@aiclude/security-skill 0.1.0

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/SKILL.md

@@ -0,0 +1,57 @@
+# /security-scan - AIclude Security Vulnerability Scanner
+
+AI Agent 시스템에서 사용하는 MCP Server 또는 Skill의 보안 취약점을 검사합니다.
+기존 스캔 결과가 있으면 즉시 반환하고, 없으면 새로 등록하여 스캔을 수행합니다.
+
+## Usage
+
+```
+# 이름으로 보안 검색 (권장 - 기존 스캔 결과 활용)
+/security-scan --name <package-name> [options]
+
+# 로컬 경로 직접 스캔
+/security-scan <target-path> [options]
+```
+
+## Parameters
+
+- `--name`: 검색할 MCP 서버 또는 Skill 이름 (npm 패키지명, GitHub 레포 등)
+- `target-path`: 스캔할 로컬 경로 (--name 대신 사용)
+- `--type`: 대상 유형 (`mcp-server` | `skill`) - 자동 감지됨
+- `--profile`: 샌드박스 프로필 (`strict` | `standard` | `permissive`)
+- `--format`: 리포트 출력 형식 (`markdown` | `json`)
+- `--engines`: 사용할 스캔 엔진 (쉼표 구분)
+
+## Examples
+
+```
+# MCP 서버 보안 검색
+/security-scan --name @anthropic/mcp-server-fetch
+
+# Skill 보안 검색
+/security-scan --name my-awesome-skill --type skill
+
+# 로컬 스캔
+/security-scan ./my-mcp-server
+```
+
+## What It Checks
+
+- **Prompt Injection**: LLM 대상 프롬프트 인젝션 패턴
+- **Tool Poisoning**: 도구 설명에 숨겨진 악성 지시문
+- **Command Injection**: exec/spawn에 검증되지 않은 입력 사용
+- **Supply Chain**: 의존성의 알려진 CVE 및 악성 패키지
+- **Malware**: 백도어, 크립토마이너, 랜섬웨어 탐지
+- **Permission Abuse**: 과도한 파일시스템/네트워크 권한
+
+## Output
+
+리포트에는 다음이 포함됩니다:
+1. **위험 수준 요약** (CRITICAL / HIGH / MEDIUM / LOW / INFO)
+2. **발견된 취약점 목록** (코드 위치, 설명, 심각도)
+3. **사용 리스크 평가** (어떤 위험이 있는지)
+4. **수정 권장사항** (각 취약점별 해결 방법)
+
+## Web Dashboard
+
+모든 스캔 결과는 https://vs.aiclude.com 에서 확인할 수 있습니다.

package/dist/index.d.ts

@@ -0,0 +1,48 @@
+import { ReportFormat, ScanEngineId } from '@asvs/core';
+
+/**
+ * Skill Handler
+ * Processes /security-scan skill invocations from Claude Code
+ * 로컬 경로 스캔 + 이름 기반 API 검색 모두 지원
+ */
+
+interface SkillInvocation {
+    targetPath: string;
+    type?: "mcp-server" | "skill";
+    profile?: "strict" | "standard" | "permissive";
+    format?: ReportFormat;
+    engines?: ScanEngineId[];
+}
+/** API 기반 조회 요청 */
+interface SkillLookupInvocation {
+    name: string;
+    type?: "mcp-server" | "skill";
+    description?: string;
+    repositoryUrl?: string;
+    npmPackage?: string;
+}
+declare class SkillHandler {
+    private scanner;
+    private reporter;
+    private apiBase;
+    constructor();
+    /** API 호출에 사용할 인증 헤더 생성 */
+    private createAuthHeaders;
+    /**
+     * API 기반 보안 스캔 조회/요청
+     * 기존 스캔 결과를 검색하고, 없으면 등록 후 스캔을 요청
+     */
+    lookup(invocation: SkillLookupInvocation): Promise<string>;
+    /** Handle a /security-scan invocation (로컬 경로 스캔) */
+    handle(invocation: SkillInvocation): Promise<string>;
+    /** Auto-detect whether target is an MCP server or skill */
+    private detectTargetType;
+    /** Format the report output with detailed findings */
+    private formatOutput;
+    /** API에서 받은 상세 리포트를 마크다운으로 포맷 */
+    private formatApiReport;
+    /** 스캔 요약만 포맷 */
+    private formatScanSummary;
+}
+
+export { SkillHandler, type SkillInvocation, type SkillLookupInvocation };

package/dist/index.js

@@ -0,0 +1,350 @@
+// src/skill-handler.ts
+import {
+  Scanner,
+  SastEngine,
+  ScaEngine,
+  ToolAnalyzerEngine,
+  MalwareDetectorEngine,
+  PermissionCheckerEngine,
+  DastEngine,
+  BehaviorMonitorEngine,
+  loadGlobalConfig,
+  RiskLevel,
+  validateScanPath
+} from "@asvs/core";
+import { ReportGenerator } from "@asvs/reporter";
+import { existsSync } from "fs";
+import { resolve } from "path";
+import { createHmac } from "crypto";
+var SkillHandler = class {
+  scanner;
+  reporter;
+  apiBase;
+  constructor() {
+    this.scanner = new Scanner();
+    this.reporter = new ReportGenerator();
+    this.apiBase = process.env["ASVS_API_URL"] ?? "https://vs-api.aiclude.com";
+    this.scanner.registerEngine(new SastEngine());
+    this.scanner.registerEngine(new ScaEngine());
+    this.scanner.registerEngine(new ToolAnalyzerEngine());
+    this.scanner.registerEngine(new MalwareDetectorEngine());
+    this.scanner.registerEngine(new PermissionCheckerEngine());
+    this.scanner.registerEngine(new DastEngine());
+    this.scanner.registerEngine(new BehaviorMonitorEngine());
+  }
+  /** API 호출에 사용할 인증 헤더 생성 */
+  createAuthHeaders(name) {
+    const secret = process.env["ASVS_SIGNING_SECRET"] ?? "asvs-default-signing-key-2026";
+    const timestamp = String(Date.now());
+    const payload = `skill:${name}:${timestamp}`;
+    const signature = createHmac("sha256", secret).update(payload).digest("hex");
+    return {
+      "Content-Type": "application/json",
+      "X-ASVS-Source": "skill",
+      "X-ASVS-Timestamp": timestamp,
+      "X-ASVS-Signature": signature
+    };
+  }
+  /**
+   * API 기반 보안 스캔 조회/요청
+   * 기존 스캔 결과를 검색하고, 없으면 등록 후 스캔을 요청
+   */
+  async lookup(invocation) {
+    const apiUrl = `${this.apiBase}/api/v1/scan/lookup`;
+    const lookupRes = await fetch(apiUrl, {
+      method: "POST",
+      headers: this.createAuthHeaders(invocation.name),
+      body: JSON.stringify({
+        name: invocation.name,
+        type: invocation.type ?? "mcp-server",
+        description: invocation.description ?? "",
+        repositoryUrl: invocation.repositoryUrl ?? "",
+        npmPackage: invocation.npmPackage ?? "",
+        source: "skill"
+      })
+    });
+    const lookupData = await lookupRes.json();
+    if (lookupData["status"] === "found") {
+      const report = lookupData["report"];
+      const scan = lookupData["scan"];
+      const target = lookupData["target"];
+      if (report) {
+        return this.formatApiReport(report, target);
+      }
+      return this.formatScanSummary(target, scan);
+    }
+    if (lookupData["status"] === "scanning" || lookupData["status"] === "registered") {
+      const jobId = lookupData["jobId"];
+      const target = lookupData["target"];
+      const maxWait = 12e4;
+      const interval = 5e3;
+      const startTime = Date.now();
+      while (Date.now() - startTime < maxWait) {
+        await new Promise((r) => setTimeout(r, interval));
+        const statusRes = await fetch(`${this.apiBase}/api/v1/scan/status/${jobId}`, {
+          headers: this.createAuthHeaders(invocation.name)
+        });
+        const statusData = await statusRes.json();
+        if (statusData["status"] === "completed") {
+          const report = statusData["report"];
+          const scanResult = statusData["scan"];
+          const completedTarget = statusData["target"];
+          if (report) {
+            return this.formatApiReport(report, completedTarget);
+          }
+          return this.formatScanSummary(completedTarget, scanResult);
+        }
+        if (statusData["status"] === "failed") {
+          const job = statusData["job"];
+          throw new Error(`\uC2A4\uCE94 \uC2E4\uD328: ${job?.["error"] ?? "\uC54C \uC218 \uC5C6\uB294 \uC624\uB958"}`);
+        }
+      }
+      return [
+        `# \uBCF4\uC548 \uC2A4\uCE94 \uC9C4\uD589 \uC911: ${invocation.name}`,
+        "",
+        `\uC2A4\uCE94\uC774 \uC544\uC9C1 \uC9C4\uD589 \uC911\uC785\uB2C8\uB2E4. \uC7A0\uC2DC \uD6C4 \uB2E4\uC2DC \uC2DC\uB3C4\uD558\uC138\uC694.`,
+        `Job ID: ${jobId}`,
+        `\uD0C0\uAC9F: ${target["canonicalName"] ?? invocation.name}`,
+        "",
+        `*\uC0C1\uC138 \uACB0\uACFC\uB294 https://vs.aiclude.com \uC5D0\uC11C \uD655\uC778\uD558\uC138\uC694*`
+      ].join("\n");
+    }
+    return `API \uC751\uB2F5: ${JSON.stringify(lookupData, null, 2)}`;
+  }
+  /** Handle a /security-scan invocation (로컬 경로 스캔) */
+  async handle(invocation) {
+    const config = loadGlobalConfig();
+    const scanConfig = {
+      ...config.defaultScanConfig,
+      ...invocation.profile && { sandboxProfile: invocation.profile },
+      ...invocation.engines && { engines: invocation.engines }
+    };
+    if (!scanConfig.engines.includes("malware-detector")) {
+      scanConfig.engines.push("malware-detector");
+    }
+    const targetPath = validateScanPath(invocation.targetPath);
+    const targetType = invocation.type ?? this.detectTargetType(targetPath);
+    const target = {
+      type: targetType,
+      name: targetPath.split("/").pop() ?? targetPath,
+      path: targetPath
+    };
+    const scanResult = await this.scanner.scan(target, scanConfig);
+    const format = invocation.format ?? "markdown";
+    const report = this.reporter.generate(scanResult, format);
+    return this.formatOutput(report, format, scanResult.engineResults.flatMap((r) => r.vulnerabilities));
+  }
+  /** Auto-detect whether target is an MCP server or skill */
+  detectTargetType(targetPath) {
+    if (existsSync(resolve(targetPath, "SKILL.md")) || targetPath.endsWith("SKILL.md") || targetPath.includes("/skill")) {
+      return "skill";
+    }
+    return "mcp-server";
+  }
+  /** Format the report output with detailed findings */
+  formatOutput(report, format, vulnerabilities) {
+    if (format === "json") {
+      return JSON.stringify(report, null, 2);
+    }
+    const lines = [];
+    const { summary } = report.scanResult;
+    const icon = summary.overallRiskLevel === RiskLevel.CRITICAL ? "[CRITICAL]" : summary.overallRiskLevel === RiskLevel.HIGH ? "[HIGH RISK]" : summary.overallRiskLevel === RiskLevel.MEDIUM ? "[MEDIUM RISK]" : summary.overallRiskLevel === RiskLevel.LOW ? "[LOW RISK]" : "[CLEAN]";
+    lines.push(`# ${icon} Security Scan Report: ${report.title}`);
+    lines.push("");
+    lines.push(`| Metric | Value |`);
+    lines.push(`|--------|-------|`);
+    lines.push(`| Scan Date | ${report.generatedAt} |`);
+    lines.push(`| Target | ${report.scanResult.target.path} |`);
+    lines.push(`| Target Type | ${report.scanResult.target.type} |`);
+    lines.push(`| Overall Risk | **${summary.overallRiskLevel}** |`);
+    lines.push(`| Risk Score | **${summary.overallScore}/100** |`);
+    lines.push(`| Total Findings | ${summary.totalVulnerabilities} |`);
+    lines.push(`| Scan Duration | ${report.scanResult.duration}ms |`);
+    lines.push("");
+    lines.push("## Severity Breakdown");
+    lines.push("");
+    lines.push(`| Severity | Count |`);
+    lines.push(`|----------|-------|`);
+    for (const [level, count] of Object.entries(summary.bySeverity)) {
+      if (count > 0) {
+        lines.push(`| **${level}** | ${count} |`);
+      }
+    }
+    lines.push("");
+    if (vulnerabilities.length > 0) {
+      lines.push("## Detailed Findings");
+      lines.push("");
+      const sorted = [...vulnerabilities].sort((a, b) => {
+        const order = { CRITICAL: 0, HIGH: 1, MEDIUM: 2, LOW: 3, INFO: 4 };
+        return (order[a.severity] ?? 5) - (order[b.severity] ?? 5);
+      });
+      const top = sorted.slice(0, 20);
+      for (let i = 0; i < top.length; i++) {
+        const v = top[i];
+        lines.push(`### ${i + 1}. [${v.severity}] ${v.title}`);
+        lines.push("");
+        lines.push(`- **ID**: ${v.id}`);
+        lines.push(`- **Category**: ${v.category}`);
+        lines.push(`- **Confidence**: ${Math.round(v.confidence * 100)}%`);
+        if (v.location) {
+          lines.push(`- **Location**: \`${v.location.file}:${v.location.line}\``);
+        }
+        lines.push(`- **Description**: ${v.description}`);
+        lines.push(`- **Remediation**: ${v.remediation}`);
+        if (v.cveIds?.length) {
+          lines.push(`- **CVE**: ${v.cveIds.join(", ")}`);
+        }
+        if (v.location?.snippet) {
+          lines.push("");
+          lines.push("```");
+          lines.push(v.location.snippet.substring(0, 300));
+          lines.push("```");
+        }
+        lines.push("");
+      }
+      if (sorted.length > 20) {
+        lines.push(`> ... and ${sorted.length - 20} more findings. Use \`--format json\` for the complete list.`);
+        lines.push("");
+      }
+    }
+    if (report.risks.length > 0) {
+      lines.push("## Risk Assessment");
+      lines.push("");
+      for (const risk of report.risks) {
+        lines.push(`### [${risk.level}] ${risk.area}`);
+        lines.push(`- **Impact**: ${risk.impact}`);
+        lines.push(`- **Likelihood**: ${risk.likelihood}`);
+        lines.push(`- **Remediation**: ${risk.remediation}`);
+        lines.push("");
+      }
+    }
+    if (report.precautions.length > 0) {
+      lines.push("## Precautions & Warnings");
+      lines.push("");
+      for (const precaution of report.precautions) {
+        lines.push(`- ${precaution}`);
+      }
+      lines.push("");
+    }
+    return lines.join("\n");
+  }
+  // -----------------------------------------------------------------------
+  // API 리포트 포맷팅 헬퍼
+  // -----------------------------------------------------------------------
+  /** API에서 받은 상세 리포트를 마크다운으로 포맷 */
+  formatApiReport(report, target) {
+    const lines = [];
+    const scanResult = report["scanResult"];
+    const summary = scanResult?.["summary"];
+    const engineResults = scanResult?.["engineResults"] ?? [];
+    const risks = report["risks"] ?? [];
+    const precautions = report["precautions"] ?? [];
+    const riskLevel = summary?.["overallRiskLevel"] ?? target["riskLevel"] ?? "UNKNOWN";
+    const score = summary?.["overallScore"] ?? target["lastScore"] ?? 0;
+    const totalVulns = summary?.["totalVulnerabilities"] ?? 0;
+    const bySeverity = summary?.["bySeverity"] ?? {};
+    const targetName = target["canonicalName"] ?? target["displayName"] ?? "Unknown";
+    const targetType = target["type"] ?? "mcp-server";
+    const icon = riskLevel === "CRITICAL" ? "[CRITICAL]" : riskLevel === "HIGH" ? "[HIGH RISK]" : riskLevel === "MEDIUM" ? "[MEDIUM RISK]" : riskLevel === "LOW" ? "[LOW RISK]" : "[CLEAN]";
+    lines.push(`# ${icon} Security Scan Report: ${targetName}`);
+    lines.push("");
+    lines.push(`| Metric | Value |`);
+    lines.push(`|--------|-------|`);
+    lines.push(`| Target | ${targetName} |`);
+    lines.push(`| Type | ${targetType} |`);
+    lines.push(`| Overall Risk | **${riskLevel}** |`);
+    lines.push(`| Risk Score | **${score}/100** |`);
+    lines.push(`| Total Findings | ${totalVulns} |`);
+    lines.push(`| Scan Date | ${report["generatedAt"] ?? "N/A"} |`);
+    lines.push("");
+    lines.push("## Severity Breakdown");
+    lines.push("");
+    lines.push("| Severity | Count |");
+    lines.push("|----------|-------|");
+    for (const level of ["CRITICAL", "HIGH", "MEDIUM", "LOW", "INFO"]) {
+      const count = bySeverity[level] ?? 0;
+      if (count > 0) {
+        lines.push(`| **${level}** | ${count} |`);
+      }
+    }
+    lines.push("");
+    const allVulns = engineResults.flatMap(
+      (r) => r["vulnerabilities"] ?? []
+    );
+    if (allVulns.length > 0) {
+      lines.push("## Detailed Findings");
+      lines.push("");
+      const sorted = [...allVulns].sort((a, b) => {
+        const order = { CRITICAL: 0, HIGH: 1, MEDIUM: 2, LOW: 3, INFO: 4 };
+        return (order[a["severity"]] ?? 5) - (order[b["severity"]] ?? 5);
+      });
+      const top = sorted.slice(0, 20);
+      for (let i = 0; i < top.length; i++) {
+        const v = top[i];
+        lines.push(`### ${i + 1}. [${v["severity"]}] ${v["title"]}`);
+        lines.push("");
+        lines.push(`- **Category**: ${v["category"]}`);
+        lines.push(`- **Confidence**: ${Math.round(v["confidence"] * 100)}%`);
+        const loc = v["location"];
+        if (loc) {
+          lines.push(`- **Location**: \`${loc["file"]}:${loc["line"]}\``);
+        }
+        lines.push(`- **Description**: ${v["description"]}`);
+        lines.push(`- **Remediation**: ${v["remediation"]}`);
+        lines.push("");
+      }
+      if (sorted.length > 20) {
+        lines.push(`> ... and ${sorted.length - 20} more findings.`);
+        lines.push("");
+      }
+    }
+    if (risks.length > 0) {
+      lines.push("## Risk Assessment");
+      lines.push("");
+      for (const risk of risks) {
+        lines.push(`### [${risk["level"]}] ${risk["area"]}`);
+        lines.push(`- **Impact**: ${risk["impact"]}`);
+        lines.push(`- **Remediation**: ${risk["remediation"]}`);
+        lines.push("");
+      }
+    }
+    if (precautions.length > 0) {
+      lines.push("## Precautions & Warnings");
+      lines.push("");
+      for (const p of precautions) {
+        lines.push(`- ${p}`);
+      }
+      lines.push("");
+    }
+    lines.push("---");
+    lines.push(`*Report ID: ${report["id"] ?? "N/A"}*`);
+    lines.push(`*Web Dashboard: https://vs.aiclude.com/targets*`);
+    return lines.join("\n");
+  }
+  /** 스캔 요약만 포맷 */
+  formatScanSummary(target, scan) {
+    const lines = [];
+    const targetName = target["canonicalName"] ?? target["displayName"] ?? "Unknown";
+    const riskLevel = scan["riskLevel"] ?? target["riskLevel"] ?? "UNKNOWN";
+    const score = scan["score"] ?? target["lastScore"] ?? 0;
+    lines.push(`# Security Scan Summary: ${targetName}`);
+    lines.push("");
+    lines.push(`| Metric | Value |`);
+    lines.push(`|--------|-------|`);
+    lines.push(`| Risk Level | **${riskLevel}** |`);
+    lines.push(`| Risk Score | **${score}/100** |`);
+    lines.push(`| Total Vulnerabilities | ${scan["totalVulnerabilities"] ?? 0} |`);
+    lines.push(`| CRITICAL | ${scan["criticalCount"] ?? 0} |`);
+    lines.push(`| HIGH | ${scan["highCount"] ?? 0} |`);
+    lines.push(`| MEDIUM | ${scan["mediumCount"] ?? 0} |`);
+    lines.push(`| LOW | ${scan["lowCount"] ?? 0} |`);
+    lines.push(`| INFO | ${scan["infoCount"] ?? 0} |`);
+    lines.push(`| Scanned At | ${scan["scannedAt"] ?? "N/A"} |`);
+    lines.push("");
+    lines.push(`*\uC0C1\uC138 \uB9AC\uD3EC\uD2B8\uB294 https://vs.aiclude.com \uC5D0\uC11C \uD655\uC778\uD558\uC138\uC694*`);
+    return lines.join("\n");
+  }
+};
+export {
+  SkillHandler
+};

package/package.json

@@ -0,0 +1,63 @@
+{
+  "name": "@aiclude/security-skill",
+  "version": "0.1.0",
+  "description": "AIclude Security Vulnerability Scanner - Claude Code Skill for inline security scanning",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./dist/index.js",
+      "types": "./dist/index.d.ts"
+    }
+  },
+  "keywords": [
+    "claude-code",
+    "skill",
+    "security",
+    "vulnerability",
+    "scanner",
+    "ai-agent",
+    "mcp",
+    "aiclude",
+    "sast",
+    "sca",
+    "malware"
+  ],
+  "license": "MIT",
+  "author": "AICLUDE Inc. <dev@aiclude.com>",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/aiclude/asvs"
+  },
+  "homepage": "https://vs.aiclude.com",
+  "bugs": {
+    "url": "https://github.com/aiclude/asvs/issues"
+  },
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "SKILL.md",
+    "README.md",
+    "LICENSE"
+  ],
+  "dependencies": {
+    "@asvs/core": "0.1.0",
+    "@asvs/reporter": "0.1.0"
+  },
+  "devDependencies": {
+    "tsup": "^8.0.0",
+    "typescript": "^5.5.0"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts --format esm --dts",
+    "dev": "tsup src/index.ts --format esm --dts --watch",
+    "test": "vitest run",
+    "clean": "rm -rf dist"
+  }
+}