0xkobold 0.5.0 → 0.5.2

package/skills/kobold-scan-skill/package-lock.json

@@ -0,0 +1,188 @@
+{
+  "name": "kobold-scan",
+  "version": "1.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "kobold-scan",
+      "version": "1.0.0",
+      "license": "MIT",
+      "dependencies": {
+        "chalk": "^4.1.2",
+        "commander": "^9.4.1",
+        "glob": "^8.1.0"
+      },
+      "bin": {
+        "kobold-scan": "index.js"
+      },
+      "engines": {
+        "node": ">=14.0.0"
+      }
+    },
+    "node_modules/ansi-styles": {
+      "version": "4.3.0",
+      "resolved": "https://registry.npmjs.org/ansi-styles/-/ansi-styles-4.3.0.tgz",
+      "integrity": "sha512-zbB9rCJAT1rbjiVDb2hqKFHNYLxgtk8NURxZ3IZwD3F6NtxbXZQCnnSi1Lkx+IDohdPlFp222wVALIheZJQSEg==",
+      "license": "MIT",
+      "dependencies": {
+        "color-convert": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=8"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/ansi-styles?sponsor=1"
+      }
+    },
+    "node_modules/balanced-match": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
+      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "license": "MIT"
+    },
+    "node_modules/brace-expansion": {
+      "version": "2.0.2",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.0.2.tgz",
+      "integrity": "sha512-Jt0vHyM+jmUBqojB7E1NIYadt0vI0Qxjxd2TErW94wDz+E2LAm5vKMXXwg6ZZBTHPuUlDgQHKXvjGBdfcF1ZDQ==",
+      "license": "MIT",
+      "dependencies": {
+        "balanced-match": "^1.0.0"
+      }
+    },
+    "node_modules/chalk": {
+      "version": "4.1.2",
+      "resolved": "https://registry.npmjs.org/chalk/-/chalk-4.1.2.tgz",
+      "integrity": "sha512-oKnbhFyRIXpUuez8iBMmyEa4nbj4IOQyuhc/wy9kY7/WVPcwIO9VA668Pu8RkO7+0G76SLROeyw9CpQ061i4mA==",
+      "license": "MIT",
+      "dependencies": {
+        "ansi-styles": "^4.1.0",
+        "supports-color": "^7.1.0"
+      },
+      "engines": {
+        "node": ">=10"
+      },
+      "funding": {
+        "url": "https://github.com/chalk/chalk?sponsor=1"
+      }
+    },
+    "node_modules/color-convert": {
+      "version": "2.0.1",
+      "resolved": "https://registry.npmjs.org/color-convert/-/color-convert-2.0.1.tgz",
+      "integrity": "sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==",
+      "license": "MIT",
+      "dependencies": {
+        "color-name": "~1.1.4"
+      },
+      "engines": {
+        "node": ">=7.0.0"
+      }
+    },
+    "node_modules/color-name": {
+      "version": "1.1.4",
+      "resolved": "https://registry.npmjs.org/color-name/-/color-name-1.1.4.tgz",
+      "integrity": "sha512-dOy+3AuW3a2wNbZHIuMZpTcgjGuLU/uBL/ubcZF9OXbDo8ff4O8yVp5Bf0efS8uEoYo5q4Fx7dY9OgQGXgAsQA==",
+      "license": "MIT"
+    },
+    "node_modules/commander": {
+      "version": "9.5.0",
+      "resolved": "https://registry.npmjs.org/commander/-/commander-9.5.0.tgz",
+      "integrity": "sha512-KRs7WVDKg86PWiuAqhDrAQnTXZKraVcCc6vFdL14qrZ/DcWwuRo7VoiYXalXO7S5GKpqYiVEwCbgFDfxNHKJBQ==",
+      "license": "MIT",
+      "engines": {
+        "node": "^12.20.0 || >=14"
+      }
+    },
+    "node_modules/fs.realpath": {
+      "version": "1.0.0",
+      "resolved": "https://registry.npmjs.org/fs.realpath/-/fs.realpath-1.0.0.tgz",
+      "integrity": "sha512-OO0pH2lK6a0hZnAdau5ItzHPI6pUlvI7jMVnxUQRtw4owF2wk8lOSabtGDCTP4Ggrg2MbGnWO9X8K1t4+fGMDw==",
+      "license": "ISC"
+    },
+    "node_modules/glob": {
+      "version": "8.1.0",
+      "resolved": "https://registry.npmjs.org/glob/-/glob-8.1.0.tgz",
+      "integrity": "sha512-r8hpEjiQEYlF2QU0df3dS+nxxSIreXQS1qRhMJM0Q5NDdR386C7jb7Hwwod8Fgiuex+k0GFjgft18yvxm5XoCQ==",
+      "deprecated": "Old versions of glob are not supported, and contain widely publicized security vulnerabilities, which have been fixed in the current version. Please update. Support for old versions may be purchased (at exorbitant rates) by contacting i@izs.me",
+      "license": "ISC",
+      "dependencies": {
+        "fs.realpath": "^1.0.0",
+        "inflight": "^1.0.4",
+        "inherits": "2",
+        "minimatch": "^5.0.1",
+        "once": "^1.3.0"
+      },
+      "engines": {
+        "node": ">=12"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
+    "node_modules/has-flag": {
+      "version": "4.0.0",
+      "resolved": "https://registry.npmjs.org/has-flag/-/has-flag-4.0.0.tgz",
+      "integrity": "sha512-EykJT/Q1KjTWctppgIAgfSO0tKVuZUjhgMr17kqTumMl6Afv3EISleU7qZUzoXDFTAHTDC4NOoG/ZxU3EvlMPQ==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/inflight": {
+      "version": "1.0.6",
+      "resolved": "https://registry.npmjs.org/inflight/-/inflight-1.0.6.tgz",
+      "integrity": "sha512-k92I/b08q4wvFscXCLvqfsHCrjrF7yiXsQuIVvVE7N82W3+aqpzuUdBbfhWcy/FZR3/4IgflMgKLOsvPDrGCJA==",
+      "deprecated": "This module is not supported, and leaks memory. Do not use it. Check out lru-cache if you want a good and tested way to coalesce async requests by a key value, which is much more comprehensive and powerful.",
+      "license": "ISC",
+      "dependencies": {
+        "once": "^1.3.0",
+        "wrappy": "1"
+      }
+    },
+    "node_modules/inherits": {
+      "version": "2.0.4",
+      "resolved": "https://registry.npmjs.org/inherits/-/inherits-2.0.4.tgz",
+      "integrity": "sha512-k/vGaX4/Yla3WzyMCvTQOXYeIHvqOKtnqBduzTHpzpQZzAskKMhZ2K+EnBiSM9zGSoIFeMpXKxa4dYeZIQqewQ==",
+      "license": "ISC"
+    },
+    "node_modules/minimatch": {
+      "version": "5.1.6",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-5.1.6.tgz",
+      "integrity": "sha512-lKwV/1brpG6mBUFHtb7NUmtABCb2WZZmm2wNiOA5hAb8VdCS4B3dtMWyvcoViccwAW/COERjXLt0zP1zXUN26g==",
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.1"
+      },
+      "engines": {
+        "node": ">=10"
+      }
+    },
+    "node_modules/once": {
+      "version": "1.4.0",
+      "resolved": "https://registry.npmjs.org/once/-/once-1.4.0.tgz",
+      "integrity": "sha512-lNaJgI+2Q5URQBkccEKHTQOPaXdUxnZZElQTZY0MFUAuaEqe1E+Nyvgdz/aIyNi6Z9MzO5dv1H8n58/GELp3+w==",
+      "license": "ISC",
+      "dependencies": {
+        "wrappy": "1"
+      }
+    },
+    "node_modules/supports-color": {
+      "version": "7.2.0",
+      "resolved": "https://registry.npmjs.org/supports-color/-/supports-color-7.2.0.tgz",
+      "integrity": "sha512-qpCAvRl9stuOHveKsn7HncJRvv501qIacKzQlO/+Lwxc9+0q2wLyv4Dfvt80/DPn2pqOBsJdDiogXGR9+OvwRw==",
+      "license": "MIT",
+      "dependencies": {
+        "has-flag": "^4.0.0"
+      },
+      "engines": {
+        "node": ">=8"
+      }
+    },
+    "node_modules/wrappy": {
+      "version": "1.0.2",
+      "resolved": "https://registry.npmjs.org/wrappy/-/wrappy-1.0.2.tgz",
+      "integrity": "sha512-l4Sp/DRseor9wL6EvV2+TuQn63dMkPjZ/sp9XkghTEbV9KlPS1xUsZ3u7/IQO4wxtcFB4bgpQPRcR3QCvezPcQ==",
+      "license": "ISC"
+    }
+  }
+}

package/skills/kobold-scan-skill/package.json

@@ -0,0 +1,34 @@
+{
+  "name": "kobold-scan",
+  "version": "1.0.0",
+  "description": "Security vulnerability scanner and code review tool for the KOBOLDS ecosystem",
+  "main": "index.js",
+  "bin": {
+    "kobold-scan": "./index.js"
+  },
+  "scripts": {
+    "test": "echo \"Error: no test specified\" && exit 1"
+  },
+  "keywords": [
+    "security",
+    "scanner",
+    "vulnerability",
+    "solidity",
+    "smart-contracts",
+    "kobolds"
+  ],
+  "author": "Shalom Assistant",
+  "license": "MIT",
+  "dependencies": {
+    "chalk": "^4.1.2",
+    "glob": "^8.1.0",
+    "commander": "^9.4.1"
+  },
+  "engines": {
+    "node": ">=14.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/MoikasLabs/kobold-scan"
+  }
+}

package/skills/kobold-scan-skill/rules/general.json

@@ -0,0 +1,30 @@
+[
+  {
+    "id": "GEN-001",
+    "name": "TODO/FIXME Markers",
+    "severity": "low",
+    "description": "Technical debt markers in code",
+    "remediation": "Resolve or track in issue tracker"
+  },
+  {
+    "id": "GEN-002",
+    "name": "Magic Numbers",
+    "severity": "low",
+    "description": "Numeric literals without context",
+    "remediation": "Extract to named constants"
+  },
+  {
+    "id": "GEN-003",
+    "name": "Deep Nesting",
+    "severity": "medium",
+    "description": "Code blocks nested 4+ levels deep",
+    "remediation": "Extract to functions, early returns"
+  },
+  {
+    "id": "GEN-008",
+    "name": "World-Writable Permissions",
+    "severity": "high",
+    "description": "chmod 777 or equivalent - security risk",
+    "remediation": "Use least-privilege permissions (755 or less)"
+  }
+]

package/skills/kobold-scan-skill/rules/javascript.json

@@ -0,0 +1,44 @@
+[
+  {
+    "id": "JS-001",
+    "name": "eval() Usage",
+    "severity": "critical",
+    "description": "Dangerous eval() allows arbitrary code execution",
+    "remediation": "Use JSON.parse for data, avoid dynamic code execution"
+  },
+  {
+    "id": "JS-002",
+    "name": "Hardcoded Secrets",
+    "severity": "critical",
+    "description": "API keys, passwords, or tokens hardcoded in source",
+    "remediation": "Use environment variables or secure vaults"
+  },
+  {
+    "id": "JS-004",
+    "name": "SQL Injection",
+    "severity": "high",
+    "description": "String concatenation in SQL queries allows injection",
+    "remediation": "Use parameterized queries/prepared statements"
+  },
+  {
+    "id": "JS-005",
+    "name": "Path Traversal",
+    "severity": "high",
+    "description": "User input used directly in file paths",
+    "remediation": "Sanitize/validate paths, use path.normalize()"
+  },
+  {
+    "id": "JS-006",
+    "name": "Prototype Pollution",
+    "severity": "high",
+    "description": "Modifying Object.prototype allows property injection",
+    "remediation": "Use Object.freeze(), validate input keys"
+  },
+  {
+    "id": "JS-007",
+    "name": "console.log in Production",
+    "severity": "low",
+    "description": "Debug logging statements left in production code",
+    "remediation": "Remove or use proper logging library with levels"
+  }
+]

package/skills/kobold-scan-skill/rules/solidity.json

@@ -0,0 +1,30 @@
+[
+  {
+    "id": "SOL-001",
+    "name": "Reentrancy",
+    "severity": "critical",
+    "description": "External call before state update - reentrancy vulnerability",
+    "remediation": "Update state before external calls, or use ReentrancyGuard"
+  },
+  {
+    "id": "SOL-003",
+    "name": "Integer Overflow",
+    "severity": "high",
+    "description": "Potential integer overflow/underflow in arithmetic operations",
+    "remediation": "Use Solidity 0.8+ or SafeMath library"
+  },
+  {
+    "id": "SOL-004",
+    "name": "tx.origin Authentication",
+    "severity": "critical",
+    "description": "Using tx.origin for authentication allows phishing attacks",
+    "remediation": "Use msg.sender instead of tx.origin"
+  },
+  {
+    "id": "SOL-006",
+    "name": "Delegatecall Injection",
+    "severity": "critical",
+    "description": "Delegatecall to user-controlled address - proxy pattern risk",
+    "remediation": "Validate implementation addresses before delegatecall"
+  }
+]

package/skills/kobold-scan-skill/src/formatters/json.js

@@ -0,0 +1,7 @@
+class JSONFormatter {
+  static format(results) {
+    return JSON.stringify(results, null, 2);
+  }
+}
+
+module.exports = JSONFormatter;

package/skills/kobold-scan-skill/src/formatters/terminal.js

@@ -0,0 +1,66 @@
+const chalk = require('chalk');
+
+class TerminalFormatter {
+  static format(results) {
+    let output = '\n';
+    output += chalk.bold.cyan('╔════════════════════════════════════════════════════════╗\n');
+    output += chalk.bold.cyan('║              🔍 KOBOLD-SCAN RESULTS                    ║\n');
+    output += chalk.bold.cyan('╚════════════════════════════════════════════════════════╝\n\n');
+
+    if (results.vulnerabilities.length === 0) {
+      output += chalk.green.bold('✅ No vulnerabilities found!\n');
+      return output;
+    }
+
+    // Group by severity
+    const bySeverity = {
+      critical: [],
+      high: [],
+      medium: [],
+      low: []
+    };
+
+    results.vulnerabilities.forEach(v => {
+      if (bySeverity[v.severity]) {
+        bySeverity[v.severity].push(v);
+      }
+    });
+
+    const severityConfig = {
+      critical: { label: 'CRITICAL', color: chalk.bgRed.white, icon: '💀' },
+      high: { label: 'HIGH', color: chalk.red, icon: '⚠️' },
+      medium: { label: 'MEDIUM', color: chalk.yellow, icon: '⚡' },
+      low: { label: 'LOW', color: chalk.gray, icon: 'ℹ️' }
+    };
+
+    Object.entries(bySeverity).forEach(([severity, issues]) => {
+      if (issues.length === 0) return;
+
+      const cfg = severityConfig[severity];
+      output += cfg.color.bold(` ${cfg.icon} ${cfg.label} (${issues.length}) `) + '\n';
+      output += chalk.gray('─'.repeat(60)) + '\n';
+
+      issues.forEach(issue => {
+        output += `  ${chalk.bold(issue.rule)}: ${issue.message}\n`;
+        output += `  ${chalk.gray(`at ${issue.file}:${issue.line}`)}\n`;
+        if (issue.code) {
+          output += `  ${chalk.cyan('>')} ${issue.code}\n`;
+        }
+        output += '\n';
+      });
+    });
+
+    // Summary
+    output += '\n' + chalk.bold('📊 Summary:\n');
+    output += `  Files scanned: ${results.filesScanned || 0}\n`;
+    output += `  Total issues: ${results.vulnerabilities.length}\n`;
+    output += `    Critical: ${bySeverity.critical.length}\n`;
+    output += `    High: ${bySeverity.high.length}\n`;
+    output += `    Medium: ${bySeverity.medium.length}\n`;
+    output += `    Low: ${bySeverity.low.length}\n`;
+
+    return output;
+  }
+}
+
+module.exports = TerminalFormatter;

package/skills/kobold-scan-skill/src/scanner-engine.js

@@ -0,0 +1,139 @@
+const fs = require('fs');
+const path = require('path');
+
+const SolidityScanner = require('./scanners/solidity');
+const JavaScriptScanner = require('./scanners/javascript');
+const GeneralScanner = require('./scanners/general');
+
+class ScannerEngine {
+  constructor(config) {
+    this.config = config;
+    this.scanners = {
+      '.sol': new SolidityScanner(config),
+      '.js': new JavaScriptScanner(config),
+      '.ts': new JavaScriptScanner(config),
+      '.jsx': new JavaScriptScanner(config),
+      '.tsx': new JavaScriptScanner(config),
+      'general': new GeneralScanner(config)
+    };
+    this.supportedExts = new Set(['.sol', '.js', '.ts', '.jsx', '.tsx']);
+  }
+
+  async scan(targetPath) {
+    const vulnerabilities = [];
+    let filesScanned = 0;
+
+    // Resolve to absolute path
+    const resolvedPath = path.resolve(targetPath);
+    
+    // Determine if path is file or directory
+    const stats = fs.statSync(resolvedPath);
+    
+    if (stats.isFile()) {
+      const result = await this.scanFile(resolvedPath);
+      if (result.length > 0) {
+        vulnerabilities.push(...result);
+      }
+      filesScanned = 1;
+    } else {
+      // Recursively find files
+      const files = this.findFiles(resolvedPath);
+
+      for (const file of files) {
+        const result = await this.scanFile(file);
+        if (result.length > 0) {
+          vulnerabilities.push(...result);
+        }
+        filesScanned++;
+      }
+    }
+
+    return {
+      vulnerabilities,
+      filesScanned,
+      timestamp: new Date().toISOString(),
+      config: this.config
+    };
+  }
+
+  shouldIgnore(fullPath) {
+    const basename = path.basename(fullPath);
+    
+    return this.config.exclude.some(pattern => {
+      // Simple pattern matching
+      if (pattern.includes('node_modules')) {
+        return fullPath.includes('node_modules');
+      }
+      if (pattern.includes('.git')) {
+        return fullPath.includes('.git');
+      }
+      if (pattern.includes('build')) {
+        return basename === 'build' || fullPath.includes('/build/');
+      }
+      if (pattern.includes('dist')) {
+        return basename === 'dist' || fullPath.includes('/dist/');
+      }
+      return false;
+    });
+  }
+
+  findFiles(dir) {
+    const files = [];
+    
+    const traverse = (currentDir) => {
+      try {
+        const entries = fs.readdirSync(currentDir, { withFileTypes: true });
+        
+        for (const entry of entries) {
+          const fullPath = path.join(currentDir, entry.name);
+          
+          if (this.shouldIgnore(fullPath)) {
+            continue;
+          }
+          
+          if (entry.isDirectory()) {
+            traverse(fullPath);
+          } else if (entry.isFile()) {
+            const ext = path.extname(entry.name).toLowerCase();
+            if (this.supportedExts.has(ext)) {
+              files.push(fullPath);
+            }
+          }
+        }
+      } catch (err) {
+        // Ignore permission errors
+      }
+    };
+    
+    traverse(dir);
+    return files;
+  }
+
+  async scanFile(filePath) {
+    const ext = path.extname(filePath).toLowerCase();
+    let content;
+    
+    try {
+      content = fs.readFileSync(filePath, 'utf8');
+    } catch (err) {
+      return []; // Skip files we can't read
+    }
+    
+    const vulnerabilities = [];
+
+    // Run language-specific scanner
+    const scanner = this.scanners[ext];
+    if (scanner) {
+      const results = scanner.scan(content, filePath);
+      vulnerabilities.push(...results);
+    }
+
+    // Always run general scanner
+    const generalResults = this.scanners.general.scan(content, filePath);
+    vulnerabilities.push(...generalResults);
+
+    return vulnerabilities;
+  }
+}
+
+module.exports = ScannerEngine;

package/skills/kobold-scan-skill/src/scanners/general.js

@@ -0,0 +1,83 @@
+class GeneralScanner {
+  constructor(config) {
+    this.config = config;
+  }
+
+  scan(content, filePath) {
+    const vulnerabilities = [];
+    const lines = content.split('\n');
+
+    // GEN-001: TODO/FIXME comments
+    const todoPattern = /\/\/.*TODO|\/\/.*FIXME|\/\/.*HACK|\/\*.*TODO|\/\*.*FIXME/;
+    
+    // GEN-002: Magic numbers (not perfect, catches common cases)
+    const magicNumberPattern = /[^\w](\d{3,})(?!\d*['"])[^\w]/;
+    
+    // GEN-003: Deep nesting (4+ levels of indentation)
+    const deepNestingPattern = /^\s{16,}/;
+    
+    // GEN-008: World-writable permissions
+    const chmodPattern = /chmod\s+777|chmod\s+a\+rw|chmod\s+o\+w/;
+
+    let consecutiveEmpty = 0;
+
+    lines.forEach((line, index) => {
+      // Check TODO/FIXME
+      if (todoPattern.test(line)) {
+        vulnerabilities.push({
+          rule: 'GEN-001',
+          severity: 'low',
+          message: 'Technical debt marker (TODO/FIXME/HACK)',
+          file: filePath,
+          line: index + 1,
+          code: line.trim()
+        });
+      }
+
+      // Check magic numbers
+      if (magicNumberPattern.test(line)) {
+        const match = line.match(magicNumberPattern);
+        const num = match ? match[1] : '';
+        // Exclude common non-magic numbers
+        if (!['100', '200', '404', '500', '1000', '1024', '2000', '3000', '4000', '5000', '8000', '8080', '443', '80'].includes(num)) {
+          vulnerabilities.push({
+            rule: 'GEN-002',
+            severity: 'low',
+            message: `Magic number detected: ${num} (consider named constant)`,
+            file: filePath,
+            line: index + 1,
+            code: line.trim()
+          });
+        }
+      }
+
+      // Check deep nesting
+      if (deepNestingPattern.test(line)) {
+        vulnerabilities.push({
+          rule: 'GEN-003',
+          severity: 'medium',
+          message: 'Deep nesting detected (>4 levels) - consider refactoring',
+          file: filePath,
+          line: index + 1,
+          code: line.trim().substring(0, 50) + '...'
+        });
+      }
+
+      // Check world-writable permissions
+      if (chmodPattern.test(line)) {
+        vulnerabilities.push({
+          rule: 'GEN-008',
+          severity: 'high',
+          message: 'World-writable file permissions - security risk',
+          file: filePath,
+          line: index + 1,
+          code: line.trim()
+        });
+      }
+    });
+
+    return vulnerabilities;
+  }
+}
+
+module.exports = GeneralScanner;