@feiyoug/skill-lab 0.0.0

package/script/analyzer/rules/bash/commands/eval.js

@@ -0,0 +1,53 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.EVAL_RULES = void 0;
+exports.EVAL_RULES = [
+    {
+        id: "shell-eval",
+        description: "Detects eval execution",
+        grammar: "bash",
+        patterns: ["eval $CMD", 'eval "$CMD"', "eval '$CMD'"],
+        permission: {
+            tool: "eval",
+            scope: "sys",
+            permission: "shell",
+            metadata: { command: "CMD" },
+        },
+    },
+    {
+        id: "shell-sh-c",
+        description: "Detects sh -c execution",
+        grammar: "bash",
+        patterns: ["sh -c $CMD", 'sh -c "$CMD"', "sh -c '$CMD'"],
+        permission: {
+            tool: "sh",
+            scope: "sys",
+            permission: "shell",
+            metadata: { command: "CMD" },
+        },
+    },
+    {
+        id: "shell-bash-c",
+        description: "Detects bash -c execution",
+        grammar: "bash",
+        patterns: ["bash -c $CMD", 'bash -c "$CMD"', "bash -c '$CMD'"],
+        permission: {
+            tool: "bash",
+            scope: "sys",
+            permission: "shell",
+            metadata: { command: "CMD" },
+        },
+    },
+    {
+        id: "shell-source",
+        description: "Detects source command",
+        grammar: "bash",
+        patterns: ["source $FILE", ". $FILE"],
+        permission: {
+            tool: "source",
+            scope: "fs",
+            permission: "read",
+            metadata: { file: "FILE" },
+        },
+    },
+];

package/script/analyzer/rules/bash/commands/generic.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const GENERIC_SHELL_RULES: AstGrepRule[];
+//# sourceMappingURL=generic.d.ts.map

package/script/analyzer/rules/bash/commands/generic.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"generic.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/generic.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,mBAAmB,EAAE,WAAW,EAa5C,CAAC"}

package/script/analyzer/rules/bash/commands/generic.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GENERIC_SHELL_RULES = void 0;
+exports.GENERIC_SHELL_RULES = [
+    {
+        id: "shell-generic-command",
+        description: "Catches unrecognized shell command invocations",
+        grammar: "bash",
+        patterns: ["$TOOL $$$ARGS"],
+        permission: {
+            tool: "detected",
+            scope: "sys",
+            permission: "shell",
+            metadata: { tool: "TOOL", args: "ARGS" },
+        },
+    },
+];

package/script/analyzer/rules/bash/commands/gh.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const GH_RULES: AstGrepRule[];
+//# sourceMappingURL=gh.d.ts.map

package/script/analyzer/rules/bash/commands/gh.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gh.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/gh.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,QAAQ,EAAE,WAAW,EAkBjC,CAAC"}

package/script/analyzer/rules/bash/commands/gh.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GH_RULES = void 0;
+exports.GH_RULES = [
+    {
+        id: "shell-gh",
+        description: "Detects GitHub CLI commands",
+        grammar: "bash",
+        patterns: [
+            "gh pr $$$ARGS",
+            "gh issue $$$ARGS",
+            "gh repo $$$ARGS",
+            "gh api $$$ARGS",
+            "gh auth $$$ARGS",
+        ],
+        permission: {
+            tool: "gh",
+            scope: "sys",
+            permission: "shell",
+        },
+    },
+];

package/script/analyzer/rules/bash/commands/git.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const GIT_RULES: AstGrepRule[];
+//# sourceMappingURL=git.d.ts.map

package/script/analyzer/rules/bash/commands/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/git.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,SAAS,EAAE,WAAW,EAyBlC,CAAC"}

package/script/analyzer/rules/bash/commands/git.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GIT_RULES = void 0;
+exports.GIT_RULES = [
+    {
+        id: "shell-git",
+        description: "Detects git commands",
+        grammar: "bash",
+        patterns: [
+            "git status",
+            "git add $PATH",
+            "git commit $$$ARGS",
+            "git pull $$$ARGS",
+            "git push $$$ARGS",
+            "git checkout $BRANCH",
+            "git merge $BRANCH",
+            "git rebase $BRANCH",
+            "git clone $URL",
+            "git fetch $$$ARGS",
+            "git log $$$ARGS",
+        ],
+        permission: {
+            tool: "git",
+            scope: "sys",
+            permission: "shell",
+            metadata: { url: "URL", branch: "BRANCH", path: "PATH" },
+        },
+    },
+];

package/script/analyzer/rules/bash/commands/mod.d.ts

@@ -0,0 +1,13 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export * from "./bd.js";
+export * from "./cron.js";
+export * from "./docker.js";
+export * from "./eval.js";
+export * from "./generic.js";
+export * from "./gh.js";
+export * from "./git.js";
+export * from "./node.js";
+export * from "./openspec.js";
+export * from "./sudo.js";
+export declare const BASH_COMMAND_RULES: AstGrepRule[];
+//# sourceMappingURL=mod.d.ts.map

package/script/analyzer/rules/bash/commands/mod.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"mod.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/mod.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAY9D,cAAc,SAAS,CAAC;AACxB,cAAc,WAAW,CAAC;AAC1B,cAAc,aAAa,CAAC;AAC5B,cAAc,WAAW,CAAC;AAC1B,cAAc,cAAc,CAAC;AAC7B,cAAc,SAAS,CAAC;AACxB,cAAc,UAAU,CAAC;AACzB,cAAc,WAAW,CAAC;AAC1B,cAAc,eAAe,CAAC;AAC9B,cAAc,WAAW,CAAC;AAE1B,eAAO,MAAM,kBAAkB,EAAE,WAAW,EAW3C,CAAC"}

package/script/analyzer/rules/bash/commands/mod.js

@@ -0,0 +1,49 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BASH_COMMAND_RULES = void 0;
+const bd_js_1 = require("./bd.js");
+const cron_js_1 = require("./cron.js");
+const docker_js_1 = require("./docker.js");
+const eval_js_1 = require("./eval.js");
+const generic_js_1 = require("./generic.js");
+const gh_js_1 = require("./gh.js");
+const git_js_1 = require("./git.js");
+const node_js_1 = require("./node.js");
+const openspec_js_1 = require("./openspec.js");
+const sudo_js_1 = require("./sudo.js");
+__exportStar(require("./bd.js"), exports);
+__exportStar(require("./cron.js"), exports);
+__exportStar(require("./docker.js"), exports);
+__exportStar(require("./eval.js"), exports);
+__exportStar(require("./generic.js"), exports);
+__exportStar(require("./gh.js"), exports);
+__exportStar(require("./git.js"), exports);
+__exportStar(require("./node.js"), exports);
+__exportStar(require("./openspec.js"), exports);
+__exportStar(require("./sudo.js"), exports);
+exports.BASH_COMMAND_RULES = [
+    ...git_js_1.GIT_RULES,
+    ...gh_js_1.GH_RULES,
+    ...node_js_1.NODE_ECOSYSTEM_RULES,
+    ...docker_js_1.DOCKER_RULES,
+    ...bd_js_1.BD_RULES,
+    ...sudo_js_1.SUDO_RULES,
+    ...eval_js_1.EVAL_RULES,
+    ...openspec_js_1.OPENSPEC_RULES,
+    ...cron_js_1.CRON_RULES,
+    ...generic_js_1.GENERIC_SHELL_RULES,
+];

package/script/analyzer/rules/bash/commands/node.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const NODE_ECOSYSTEM_RULES: AstGrepRule[];
+//# sourceMappingURL=node.d.ts.map

package/script/analyzer/rules/bash/commands/node.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"node.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/node.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,oBAAoB,EAAE,WAAW,EA6D7C,CAAC"}

package/script/analyzer/rules/bash/commands/node.js

@@ -0,0 +1,65 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NODE_ECOSYSTEM_RULES = void 0;
+exports.NODE_ECOSYSTEM_RULES = [
+    {
+        id: "shell-npm",
+        description: "Detects npm commands",
+        grammar: "bash",
+        patterns: ["npm $SUB $$$ARGS"],
+        permission: {
+            tool: "npm",
+            scope: "sys",
+            permission: "shell",
+            metadata: { subcommand: "SUB" },
+        },
+    },
+    {
+        id: "shell-pnpm",
+        description: "Detects pnpm commands",
+        grammar: "bash",
+        patterns: ["pnpm $SUB $$$ARGS"],
+        permission: {
+            tool: "pnpm",
+            scope: "sys",
+            permission: "shell",
+            metadata: { subcommand: "SUB" },
+        },
+    },
+    {
+        id: "shell-yarn",
+        description: "Detects yarn commands",
+        grammar: "bash",
+        patterns: ["yarn $SUB $$$ARGS"],
+        permission: {
+            tool: "yarn",
+            scope: "sys",
+            permission: "shell",
+            metadata: { subcommand: "SUB" },
+        },
+    },
+    {
+        id: "shell-deno",
+        description: "Detects deno commands",
+        grammar: "bash",
+        patterns: ["deno $SUB $$$ARGS"],
+        permission: {
+            tool: "deno",
+            scope: "sys",
+            permission: "shell",
+            metadata: { subcommand: "SUB" },
+        },
+    },
+    {
+        id: "shell-node",
+        description: "Detects node commands",
+        grammar: "bash",
+        patterns: ["node $FILE $$$ARGS"],
+        permission: {
+            tool: "node",
+            scope: "sys",
+            permission: "shell",
+            metadata: { file: "FILE" },
+        },
+    },
+];

package/script/analyzer/rules/bash/commands/openspec.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const OPENSPEC_RULES: AstGrepRule[];
+//# sourceMappingURL=openspec.d.ts.map

package/script/analyzer/rules/bash/commands/openspec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"openspec.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/openspec.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,cAAc,EAAE,WAAW,EAavC,CAAC"}

package/script/analyzer/rules/bash/commands/openspec.js

@@ -0,0 +1,17 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OPENSPEC_RULES = void 0;
+exports.OPENSPEC_RULES = [
+    {
+        id: "shell-openspec",
+        description: "Detects openspec commands",
+        grammar: "bash",
+        patterns: ["openspec $SUB $$$ARGS"],
+        permission: {
+            tool: "openspec",
+            scope: "sys",
+            permission: "shell",
+            metadata: { subcommand: "SUB" },
+        },
+    },
+];

package/script/analyzer/rules/bash/commands/sudo.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../../astgrep/client.js";
+export declare const SUDO_RULES: AstGrepRule[];
+//# sourceMappingURL=sudo.d.ts.map

package/script/analyzer/rules/bash/commands/sudo.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sudo.d.ts","sourceRoot":"","sources":["../../../../../src/analyzer/rules/bash/commands/sudo.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAE9D,eAAO,MAAM,UAAU,EAAE,WAAW,EAkBnC,CAAC"}

package/script/analyzer/rules/bash/commands/sudo.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SUDO_RULES = void 0;
+exports.SUDO_RULES = [
+    {
+        id: "shell-sudo",
+        description: "Detects sudo usage",
+        grammar: "bash",
+        patterns: ["sudo $CMD $$$ARGS"],
+        permission: {
+            tool: "sudo",
+            scope: "sys",
+            permission: "sudo",
+            metadata: { command: "CMD" },
+            mappedRisks: [{
+                    code: "PRIVILEGE:privilege_escalation",
+                    severity: "critical",
+                    message: "Privilege escalation via sudo",
+                }],
+        },
+    },
+];

package/script/analyzer/rules/bash/destructive.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+export declare const BASH_DESTRUCTIVE_RULES: AstGrepRule[];
+//# sourceMappingURL=destructive.d.ts.map

package/script/analyzer/rules/bash/destructive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"destructive.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/destructive.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,eAAO,MAAM,sBAAsB,EAAE,WAAW,EAyB/C,CAAC"}

package/script/analyzer/rules/bash/destructive.js

@@ -0,0 +1,29 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BASH_DESTRUCTIVE_RULES = void 0;
+exports.BASH_DESTRUCTIVE_RULES = [
+    {
+        id: "destructive-format",
+        description: "Detects disk format commands",
+        grammar: "bash",
+        patterns: ["mkfs $DEVICE", "format $DEVICE"],
+        permission: {
+            tool: "format",
+            scope: "fs",
+            permission: "write",
+            metadata: { device: "DEVICE" },
+        },
+    },
+    {
+        id: "destructive-config-write",
+        description: "Detects config file overwrite",
+        grammar: "bash",
+        patterns: ["echo $VALUE > $FILE"],
+        permission: {
+            tool: "write",
+            scope: "fs",
+            permission: "write",
+            metadata: { file: "FILE" },
+        },
+    },
+];

package/script/analyzer/rules/bash/extractFileRefs.d.ts

@@ -0,0 +1,13 @@
+/**
+ * File reference extractor for Bash/shell scripts.
+ *
+ * Detects:
+ * - External URLs referenced via curl/wget → via: "url"
+ * - Local file includes via source/. → via: "source"
+ * - Host filesystem paths in command arguments → via: "bare-path"
+ *
+ * Uses ast-grep AST traversal on `command` nodes.
+ */
+import type { AnalyzerContext, FileRefDiscovery } from "../../types.js";
+export declare function extractBashFileRefs(context: AnalyzerContext, content: string): FileRefDiscovery[];
+//# sourceMappingURL=extractFileRefs.d.ts.map

package/script/analyzer/rules/bash/extractFileRefs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extractFileRefs.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/extractFileRefs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAGxE,wBAAgB,mBAAmB,CAC/B,OAAO,EAAE,eAAe,EACxB,OAAO,EAAE,MAAM,GAChB,gBAAgB,EAAE,CAkFpB"}

package/script/analyzer/rules/bash/extractFileRefs.js

@@ -0,0 +1,88 @@
+"use strict";
+/**
+ * File reference extractor for Bash/shell scripts.
+ *
+ * Detects:
+ * - External URLs referenced via curl/wget → via: "url"
+ * - Local file includes via source/. → via: "source"
+ * - Host filesystem paths in command arguments → via: "bare-path"
+ *
+ * Uses ast-grep AST traversal on `command` nodes.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.extractBashFileRefs = extractBashFileRefs;
+const file_refs_js_1 = require("../shared/file-refs.js");
+const astTypes_js_1 = require("./astTypes.js");
+function extractBashFileRefs(context, content) {
+    const refs = [];
+    const ast = context.astgrepClient.parse("bash", content);
+    const root = ast.root();
+    const commandNodes = root.findAll({ rule: { kind: astTypes_js_1.BASH_NODE.COMMAND } });
+    for (const node of commandNodes) {
+        const line = node.range().start.line + 1;
+        const nameNode = node.field("name");
+        const commandName = nameNode?.text() ?? "";
+        // ── source / . includes ──────────────────────────────────────────────
+        if (commandName === "source" || commandName === ".") {
+            const argNode = node.field("argument");
+            const path = argNode?.text() ?? "";
+            if (path && (0, file_refs_js_1.looksLikePath)(path)) {
+                refs.push({ path, line, via: "source" });
+            }
+            continue;
+        }
+        // ── curl / wget URLs ─────────────────────────────────────────────────
+        if (commandName === "curl" || commandName === "wget") {
+            // All word children — find URL args
+            const wordNodes = node.findAll({ rule: { kind: astTypes_js_1.BASH_NODE.WORD } });
+            for (const word of wordNodes) {
+                const text = word.text();
+                if ((0, file_refs_js_1.isUrl)(text)) {
+                    refs.push({ path: text, line, via: "url" });
+                }
+            }
+            continue;
+        }
+        // ── file operation commands ──────────────────────────────────────────
+        const FILE_CMDS = new Set([
+            "cat",
+            "cp",
+            "mv",
+            "ln",
+            "touch",
+            "mkdir",
+            "rm",
+            "chmod",
+            "chown",
+            "open",
+            "exec",
+            "read",
+        ]);
+        if (FILE_CMDS.has(commandName)) {
+            const wordNodes = node.findAll({ rule: { kind: astTypes_js_1.BASH_NODE.WORD } });
+            for (const word of wordNodes) {
+                const text = word.text();
+                // Skip flags and the command name itself
+                if (text === commandName || text.startsWith("-"))
+                    continue;
+                if ((0, file_refs_js_1.isHostFsPath)(text)) {
+                    refs.push({ path: text, line, via: "bare-path" });
+                }
+            }
+            continue;
+        }
+        // ── command itself is a script path (e.g. `scripts/run.py`) ─────────
+        if ((0, file_refs_js_1.looksLikePath)(commandName) && !(0, file_refs_js_1.isUrl)(commandName)) {
+            refs.push({ path: commandName, line, via: "bare-path" });
+        }
+        // ── default: check first argument for path-like value ────────────────
+        const argNode = node.field("argument");
+        if (argNode) {
+            const text = argNode.text();
+            if ((0, file_refs_js_1.looksLikePath)(text) && !(0, file_refs_js_1.isUrl)(text)) {
+                refs.push({ path: text, line, via: "bare-path" });
+            }
+        }
+    }
+    return refs;
+}

package/script/analyzer/rules/bash/filesystem.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+export declare const BASH_FILESYSTEM_RULES: AstGrepRule[];
+//# sourceMappingURL=filesystem.d.ts.map

package/script/analyzer/rules/bash/filesystem.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"filesystem.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/filesystem.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,eAAO,MAAM,qBAAqB,EAAE,WAAW,EA+C9C,CAAC"}

package/script/analyzer/rules/bash/filesystem.js

@@ -0,0 +1,51 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BASH_FILESYSTEM_RULES = void 0;
+exports.BASH_FILESYSTEM_RULES = [
+    {
+        id: "fs-read-cat",
+        description: "Detects cat file reads",
+        grammar: "bash",
+        patterns: ["cat $FILE", "less $FILE", "head $FILE", "tail $FILE"],
+        permission: {
+            tool: "cat",
+            scope: "fs",
+            permission: "read",
+            metadata: { file: "FILE" },
+        },
+    },
+    {
+        id: "fs-rm-rf",
+        description: "Detects recursive delete",
+        grammar: "bash",
+        patterns: ["rm -rf $PATH", "rm -fr $PATH"],
+        permission: {
+            tool: "rm",
+            scope: "fs",
+            permission: "write",
+            metadata: { path: "PATH" },
+            mappedRisks: [{
+                    code: "DESTRUCTIVE:destructive_behavior",
+                    severity: "critical",
+                    message: "Recursive delete detected",
+                }],
+        },
+    },
+    {
+        id: "fs-chmod-777",
+        description: "Detects permissive chmod",
+        grammar: "bash",
+        patterns: ["chmod 777 $PATH", "chmod -R 777 $PATH"],
+        permission: {
+            tool: "chmod",
+            scope: "fs",
+            permission: "write",
+            metadata: { path: "PATH" },
+            mappedRisks: [{
+                    code: "DESTRUCTIVE:permission_weakening",
+                    severity: "warning",
+                    message: "Overly permissive chmod detected",
+                }],
+        },
+    },
+];

package/script/analyzer/rules/bash/injection.d.ts

@@ -0,0 +1,3 @@
+import type { AstGrepRule } from "../../astgrep/client.js";
+export declare const BASH_INJECTION_RULES: AstGrepRule[];
+//# sourceMappingURL=injection.d.ts.map

package/script/analyzer/rules/bash/injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"injection.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/injection.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAE3D,eAAO,MAAM,oBAAoB,EAAE,WAAW,EAkB7C,CAAC"}

package/script/analyzer/rules/bash/injection.js

@@ -0,0 +1,22 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.BASH_INJECTION_RULES = void 0;
+exports.BASH_INJECTION_RULES = [
+    {
+        id: "inject-substitution",
+        description: "Detects shell command substitution",
+        grammar: "bash",
+        patterns: ["$($CMD)", "`$CMD`"],
+        permission: {
+            tool: "bash",
+            scope: "sys",
+            permission: "shell",
+            metadata: { command: "CMD" },
+            mappedRisks: [{
+                    code: "INJECTION:command_injection",
+                    severity: "warning",
+                    message: "Command substitution can enable injection",
+                }],
+        },
+    },
+];

package/script/analyzer/rules/bash/inline-command-classifier.d.ts

@@ -0,0 +1,6 @@
+import type { AnalyzerContext } from "../../types.js";
+export declare function isLikelyInlineBashCommand(context: AnalyzerContext, input: {
+    snippet: string;
+    lineContext?: string;
+}): boolean;
+//# sourceMappingURL=inline-command-classifier.d.ts.map

package/script/analyzer/rules/bash/inline-command-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inline-command-classifier.d.ts","sourceRoot":"","sources":["../../../../src/analyzer/rules/bash/inline-command-classifier.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AA4CtD,wBAAgB,yBAAyB,CACrC,OAAO,EAAE,eAAe,EACxB,KAAK,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,GACjD,OAAO,CAuBT"}