What problem does it solve? Security regressions in a fullstack framework slip through when reviews are ad hoc: unbound SQL, leaked credentials in logs, RFC violations in HTTP/WS handling, and authorization gaps across the shared HTTP+WebSocket pipeline. This Skill enforces a rigorous, repeatable security gate before every commit and proactively attacks security components to prove they resist real threats. ## Core Features & Use Cases - Pre-commit REVIEW mode: Scans only the changed diff against a categorized checklist (injection bindings, secret redaction, RFC compliance for HTTP/WS/cookies/CORS/JWT, Zero Trust 403 defaults, zero any typing, dependency vulnerability audit) and outputs a per-category verdict with blockers. - RED/BLUE-TEAM mode: Runs two-pass attack campaigns on a security brick (auth, JWT, CSRF, CORS, sessions) — threat-first matrix designed before reading code to avoid confirmation bias, then code-first coverage pass — producing <brick>.attack.test.ts files and a factual per-vector report. - Framework-specific attack design: Conceives attacks unique to Nodefony's architecture (shared HTTP+WS pipeline, token in ALS, api.request bridge, WS channels, firewall zones, DI scopes, trust-proxy) beyond generic OWASP lists, with a find → fix → re-prove cycle. - Use Case: Before committing a change to the session module, run a security review to verify cookies carry HttpOnly; Secure; SameSite, no password hashes reach the profiler logs, and all SQL uses bound parameters — then get a commit/no-commit verdict. ## Quick Start Ask the agent to run a security review of the current uncommitted diff before committing, or request a red-team attack campaign on a specific security brick such as JWT authentication.
