@feiyoug/skill-lab 0.0.0 → 0.0.2

package/README.md

@@ -0,0 +1,73 @@
+# Skill Lab
+
+Skill Lab is a toolkit for analyzing and understanding AI agent skills.
+
+It helps to inspect skill behavior before enablement by producing deterministic
+permission and risk output.
+
+The project is still experimental. Feedback and PRs are welcome.
+
+## What it provides
+
+- Deterministic static analysis for skills from local paths or GitHub.
+- Structured `permissions` and `risks` output for review and automation.
+- Aggregate `score`, `riskLevel`, and `summary` for fast triage.
+
+📖 [Documentation](https://skill-lab.pages.dev/)
+
+## Install the CLI (`slab`)
+
+### Homebrew
+
+```bash
+brew tap feiyoug/tap/slab
+```
+
+Or:
+
+```bash
+brew tap feiyoug/tap
+brew install slab
+```
+
+Verify installation:
+
+```bash
+slab --help
+```
+
+For other install options, see [CLI Installation](https://skill-lab.pages.dev/cli/installation).
+
+## Install the library
+
+### npm
+
+```bash
+npm install @FeiyouG/skill-lab
+```
+
+### pnpm
+
+```bash
+pnpm add @FeiyouG/skill-lab
+```
+
+### Deno
+
+```bash
+deno add npm:@FeiyouG/skill-lab
+```
+
+Use in code:
+
+```ts
+import { Analyzer } from "@FeiyouG/skill-lab";
+```
+
+## Quick example
+
+```bash
+slab analyze ./path/to/skill --json
+```
+
+The target directory should contain `SKILL.md` at its root.

package/esm/analyzer/astgrep/client.d.ts

@@ -1,6 +1,8 @@
-import { parse } from "@ast-grep/napi";
+import { parse } from "../../.npm-build-vendor/ast-grep-wasm/mod.js";
 import type { Finding, PermissionScope, Reference, ReferenceType, RuleRiskMapping } from "../../shared/mod.js";
-import { type AstGrepGrammar } from "./registry.js";
+import type { TreesitterGrammar } from "../treesitter/registry.js";
+import type { AnalyzerLogger } from "../types.js";
+export type AstGrepGrammar = Exclude<TreesitterGrammar, "markdown" | "markdown-inline" | "tsx">;
 export type AstGrepRule = {
     id: string;
     description: string;
@@ -20,16 +22,26 @@ export type AstGrepMatch = {
     lineEnd?: number;
     extracted: Record<string, unknown>;
 };
+type SgRoot = ReturnType<typeof parse>;
 export declare class AstGrepClient {
-    private isLanguageRegistryInitialized;
-    private PARSE_CACHE_BY_GRAMMAR;
+    private readonly logger;
+    private readonly showProgressBar;
+    private REGISTERED_GRAMMARS;
+    private SG_ROOT_CACHE_BY_CONTENT;
+    /** Lazy runtime init promise — created on first use, shared across all calls. */
+    private parserInitialized;
+    constructor(logger?: AnalyzerLogger, showProgressBar?: boolean);
     /** Parse content for direct AST traversal using kind/composite rules. */
-    parse(language: AstGrepRule["grammar"] | "markdown", content: string): ReturnType<typeof parse>;
-    scanWithRules(content: string, language: AstGrepRule["grammar"], rules: AstGrepRule[]): AstGrepMatch[];
+    parse(language: AstGrepGrammar, content: string): Promise<SgRoot>;
+    scanWithRules(content: string, language: AstGrepGrammar, rules: AstGrepRule[]): Promise<AstGrepMatch[]>;
     matchesToFindings(file: string, type: ReferenceType, matches: AstGrepMatch[], referencedBy?: Reference): Finding[];
-    private ensureLanguageRegistry;
+    /** Initializes the ast-grep runtime once (without registering grammars yet). */
+    private ensureRuntimeInit;
+    /** Lazily register a single grammar the first time it is needed. */
+    private ensureLanguageRegistered;
     private stripQuotes;
-    private getParseCache;
+    private getSgRootCache;
     private hashContent;
 }
+export {};
 //# sourceMappingURL=client.d.ts.map

package/esm/analyzer/astgrep/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/analyzer/astgrep/client.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAA2B,MAAM,gBAAgB,CAAC;AAChE,OAAO,KAAK,EACR,OAAO,EACP,eAAe,EACf,SAAS,EACT,aAAa,EACb,eAAe,EAClB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACH,KAAK,cAAc,EAGtB,MAAM,eAAe,CAAC;AAEvB,MAAM,MAAM,WAAW,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,eAAe,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;KACnC,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,CAAC;AAEF,qBAAa,aAAa;IACtB,OAAO,CAAC,6BAA6B,CAAS;IAC9C,OAAO,CAAC,sBAAsB,CAKvB;IAEP,yEAAyE;IAClE,KAAK,CACR,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,GAAG,UAAU,EAC7C,OAAO,EAAE,MAAM,GAChB,UAAU,CAAC,OAAO,KAAK,CAAC;IAoBpB,aAAa,CAChB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,WAAW,CAAC,SAAS,CAAC,EAChC,KAAK,EAAE,WAAW,EAAE,GACrB,YAAY,EAAE;IAyCV,iBAAiB,CACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,YAAY,EAAE,EACvB,YAAY,CAAC,EAAE,SAAS,GACzB,OAAO,EAAE;IAcZ,OAAO,CAAC,sBAAsB;IAY9B,OAAO,CAAC,WAAW;IAQnB,OAAO,CAAC,aAAa;IAYrB,OAAO,CAAC,WAAW;CAStB"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../../src/analyzer/astgrep/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAwB,KAAK,EAA2B,MAAM,8CAA8C,CAAC;AACpH,OAAO,KAAK,EACR,OAAO,EACP,eAAe,EACf,SAAS,EACT,aAAa,EACb,eAAe,EAClB,MAAM,qBAAqB,CAAC;AAE7B,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAGlD,MAAM,MAAM,cAAc,GAAG,OAAO,CAAC,iBAAiB,EAAE,UAAU,GAAG,iBAAiB,GAAG,KAAK,CAAC,CAAC;AAEhG,MAAM,MAAM,WAAW,GAAG;IACtB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,cAAc,CAAC;IACxB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,UAAU,EAAE;QACR,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,eAAe,CAAC;QACvB,UAAU,EAAE,MAAM,CAAC;QACnB,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClC,WAAW,CAAC,EAAE,eAAe,EAAE,CAAC;KACnC,CAAC;CACL,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACvB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACtC,CAAC;AAEF,KAAK,MAAM,GAAG,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC;AAGvC,qBAAa,aAAa;IAQlB,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,eAAe;IARpC,OAAO,CAAC,mBAAmB,CAA6B;IACxD,OAAO,CAAC,wBAAwB,CAAoD;IAEpF,iFAAiF;IACjF,OAAO,CAAC,iBAAiB,CAAkB;gBAGtB,MAAM,GAAE,cAA6B,EACrC,eAAe,GAAE,OAAe;IAGrD,yEAAyE;IAC5D,KAAK,CACd,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,MAAM,GAChB,OAAO,CAAC,MAAM,CAAC;IAoBL,aAAa,CACtB,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,WAAW,EAAE,GACrB,OAAO,CAAC,YAAY,EAAE,CAAC;IAyCnB,iBAAiB,CACpB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,aAAa,EACnB,OAAO,EAAE,YAAY,EAAE,EACvB,YAAY,CAAC,EAAE,SAAS,GACzB,OAAO,EAAE;IAcZ,gFAAgF;YAClE,iBAAiB;IAM/B,oEAAoE;YACtD,wBAAwB;IAYtC,OAAO,CAAC,WAAW;IAQnB,OAAO,CAAC,cAAc;IAOtB,OAAO,CAAC,WAAW;CAStB"}

package/esm/analyzer/astgrep/client.js

@@ -1,45 +1,64 @@
-import * as dntShim from "../../_dnt.shims.js";
-import { parse, registerDynamicLanguage } from "@ast-grep/napi";
-import { buildBundledRegistrations, buildDevRegistrations, } from "./registry.js";
+import { initializeTreeSitter, parse, registerDynamicLanguage } from "../../.npm-build-vendor/ast-grep-wasm/mod.js";
+import { ensureGrammar } from "../treesitter/registry.js";
+import { NO_OP_LOGGER } from "../logging.js";
 export class AstGrepClient {
-    constructor() {
-        Object.defineProperty(this, "isLanguageRegistryInitialized", {
+    constructor(logger = NO_OP_LOGGER, showProgressBar = false) {
+        Object.defineProperty(this, "logger", {
             enumerable: true,
             configurable: true,
             writable: true,
-            value: false
+            value: logger
+        });
+        Object.defineProperty(this, "showProgressBar", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: showProgressBar
+        });
+        Object.defineProperty(this, "REGISTERED_GRAMMARS", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: new Set()
         });
-        Object.defineProperty(this, "PARSE_CACHE_BY_GRAMMAR", {
+        Object.defineProperty(this, "SG_ROOT_CACHE_BY_CONTENT", {
             enumerable: true,
             configurable: true,
             writable: true,
             value: {}
         });
+        /** Lazy runtime init promise — created on first use, shared across all calls. */
+        Object.defineProperty(this, "parserInitialized", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: false
+        });
     }
     /** Parse content for direct AST traversal using kind/composite rules. */
-    parse(language, content) {
-        this.ensureLanguageRegistry();
-        const rootByLen = this.getParseCache(language);
+    async parse(language, content) {
+        await this.ensureLanguageRegistered(language);
+        const sgRootByLen = this.getSgRootCache(language);
         const len = content.length;
-        const rootByHash = rootByLen.get(len);
+        const rootByHash = sgRootByLen.get(len);
         if (rootByHash) {
             const hash = this.hashContent(content);
             const cached = rootByHash.get(hash);
             if (cached)
                 return cached;
         }
-        const ast = parse(language, content);
+        const sgRoot = parse(language, content);
         const hash = this.hashContent(content);
-        const bucket = rootByLen.get(len) ?? new Map();
-        bucket.set(hash, ast);
-        rootByLen.set(len, bucket);
-        return ast;
+        const bucket = sgRootByLen.get(len) ?? new Map();
+        bucket.set(hash, sgRoot);
+        sgRootByLen.set(len, bucket);
+        return sgRoot;
     }
-    scanWithRules(content, language, rules) {
-        this.ensureLanguageRegistry();
+    async scanWithRules(content, language, rules) {
+        await this.ensureLanguageRegistered(language);
         const matches = [];
         try {
-            const ast = this.parse(language, content);
+            const ast = await this.parse(language, content);
             const root = ast.root();
             for (const rule of rules) {
                 for (const pattern of rule.patterns) {
@@ -83,15 +102,23 @@ export class AstGrepClient {
             extracted: match.extracted,
         }));
     }
-    ensureLanguageRegistry() {
-        if (this.isLanguageRegistryInitialized)
+    /** Initializes the ast-grep runtime once (without registering grammars yet). */
+    async ensureRuntimeInit() {
+        if (this.parserInitialized)
+            return;
+        await initializeTreeSitter();
+    }
+    /** Lazily register a single grammar the first time it is needed. */
+    async ensureLanguageRegistered(language) {
+        if (this.REGISTERED_GRAMMARS.has(language))
             return;
-        const bundledResourceDir = dntShim.Deno.env.get("SKILL_LAB_AST_GREP_RESOURCES_DIR");
-        const registrations = bundledResourceDir
-            ? buildBundledRegistrations(bundledResourceDir)
-            : buildDevRegistrations();
-        registerDynamicLanguage(registrations);
-        this.isLanguageRegistryInitialized = true;
+        await this.ensureRuntimeInit();
+        const wasmPath = await ensureGrammar(language, {
+            logger: this.logger,
+            showProgressBar: this.showProgressBar,
+        });
+        await registerDynamicLanguage({ [language]: { libraryPath: wasmPath } });
+        this.REGISTERED_GRAMMARS.add(language);
     }
     stripQuotes(value) {
         return value
@@ -100,11 +127,11 @@ export class AstGrepClient {
             .replace(/[;,)]+$/, "")
             .trim();
     }
-    getParseCache(language) {
-        if (!this.PARSE_CACHE_BY_GRAMMAR[language]) {
-            this.PARSE_CACHE_BY_GRAMMAR[language] = new Map();
+    getSgRootCache(language) {
+        if (!this.SG_ROOT_CACHE_BY_CONTENT[language]) {
+            this.SG_ROOT_CACHE_BY_CONTENT[language] = new Map();
         }
-        return this.PARSE_CACHE_BY_GRAMMAR[language];
+        return this.SG_ROOT_CACHE_BY_CONTENT[language];
     }
     hashContent(content) {
         // FNV-1a 32-bit (fast, non-cryptographic)

package/esm/analyzer/config/default.d.ts

@@ -0,0 +1,8 @@
+import type { TreesitterGrammar } from "../treesitter/registry.js";
+import type { AnalyzerConfig, LanguagePolicy, RiskReportConfig } from "./types.js";
+export declare const NODE_BUILTIN_IMPORTS: readonly ["buffer", "child_process", "crypto", "events", "fs", "fs/promises", "http", "https", "os", "path", "stream", "timers", "url", "util", "node:buffer", "node:child_process", "node:crypto", "node:events", "node:fs", "node:fs/promises", "node:http", "node:https", "node:os", "node:path", "node:stream", "node:timers", "node:url", "node:util"];
+export declare const PYTHON_BUILTIN_IMPORTS: readonly ["argparse", "collections", "datetime", "functools", "hashlib", "itertools", "json", "logging", "math", "os", "os.path", "pathlib", "re", "shutil", "subprocess", "sys", "tempfile", "typing", "urllib", "urllib.parse", "urllib.request"];
+export declare const DEFAULT_ALLOWLIST_LANGUAGES: Partial<Record<TreesitterGrammar, LanguagePolicy>>;
+export declare const DEFAULT_RISK_REPORT_CONFIG: Required<RiskReportConfig>;
+export declare const DEFAULT_ANALYZER_CONFIG: AnalyzerConfig;
+//# sourceMappingURL=default.d.ts.map

package/esm/analyzer/config/default.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default.d.ts","sourceRoot":"","sources":["../../../src/analyzer/config/default.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AACnE,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEnF,eAAO,MAAM,oBAAoB,6VA6BvB,CAAC;AAEX,eAAO,MAAM,sBAAsB,qPAsBzB,CAAC;AAEX,eAAO,MAAM,2BAA2B,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAK1F,CAAC;AAEF,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,gBAAgB,CAmBjE,CAAC;AAEF,eAAO,MAAM,uBAAuB,EAAE,cAWrC,CAAC"}

package/esm/analyzer/config/default.js

@@ -0,0 +1,91 @@
+export const NODE_BUILTIN_IMPORTS = [
+    "buffer",
+    "child_process",
+    "crypto",
+    "events",
+    "fs",
+    "fs/promises",
+    "http",
+    "https",
+    "os",
+    "path",
+    "stream",
+    "timers",
+    "url",
+    "util",
+    "node:buffer",
+    "node:child_process",
+    "node:crypto",
+    "node:events",
+    "node:fs",
+    "node:fs/promises",
+    "node:http",
+    "node:https",
+    "node:os",
+    "node:path",
+    "node:stream",
+    "node:timers",
+    "node:url",
+    "node:util",
+];
+export const PYTHON_BUILTIN_IMPORTS = [
+    "argparse",
+    "collections",
+    "datetime",
+    "functools",
+    "hashlib",
+    "itertools",
+    "json",
+    "logging",
+    "math",
+    "os",
+    "os.path",
+    "pathlib",
+    "re",
+    "shutil",
+    "subprocess",
+    "sys",
+    "tempfile",
+    "typing",
+    "urllib",
+    "urllib.parse",
+    "urllib.request",
+];
+export const DEFAULT_ALLOWLIST_LANGUAGES = {
+    javascript: { imports: [...NODE_BUILTIN_IMPORTS] },
+    typescript: { imports: [...NODE_BUILTIN_IMPORTS] },
+    tsx: { imports: [...NODE_BUILTIN_IMPORTS] },
+    python: { imports: [...PYTHON_BUILTIN_IMPORTS] },
+};
+export const DEFAULT_RISK_REPORT_CONFIG = {
+    baseScore: {
+        info: 0,
+        warning: 1,
+        critical: 5,
+    },
+    uplift: {
+        "NETWORK:data_exfiltration": 5,
+        "NETWORK:remote_code_execution": 5,
+        "NETWORK:credential_leak": 7,
+        "NETWORK:localhost_secret_exposure": 2,
+    },
+    thresholds: {
+        safe: 0,
+        caution: 1,
+        attention: 3,
+        risky: 5,
+        avoid: 7,
+    },
+};
+export const DEFAULT_ANALYZER_CONFIG = {
+    scan: {
+        maxFileSize: 1_000_000,
+        maxFileCount: 100,
+        maxScanDepth: 5,
+    },
+    allowlist: {
+        languages: DEFAULT_ALLOWLIST_LANGUAGES,
+    },
+    denylist: undefined,
+    riskReport: DEFAULT_RISK_REPORT_CONFIG,
+};

package/esm/analyzer/config/helpers.d.ts

@@ -0,0 +1,8 @@
+import type { AnalyzerConfig } from "./types.js";
+type DeepPartial<T> = {
+    [K in keyof T]?: T[K] extends Array<infer U> ? Array<U> : T[K] extends Record<string, unknown> ? DeepPartial<T[K]> : T[K];
+};
+export declare function resolveConfig(partial?: Partial<AnalyzerConfig>): AnalyzerConfig;
+export declare function deepMergeJson<T extends Record<string, unknown>>(base: T, override: DeepPartial<T>): T;
+export {};
+//# sourceMappingURL=helpers.d.ts.map

package/esm/analyzer/config/helpers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"helpers.d.ts","sourceRoot":"","sources":["../../../src/analyzer/config/helpers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAa,cAAc,EAAiC,MAAM,YAAY,CAAC;AAE3F,KAAK,WAAW,CAAC,CAAC,IAAI;KACjB,CAAC,IAAI,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,KAAK,CAAC,MAAM,CAAC,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GACjD,CAAC,CAAC,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GACxD,CAAC,CAAC,CAAC,CAAC;CACb,CAAC;AAEF,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,GAAG,cAAc,CAY/E;AAED,wBAAgB,aAAa,CAAC,CAAC,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC3D,IAAI,EAAE,CAAC,EACP,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,GACzB,CAAC,CAqBH"}

package/esm/analyzer/config/helpers.js

@@ -0,0 +1,72 @@
+import { DEFAULT_ANALYZER_CONFIG } from "./default.js";
+export function resolveConfig(partial) {
+    const defaultScan = DEFAULT_ANALYZER_CONFIG.scan ?? {};
+    const partialScan = partial?.scan ?? {};
+    const defaultRiskReport = DEFAULT_ANALYZER_CONFIG.riskReport ?? {};
+    const partialRiskReport = partial?.riskReport ?? {};
+    return {
+        scan: deepMergeJson(defaultScan, partialScan),
+        allowlist: mergeAllowlist(DEFAULT_ANALYZER_CONFIG.allowlist, partial?.allowlist),
+        denylist: mergeAllowlist(DEFAULT_ANALYZER_CONFIG.denylist, partial?.denylist),
+        riskReport: deepMergeJson(defaultRiskReport, partialRiskReport),
+    };
+}
+export function deepMergeJson(base, override) {
+    const result = { ...base };
+    for (const key of Object.keys(override)) {
+        const baseValue = result[key];
+        const overrideValue = override[key];
+        if (overrideValue === undefined)
+            continue;
+        if (isPlainObject(baseValue) && isPlainObject(overrideValue)) {
+            result[key] = deepMergeJson(baseValue, overrideValue);
+            continue;
+        }
+        result[key] = overrideValue;
+    }
+    return result;
+}
+function isPlainObject(value) {
+    if (typeof value !== "object" || value === null)
+        return false;
+    if (Array.isArray(value))
+        return false;
+    return Object.getPrototypeOf(value) === Object.prototype;
+}
+function mergeAllowlist(base, override) {
+    if (!base && !override)
+        return undefined;
+    const languages = mergeLanguagePolicies(base?.languages, override?.languages);
+    const network = mergeNetworkPolicy(base?.network, override?.network);
+    if (!languages && !network)
+        return undefined;
+    return { languages, network };
+}
+function mergeLanguagePolicies(base, override) {
+    if (!base && !override)
+        return undefined;
+    const keys = new Set([
+        ...Object.keys(base ?? {}),
+        ...Object.keys(override ?? {}),
+    ]);
+    const result = {};
+    for (const key of keys) {
+        const imports = mergeStringList(base?.[key]?.imports, override?.[key]?.imports);
+        if (!imports)
+            continue;
+        result[key] = { imports };
+    }
+    return Object.keys(result).length > 0 ? result : undefined;
+}
+function mergeNetworkPolicy(base, override) {
+    if (!base && !override)
+        return undefined;
+    const domains = mergeStringList(base?.domains, override?.domains);
+    return domains ? { domains } : undefined;
+}
+function mergeStringList(base, override) {
+    if (!base && !override)
+        return undefined;
+    const values = new Set([...(base ?? []), ...(override ?? [])]);
+    return values.size > 0 ? [...values] : undefined;
+}

package/esm/analyzer/config/mod.d.ts

@@ -0,0 +1,4 @@
+export * from "./types.js";
+export * from "./default.js";
+export { resolveConfig } from "./helpers.js";
+//# sourceMappingURL=mod.d.ts.map

package/esm/analyzer/config/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../src/analyzer/config/mod.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}

package/esm/analyzer/config/mod.js

@@ -0,0 +1,3 @@
+export * from "./types.js";
+export * from "./default.js";
+export { resolveConfig } from "./helpers.js";

package/esm/analyzer/config/types.d.ts

@@ -0,0 +1,58 @@
+import type { RiskCode } from "../../shared/mod.js";
+import { PermissionScope } from "../../shared/mod.js";
+import type { TreesitterGrammar } from "../treesitter/registry.js";
+export declare const DEFAULT_SKILL_VERSION = "0.0.1";
+export type LanguagePolicy = {
+    imports?: string[];
+};
+export type NetworkPolicy = {
+    domains?: string[];
+};
+export type ScanConfig = {
+    maxFileSize?: number;
+    maxFileCount?: number;
+    maxScanDepth?: number;
+};
+export type Allowlist = {
+    languages?: Partial<Record<TreesitterGrammar, LanguagePolicy>>;
+    network?: NetworkPolicy;
+};
+export type Denylist = {
+    languages?: Partial<Record<TreesitterGrammar, LanguagePolicy>>;
+    network?: NetworkPolicy;
+};
+export type AnalyzerConfig = {
+    scan?: ScanConfig;
+    allowlist?: Allowlist;
+    denylist?: Denylist;
+    riskReport?: RiskReportConfig;
+};
+export type RiskUpliftConfig = Partial<Record<RiskCode, number>>;
+export type RiskThresholdConfig = {
+    safe: number;
+    caution: number;
+    attention: number;
+    risky: number;
+    avoid: number;
+};
+export type RiskReportConfig = {
+    baseScore?: {
+        info?: number;
+        warning?: number;
+        critical?: number;
+    };
+    uplift?: RiskUpliftConfig;
+    thresholds?: Partial<RiskThresholdConfig>;
+};
+export declare const ALLOWED_TOOLS_MAPPING: Record<string, {
+    tool: string;
+    scope: PermissionScope;
+    permission: string;
+}>;
+export declare const TOOLS_MAPPING: Record<string, {
+    scope: PermissionScope;
+    permission: string;
+}>;
+export declare const UNSUPPORTED_SKILL_FRONTMATTER_FIELDS: readonly ["argument-hint", "disable-model-invocation", "user-invocable", "model", "context", "agent", "hooks"];
+export declare const FRONTMATTER_SUPPORTED_FIELDS: readonly ["name", "description", "license", "compatibility", "metadata", "allowed-tools"];
+//# sourceMappingURL=types.d.ts.map

package/esm/analyzer/config/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/analyzer/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnE,eAAO,MAAM,qBAAqB,UAAU,CAAC;AAE7C,MAAM,MAAM,cAAc,GAAG;IACzB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IACxB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;CACtB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,EAAE,aAAa,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACnB,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,iBAAiB,EAAE,cAAc,CAAC,CAAC,CAAC;IAC/D,OAAO,CAAC,EAAE,aAAa,CAAC;CAC3B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IACzB,IAAI,CAAC,EAAE,UAAU,CAAC;IAClB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,UAAU,CAAC,EAAE,gBAAgB,CAAC;CACjC,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;AAEjE,MAAM,MAAM,mBAAmB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC3B,SAAS,CAAC,EAAE;QACR,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,MAAM,CAAC,EAAE,gBAAgB,CAAC;IAC1B,UAAU,CAAC,EAAE,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAC7C,CAAC;AAEF,eAAO,MAAM,qBAAqB,EAAE,MAAM,CACtC,MAAM,EACN;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAS/D,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,MAAM,CAAC,MAAM,EAAE;IAAE,KAAK,EAAE,eAAe,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAaxF,CAAC;AAEF,eAAO,MAAM,oCAAoC,gHAQvC,CAAC;AAEX,eAAO,MAAM,4BAA4B,2FAO/B,CAAC"}

package/esm/analyzer/{config.js → config/types.js}

@@ -1,9 +1,4 @@
 export const DEFAULT_SKILL_VERSION = "0.0.1";
-export const DEFAULT_CONFIG = {
-    maxFileSize: 1_000_000,
-    maxFileCount: 100,
-    maxScanDepth: 5,
-};
 export const ALLOWED_TOOLS_MAPPING = {
     Bash: { tool: "bash", scope: "sys", permission: "shell" },
     Read: { tool: "read", scope: "fs", permission: "read" },
@@ -27,29 +22,6 @@ export const TOOLS_MAPPING = {
     deno: { scope: "sys", permission: "shell" },
     docker: { scope: "sys", permission: "shell" },
 };
-export const SCORING = {
-    severity: {
-        info: 0,
-        warning: 2,
-        critical: 4,
-    },
-    permissions: {
-        "fs:read": 1,
-        "env:read": 1,
-        "net:fetch": 1,
-        "fs:write": 2,
-        "sys:shell": 2,
-        "sys:subprocess": 2,
-        "sys:sudo": 3,
-    },
-    scopeWildcard: 1,
-    uplift: {
-        externalPost: 2,
-        pipeToShell: 3,
-        multipleCritical: 1,
-        secretsInRequest: 2,
-    },
-};
 export const UNSUPPORTED_SKILL_FRONTMATTER_FIELDS = [
     "argument-hint",
     "disable-model-invocation",

package/esm/analyzer/logging.d.ts

@@ -0,0 +1,3 @@
+import type { AnalyzerLogger } from "./types.js";
+export declare const NO_OP_LOGGER: AnalyzerLogger;
+//# sourceMappingURL=logging.d.ts.map

package/esm/analyzer/logging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logging.d.ts","sourceRoot":"","sources":["../../src/analyzer/logging.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD,eAAO,MAAM,YAAY,EAAE,cAK1B,CAAC"}

package/esm/analyzer/logging.js

@@ -0,0 +1,6 @@
+export const NO_OP_LOGGER = {
+    debug: () => { },
+    info: () => { },
+    warn: () => { },
+    error: () => { },
+};

package/esm/analyzer/mod.d.ts

@@ -1,21 +1,28 @@
-import type { AnalyzerConfig, AnalyzerResult, AnalyzerState } from "./types.js";
+import { SkillAnalyzerResult } from "./result.js";
+import type { AnalyzerConfig, AnalyzerLogger, AnalyzerState } from "./types.js";
 import type { SkillReaderFactoryOptions } from "../skillreader/factory.js";
-export type { AnalyzerConfig, AnalyzerResult, AnalyzerState } from "./types.js";
-export { DEFAULT_CONFIG, DEFAULT_SKILL_VERSION } from "./config.js";
+export type { AnalyzerConfig, AnalyzerLogger, AnalyzerState } from "./types.js";
+export type { Allowlist, Denylist, LanguagePolicy, NetworkPolicy, RiskReportConfig, ScanConfig, } from "./config/mod.js";
+export { SkillAnalyzerResult } from "./result.js";
+export { DEFAULT_ANALYZER_CONFIG, DEFAULT_SKILL_VERSION, resolveConfig } from "./config/mod.js";
 export type AnalyzerAnalyzeInput = SkillReaderFactoryOptions & {
     skillId?: string;
     skillVersionId?: string;
     config?: Partial<AnalyzerConfig>;
+    logger?: AnalyzerLogger;
+    showProgressBar?: boolean;
 };
 export declare class Analyzer {
-    analyze(input: AnalyzerAnalyzeInput): Promise<AnalyzerResult>;
+    analyze(input: AnalyzerAnalyzeInput): Promise<SkillAnalyzerResult>;
 }
 export declare function runAnalysis(input: {
     options: SkillReaderFactoryOptions;
     skillId?: string;
     skillVersionId?: string;
     config?: Partial<AnalyzerConfig>;
-}): Promise<AnalyzerResult>;
+    logger?: AnalyzerLogger;
+    showProgressBar?: boolean;
+}): Promise<SkillAnalyzerResult>;
 export declare function createInitialState(input?: {
     skillId?: string;
     skillVersionId?: string;

package/esm/analyzer/mod.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../src/analyzer/mod.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAK3E,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhF,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpE,MAAM,MAAM,oBAAoB,GAAG,yBAAyB,GAAG;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACpC,CAAC;AAEF,qBAAa,QAAQ;IACjB,OAAO,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,cAAc,CAAC;CAahE;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE;IACrC,OAAO,EAAE,yBAAyB,CAAC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACpC,GAAG,OAAO,CAAC,cAAc,CAAC,CAuB1B;AAED,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACpC,GAAG,aAAa,CAqBhB"}
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../src/analyzer/mod.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,KAAK,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,2BAA2B,CAAC;AAK3E,YAAY,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAChF,YAAY,EACR,SAAS,EACT,QAAQ,EACR,cAAc,EACd,aAAa,EACb,gBAAgB,EAChB,UAAU,GACb,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEhG,MAAM,MAAM,oBAAoB,GAAG,yBAAyB,GAAG;IAC3D,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAEF,qBAAa,QAAQ;IACjB,OAAO,CAAC,KAAK,EAAE,oBAAoB,GAAG,OAAO,CAAC,mBAAmB,CAAC;CAerE;AAED,wBAAsB,WAAW,CAAC,KAAK,EAAE;IACrC,OAAO,EAAE,yBAAyB,CAAC;IACnC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;IACjC,MAAM,CAAC,EAAE,cAAc,CAAC;IACxB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC7B,GAAG,OAAO,CAAC,mBAAmB,CAAC,CA+B/B;AAED,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;CACpC,GAAG,aAAa,CAwBhB"}