0xkobold 0.5.0 → 0.5.2

package/skills/kobold-scan-skill/src/scanners/javascript.js

@@ -0,0 +1,182 @@
+class JavaScriptScanner {
+  constructor(config) {
+    this.config = config;
+    this.exclusions = config.exclusions || {
+      tokenNames: ['KOBOLDS', 'DRAKIN', 'TRIDENT', 'MLTL', 'WETH', 'USDC', 'ETH'],
+      minSecretLength: 20, // Skip short strings (not real secrets)
+      allowedInComments: true
+    };
+  }
+
+  scan(content, filePath) {
+    const vulnerabilities = [];
+    const lines = content.split('\n');
+
+    // Skip test/example files
+    if (this.isTestFile(filePath)) {
+      return [];
+    }
+
+    // Skip scanner rule files (they define patterns, not vulnerabilities)
+    if (filePath.includes('/scanners/') || filePath.includes('/rules/')) {
+      return [];
+    }
+
+    lines.forEach((line, index) => {
+      // Skip comments (lines starting with //)
+      if (this.isComment(line)) {
+        return;
+      }
+
+      // JS-001: eval() usage
+      this.checkEval(line, index, filePath, vulnerabilities);
+
+      // JS-002: Hardcoded secrets (with exclusions)
+      this.checkSecrets(line, index, filePath, vulnerabilities);
+
+      // JS-004: SQL injection
+      this.checkSQLInjection(line, index, filePath, vulnerabilities);
+
+      // JS-005: Path traversal
+      this.checkPathTraversal(line, index, filePath, vulnerabilities);
+
+      // JS-007: console.log
+      this.checkConsoleLog(line, index, filePath, vulnerabilities);
+
+      // JS-006: Prototype pollution
+      this.checkPrototypePollution(line, index, filePath, vulnerabilities);
+    });
+
+    return vulnerabilities;
+  }
+
+  isTestFile(filePath) {
+    const testPatterns = [
+      /\/examples\//,
+      /\/test\//,
+      /\/tests\//,
+      /\.test\./,
+      /\.spec\./,
+      /\/fixtures\//,
+      /\/mocks\//
+    ];
+    return testPatterns.some(p => p.test(filePath));
+  }
+
+  isComment(line) {
+    return /^\s*\/\//.test(line) || /^\s*\/\*/.test(line);
+  }
+
+  checkEval(line, index, filePath, vulns) {
+    const evalPattern = /\beval\s*\(/;
+    if (evalPattern.test(line)) {
+      vulns.push({
+        rule: 'JS-001',
+        severity: 'critical',
+        message: 'Dangerous eval() usage - code injection risk',
+        file: filePath,
+        line: index + 1,
+        code: line.trim()
+      });
+    }
+  }
+
+  checkSecrets(line, index, filePath, vulns) {
+    // Improved secret pattern - requires proper key format
+    const secretPattern = /(api[_-]?key|apikey|secret[_-]?key|secretkey|private[_-]?key|privatekey)\s*[:=]\s*["']([a-zA-Z0-9_\-]{20,})["']/i;
+    
+    const match = line.match(secretPattern);
+    if (match) {
+      const value = match[2];
+      
+      // Skip if matches known token names
+      if (this.exclusions.tokenNames.includes(value)) {
+        return;
+      }
+      
+      // Skip if too short (not a real secret)
+      if (value.length < this.exclusions.minSecretLength) {
+        return;
+      }
+      
+      // Skip if looks like an address (0x...)
+      if (value.startsWith('0x')) {
+        return;
+      }
+
+      vulns.push({
+        rule: 'JS-002',
+        severity: 'critical',
+        message: 'Hardcoded secret/credential detected',
+        file: filePath,
+        line: index + 1,
+        code: line.trim()
+      });
+    }
+  }
+
+  checkSQLInjection(line, index, filePath, vulns) {
+    // Only flag actual concatenation in query strings
+    const sqlPattern = /(query|execute|exec)\s*\(.*["'].*(SELECT|INSERT|UPDATE|DELETE).*\+.*\$|\+.*["'].*(SELECT|INSERT|UPDATE|DELETE)/i;
+    
+    if (sqlPattern.test(line)) {
+      vulns.push({
+        rule: 'JS-004',
+        severity: 'high',
+        message: 'Potential SQL injection via string concatenation',
+        file: filePath,
+        line: index + 1,
+        code: line.trim()
+      });
+    }
+  }
+
+  checkPathTraversal(line, index, filePath, vulns) {
+    const pathPattern = /fs\.(readFile|writeFile|createReadStream|unlink)\s*\([^)]*\+\s*(req|request|params|body)\.|\.\.[\/\\].*(req|request|params)/;
+    
+    if (pathPattern.test(line)) {
+      vulns.push({
+        rule: 'JS-005',
+        severity: 'high',
+        message: 'Path traversal risk - user input in file path',
+        file: filePath,
+        line: index + 1,
+        code: line.trim()
+      });
+    }
+  }
+
+  checkConsoleLog(line, index, filePath, vulns) {
+    // Skip console logs that just log errors (common pattern)
+    const consolePattern = /console\.(log|debug|warn|error)\s*\(/;
+    const isErrorLog = /console\.error\s*\(\s*(err|error|e)\s*\)/i;
+    
+    if (consolePattern.test(line) && !isErrorLog.test(line)) {
+      vulns.push({
+        rule: 'JS-007',
+        severity: 'low',
+        message: 'console.log left in production code',
+        file: filePath,
+        line: index + 1,
+        code: line.trim()
+      });
+    }
+  }
+
+  checkPrototypePollution(line, index, filePath, vulns) {
+    const protoPattern = /Object\.prototype\.__proto__|Object\.prototype\.constructor\s*=/;
+    
+    if (protoPattern.test(line)) {
+      vulns.push({
+        rule: 'JS-006',
+        severity: 'high',
+        message: 'Prototype pollution risk detected',
+        file: filePath,
+        line: index + 1,
+        code: line.trim()
+      });
+    }
+  }
+}
+
+module.exports = JavaScriptScanner;

package/skills/kobold-scan-skill/src/scanners/solidity.js

@@ -0,0 +1,131 @@
+class SolidityScanner {
+  constructor(config) {
+    this.config = config;
+  }
+
+  scan(content, filePath) {
+    const vulnerabilities = [];
+    const lines = content.split('\n');
+
+    // Skip example/test files
+    if (filePath.includes('/examples/') || filePath.includes('/test/')) {
+      return [];
+    }
+
+    lines.forEach((line, index) => {
+      // Skip comments
+      if (this.isComment(line)) {
+        return;
+      }
+
+      // SOL-004: tx.origin usage
+      this.checkTxOrigin(line, index, filePath, vulnerabilities);
+
+      // SOL-001: Reentrancy
+      this.checkReentrancy(line, index, filePath, vulnerabilities);
+
+      // SOL-006: Delegatecall injection
+      this.checkDelegatecall(line, index, filePath, vulnerabilities);
+
+      // SOL-003: Overflow (only flag in pre-0.8 versions)
+      this.checkOverflow(line, index, filePath, content, vulnerabilities);
+    });
+
+    return vulnerabilities;
+  }
+
+  isComment(line) {
+    return /^\s*\/\//.test(line) || /^\s*\/\*/.test(line) || /\*\//.test(line);
+  }
+
+  checkTxOrigin(line, index, filePath, vulns) {
+    const txOriginPattern = /tx\.origin/;
+    
+    // Skip if it's in a comment about the vulnerability
+    if (line.includes('phishing') || line.includes('authentication')) {
+      // This is likely a comment warning about the issue
+      return;
+    }
+    
+    if (txOriginPattern.test(line)) {
+      // Check if it's actually used for auth (require statement)
+      if (line.includes('require') || line.includes('==') || line.includes('!=')) {
+        vulns.push({
+          rule: 'SOL-004',
+          severity: 'critical',
+          message: 'tx.origin used for authentication - phishing risk',
+          file: filePath,
+          line: index + 1,
+          code: line.trim()
+        });
+      }
+    }
+  }
+
+  checkReentrancy(line, index, filePath, vulns) {
+    // Look for external call patterns that could be reentrant
+    const externalCallPattern = /\.call\{value:[^}]+\}\([^)]*\)/;
+    const transferPattern = /\.transfer\s*\(/;
+    const sendPattern = /\.send\s*\(/;
+    
+    if (externalCallPattern.test(line) && !transferPattern.test(line) && !sendPattern.test(line)) {
+      // Check if state is updated AFTER the call (reentrancy pattern)
+      // This is a simplified check - real detection needs flow analysis
+      vulns.push({
+        rule: 'SOL-001',
+        severity: 'high', // Downgrade from critical unless we confirm pattern
+        message: 'External call detected - verify state updates happen before, not after',
+        file: filePath,
+        line: index + 1,
+        code: line.trim()
+      });
+    }
+  }
+
+  checkDelegatecall(line, index, filePath, vulns) {
+    const delegatecallPattern = /\.delegatecall\s*\(/;
+    
+    if (delegatecallPattern.test(line)) {
+      // Check if address is user-controlled (contains msg.sender or parameter)
+      if (line.includes('msg.sender') || line.includes('address(') || /\b[A-Za-z]+\)/.test(line)) {
+        vulns.push({
+          rule: 'SOL-006',
+          severity: 'high',
+          message: 'Delegatecall to potentially user-controlled address',
+          file: filePath,
+          line: index + 1,
+          code: line.trim()
+        });
+      }
+    }
+  }
+
+  checkOverflow(line, index, filePath, content, vulns) {
+    // Only flag for Solidity < 0.8 which doesn't have built-in checks
+    const pragmaMatch = content.match(/pragma\s+solidity\s+\^?(\d+)\.(\d+)/);
+    if (!pragmaMatch) return;
+    
+    const major = parseInt(pragmaMatch[1]);
+    const minor = parseInt(pragmaMatch[2]);
+    
+    // Solidity 0.8+ has built-in overflow checks
+    if (major > 0 || (major === 0 && minor >= 8)) {
+      return;
+    }
+    
+    const overflowPattern = /uint\d*\s+\w+\s*=\s*\w+\s*[\+\-\*]\s*\w+/;
+    
+    if (overflowPattern.test(line)) {
+      vulns.push({
+        rule: 'SOL-003',
+        severity: 'medium', // Downgrade since it's context-dependent
+        message: 'Potential integer overflow (pre-Solidity 0.8) - consider SafeMath',
+        file: filePath,
+        line: index + 1,
+        code: line.trim()
+      });
+    }
+  }
+}
+
+module.exports = SolidityScanner;

package/skills/kobold-scan-skill/src/utils/config-manager.js

@@ -0,0 +1,37 @@
+const fs = require('fs');
+const path = require('path');
+
+const DEFAULT_CONFIG = {
+  severity: 'low',
+  include: ['**/*'],
+  exclude: ['node_modules/**', '.git/**', 'build/**', 'dist/**', '**/*.min.js'],
+  rules: {
+    solidity: { enabled: true },
+    javascript: { enabled: true },
+    general: { enabled: true }
+  },
+  output: {
+    showCodeSnippets: true,
+    maxIssuesPerRule: 50
+  }
+};
+
+class ConfigManager {
+  static loadDefault() {
+    return JSON.parse(JSON.stringify(DEFAULT_CONFIG));
+  }
+
+  static loadCustom(configPath) {
+    if (!fs.existsSync(configPath)) {
+      throw new Error(`Config file not found: ${configPath}`);
+    }
+    const userConfig = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    return { ...DEFAULT_CONFIG, ...userConfig };
+  }
+
+  static getDefaultConfig() {
+    return JSON.parse(JSON.stringify(DEFAULT_CONFIG));
+  }
+}
+
+module.exports = ConfigManager;

package/skills/kobold-scan-skill/src/utils/rule-loader.js

@@ -0,0 +1,24 @@
+const fs = require('fs');
+const path = require('path');
+
+const RULES_DIR = path.join(__dirname, '../../rules');
+
+class RuleLoader {
+  static loadRules(language) {
+    const ruleFile = path.join(RULES_DIR, `${language}.json`);
+    if (!fs.existsSync(ruleFile)) {
+      return [];
+    }
+    return JSON.parse(fs.readFileSync(ruleFile, 'utf8'));
+  }
+
+  static loadAllRules() {
+    return {
+      solidity: this.loadRules('solidity'),
+      javascript: this.loadRules('javascript'),
+      general: this.loadRules('general')
+    };
+  }
+}
+
+module.exports = RuleLoader;

package/skills/kobold-scan.ts

@@ -0,0 +1,107 @@
+/**
+ * 🔍 Kobold Scan Skill
+ *
+ * Security vulnerability scanner for 0xKobold projects.
+ * Scans code for secrets, vulnerabilities, and anti-patterns.
+ *
+ * This is a wrapper around the kobold-scan tool from
+ * https://git.kobolds.run/kobolds/kobold-scan-skill
+ */
+
+import { Skill } from '../src/skills/types';
+import { execSync } from 'child_process';
+import { existsSync } from 'fs';
+import { resolve } from 'path';
+
+export const koboldScan: Skill = {
+  name: 'koboldScan',
+  description: 'Security vulnerability scanner for JavaScript, Node.js, and Solidity codebases. Detects hardcoded secrets, SQL injection, path traversal, eval usage, and smart contract vulnerabilities.',
+  risk: 'safe',
+
+  toolDefinition: {
+    type: 'function',
+    function: {
+      name: 'koboldScan',
+      description: 'Scan code for security vulnerabilities and anti-patterns. Detects secrets, injection vulnerabilities, and Solidity issues.',
+      parameters: {
+        type: 'object',
+        properties: {
+          path: {
+            type: 'string',
+            description: 'Path to directory or file to scan (relative to workspace)'
+          },
+          severity: {
+            type: 'string',
+            enum: ['critical', 'high', 'medium', 'low'],
+            description: 'Minimum severity level to report'
+          },
+          format: {
+            type: 'string',
+            enum: ['terminal', 'json', 'markdown'],
+            description: 'Output format'
+          }
+        },
+        required: ['path']
+      }
+    }
+  },
+
+  async execute(args: { path: string; severity?: string; format?: string }) {
+    const scanPath = resolve(args.path);
+    
+    if (!existsSync(scanPath)) {
+      return {
+        success: false,
+        error: `Path not found: ${args.path}`
+      };
+    }
+
+    const severity = args.severity || 'low';
+    const format = args.format || 'json';
+
+    try {
+      // Check if kobold-scan is available
+      const cmd = `cd /home/moika/Documents/code/0xKobolds/skills/kobold-scan-skill && node index.js scan "${scanPath}" --severity ${severity} --format ${format}`;
+      const result = execSync(cmd, { encoding: 'utf-8', timeout: 60000 });
+      
+      if (format === 'json') {
+        const parsed = JSON.parse(result);
+        return {
+          success: true,
+          data: parsed,
+          summary: `${parsed.summary?.filesScanned || 0} files scanned, ${parsed.summary?.issuesFound || 0} issues found`
+        };
+      }
+
+      return {
+        success: true,
+        data: result
+      };
+    } catch (error: any) {
+      // Scanner exits with code 1 if issues found, but still outputs valid result
+      if (error.stdout) {
+        try {
+          if (format === 'json') {
+            const parsed = JSON.parse(error.stdout);
+            return {
+              success: true,
+              data: parsed,
+              summary: `${parsed.summary?.filesScanned || 0} files scanned, ${parsed.summary?.issuesFound || 0} issues found`,
+              issues: parsed.vulnerabilities
+            };
+          }
+          return { success: true, data: error.stdout };
+        } catch {
+          return { success: true, data: error.stdout };
+        }
+      }
+      
+      return {
+        success: false,
+        error: `Scan failed: ${error.message}`
+      };
+    }
+  }
+};
+
+export default koboldScan;