Update to Tahr Security

{
  "name": "tahr-secure-app",
  "description": "Perform an evidence-backed, pentester-style security review of an application from source, configuration, specifications, tests, and optionally an explicitly authorized local or staging runtime. Use for comprehensive app security audits, pentest readiness, pre-release reviews, dangerous-flaw discovery, or coordinating the Tahr specialist skills; also use when a prior scanner or LLM review created confidence that needs independent verification.",
  "included_files": [
    {
      "relative_path": "agents/openai.yaml",
      "size_in_bytes": 227
    },
    {
      "relative_path": "assets/review-report.template.json",
      "size_in_bytes": 466
    },
    {
      "relative_path": "references/evidence-contract.md",
      "size_in_bytes": 4898
    },
    {
      "relative_path": "references/review-routing.md",
      "size_in_bytes": 2381
    },
    {
      "relative_path": "scripts/validate_review.py",
      "size_in_bytes": 7367
    }
  ],
  "skill_md_contents": "---\nname: tahr-secure-app\ndescription: Perform an evidence-backed, pentester-style security review of an application from source, configuration, specifications, tests, and optionally an explicitly authorized local or staging runtime. Use for comprehensive app security audits, pentest readiness, pre-release reviews, dangerous-flaw discovery, or coordinating the Tahr specialist skills; also use when a prior scanner or LLM review created confidence that needs independent verification.\n---\n\n# Tahr Secure App\n\nReview the application as an attacker would: map what is reachable, form target-specific hypotheses, try to disprove each candidate, require exploit-class proof, and account for what was not tested.\n\n## Set the review mode\n\nChoose one mode and state it before reviewing:\n\n- `deep`: inspect every admitted first-party file and close every high-risk gap. Use by default for “secure this app.”\n- `focused`: review a named feature or boundary deeply and list excluded areas.\n- `retest`: verify an accepted fix with `$tahr-verify-security-fix`.\n\nTreat source and local artifact inspection as read-only review. Run runtime probes only against a local, disposable, or explicitly authorized test target. Do not infer permission to test production, third parties, other tenants, or real accounts. Use low-impact canaries, disposable objects, bounded concurrency, and reversible actions. Never persist raw passwords, tokens, cookies, private keys, personal data, or cloud credentials.\n\n## Create the evidence ledger\n\nRead [references/evidence-contract.md](references/evidence-contract.md) before classifying any issue. Use [assets/review-report.template.json](assets/review-report.template.json) when a durable JSON artifact is useful. Write artifacts only where the user requests or in a clearly named local review directory; do not modify application code during a review.\n\nKeep three lanes separate throughout the work:\n\n1. `findings`: claims that meet the applicable proof status.\n2. `candidates`: concrete leads whose required proof is incomplete.\n3. `coverage`: reviewed, partial, blocked, skipped, and not-applicable scope.\n\nNever promote a scanner hit, dangerous function name, package advisory, route name, response status, reflection, timing change, accepted upload, or prior report statement by itself.\n\n## Map before judging\n\nInventory the application before searching for bugs:\n\n- first-party files, frameworks, manifests, lockfiles, infrastructure, deployment and CI configuration;\n- HTTP routes, GraphQL resolvers, RPC/gRPC handlers, WebSockets/SSE, webhooks, uploads, callbacks, serverless functions, CLI entrypoints, queues, jobs, and externally influenced schedulers;\n- actors, roles, service principals, tenants, organizations, groups, ownership fields, sessions, and recovery flows;\n- assets, data stores, secrets, billing or entitlement state, admin/debug functions, AI models, RAG sources, tools, and external integrations;\n- browser routes, lazy chunks, source maps, API clients, mobile deep links, and undocumented or legacy API versions.\n\nFollow thin controllers into middleware, policies, services, repositories, serializers, templates, and asynchronous consumers. Mark each admitted item `reviewed`, `partial`, `blocked`, `skipped-with-reason`, or `not-applicable`. Low apparent risk is a reason to review briefly, not to disappear the file from coverage.\n\nUse `$tahr-map-attack-surface` when the reachable surface or identity coverage is unclear.\n\n## Build attacker hypotheses\n\nCreate target-specific hypotheses in four forms:\n\n- `actor -> action -> resource -> owner/tenant boundary -> expected decision`;\n- `untrusted source -> transformations -> dangerous sink -> expected control`;\n- `workflow state -> attempted transition/replay/race -> invariant -> authoritative readback`;\n- `deployment input/default -> privileged capability or sensitive asset -> compensating control`.\n\nPrioritize unauthenticated paths, cross-user or cross-tenant boundaries, state-changing functions, sensitive exports, callbacks and outbound fetches, file processing, server-side rendering, privileged fields, legacy versions, recovery paths, background workers, and AI tool use.\n\n## Route to specialist skills\n\nRead [references/review-routing.md](references/review-routing.md) and invoke only the applicable specialist skills. A comprehensive review normally includes:\n\n- `$tahr-test-authentication` for login, recovery, MFA, OAuth/OIDC, tokens, cookies, and session lifecycle;\n- `$tahr-test-access-control` for a complete actor-resource-action model,\n  path-specific authorization traces, proof-gated findings, and safe validation;\n- `$tahr-trace-dangerous-inputs` for injection, browser sinks, outbound requests, parsers, files, and uploads;\n- `$tahr-test-business-workflows` for state, pricing, quota, invitation, approval, replay, and race abuse;\n- `$tahr-audit-secrets-config` for secrets, cryptography, dependencies, infrastructure, and deployment defaults;\n- `$tahr-test-ai-agents` or `$tahr-audit-android` when those technologies exist;\n- `$tahr-threat-model-app` when a full-system threat model and validation plan\n  are requested for the entire existing application.\n\n## Investigate and challenge\n\nFor every candidate:\n\n1. Cite the exact route, file, line or symbol, actor, input, object, or configuration involved.\n2. Trace reachability across files and processes; distinguish dead, test, generated, dependency, and production code.\n3. Name the expected control and inspect its actual placement and applicability.\n4. Search for the strongest contradiction: middleware, policy, tenant filter, validator, encoder, allowlist, safe parser, parameter binding, environment guard, or framework behavior.\n5. Record the contradiction verdict as `not-contradicted`, `contradicted`, `partially-contradicted`, or `insufficient-evidence`.\n6. Define the exact claim and proof needed before attempting runtime validation.\n7. Establish a normal baseline and an expected-denial or benign negative control.\n8. Use the smallest safe proof. Record request/state/browser/callback/readback evidence without raw secrets.\n9. Search one bounded set of sibling routes, helpers, models, and variants after a strong seed; give each variant its own evidence.\n\nOperational failure is a limitation, not target-side proof. Stale authentication, missing roles, WAF or rate limiting, callback outage, tool error, or target instability must not become either a finding or a false-positive conclusion.\n\n## Close coverage and chain impact\n\nBefore concluding:\n\n- resolve every high-risk candidate as accepted, rejected with exact control evidence, out of scope, or deferred with a specific blocker;\n- list unreviewed files, endpoints, identities, tenants, workflows, sinks, environments, and runtime-only claims;\n- distinguish “tested with no issue observed” from “not tested”;\n- link only independently proven primitives into attack chains, and require evidence for every hop;\n- avoid “secure” or “no vulnerabilities” language when material gaps remain.\n\nA clean result means only: no verified findings were produced within the stated, completed scope. It is not a guarantee about omitted or blocked scope.\n\n## Deliver the review\n\nLead with dangerous, reachable issues. For each finding include the exact claim, affected location, preconditions, required proof, positive and negative evidence, contradiction result, impact, confidence, limitations, remediation target, and a repo-native regression test. Keep severity separate from confidence.\n\nSummarize candidates and coverage gaps after findings. Redact sensitive substrings while preserving type, source, length, scope, expiry where relevant, and a non-secret fingerprint.\n\nValidate a JSON review artifact with:\n\n```bash\npython3 <skill-directory>/scripts/validate_review.py path/to/tahr-review.json\n```\n\nUse `--strict` only when claiming a deep review has no unresolved high-risk scope.\n"
}