@feiyoug/skill-lab 0.0.0

package/esm/_dnt.polyfills.d.ts

@@ -0,0 +1,12 @@
+declare global {
+    interface Object {
+        /**
+         * Determines whether an object has a property with the specified name.
+         * @param o An object.
+         * @param v A property name.
+         */
+        hasOwn(o: object, v: PropertyKey): boolean;
+    }
+}
+export {};
+//# sourceMappingURL=_dnt.polyfills.d.ts.map

package/esm/_dnt.polyfills.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_dnt.polyfills.d.ts","sourceRoot":"","sources":["../src/_dnt.polyfills.ts"],"names":[],"mappings":"AAeA,OAAO,CAAC,MAAM,CAAC;IACb,UAAU,MAAM;QACd;;;;WAIG;QACH,MAAM,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC;KAC5C;CACF;AAED,OAAO,EAAE,CAAC"}

package/esm/_dnt.polyfills.js

@@ -0,0 +1,15 @@
+// https://github.com/tc39/proposal-accessible-object-hasownproperty/blob/main/polyfill.js
+if (!Object.hasOwn) {
+    Object.defineProperty(Object, "hasOwn", {
+        value: function (object, property) {
+            if (object == null) {
+                throw new TypeError("Cannot convert undefined or null to object");
+            }
+            return Object.prototype.hasOwnProperty.call(Object(object), property);
+        },
+        configurable: true,
+        enumerable: false,
+        writable: true,
+    });
+}
+export {};

package/esm/_dnt.shims.d.ts

@@ -0,0 +1,6 @@
+import { Deno } from "@deno/shim-deno";
+export { Deno } from "@deno/shim-deno";
+export declare const dntGlobalThis: Omit<typeof globalThis, "Deno"> & {
+    Deno: typeof Deno;
+};
+//# sourceMappingURL=_dnt.shims.d.ts.map

package/esm/_dnt.shims.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"_dnt.shims.d.ts","sourceRoot":"","sources":["../src/_dnt.shims.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,iBAAiB,CAAC;AAKvC,eAAO,MAAM,aAAa;;CAA2C,CAAC"}

package/esm/_dnt.shims.js

@@ -0,0 +1,61 @@
+import { Deno } from "@deno/shim-deno";
+export { Deno } from "@deno/shim-deno";
+const dntGlobals = {
+    Deno,
+};
+export const dntGlobalThis = createMergeProxy(globalThis, dntGlobals);
+function createMergeProxy(baseObj, extObj) {
+    return new Proxy(baseObj, {
+        get(_target, prop, _receiver) {
+            if (prop in extObj) {
+                return extObj[prop];
+            }
+            else {
+                return baseObj[prop];
+            }
+        },
+        set(_target, prop, value) {
+            if (prop in extObj) {
+                delete extObj[prop];
+            }
+            baseObj[prop] = value;
+            return true;
+        },
+        deleteProperty(_target, prop) {
+            let success = false;
+            if (prop in extObj) {
+                delete extObj[prop];
+                success = true;
+            }
+            if (prop in baseObj) {
+                delete baseObj[prop];
+                success = true;
+            }
+            return success;
+        },
+        ownKeys(_target) {
+            const baseKeys = Reflect.ownKeys(baseObj);
+            const extKeys = Reflect.ownKeys(extObj);
+            const extKeysSet = new Set(extKeys);
+            return [...baseKeys.filter((k) => !extKeysSet.has(k)), ...extKeys];
+        },
+        defineProperty(_target, prop, desc) {
+            if (prop in extObj) {
+                delete extObj[prop];
+            }
+            Reflect.defineProperty(baseObj, prop, desc);
+            return true;
+        },
+        getOwnPropertyDescriptor(_target, prop) {
+            if (prop in extObj) {
+                return Reflect.getOwnPropertyDescriptor(extObj, prop);
+            }
+            else {
+                return Reflect.getOwnPropertyDescriptor(baseObj, prop);
+            }
+        },
+        has(_target, prop) {
+            return prop in extObj || prop in baseObj;
+        },
+    });
+}

package/esm/analyzer/astgrep/client.d.ts

@@ -0,0 +1,35 @@
+import { parse } from "@ast-grep/napi";
+import type { Finding, PermissionScope, Reference, ReferenceType, RuleRiskMapping } from "../../shared/mod.js";
+import { type AstGrepGrammar } from "./registry.js";
+export type AstGrepRule = {
+    id: string;
+    description: string;
+    grammar: AstGrepGrammar;
+    patterns: string[];
+    permission: {
+        tool: string;
+        scope: PermissionScope;
+        permission: string;
+        metadata?: Record<string, string>;
+        mappedRisks?: RuleRiskMapping[];
+    };
+};
+export type AstGrepMatch = {
+    ruleId: string;
+    line: number;
+    lineEnd?: number;
+    extracted: Record<string, unknown>;
+};
+export declare class AstGrepClient {
+    private isLanguageRegistryInitialized;
+    private PARSE_CACHE_BY_GRAMMAR;
+    /** Parse content for direct AST traversal using kind/composite rules. */
+    parse(language: AstGrepRule["grammar"] | "markdown", content: string): ReturnType<typeof parse>;
+    scanWithRules(content: string, language: AstGrepRule["grammar"], rules: AstGrepRule[]): AstGrepMatch[];
+    matchesToFindings(file: string, type: ReferenceType, matches: AstGrepMatch[], referencedBy?: Reference): Finding[];
+    private ensureLanguageRegistry;
+    private stripQuotes;
+    private getParseCache;
+    private hashContent;
+}
+//# sourceMappingURL=client.d.ts.map

package/esm/analyzer/astgrep/client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/analyzer/astgrep/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAA2B,MAAM,gBAAgB,CAAC;AAChE,OAAO,KAAK,EACR,OAAO,EACP,eAAe,EACf,SAAS,EACT,aAAa,EACb,eAAe,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACH,KAAK,cAAc,EAGtB,MAAM,eAAe,CAAC;AAEvB,MAAM,MAAM,WAAW,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,eAAe,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;KACnC,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,CAAC;AAEF,qBAAa,aAAa;IACtB,OAAO,CAAC,6BAA6B,CAAS;IAC9C,OAAO,CAAC,sBAAsB,CAKvB;IAEP,yEAAyE;IAClE,KAAK,CACR,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,UAAU,EAC7C,OAAO,EAAE,MAAM,GAChB,UAAU,CAAC,OAAO,KAAK,CAAC;IAoBpB,aAAa,CAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,EAChC,KAAK,EAAE,WAAW,EAAE,GACrB,YAAY,EAAE;IAyCV,iBAAiB,CACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,YAAY,EAAE,EACvB,YAAY,CAAC,EAAE,SAAS,GACzB,OAAO,EAAE;IAcZ,OAAO,CAAC,sBAAsB;IAY9B,OAAO,CAAC,WAAW;IAQnB,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,WAAW;CAStB"}

package/esm/analyzer/astgrep/client.js

@@ -0,0 +1,118 @@
+import * as dntShim from "../../_dnt.shims.js";
+import { parse, registerDynamicLanguage } from "@ast-grep/napi";
+import { buildBundledRegistrations, buildDevRegistrations, } from "./registry.js";
+export class AstGrepClient {
+    constructor() {
+        Object.defineProperty(this, "isLanguageRegistryInitialized", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
+        Object.defineProperty(this, "PARSE_CACHE_BY_GRAMMAR", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: {}
+        });
+    }
+    /** Parse content for direct AST traversal using kind/composite rules. */
+    parse(language, content) {
+        this.ensureLanguageRegistry();
+        const rootByLen = this.getParseCache(language);
+        const len = content.length;
+        const rootByHash = rootByLen.get(len);
+        if (rootByHash) {
+            const hash = this.hashContent(content);
+            const cached = rootByHash.get(hash);
+            if (cached)
+                return cached;
+        }
+        const ast = parse(language, content);
+        const hash = this.hashContent(content);
+        const bucket = rootByLen.get(len) ?? new Map();
+        bucket.set(hash, ast);
+        rootByLen.set(len, bucket);
+        return ast;
+    }
+    scanWithRules(content, language, rules) {
+        this.ensureLanguageRegistry();
+        const matches = [];
+        try {
+            const ast = this.parse(language, content);
+            const root = ast.root();
+            for (const rule of rules) {
+                for (const pattern of rule.patterns) {
+                    const nodes = root.findAll(pattern);
+                    for (const node of nodes) {
+                        const range = node.range();
+                        const extracted = { pattern };
+                        if (rule.permission.metadata) {
+                            for (const [key, metaVar] of Object.entries(rule.permission.metadata)) {
+                                const varNode = node.getMatch(metaVar);
+                                if (varNode) {
+                                    extracted[key] = this.stripQuotes(varNode.text());
+                                }
+                            }
+                        }
+                        matches.push({
+                            ruleId: rule.id,
+                            line: range.start.line + 1,
+                            lineEnd: range.end.line + 1,
+                            extracted,
+                        });
+                    }
+                }
+            }
+        }
+        catch (error) {
+            throw new Error(`Failed to match rules: ${error}`);
+        }
+        return matches;
+    }
+    matchesToFindings(file, type, matches, referencedBy) {
+        return matches.map((match) => ({
+            ruleId: match.ruleId,
+            reference: {
+                file,
+                line: match.line,
+                lineEnd: match.lineEnd,
+                type,
+                referencedBy,
+            },
+            extracted: match.extracted,
+        }));
+    }
+    ensureLanguageRegistry() {
+        if (this.isLanguageRegistryInitialized)
+            return;
+        const bundledResourceDir = dntShim.Deno.env.get("SKILL_LAB_AST_GREP_RESOURCES_DIR");
+        const registrations = bundledResourceDir
+            ? buildBundledRegistrations(bundledResourceDir)
+            : buildDevRegistrations();
+        registerDynamicLanguage(registrations);
+        this.isLanguageRegistryInitialized = true;
+    }
+    stripQuotes(value) {
+        return value
+            .replace(/^['"`]/, "")
+            .replace(/['"`]$/, "")
+            .replace(/[;,)]+$/, "")
+            .trim();
+    }
+    getParseCache(language) {
+        if (!this.PARSE_CACHE_BY_GRAMMAR[language]) {
+            this.PARSE_CACHE_BY_GRAMMAR[language] = new Map();
+        }
+        return this.PARSE_CACHE_BY_GRAMMAR[language];
+    }
+    hashContent(content) {
+        // FNV-1a 32-bit (fast, non-cryptographic)
+        let hash = 0x811c9dc5;
+        for (let i = 0; i < content.length; i++) {
+            hash ^= content.charCodeAt(i);
+            hash = Math.imul(hash, 0x01000193);
+        }
+        return hash >>> 0;
+    }
+}

package/esm/analyzer/astgrep/mod.d.ts

@@ -0,0 +1,3 @@
+export type { AstGrepMatch, AstGrepRule } from "./client.js";
+export { AstGrepClient } from "./client.js";
+//# sourceMappingURL=mod.d.ts.map

package/esm/analyzer/astgrep/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../src/analyzer/astgrep/mod.ts"],"names":[],"mappings":"AAAA,YAAY,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}

package/esm/analyzer/astgrep/mod.js

@@ -0,0 +1 @@
+export { AstGrepClient } from "./client.js";

package/esm/analyzer/astgrep/registry.d.ts

@@ -0,0 +1,18 @@
+export type AstGrepGrammar = "javascript" | "typescript" | "python" | "bash" | "markdown";
+export type DynamicLangRegistration = {
+    libraryPath: string;
+    extensions: string[];
+    languageSymbol?: string;
+    metaVarChar?: string;
+    expandoChar?: string;
+};
+type AstGrepLanguageSpec = {
+    parserFileName: string;
+    parserTarballUrl: string;
+    developmentRegistration: DynamicLangRegistration;
+};
+export declare const AST_GREP_LANGUAGE_SPECS: Record<AstGrepGrammar, AstGrepLanguageSpec>;
+export declare function buildDevRegistrations(): Record<AstGrepGrammar, DynamicLangRegistration>;
+export declare function buildBundledRegistrations(resourceDir: string): Record<AstGrepGrammar, DynamicLangRegistration>;
+export {};
+//# sourceMappingURL=registry.d.ts.map

package/esm/analyzer/astgrep/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../../src/analyzer/astgrep/registry.ts"],"names":[],"mappings":"AAQA,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;AAE1F,MAAM,MAAM,uBAAuB,GAAG;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB,CAAC;AAEF,KAAK,mBAAmB,GAAG;IACvB,cAAc,EAAE,MAAM,CAAC;IACvB,gBAAgB,EAAE,MAAM,CAAC;IACzB,uBAAuB,EAAE,uBAAuB,CAAC;CACpD,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,MAAM,CAAC,cAAc,EAAE,mBAAmB,CAgC/E,CAAC;AAEF,wBAAgB,qBAAqB,IAAI,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAMvF;AAED,wBAAgB,yBAAyB,CACrC,WAAW,EAAE,MAAM,GACpB,MAAM,CAAC,cAAc,EAAE,uBAAuB,CAAC,CAwBjD"}

package/esm/analyzer/astgrep/registry.js

@@ -0,0 +1,71 @@
+import * as dntShim from "../../_dnt.shims.js";
+import * as bashRegistration from "@ast-grep/lang-bash";
+import * as javascriptRegistration from "@ast-grep/lang-javascript";
+import * as markdownRegistration from "@ast-grep/lang-markdown";
+import * as pythonRegistration from "@ast-grep/lang-python";
+import * as typescriptRegistration from "@ast-grep/lang-typescript";
+import { join } from "../../deps/jsr.io/@std/path/1.1.4/mod.js";
+export const AST_GREP_LANGUAGE_SPECS = {
+    bash: {
+        parserFileName: "bash-parser.so",
+        parserTarballUrl: "https://registry.npmjs.org/@ast-grep/lang-bash/-/lang-bash-0.0.7.tgz",
+        developmentRegistration: bashRegistration.default,
+    },
+    javascript: {
+        parserFileName: "javascript-parser.so",
+        parserTarballUrl: "https://registry.npmjs.org/@ast-grep/lang-javascript/-/lang-javascript-0.0.6.tgz",
+        developmentRegistration: javascriptRegistration
+            .default,
+    },
+    markdown: {
+        parserFileName: "markdown-parser.so",
+        parserTarballUrl: "https://registry.npmjs.org/@ast-grep/lang-markdown/-/lang-markdown-0.0.5.tgz",
+        developmentRegistration: markdownRegistration.default,
+    },
+    python: {
+        parserFileName: "python-parser.so",
+        parserTarballUrl: "https://registry.npmjs.org/@ast-grep/lang-python/-/lang-python-0.0.5.tgz",
+        developmentRegistration: pythonRegistration.default,
+    },
+    typescript: {
+        parserFileName: "typescript-parser.so",
+        parserTarballUrl: "https://registry.npmjs.org/@ast-grep/lang-typescript/-/lang-typescript-0.0.6.tgz",
+        developmentRegistration: typescriptRegistration
+            .default,
+    },
+};
+export function buildDevRegistrations() {
+    const registrations = {};
+    for (const grammar of Object.keys(AST_GREP_LANGUAGE_SPECS)) {
+        registrations[grammar] = AST_GREP_LANGUAGE_SPECS[grammar].developmentRegistration;
+    }
+    return registrations;
+}
+export function buildBundledRegistrations(resourceDir) {
+    const registrations = {};
+    for (const grammar of Object.keys(AST_GREP_LANGUAGE_SPECS)) {
+        const spec = AST_GREP_LANGUAGE_SPECS[grammar];
+        const devRegistration = spec.developmentRegistration;
+        const libraryPath = join(resourceDir, spec.parserFileName);
+        if (!fileExists(libraryPath)) {
+            throw new Error(`Missing ast-grep parser for ${grammar}: ${libraryPath}. Reinstall the CLI release artifact for your platform.`);
+        }
+        registrations[grammar] = {
+            libraryPath,
+            extensions: [...devRegistration.extensions],
+            languageSymbol: devRegistration.languageSymbol,
+            expandoChar: devRegistration.expandoChar,
+            metaVarChar: devRegistration.metaVarChar,
+        };
+    }
+    return registrations;
+}
+function fileExists(path) {
+    try {
+        const stat = dntShim.Deno.statSync(path);
+        return stat.isFile;
+    }
+    catch {
+        return false;
+    }
+}

package/esm/analyzer/config.d.ts

@@ -0,0 +1,27 @@
+import { PermissionScope, Severity } from "../shared/mod.js";
+import type { AnalyzerConfig } from "./types.js";
+export declare const DEFAULT_SKILL_VERSION = "0.0.1";
+export declare const DEFAULT_CONFIG: AnalyzerConfig;
+export declare const ALLOWED_TOOLS_MAPPING: Record<string, {
+    tool: string;
+    scope: PermissionScope;
+    permission: string;
+}>;
+export declare const TOOLS_MAPPING: Record<string, {
+    scope: PermissionScope;
+    permission: string;
+}>;
+export declare const SCORING: {
+    severity: Record<Severity, number>;
+    permissions: Record<string, number>;
+    scopeWildcard: number;
+    uplift: {
+        externalPost: number;
+        pipeToShell: number;
+        multipleCritical: number;
+        secretsInRequest: number;
+    };
+};
+export declare const UNSUPPORTED_SKILL_FRONTMATTER_FIELDS: readonly ["argument-hint", "disable-model-invocation", "user-invocable", "model", "context", "agent", "hooks"];
+export declare const FRONTMATTER_SUPPORTED_FIELDS: readonly ["name", "description", "license", "compatibility", "metadata", "allowed-tools"];
+//# sourceMappingURL=config.d.ts.map

package/esm/analyzer/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/analyzer/config.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC7D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,qBAAqB,UAAU,CAAC;AAE7C,eAAO,MAAM,cAAc,EAAE,cAI5B,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,MAAM,CACtC,MAAM,EACN;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAS/D,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAaxF,CAAC;AAEF,eAAO,MAAM,OAAO;cAKX,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC;iBASxB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;;;;;;;;CAQ9B,CAAC;AAEF,eAAO,MAAM,oCAAoC,gHAQvC,CAAC;AAEX,eAAO,MAAM,4BAA4B,2FAO/B,CAAC"}

package/esm/analyzer/config.js

@@ -0,0 +1,69 @@
+export const DEFAULT_SKILL_VERSION = "0.0.1";
+export const DEFAULT_CONFIG = {
+    maxFileSize: 1_000_000,
+    maxFileCount: 100,
+    maxScanDepth: 5,
+};
+export const ALLOWED_TOOLS_MAPPING = {
+    Bash: { tool: "bash", scope: "sys", permission: "shell" },
+    Read: { tool: "read", scope: "fs", permission: "read" },
+    Write: { tool: "write", scope: "fs", permission: "write" },
+    Edit: { tool: "edit", scope: "fs", permission: "write" },
+    WebFetch: { tool: "webfetch", scope: "net", permission: "fetch" },
+    Fetch: { tool: "fetch", scope: "net", permission: "fetch" },
+    Subprocess: { tool: "subprocess", scope: "sys", permission: "subprocess" },
+};
+export const TOOLS_MAPPING = {
+    gh: { scope: "sys", permission: "shell" },
+    git: { scope: "sys", permission: "shell" },
+    jq: { scope: "sys", permission: "shell" },
+    curl: { scope: "net", permission: "fetch" },
+    wget: { scope: "net", permission: "fetch" },
+    npm: { scope: "sys", permission: "shell" },
+    pnpm: { scope: "sys", permission: "shell" },
+    yarn: { scope: "sys", permission: "shell" },
+    python: { scope: "sys", permission: "shell" },
+    node: { scope: "sys", permission: "shell" },
+    deno: { scope: "sys", permission: "shell" },
+    docker: { scope: "sys", permission: "shell" },
+};
+export const SCORING = {
+    severity: {
+        info: 0,
+        warning: 2,
+        critical: 4,
+    },
+    permissions: {
+        "fs:read": 1,
+        "env:read": 1,
+        "net:fetch": 1,
+        "fs:write": 2,
+        "sys:shell": 2,
+        "sys:subprocess": 2,
+        "sys:sudo": 3,
+    },
+    scopeWildcard: 1,
+    uplift: {
+        externalPost: 2,
+        pipeToShell: 3,
+        multipleCritical: 1,
+        secretsInRequest: 2,
+    },
+};
+export const UNSUPPORTED_SKILL_FRONTMATTER_FIELDS = [
+    "argument-hint",
+    "disable-model-invocation",
+    "user-invocable",
+    "model",
+    "context",
+    "agent",
+    "hooks",
+];
+export const FRONTMATTER_SUPPORTED_FIELDS = [
+    "name",
+    "description",
+    "license",
+    "compatibility",
+    "metadata",
+    "allowed-tools",
+];

package/esm/analyzer/mod.d.ts

@@ -0,0 +1,24 @@
+import type { AnalyzerConfig, AnalyzerResult, AnalyzerState } from "./types.js";
+import type { SkillReaderFactoryOptions } from "../skillreader/factory.js";
+export type { AnalyzerConfig, AnalyzerResult, AnalyzerState } from "./types.js";
+export { DEFAULT_CONFIG, DEFAULT_SKILL_VERSION } from "./config.js";
+export type AnalyzerAnalyzeInput = SkillReaderFactoryOptions & {
+    skillId?: string;
+    skillVersionId?: string;
+    config?: Partial<AnalyzerConfig>;
+};
+export declare class Analyzer {
+    analyze(input: AnalyzerAnalyzeInput): Promise<AnalyzerResult>;
+}
+export declare function runAnalysis(input: {
+    options: SkillReaderFactoryOptions;
+    skillId?: string;
+    skillVersionId?: string;
+    config?: Partial<AnalyzerConfig>;
+}): Promise<AnalyzerResult>;
+export declare function createInitialState(input?: {
+    skillId?: string;
+    skillVersionId?: string;
+    config?: Partial<AnalyzerConfig>;
+}): AnalyzerState;
+//# sourceMappingURL=mod.d.ts.map

package/esm/analyzer/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../src/analyzer/mod.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAK3E,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhF,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG,yBAAyB,GAAG;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACpC,CAAC;AAEF,qBAAa,QAAQ;IACjB,OAAO,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;CAahE;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE;IACrC,OAAO,EAAE,yBAAyB,CAAC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACpC,GAAG,OAAO,CAAC,cAAc,CAAC,CAuB1B;AAED,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACpC,GAAG,aAAa,CAqBhB"}

package/esm/analyzer/mod.js

@@ -0,0 +1,63 @@
+import { DEFAULT_CONFIG, DEFAULT_SKILL_VERSION } from "./config.js";
+import { run001Discovery, run002Permissions, run003Risks } from "./steps/mod.js";
+import { SkillReaderFactory } from "../skillreader/factory.js";
+import { TreesitterClient } from "./treesiter/client.js";
+import { AstGrepClient } from "./astgrep/mod.js";
+export { DEFAULT_CONFIG, DEFAULT_SKILL_VERSION } from "./config.js";
+export class Analyzer {
+    analyze(input) {
+        return runAnalysis({
+            options: {
+                source: input.source,
+                subDir: input.subDir,
+                gitRef: input.gitRef,
+                githubToken: input.githubToken,
+            },
+            skillId: input.skillId,
+            skillVersionId: input.skillVersionId,
+            config: input.config,
+        });
+    }
+}
+export async function runAnalysis(input) {
+    let state = createInitialState({
+        skillId: input.skillId,
+        skillVersionId: input.skillVersionId,
+        config: input.config,
+    });
+    const skillReader = await SkillReaderFactory.create(input.options);
+    const validation = await skillReader.validate();
+    if (!validation.ok) {
+        throw new Error(validation.reason ?? "Invalid skill repository");
+    }
+    const context = {
+        skillReader,
+        treesitterClient: new TreesitterClient(),
+        astgrepClient: new AstGrepClient(),
+    };
+    state = await run001Discovery(state, context);
+    state = await run002Permissions(state, context);
+    return run003Risks(state);
+}
+export function createInitialState(input) {
+    return {
+        skillId: input?.skillId ?? "unknown",
+        skillVersionId: input?.skillVersionId ?? DEFAULT_SKILL_VERSION,
+        files: [],
+        frontmatter: {},
+        scanQueue: [],
+        permissions: [],
+        findings: [],
+        risks: [],
+        warnings: [],
+        metadata: {
+            scannedFiles: [],
+            skippedFiles: [],
+            rulesUsed: [],
+            config: {
+                ...DEFAULT_CONFIG,
+                ...(input?.config ?? {}),
+            },
+        },
+    };
+}

package/esm/analyzer/rules/bash/astTypes.d.ts

@@ -0,0 +1,6 @@
+/** ast-grep node types for Bash (via @ast-grep/lang-bash). */
+export declare const BASH_NODE: {
+    readonly COMMAND: "command";
+    readonly WORD: "word";
+};
+//# sourceMappingURL=astTypes.d.ts.map

package/esm/analyzer/rules/bash/astTypes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"astTypes.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/astTypes.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,eAAO,MAAM,SAAS;;;CAGZ,CAAC"}

package/esm/analyzer/rules/bash/astTypes.js

@@ -0,0 +1,5 @@
+/** ast-grep node types for Bash (via @ast-grep/lang-bash). */
+export const BASH_NODE = {
+    COMMAND: "command",
+    WORD: "word",
+};

package/esm/analyzer/rules/bash/commands/bd.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const BD_RULES: AstGrepRule[];
+//# sourceMappingURL=bd.d.ts.map

package/esm/analyzer/rules/bash/commands/bd.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bd.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/bd.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,QAAQ,EAAE,WAAW,EAoBjC,CAAC"}

package/esm/analyzer/rules/bash/commands/bd.js

@@ -0,0 +1,21 @@
+export const BD_RULES = [
+    {
+        id: "shell-bd",
+        description: "Detects bd task commands",
+        grammar: "bash",
+        patterns: [
+            "bd ready",
+            "bd show $ID",
+            "bd update $ID $$$ARGS",
+            "bd close $ID",
+            "bd sync",
+            "bd create $$$ARGS",
+        ],
+        permission: {
+            tool: "bd",
+            scope: "sys",
+            permission: "shell",
+            metadata: { id: "ID" },
+        },
+    },
+];

package/esm/analyzer/rules/bash/commands/cron.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const CRON_RULES: AstGrepRule[];
+//# sourceMappingURL=cron.d.ts.map

package/esm/analyzer/rules/bash/commands/cron.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cron.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/cron.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,UAAU,EAAE,WAAW,EAkBnC,CAAC"}

package/esm/analyzer/rules/bash/commands/cron.js

@@ -0,0 +1,19 @@
+export const CRON_RULES = [
+    {
+        id: "shell-cron",
+        description: "Detects cron persistence",
+        grammar: "bash",
+        patterns: ["crontab $FILE", "echo $ENTRY | crontab -"],
+        permission: {
+            tool: "crontab",
+            scope: "sys",
+            permission: "shell",
+            metadata: { file: "FILE" },
+            mappedRisks: [{
+                    code: "PERSISTENCE:persistence",
+                    severity: "warning",
+                    message: "Persistence mechanism detected",
+                }],
+        },
+    },
+];

package/esm/analyzer/rules/bash/commands/docker.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const DOCKER_RULES: AstGrepRule[];
+//# sourceMappingURL=docker.d.ts.map

package/esm/analyzer/rules/bash/commands/docker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"docker.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/docker.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,YAAY,EAAE,WAAW,EAkCrC,CAAC"}