@agent-beam/beam 0.2.21 → 0.2.22

package/dist/skill-inventory.d.ts

@@ -0,0 +1,81 @@
+import { type SkillScan } from "./skill-scan.js";
+export type SkillFindingSummary = {
+    id: string;
+    title: string;
+    severity: string;
+    file: string;
+    line?: number;
+    explanation?: string;
+    evidence?: string;
+    fp?: string;
+};
+/** Every finding, minimal: enough for the dashboard to re-score a skill after some are reviewed as safe. */
+export type SkillFindingRef = {
+    id: string;
+    severity: string;
+    fp: string;
+};
+export type InventorySkill = {
+    /** Stable per-machine id (hash of the folder), so a report can name a skill without its path. Absent in files written before this field existed. */
+    id?: string;
+    topFindings?: SkillFindingSummary[];
+    allFindings?: SkillFindingRef[];
+    name: string;
+    dir: string;
+    agent: string;
+    scope: "global" | "project" | "other";
+    repo: string | null;
+    hash: string;
+    score: number;
+    level: SkillScan["level"];
+    findings: number;
+    injection: boolean;
+    files: number;
+    firstSeen: string;
+    lastSeen: string;
+    modifiedAt: string | null;
+};
+export type Inventory = {
+    version: 1;
+    generatedAt: string;
+    roots: string[];
+    truncated: boolean;
+    skills: InventorySkill[];
+    /** When a whole-home search last ran (`beam skills index`). Null/absent: only agent skill folders have been checked. */
+    lastFullScanAt?: string | null;
+};
+export type IndexChanges = {
+    added: string[];
+    modified: string[];
+    removed: string[];
+};
+export declare const inventoryFile: () => string;
+export declare function agentSkillRoots(home?: string): Promise<string[]>;
+export type DiscoverOptions = {
+    roots?: string[];
+    maxDepth?: number;
+    maxDirs?: number;
+    budgetMs?: number;
+};
+export declare function discoverAllSkills(options?: DiscoverOptions): Promise<{
+    found: Array<{
+        dir: string;
+        repo: string | null;
+    }>;
+    roots: string[];
+    truncated: boolean;
+}>;
+export declare function readInventory(): Promise<Inventory | null>;
+export declare function indexSkills(options?: DiscoverOptions, home?: string): Promise<{
+    inventory: Inventory;
+    changes: IndexChanges;
+}>;
+export declare function trustedHashes(): Promise<Set<string>>;
+export declare function deviceSkillsScore(skills: Array<{
+    score: number;
+    level: string;
+    hash: string;
+}>, trusted: Set<string>): {
+    score: number;
+    highCount: number;
+};

package/dist/skill-inventory.js

@@ -0,0 +1,167 @@
+import { createHash } from "node:crypto";
+import { access, mkdir, readFile, readdir, rename, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import { basename, join, sep } from "node:path";
+import { getDataDirectory } from "./config.js";
+import { redact } from "./core.js";
+import { findingFingerprint, scanSkillDir } from "./skill-scan.js";
+const MAX_ALL_FINDINGS = 200;
+import { readTrustedSkills } from "./trusted-skills.js";
+export const inventoryFile = () => join(getDataDirectory(), "skills-inventory.json");
+const SKIP = new Set(["node_modules", ".git", "Library", ".Trash", "Applications", "venv", ".venv", "__pycache__", "site-packages", "target", "Pods", ".gradle", ".m2", ".cargo", ".rustup", ".npm", ".pnpm-store", ".cache", ".next", ".turbo", "DerivedData"]);
+// Dot-directories are skipped wholesale (caches, tool state) except the ones agents keep skills in.
+const DOT_ALLOW = new Set([".claude", ".agents", ".codex", ".cursor", ".gemini", ".github", ".windsurf", ".roo", ".cline", ".continue", ".opencode", ".copilot"]);
+function classify(dir, home) {
+    const p = dir.split(sep);
+    const agent = p.includes(".claude") ? "claude-code" : p.includes(".codex") ? "codex" : p.includes(".cursor") ? "cursor"
+        : p.includes(".gemini") ? "gemini" : p.includes(".copilot") ? "copilot-cli" : p.includes(".opencode") ? "opencode" : p.includes(".agents") ? "universal" : p.includes(".windsurf") ? "windsurf" : "unknown";
+    const rel = dir.startsWith(home + sep) ? dir.slice(home.length + 1).split(sep) : [];
+    const globalRoot = rel.length === 3 && rel[0].startsWith(".") && rel[1] === "skills";
+    return { agent, scope: globalRoot ? "global" : agent === "unknown" ? "other" : "project" };
+}
+// The folders agents keep their own skills and plugins in. These are dot-directories directly under
+// home, which macOS does not protect -- unlike Desktop, Documents, Downloads, iCloud and external
+// volumes, which raise a "beam would like to access files in..." prompt the moment something walks
+// them. Anything that runs unattended (the background service) must stay inside these; walking the
+// rest of home is reserved for an explicit `beam skills index` / `beam skills list`.
+const AGENT_HOME_DIRS = [".claude", ".agents", ".codex", ".cursor", ".gemini", ".copilot", ".windsurf", ".opencode", ".continue", ".config/opencode"];
+export async function agentSkillRoots(home = homedir()) {
+    const found = [];
+    for (const rel of AGENT_HOME_DIRS) {
+        const dir = join(home, rel);
+        try {
+            await access(dir);
+            found.push(dir);
+        }
+        catch { /* not installed */ }
+    }
+    return found;
+}
+// Finds every folder that contains a SKILL.md. Does not descend into a skill it found (bundled
+// fixtures/examples aren't separate skills), never follows symlinks, and stops at the dir/time
+// budget rather than hanging on a huge disk -- `truncated` reports when that happened.
+export async function discoverAllSkills(options = {}) {
+    // An explicit empty list means "search nothing", never "fall back to the whole home directory".
+    const roots = options.roots ?? [homedir()];
+    const maxDepth = options.maxDepth ?? 10, maxDirs = options.maxDirs ?? 400_000;
+    const deadline = Date.now() + (options.budgetMs ?? 60_000);
+    const found = [];
+    const seen = new Set();
+    let visited = 0, truncated = false;
+    const stack = roots.map(r => ({ dir: r, depth: 0, repo: null }));
+    while (stack.length) {
+        if (visited++ > maxDirs || Date.now() > deadline) {
+            truncated = true;
+            break;
+        }
+        const { dir, depth, repo } = stack.pop();
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        if (entries.some(e => e.isFile() && e.name === "SKILL.md")) {
+            if (!seen.has(dir)) {
+                seen.add(dir);
+                found.push({ dir, repo });
+            }
+            continue;
+        }
+        const here = entries.some(e => e.name === ".git") ? dir : repo;
+        if (depth >= maxDepth)
+            continue;
+        for (const e of entries) {
+            if (!e.isDirectory() || e.isSymbolicLink() || SKIP.has(e.name))
+                continue;
+            if (e.name.startsWith(".") && !DOT_ALLOW.has(e.name))
+                continue;
+            stack.push({ dir: join(dir, e.name), depth: depth + 1, repo: here });
+        }
+    }
+    return { found, roots, truncated };
+}
+export async function readInventory() {
+    try {
+        const inv = JSON.parse(await readFile(inventoryFile(), "utf8"));
+        return inv?.version === 1 && Array.isArray(inv.skills) ? inv : null;
+    }
+    catch {
+        return null;
+    }
+}
+async function write(inv) {
+    await mkdir(getDataDirectory(), { recursive: true, mode: 0o700 });
+    const file = inventoryFile();
+    const temp = `${file}.tmp`;
+    await writeFile(temp, JSON.stringify(inv, null, 2) + "\n", { mode: 0o600 });
+    await rename(temp, file);
+}
+// Full re-index: discover, scan each skill, diff against the previous file, write it back.
+// Skills that vanished are dropped -- but only when the walk finished; a truncated walk can't
+// prove absence, so previously known skills under the same roots are kept in that case.
+export async function indexSkills(options = {}, home = homedir()) {
+    const previous = await readInventory();
+    const prev = new Map((previous?.skills ?? []).map(s => [s.dir, s]));
+    const full = options.roots === undefined;
+    const { found, roots, truncated } = await discoverAllSkills(full ? { ...options, roots: [home] } : options);
+    const now = new Date().toISOString();
+    const skills = [];
+    const changes = { added: [], modified: [], removed: [] };
+    for (const { dir, repo } of found) {
+        let scan;
+        try {
+            scan = await scanSkillDir(dir, basename(dir));
+        }
+        catch {
+            continue;
+        }
+        const old = prev.get(dir);
+        if (!old)
+            changes.added.push(dir);
+        else if (old.hash !== scan.hash)
+            changes.modified.push(dir);
+        skills.push({
+            id: createHash("sha256").update(dir).digest("hex").slice(0, 16),
+            topFindings: scan.findings.slice(0, 5).map(f => ({
+                id: f.id, title: f.title, severity: f.severity, file: f.file, ...(f.line ? { line: f.line } : {}),
+                explanation: f.explanation.slice(0, 300), ...(f.evidence ? { evidence: redact(f.evidence).slice(0, 300) } : {}),
+                fp: findingFingerprint(f, f.file),
+            })),
+            allFindings: scan.findings.slice(0, MAX_ALL_FINDINGS).map(f => ({ id: f.id, severity: f.severity, fp: findingFingerprint(f, f.file) })),
+            name: scan.name, dir, ...classify(dir, home), repo, hash: scan.hash, score: scan.score, level: scan.level,
+            findings: scan.findings.length, injection: scan.findings.some(f => f.id.startsWith("injection.")), files: scan.filesScanned,
+            firstSeen: old?.firstSeen ?? now, lastSeen: now, modifiedAt: !old ? null : old.hash !== scan.hash ? now : old.modifiedAt,
+        });
+    }
+    const scanned = new Set(skills.map(s => s.dir));
+    for (const old of prev.values()) {
+        if (scanned.has(old.dir))
+            continue;
+        const inScope = roots.some(r => old.dir === r || old.dir.startsWith(r + sep));
+        if (truncated && inScope)
+            skills.push(old); // can't prove it's gone
+        else if (inScope)
+            changes.removed.push(old.dir);
+        else
+            skills.push(old); // outside this run's roots (e.g. an ad-hoc --root): leave untouched
+    }
+    skills.sort((a, b) => b.score - a.score || a.name.localeCompare(b.name));
+    const inventory = { version: 1, generatedAt: now, roots: [...new Set([...(previous?.roots ?? []), ...roots])], truncated, skills, lastFullScanAt: full ? now : previous?.lastFullScanAt ?? null };
+    await write(inventory);
+    return { inventory, changes };
+}
+export async function trustedHashes() { return new Set((await readTrustedSkills()).map(t => t.hash)); }
+// One 0-100 skills risk score for this machine (higher = riskier). Starts from the worst skill and
+// adds 5 for every further HIGH/CRITICAL one (capped at +20). Skills you have trusted are left
+// out. The workspace collector computes the same number for each device
+// (beam/apps/collector/src/skill-score.ts) -- keep the two in step.
+export function deviceSkillsScore(skills, trusted) {
+    const counted = skills.filter(s => !trusted.has(s.hash));
+    if (!counted.length)
+        return { score: 0, highCount: 0 };
+    const highCount = counted.filter(s => s.level === "HIGH" || s.level === "CRITICAL").length;
+    return { score: Math.min(100, Math.max(...counted.map(s => s.score)) + Math.min(20, 5 * Math.max(0, highCount - 1))), highCount };
+}
+//# sourceMappingURL=skill-inventory.js.map

package/dist/skill-inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-inventory.js","sourceRoot":"","sources":["../src/skill-inventory.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvF,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAChD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/C,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AACnC,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAkB,MAAM,iBAAiB,CAAC;AAEnF,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,qBAAqB,CAAC;AAwBxD,MAAM,CAAC,MAAM,aAAa,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,gBAAgB,EAAE,EAAE,uBAAuB,CAAC,CAAC;AAErF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,cAAc,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,cAAc,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,CAAC;AACjQ,oGAAoG;AACpG,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC;AAElK,SAAS,QAAQ,CAAC,GAAW,EAAE,IAAY;IACzC,MAAM,CAAC,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IACzB,MAAM,KAAK,GAAG,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ;QACrH,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9M,MAAM,GAAG,GAAG,GAAG,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACpF,MAAM,UAAU,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,QAAQ,CAAC;IACrF,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC;AAC7F,CAAC;AAED,oGAAoG;AACpG,kGAAkG;AAClG,mGAAmG;AACnG,mGAAmG;AACnG,qFAAqF;AACrF,MAAM,eAAe,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,WAAW,EAAE,kBAAkB,CAAC,CAAC;AACtJ,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,IAAI,GAAG,OAAO,EAAE;IACpD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;QAAC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAAC,IAAI,CAAC;YAAC,MAAM,MAAM,CAAC,GAAG,CAAC,CAAC;YAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,mBAAmB,CAAC,CAAC;IAAC,CAAC;IAC7I,OAAO,KAAK,CAAC;AACf,CAAC;AAID,+FAA+F;AAC/F,+FAA+F;AAC/F,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAA2B,EAAE;IACnE,gGAAgG;IAChG,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,EAAE,EAAE,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC;IAC9E,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,OAAO,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC;IAC3D,MAAM,KAAK,GAAgD,EAAE,CAAC;IAC9D,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,OAAO,GAAG,CAAC,EAAE,SAAS,GAAG,KAAK,CAAC;IACnC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,IAAqB,EAAE,CAAC,CAAC,CAAC;IAClF,OAAO,KAAK,CAAC,MAAM,EAAE,CAAC;QACpB,IAAI,OAAO,EAAE,GAAG,OAAO,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;YAAC,SAAS,GAAG,IAAI,CAAC;YAAC,MAAM;QAAC,CAAC;QAC9E,MAAM,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,GAAG,EAAG,CAAC;QAC1C,IAAI,OAAO,CAAC;QAAC,IAAI,CAAC;YAAC,OAAO,GAAG,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/F,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,EAAE,CAAC;YAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;gBAAC,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QAC3I,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;QAC/D,IAAI,KAAK,IAAI,QAAQ;YAAE,SAAS;QAChC,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,CAAC,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,cAAc,EAAE,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YACzE,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAAE,SAAS;YAC/D,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,KAAK,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC;IACH,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa;IACjC,IAAI,CAAC;QAAC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,aAAa,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC;QAAC,OAAO,GAAG,EAAE,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAAC,CAAC;IAC7I,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AACxB,CAAC;AAED,KAAK,UAAU,KAAK,CAAC,GAAc;IACjC,MAAM,KAAK,CAAC,gBAAgB,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAClE,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAAC,MAAM,IAAI,GAAG,GAAG,IAAI,MAAM,CAAC;IACzD,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5E,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,2FAA2F;AAC3F,8FAA8F;AAC9F,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAA2B,EAAE,EAAE,IAAI,GAAG,OAAO,EAAE;IAC/E,MAAM,QAAQ,GAAG,MAAM,aAAa,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,CAAC,QAAQ,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IACpE,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,KAAK,SAAS,CAAC;IACzC,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,SAAS,EAAE,GAAG,MAAM,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC5G,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAqB,EAAE,CAAC;IAAC,MAAM,OAAO,GAAiB,EAAE,KAAK,EAAE,EAAE,EAAE,QAAQ,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;IAC5G,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,KAAK,EAAE,CAAC;QAClC,IAAI,IAAe,CAAC;QAAC,IAAI,CAAC;YAAC,IAAI,GAAG,MAAM,YAAY,CAAC,GAAG,EAAE,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC;YAAC,SAAS;QAAC,CAAC;QAC/F,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,GAAG;YAAE,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC/F,MAAM,CAAC,IAAI,CAAC;YACV,EAAE,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;YAC/D,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;gBAC/C,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjG,WAAW,EAAE,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAC/G,EAAE,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;aAClC,CAAC,CAAC;YACH,WAAW,EAAE,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,EAAE,EAAE,kBAAkB,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACvI,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK;YACzG,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,YAAY;YAC3H,SAAS,EAAE,GAAG,EAAE,SAAS,IAAI,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU;SACzH,CAAC,CAAC;IACL,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IAChD,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;QAChC,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;QAC9E,IAAI,SAAS,IAAI,OAAO;YAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,wBAAwB;aAC/D,IAAI,OAAO;YAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;;YAC3C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,oEAAoE;IAC7F,CAAC;IACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzE,MAAM,SAAS,GAAc,EAAE,OAAO,EAAE,CAAC,EAAE,WAAW,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,IAAI,EAAE,CAAC,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,EAAE,cAAc,IAAI,IAAI,EAAE,CAAC;IAC7M,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;IACvB,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAChC,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,KAA2B,OAAO,IAAI,GAAG,CAAC,CAAC,MAAM,iBAAiB,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;AAE7H,mGAAmG;AACnG,+FAA+F;AAC/F,wEAAwE;AACxE,oEAAoE;AACpE,MAAM,UAAU,iBAAiB,CAAC,MAA6D,EAAE,OAAoB;IACnH,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,CAAC;IACvD,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC;IAC3F,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;AACpI,CAAC"}

package/dist/skill-risk-rules.d.ts

@@ -0,0 +1,17 @@
+import { type Finding, type Severity } from "./core.js";
+type RiskRule = {
+    id: string;
+    title: string;
+    severity: Severity;
+    explanation: string;
+    re: RegExp;
+};
+export declare const riskRules: RiskRule[];
+export declare function scanRisky(content: string): Finding[];
+export declare function comboFindings(perFile: Array<{
+    file: string;
+    ids: Set<string>;
+}>): Array<Finding & {
+    file: string;
+}>;
+export {};

package/dist/skill-risk-rules.js

@@ -0,0 +1,61 @@
+import { redact } from "./core.js";
+import { firstInstruction } from "./skill-context.js";
+export const riskRules = [
+    { id: "risk.privilege_escalation", title: "Privilege escalation (sudo / su / setuid)", severity: "high", explanation: "The skill runs commands with elevated privileges. Confirm it needs root and prefer least-privilege alternatives.",
+        re: /\b(?:sudo|doas)\b|(?:^|[\s;&|`(])su\s+(?:-\s*\w*|root)\b|\bchown\s+(?:-R\s+)?root\b|\b(?:setuid|setgid)\b|\bchmod\s+(?:[ugoa]*\+s\b|[2467][0-7]{3}\b)/i },
+    { id: "risk.sudoers", title: "Sudoers or admin-group modification", severity: "critical", explanation: "The skill edits sudo configuration or grants admin rights, which permanently widens what any process on the machine can do.",
+        re: /\/etc\/sudoers|\bvisudo\b|\bNOPASSWD\b|\busermod\s+-aG\s+(?:sudo|wheel|admin)\b/i },
+    { id: "risk.persistence", title: "Persistence mechanism", severity: "high", explanation: "The skill schedules itself or edits startup files, so its effects survive after the agent session ends.",
+        re: /\bcrontab\s+(?:-[a-z]+\s+)?\S|\/etc\/cron\.\w+|\blaunchctl\s+(?:load|bootstrap|enable)\b|Launch(?:Agents|Daemons)\b|\bsystemctl\s+(?:--user\s+)?enable\b|\bschtasks(?:\.exe)?\s+\/create\b|Register-ScheduledTask|\bsc(?:\.exe)?\s+create\b|(?:>>|\btee\s+-a)\s*~?\/?(?:\S*\/)?\.(?:bashrc|zshrc|profile|bash_profile|zprofile)\b|\/etc\/(?:rc\.local|profile\.d)\b/i },
+    { id: "risk.sensitive_files", title: "Credential or identity file access", severity: "high", explanation: "The skill touches SSH keys, cloud credentials, browser stores or password files. Confirm the agent needs their contents.",
+        re: /(?:~|\$HOME)?\/?\.ssh\/|\bid_(?:rsa|ed25519|ecdsa)\b|\/etc\/(?:shadow|passwd)\b|(?:~|\$HOME)\/\.aws\/|\.config\/gcloud\b|\.kube\/config\b|\.docker\/config\.json\b|\.gnupg\b|\.netrc\b|\.git-credentials\b|\bLogin Data\b|\bcookies\.sqlite\b|\bwallet\.dat\b|Library\/Keychains/i },
+    { id: "risk.exfil_tools", title: "Data exfiltration tooling", severity: "high", explanation: "The skill pipes data to a network tool, uploads files, or sends to a public collection endpoint.",
+        re: /\|\s*(?:curl|wget|nc|ncat|netcat|socat)\b|\b(?:scp|rsync)\s+[^\n]*\S+@\S+:|\b(?:sendmail|swaks)\b|\bmailx?\s+-s\b|\bcurl\b[^\n]*(?:\s-d\s+[@<]|--data(?:-binary|-raw)?\s+[@<]|\s-F\s|\s-T\s|--upload-file)|\b(?:transfer\.sh|pastebin\.com|webhook\.site|requestbin\.\w+|interact\.sh|ngrok\.io|burpcollaborator\.net|oast\.\w+)\b/i },
+    { id: "risk.obfuscation", title: "Obfuscated or encoded content", severity: "medium", explanation: "Encoded strings, hex escapes or URL shorteners hide what will actually run or where it goes.",
+        re: /\bbase64\s+(?:-d|--decode|-D)\b|\batob\s*\(|\bFromBase64String\b|(?:\\x[0-9a-f]{2}){4,}|\b(?:bit\.ly|tinyurl\.com|t\.co|is\.gd|goo\.gl|cutt\.ly)\/\w|\bchr\s*\(\s*\d+\s*\)\s*\+\s*chr/i },
+    { id: "risk.decode_exec", title: "Decode then execute", severity: "high", explanation: "Decompressed or decoded data is piped straight into a shell or interpreter, so its contents are never reviewed.",
+        re: /\b(?:gunzip|zcat|gzip\s+-d|xxd\s+-r|openssl\s+enc\s+-d)\b[^\n]*\|\s*(?:sudo\s+)?(?:ba|z|da)?sh\b|\bbase64\s+(?:-d|--decode)\b[^\n]*\|\s*(?:sudo\s+)?(?:python3?|node|ruby|perl)\b/i },
+    { id: "risk.code_exec", title: "Dynamic code execution", severity: "medium", explanation: "Strings are evaluated or shells are spawned from code. Check what feeds them.",
+        re: /\beval\s*\(|\bnew\s+Function\s*\(|\b__import__\s*\(|\bimportlib\.import_module\b|\bos\.system\s*\(|\bsubprocess\.\w+\([^\n]*shell\s*=\s*True|\bRuntime\.getRuntime\(\)\.exec|\bchild_process\b[^\n]*\bexec(?:Sync)?\s*\(/i },
+    { id: "risk.download_exec", title: "Download and run", severity: "high", explanation: "The skill fetches a file or script and executes it in the same step.",
+        re: /\b(?:curl|wget)\b[^\n]*(?:\s-o\s|\s-O\b|--output\b)[^\n]*(?:&&|;)\s*(?:chmod\s+\+x|(?:ba|z)?sh\b|python3?\b|node\b|\.\/)|\bcurl\b[^\n]*\|\s*(?:sudo\s+)?(?:python3?|node|ruby|perl)\b|\b(?:iwr|Invoke-WebRequest)\b[^\n]*\|\s*(?:iex|Invoke-Expression)\b|\bDownloadString\s*\(|\b(?:iex|Invoke-Expression)\b[^\n]*\b(?:iwr|Invoke-WebRequest|DownloadString)\b/i },
+    { id: "risk.supply_chain", title: "Unpinned or non-registry install", severity: "medium", explanation: "Packages come from a git URL, a custom index, or a mutable tag instead of a reviewed registry version.",
+        re: /\bpip3?\s+install\s+[^\n]*git\+|\bnpm\s+(?:i|install)\s+(?:-g\s+)?(?:github:|git\+|https?:\/\/)|\bnpx\s+(?:-y\s+)?(?:github:|https?:\/\/)|(?:--index-url|--extra-index-url|--trusted-host|--allow-unverified)\b|\bgo\s+install\s+\S+@latest\b|\bcargo\s+install\s+--git\b|\bnpm\s+config\s+set\s+registry\b|\bnpm\s+(?:i|install)\s+[^\n]*--registry\b/i },
+    { id: "risk.destructive_broad", title: "Broad destructive command", severity: "high", explanation: "The command can wipe a disk, the home directory, or shared git history.",
+        re: /\brm\s+(?:-[a-z]*[rf][a-z]*\s+)+(?:\/(?:\s|$|\*)|~\/?(?:\s|$|\*)|\$HOME\/?(?:\s|$|\*))|\bmkfs\.\w+|\bdd\s+if=[^\n]*\bof=\/dev\/|:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:|>\s*\/dev\/sd[a-z]|\bchmod\s+-R\s+777\s+\/(?:\s|$)|\bgit\s+push\s+[^\n]*(?:--force|\s-f\b)[^\n]*\b(?:main|master)\b/i },
+];
+export function scanRisky(content) {
+    const findings = [];
+    const lines = content.split(/\r?\n/);
+    for (const rule of riskRules) {
+        for (let i = 0; i < lines.length; i++) {
+            if (lines[i].length > 2000 || !firstInstruction(lines[i], rule.re, "command", { prev: lines[i - 1], next: lines[i + 1] }))
+                continue;
+            findings.push({ id: rule.id, title: rule.title, severity: rule.severity, explanation: rule.explanation, evidence: redact(lines[i].trim()).slice(0, 200), line: i + 1 });
+            break;
+        }
+    }
+    return findings;
+}
+// Pairs that are worse together than either alone (explainx escalates the same way: privilege
+// escalation plus destruction is critical). "skill" combos look across the whole skill, since an
+// instruction file and the script it runs are separate files. The credential/exfil pair is
+// "file"-scoped: both halves are common in unrelated reference docs (an API example with curl,
+// a path-traversal note mentioning /etc/passwd), so co-occurring anywhere in a big skill means
+// nothing -- they only count together in one file.
+const COMBOS = [
+    { scope: "skill", all: ["risk.privilege_escalation", "risk.destructive_broad"], id: "risk.combo.privileged_destructive", title: "Elevated privileges combined with destructive commands", explanation: "Root access plus a broad delete or overwrite can destroy the whole machine." },
+    { scope: "skill", all: ["risk.privilege_escalation", "risk.download_exec"], id: "risk.combo.privileged_download_exec", title: "Downloads and runs code with elevated privileges", explanation: "Unreviewed remote code would run as root." },
+    { scope: "file", all: ["risk.sensitive_files", "risk.exfil_tools"], id: "risk.combo.credential_exfil", title: "Credential files together with outbound transfer tooling", explanation: "Reading key or credential files and having a way to send data out is the shape of credential theft." },
+];
+export function comboFindings(perFile) {
+    const all = new Set(perFile.flatMap(f => [...f.ids]));
+    const out = [];
+    for (const c of COMBOS) {
+        const hits = c.scope === "skill" ? (c.all.every(id => all.has(id)) ? ["(whole skill)"] : []) : perFile.filter(f => c.all.every(id => f.ids.has(id))).map(f => f.file);
+        for (const file of hits)
+            out.push({ id: c.id, title: c.title, severity: "critical", explanation: c.explanation, evidence: `Together: ${c.all.join(" + ")}`, file });
+    }
+    return out;
+}
+//# sourceMappingURL=skill-risk-rules.js.map

package/dist/skill-risk-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-risk-rules.js","sourceRoot":"","sources":["../src/skill-risk-rules.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAA+B,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AAUtD,MAAM,CAAC,MAAM,SAAS,GAAe;IACnC,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,2CAA2C,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,kHAAkH;QACtO,EAAE,EAAE,wJAAwJ,EAAE;IAChK,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,qCAAqC,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,6HAA6H;QAClO,EAAE,EAAE,kFAAkF,EAAE;IAC1F,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,uBAAuB,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,yGAAyG;QAChM,EAAE,EAAE,sWAAsW,EAAE;IAC9W,EAAE,EAAE,EAAE,sBAAsB,EAAE,KAAK,EAAE,oCAAoC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,0HAA0H;QAClO,EAAE,EAAE,mRAAmR,EAAE;IAC3R,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,kGAAkG;QAC7L,EAAE,EAAE,qUAAqU,EAAE;IAC7U,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,+BAA+B,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,8FAA8F;QAC/L,EAAE,EAAE,wLAAwL,EAAE;IAChM,EAAE,EAAE,EAAE,kBAAkB,EAAE,KAAK,EAAE,qBAAqB,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,iHAAiH;QACtM,EAAE,EAAE,oLAAoL,EAAE;IAC5L,EAAE,EAAE,EAAE,gBAAgB,EAAE,KAAK,EAAE,wBAAwB,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,+EAA+E;QACvK,EAAE,EAAE,2NAA2N,EAAE;IACnO,EAAE,EAAE,EAAE,oBAAoB,EAAE,KAAK,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,sEAAsE;QAC1J,EAAE,EAAE,kWAAkW,EAAE;IAC1W,EAAE,EAAE,EAAE,mBAAmB,EAAE,KAAK,EAAE,kCAAkC,EAAE,QAAQ,EAAE,QAAQ,EAAE,WAAW,EAAE,wGAAwG;QAC7M,EAAE,EAAE,yVAAyV,EAAE;IACjW,EAAE,EAAE,EAAE,wBAAwB,EAAE,KAAK,EAAE,2BAA2B,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,yEAAyE;QAC1K,EAAE,EAAE,+RAA+R,EAAE;CACxS,CAAC;AAEF,MAAM,UAAU,SAAS,CAAC,OAAe;IACvC,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,MAAM,IAAI,IAAI,SAAS,EAAE,CAAC;QAC7B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,IAAI,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAAE,SAAS;YACpI,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACxK,MAAM;QACR,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8FAA8F;AAC9F,iGAAiG;AACjG,2FAA2F;AAC3F,+FAA+F;AAC/F,+FAA+F;AAC/F,mDAAmD;AACnD,MAAM,MAAM,GAAsG;IAChH,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,2BAA2B,EAAE,wBAAwB,CAAC,EAAE,EAAE,EAAE,mCAAmC,EAAE,KAAK,EAAE,wDAAwD,EAAE,WAAW,EAAE,6EAA6E,EAAE;IACtR,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,2BAA2B,EAAE,oBAAoB,CAAC,EAAE,EAAE,EAAE,qCAAqC,EAAE,KAAK,EAAE,kDAAkD,EAAE,WAAW,EAAE,2CAA2C,EAAE;IAC5O,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,sBAAsB,EAAE,kBAAkB,CAAC,EAAE,EAAE,EAAE,6BAA6B,EAAE,KAAK,EAAE,0DAA0D,EAAE,WAAW,EAAE,qGAAqG,EAAE;CAC/R,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,OAAkD;IAC9E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACtD,MAAM,GAAG,GAAsC,EAAE,CAAC;IAClD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACtK,KAAK,MAAM,IAAI,IAAI,IAAI;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IACtK,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/skill-scan.d.ts

@@ -0,0 +1,27 @@
+import { type Finding, type Severity } from "./core.js";
+export declare function skillRiskScore(findings: Finding[]): {
+    score: number;
+    level: SkillScan["level"];
+};
+export interface SkillFileScan {
+    file: string;
+    findings: Finding[];
+}
+export interface SkillScan {
+    name: string;
+    dir: string;
+    hash: string;
+    score: number;
+    level: "LOW" | "MEDIUM" | "HIGH" | "CRITICAL";
+    risk: Severity;
+    files: SkillFileScan[];
+    findings: Array<Finding & {
+        file: string;
+    }>;
+    filesScanned: number;
+    skipped: string[];
+}
+export declare function findingFingerprint(f: Pick<Finding, "id" | "evidence">, file: string): string;
+export declare function scanInjection(content: string): Finding[];
+export declare function scanSkillDir(dir: string, name: string): Promise<SkillScan>;
+export declare function scanSkillFile(file: string): Promise<SkillScan>;

package/dist/skill-scan.js

@@ -0,0 +1,157 @@
+import { createHash } from "node:crypto";
+import { readdir, readFile, stat } from "node:fs/promises";
+import { basename, join, relative } from "node:path";
+import { comboFindings, scanRisky } from "./skill-risk-rules.js";
+import { firstInstruction } from "./skill-context.js";
+import { detect, redact, risk, scanText, severityRank } from "./core.js";
+const ruleMatches = (rule, text) => rule.re ? new RegExp(rule.re.source, rule.re.flags.replace("g", "")).test(text) : Boolean(rule.match?.(text));
+const injectionRules = [
+    { id: "injection.role_override", title: "Role or system-prompt override", severity: "critical", explanation: "The skill tells the agent to drop its existing instructions or adopt a new identity.", re: /\b(?:ignore|disregard)\s+(?:all\s+|any\s+)?(?:of\s+)?(?:the\s+|your\s+)?(?:previous|prior|above|earlier|preceding)\s+(?:system\s+)?(?:instructions|prompts?|rules|messages)\b|\b(?:disregard|forget|override|bypass)\s+(?:all\s+|any\s+)?(?:your|the|previous|prior|above)\s+(?:system\s+)?(?:prompt|instructions|rules|guidelines|safeguards)\b|\bforget\s+everything\s+(?:above|before)\b|\byou\s+are\s+now\s+(?:in\s+)?(?:DAN|developer\s+mode|an?\s+unrestricted)\b/i },
+    { id: "injection.fake_delimiter", title: "Forged conversation or system delimiter", severity: "critical", explanation: "Chat-template or 'end of skill' markers are used to make the following text look like a higher-trust message.", re: /<\|(?:im_start|im_end|system|endoftext)\|>|<\/?system(?:-reminder)?>|\[\/?INST\]|---\s*END\s+(?:OF\s+)?SKILL\s*---|\bBEGIN\s+SYSTEM\s+PROMPT\b/i },
+    { id: "injection.concealment", title: "Instruction to hide activity from the user", severity: "high", explanation: "The skill asks the agent to act without telling the user or to hide what it did.", re: /(?:without|don'?t|do\s+not|never)\s+(?:telling|tell|mention(?:ing)?|inform(?:ing)?|reveal(?:ing)?|show(?:ing)?)\s+(?:the\s+)?(?:user|human|operator)\b(?!\s+to\b)|\b(?:silently|secretly|covertly)\s+(?:run|execute|send|upload|post|fetch|install|delete|modify)\b|hide\s+(?:this|these|the)\s+(?:step|action|output|command)s?\s+from/i },
+    { id: "injection.priority_hijack", title: "Attempt to outrank the user or system", severity: "high", explanation: "The skill claims its instructions take precedence over the user's or the platform's.", re: /\b(?:these|this)\s+instructions?\s+(?:take|has|have)\s+(?:priority|precedence)\s+over|\bbefore\s+(?:doing\s+)?anything\s+else,?\s+(?:you\s+must\s+)?(?:(?:fetch|send|curl|wget|download|upload)\b|(?:run|execute)\s+[`"']?(?:curl|wget|nc|ncat|bash|sh|eval|powershell)\b)/i },
+    { id: "injection.hidden_text", context: false, title: "Hidden or invisible text", severity: "high", explanation: "Zero-width, bidirectional-control, or Unicode tag characters can smuggle instructions a human reviewer never sees.", re: /[​-‏‪-‮⁠-⁤]|[\u{E0000}-\u{E007F}]/u },
+    { id: "injection.hidden_comment", title: "Instructions inside an HTML comment", severity: "high", explanation: "HTML comments are invisible when a skill is rendered but are still read by the agent.", re: /(?:ignore\s+(?:all\s+|the\s+)?(?:previous|prior|above)|\byou\s+(?:must|should|will)\b|(?:new|hidden|secret)\s+instructions?|system\s+prompt|do\s+not\s+(?:tell|mention|reveal)|\b(?:curl|wget)\s+\S+|\bsend\s+(?:it|this|the\s+\w+)\s+to\b|exfiltrat\w+|\bassistant\s*:)/i },
+    { id: "injection.encoded_payload", title: "Encoded payload with a follow-instruction", severity: "high", explanation: "A base64 or hex blob is paired with a request to decode and act on it.", match: s => /(?:[A-Za-z0-9+/]{80,}={0,2})/.test(s) && /\b(?:decode|decrypt|deobfuscate)\b[^\n]{0,60}\b(?:and\s+)?(?:follow|run|execute|obey|apply)\b/i.test(s) },
+    { id: "injection.exfil_instruction", title: "Instruction to send data to an external address", severity: "critical", explanation: "The skill directs the agent to transmit conversation, files, or environment to a remote URL.", re: /\b(?:send|post|upload|forward|include|append)\b[^\n]{0,80}\b(?:conversation|chat\s+history|system\s+prompt|context|transcript|environment|env\s+vars?|credentials?|api\s+keys?|source\s+code)\b[^\n]{0,80}https?:\/\//i },
+];
+// 0-100. Prompt injection is weighted up because a skill is text the agent will obey, and one
+// critical finding alone is already enough to land in HIGH.
+const WEIGHT = { critical: 40, high: 20, medium: 8, info: 2 };
+export function skillRiskScore(findings) {
+    // Each rule counts once per skill (a big skill repeating "production" across 30 files is one
+    // signal, not thirty). Ordinary rules that merely *mention* env vars, sudo or curl are common in
+    // legitimate skills, so their non-critical total is capped below the HIGH band; reaching HIGH or
+    // CRITICAL takes prompt injection or a genuinely critical pattern.
+    const unique = [...new Map(findings.map(f => [f.id, f])).values()];
+    const injection = unique.filter(f => f.id.startsWith("injection.")).reduce((s, f) => s + WEIGHT[f.severity] * 1.5, 0);
+    const critical = unique.filter(f => !f.id.startsWith("injection.") && f.severity === "critical").length * WEIGHT.critical;
+    const ordinary = Math.min(35, unique.filter(f => !f.id.startsWith("injection.") && f.severity !== "critical").reduce((s, f) => s + WEIGHT[f.severity] / (f.id.startsWith("risk.") ? 1 : 2), 0));
+    const score = Math.min(100, Math.round(injection + critical + ordinary));
+    return { score, level: score >= 70 ? "CRITICAL" : score >= 40 ? "HIGH" : score >= 15 ? "MEDIUM" : "LOW" };
+}
+// Core rules that don't fit skill prose. `instructions.override` is the older, context-blind version
+// of injection.role_override / injection.concealment, which already cover it with quoting and
+// negation handled. `mcp.write` matches tool identifiers such as mcp__memory__memory_write, which
+// in live events means "the agent is calling a write tool", but in a skill is a documentation
+// mention of a tool by name.
+const SKIP_CORE_FOR_SKILLS = new Set(["instructions.override", "mcp.write"]);
+const TEXT_EXT = /\.(?:md|mdx|txt|json|ya?ml|toml|sh|bash|zsh|py|js|mjs|cjs|ts|rb|ps1)$/i;
+const SKIP_DIR = new Set([".git", "node_modules", ".venv", "__pycache__"]);
+const MAX_FILES = 200;
+const MAX_FILE_BYTES = 500_000;
+async function listFiles(root, dir = root, out = []) {
+    for (const entry of await readdir(dir, { withFileTypes: true })) {
+        if (out.length >= MAX_FILES)
+            break;
+        if (entry.isSymbolicLink() || SKIP_DIR.has(entry.name))
+            continue;
+        const full = join(dir, entry.name);
+        if (entry.isDirectory())
+            await listFiles(root, full, out);
+        else if (entry.isFile())
+            out.push(full);
+    }
+    return out;
+}
+// A finding's identity for review purposes: the rule, the file inside the skill, and the text of
+// the line -- but not the line number, so a "safe" verdict survives the line moving when the skill
+// is edited elsewhere, and stops applying the moment the flagged text itself changes. Computed on
+// the device (where the full text is) and never reversible to the line.
+export function findingFingerprint(f, file) {
+    const text = redact(f.evidence ?? "").replace(/\s+/g, " ").trim().toLowerCase().slice(0, 300);
+    return createHash("sha256").update(`${f.id}|${file}|${text}`).digest("hex").slice(0, 16);
+}
+const lineOf = (content, index) => content.slice(0, index).split("\n").length;
+const snippet = (text) => redact(text.trim().replace(/\s+/g, " ")).slice(0, 200);
+export function scanInjection(content) {
+    const findings = [];
+    const lines = content.split(/\r?\n/);
+    const add = (rule, evidence, line) => findings.push({ id: rule.id, title: rule.title, severity: rule.severity, explanation: rule.explanation, evidence, line });
+    for (const rule of injectionRules) {
+        // These two span lines, so they are matched against the whole file -- but each still points at
+        // the line and text that triggered it, since that is what a reviewer needs to see.
+        if (rule.id === "injection.hidden_comment") {
+            for (const block of content.matchAll(/<!--[\s\S]*?-->/g)) {
+                if (ruleMatches(rule, block[0])) {
+                    add(rule, snippet(block[0]), lineOf(content, block.index ?? 0));
+                    break;
+                }
+            }
+            continue;
+        }
+        if (rule.id === "injection.encoded_payload") {
+            if (!ruleMatches(rule, content))
+                continue;
+            const at = lines.findIndex(l => /\b(?:decode|decrypt|deobfuscate)\b[^\n]{0,60}\b(?:and\s+)?(?:follow|run|execute|obey|apply)\b/i.test(l));
+            add(rule, at >= 0 ? snippet(lines[at]) : "Long encoded string with a decode-and-run instruction", at >= 0 ? at + 1 : 1);
+            continue;
+        }
+        for (let i = 0; i < lines.length; i++) {
+            // A phrase that is only being quoted, refused, or given as an example is not an instruction.
+            const hit = rule.re && rule.context !== false ? firstInstruction(lines[i], rule.re, "phrase", { prev: lines[i - 1], next: lines[i + 1] }) : ruleMatches(rule, lines[i]) ? { index: 0 } : null;
+            if (hit) {
+                add(rule, snippet(lines[i]), i + 1);
+                break;
+            }
+        }
+    }
+    return findings;
+}
+// scanText looks at three-line windows (so a credential on one line and a "send it to" on the next
+// are seen together) and reports the window's first line. For a reviewer that is misleading: the
+// risky text can be two lines further down. When the rule matches a single line on its own, point
+// at that line and show only it; when it needs the lines together, keep the window.
+function narrowToLine(finding, content) {
+    if (!finding.line)
+        return finding;
+    const lines = content.split(/\r?\n/);
+    for (let k = 0; k < 3; k++) {
+        const text = lines[finding.line - 1 + k];
+        if (text !== undefined && detect(text).some(f => f.id === finding.id))
+            return { ...finding, line: finding.line + k, evidence: snippet(text) };
+    }
+    return { ...finding, evidence: snippet(finding.evidence) };
+}
+// Scans every text file in a skill folder -- not just SKILL.md, since bundled scripts and
+// reference docs are loaded or executed by the agent too. Never executes anything.
+export async function scanSkillDir(dir, name) {
+    return scanPaths(dir, name, await listFiles(dir));
+}
+// One markdown file on its own (a stray skills.md), without sweeping its whole parent folder.
+export async function scanSkillFile(file) {
+    return scanPaths(join(file, ".."), basename(file), [file]);
+}
+async function scanPaths(dir, name, paths) {
+    const skipped = [];
+    const files = [];
+    const hash = createHash("sha256");
+    for (const path of paths) {
+        const rel = relative(dir, path);
+        if (!TEXT_EXT.test(path))
+            continue;
+        if ((await stat(path)).size > MAX_FILE_BYTES) {
+            skipped.push(`${rel} (over 500 KB)`);
+            continue;
+        }
+        const content = await readFile(path, "utf8");
+        if (!content.trim())
+            continue;
+        hash.update(`${rel}\0${content}\0`);
+        const findings = [...scanInjection(content), ...scanRisky(content)];
+        try {
+            for (const f of scanText(rel, content, "skill").findings)
+                if (!SKIP_CORE_FOR_SKILLS.has(f.id) && !findings.some(x => x.id === f.id))
+                    findings.push(narrowToLine(f, content));
+        }
+        catch { /* over the scanText size cap; injection rules above still ran */ }
+        files.push({ file: rel, findings });
+    }
+    const fileFindings = files.flatMap(f => f.findings.map(x => ({ ...x, file: f.file })));
+    // Combinations (e.g. sudo in one file, a broad rm in another) are judged over the whole skill or per file, see skill-risk-rules.ts.
+    const combos = comboFindings(files.map(f => ({ file: f.file, ids: new Set(f.findings.map(x => x.id)) })));
+    const findings = [...fileFindings, ...combos]
+        .sort((a, b) => severityRank[b.severity] - severityRank[a.severity]);
+    return { name, dir, hash: hash.digest("hex"), ...skillRiskScore(findings), risk: risk(findings), files, findings, filesScanned: files.length, skipped };
+}
+//# sourceMappingURL=skill-scan.js.map

package/dist/skill-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-scan.js","sourceRoot":"","sources":["../src/skill-scan.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACtD,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,YAAY,EAA+B,MAAM,WAAW,CAAC;AAOtG,MAAM,WAAW,GAAG,CAAC,IAAmB,EAAE,IAAY,EAAE,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AACzK,MAAM,cAAc,GAAoB;IACtC,EAAE,EAAE,EAAE,yBAAyB,EAAE,KAAK,EAAE,gCAAgC,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,sFAAsF,EAAE,EAAE,EAAE,0cAA0c,EAAE;IACrpB,EAAE,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,yCAAyC,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,+GAA+G,EAAE,EAAE,EAAE,iJAAiJ,EAAE;IAC/X,EAAE,EAAE,EAAE,uBAAuB,EAAE,KAAK,EAAE,4CAA4C,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,kFAAkF,EAAE,EAAE,EAAE,0UAA0U,EAAE;IACvhB,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,uCAAuC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,sFAAsF,EAAE,EAAE,EAAE,6QAA6Q,EAAE;IAC7d,EAAE,EAAE,EAAE,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,0BAA0B,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,oHAAoH,EAAE,EAAE,EAAE,qCAAqC,EAAE;IAClR,EAAE,EAAE,EAAE,0BAA0B,EAAE,KAAK,EAAE,qCAAqC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,uFAAuF,EAAE,EAAE,EAAE,2QAA2Q,EAAE;IACzd,EAAE,EAAE,EAAE,2BAA2B,EAAE,KAAK,EAAE,2CAA2C,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,wEAAwE,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,CAAC,8BAA8B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,gGAAgG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;IAChW,EAAE,EAAE,EAAE,6BAA6B,EAAE,KAAK,EAAE,iDAAiD,EAAE,QAAQ,EAAE,UAAU,EAAE,WAAW,EAAE,8FAA8F,EAAE,EAAE,EAAE,wNAAwN,EAAE;CACjc,CAAC;AAEF,8FAA8F;AAC9F,4DAA4D;AAC5D,MAAM,MAAM,GAA6B,EAAE,QAAQ,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;AACxF,MAAM,UAAU,cAAc,CAAC,QAAmB;IAChD,6FAA6F;IAC7F,iGAAiG;IACjG,iGAAiG;IACjG,mEAAmE;IACnE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC;IACtH,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;IAC1H,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAChM,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC;IACzE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AAC5G,CAAC;AAED,qGAAqG;AACrG,8FAA8F;AAC9F,kGAAkG;AAClG,8FAA8F;AAC9F,6BAA6B;AAC7B,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC,CAAC,uBAAuB,EAAE,WAAW,CAAC,CAAC,CAAC;AAE7E,MAAM,QAAQ,GAAG,wEAAwE,CAAC;AAC1F,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,EAAE,OAAO,EAAE,aAAa,CAAC,CAAC,CAAC;AAC3E,MAAM,SAAS,GAAG,GAAG,CAAC;AACtB,MAAM,cAAc,GAAG,OAAO,CAAC;AAK/B,KAAK,UAAU,SAAS,CAAC,IAAY,EAAE,GAAG,GAAG,IAAI,EAAE,MAAgB,EAAE;IACnE,KAAK,MAAM,KAAK,IAAI,MAAM,OAAO,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAChE,IAAI,GAAG,CAAC,MAAM,IAAI,SAAS;YAAE,MAAM;QACnC,IAAI,KAAK,CAAC,cAAc,EAAE,IAAI,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YAAE,SAAS;QACjE,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACnC,IAAI,KAAK,CAAC,WAAW,EAAE;YAAE,MAAM,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;aACrD,IAAI,KAAK,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iGAAiG;AACjG,mGAAmG;AACnG,kGAAkG;AAClG,wEAAwE;AACxE,MAAM,UAAU,kBAAkB,CAAC,CAAmC,EAAE,IAAY;IAClF,MAAM,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC9F,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AAC3F,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,OAAe,EAAE,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;AAC9F,MAAM,OAAO,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAEzF,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,QAAQ,GAAc,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,CAAC,IAAmB,EAAE,QAAgB,EAAE,IAAY,EAAE,EAAE,CAClE,QAAQ,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAC5H,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;QAClC,+FAA+F;QAC/F,mFAAmF;QACnF,IAAI,IAAI,CAAC,EAAE,KAAK,0BAA0B,EAAE,CAAC;YAC3C,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAC,EAAE,CAAC;gBACzD,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;oBAAC,MAAM;gBAAC,CAAC;YAC9G,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,EAAE,KAAK,2BAA2B,EAAE,CAAC;YAC5C,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,OAAO,CAAC;gBAAE,SAAS;YAC1C,MAAM,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,gGAAgG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1I,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,uDAAuD,EAAE,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YACxH,SAAS;QACX,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,6FAA6F;YAC7F,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;YAC9L,IAAI,GAAG,EAAE,CAAC;gBAAC,GAAG,CAAC,IAAI,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;gBAAC,MAAM;YAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,mGAAmG;AACnG,iGAAiG;AACjG,kGAAkG;AAClG,oFAAoF;AACpF,SAAS,YAAY,CAAC,OAAgB,EAAE,OAAe;IACrD,IAAI,CAAC,OAAO,CAAC,IAAI;QAAE,OAAO,OAAO,CAAC;IAClC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACrC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;QACzC,IAAI,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,GAAG,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;IAChJ,CAAC;IACD,OAAO,EAAE,GAAG,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7D,CAAC;AAED,0FAA0F;AAC1F,mFAAmF;AACnF,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,GAAW,EAAE,IAAY;IAC1D,OAAO,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;AACpD,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAAY;IAC9C,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,GAAW,EAAE,IAAY,EAAE,KAAe;IACjE,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,MAAM,KAAK,GAAoB,EAAE,CAAC;IAClC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,SAAS;QACnC,IAAI,CAAC,MAAM,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,cAAc,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,GAAG,GAAG,gBAAgB,CAAC,CAAC;YAAC,SAAS;QAAC,CAAC;QACjG,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE;YAAE,SAAS;QAC9B,IAAI,CAAC,MAAM,CAAC,GAAG,GAAG,KAAK,OAAO,IAAI,CAAC,CAAC;QACpC,MAAM,QAAQ,GAAG,CAAC,GAAG,aAAa,CAAC,OAAO,CAAC,EAAE,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QACpE,IAAI,CAAC;YAAC,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,QAAQ;gBAAE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;oBAAE,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC;QAAC,CAAC;QACrL,MAAM,CAAC,CAAC,iEAAiE,CAAC,CAAC;QAC3E,KAAK,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IACvF,oIAAoI;IACpI,MAAM,MAAM,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1G,MAAM,QAAQ,GAAG,CAAC,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC;SAC1C,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;AAC1J,CAAC"}

package/dist/skill-setup.d.ts

@@ -0,0 +1,11 @@
+import { type SkillSyncResult } from "./skill-sync.js";
+export type SkillSetupResult = {
+    total: number;
+    highRisk: number;
+    searchedHome: boolean;
+    sync: SkillSyncResult;
+};
+export declare function indexAndReportSkills(options: {
+    searchProjects: boolean;
+    home?: string;
+}): Promise<SkillSetupResult>;

package/dist/skill-setup.js

@@ -0,0 +1,26 @@
+import { agentSkillRoots, indexSkills, readInventory } from "./skill-inventory.js";
+import { syncSkillInventory } from "./skill-sync.js";
+// What `beam setup` does about skills: index what is installed and, if this device is connected
+// to a workspace, report the names and risk scores right away instead of waiting for the daily
+// check. The agents' own skill folders are always covered (no macOS folder prompt). Searching the
+// rest of the home folder for skills inside project repos is what raises the "beam would like to
+// access Desktop / Documents / Downloads" prompt, so it only happens when the caller asked for it
+// (setup asks; a non-interactive run does not). Doing it once also switches on the daily
+// whole-home rescan in skill-watch.ts.
+export async function indexAndReportSkills(options) {
+    const roots = await agentSkillRoots(options.home);
+    if (options.searchProjects)
+        await indexSkills({}, options.home);
+    else if (roots.length)
+        await indexSkills({ roots }, options.home);
+    const inventory = await readInventory();
+    const skills = inventory?.skills ?? [];
+    const sync = await syncSkillInventory({ home: options.home }).catch(() => ({ status: "failed", reason: "unexpected error" }));
+    return {
+        total: skills.length,
+        highRisk: skills.filter(s => s.level === "HIGH" || s.level === "CRITICAL").length,
+        searchedHome: options.searchProjects,
+        sync,
+    };
+}
+//# sourceMappingURL=skill-setup.js.map

package/dist/skill-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-setup.js","sourceRoot":"","sources":["../src/skill-setup.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,kBAAkB,EAAwB,MAAM,iBAAiB,CAAC;AAI3E,gGAAgG;AAChG,+FAA+F;AAC/F,kGAAkG;AAClG,iGAAiG;AACjG,kGAAkG;AAClG,yFAAyF;AACzF,uCAAuC;AACvC,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAmD;IAC5F,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAClD,IAAI,OAAO,CAAC,cAAc;QAAE,MAAM,WAAW,CAAC,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;SAC3D,IAAI,KAAK,CAAC,MAAM;QAAE,MAAM,WAAW,CAAC,EAAE,KAAK,EAAE,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,SAAS,GAAG,MAAM,aAAa,EAAE,CAAC;IACxC,MAAM,MAAM,GAAG,SAAS,EAAE,MAAM,IAAI,EAAE,CAAC;IACvC,MAAM,IAAI,GAAG,MAAM,kBAAkB,CAAC,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAoB,EAAE,CAAC,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAC/I,OAAO;QACL,KAAK,EAAE,MAAM,CAAC,MAAM;QACpB,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,MAAM,IAAI,CAAC,CAAC,KAAK,KAAK,UAAU,CAAC,CAAC,MAAM;QACjF,YAAY,EAAE,OAAO,CAAC,cAAc;QACpC,IAAI;KACL,CAAC;AACJ,CAAC"}