[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M754KA701S79DHQT63TGWM2B":3,"skill-same:01M754KA701S79DHQT63TGWM2B":57},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":19,"linkOnly":20,"markdownContent":21,"markdownBody":22,"frontMatter":23,"refName":29,"commitSha":30,"skillDirectory":31,"forksCount":32,"repositoryHtmlUrl":33,"repositoryHomepageUrl":6,"ownerHtmlUrl":34,"ownerBlogUrl":35,"ownerDescription":36,"updatedAt":37,"install":38,"resources":50},"01M754KA701S79DHQT63TGWM2B","x-evaluate-hardening",null,"Evaluates application hardening posture against CIS and OWASP benchmarks: HTTP security headers, TLS configuration, CORS policy, cookie security, error handling, input limits, and information disclosure. Produces SARIF output with weighted scoring.","review-bench\u002Federcnj_ia-dev-environment","review-bench","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F286778065?v=4","01M7517F9NTEPDZDAXJBR30FWT","ReviewBench","01M7517FAC9F4P7TGWCNJ8VYVW",0,"MIT","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-fintech-pci\u002F.claude\u002Fskills\u002Fx-evaluate-hardening\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: x-evaluate-hardening\ndescription: \"Evaluates application hardening posture against CIS and OWASP benchmarks: HTTP security headers, TLS configuration, CORS policy, cookie security, error handling, input limits, and information disclosure. Produces SARIF output with weighted scoring.\"\nuser-invocable: true\nallowed-tools: Read, Write, Bash, Grep, Glob, Agent\nargument-hint: \"--target \u003Curl> [--scope all|headers|tls|cors|cookies|errors|limits|disclosure] [--benchmark cis|owasp] [--level L1|L2|L3]\"\ncontext-budget: medium\nrequires-capabilities: []\n---\n\n## Global Output Policy\n\n- **Language**: English ONLY.\n- **Tone**: Technical, Direct, and Concise.\n- **Efficiency**: Remove all conversational fillers and greetings to save tokens.\n\n# Skill: Application Hardening Eval\n\n## Purpose\n\nEvaluates the defensive posture of {{PROJECT_NAME}} against recognized benchmarks (CIS, OWASP). Analyzes 7 hardening dimensions with weighted scoring: HTTP security headers, TLS configuration, CORS policy, cookie security, error handling, input limits, and information disclosure. Produces SARIF 2.1.0 output and a Markdown report with per-dimension scores.\n\n## Triggers\n\n- `\u002Fx-evaluate-hardening --target \u003Curl>` — full hardening evaluation (all dimensions, OWASP benchmark, L1)\n- `\u002Fx-evaluate-hardening --target \u003Curl> --scope headers` — evaluate HTTP security headers only\n- `\u002Fx-evaluate-hardening --target \u003Curl> --scope tls` — evaluate TLS configuration only\n- `\u002Fx-evaluate-hardening --target \u003Curl> --benchmark cis` — evaluate against CIS benchmark\n- `\u002Fx-evaluate-hardening --target \u003Curl> --level L2` — evaluate against ASVS Level 2\n\n## Parameters\n\n| Parameter | Type | Required | Default | Description |\n|-----------|------|----------|---------|-------------|\n| `--target` | URL | Yes | — | Target application URL (HTTP\u002FHTTPS) |\n| `--scope` | Enum | No | `all` | Dimension filter: all, headers, tls, cors, cookies, errors, limits, disclosure |\n| `--benchmark` | Enum | No | `owasp` | Benchmark: cis (infrastructure-focused) or owasp (application-focused) |\n| `--level` | Enum | No | `L1` | ASVS verification level: L1, L2, L3 |\n\n## Workflow\n\n```\n1. VALIDATE   -> Parse and validate CLI parameters\n2. CONFIGURE  -> Load benchmark checks and ASVS level mapping\n3. PROBE      -> Send HTTP requests to collect headers, TLS info, CORS behavior\n4. EVALUATE   -> Assess each dimension against benchmark checks\n5. SCORE      -> Calculate weighted scores per dimension and overall\n6. REPORT     -> Generate SARIF 2.1.0 output + Markdown report\n```\n\n### Step 1 — Validate Parameters\n\nValidate all CLI parameters before proceeding:\n\n- `--target` must be a valid HTTP or HTTPS URL\n- `--scope` must be one of: all, headers, tls, cors, cookies, errors, limits, disclosure\n- `--benchmark` must be one of: cis, owasp\n- `--level` must be one of: L1, L2, L3\n\n**Error — Target Unreachable:**\n\nIf the target URL is unreachable (connection refused, DNS failure, timeout):\n\n```\nERROR: Target unreachable: \u003Curl>\nReason: \u003Cconnection error detail>\nNo score calculated. Verify the URL and ensure the application is running.\n```\n\n### Step 2 — Configure Benchmark Checks\n\nLoad the appropriate check set based on `--benchmark` and `--level`:\n\n#### OWASP Benchmark (Default)\n\nChecks derived from OWASP ASVS V14 (Configuration) and OWASP Secure Headers Project.\n\n#### CIS Benchmark\n\nChecks derived from CIS Benchmarks for web servers (Apache, Nginx, IIS). Includes additional server-specific hardening checks.\n\n#### ASVS Level Mapping\n\n| Level | Scope | Description |\n|-------|-------|-------------|\n| L1 | Opportunistic | Basic security checks applicable to all applications |\n| L2 | Standard | Covers most applications with sensitive data |\n| L3 | Advanced | High-value applications requiring maximum assurance |\n\nHigher levels include all checks from lower levels plus additional requirements.\n\n### Step 3 — Probe Target\n\nSend HTTP requests to collect security-relevant data:\n\n```bash\n# Collect response headers\ncurl -sI --max-time 10 \u003Ctarget-url>\n\n# Test CORS with preflight\ncurl -sI -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: POST\" \\\n  --max-time 10 \u003Ctarget-url>\n\n# Check TLS configuration (if HTTPS)\nopenssl s_client -connect \u003Chost>:\u003Cport> \\\n  -servername \u003Chost> \u003C\u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull\n\n# Test error handling\ncurl -s --max-time 10 \u003Ctarget-url>\u002Fnonexistent-path-404\n```\n\n### Step 4 — Evaluate Dimensions\n\nEvaluate each dimension (filtered by `--scope`) against the configured benchmark checks.\n\n#### 4.1 — HTTP Security Headers (Weight: 25%)\n\n| Header | CIS | OWASP | Check | Severity |\n|--------|-----|-------|-------|----------|\n| Strict-Transport-Security | Yes | Yes | Present, max-age >= 31536000, includeSubDomains | HIGH |\n| X-Frame-Options | Yes | Yes | DENY or SAMEORIGIN | MEDIUM |\n| X-Content-Type-Options | Yes | Yes | nosniff | MEDIUM |\n| Content-Security-Policy | No | Yes | Present, no unsafe-inline or unsafe-eval | HIGH |\n| Cross-Origin-Resource-Policy | No | Yes | same-origin or same-site | MEDIUM |\n| Permissions-Policy | No | Yes | Present and restrictive | LOW |\n| Referrer-Policy | No | Yes | strict-origin-when-cross-origin or no-referrer | LOW |\n\n**HSTS Fix Recommendation:**\n\n```\nStrict-Transport-Security: max-age=31536000; includeSubDomains\n```\n\n**CSP Fix Recommendation:**\n\n```\nContent-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'\n```\n\n#### 4.2 — TLS Configuration (Weight: 20%)\n\n| Check | CIS | OWASP | Requirement | Severity |\n|-------|-----|-------|-------------|----------|\n| TLS Version | Yes | Yes | Minimum TLS 1.2 (L1), TLS 1.3 only (L3) | HIGH |\n| Cipher Suites | Yes | Yes | Strong ciphers only (AEAD) | HIGH |\n| OCSP Stapling | Yes | No | Enabled for certificate validation | MEDIUM |\n| Certificate Chain | Yes | Yes | Valid, not expired, correct hostname | HIGH |\n| HSTS Preload | No | Yes | Listed in HSTS preload list (L2+) | LOW |\n\n#### 4.3 — CORS Policy (Weight: 15%)\n\n| Check | CIS | OWASP | Requirement | Severity |\n|-------|-----|-------|-------------|----------|\n| Origin Whitelist | No | Yes | No wildcard (*) with credentials | HIGH |\n| Credentials Handling | No | Yes | Access-Control-Allow-Credentials only with explicit origins | HIGH |\n| Preflight Cache | No | Yes | Access-Control-Max-Age set (recommended >= 600) | LOW |\n| Exposed Headers | No | Yes | Minimal set of exposed headers | MEDIUM |\n| Allowed Methods | Yes | Yes | Restrict to required HTTP methods only | MEDIUM |\n\n#### 4.4 — Cookie Security (Weight: 15%)\n\n| Check | CIS | OWASP | Requirement | Severity |\n|-------|-----|-------|-------------|----------|\n| Secure Flag | Yes | Yes | All session cookies use Secure flag | HIGH |\n| HttpOnly Flag | Yes | Yes | Session cookies use HttpOnly flag | HIGH |\n| SameSite Attribute | No | Yes | SameSite=Strict or SameSite=Lax | MEDIUM |\n| Path Scope | No | Yes | Path restricted to application root | LOW |\n| Cookie Prefix | No | Yes | __Secure- or __Host- prefix (L2+) | LOW |\n\n#### 4.5 — Error Handling (Weight: 10%)\n\n| Check | CIS | OWASP | Requirement | Severity |\n|-------|-----|-------|-------------|----------|\n| Stack Trace Suppression | Yes | Yes | No stack traces in error responses | HIGH |\n| Error Code Format | No | Yes | Standardized error codes (RFC 7807) | MEDIUM |\n| Custom Error Pages | Yes | Yes | Custom 404\u002F500 pages without server info | MEDIUM |\n| Debug Mode | Yes | Yes | Debug mode disabled in production | CRITICAL |\n\n#### 4.6 — Input Limits (Weight: 10%)\n\n| Check | CIS | OWASP | Requirement | Severity |\n|-------|-----|-------|-------------|----------|\n| Request Body Size | Yes | Yes | Max body size configured | MEDIUM |\n| URL Length | Yes | No | Max URL length enforced (8192 recommended) | LOW |\n| Header Size | Yes | No | Max header size configured | LOW |\n| Upload Limits | Yes | Yes | File upload size restricted | MEDIUM |\n| Rate Limiting | No | Yes | Rate limiting headers present (X-RateLimit-*) | HIGH |\n\n#### 4.7 — Information Disclosure (Weight: 5%)\n\n| Check | CIS | OWASP | Requirement | Severity |\n|-------|-----|-------|-------------|----------|\n| Server Header | Yes | Yes | Removed or generic (no version) | MEDIUM |\n| X-Powered-By | Yes | Yes | Removed entirely | MEDIUM |\n| Version Disclosure | Yes | Yes | No version numbers in headers or body | MEDIUM |\n| Directory Listing | Yes | No | Disabled | HIGH |\n\n### Step 5 — Calculate Weighted Score\n\n#### Dimension Weights\n\n| Dimension | Weight |\n|-----------|--------|\n| headers | 0.25 |\n| tls | 0.20 |\n| cors | 0.15 |\n| cookies | 0.15 |\n| errors | 0.10 |\n| limits | 0.10 |\n| disclosure | 0.05 |\n\n**Score Calculation:**\n\n```\ndimension_score = (passed_checks \u002F total_checks) * 100\n\noverall_score = sum(dimension_score * weight) \u002F sum(applicable_weights)\n```\n\nWhen `--scope` filters dimensions, only the applicable dimensions are included in the weighted average. Excluded dimensions do not affect the overall score.\n\n#### Grade Mapping\n\n| Score Range | Grade |\n|-------------|-------|\n| 90-100 | A |\n| 80-89 | B |\n| 70-79 | C |\n| 60-69 | D |\n| 0-59 | F |\n\n### Step 6 — Generate Reports\n\n#### 6.1 — SARIF 2.1.0 Output\n\nWrite SARIF to `results\u002Fsecurity\u002Fhardening-eval-YYYY-MM-DD.sarif.json`:\n\n```json\n{\n  \"$schema\": \"https:\u002F\u002Fraw.githubusercontent.com\u002Foasis-tcs\u002Fsarif-spec\u002Fmain\u002Fsarif-2.1\u002Fschema\u002Fsarif-schema-2.1.0.json\",\n  \"version\": \"2.1.0\",\n  \"runs\": [{\n    \"tool\": {\n      \"driver\": {\n        \"name\": \"x-evaluate-hardening\",\n        \"version\": \"1.0.0\",\n        \"rules\": [\n          {\n            \"id\": \"HARDEN-HDR-001\",\n            \"name\": \"MissingHSTS\",\n            \"shortDescription\": {\n              \"text\": \"Strict-Transport-Security header missing\"\n            },\n            \"defaultConfiguration\": {\n              \"level\": \"error\"\n            },\n            \"properties\": {\n              \"dimension\": \"headers\",\n              \"benchmark\": \"owasp\",\n              \"asvsLevel\": \"L1\",\n              \"severity\": \"HIGH\"\n            }\n          }\n        ]\n      }\n    },\n    \"results\": [\n      {\n        \"ruleId\": \"HARDEN-HDR-001\",\n        \"level\": \"error\",\n        \"message\": {\n          \"text\": \"HSTS header not found. Add: Strict-Transport-Security: max-age=31536000; includeSubDomains\"\n        },\n        \"locations\": [{\n          \"physicalLocation\": {\n            \"artifactLocation\": {\n              \"uri\": \"https:\u002F\u002Fapp.example.com\"\n            }\n          }\n        }],\n        \"properties\": {\n          \"fixRecommendation\": \"Strict-Transport-Security: max-age=31536000; includeSubDomains\"\n        }\n      }\n    ],\n    \"properties\": {\n      \"overallScore\": 78,\n      \"grade\": \"C\",\n      \"benchmark\": \"owasp\",\n      \"level\": \"L1\"\n    }\n  }]\n}\n```\n\n#### SARIF Rule ID Convention\n\n| Dimension | Prefix | Example |\n|-----------|--------|---------|\n| headers | HARDEN-HDR | HARDEN-HDR-001 |\n| tls | HARDEN-TLS | HARDEN-TLS-001 |\n| cors | HARDEN-COR | HARDEN-COR-001 |\n| cookies | HARDEN-COK | HARDEN-COK-001 |\n| errors | HARDEN-ERR | HARDEN-ERR-001 |\n| limits | HARDEN-LIM | HARDEN-LIM-001 |\n| disclosure | HARDEN-DIS | HARDEN-DIS-001 |\n\n#### 6.2 — Markdown Report\n\nWrite report to `results\u002Fsecurity\u002Fhardening-eval-YYYY-MM-DD.md`:\n\n```markdown\n# Application Hardening Evaluation — {{PROJECT_NAME}}\n\n**Date:** YYYY-MM-DD\n**Target:** \u003Curl>\n**Benchmark:** OWASP \u002F CIS\n**ASVS Level:** L1 \u002F L2 \u002F L3\n**Overall Score:** NN\u002F100 (Grade: X)\n\n## Score Heatmap\n\n| Dimension | Weight | Score | Passed | Failed | Grade |\n|-----------|--------|-------|--------|--------|-------|\n| HTTP Headers | 25% | 85 | 6\u002F7 | 1 | B |\n| TLS | 20% | 100 | 5\u002F5 | 0 | A |\n| CORS | 15% | 60 | 3\u002F5 | 2 | D |\n| Cookies | 15% | 75 | 3\u002F4 | 1 | C |\n| Error Handling | 10% | 50 | 2\u002F4 | 2 | F |\n| Input Limits | 10% | 80 | 4\u002F5 | 1 | B |\n| Info Disclosure | 5% | 100 | 4\u002F4 | 0 | A |\n\n**Weakest Dimension:** Error Handling (50)\n**Strongest Dimension:** TLS (100)\n\n## Findings\n\n### [HARDEN-HDR-001] Missing HSTS Header\n- **Dimension:** HTTP Headers\n- **Severity:** HIGH\n- **Benchmark:** OWASP, CIS\n- **ASVS Reference:** V14.4.1\n- **Description:** Strict-Transport-Security header not present\n- **Fix:** Add header `Strict-Transport-Security: max-age=31536000; includeSubDomains`\n\n## Recommendations\n\n1. **Immediate:** Address HIGH and CRITICAL findings\n2. **Short-term:** Resolve MEDIUM findings in current sprint\n3. **Long-term:** Review LOW findings for defense-in-depth\n```\n\n## CI Integration\n\n### GitHub Actions\n\n```yaml\n- name: Hardening Eval\n  run: |\n    \u002Fx-evaluate-hardening --target ${{ env.APP_URL }} \\\n      --benchmark owasp --level L1\n    # Upload SARIF to GitHub Security tab\n    gh api repos\u002F${{ github.repository }}\u002Fcode-scanning\u002Fsarifs \\\n      -f \"sarif=$(cat results\u002Fsecurity\u002Fhardening-eval-*.sarif.json | base64)\"\n```\n\n### GitLab CI\n\n```yaml\nhardening-eval:\n  stage: security\n  script:\n    - \u002Fx-evaluate-hardening --target $APP_URL --benchmark owasp --level L1\n  artifacts:\n    reports:\n      sast: results\u002Fsecurity\u002Fhardening-eval-*.sarif.json\n```\n\n## Error Handling\n\n| Scenario | Action |\n|----------|--------|\n| Target unreachable | Report error with URL, no score calculated |\n| HTTPS target with invalid certificate | Warn, proceed with evaluation, note in findings |\n| Non-HTTP target | Reject with \"Target must be HTTP or HTTPS URL\" |\n| TLS probing unavailable | Skip TLS dimension, adjust weights |\n| Partial response | Evaluate available data, note gaps in report |\n| Unknown scope value | Reject with \"Invalid scope: \u003Cvalue>\" |\n\n## Integration Notes\n\n| Skill | Relationship | Context |\n|-------|-------------|---------|\n| `security-engineer` agent | calls | Used for in-depth analysis via Agent tool |\n| `x-generate-security-dashboard` | reads | Dashboard aggregates results from this skill |\n| `x-scan-owasp` | complementary | OWASP scan covers application-level vulnerabilities; hardening covers infrastructure posture |\n\n## Knowledge Pack References\n\n| Pack | Files | Purpose |\n|------|-------|---------|\n| security | `knowledge\u002Fsecurity\u002Fsecurity-principles.md` | Data classification, input validation, fail-secure patterns |\n| security | `knowledge\u002Fsecurity\u002Fapplication-security.md` | OWASP Top 10, security headers, secrets management |\n| security | `knowledge\u002Fsecurity\u002Fcryptography.md` | TLS requirements, cipher suites, certificate management |\n","## Global Output Policy\n\n- **Language**: English ONLY.\n- **Tone**: Technical, Direct, and Concise.\n- **Efficiency**: Remove all conversational fillers and greetings to save tokens.\n\n# Skill: Application Hardening Eval\n\n## Purpose\n\nEvaluates the defensive posture of {{PROJECT_NAME}} against recognized benchmarks (CIS, OWASP). Analyzes 7 hardening dimensions with weighted scoring: HTTP security headers, TLS configuration, CORS policy, cookie security, error handling, input limits, and information disclosure. Produces SARIF 2.1.0 output and a Markdown report with per-dimension scores.\n\n## Triggers\n\n- `\u002Fx-evaluate-hardening --target \u003Curl>` — full hardening evaluation (all dimensions, OWASP benchmark, L1)\n- `\u002Fx-evaluate-hardening --target \u003Curl> --scope headers` — evaluate HTTP security headers only\n- `\u002Fx-evaluate-hardening --target \u003Curl> --scope tls` — evaluate TLS configuration only\n- `\u002Fx-evaluate-hardening --target \u003Curl> --benchmark cis` — evaluate against CIS benchmark\n- `\u002Fx-evaluate-hardening --target \u003Curl> --level L2` — evaluate against ASVS Level 2\n\n## Parameters\n\n| Parameter | Type | Required | Default | Description |\n|-----------|------|----------|---------|-------------|\n| `--target` | URL | Yes | — | Target application URL (HTTP\u002FHTTPS) |\n| `--scope` | Enum | No | `all` | Dimension filter: all, headers, tls, cors, cookies, errors, limits, disclosure |\n| `--benchmark` | Enum | No | `owasp` | Benchmark: cis (infrastructure-focused) or owasp (application-focused) |\n| `--level` | Enum | No | `L1` | ASVS verification level: L1, L2, L3 |\n\n## Workflow\n\n```\n1. VALIDATE   -> Parse and validate CLI parameters\n2. CONFIGURE  -> Load benchmark checks and ASVS level mapping\n3. PROBE      -> Send HTTP requests to collect headers, TLS info, CORS behavior\n4. EVALUATE   -> Assess each dimension against benchmark checks\n5. SCORE      -> Calculate weighted scores per dimension and overall\n6. REPORT     -> Generate SARIF 2.1.0 output + Markdown report\n```\n\n### Step 1 — Validate Parameters\n\nValidate all CLI parameters before proceeding:\n\n- `--target` must be a valid HTTP or HTTPS URL\n- `--scope` must be one of: all, headers, tls, cors, cookies, errors, limits, disclosure\n- `--benchmark` must be one of: cis, owasp\n- `--level` must be one of: L1, L2, L3\n\n**Error — Target Unreachable:**\n\nIf the target URL is unreachable (connection refused, DNS failure, timeout):\n\n```\nERROR: Target unreachable: \u003Curl>\nReason: \u003Cconnection error detail>\nNo score calculated. Verify the URL and ensure the application is running.\n```\n\n### Step 2 — Configure Benchmark Checks\n\nLoad the appropriate check set based on `--benchmark` and `--level`:\n\n#### OWASP Benchmark (Default)\n\nChecks derived from OWASP ASVS V14 (Configuration) and OWASP Secure Headers Project.\n\n#### CIS Benchmark\n\nChecks derived from CIS Benchmarks for web servers (Apache, Nginx, IIS). Includes additional server-specific hardening checks.\n\n#### ASVS Level Mapping\n\n| Level | Scope | Description |\n|-------|-------|-------------|\n| L1 | Opportunistic | Basic security checks applicable to all applications |\n| L2 | Standard | Covers most applications with sensitive data |\n| L3 | Advanced | High-value applications requiring maximum assurance |\n\nHigher levels include all checks from lower levels plus additional requirements.\n\n### Step 3 — Probe Target\n\nSend HTTP requests to collect security-relevant data:\n\n```bash\n# Collect response headers\ncurl -sI --max-time 10 \u003Ctarget-url>\n\n# Test CORS with preflight\ncurl -sI -X OPTIONS \\\n  -H \"Origin: https:\u002F\u002Fevil.example.com\" \\\n  -H \"Access-Control-Request-Method: POST\" \\\n  --max-time 10 \u003Ctarget-url>\n\n# Check TLS configuration (if HTTPS)\nopenssl s_client -connect \u003Chost>:\u003Cport> \\\n  -servername \u003Chost> \u003C\u002Fdev\u002Fnull 2>\u002Fdev\u002Fnull\n\n# Test error handling\ncurl -s --max-time 10 \u003Ctarget-url>\u002Fnonexistent-path-404\n```\n\n### Step 4 — Evaluate Dimensions\n\nEvaluate each dimension (filtered by `--scope`) against the configured benchmark checks.\n\n#### 4.1 — HTTP Security Headers (Weight: 25%)\n\n| Header | CIS | OWASP | Check | Severity |\n|--------|-----|-------|-------|----------|\n| Strict-Transport-Security | Yes | Yes | Present, max-age >= 31536000, includeSubDomains | HIGH |\n| X-Frame-Options | Yes | Yes | DENY or SAMEORIGIN | MEDIUM |\n| X-Content-Type-Options | Yes | Yes | nosniff | MEDIUM |\n| Content-Security-Policy | No | Yes | Present, no unsafe-inline or unsafe-eval | HIGH |\n| Cross-Origin-Resource-Policy | No | Yes | same-origin or same-site | MEDIUM |\n| Permissions-Policy | No | Yes | Present and restrictive | LOW |\n| Referrer-Policy | No | Yes | strict-origin-when-cross-origin or no-referrer | LOW |\n\n**HSTS Fix Recommendation:**\n\n```\nStrict-Transport-Security: max-age=31536000; includeSubDomains\n```\n\n**CSP Fix Recommendation:**\n\n```\nContent-Security-Policy: default-src 'self'; script-src 'self'; style-src 'self'; img-src 'self'; font-src 'self'\n```\n\n#### 4.2 — TLS Configuration (Weight: 20%)\n\n| Check | CIS | OWASP | Requirement | Severity |\n|-------|-----|-------|-------------|----------|\n| TLS Version | Yes | Yes | Minimum TLS 1.2 (L1), TLS 1.3 only (L3) | HIGH |\n| Cipher Suites | Yes | Yes | Strong ciphers only (AEAD) | HIGH |\n| OCSP Stapling | Yes | No | Enabled for certificate validation | MEDIUM |\n| Certificate Chain | Yes | Yes | Valid, not expired, correct hostname | HIGH |\n| HSTS Preload | No | Yes | Listed in HSTS preload list (L2+) | LOW |\n\n#### 4.3 — CORS Policy (Weight: 15%)\n\n| Check | CIS | OWASP | Requirement | Severity |\n|-------|-----|-------|-------------|----------|\n| Origin Whitelist | No | Yes | No wildcard (*) with credentials | HIGH |\n| Credentials Handling | No | Yes | Access-Control-Allow-Credentials only with explicit origins | HIGH |\n| Preflight Cache | No | Yes | Access-Control-Max-Age set (recommended >= 600) | LOW |\n| Exposed Headers | No | Yes | Minimal set of exposed headers | MEDIUM |\n| Allowed Methods | Yes | Yes | Restrict to required HTTP methods only | MEDIUM |\n\n#### 4.4 — Cookie Security (Weight: 15%)\n\n| Check | CIS | OWASP | Requirement | Severity |\n|-------|-----|-------|-------------|----------|\n| Secure Flag | Yes | Yes | All session cookies use Secure flag | HIGH |\n| HttpOnly Flag | Yes | Yes | Session cookies use HttpOnly flag | HIGH |\n| SameSite Attribute | No | Yes | SameSite=Strict or SameSite=Lax | MEDIUM |\n| Path Scope | No | Yes | Path restricted to application root | LOW |\n| Cookie Prefix | No | Yes | __Secure- or __Host- prefix (L2+) | LOW |\n\n#### 4.5 — Error Handling (Weight: 10%)\n\n| Check | CIS | OWASP | Requirement | Severity |\n|-------|-----|-------|-------------|----------|\n| Stack Trace Suppression | Yes | Yes | No stack traces in error responses | HIGH |\n| Error Code Format | No | Yes | Standardized error codes (RFC 7807) | MEDIUM |\n| Custom Error Pages | Yes | Yes | Custom 404\u002F500 pages without server info | MEDIUM |\n| Debug Mode | Yes | Yes | Debug mode disabled in production | CRITICAL |\n\n#### 4.6 — Input Limits (Weight: 10%)\n\n| Check | CIS | OWASP | Requirement | Severity |\n|-------|-----|-------|-------------|----------|\n| Request Body Size | Yes | Yes | Max body size configured | MEDIUM |\n| URL Length | Yes | No | Max URL length enforced (8192 recommended) | LOW |\n| Header Size | Yes | No | Max header size configured | LOW |\n| Upload Limits | Yes | Yes | File upload size restricted | MEDIUM |\n| Rate Limiting | No | Yes | Rate limiting headers present (X-RateLimit-*) | HIGH |\n\n#### 4.7 — Information Disclosure (Weight: 5%)\n\n| Check | CIS | OWASP | Requirement | Severity |\n|-------|-----|-------|-------------|----------|\n| Server Header | Yes | Yes | Removed or generic (no version) | MEDIUM |\n| X-Powered-By | Yes | Yes | Removed entirely | MEDIUM |\n| Version Disclosure | Yes | Yes | No version numbers in headers or body | MEDIUM |\n| Directory Listing | Yes | No | Disabled | HIGH |\n\n### Step 5 — Calculate Weighted Score\n\n#### Dimension Weights\n\n| Dimension | Weight |\n|-----------|--------|\n| headers | 0.25 |\n| tls | 0.20 |\n| cors | 0.15 |\n| cookies | 0.15 |\n| errors | 0.10 |\n| limits | 0.10 |\n| disclosure | 0.05 |\n\n**Score Calculation:**\n\n```\ndimension_score = (passed_checks \u002F total_checks) * 100\n\noverall_score = sum(dimension_score * weight) \u002F sum(applicable_weights)\n```\n\nWhen `--scope` filters dimensions, only the applicable dimensions are included in the weighted average. Excluded dimensions do not affect the overall score.\n\n#### Grade Mapping\n\n| Score Range | Grade |\n|-------------|-------|\n| 90-100 | A |\n| 80-89 | B |\n| 70-79 | C |\n| 60-69 | D |\n| 0-59 | F |\n\n### Step 6 — Generate Reports\n\n#### 6.1 — SARIF 2.1.0 Output\n\nWrite SARIF to `results\u002Fsecurity\u002Fhardening-eval-YYYY-MM-DD.sarif.json`:\n\n```json\n{\n  \"$schema\": \"https:\u002F\u002Fraw.githubusercontent.com\u002Foasis-tcs\u002Fsarif-spec\u002Fmain\u002Fsarif-2.1\u002Fschema\u002Fsarif-schema-2.1.0.json\",\n  \"version\": \"2.1.0\",\n  \"runs\": [{\n    \"tool\": {\n      \"driver\": {\n        \"name\": \"x-evaluate-hardening\",\n        \"version\": \"1.0.0\",\n        \"rules\": [\n          {\n            \"id\": \"HARDEN-HDR-001\",\n            \"name\": \"MissingHSTS\",\n            \"shortDescription\": {\n              \"text\": \"Strict-Transport-Security header missing\"\n            },\n            \"defaultConfiguration\": {\n              \"level\": \"error\"\n            },\n            \"properties\": {\n              \"dimension\": \"headers\",\n              \"benchmark\": \"owasp\",\n              \"asvsLevel\": \"L1\",\n              \"severity\": \"HIGH\"\n            }\n          }\n        ]\n      }\n    },\n    \"results\": [\n      {\n        \"ruleId\": \"HARDEN-HDR-001\",\n        \"level\": \"error\",\n        \"message\": {\n          \"text\": \"HSTS header not found. Add: Strict-Transport-Security: max-age=31536000; includeSubDomains\"\n        },\n        \"locations\": [{\n          \"physicalLocation\": {\n            \"artifactLocation\": {\n              \"uri\": \"https:\u002F\u002Fapp.example.com\"\n            }\n          }\n        }],\n        \"properties\": {\n          \"fixRecommendation\": \"Strict-Transport-Security: max-age=31536000; includeSubDomains\"\n        }\n      }\n    ],\n    \"properties\": {\n      \"overallScore\": 78,\n      \"grade\": \"C\",\n      \"benchmark\": \"owasp\",\n      \"level\": \"L1\"\n    }\n  }]\n}\n```\n\n#### SARIF Rule ID Convention\n\n| Dimension | Prefix | Example |\n|-----------|--------|---------|\n| headers | HARDEN-HDR | HARDEN-HDR-001 |\n| tls | HARDEN-TLS | HARDEN-TLS-001 |\n| cors | HARDEN-COR | HARDEN-COR-001 |\n| cookies | HARDEN-COK | HARDEN-COK-001 |\n| errors | HARDEN-ERR | HARDEN-ERR-001 |\n| limits | HARDEN-LIM | HARDEN-LIM-001 |\n| disclosure | HARDEN-DIS | HARDEN-DIS-001 |\n\n#### 6.2 — Markdown Report\n\nWrite report to `results\u002Fsecurity\u002Fhardening-eval-YYYY-MM-DD.md`:\n\n```markdown\n# Application Hardening Evaluation — {{PROJECT_NAME}}\n\n**Date:** YYYY-MM-DD\n**Target:** \u003Curl>\n**Benchmark:** OWASP \u002F CIS\n**ASVS Level:** L1 \u002F L2 \u002F L3\n**Overall Score:** NN\u002F100 (Grade: X)\n\n## Score Heatmap\n\n| Dimension | Weight | Score | Passed | Failed | Grade |\n|-----------|--------|-------|--------|--------|-------|\n| HTTP Headers | 25% | 85 | 6\u002F7 | 1 | B |\n| TLS | 20% | 100 | 5\u002F5 | 0 | A |\n| CORS | 15% | 60 | 3\u002F5 | 2 | D |\n| Cookies | 15% | 75 | 3\u002F4 | 1 | C |\n| Error Handling | 10% | 50 | 2\u002F4 | 2 | F |\n| Input Limits | 10% | 80 | 4\u002F5 | 1 | B |\n| Info Disclosure | 5% | 100 | 4\u002F4 | 0 | A |\n\n**Weakest Dimension:** Error Handling (50)\n**Strongest Dimension:** TLS (100)\n\n## Findings\n\n### [HARDEN-HDR-001] Missing HSTS Header\n- **Dimension:** HTTP Headers\n- **Severity:** HIGH\n- **Benchmark:** OWASP, CIS\n- **ASVS Reference:** V14.4.1\n- **Description:** Strict-Transport-Security header not present\n- **Fix:** Add header `Strict-Transport-Security: max-age=31536000; includeSubDomains`\n\n## Recommendations\n\n1. **Immediate:** Address HIGH and CRITICAL findings\n2. **Short-term:** Resolve MEDIUM findings in current sprint\n3. **Long-term:** Review LOW findings for defense-in-depth\n```\n\n## CI Integration\n\n### GitHub Actions\n\n```yaml\n- name: Hardening Eval\n  run: |\n    \u002Fx-evaluate-hardening --target ${{ env.APP_URL }} \\\n      --benchmark owasp --level L1\n    # Upload SARIF to GitHub Security tab\n    gh api repos\u002F${{ github.repository }}\u002Fcode-scanning\u002Fsarifs \\\n      -f \"sarif=$(cat results\u002Fsecurity\u002Fhardening-eval-*.sarif.json | base64)\"\n```\n\n### GitLab CI\n\n```yaml\nhardening-eval:\n  stage: security\n  script:\n    - \u002Fx-evaluate-hardening --target $APP_URL --benchmark owasp --level L1\n  artifacts:\n    reports:\n      sast: results\u002Fsecurity\u002Fhardening-eval-*.sarif.json\n```\n\n## Error Handling\n\n| Scenario | Action |\n|----------|--------|\n| Target unreachable | Report error with URL, no score calculated |\n| HTTPS target with invalid certificate | Warn, proceed with evaluation, note in findings |\n| Non-HTTP target | Reject with \"Target must be HTTP or HTTPS URL\" |\n| TLS probing unavailable | Skip TLS dimension, adjust weights |\n| Partial response | Evaluate available data, note gaps in report |\n| Unknown scope value | Reject with \"Invalid scope: \u003Cvalue>\" |\n\n## Integration Notes\n\n| Skill | Relationship | Context |\n|-------|-------------|---------|\n| `security-engineer` agent | calls | Used for in-depth analysis via Agent tool |\n| `x-generate-security-dashboard` | reads | Dashboard aggregates results from this skill |\n| `x-scan-owasp` | complementary | OWASP scan covers application-level vulnerabilities; hardening covers infrastructure posture |\n\n## Knowledge Pack References\n\n| Pack | Files | Purpose |\n|------|-------|---------|\n| security | `knowledge\u002Fsecurity\u002Fsecurity-principles.md` | Data classification, input validation, fail-secure patterns |\n| security | `knowledge\u002Fsecurity\u002Fapplication-security.md` | OWASP Top 10, security headers, secrets management |\n| security | `knowledge\u002Fsecurity\u002Fcryptography.md` | TLS requirements, cipher suites, certificate management |\n",{"name":5,"description":7,"allowed-tools":24,"argument-hint":25,"context-budget":26,"user-invocable":27,"requires-capabilities":28},"Read, Write, Bash, Grep, Glob, Agent","--target \u003Curl> [--scope all|headers|tls|cors|cookies|errors|limits|disclosure] [--benchmark cis|owasp] [--level L1|L2|L3]","medium",true,[],"main","952a630c6f38d193a349d86fa18db1de8843e837","src\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-fintech-pci\u002F.claude\u002Fskills\u002Fx-evaluate-hardening",1,"https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment","https:\u002F\u002Fgithub.com\u002Freview-bench","https:\u002F\u002Freview-bench.ai","An open benchmark for AI code review.","2026-10-27 06:56:37",{"source":8,"skillName":5,"commands":39,"prompt":49,"zipAvailable":27},[40,43,46],{"tool":41,"command":42},"npx","npx skills add review-bench\u002Federcnj_ia-dev-environment --skill x-evaluate-hardening",{"tool":44,"command":45},"bunx","bunx skills add review-bench\u002Federcnj_ia-dev-environment --skill x-evaluate-hardening",{"tool":47,"command":48},"pnpm","pnpm dlx skills add review-bench\u002Federcnj_ia-dev-environment --skill x-evaluate-hardening","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-fintech-pci\u002F.claude\u002Fskills\u002Fx-evaluate-hardening\u002FSKILL.md",[51],{"path":52,"resourceType":53,"resourceTypeDesc":54,"sizeBytes":55,"sourceHtmlUrl":56},"README.md","REFERENCE","参考文档",2285,"https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring-fintech-pci\u002F.claude\u002Fskills\u002Fx-evaluate-hardening\u002FREADME.md",[58,65,72,79,86,93],{"skillNo":59,"name":60,"nameZh":6,"description":61,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":62,"categories":63,"keywords":64,"publishedAt":19},"01M757M8J48TQ1Y3X25GSJBXAS","x-parallel-eval","Detects and classifies file-collision risks between work units (tasks, stories, or epic phases) before parallel execution. Reads ## File Footprint blocks produced by x-task-plan \u002F x-story-plan, applies the parallelism-heuristics knowledge pack (hard \u002F regen \u002F soft categories + hotspot overrides), and emits a collision matrix + serialization recommendation in Markdown (default) or JSON.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fx-parallel-eval\u002FSKILL.md",[],[],{"skillNo":66,"name":67,"nameZh":6,"description":68,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":69,"categories":70,"keywords":71,"publishedAt":19},"01M757M57XMR9546S69466HDWT","parallelism-heuristics","Canonical catalog of file-collision heuristics for parallel task, story, and epic execution. Defines the File Footprint block format, the three Conflict Categories (hard \u002F regen \u002F soft), a hotspot list of high-contention paths, and the degrade-with-warning policy. Consumed by x-task-plan, x-story-plan, x-epic-map, x-parallel-eval, and x-dev-*-implement.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fparallelism-heuristics\u002FSKILL.md",[],[],{"skillNo":73,"name":74,"nameZh":6,"description":75,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":76,"categories":77,"keywords":78,"publishedAt":19},"01M757M11SZ8P1VCQABT08QVYA","x-watch-pr-ci","Polls a PR's CI checks and Copilot review status, blocking until checks complete or timeout. Returns one of 8 stable exit codes (SUCCESS=0, CI_PENDING_PROCEED=10, CI_FAILED=20, TIMEOUT=30, PR_ALREADY_MERGED=40, NO_CI_CONFIGURED=50, PR_CLOSED=60, PR_NOT_FOUND=70). Writes a versioned state-file for session resume.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-watch-pr-ci\u002FSKILL.md",[],[],{"skillNo":80,"name":81,"nameZh":6,"description":82,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":83,"categories":84,"keywords":85,"publishedAt":19},"01M757KW53K8KFPGADFB4PH949","x-validate-docs","Documentation freshness gate: validates 6 dimensions (readme, api-specs, grpc-proto, adr, skill-docs, system-architecture) against code changes in a PR. Stack-aware — only validates targets declared\u002Fauto-detected from ProjectConfig.documentation.targets. Returns exit non-zero on staleness; produces structured report.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-validate-docs\u002FSKILL.md",[],[],{"skillNo":87,"name":88,"nameZh":6,"description":89,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":90,"categories":91,"keywords":92,"publishedAt":19},"01M757KQZHSA10MKC0CR571D60","x-update-system-architecture","Incrementally updates docs\u002Farchitecture\u002Fsystem.md after an epic completes. Appends new entries to the Decision Log (§11) using x-internal-write-report --append (dedup by ## ID: marker) and surgically inserts component\u002Fintegration changes into sections 1-10 via Edit. Idempotent: re-running with the same epic produces a byte-identical system.md.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-update-system-architecture\u002FSKILL.md",[],[],{"skillNo":94,"name":95,"nameZh":6,"description":96,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":97,"categories":98,"keywords":99,"publishedAt":19},"01M757KKBT5Q1SVF8DMJBVF46M","x-update-architecture","Incrementally updates the service architecture document with changes from architecture plans. Adds new components, integrations, flows, and ADR references without rewriting existing content. Use after implementation to keep architecture documentation current.","https:\u002F\u002Fgithub.com\u002Freview-bench\u002Federcnj_ia-dev-environment\u002Fblob\u002Fmain\u002Fsrc\u002Ftest\u002Fresources\u002Fgolden\u002Fjava-spring\u002Fplatform-claude-code\u002F.claude\u002Fskills\u002Fx-update-architecture\u002FSKILL.md",[],[]]