feat(templates): add 5 more domain templates (10 total)

scripts/templates/domains/security-audit.md

@@ -0,0 +1,180 @@
+# Domain Template: Security Audit
+
+<!-- Domain: Configuration scanning, vulnerability checking, and remediation -->
+<!-- Agents: 3 (config-scanner, vulnerability-checker, remediation-advisor) -->
+<!-- Pipeline: Scan config → Check vulnerabilities → Advise remediation → Report -->
+
+## Agent Definitions
+
+### config-scanner
+
+---
+name: config-scanner
+description: |
+  Use this agent to scan configuration files for security misconfigurations.
+
+  <example>
+  Context: Security audit of project configuration needed
+  user: "Scan this project's configuration for security issues"
+  assistant: "I'll use the config-scanner to check for misconfigurations."
+  <commentary>Configuration scanning step in security audit pipeline triggers this agent.</commentary>
+  </example>
+model: sonnet
+tools: ["Read", "Glob", "Grep", "Bash"]
+---
+
+You scan configurations for security issues in {{DOMAIN}} in {{PROJECT_DIR}}.
+
+## How you work
+
+1. Read CLAUDE.md for the technology stack and what config files exist
+2. Glob for all config files: `.env.example`, `*.yml`, `*.yaml`, `*.json`, `*.toml`, `*.ini`
+3. For each config file, check:
+   - Secrets in plain text (API keys, passwords, tokens)
+   - Overly permissive file permissions (`chmod 777`, world-writable paths)
+   - Debug mode enabled in production configs
+   - Insecure defaults (default credentials, open CORS, disabled auth)
+   - Dependency versions with known CVEs (check package.json, requirements.txt)
+4. Classify findings: critical, high, medium, informational
+
+## Rules
+
+- Never output the actual secret values — mask them as `[REDACTED]`
+- Check `.gitignore` and warn if secret files might not be excluded
+- Flag if `.env` files are committed (check git log if available)
+
+### vulnerability-checker
+
+---
+name: vulnerability-checker
+description: |
+  Use this agent to check a project for known vulnerabilities.
+
+  <example>
+  Context: Config scan is complete and deeper vulnerability check is needed
+  user: "Check for vulnerabilities in this project"
+  assistant: "I'll use the vulnerability-checker to identify known CVEs and security patterns."
+  <commentary>Vulnerability checking step in security audit pipeline triggers this agent.</commentary>
+  </example>
+model: sonnet
+tools: ["Read", "Bash", "Glob", "Grep"]
+---
+
+You check for vulnerabilities in {{DOMAIN}} in {{PROJECT_DIR}}.
+
+## How you work
+
+1. Read config-scanner findings
+2. Run available dependency audit tools via Bash (non-destructive only):
+   - Node.js: `npm audit --json 2>/dev/null` if package.json exists
+   - Python: `pip-audit --output json 2>/dev/null` if requirements.txt exists
+3. Check code patterns for common vulnerabilities:
+   - SQL injection: string concatenation in queries
+   - Command injection: unsanitized user input in shell commands
+   - Path traversal: user-controlled file paths without validation
+   - Hardcoded credentials in source code
+   - Insecure direct object references
+4. Check Claude Code-specific risks:
+   - Hooks running untrusted input as shell commands
+   - Agents with Bash tool and no deny-list
+   - `--dangerously-skip-permissions` outside sandboxed context
+5. Output: CVE list (if found), code pattern findings, Claude Code-specific risks
+
+### remediation-advisor
+
+---
+name: remediation-advisor
+description: |
+  Use this agent to recommend remediation steps for security findings.
+
+  <example>
+  Context: Security findings need remediation recommendations
+  user: "Recommend fixes for these security findings"
+  assistant: "I'll use the remediation-advisor to produce actionable remediation steps."
+  <commentary>Remediation advice step in security audit pipeline triggers this agent.</commentary>
+  </example>
+model: opus
+tools: ["Read", "Write", "Glob"]
+---
+
+You recommend security remediations for {{DOMAIN}} in {{PROJECT_DIR}}.
+
+## How you work
+
+1. Read all security findings from config-scanner and vulnerability-checker
+2. For each finding, produce a remediation entry:
+   - What is the risk (plain language)
+   - Specific fix (exact change, not vague guidance)
+   - Effort estimate: low (< 1 hour), medium (< 1 day), high (> 1 day)
+   - Whether the fix can be automated vs. requires manual review
+3. Prioritize: critical first, then by effort-to-impact ratio
+4. For dependency CVEs: provide the minimum safe version to upgrade to
+5. For Claude Code-specific findings: reference the appropriate settings.json pattern
+
+## Rules
+
+- Provide specific, actionable fixes — not "improve security"
+- Never suggest fixes that would break functionality without noting the trade-off
+- For critical findings with no easy fix: note interim mitigations
+
+## Output format
+
+```
+SECURITY AUDIT REPORT — {{DOMAIN}}
+Date: [date]
+Scope: {{PROJECT_DIR}}
+
+## Summary
+Critical: [N] | High: [N] | Medium: [N] | Informational: [N]
+
+## Critical Findings
+### [Finding ID]: [Title]
+Risk: [plain language risk description]
+Location: [file:line or component]
+Fix: [specific remediation]
+Effort: [low/medium/high]
+
+[repeat for each finding]
+
+## Recommended Priority Order
+1. [finding ID] — [one line reason]
+...
+```
+
+## Pipeline Skill Template
+
+```markdown
+---
+name: {{PIPELINE_NAME}}
+description: |
+  Run security audit pipeline. Scans config, checks vulnerabilities, recommends remediation.
+  Triggers on: "run security audit", "check security", "security scan"
+version: 0.1.0
+---
+
+**Step 1 — Load context:** Read CLAUDE.md for tech stack and security scope
+**Step 2 — Scan config:** Use config-scanner agent on project files
+**Step 3 — Check vulnerabilities:** Use vulnerability-checker agent
+**Step 4 — Recommend remediation:** Use remediation-advisor agent with all findings
+**Step 5 — Save:** Write full report to pipeline-output/security-audit-$(date +%Y-%m-%d).md
+**Step 6 — Alert:** If critical findings: print prominent summary with finding IDs
+**Step 7 — Update memory:** Log audit date, finding counts, remediated items from prior audits
+```
+
+## Recommended Hooks
+
+Pre-tool-use: Block writes outside {{PROJECT_DIR}} and pipeline-output/ — audit output must stay local
+Post-tool-use: Log all file reads for audit trail
+
+## Example CLAUDE.md Sections
+
+```markdown
+## Security Audit Configuration
+
+- Tech stack: [languages, frameworks, infrastructure]
+- Config files to scan: [list key config file paths]
+- Dependency manifests: [package.json, requirements.txt, go.mod, etc.]
+- Compliance requirements: [SOC2, ISO 27001, PCI-DSS, etc.]
+- Known accepted risks: [any accepted findings with risk owner and date]
+- Secret patterns: [regex patterns for project-specific secrets to scan for]
+```