fireworks-security

name	fireworks-security
description	Security hardening superbrain — CWE Top 25, STRIDE threat modeling, Electron hardening, encryption, dependency audits, OWASP compliance
version	2.0.0
author	mneme
tags	["security","vulnerability","CWE","OWASP","hardening","encryption","audit","XSS","injection"]
triggers	["security","vulnerability","CWE","OWASP","hardening","encryption","audit","credential","XSS","injection","CSP"]

Fireworks Security — Enterprise Security Superbrain

Purpose

This skill consolidates ALL security knowledge into a single reference brain. It replaces the need to invoke separate security-scanner, security-reviewer, security-hardener, and encryption agents. One skill, total coverage.

Activate this skill whenever:

• Scanning code for vulnerabilities
• Hardening an Electron app
• Reviewing IPC channels or preload scripts
• Implementing or auditing encryption
• Running dependency audits
• Preparing for a security review or compliance check

---

1. Security Scan Protocol — 5-Phase Pipeline

Phase 1: Target Identification

1. Identify the project type (Electron, Node.js CLI, web app, library).
2. List all entry points: main process, renderer processes, preload scripts, IPC channels, HTTP endpoints.
3. Map the trust boundary: what runs with Node.js privileges vs. sandboxed renderer.
4. Identify all external inputs: user input fields, file uploads, URL parameters, IPC messages, environment variables.

Phase 2: CWE Top 25 Scan

1. For each CWE in the quick-reference table below, run the detection pattern against the codebase.
2. Log every match with file path, line number, and severity.
3. Cross-reference with references/cwe-detection.md for Electron-specific variants.
4. Classify findings: CRITICAL (blocks release), HIGH (must fix before merge), MEDIUM (fix in next sprint).

Phase 3: STRIDE Threat Modeling

1. For each STRIDE category, answer the guiding question against the project architecture.
2. Document threats discovered with likelihood (HIGH/MEDIUM/LOW) and impact (HIGH/MEDIUM/LOW).
3. Map each threat to a mitigation strategy.

Phase 4: Auto-Fix Suggestions

1. For each finding from Phase 2, generate a concrete code fix.
2. Fixes must be minimal — change only what is necessary.
3. Each fix must include a before/after code snippet.
4. Never introduce new dependencies without explicit user approval.

Phase 5: Security Report

1. Generate the report using the format in Section 7.
2. Summary statistics: total findings by severity.
3. Include verification commands the user can run to confirm fixes.

---

2. CWE Top 25 Quick-Reference

CWE ID	Vulnerability	Detection Pattern	Severity
CWE-787	Out-of-bounds Write	Buffer operations without bounds checking, Buffer.alloc misuse	CRITICAL
CWE-79	Cross-site Scripting (XSS)	innerHTML, dangerouslySetInnerHTML, document.write, v-html, {@html}	CRITICAL
CWE-89	SQL Injection	String concatenation in SQL queries, template literals in .run(), .exec(), .all()	CRITICAL
CWE-416	Use After Free	Manual memory management in native addons, double .destroy() calls	CRITICAL
CWE-78	OS Command Injection	child_process.exec() with user input, shell: true in spawn options	CRITICAL
CWE-20	Improper Input Validation	Missing Zod/Joi schemas on IPC handlers, unvalidated function arguments	HIGH
CWE-125	Out-of-bounds Read	Array access without length check, Buffer.read beyond size	HIGH
CWE-22	Path Traversal	path.join with user input not validated against base directory, ../ in paths	HIGH
CWE-352	Cross-Site Request Forgery	Missing CSRF tokens on mutation endpoints (less relevant for desktop, still check webview)	HIGH
CWE-434	Unrestricted Upload	File dialog without extension filtering, no MIME type validation	HIGH
CWE-862	Missing Authorization	IPC handlers without permission checks, no role-based access on channels	HIGH
CWE-476	NULL Pointer Dereference	Optional chaining missing on potentially null DB results, unchecked .get()	MEDIUM
CWE-287	Improper Authentication	Hardcoded credentials, plaintext password storage, missing bcrypt/argon2

See references/cwe-detection.md for complete detection patterns and fix templates.

---

3. STRIDE Threat Model

Category	Guiding Question	Desktop App Examples
Spoofing	Can an attacker pretend to be someone/something else?	Fake IPC messages between renderer and main, spoofed auto-update server, modified preload script
Tampering	Can an attacker modify data they should not?	Modify SQLite database file on disk, tamper with ASAR archive, alter localStorage, MITM update downloads
Repudiation	Can an attacker deny performing an action?	No audit log for destructive operations, missing transaction history, no action timestamps
Information Disclosure	Can an attacker access data they should not?	Credentials in plaintext config, sensitive data in renderer console, unencrypted database, verbose error messages exposing internals
Denial of Service	Can an attacker crash or slow the app?	Infinite loop in IPC handler, massive file upload crashing renderer, uncaught promise rejection crashing main process
Elevation of Privilege	Can an attacker gain higher access?	Renderer escaping sandbox via nodeIntegration, IPC channel granting filesystem access without auth, prototype pollution

---

---

Full Reference

For complete patterns, examples, and advanced usage, see references/full-guide.md. Read that file when you need deeper context than the summary above.