@aiclude/security-skill 2.1.0 → 3.0.0

package/README.md

@@ -2,7 +2,7 @@
 
 Security vulnerability scanner for MCP Servers and AI Agent Skills. Provides the `/security-scan` slash command for Claude Code.
 
-Queries the [AIclude scan database](https://vs.aiclude.com) for existing vulnerability reports. If no report exists, the target is automatically registered and scanned server-side.
+Queries the [AICLUDE scan database](https://vs.aiclude.com) for existing vulnerability reports. If no report exists, the target is automatically registered and scanned server-side.
 
 ## Installation
 
@@ -41,7 +41,7 @@ const report = await handler.lookup({
 
 ## How It Works
 
-1. Sends the package name to the AIclude scan API
+1. Sends the package name to the AICLUDE scan API
 2. If a scan report exists, returns it immediately
 3. If not, registers the target for server-side scanning
 4. Waits for the scan to complete and returns the results
@@ -50,7 +50,7 @@ Only the package name and type are sent. No source code, files, or credentials a
 
 ## Server-Side Scan Engines
 
-The AIclude server runs 7 engines on registered targets:
+The AICLUDE server runs 7 engines on registered targets:
 
 | Engine | What It Detects |
 |--------|----------------|
@@ -78,4 +78,4 @@ Reports include:
 
 ## License
 
-MIT — [AICLUDE Inc.](https://aiclude.com)
+Apache 2.0 — [AICLUDE Inc.](https://aiclude.com)

package/SKILL.md

@@ -1,14 +1,14 @@
 ---
 name: aiclude-vulns-scan
-description: Search security vulnerability scan results for MCP Servers and AI Agent Skills from the AIclude scan database.
+description: Search security vulnerability scan results for MCP Servers and AI Agent Skills from the AICLUDE scan database.
 tags: [security, vulnerability, scanner, mcp, ai-agent]
 homepage: https://vs.aiclude.com
 repository: https://github.com/aiclude/asvs
 ---
 
-# /security-scan - AIclude Vulnerability Scanner
+# /security-scan - AICLUDE Vulnerability Scanner
 
-Search the AIclude security scan database for vulnerability reports on MCP Servers and AI Agent Skills. If no report exists, the target is registered and scanned automatically.
+Search the AICLUDE security scan database for vulnerability reports on MCP Servers and AI Agent Skills. If no report exists, the target is registered and scanned automatically.
 
 ## Usage
 
@@ -30,7 +30,7 @@ Search the AIclude security scan database for vulnerability reports on MCP Serve
 
 ## How It Works
 
-1. Sends the package name to the AIclude scan API
+1. Sends the package name to the AICLUDE scan API
 2. If a scan report exists, returns it immediately
 3. If not, registers the target for scanning
 4. Waits for the scan to complete and returns the results
@@ -52,4 +52,4 @@ Only the package name and type are sent. No source code or credentials are trans
 
 ## License
 
-MIT - AICLUDE Inc.
+Apache 2.0 - AICLUDE Inc.

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 /**
  * Skill Handler
- * Processes /security-scan skill invocations from Claude Code
+ * Claude Code의 /security-scan 스킬 호출을 처리합니다.
  * 서버 DB 조회 → 없으면 등록 → 스캔 결과 반환
  */
 interface SkillLookupInvocation {
@@ -11,8 +11,6 @@ interface SkillLookupInvocation {
     npmPackage?: string;
 }
 declare class SkillHandler {
-    /** API 인증 헤더 생성 */
-    private createAuthHeaders;
     /**
      * 보안 스캔 조회/등록
      * 기존 결과 검색 → 없으면 서버에 등록 → 스캔 실행 → 결과 반환
@@ -22,4 +20,36 @@ declare class SkillHandler {
     private formatScanSummary;
 }
 
-export { SkillHandler, type SkillLookupInvocation };
+/**
+ * ASVS 시간 기반 동적 서명 생성
+ *
+ * MCP Server와 Skill이 동일하게 사용하는 인증 헬퍼.
+ * 고정 secret 없이, 타임스탬프에서 파생된 키로 HMAC 서명을 생성합니다.
+ *
+ * 동작 원리:
+ *   1. 타임스탬프를 분 단위로 양자화(quantize)하여 minuteSeed 생성
+ *   2. minuteSeed + 고정 salt("aiclude-vs")로 파생 키(derivedKey) 생성
+ *   3. "asvs:{source}:{name}:{minuteSeed}" 페이로드를 derivedKey로 HMAC-SHA256 서명
+ *
+ * 서버(BE)에서는 동일 로직으로 현재/이전 분 2개 윈도우를 비교하여 검증합니다.
+ * 이 방식으로 5분 이내의 clock drift를 허용합니다.
+ */
+/**
+ * 시간 기반 동적 HMAC-SHA256 서명을 생성합니다.
+ *
+ * @param source - 요청 소스 ("mcp" | "skill" | "cli" | "ci")
+ * @param name - 타겟 이름
+ * @param timestamp - 밀리초 타임스탬프 (기본: 현재 시각)
+ * @returns 서명 문자열 (hex)
+ */
+declare function createDynamicSignature(source: string, name: string, timestamp?: number): string;
+/**
+ * API 요청에 필요한 인증 헤더를 생성합니다.
+ *
+ * @param source - 요청 소스 ("mcp" | "skill")
+ * @param name - 타겟 이름
+ * @returns HTTP 헤더 객체
+ */
+declare function createAuthHeaders(source: string, name: string): Record<string, string>;
+
+export { SkillHandler, type SkillLookupInvocation, createAuthHeaders, createDynamicSignature };

package/dist/index.js

@@ -1,24 +1,33 @@
-// src/skill-handler.ts
+// src/auth.ts
 import { createHmac } from "crypto";
-var API_BASE = "https://vs-api.aiclude.com";
-function createRequestSignature(name, timestamp) {
-  const minuteSeed = Math.floor(Number(timestamp) / 6e4).toString(36);
-  const payload = `asvs:${name}:${minuteSeed}`;
-  const derivedKey = createHmac("sha256", minuteSeed).update("aiclude-vs").digest("hex").slice(0, 32);
-  return createHmac("sha256", derivedKey).update(payload).digest("hex");
+var SALT = "aiclude-vs";
+var WINDOW_MS = 6e4;
+function getMinuteSeed(timestamp) {
+  return Math.floor(timestamp / WINDOW_MS).toString(36);
+}
+function deriveKey(minuteSeed) {
+  return createHmac("sha256", minuteSeed).update(SALT).digest("hex").slice(0, 32);
+}
+function createDynamicSignature(source, name, timestamp = Date.now()) {
+  const minuteSeed = getMinuteSeed(timestamp);
+  const payload = `asvs:${source}:${name}:${minuteSeed}`;
+  const key = deriveKey(minuteSeed);
+  return createHmac("sha256", key).update(payload).digest("hex");
 }
+function createAuthHeaders(source, name) {
+  const timestamp = Date.now();
+  const signature = createDynamicSignature(source, name, timestamp);
+  return {
+    "Content-Type": "application/json",
+    "X-ASVS-Source": source,
+    "X-ASVS-Timestamp": String(timestamp),
+    "X-ASVS-Signature": signature
+  };
+}
+
+// src/skill-handler.ts
+var API_BASE = "https://vs-api.aiclude.com";
 var SkillHandler = class {
-  /** API 인증 헤더 생성 */
-  createAuthHeaders(name) {
-    const timestamp = String(Date.now());
-    const signature = createRequestSignature(name, timestamp);
-    return {
-      "Content-Type": "application/json",
-      "X-ASVS-Source": "skill",
-      "X-ASVS-Timestamp": timestamp,
-      "X-ASVS-Signature": signature
-    };
-  }
   /**
    * 보안 스캔 조회/등록
    * 기존 결과 검색 → 없으면 서버에 등록 → 스캔 실행 → 결과 반환
@@ -27,7 +36,7 @@ var SkillHandler = class {
     const apiUrl = `${API_BASE}/api/v1/scan/lookup`;
     const lookupRes = await fetch(apiUrl, {
       method: "POST",
-      headers: this.createAuthHeaders(invocation.name),
+      headers: createAuthHeaders("skill", invocation.name),
       body: JSON.stringify({
         name: invocation.name,
         type: invocation.type ?? "mcp-server",
@@ -56,7 +65,7 @@ var SkillHandler = class {
       while (Date.now() - startTime < maxWait) {
         await new Promise((r) => setTimeout(r, interval));
         const statusRes = await fetch(`${API_BASE}/api/v1/scan/status/${jobId}`, {
-          headers: this.createAuthHeaders(invocation.name)
+          headers: createAuthHeaders("skill", invocation.name)
         });
         const statusData = await statusRes.json();
         if (statusData["status"] === "completed") {
@@ -198,5 +207,7 @@ var SkillHandler = class {
   }
 };
 export {
-  SkillHandler
+  SkillHandler,
+  createAuthHeaders,
+  createDynamicSignature
 };

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@aiclude/security-skill",
-  "version": "2.1.0",
-  "description": "AIclude Security Vulnerability Scanner - Claude Code Skill for querying the AIclude scan database",
+  "version": "3.0.0",
+  "description": "AICLUDE Security Vulnerability Scanner - Claude Code Skill for querying the AICLUDE scan database",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -24,7 +24,7 @@
     "sca",
     "malware"
   ],
-  "license": "MIT",
+  "license": "Apache-2.0",
   "author": "AICLUDE Inc. <dev@aiclude.com>",
   "repository": {
     "type": "git",
@@ -53,9 +53,10 @@
     "clean": "rm -rf dist",
     "prepublishOnly": "npm run build"
   },
-  "dependencies": {},
   "devDependencies": {
+    "@types/node": "^25.2.3",
     "tsup": "^8.0.0",
-    "typescript": "^5.5.0"
+    "typescript": "^5.5.0",
+    "vitest": "^4.0.18"
   }
 }