# security-operations

> This skill should be **automatically invoked** when: - User mentions committing code or pushing to git - Discussing code review or security concerns - Before any production deployment - When credentials, passwords, or API keys are mentioned - User asks about vulnerabilities or security best practices - Pre-commit validation is needed

- Author: eboncorp
- Repository: eboncorp/claude-code-config
- Version: 20260130180656
- Stars: 0
- Forks: 0
- Last Updated: 2026-02-08
- Source: https://github.com/eboncorp/claude-code-config
- Web: https://mule.run/skillshub/@@eboncorp/claude-code-config~security-operations:20260130180656

---

---
name: security-operations
description: This skill should be **automatically invoked** when: User mentions committing code or pushing to git Discussing code review or security concerns
hooks:
  PreToolUse:
    - matcher: "Bash(git commit:*)|Bash(git push:*)"
      hooks:
        - type: command
          command: "$HOME/.claude/hooks/pre_tool_use.sh"
          timeout: 5000
        - type: prompt
          prompt: "Git operation detected: $ARGUMENTS. Security check: 1) No credentials in staged files, 2) No .env files being committed, 3) No private keys. Return {\"ok\": true} if safe, {\"ok\": false, \"blocked_files\": [...]} if sensitive files detected."
          timeout: 8000
    - matcher: "Bash"
      hooks:
        - type: command
          command: "echo \"$(date +%Y-%m-%d\\ %H:%M:%S) - Security audit: $TOOL_NAME - $TOOL_INPUT\" >> $HOME/.claude/logs/security_audit.log"
          timeout: 2000
---

# Security Operations Skill

**Version:** 1.0.0
**Last Updated:** 2025-11-17
**Auto-Invoke:** Yes - before git commits, code reviews, or when security is mentioned

## When to Use This Skill

This skill should be **automatically invoked** when:
- User mentions committing code or pushing to git
- Discussing code review or security concerns
- Before any production deployment
- When credentials, passwords, or API keys are mentioned
- User asks about vulnerabilities or security best practices
- Pre-commit validation is needed

## Security Achievement Context

**Recent Success:** Security score improved from 3/10 to 9/10 (+200%)
- Eliminated 8 vulnerabilities
- Added 37+ security tests
- Removed SQL files containing passwords from GitHub
- Implemented OWASP Top 10 protections

## CRITICAL: Pre-Commit Security Checks

### 1. Credential Exposure Detection (MUST CHECK)

```bash
# Check for hardcoded passwords
git diff --cached | grep -n "password\s*=\s*['\"]" && echo "⚠️ HARDCODED PASSWORD DETECTED"

# Check for API keys
git diff --cached | grep -n "api_key\s*=\s*['\"]" && echo "⚠️ API KEY EXPOSED"

# Check for .env files staged
git diff --cached --name-only | grep -q "\.env$" && echo "❌ CRITICAL: .env FILE STAGED"

# Check for SQL dumps (contain passwords!)
git diff --cached --name-only | grep -q "\.sql$" && echo "❌ CRITICAL: SQL DUMP STAGED"
```

**If any of these trigger: BLOCK THE COMMIT**

### 2. OWASP Top 10 Vulnerability Scan

**SQL Injection:**
```bash
# Bad pattern (WordPress)
grep -n "\$wpdb->query.*\\\$" --include="*.php" .
# Should use: $wpdb->prepare()
```

**XSS (Cross-Site Scripting):**
```bash
# Unescaped output
grep -n "echo\s*\\\$_" --include="*.php" .
# Should use: esc_html(), esc_attr(), wp_kses()
```

**CSRF Protection:**
```bash
# Forms need nonce verification
grep -n "wp_nonce_field\|check_admin_referer" --include="*.php" .
```

**Command Injection:**
```bash
# Dangerous functions
grep -n "exec(\|system(\|passthru(\|shell_exec(" --include="*.php" .
```

### 3. WordPress-Specific Security

**Direct File Access Protection:**
```php
// Every PHP file should have:
if (!defined('ABSPATH')) exit;
```

**Input Sanitization:**
```php
// Bad
$value = $_POST['field'];

// Good
$value = sanitize_text_field($_POST['field']);
$email = sanitize_email($_POST['email']);
$number = absint($_POST['count']);
```

**Output Escaping:**
```php
// Bad
echo $user_input;

// Good
echo esc_html($user_input);
echo esc_attr($attribute_value);
echo wp_kses($html_content, $allowed_tags);
```

**CSRF Protection:**
```php
// In form
wp_nonce_field('my_action', 'my_nonce');

// In handler
check_admin_referer('my_action', 'my_nonce');
// or
if (!wp_verify_nonce($_POST['my_nonce'], 'my_action')) {
    die('Security check failed');
}
```

### 4. File Naming Convention Enforcement

```bash
# Check for uppercase letters (VIOLATION)
for file in $(git diff --cached --name-only); do
  if echo "$(basename "$file")" | grep -q '[A-Z]'; then
    echo "❌ NAMING VIOLATION: $file contains uppercase"
    echo "   Should be: $(basename "$file" | tr '[:upper:]' '[:lower:]' | tr ' -' '__')"
  fi
done

# Check for spaces (VIOLATION)
for file in $(git diff --cached --name-only); do
  if echo "$(basename "$file")" | grep -q ' '; then
    echo "❌ NAMING VIOLATION: $file contains spaces"
  fi
done
```

### 5. /tmp/ Usage Prevention

```bash
# Check for /tmp/ references
git diff --cached | grep -n "^+.*\/tmp\/" && echo "❌ CRITICAL: /tmp/ USAGE DETECTED - USE SESSION_DIR"
```

## Risk Scoring System

| Score | Severity | Action Required |
|-------|----------|-----------------|
| 9-10 | CRITICAL | Block commit immediately (credentials exposed) |
| 7-8 | HIGH | Fix before deployment (SQL injection, XSS) |
| 5-6 | MEDIUM | Fix soon (missing input validation) |
| 3-4 | LOW | Best practice improvements |
| 1-2 | INFO | Code quality suggestions |

## Generate Security Report

```bash
AUDIT_DIR="/home/dave/skippy/work/security/$(date +%Y%m%d_%H%M%S)_security_audit"
mkdir -p "$AUDIT_DIR"

cat > "$AUDIT_DIR/SECURITY_REPORT.md" <<EOF
# Security Audit Report
**Date:** $(date)
**Scope:** {files/repository}
**Risk Score:** {X}/10

## Critical Issues (Must Fix)
{list}

## High Priority
{list}

## Recommendations
1. {action items}

## Files Reviewed
{list}
EOF
```

## Known Security Patterns for RunDaveRun

**GitHub Repositories:**
- `$GITHUB_ORG/$REPO_NAME` - Main campaign site
- Critical issue fixed: Sensitive database files removed from repository
- 4 remaining security items to address

**Plugin Security:**
- dave-biggers-policy-manager
- Uses nonce verification ✅
- Uses input sanitization ✅
- Uses prepared statements ✅

## Automated Security Workflow

### Before Every Commit:
1. Check for credential exposure
2. Scan for OWASP vulnerabilities
3. Verify file naming conventions
4. Ensure no /tmp/ usage
5. Validate WordPress security patterns
6. Generate audit report if issues found

### Before Every Production Deploy:
1. Full security audit
2. Dependency vulnerability check
3. Permission verification
4. SSL/TLS validation
5. Error logging disabled for production

## Git Safety Protocol

**NEVER:**
- Update git config
- Run destructive commands (push --force, hard reset)
- Skip hooks (--no-verify)
- Commit credentials or secrets
- Amend other developers' commits

**ALWAYS:**
- Check authorship before amend: `git log -1 --format='%an %ae'`
- Verify not pushed: `git status` shows "ahead"
- Quote file paths with spaces
- Use HEREDOC for commit messages

## Quick Reference: Common Fixes

**Exposed Password:**
```bash
# Remove from staging
git reset HEAD .env
# Add to .gitignore
echo ".env" >> .gitignore
```

**SQL Injection:**
```php
// Fix: Use prepared statement
$result = $wpdb->get_results(
    $wpdb->prepare("SELECT * FROM table WHERE id = %d", $user_id)
);
```

**XSS Vulnerability:**
```php
// Fix: Escape output
echo esc_html($user_name);
```

**Missing Nonce:**
```php
// Add to form
wp_nonce_field('action_name', 'nonce_name');
// Add to handler
if (!wp_verify_nonce($_POST['nonce_name'], 'action_name')) {
    wp_die('Security check failed');
}
```

## Related Skills

- **pre-commit** - Enforce standards before commit
- **git-workflow** - Branch management and safety
- **emergency-recovery** - Incident response procedures