@feiyoug/skill-lab 0.0.0 → 0.0.2

package/src/analyzer/rules/mod.ts

@@ -0,0 +1,77 @@
+import { BASH_FILETYPE_CONFIS, BASH_RULES } from "./bash/mod.js";
+import {
+    JAVASCRIPT_FILETYPE_CONFIGS,
+    JAVASCRIPT_RULES,
+    TYPESCRIPT_FILETYPE_CONFIGS,
+} from "./javascript/mod.js";
+import { MARKDOWN_FILETYPE_CONFIG, MARKDOWN_RULES } from "./markdown/mod.js";
+import { PYTHON_RULES, PYTHONG_FILETYPE_CONFIGS } from "./python/mod.js";
+import { PROMPT_REGEX_RULES } from "./shared/prompt-injection.js";
+import type { FileRefDiscovery, FileTypeConfig } from "../types.js";
+import { TEXT_FILETYPE_CONFIG, TEXT_RULES } from "./text/mod.js";
+import { TYPESCRIPT_RULES } from "./typescript/mod.js";
+import type { FileType, RuleRiskInput, RuleRiskResult } from "../../shared/mod.js";
+import type { AstGrepRule } from "../astgrep/client.js";
+import type { PromptRegexRule } from "./shared/prompt-injection.js";
+
+// Single registry used for both file-level scanning and code-block scanning.
+export const RULES_BY_FILETYPE: Partial<Record<FileType, readonly AstGrepRule[]>> = {
+    markdown: MARKDOWN_RULES,
+    text: TEXT_RULES,
+    bash: BASH_RULES,
+    javascript: JAVASCRIPT_RULES,
+    typescript: TYPESCRIPT_RULES,
+    python: PYTHON_RULES,
+} as const;
+
+export const FILETYPE_CONFIGS: Record<FileType, FileTypeConfig> = {
+    markdown: MARKDOWN_FILETYPE_CONFIG,
+    text: TEXT_FILETYPE_CONFIG,
+    bash: BASH_FILETYPE_CONFIS,
+    javascript: JAVASCRIPT_FILETYPE_CONFIGS,
+    typescript: TYPESCRIPT_FILETYPE_CONFIGS,
+    python: PYTHONG_FILETYPE_CONFIGS,
+    csv: { defaultLanguage: null },
+    json: { defaultLanguage: null },
+    yaml: { defaultLanguage: null },
+    toml: { defaultLanguage: null },
+    config: { defaultLanguage: null },
+    sql: { defaultLanguage: null },
+    xml: { defaultLanguage: null },
+    binary: { defaultLanguage: null },
+    unknown: { defaultLanguage: null },
+} as const;
+
+export { PROMPT_REGEX_RULES };
+export type { FileRefDiscovery };
+
+export type RiskRuleDefinition = AstGrepRule | PromptRegexRule;
+
+export const RULES_BY_ID: Map<string, RiskRuleDefinition> = new Map(
+    [
+        ...Object.values(RULES_BY_FILETYPE).flatMap((rules) => rules ?? []),
+        ...PROMPT_REGEX_RULES,
+    ].map((rule) => [rule.id, rule] as const),
+);
+
+export function evalRuleRiskMappings(
+    rule: RiskRuleDefinition,
+    input: RuleRiskInput,
+): RuleRiskResult[] {
+    const entries = "permission" in rule
+        ? (rule.permission.mappedRisks ?? [])
+        : (rule.mappedRisks ?? []);
+    const results: RuleRiskResult[] = [];
+
+    for (const entry of entries) {
+        if (typeof entry === "function") {
+            const value = entry(input);
+            if (!value) continue;
+            results.push(...(Array.isArray(value) ? value : [value]));
+            continue;
+        }
+        results.push(entry);
+    }
+
+    return results;
+}

package/src/analyzer/rules/python/astTypes.ts

@@ -0,0 +1,9 @@
+/** ast-grep node types for Python. */
+export const PYTHON_NODE = {
+    IMPORT_STATEMENT: "import_statement",
+    IMPORT_FROM_STATEMENT: "import_from_statement",
+    CALL: "call",
+    STRING: "string",
+    STRING_CONTENT: "string_content",
+    DOTTED_NAME: "dotted_name",
+} as const;

package/src/analyzer/rules/python/extractFileRefs.ts

@@ -0,0 +1,92 @@
+/**
+ * File reference extractor for Python scripts.
+ *
+ * Detects:
+ * - import statements → via: "import"
+ * - from...import statements → via: "import"
+ * - open() calls with host FS paths → via: "bare-path"
+ * - URL string literals (requests.get, urllib, etc.) → via: "url"
+ *
+ * Uses ast-grep AST traversal.
+ */
+
+import { isHostFsPath, isUrl } from "../shared/file-refs.js";
+import type { AnalyzerContext, FileRefDiscovery } from "../../types.js";
+import { PYTHON_NODE } from "./astTypes.js";
+
+export async function extractPythonFileRefs(
+    context: AnalyzerContext,
+    content: string,
+): Promise<FileRefDiscovery[]> {
+    const refs: FileRefDiscovery[] = [];
+
+    const ast = await context.astgrepClient.parse("python", content);
+    const root = ast.root();
+
+    // ── import_statement (e.g. `import os`, `import os.path`) ───────────────
+    const importNodes = root.findAll({ rule: { kind: PYTHON_NODE.IMPORT_STATEMENT } });
+    for (const node of importNodes) {
+        const nameNode = node.find({ rule: { kind: PYTHON_NODE.DOTTED_NAME } });
+        const pkg = nameNode?.text() ?? "";
+        if (pkg) {
+            refs.push({ path: pkg, line: node.range().start.line + 1, via: "import" });
+        }
+    }
+
+    // ── import_from_statement (e.g. `from os.path import join`) ─────────────
+    const fromImportNodes = root.findAll({ rule: { kind: PYTHON_NODE.IMPORT_FROM_STATEMENT } });
+    for (const node of fromImportNodes) {
+        const moduleNode = node.field("module_name");
+        const pkg = moduleNode?.text() ?? "";
+        if (pkg) {
+            refs.push({ path: pkg, line: node.range().start.line + 1, via: "import" });
+        }
+    }
+
+    // ── open("path") ─────────────────────────────────────────────────────────
+    const openCallNodes = root.findAll({
+        rule: {
+            kind: PYTHON_NODE.CALL,
+            has: {
+                field: "function",
+                regex: "^open$",
+                stopBy: "neighbor",
+            },
+        },
+    });
+    for (const node of openCallNodes) {
+        const argsNode = node.field("arguments");
+        if (!argsNode) continue;
+        // string → string_content (Python string has no string_fragment)
+        const strNode = argsNode.find({ rule: { kind: PYTHON_NODE.STRING } });
+        const contentNode = strNode?.find({ rule: { kind: PYTHON_NODE.STRING_CONTENT } });
+        const path = contentNode?.text() ?? "";
+        if (path && isHostFsPath(path)) {
+            refs.push({ path, line: node.range().start.line + 1, via: "bare-path" });
+        }
+    }
+
+    // ── requests.*/urllib.* URL calls ────────────────────────────────────────
+    const httpCallNodes = root.findAll({
+        rule: {
+            kind: PYTHON_NODE.CALL,
+            has: {
+                field: "function",
+                regex: "^(?:requests|urllib)",
+                stopBy: "neighbor",
+            },
+        },
+    });
+    for (const node of httpCallNodes) {
+        const argsNode = node.field("arguments");
+        if (!argsNode) continue;
+        const strNode = argsNode.find({ rule: { kind: PYTHON_NODE.STRING } });
+        const contentNode = strNode?.find({ rule: { kind: PYTHON_NODE.STRING_CONTENT } });
+        const url = contentNode?.text() ?? "";
+        if (url && isUrl(url)) {
+            refs.push({ path: url, line: node.range().start.line + 1, via: "url" });
+        }
+    }
+
+    return refs;
+}

package/src/analyzer/rules/python/mod.ts

@@ -0,0 +1,15 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+import { FileTypeConfig } from "../../types.js";
+import { extractPythonFileRefs } from "./extractFileRefs.js";
+import { PYTHON_NETWORK_RULES } from "./network.js";
+import { PYTHON_SECRET_DETECTION_RULES } from "./secret-detection.js";
+
+export const PYTHON_RULES: AstGrepRule[] = [
+    ...PYTHON_NETWORK_RULES,
+    ...PYTHON_SECRET_DETECTION_RULES,
+];
+
+export const PYTHONG_FILETYPE_CONFIGS: FileTypeConfig = {
+    defaultLanguage: "python",
+    extractFileRefs: extractPythonFileRefs,
+};

package/src/analyzer/rules/python/network.ts

@@ -0,0 +1,26 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+import { DETECT_NETWORK_FETCH_RISKS } from "../shared/network-evaluators.js";
+
+export const PYTHON_NETWORK_RULES: AstGrepRule[] = [
+    {
+        id: "net-requests",
+        description: "Detects Python requests usage",
+        grammar: "python",
+        patterns: [
+            "requests.get($URL)",
+            "requests.post($URL, data=$DATA)",
+            "requests.put($URL, data=$DATA)",
+            "requests.patch($URL, data=$DATA)",
+        ],
+        permission: {
+            tool: "requests",
+            scope: "net",
+            permission: "fetch",
+            metadata: {
+                url: "URL",
+                data: "DATA",
+            },
+            mappedRisks: [DETECT_NETWORK_FETCH_RISKS],
+        },
+    },
+];

package/src/analyzer/rules/python/secret-detection.ts

@@ -0,0 +1,30 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+import { DETECT_SECRET_NAME_RISK } from "../shared/secret-evaluators.js";
+
+export const PYTHON_SECRET_DETECTION_RULES: AstGrepRule[] = [
+    {
+        id: "secret-python-env-read",
+        description: "Detects Python env reads",
+        grammar: "python",
+        patterns: ["os.environ[$KEY]", "os.environ.get($KEY)", "os.getenv($KEY)"],
+        permission: {
+            tool: "env",
+            scope: "env",
+            permission: "read",
+            metadata: { key: "KEY" },
+            mappedRisks: [DETECT_SECRET_NAME_RISK],
+        },
+    },
+    {
+        id: "secret-python-env-write",
+        description: "Detects Python env writes",
+        grammar: "python",
+        patterns: ["os.environ[$KEY] = $VALUE"],
+        permission: {
+            tool: "env",
+            scope: "env",
+            permission: "write",
+            metadata: { key: "KEY" },
+        },
+    },
+];

package/src/analyzer/rules/shared/file-refs.ts

@@ -0,0 +1,38 @@
+/**
+ * Shared types and utilities for file reference discovery across all language extractors.
+ */
+
+import { getFileType } from "../../../shared/mod.js";
+
+/**
+ * Patterns that indicate the referenced path targets the host filesystem
+ * rather than the skill package itself.
+ */
+export const HOST_FS_PATTERNS: RegExp[] = [
+    /^~\//, // ~/... (HOME directory expansion)
+    /^\$[A-Z_][A-Z0-9_]*\//, // $HOME/..., $VAR/... (env var expansion)
+    /^\//, // /absolute/path (absolute path)
+];
+
+/** Returns true if the path targets the host filesystem. */
+export function isHostFsPath(path: string): boolean {
+    return HOST_FS_PATTERNS.some((p) => p.test(path));
+}
+
+/** Returns true if the string looks like a URL. */
+export function isUrl(value: string): boolean {
+    return /^https?:\/\//i.test(value);
+}
+
+/**
+ * Regex pattern for bare relative paths (e.g. references/guide.md, ./script.py).
+ * Used by markdown and text extractors for prose scanning.
+ */
+export const BARE_PATH_PATTERN = /(?:\.\.?\/)?[\w./-]+\.[\w-]+/g;
+
+/** Returns true if the value looks like a file path (not a command or word). */
+export function looksLikePath(value: string): boolean {
+    if (/^\.?\.?\//.test(value)) return true;
+    if (value.includes("/")) return true;
+    return getFileType(value) != "unknown";
+}

package/src/analyzer/rules/shared/network-evaluators.ts

@@ -0,0 +1,107 @@
+import type {
+    DynamicRuleRiskMapping,
+    Permission,
+    RuleRiskResult,
+    StaticRuleRiskMapping,
+} from "../../../shared/mod.js";
+import { classifyDestination, parseUrlFromUnknown } from "../../utils/url-parser.js";
+
+const WRITE_METHODS = new Set(["POST", "PUT", "PATCH"]);
+
+export const DETECT_NETWORK_FETCH_RISKS: DynamicRuleRiskMapping = ({ permission }) => {
+    if (!permission) return null;
+
+    const rawUrl = resolveUrl(permission);
+    if (!rawUrl) return null;
+
+    const parsed = parseUrlFromUnknown(rawUrl);
+    if (!parsed) return null;
+
+    const method = resolveMethod(permission);
+    const destination = classifyDestination(parsed.host);
+    const hasSecretsInRequest = hasSecretInRequest(permission, rawUrl);
+    const results: RuleRiskResult[] = [];
+
+    if (destination === "external") {
+        if (WRITE_METHODS.has(method)) {
+            results.push({
+                code: "NETWORK:data_exfiltration",
+                severity: "critical",
+                message: `Writes data to external host ${parsed.host} via ${method}`,
+                metadata: {
+                    host: parsed.host,
+                    method,
+                    destination,
+                    url: parsed.raw,
+                },
+            });
+        } else {
+            results.push({
+                code: "NETWORK:external_network_access",
+                severity: "warning",
+                message: `Reads from external host ${parsed.host}`,
+                metadata: {
+                    host: parsed.host,
+                    method,
+                    destination,
+                    url: parsed.raw,
+                },
+            });
+        }
+    }
+
+    if (hasSecretsInRequest) {
+        results.push({
+            code: destination === "external"
+                ? "NETWORK:credential_leak"
+                : "NETWORK:localhost_secret_exposure",
+            severity: destination === "external" ? "critical" : "warning",
+            message: `Potential secret transmission detected for ${parsed.host}`,
+            metadata: {
+                host: parsed.host,
+                method,
+                destination,
+                url: parsed.raw,
+            },
+        });
+    }
+
+    if (results.length === 0) return null;
+
+    return results;
+};
+
+export const DETECT_REMOTE_CODE_EXECUTION_RISK: StaticRuleRiskMapping = {
+    code: "NETWORK:remote_code_execution",
+    severity: "critical",
+    message: "Remote output piped to shell",
+};
+
+function resolveUrl(permission: Permission): string | undefined {
+    const metadata = permission.metadata ?? {};
+    if (typeof metadata.url === "string") return metadata.url;
+    if (!Array.isArray(permission.args) || permission.args.length === 0) return undefined;
+    return permission.args.find((arg) => /\.|localhost|\//.test(arg));
+}
+
+function resolveMethod(permission: Permission): string {
+    const metadata = permission.metadata ?? {};
+    const raw = typeof metadata.method === "string"
+        ? metadata.method
+        : inferMethodFromArgs(permission.args);
+    return String(raw).toUpperCase();
+}
+
+function inferMethodFromArgs(args?: string[]): string {
+    if (!args || args.length === 0) return "GET";
+    const explicit = args.find((arg) => /^(get|post|put|patch|delete)$/i.test(arg));
+    return explicit ? explicit.toUpperCase() : "GET";
+}
+
+function hasSecretInRequest(permission: Permission, rawUrl: string): boolean {
+    const metadata = permission.metadata ?? {};
+    const header = String(metadata.header ?? metadata.headers ?? "");
+    return /token|authorization|bearer|api[_-]?key|secret/i.test(
+        `${header} ${rawUrl} ${JSON.stringify(metadata)}`,
+    );
+}

package/src/analyzer/rules/shared/prompt-injection.ts

@@ -0,0 +1,48 @@
+import type { RuleRiskMapping } from "../../../shared/mod.js";
+
+export type PromptRegexRule = {
+    id: string;
+    pattern: RegExp;
+    mappedRisks?: RuleRiskMapping[];
+};
+
+export const PROMPT_REGEX_RULES: PromptRegexRule[] = [
+    {
+        id: "prompt-ignore-previous",
+        pattern: /ignore previous instructions?/i,
+        mappedRisks: [{
+            code: "PROMPT:prompt_override",
+            severity: "critical",
+            message: "Prompt override attempt detected",
+        }],
+    },
+    {
+        id: "prompt-forget-rules",
+        pattern: /forget (all )?(previous|earlier) rules/i,
+        mappedRisks: [{
+            code: "PROMPT:prompt_override",
+            severity: "critical",
+            message: "Prompt override attempt detected",
+        }],
+    },
+    {
+        id: "prompt-reveal-system-prompt",
+        pattern:
+            /(reveal|show|print|dump|leak|disclose|output)\b[\s\S]{0,80}\b(system prompt|hidden instructions?)/i,
+        mappedRisks: [{
+            code: "PROMPT:prompt_override",
+            severity: "warning",
+            message: "Prompt override attempt detected",
+        }],
+    },
+    {
+        id: "prompt-ignore-and-reveal",
+        pattern:
+            /\b(ignore|forget)\b[\s\S]{0,80}\b(previous|earlier)\b[\s\S]{0,80}\b(instructions?|rules?|system prompt)/i,
+        mappedRisks: [{
+            code: "PROMPT:prompt_override",
+            severity: "critical",
+            message: "Prompt override attempt detected",
+        }],
+    },
+];

package/src/analyzer/rules/shared/secret-evaluators.ts

@@ -0,0 +1,13 @@
+import type { DynamicRuleRiskMapping } from "../../../shared/mod.js";
+import { isSecretLikeName, normalizeKeyCandidate } from "../../utils/secret-validator.js";
+
+export const DETECT_SECRET_NAME_RISK: DynamicRuleRiskMapping = ({ finding }) => {
+    const key = normalizeKeyCandidate(finding.extracted.key ?? finding.extracted.var);
+    if (!isSecretLikeName(key)) return null;
+
+    return {
+        code: "SECRETS:secret_access",
+        severity: "warning",
+        message: `Potential secret or credential access: ${key}`,
+    };
+};

package/src/analyzer/rules/text/mod.ts

@@ -0,0 +1,12 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+import { FileTypeConfig } from "../../types.js";
+import { extractCodeBlocks } from "../markdown/extractCodeBlocks.js";
+import { extractMarkdownFileRefs } from "../markdown/extractFileRefs.js";
+
+export const TEXT_RULES: AstGrepRule[] = [];
+
+export const TEXT_FILETYPE_CONFIG: FileTypeConfig = {
+    extractCodeBlocks,
+    defaultLanguage: "markdown",
+    extractFileRefs: extractMarkdownFileRefs,
+};

package/src/analyzer/rules/typescript/mod.ts

@@ -0,0 +1,7 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+import { JAVASCRIPT_RULES } from "../javascript/mod.js";
+
+export const TYPESCRIPT_RULES: AstGrepRule[] = [...JAVASCRIPT_RULES].map((rule) => ({
+    ...rule,
+    language: "typescript",
+}));