FlightLog RPAS Chile: multi-tenant backend, dual auth, GIS, authenticated frontend

.agents/skills/code-security/README.md

@@ -0,0 +1,113 @@
+# Code Security Skill
+
+Comprehensive security guidelines for writing secure code across 15+ languages, covering OWASP Top 10, infrastructure security, and coding best practices.
+
+## Categories (28 Total)
+
+### Critical Impact
+- SQL Injection, Command Injection, XSS, XXE, Path Traversal
+- Insecure Deserialization, Code Injection, Hardcoded Secrets, Memory Safety
+
+### High Impact
+- Insecure Crypto, Insecure Transport, SSRF, JWT Auth, CSRF
+- Prototype Pollution, Unsafe Functions
+- Terraform (AWS/Azure/GCP), Kubernetes, Docker, GitHub Actions
+
+### Medium/Low Impact
+- Regex DoS, Race Conditions, Code Correctness
+- Best Practices, Performance, Maintainability
+
+## Structure
+
+```
+code-security/
+├── SKILL.md           # Skill definition (loaded by agents)
+├── rules/             # Security rule files
+│   ├── _sections.md   # Index of all categories
+│   ├── _template.md   # Template for new rules
+│   ├── sql-injection.md
+│   ├── xss.md
+│   └── ...            # 28 rule files total
+├── metadata.json      # Skill metadata
+└── README.md          # This file
+```
+
+## Usage
+
+### For End Users
+
+Install the skill:
+```bash
+npx skills add semgrep/skills
+```
+
+The agent will automatically reference these guidelines when writing or reviewing code.
+
+### For Contributors
+
+From the repo root:
+```bash
+make validate    # Validate all rule files
+make build       # Build the skill
+make zip         # Create distribution package
+make             # All of the above
+```
+
+Or from the build package:
+```bash
+cd packages/skill-build
+pnpm install
+pnpm validate code-security    # Validate rule files
+pnpm build-agents code-security  # Build AGENTS.md
+```
+
+## Creating a New Rule
+
+1. Copy `rules/_template.md` to `rules/{category}.md`
+2. Follow this structure:
+
+````markdown
+---
+title: Rule Title
+impact: HIGH
+tags: security, category-name
+---
+
+## Rule Title
+
+Brief explanation of the vulnerability.
+
+**Incorrect (description):**
+
+```python
+# Vulnerable code
+```
+
+**Correct (description):**
+
+```python
+# Secure code
+```
+````
+
+3. Run `make validate` to check formatting
+4. Run `make` to rebuild everything
+
+## Impact Levels
+
+| Level | Description |
+|-------|-------------|
+| CRITICAL | Remote code execution, data breach |
+| HIGH | Significant security risk |
+| MEDIUM | Moderate risk, defense in depth |
+| LOW | Best practices, code quality |
+
+## Languages Supported
+
+Python, JavaScript/TypeScript, Java, Go, Ruby, PHP, C/C++, C#, Scala, Kotlin, Rust, HCL (Terraform), YAML (Kubernetes/Docker)
+
+## Acknowledgments
+
+Created by [@DrewDennison](https://x.com/drewdennison) at [Semgrep](https://semgrep.dev).
+
+Rules derived from [Semgrep Registry](https://semgrep.dev/r) with 2000+ security patterns.

.agents/skills/code-security/SKILL.md

@@ -0,0 +1,82 @@
+---
+name: code-security
+description: "Security guidelines for writing secure code. Use when writing code, reviewing code for vulnerabilities, or asking about secure coding practices like 'check for SQL injection' or 'review security'. IMPORTANT: Always consult this skill when writing or reviewing any code that handles user input, authentication, file operations, database queries, network requests, cryptography, or infrastructure configuration (Terraform, Kubernetes, Docker, GitHub Actions) — even if the user doesn't explicitly mention security. Also use when users ask to 'review my code', 'check this for bugs', or 'is this safe'."
+---
+
+# Code Security Guidelines
+
+Comprehensive security rules for writing secure code across 15+ languages. Covers OWASP Top 10, infrastructure security, and coding best practices with 28 rule categories.
+
+## How to Use This Skill
+
+**Proactive mode** — When writing or reviewing code, automatically check for relevant vulnerabilities based on the language and patterns present. You don't need to wait for the user to ask about security.
+
+**Reactive mode** — When the user asks about security, use the categories below to find the relevant rule file, then read it for detailed vulnerable/secure code examples.
+
+### Workflow
+1. Identify the language and what the code does (handles input? queries a DB? reads files?)
+2. Check the relevant rules below — focus on Critical and High impact first
+3. Read the specific rule file from `rules/` for detailed code examples in that language
+4. Apply the secure patterns, or flag the vulnerable patterns if reviewing
+
+## Language-Specific Priority Rules
+
+When writing code in these languages, check these rules first:
+
+| Language | Priority Rules to Check |
+|----------|------------------------|
+| **Python** | SQL injection, command injection, path traversal, code injection, SSRF, insecure crypto |
+| **JavaScript/TypeScript** | XSS, prototype pollution, code injection, insecure transport, CSRF |
+| **Java** | SQL injection, XXE, insecure deserialization, insecure crypto, SSRF |
+| **Go** | SQL injection, command injection, path traversal, insecure transport |
+| **C/C++** | Memory safety, unsafe functions, command injection, path traversal |
+| **Ruby** | SQL injection, command injection, code injection, insecure deserialization |
+| **PHP** | SQL injection, XSS, command injection, code injection, path traversal |
+| **HCL/YAML** | Terraform (AWS/Azure/GCP), Kubernetes, Docker, GitHub Actions |
+
+## Categories
+
+### Critical Impact
+- **SQL Injection** (`rules/sql-injection.md`) - Use parameterized queries, never concatenate user input
+- **Command Injection** (`rules/command-injection.md`) - Avoid shell commands with user input, use safe APIs
+- **XSS** (`rules/xss.md`) - Escape output, use framework protections
+- **XXE** (`rules/xxe.md`) - Disable external entities in XML parsers
+- **Path Traversal** (`rules/path-traversal.md`) - Validate and sanitize file paths
+- **Insecure Deserialization** (`rules/insecure-deserialization.md`) - Never deserialize untrusted data
+- **Code Injection** (`rules/code-injection.md`) - Never eval() user input
+- **Hardcoded Secrets** (`rules/secrets.md`) - Use environment variables or secret managers
+- **Memory Safety** (`rules/memory-safety.md`) - Prevent buffer overflows, use-after-free (C/C++)
+
+### High Impact
+- **Insecure Crypto** (`rules/insecure-crypto.md`) - Use SHA-256+, AES-256, avoid MD5/SHA1/DES
+- **Insecure Transport** (`rules/insecure-transport.md`) - Use HTTPS, verify certificates
+- **SSRF** (`rules/ssrf.md`) - Validate URLs, use allowlists
+- **JWT Issues** (`rules/authentication-jwt.md`) - Always verify signatures
+- **CSRF** (`rules/csrf.md`) - Use CSRF tokens on state-changing requests
+- **Prototype Pollution** (`rules/prototype-pollution.md`) - Validate object keys in JavaScript
+
+### Infrastructure
+- **Terraform AWS/Azure/GCP** (`rules/terraform-aws.md`, `rules/terraform-azure.md`, `rules/terraform-gcp.md`) - Encryption, least privilege, no public access
+- **Kubernetes** (`rules/kubernetes.md`) - No privileged containers, run as non-root
+- **Docker** (`rules/docker.md`) - Don't run as root, pin image versions
+- **GitHub Actions** (`rules/github-actions.md`) - Avoid script injection, pin action versions
+
+### Medium/Low Impact
+- **Regex DoS** (`rules/regex-dos.md`) - Avoid catastrophic backtracking
+- **Race Conditions** (`rules/race-condition.md`) - Use proper synchronization
+- **Correctness** (`rules/correctness.md`) - Avoid common logic bugs
+- **Best Practices** (`rules/best-practice.md`) - General secure coding patterns
+
+See `rules/_sections.md` for the full index with CWE/OWASP references.
+
+## Quick Reference
+
+| Vulnerability | Key Prevention |
+|--------------|----------------|
+| SQL Injection | Parameterized queries |
+| XSS | Output encoding |
+| Command Injection | Avoid shell, use APIs |
+| Path Traversal | Validate paths |
+| SSRF | URL allowlists |
+| Secrets | Environment variables |
+| Crypto | SHA-256, AES-256 |

.agents/skills/code-security/rules/_sections.md

@@ -0,0 +1,195 @@
+# Sections
+
+This file defines all sections, their ordering, impact levels, and descriptions.
+The section ID (in parentheses) is the filename prefix used to group rules.
+
+---
+
+## Critical Impact
+
+### 1. SQL Injection (sql-injection)
+
+**Impact:** CRITICAL
+**Description:** SQL injection allows attackers to manipulate database queries, leading to data theft, modification, or deletion. OWASP Top 10.
+
+### 2. Command Injection (command-injection)
+
+**Impact:** CRITICAL
+**Description:** OS command injection allows attackers to execute arbitrary system commands, leading to full system compromise. CWE-78.
+
+### 3. Cross-Site Scripting (xss)
+
+**Impact:** CRITICAL
+**Description:** XSS allows attackers to inject malicious scripts into web pages, leading to session hijacking, defacement, or malware distribution. CWE-79.
+
+### 4. XML External Entity (xxe)
+
+**Impact:** CRITICAL
+**Description:** XXE attacks exploit XML parsers to access local files, perform SSRF, or cause denial of service. CWE-611.
+
+### 5. Path Traversal (path-traversal)
+
+**Impact:** CRITICAL
+**Description:** Path traversal allows attackers to access files outside intended directories using sequences like "../". CWE-22.
+
+### 6. Insecure Deserialization (insecure-deserialization)
+
+**Impact:** CRITICAL
+**Description:** Deserializing untrusted data can lead to remote code execution, DoS, or authentication bypass. CWE-502.
+
+### 7. Code Injection (code-injection)
+
+**Impact:** CRITICAL
+**Description:** Code injection (eval, template injection) allows attackers to execute arbitrary code in the application context. CWE-94.
+
+### 8. Hardcoded Secrets (secrets)
+
+**Impact:** CRITICAL
+**Description:** Hardcoded credentials, API keys, and tokens in source code lead to unauthorized access when code is exposed. CWE-798.
+
+### 9. Memory Safety (memory-safety)
+
+**Impact:** CRITICAL
+**Description:** Memory safety issues (buffer overflow, use-after-free) can lead to code execution or crashes. CWE-119, CWE-416.
+
+---
+
+## High Impact
+
+### 10. Insecure Cryptography (insecure-crypto)
+
+**Impact:** HIGH
+**Description:** Weak hashing (MD5, SHA1), weak encryption (DES, RC4), or improper key management compromises data confidentiality. CWE-327.
+
+### 11. Insecure Transport (insecure-transport)
+
+**Impact:** HIGH
+**Description:** Cleartext transmission, disabled certificate verification, or weak TLS exposes data in transit. CWE-319.
+
+### 12. Server-Side Request Forgery (ssrf)
+
+**Impact:** HIGH
+**Description:** SSRF allows attackers to make requests from the server to internal systems or cloud metadata endpoints. CWE-918.
+
+### 13. JWT Authentication (authentication-jwt)
+
+**Impact:** HIGH
+**Description:** JWT vulnerabilities include the "none" algorithm attack, weak secrets, and missing signature verification. CWE-347.
+
+### 14. Cross-Site Request Forgery (csrf)
+
+**Impact:** HIGH
+**Description:** CSRF attacks force authenticated users to perform unwanted actions without their knowledge. CWE-352.
+
+### 15. Prototype Pollution (prototype-pollution)
+
+**Impact:** HIGH
+**Description:** Prototype pollution in JavaScript can lead to property injection, denial of service, or code execution. CWE-1321.
+
+### 16. Unsafe Functions (unsafe-functions)
+
+**Impact:** HIGH
+**Description:** Inherently dangerous functions (gets, strcpy, eval) bypass safety checks and should be avoided. CWE-242.
+
+### 17. Terraform AWS Security (terraform-aws)
+
+**Impact:** HIGH
+**Description:** AWS infrastructure misconfigurations including public S3 buckets, unencrypted resources, and overly permissive IAM.
+
+### 18. Terraform Azure Security (terraform-azure)
+
+**Impact:** HIGH
+**Description:** Azure infrastructure misconfigurations including public endpoints, missing encryption, and insecure network settings.
+
+### 19. Terraform GCP Security (terraform-gcp)
+
+**Impact:** HIGH
+**Description:** GCP infrastructure misconfigurations including public resources, disabled logging, and insecure IAM bindings.
+
+### 20. Kubernetes Security (kubernetes)
+
+**Impact:** HIGH
+**Description:** Kubernetes misconfigurations including privileged containers, host namespace access, and excessive RBAC permissions.
+
+### 21. Docker Security (docker)
+
+**Impact:** HIGH
+**Description:** Docker misconfigurations including running as root, privileged mode, and exposed Docker socket.
+
+### 22. GitHub Actions Security (github-actions)
+
+**Impact:** HIGH
+**Description:** GitHub Actions vulnerabilities including script injection, unsafe checkout of PR code, and unpinned actions.
+
+---
+
+## Medium Impact
+
+### 23. Regular Expression DoS (regex-dos)
+
+**Impact:** MEDIUM
+**Description:** ReDoS attacks exploit inefficient regex patterns to cause CPU exhaustion and denial of service. CWE-1333.
+
+### 24. Race Conditions (race-condition)
+
+**Impact:** MEDIUM
+**Description:** TOCTOU race conditions and insecure temporary file creation can lead to privilege escalation. CWE-367.
+
+### 25. Code Correctness (correctness)
+
+**Impact:** MEDIUM
+**Description:** Common coding mistakes including exception handling errors, null checks, type errors, and logic bugs.
+
+---
+
+## Low Impact
+
+### 26. Best Practices (best-practice)
+
+**Impact:** LOW
+**Description:** Code style, API usage patterns, deprecated patterns, and general coding recommendations.
+
+### 27. Performance (performance)
+
+**Impact:** LOW
+**Description:** Performance anti-patterns including inefficient loops, unnecessary database queries, and memory waste.
+
+### 28. Maintainability (maintainability)
+
+**Impact:** LOW
+**Description:** Code organization, deprecated API usage, naming conventions, and long-term code health.
+
+---
+
+## Rule File Summary
+
+| # | Category | Filename | Impact |
+|---|----------|----------|--------|
+| 1 | SQL Injection | sql-injection.md | CRITICAL |
+| 2 | Command Injection | command-injection.md | CRITICAL |
+| 3 | Cross-Site Scripting | xss.md | CRITICAL |
+| 4 | XML External Entity | xxe.md | CRITICAL |
+| 5 | Path Traversal | path-traversal.md | CRITICAL |
+| 6 | Insecure Deserialization | insecure-deserialization.md | CRITICAL |
+| 7 | Code Injection | code-injection.md | CRITICAL |
+| 8 | Hardcoded Secrets | secrets.md | CRITICAL |
+| 9 | Memory Safety | memory-safety.md | CRITICAL |
+| 10 | Insecure Cryptography | insecure-crypto.md | HIGH |
+| 11 | Insecure Transport | insecure-transport.md | HIGH |
+| 12 | SSRF | ssrf.md | HIGH |
+| 13 | JWT Authentication | authentication-jwt.md | HIGH |
+| 14 | CSRF | csrf.md | HIGH |
+| 15 | Prototype Pollution | prototype-pollution.md | HIGH |
+| 16 | Unsafe Functions | unsafe-functions.md | HIGH |
+| 17 | Terraform AWS | terraform-aws.md | HIGH |
+| 18 | Terraform Azure | terraform-azure.md | HIGH |
+| 19 | Terraform GCP | terraform-gcp.md | HIGH |
+| 20 | Kubernetes | kubernetes.md | HIGH |
+| 21 | Docker | docker.md | HIGH |
+| 22 | GitHub Actions | github-actions.md | HIGH |
+| 23 | Regex DoS | regex-dos.md | MEDIUM |
+| 24 | Race Conditions | race-condition.md | MEDIUM |
+| 25 | Correctness | correctness.md | MEDIUM |
+| 26 | Best Practices | best-practice.md | LOW |
+| 27 | Performance | performance.md | LOW |
+| 28 | Maintainability | maintainability.md | LOW |