Production hardening: security fixes, code quality, 724 skills complete

- Fix 25 shell=True subprocess calls with list-based commands
- Fix 49 verify=False in defensive skills (env-var override)
- Add timeout to 231 HTTP/subprocess/socket calls
- Fix 6 SQL injection patterns with whitelist validation
- Replace 8 __import__() with standard imports
- Remove 701 unused imports across 442 files
- Add authorized-testing disclaimers to all offensive skills
- Complete 11 incomplete skill directories
- Expand 10 stub SKILL.md files with full content
- Fix 2 YAML parse errors in frontmatter
- Fix 5 pre-existing syntax errors
- Convert 22 hardcoded paths/ports to environment variables
- Back up 21 redundant skill pairs to .bak
- Fix 2 global declaration errors
- 724/724 skills with full folder anatomy (SKILL.md + agent.py + api-reference.md + LICENSE)
- 0 compile errors across all 724 agent.py files

skills/auditing-kubernetes-rbac-permissions.bak/references/api-reference.md

@@ -0,0 +1,55 @@
+# API Reference: Kubernetes RBAC Audit
+
+## Python Kubernetes Client
+```python
+from kubernetes import client, config
+config.load_kube_config()
+rbac = client.RbacAuthorizationV1Api()
+core = client.CoreV1Api()
+```
+
+## RBAC API Calls
+| Method | Description |
+|--------|-------------|
+| `rbac.list_cluster_role()` | List all ClusterRoles |
+| `rbac.list_cluster_role_binding()` | List all ClusterRoleBindings |
+| `rbac.list_namespaced_role(ns)` | List Roles in namespace |
+| `rbac.list_namespaced_role_binding(ns)` | List RoleBindings in namespace |
+
+## ClusterRole Rule Structure
+```python
+role.rules[0].verbs       # ["get", "list", "watch"]
+role.rules[0].resources   # ["pods", "secrets"]
+role.rules[0].api_groups  # ["", "apps"]
+```
+
+## Dangerous RBAC Permissions
+| Permission | Risk |
+|------------|------|
+| `* / *` (all verbs, resources) | Full cluster admin |
+| `create` on `pods/exec` | Remote code execution |
+| `get` on `secrets` | Credential theft |
+| `bind` on `clusterroles` | Privilege escalation |
+| `impersonate` on users | Identity spoofing |
+| `escalate` on roles | Self-privilege escalation |
+
+## Subject Types
+| Kind | Description |
+|------|-------------|
+| User | Human user identity |
+| Group | User group (e.g., system:authenticated) |
+| ServiceAccount | Pod identity |
+
+## Risky Groups
+| Group | Risk |
+|-------|------|
+| `system:unauthenticated` | Anonymous access |
+| `system:authenticated` | Any authenticated user |
+| `system:masters` | Full cluster admin |
+
+## kubectl RBAC Commands
+```bash
+kubectl auth can-i --list
+kubectl get clusterrolebindings -o json
+kubectl auth can-i create pods --as=system:serviceaccount:default:default
+```

skills/auditing-kubernetes-rbac-permissions.bak/references/standards.md

@@ -0,0 +1,34 @@
+# Standards Reference - RBAC Auditing
+
+## CIS Kubernetes Benchmark v1.8 - Section 5.1
+
+- 5.1.1: Ensure cluster-admin role is only used where required
+- 5.1.2: Minimize access to secrets
+- 5.1.3: Minimize wildcard use in Roles and ClusterRoles
+- 5.1.4: Minimize access to create pods
+- 5.1.5: Ensure default service accounts are not actively used
+- 5.1.6: Ensure Service Account Tokens are not mounted when not needed
+- 5.1.7: Avoid use of system:masters group
+- 5.1.8: Limit use of the Bind, Impersonate and Escalate permissions
+
+## NIST SP 800-53 AC Controls
+- AC-2: Account Management
+- AC-3: Access Enforcement
+- AC-6: Least Privilege
+- AC-6(1): Authorize Access to Security Functions
+- AC-6(5): Privileged Accounts
+
+## Dangerous RBAC Combinations
+
+| Verbs | Resources | Risk Level |
+|-------|-----------|-----------|
+| * | * | CRITICAL - cluster-admin equivalent |
+| create | pods | HIGH - can deploy privileged pods |
+| create | pods/exec | HIGH - can exec into any pod |
+| get, list | secrets | HIGH - can read all secrets |
+| create | clusterrolebindings | CRITICAL - privilege escalation |
+| impersonate | users, groups, serviceaccounts | CRITICAL - identity theft |
+| escalate | roles, clusterroles | CRITICAL - RBAC escalation |
+| bind | roles, clusterroles | HIGH - can create bindings |
+| create | deployments | MEDIUM - can deploy workloads |
+| delete | pods, nodes | HIGH - denial of service |

skills/auditing-kubernetes-rbac-permissions.bak/references/workflows.md

@@ -0,0 +1,60 @@
+# Workflows - RBAC Auditing
+
+## Workflow 1: Comprehensive RBAC Audit
+
+```
+[Export all RBAC] --> [Identify cluster-admin bindings] --> [Check wildcard permissions]
+       |                       |                                    |
+       v                       v                                    v
+  kubectl get all      Flag non-system                    Flag * verbs, * resources
+  RBAC resources       cluster-admin users                Find excessive permissions
+       |                       |                                    |
+       +----------+------------+------------------------------------+
+                  |
+                  v
+       [Check service account permissions]
+                  |
+                  v
+       [Identify privilege escalation paths]
+                  |
+                  v
+       [Generate remediation report]
+```
+
+## Workflow 2: Least Privilege Implementation
+
+```
+Step 1: Inventory current permissions per team/service
+Step 2: Document actual required operations
+Step 3: Create minimal Role/ClusterRole
+Step 4: Test with auth can-i dry-run
+Step 5: Apply new bindings
+Step 6: Remove overly permissive bindings
+Step 7: Validate with automated audit
+```
+
+## Workflow 3: Continuous RBAC Monitoring
+
+```yaml
+# CronJob for weekly RBAC audit
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: rbac-audit
+spec:
+  schedule: "0 2 * * 1"  # Weekly Monday 2am
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+          - name: audit
+            image: bitnami/kubectl:latest
+            command:
+            - /bin/sh
+            - -c
+            - |
+              kubectl get clusterrolebindings -o json | jq '.items[] | select(.roleRef.name=="cluster-admin") | .metadata.name' > /audit/cluster-admin-bindings.txt
+              kubectl get clusterroles -o json | jq '.items[] | select(.rules[]? | (.verbs | index("*")) and (.resources | index("*"))) | .metadata.name' > /audit/wildcard-roles.txt
+          restartPolicy: Never
+```