@feiyoug/skill-lab 0.0.0

package/esm/analyzer/rules/bash/commands/docker.js

@@ -0,0 +1,35 @@
+export const DOCKER_RULES = [
+    {
+        id: "shell-docker",
+        description: "Detects docker commands",
+        grammar: "bash",
+        patterns: [
+            "docker run $$$ARGS",
+            "docker exec $$$ARGS",
+            "docker build $$$ARGS",
+            "docker pull $$$ARGS",
+            "docker push $$$ARGS",
+        ],
+        permission: {
+            tool: "docker",
+            scope: "sys",
+            permission: "shell",
+        },
+    },
+    {
+        id: "shell-docker-compose",
+        description: "Detects docker compose commands",
+        grammar: "bash",
+        patterns: [
+            "docker-compose up $$$ARGS",
+            "docker-compose down $$$ARGS",
+            "docker compose up $$$ARGS",
+            "docker compose down $$$ARGS",
+        ],
+        permission: {
+            tool: "docker-compose",
+            scope: "sys",
+            permission: "shell",
+        },
+    },
+];

package/esm/analyzer/rules/bash/commands/eval.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const EVAL_RULES: AstGrepRule[];
+//# sourceMappingURL=eval.d.ts.map

package/esm/analyzer/rules/bash/commands/eval.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"eval.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/eval.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,UAAU,EAAE,WAAW,EAiDnC,CAAC"}

package/esm/analyzer/rules/bash/commands/eval.js

@@ -0,0 +1,50 @@
+export const EVAL_RULES = [
+    {
+        id: "shell-eval",
+        description: "Detects eval execution",
+        grammar: "bash",
+        patterns: ["eval $CMD", 'eval "$CMD"', "eval '$CMD'"],
+        permission: {
+            tool: "eval",
+            scope: "sys",
+            permission: "shell",
+            metadata: { command: "CMD" },
+        },
+    },
+    {
+        id: "shell-sh-c",
+        description: "Detects sh -c execution",
+        grammar: "bash",
+        patterns: ["sh -c $CMD", 'sh -c "$CMD"', "sh -c '$CMD'"],
+        permission: {
+            tool: "sh",
+            scope: "sys",
+            permission: "shell",
+            metadata: { command: "CMD" },
+        },
+    },
+    {
+        id: "shell-bash-c",
+        description: "Detects bash -c execution",
+        grammar: "bash",
+        patterns: ["bash -c $CMD", 'bash -c "$CMD"', "bash -c '$CMD'"],
+        permission: {
+            tool: "bash",
+            scope: "sys",
+            permission: "shell",
+            metadata: { command: "CMD" },
+        },
+    },
+    {
+        id: "shell-source",
+        description: "Detects source command",
+        grammar: "bash",
+        patterns: ["source $FILE", ". $FILE"],
+        permission: {
+            tool: "source",
+            scope: "fs",
+            permission: "read",
+            metadata: { file: "FILE" },
+        },
+    },
+];

package/esm/analyzer/rules/bash/commands/generic.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const GENERIC_SHELL_RULES: AstGrepRule[];
+//# sourceMappingURL=generic.d.ts.map

package/esm/analyzer/rules/bash/commands/generic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/generic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,mBAAmB,EAAE,WAAW,EAa5C,CAAC"}

package/esm/analyzer/rules/bash/commands/generic.js

@@ -0,0 +1,14 @@
+export const GENERIC_SHELL_RULES = [
+    {
+        id: "shell-generic-command",
+        description: "Catches unrecognized shell command invocations",
+        grammar: "bash",
+        patterns: ["$TOOL $$$ARGS"],
+        permission: {
+            tool: "detected",
+            scope: "sys",
+            permission: "shell",
+            metadata: { tool: "TOOL", args: "ARGS" },
+        },
+    },
+];

package/esm/analyzer/rules/bash/commands/gh.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const GH_RULES: AstGrepRule[];
+//# sourceMappingURL=gh.d.ts.map

package/esm/analyzer/rules/bash/commands/gh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gh.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/gh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,QAAQ,EAAE,WAAW,EAkBjC,CAAC"}

package/esm/analyzer/rules/bash/commands/gh.js

@@ -0,0 +1,19 @@
+export const GH_RULES = [
+    {
+        id: "shell-gh",
+        description: "Detects GitHub CLI commands",
+        grammar: "bash",
+        patterns: [
+            "gh pr $$$ARGS",
+            "gh issue $$$ARGS",
+            "gh repo $$$ARGS",
+            "gh api $$$ARGS",
+            "gh auth $$$ARGS",
+        ],
+        permission: {
+            tool: "gh",
+            scope: "sys",
+            permission: "shell",
+        },
+    },
+];

package/esm/analyzer/rules/bash/commands/git.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const GIT_RULES: AstGrepRule[];
+//# sourceMappingURL=git.d.ts.map

package/esm/analyzer/rules/bash/commands/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/git.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,SAAS,EAAE,WAAW,EAyBlC,CAAC"}

package/esm/analyzer/rules/bash/commands/git.js

@@ -0,0 +1,26 @@
+export const GIT_RULES = [
+    {
+        id: "shell-git",
+        description: "Detects git commands",
+        grammar: "bash",
+        patterns: [
+            "git status",
+            "git add $PATH",
+            "git commit $$$ARGS",
+            "git pull $$$ARGS",
+            "git push $$$ARGS",
+            "git checkout $BRANCH",
+            "git merge $BRANCH",
+            "git rebase $BRANCH",
+            "git clone $URL",
+            "git fetch $$$ARGS",
+            "git log $$$ARGS",
+        ],
+        permission: {
+            tool: "git",
+            scope: "sys",
+            permission: "shell",
+            metadata: { url: "URL", branch: "BRANCH", path: "PATH" },
+        },
+    },
+];

package/esm/analyzer/rules/bash/commands/mod.d.ts

@@ -0,0 +1,13 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export * from "./bd.js";
+export * from "./cron.js";
+export * from "./docker.js";
+export * from "./eval.js";
+export * from "./generic.js";
+export * from "./gh.js";
+export * from "./git.js";
+export * from "./node.js";
+export * from "./openspec.js";
+export * from "./sudo.js";
+export declare const BASH_COMMAND_RULES: AstGrepRule[];
+//# sourceMappingURL=mod.d.ts.map

package/esm/analyzer/rules/bash/commands/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/mod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAY9D,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAE1B,eAAO,MAAM,kBAAkB,EAAE,WAAW,EAW3C,CAAC"}

package/esm/analyzer/rules/bash/commands/mod.js

@@ -0,0 +1,32 @@
+import { BD_RULES } from "./bd.js";
+import { CRON_RULES } from "./cron.js";
+import { DOCKER_RULES } from "./docker.js";
+import { EVAL_RULES } from "./eval.js";
+import { GENERIC_SHELL_RULES } from "./generic.js";
+import { GH_RULES } from "./gh.js";
+import { GIT_RULES } from "./git.js";
+import { NODE_ECOSYSTEM_RULES } from "./node.js";
+import { OPENSPEC_RULES } from "./openspec.js";
+import { SUDO_RULES } from "./sudo.js";
+export * from "./bd.js";
+export * from "./cron.js";
+export * from "./docker.js";
+export * from "./eval.js";
+export * from "./generic.js";
+export * from "./gh.js";
+export * from "./git.js";
+export * from "./node.js";
+export * from "./openspec.js";
+export * from "./sudo.js";
+export const BASH_COMMAND_RULES = [
+    ...GIT_RULES,
+    ...GH_RULES,
+    ...NODE_ECOSYSTEM_RULES,
+    ...DOCKER_RULES,
+    ...BD_RULES,
+    ...SUDO_RULES,
+    ...EVAL_RULES,
+    ...OPENSPEC_RULES,
+    ...CRON_RULES,
+    ...GENERIC_SHELL_RULES,
+];

package/esm/analyzer/rules/bash/commands/node.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const NODE_ECOSYSTEM_RULES: AstGrepRule[];
+//# sourceMappingURL=node.d.ts.map

package/esm/analyzer/rules/bash/commands/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,oBAAoB,EAAE,WAAW,EA6D7C,CAAC"}

package/esm/analyzer/rules/bash/commands/node.js

@@ -0,0 +1,62 @@
+export const NODE_ECOSYSTEM_RULES = [
+    {
+        id: "shell-npm",
+        description: "Detects npm commands",
+        grammar: "bash",
+        patterns: ["npm $SUB $$$ARGS"],
+        permission: {
+            tool: "npm",
+            scope: "sys",
+            permission: "shell",
+            metadata: { subcommand: "SUB" },
+        },
+    },
+    {
+        id: "shell-pnpm",
+        description: "Detects pnpm commands",
+        grammar: "bash",
+        patterns: ["pnpm $SUB $$$ARGS"],
+        permission: {
+            tool: "pnpm",
+            scope: "sys",
+            permission: "shell",
+            metadata: { subcommand: "SUB" },
+        },
+    },
+    {
+        id: "shell-yarn",
+        description: "Detects yarn commands",
+        grammar: "bash",
+        patterns: ["yarn $SUB $$$ARGS"],
+        permission: {
+            tool: "yarn",
+            scope: "sys",
+            permission: "shell",
+            metadata: { subcommand: "SUB" },
+        },
+    },
+    {
+        id: "shell-deno",
+        description: "Detects deno commands",
+        grammar: "bash",
+        patterns: ["deno $SUB $$$ARGS"],
+        permission: {
+            tool: "deno",
+            scope: "sys",
+            permission: "shell",
+            metadata: { subcommand: "SUB" },
+        },
+    },
+    {
+        id: "shell-node",
+        description: "Detects node commands",
+        grammar: "bash",
+        patterns: ["node $FILE $$$ARGS"],
+        permission: {
+            tool: "node",
+            scope: "sys",
+            permission: "shell",
+            metadata: { file: "FILE" },
+        },
+    },
+];

package/esm/analyzer/rules/bash/commands/openspec.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const OPENSPEC_RULES: AstGrepRule[];
+//# sourceMappingURL=openspec.d.ts.map

package/esm/analyzer/rules/bash/commands/openspec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openspec.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/openspec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,cAAc,EAAE,WAAW,EAavC,CAAC"}

package/esm/analyzer/rules/bash/commands/openspec.js

@@ -0,0 +1,14 @@
+export const OPENSPEC_RULES = [
+    {
+        id: "shell-openspec",
+        description: "Detects openspec commands",
+        grammar: "bash",
+        patterns: ["openspec $SUB $$$ARGS"],
+        permission: {
+            tool: "openspec",
+            scope: "sys",
+            permission: "shell",
+            metadata: { subcommand: "SUB" },
+        },
+    },
+];

package/esm/analyzer/rules/bash/commands/sudo.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const SUDO_RULES: AstGrepRule[];
+//# sourceMappingURL=sudo.d.ts.map

package/esm/analyzer/rules/bash/commands/sudo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/sudo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,UAAU,EAAE,WAAW,EAkBnC,CAAC"}

package/esm/analyzer/rules/bash/commands/sudo.js

@@ -0,0 +1,19 @@
+export const SUDO_RULES = [
+    {
+        id: "shell-sudo",
+        description: "Detects sudo usage",
+        grammar: "bash",
+        patterns: ["sudo $CMD $$$ARGS"],
+        permission: {
+            tool: "sudo",
+            scope: "sys",
+            permission: "sudo",
+            metadata: { command: "CMD" },
+            mappedRisks: [{
+                    code: "PRIVILEGE:privilege_escalation",
+                    severity: "critical",
+                    message: "Privilege escalation via sudo",
+                }],
+        },
+    },
+];

package/esm/analyzer/rules/bash/destructive.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+export declare const BASH_DESTRUCTIVE_RULES: AstGrepRule[];
+//# sourceMappingURL=destructive.d.ts.map

package/esm/analyzer/rules/bash/destructive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destructive.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/destructive.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,eAAO,MAAM,sBAAsB,EAAE,WAAW,EAyB/C,CAAC"}

package/esm/analyzer/rules/bash/destructive.js

@@ -0,0 +1,26 @@
+export const BASH_DESTRUCTIVE_RULES = [
+    {
+        id: "destructive-format",
+        description: "Detects disk format commands",
+        grammar: "bash",
+        patterns: ["mkfs $DEVICE", "format $DEVICE"],
+        permission: {
+            tool: "format",
+            scope: "fs",
+            permission: "write",
+            metadata: { device: "DEVICE" },
+        },
+    },
+    {
+        id: "destructive-config-write",
+        description: "Detects config file overwrite",
+        grammar: "bash",
+        patterns: ["echo $VALUE > $FILE"],
+        permission: {
+            tool: "write",
+            scope: "fs",
+            permission: "write",
+            metadata: { file: "FILE" },
+        },
+    },
+];

package/esm/analyzer/rules/bash/extractFileRefs.d.ts

@@ -0,0 +1,13 @@
+/**
+ * File reference extractor for Bash/shell scripts.
+ *
+ * Detects:
+ * - External URLs referenced via curl/wget → via: "url"
+ * - Local file includes via source/. → via: "source"
+ * - Host filesystem paths in command arguments → via: "bare-path"
+ *
+ * Uses ast-grep AST traversal on `command` nodes.
+ */
+import type { AnalyzerContext, FileRefDiscovery } from "../../types.js";
+export declare function extractBashFileRefs(context: AnalyzerContext, content: string): FileRefDiscovery[];
+//# sourceMappingURL=extractFileRefs.d.ts.map

package/esm/analyzer/rules/bash/extractFileRefs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGxE,wBAAgB,mBAAmB,CAC/B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,gBAAgB,EAAE,CAkFpB"}

package/esm/analyzer/rules/bash/extractFileRefs.js

@@ -0,0 +1,85 @@
+/**
+ * File reference extractor for Bash/shell scripts.
+ *
+ * Detects:
+ * - External URLs referenced via curl/wget → via: "url"
+ * - Local file includes via source/. → via: "source"
+ * - Host filesystem paths in command arguments → via: "bare-path"
+ *
+ * Uses ast-grep AST traversal on `command` nodes.
+ */
+import { isHostFsPath, isUrl, looksLikePath } from "../shared/file-refs.js";
+import { BASH_NODE } from "./astTypes.js";
+export function extractBashFileRefs(context, content) {
+    const refs = [];
+    const ast = context.astgrepClient.parse("bash", content);
+    const root = ast.root();
+    const commandNodes = root.findAll({ rule: { kind: BASH_NODE.COMMAND } });
+    for (const node of commandNodes) {
+        const line = node.range().start.line + 1;
+        const nameNode = node.field("name");
+        const commandName = nameNode?.text() ?? "";
+        // ── source / . includes ──────────────────────────────────────────────
+        if (commandName === "source" || commandName === ".") {
+            const argNode = node.field("argument");
+            const path = argNode?.text() ?? "";
+            if (path && looksLikePath(path)) {
+                refs.push({ path, line, via: "source" });
+            }
+            continue;
+        }
+        // ── curl / wget URLs ─────────────────────────────────────────────────
+        if (commandName === "curl" || commandName === "wget") {
+            // All word children — find URL args
+            const wordNodes = node.findAll({ rule: { kind: BASH_NODE.WORD } });
+            for (const word of wordNodes) {
+                const text = word.text();
+                if (isUrl(text)) {
+                    refs.push({ path: text, line, via: "url" });
+                }
+            }
+            continue;
+        }
+        // ── file operation commands ──────────────────────────────────────────
+        const FILE_CMDS = new Set([
+            "cat",
+            "cp",
+            "mv",
+            "ln",
+            "touch",
+            "mkdir",
+            "rm",
+            "chmod",
+            "chown",
+            "open",
+            "exec",
+            "read",
+        ]);
+        if (FILE_CMDS.has(commandName)) {
+            const wordNodes = node.findAll({ rule: { kind: BASH_NODE.WORD } });
+            for (const word of wordNodes) {
+                const text = word.text();
+                // Skip flags and the command name itself
+                if (text === commandName || text.startsWith("-"))
+                    continue;
+                if (isHostFsPath(text)) {
+                    refs.push({ path: text, line, via: "bare-path" });
+                }
+            }
+            continue;
+        }
+        // ── command itself is a script path (e.g. `scripts/run.py`) ─────────
+        if (looksLikePath(commandName) && !isUrl(commandName)) {
+            refs.push({ path: commandName, line, via: "bare-path" });
+        }
+        // ── default: check first argument for path-like value ────────────────
+        const argNode = node.field("argument");
+        if (argNode) {
+            const text = argNode.text();
+            if (looksLikePath(text) && !isUrl(text)) {
+                refs.push({ path: text, line, via: "bare-path" });
+            }
+        }
+    }
+    return refs;
+}

package/esm/analyzer/rules/bash/filesystem.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+export declare const BASH_FILESYSTEM_RULES: AstGrepRule[];
+//# sourceMappingURL=filesystem.d.ts.map

package/esm/analyzer/rules/bash/filesystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/filesystem.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,eAAO,MAAM,qBAAqB,EAAE,WAAW,EA+C9C,CAAC"}

package/esm/analyzer/rules/bash/filesystem.js

@@ -0,0 +1,48 @@
+export const BASH_FILESYSTEM_RULES = [
+    {
+        id: "fs-read-cat",
+        description: "Detects cat file reads",
+        grammar: "bash",
+        patterns: ["cat $FILE", "less $FILE", "head $FILE", "tail $FILE"],
+        permission: {
+            tool: "cat",
+            scope: "fs",
+            permission: "read",
+            metadata: { file: "FILE" },
+        },
+    },
+    {
+        id: "fs-rm-rf",
+        description: "Detects recursive delete",
+        grammar: "bash",
+        patterns: ["rm -rf $PATH", "rm -fr $PATH"],
+        permission: {
+            tool: "rm",
+            scope: "fs",
+            permission: "write",
+            metadata: { path: "PATH" },
+            mappedRisks: [{
+                    code: "DESTRUCTIVE:destructive_behavior",
+                    severity: "critical",
+                    message: "Recursive delete detected",
+                }],
+        },
+    },
+    {
+        id: "fs-chmod-777",
+        description: "Detects permissive chmod",
+        grammar: "bash",
+        patterns: ["chmod 777 $PATH", "chmod -R 777 $PATH"],
+        permission: {
+            tool: "chmod",
+            scope: "fs",
+            permission: "write",
+            metadata: { path: "PATH" },
+            mappedRisks: [{
+                    code: "DESTRUCTIVE:permission_weakening",
+                    severity: "warning",
+                    message: "Overly permissive chmod detected",
+                }],
+        },
+    },
+];

package/esm/analyzer/rules/bash/injection.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+export declare const BASH_INJECTION_RULES: AstGrepRule[];
+//# sourceMappingURL=injection.d.ts.map

package/esm/analyzer/rules/bash/injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/injection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,eAAO,MAAM,oBAAoB,EAAE,WAAW,EAkB7C,CAAC"}

package/esm/analyzer/rules/bash/injection.js

@@ -0,0 +1,19 @@
+export const BASH_INJECTION_RULES = [
+    {
+        id: "inject-substitution",
+        description: "Detects shell command substitution",
+        grammar: "bash",
+        patterns: ["$($CMD)", "`$CMD`"],
+        permission: {
+            tool: "bash",
+            scope: "sys",
+            permission: "shell",
+            metadata: { command: "CMD" },
+            mappedRisks: [{
+                    code: "INJECTION:command_injection",
+                    severity: "warning",
+                    message: "Command substitution can enable injection",
+                }],
+        },
+    },
+];

package/esm/analyzer/rules/bash/inline-command-classifier.d.ts

@@ -0,0 +1,6 @@
+import type { AnalyzerContext } from "../../types.js";
+export declare function isLikelyInlineBashCommand(context: AnalyzerContext, input: {
+    snippet: string;
+    lineContext?: string;
+}): boolean;
+//# sourceMappingURL=inline-command-classifier.d.ts.map

package/esm/analyzer/rules/bash/inline-command-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline-command-classifier.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/inline-command-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA4CtD,wBAAgB,yBAAyB,CACrC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAuBT"}