aibot88 Fireworks Security — Enterprise Security Superbrain
Purpose
This skill consolidates ALL security knowledge into a single reference brain. It replaces the need to invoke separate security-scanner, security-reviewer, security-hardener, and encryption agents. One skill, total coverage.
Activate this skill whenever:
- Scanning code for vulnerabilities
- Hardening an Electron app
- Reviewing IPC channels or preload scripts
- Implementing or auditing encryption
- Running dependency audits
- Preparing for a security review or compliance check
1. Security Scan Protocol — 5-Phase Pipeline
Phase 1: Target Identification
- Identify the project type (Electron, Node.js CLI, web app, library).
- List all entry points: main process, renderer processes, preload scripts, IPC channels, HTTP endpoints.
- Map the trust boundary: what runs with Node.js privileges vs. sandboxed renderer.
- Identify all external inputs: user input fields, file uploads, URL parameters, IPC messages, environment variables.
Phase 2: CWE Top 25 Scan
- For each CWE in the quick-reference table below, run the detection pattern against the codebase.
- Log every match with file path, line number, and severity.
- Cross-reference with
references/cwe-detection.mdfor Electron-specific variants. - Classify findings: CRITICAL (blocks release), HIGH (must fix before merge), MEDIUM (fix in next sprint).
Phase 3: STRIDE Threat Modeling
- For each STRIDE category, answer the guiding question against the project architecture.
- Document threats discovered with likelihood (HIGH/MEDIUM/LOW) and impact (HIGH/MEDIUM/LOW).
- Map each threat to a mitigation strategy.
Phase 4: Auto-Fix Suggestions
- For each finding from Phase 2, generate a concrete code fix.
- Fixes must be minimal — change only what is necessary.
- Each fix must include a before/after code snippet.
- Never introduce new dependencies without explicit user approval.
Phase 5: Security Report
- Generate the report using the format in Section 7.
- Summary statistics: total findings by severity.
- Include verification commands the user can run to confirm fixes.
2. CWE Top 25 Quick-Reference
| CWE ID | Vulnerability | Detection Pattern | Severity |
|---|---|---|---|
| CWE-787 | Out-of-bounds Write | Buffer operations without bounds checking, Buffer.alloc misuse |
CRITICAL |
| CWE-79 | Cross-site Scripting (XSS) | innerHTML, dangerouslySetInnerHTML, document.write, v-html, {@html} |
CRITICAL |
| CWE-89 | SQL Injection | String concatenation in SQL queries, template literals in .run(), .exec(), .all() |
CRITICAL |
| CWE-416 | Use After Free | Manual memory management in native addons, double .destroy() calls |
CRITICAL |
| CWE-78 | OS Command Injection | child_process.exec() with user input, shell: true in spawn options |
CRITICAL |
| CWE-20 | Improper Input Validation | Missing Zod/Joi schemas on IPC handlers, unvalidated function arguments | HIGH |
| CWE-125 | Out-of-bounds Read | Array access without length check, Buffer.read beyond size | HIGH |
| CWE-22 | Path Traversal | path.join with user input not validated against base directory, ../ in paths |
HIGH |
| CWE-352 | Cross-Site Request Forgery | Missing CSRF tokens on mutation endpoints (less relevant for desktop, still check webview) | HIGH |
| CWE-434 | Unrestricted Upload | File dialog without extension filtering, no MIME type validation | HIGH |
| CWE-862 | Missing Authorization | IPC handlers without permission checks, no role-based access on channels | HIGH |
| CWE-476 | NULL Pointer Dereference | Optional chaining missing on potentially null DB results, unchecked .get() |
MEDIUM |
| CWE-287 | Improper Authentication | Hardcoded credentials, plaintext password storage, missing bcrypt/argon2 | CRITICAL |
| CWE-190 | Integer Overflow | Large number arithmetic without BigInt, unchecked parseInt results | MEDIUM |
| CWE-502 | Deserialization of Untrusted Data | JSON.parse on external input without schema validation, eval() |
CRITICAL |
| CWE-77 | Command Injection | Template strings in exec/spawn commands, unsanitized shell arguments | CRITICAL |
| CWE-119 | Buffer Overflow | Native addon buffer operations, Buffer.allocUnsafe without fill |
HIGH |
| CWE-798 | Hardcoded Credentials | API keys in source, passwords in config files, tokens in constants | CRITICAL |
| CWE-918 | Server-Side Request Forgery | fetch/axios with user-controlled URLs, no allowlist validation |
HIGH |
| CWE-306 | Missing Authentication | Endpoints/IPC channels without any auth check | HIGH |
| CWE-362 | Race Condition | Shared state mutation without locks, TOCTOU in file operations | MEDIUM |
| CWE-269 | Improper Privilege Management | nodeIntegration: true, missing sandbox, elevated permissions |
CRITICAL |
| CWE-94 | Code Injection | eval(), new Function(), vm.runInNewContext with user input |
CRITICAL |
| CWE-863 | Incorrect Authorization | Role checks with wrong operator, bypassed permission middleware | HIGH |
| CWE-276 | Incorrect Default Permissions | World-writable files, overly permissive file modes on config/data | MEDIUM |
See references/cwe-detection.md for complete detection patterns and fix templates.
3. STRIDE Threat Model
| Category | Guiding Question | Desktop App Examples |
|---|---|---|
| Spoofing | Can an attacker pretend to be someone/something else? | Fake IPC messages between renderer and main, spoofed auto-update server, modified preload script |
| Tampering | Can an attacker modify data they should not? | Modify SQLite database file on disk, tamper with ASAR archive, alter localStorage, MITM update downloads |
| Repudiation | Can an attacker deny performing an action? | No audit log for destructive operations, missing transaction history, no action timestamps |
| Information Disclosure | Can an attacker access data they should not? | Credentials in plaintext config, sensitive data in renderer console, unencrypted database, verbose error messages exposing internals |
| Denial of Service | Can an attacker crash or slow the app? | Infinite loop in IPC handler, massive file upload crashing renderer, uncaught promise rejection crashing main process |
| Elevation of Privilege | Can an attacker gain higher access? | Renderer escaping sandbox via nodeIntegration, IPC channel granting filesystem access without auth, prototype pollution |
Full Reference
For complete patterns, examples, and advanced usage, see references/full-guide.md.
Read that file when you need deeper context than the summary above.