Kali Security Remediation Skills

This repository contains Codex skills and security documentation scaffolding for analyzing and remediating penetration test findings in a legacy .NET Framework application.

The intended application profile is:

• WPF client
• WCF/RPC communication
• application-server business logic
• custom ORM over MS SQL
• configuration through app.config, web.config, service hosting, IIS, or Windows Service deployment

Main Prompt

The primary remediation prompt is:

• docs/security/CODEX_SECURITY_REMEDIATION_PROMPT.md

Use it as the task brief for the first analysis-only pass. The first pass should create remediation documentation before any production code is changed.

Skills

The local skills are stored in skills/:

• security-remediation-triage - map pentest findings into a prioritized remediation plan.
• legacy-dotnet-wcf-security - review WPF/WCF security configuration and trust boundaries.
• server-side-authorization-review - verify sensitive operations are authorized on the server.
• sql-orm-injection-review - audit custom ORM and SQL construction for injection risk.
• secrets-config-audit - find hardcoded secrets and unsafe configuration.
• security-regression-test-design - design focused security regression tests.
• security-adr-documentation - document security decisions as ADRs.
• focused-secure-code-fix - implement small, testable security fixes after planning.

Recommended Workflow

1. Run the analysis-only phase with security-remediation-triage.
2. Use the domain skills to inspect WCF, authorization, SQL/ORM, secrets, and configuration.
3. Create or update:
   • docs/security/security-remediation-plan.md
   • docs/security/security-findings-map.csv
   • docs/security/security-regression-tests.md
   • docs/security/security-adr.md
4. Review the plan before changing production code.
5. Implement fixes in small batches with focused-secure-code-fix, starting with P0 findings.

Safety Rules

• Do not treat the WPF client as a trusted security boundary.
• Enforce authentication, authorization, validation, and business rules on the server.
• Do not add secrets to the repository.
• Do not fix security by disabling checks or suppressing warnings.
• Keep each fix small, reviewable, and tied to a specific finding.
• Add automated tests where practical, or document precise manual verification steps.

Validation

Each skill should pass the skill creator validator:

python C:\Users\vitas\.codex\skills\.system\skill-creator\scripts\quick_validate.py .\skills\<skill-name>

All currently created skills were validated successfully when added.