.agent.md)<br />[![Install in VS Code Insiders](https://img.shields.io/badge/VS_Code_Insiders-Install-24bfa5?style=flat-square&logo=visualstudiocode&logoColor=white)](https://aka.ms/awesome-copilot/install/agent?url=vscode-insiders%3Achat-agent%2Finstall%3Furl%3Dhttps%3A%2F%2Fraw.githubusercontent.com%2Fgithub%2Fawesome-copilot%2Fmain%2Fagents%2Fse-gitops-ci-specialist.agent.md) | DevOps specialist for CI/CD pipelines, deployment debugging, and GitOps workflows focused on making deployments boring and reliable | | From db6b65a549e1f0554c4681ff63db06f0a7adaae6 Mon Sep 17 00:00:00 2001 From: Burak Kaygusuz <burakkaygusuz@outlook.com> Date: Sat, 12 Sep 2026 11:04:01 +0300 Subject: [PATCH 3/3] style(skills): format table alignment in security-report-template --- .../references/security-report-template.md | 40 +++++++++---------- 1 file changed, 20 insertions(+), 20 deletions(-) diff --git a/skills/audit-integrity/references/security-report-template.md b/skills/audit-integrity/references/security-report-template.md index f78c7a6060..fd6cbd7716 100644 --- a/skills/audit-integrity/references/security-report-template.md +++ b/skills/audit-integrity/references/security-report-template.md @@ -14,20 +14,20 @@ Deliver final reports matching this structure: **Detected Languages**: <List of languages> **Scanned Modules**: <List of modules or directory paths> **Evaluated Policy**: <Policy name or "Standard Baseline"> -**Overall Status**: PASS | FAIL | CONDITIONAL +**Overall Status**: PASS | FAIL | CONDITIONAL --- ## Executive Summary -| Severity | SAST Findings | SCA Vulnerabilities | Total Count | -| :--- | :---: | :---: | :---: | -| **Critical** | <count> | <count> | <total> | -| **High** | <count> | <count> | <total> | -| **Medium** | <count> | <count> | <total> | -| **Low** | <count> | <count> | <total> | -| **Informational** | <count> | <count> | <total> | -| **Total** | <count> | <count> | <total> | +| Severity | SAST Findings | SCA Vulnerabilities | Total Count | +| :---------------- | :-----------: | :-----------------: | :---------: | +| **Critical** | <count> | <count> | <total> | +| **High** | <count> | <count> | <total> | +| **Medium** | <count> | <count> | <total> | +| **Low** | <count> | <count> | <total> | +| **Informational** | <count> | <count> | <total> | +| **Total** | <count> | <count> | <total> | **Risk Posture Summary**: <Provide one concise sentence describing the overall security posture>. @@ -36,8 +36,8 @@ Deliver final reports matching this structure: ## Module Summary | Module Path | Files Evaluated | SAST Findings | SCA Vulnerabilities | Highest Severity | -| :--- | :---: | :---: | :---: | :--- | -| `<path>` | <count> | <count> | <count> | <Severity> | +| :---------- | :-------------: | :-----------: | :-----------------: | :--------------- | +| `<path>` | <count> | <count> | <count> | <Severity> | --- @@ -83,20 +83,20 @@ Deliver final reports matching this structure: ## License Risk Summary -| Package Name | License (SPDX) | Risk Level | Commercial Use Status | -| :--- | :--- | :--- | :--- | -| `<name>` | `<SPDX ID>` | Low \| Medium \| High | Permitted \| Restricted \| Prohibited | +| Package Name | License (SPDX) | Risk Level | Commercial Use Status | +| :----------- | :------------- | :-------------------- | :------------------------------------ | +| `<name>` | `<SPDX ID>` | Low \| Medium \| High | Permitted \| Restricted \| Prohibited | --- ## Policy Compliance Verdicts -| Policy Framework | Status | Failing Requirements | -| :--- | :---: | :--- | -| OWASP Top 10 2025 | PASS \| FAIL | <List failing categories or "None"> | -| PCI-DSS v4.0.1 | PASS \| FAIL | <List failing requirements or "None"> | -| CWE Top 25 (2025) | PASS \| FAIL | <List confirmed CWEs or "None"> | -| NIST SP 800-218 | PASS \| FAIL | <List failing controls or "None"> | +| Policy Framework | Status | Failing Requirements | +| :---------------- | :----------: | :------------------------------------ | +| OWASP Top 10 2025 | PASS \| FAIL | <List failing categories or "None"> | +| PCI-DSS v4.0.1 | PASS \| FAIL | <List failing requirements or "None"> | +| CWE Top 25 (2025) | PASS \| FAIL | <List confirmed CWEs or "None"> | +| NIST SP 800-218 | PASS \| FAIL | <List failing controls or "None"> | ---