@kernel.chat/kbot 3.26.2 → 3.28.0

package/dist/tools/security.js

@@ -0,0 +1,634 @@
+// kbot Security Tools — Cybersecurity toolkit for developers
+// Dependency auditing, secret scanning, SSL/TLS checks, CVE lookup,
+// port scanning, header analysis, OWASP checks.
+// All tools are free tier — no API keys required.
+import { registerTool } from './index.js';
+import { execSync } from 'node:child_process';
+import { existsSync, readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+function fmt(n, d = 0) {
+    return n.toLocaleString('en-US', { minimumFractionDigits: d, maximumFractionDigits: d });
+}
+export function registerSecurityTools() {
+    // ─── Dependency Audit ───
+    registerTool({
+        name: 'dep_audit',
+        description: 'Audit project dependencies for known vulnerabilities. Runs npm audit, pip audit, or cargo audit depending on the project. Returns CVE IDs, severity, and fix recommendations.',
+        parameters: {
+            path: { type: 'string', description: 'Project directory to audit (default: current directory)' },
+        },
+        tier: 'free',
+        timeout: 60_000,
+        async execute(args) {
+            const dir = String(args.path || process.cwd());
+            const lines = ['## Dependency Audit', ''];
+            let totalVulns = 0;
+            // npm audit
+            if (existsSync(join(dir, 'package.json'))) {
+                try {
+                    const result = execSync('npm audit --json 2>/dev/null', { cwd: dir, maxBuffer: 5_000_000 }).toString();
+                    const audit = JSON.parse(result);
+                    const vulns = audit.vulnerabilities || {};
+                    const meta = audit.metadata?.vulnerabilities || {};
+                    const total = (meta.critical || 0) + (meta.high || 0) + (meta.moderate || 0) + (meta.low || 0);
+                    totalVulns += total;
+                    lines.push(`### npm (${total} vulnerabilities)`);
+                    if (meta.critical)
+                        lines.push(`- **CRITICAL**: ${meta.critical}`);
+                    if (meta.high)
+                        lines.push(`- **HIGH**: ${meta.high}`);
+                    if (meta.moderate)
+                        lines.push(`- **MODERATE**: ${meta.moderate}`);
+                    if (meta.low)
+                        lines.push(`- **LOW**: ${meta.low}`);
+                    // Top 5 most severe
+                    const sorted = Object.entries(vulns)
+                        .map(([name, info]) => ({ name, severity: info.severity, via: info.via, fixAvailable: info.fixAvailable }))
+                        .sort((a, b) => {
+                        const order = { critical: 0, high: 1, moderate: 2, low: 3 };
+                        return (order[a.severity] ?? 4) - (order[b.severity] ?? 4);
+                    });
+                    if (sorted.length > 0) {
+                        lines.push('', '| Package | Severity | Fix Available |', '|---------|----------|---------------|');
+                        for (const v of sorted.slice(0, 10)) {
+                            lines.push(`| ${v.name} | ${v.severity.toUpperCase()} | ${v.fixAvailable ? 'Yes' : 'No'} |`);
+                        }
+                    }
+                    if (total > 0) {
+                        lines.push('', '**Fix**: `npm audit fix` (safe) or `npm audit fix --force` (may break)');
+                    }
+                }
+                catch {
+                    // npm audit exits non-zero when vulns found — parse stderr
+                    try {
+                        const result = execSync('npm audit --json 2>&1 || true', { cwd: dir, maxBuffer: 5_000_000 }).toString();
+                        const audit = JSON.parse(result);
+                        const meta = audit.metadata?.vulnerabilities || {};
+                        const total = (meta.critical || 0) + (meta.high || 0) + (meta.moderate || 0) + (meta.low || 0);
+                        totalVulns += total;
+                        lines.push(`### npm (${total} vulnerabilities)`);
+                        if (meta.critical)
+                            lines.push(`- **CRITICAL**: ${meta.critical}`);
+                        if (meta.high)
+                            lines.push(`- **HIGH**: ${meta.high}`);
+                        if (meta.moderate)
+                            lines.push(`- **MODERATE**: ${meta.moderate}`);
+                        if (meta.low)
+                            lines.push(`- **LOW**: ${meta.low}`);
+                    }
+                    catch {
+                        lines.push('### npm — audit failed (run `npm install` first)');
+                    }
+                }
+                lines.push('');
+            }
+            // Python
+            if (existsSync(join(dir, 'requirements.txt')) || existsSync(join(dir, 'pyproject.toml'))) {
+                try {
+                    const result = execSync('pip audit --format json 2>/dev/null || pip-audit --format json 2>/dev/null || echo "[]"', { cwd: dir, maxBuffer: 2_000_000 }).toString();
+                    const vulns = JSON.parse(result);
+                    totalVulns += vulns.length;
+                    lines.push(`### Python (${vulns.length} vulnerabilities)`);
+                    if (vulns.length > 0) {
+                        lines.push('', '| Package | Version | CVE |', '|---------|---------|-----|');
+                        for (const v of vulns.slice(0, 10)) {
+                            lines.push(`| ${v.name} | ${v.version} | ${v.id || '?'} |`);
+                        }
+                    }
+                }
+                catch {
+                    lines.push('### Python — pip-audit not installed (`pip install pip-audit`)');
+                }
+                lines.push('');
+            }
+            // Rust
+            if (existsSync(join(dir, 'Cargo.toml'))) {
+                try {
+                    const result = execSync('cargo audit --json 2>/dev/null || echo "{}"', { cwd: dir, maxBuffer: 2_000_000 }).toString();
+                    const audit = JSON.parse(result);
+                    const vulns = audit.vulnerabilities?.list || [];
+                    totalVulns += vulns.length;
+                    lines.push(`### Rust (${vulns.length} vulnerabilities)`);
+                    if (vulns.length > 0) {
+                        for (const v of vulns.slice(0, 10)) {
+                            lines.push(`- **${v.advisory?.id}**: ${v.advisory?.title} (${v.package?.name})`);
+                        }
+                    }
+                }
+                catch {
+                    lines.push('### Rust — cargo-audit not installed (`cargo install cargo-audit`)');
+                }
+                lines.push('');
+            }
+            if (totalVulns === 0) {
+                lines.push('**No known vulnerabilities found.**');
+            }
+            else {
+                lines.push(`**Total: ${totalVulns} vulnerabilities across all package managers.**`);
+            }
+            return lines.join('\n');
+        },
+    });
+    // ─── Secret Scanner ───
+    registerTool({
+        name: 'secret_scan',
+        description: 'Scan files for accidentally committed secrets — API keys, tokens, passwords, private keys. Checks common patterns (AWS, Stripe, GitHub, Supabase, etc). Does NOT read .env files.',
+        parameters: {
+            path: { type: 'string', description: 'Directory to scan (default: current directory)' },
+            depth: { type: 'number', description: 'Max directory depth (default: 5)', default: 5 },
+        },
+        tier: 'free',
+        timeout: 30_000,
+        async execute(args) {
+            const dir = String(args.path || process.cwd());
+            const maxDepth = Number(args.depth) || 5;
+            const SECRET_PATTERNS = [
+                { name: 'AWS Access Key', pattern: /AKIA[0-9A-Z]{16}/ },
+                { name: 'AWS Secret Key', pattern: /(?:aws_secret|secret_access_key)\s*[:=]\s*['"]?[A-Za-z0-9/+=]{40}/ },
+                { name: 'GitHub Token', pattern: /ghp_[A-Za-z0-9]{36}/ },
+                { name: 'GitHub OAuth', pattern: /gho_[A-Za-z0-9]{36}/ },
+                { name: 'Stripe Secret', pattern: /sk_live_[A-Za-z0-9]{24,}/ },
+                { name: 'Stripe Publishable', pattern: /pk_live_[A-Za-z0-9]{24,}/ },
+                { name: 'Supabase Service Key', pattern: /eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9\.[A-Za-z0-9_-]{50,}/ },
+                { name: 'Anthropic Key', pattern: /sk-ant-[A-Za-z0-9_-]{40,}/ },
+                { name: 'OpenAI Key', pattern: /sk-[A-Za-z0-9]{48}/ },
+                { name: 'Slack Token', pattern: /xoxb-[0-9]{10,}-[A-Za-z0-9]{24,}/ },
+                { name: 'Slack Webhook', pattern: /hooks\.slack\.com\/services\/T[A-Z0-9]{8,}\/B[A-Z0-9]{8,}\/[A-Za-z0-9]{24}/ },
+                { name: 'Discord Webhook', pattern: /discord(?:app)?\.com\/api\/webhooks\/\d+\/[A-Za-z0-9_-]+/ },
+                { name: 'Private Key', pattern: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/ },
+                { name: 'Generic Secret', pattern: /(?:secret|password|passwd|token|api_key|apikey)\s*[:=]\s*['"][A-Za-z0-9/+=_-]{16,}['"]/ },
+                { name: 'npm Token', pattern: /npm_[A-Za-z0-9]{36}/ },
+                { name: 'Resend Key', pattern: /re_[A-Za-z0-9]{32,}/ },
+                { name: 'SendGrid Key', pattern: /SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43}/ },
+                { name: 'Twilio SID', pattern: /AC[a-f0-9]{32}/ },
+            ];
+            const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', '.next', '__pycache__', 'target', '.venv', 'venv']);
+            const SKIP_EXTS = new Set(['.png', '.jpg', '.jpeg', '.gif', '.ico', '.woff', '.woff2', '.ttf', '.eot', '.mp3', '.mp4', '.zip', '.tar', '.gz', '.pdf', '.lock']);
+            const findings = [];
+            function scanDir(dirPath, depth) {
+                if (depth > maxDepth)
+                    return;
+                try {
+                    const entries = readdirSync(dirPath);
+                    for (const entry of entries) {
+                        if (SKIP_DIRS.has(entry) || entry.startsWith('.env'))
+                            continue;
+                        const fullPath = join(dirPath, entry);
+                        try {
+                            const stat = statSync(fullPath);
+                            if (stat.isDirectory()) {
+                                scanDir(fullPath, depth + 1);
+                            }
+                            else if (stat.isFile() && stat.size < 500_000) {
+                                const ext = entry.slice(entry.lastIndexOf('.'));
+                                if (SKIP_EXTS.has(ext))
+                                    continue;
+                                try {
+                                    const content = readFileSync(fullPath, 'utf-8');
+                                    const lines = content.split('\n');
+                                    for (let i = 0; i < lines.length; i++) {
+                                        for (const { name, pattern } of SECRET_PATTERNS) {
+                                            const m = lines[i].match(pattern);
+                                            if (m) {
+                                                findings.push({
+                                                    file: fullPath.replace(dir + '/', ''),
+                                                    line: i + 1,
+                                                    secret: name,
+                                                    match: m[0].slice(0, 12) + '***' + m[0].slice(-4),
+                                                });
+                                            }
+                                        }
+                                    }
+                                }
+                                catch { /* binary or unreadable */ }
+                            }
+                        }
+                        catch { /* permission denied */ }
+                    }
+                }
+                catch { /* unreadable dir */ }
+            }
+            scanDir(dir, 0);
+            const lines = ['## Secret Scan', ''];
+            if (findings.length === 0) {
+                lines.push('**No secrets found.** Scanned common patterns (AWS, Stripe, GitHub, OpenAI, private keys, etc).');
+            }
+            else {
+                lines.push(`**${findings.length} potential secret(s) found:**`);
+                lines.push('');
+                lines.push('| File | Line | Type | Preview |');
+                lines.push('|------|------|------|---------|');
+                for (const f of findings.slice(0, 25)) {
+                    lines.push(`| ${f.file} | ${f.line} | ${f.secret} | \`${f.match}\` |`);
+                }
+                if (findings.length > 25)
+                    lines.push(``, `*...and ${findings.length - 25} more*`);
+                lines.push('');
+                lines.push('**Action**: Remove secrets from source, rotate compromised keys, add to `.gitignore`.');
+                lines.push('If already committed: `git filter-branch` or `bfg` to remove from history.');
+            }
+            return lines.join('\n');
+        },
+    });
+    // ─── SSL/TLS Check ───
+    registerTool({
+        name: 'ssl_check',
+        description: 'Check SSL/TLS certificate for any domain — expiry date, issuer, protocol, and security grade. Catches expiring certs before they break your site.',
+        parameters: {
+            domain: { type: 'string', description: 'Domain to check (e.g. "kernel.chat", "api.example.com")', required: true },
+        },
+        tier: 'free',
+        timeout: 15_000,
+        async execute(args) {
+            const domain = String(args.domain).replace(/^https?:\/\//, '').replace(/\/.*$/, '');
+            try {
+                const result = execSync(`echo | openssl s_client -servername ${domain} -connect ${domain}:443 2>/dev/null | openssl x509 -noout -dates -issuer -subject -text 2>/dev/null`, { timeout: 10_000 }).toString();
+                const notBefore = result.match(/notBefore=(.*)/)?.[1] || '?';
+                const notAfter = result.match(/notAfter=(.*)/)?.[1] || '?';
+                const issuer = result.match(/issuer=(.+)/)?.[1]?.trim() || '?';
+                const subject = result.match(/subject=(.+)/)?.[1]?.trim() || '?';
+                const sigAlgo = result.match(/Signature Algorithm:\s*(.+)/)?.[1]?.trim() || '?';
+                const keySize = result.match(/Public-Key:\s*\((\d+) bit\)/)?.[1] || '?';
+                const expiryDate = new Date(notAfter);
+                const now = new Date();
+                const daysLeft = Math.floor((expiryDate.getTime() - now.getTime()) / (1000 * 60 * 60 * 24));
+                let status = 'VALID';
+                if (daysLeft < 0)
+                    status = 'EXPIRED';
+                else if (daysLeft < 7)
+                    status = 'CRITICAL — expires in < 7 days';
+                else if (daysLeft < 30)
+                    status = 'WARNING — expires in < 30 days';
+                return [
+                    `## SSL/TLS: ${domain}`,
+                    '',
+                    `**Status**: ${status}`,
+                    `**Expires**: ${notAfter} (${daysLeft} days)`,
+                    `**Issued**: ${notBefore}`,
+                    `**Issuer**: ${issuer}`,
+                    `**Subject**: ${subject}`,
+                    `**Signature**: ${sigAlgo}`,
+                    `**Key Size**: ${keySize} bit`,
+                    '',
+                    daysLeft < 30 ? `**ACTION REQUIRED**: Certificate expires in ${daysLeft} days. Renew now.` : `Certificate is healthy.`,
+                ].join('\n');
+            }
+            catch {
+                return `Could not check SSL for "${domain}". Verify the domain is correct and port 443 is reachable.`;
+            }
+        },
+    });
+    // ─── Security Headers Check ───
+    registerTool({
+        name: 'headers_check',
+        description: 'Check HTTP security headers for any URL — CSP, HSTS, X-Frame-Options, etc. Reports missing headers that leave you vulnerable to XSS, clickjacking, and MIME sniffing.',
+        parameters: {
+            url: { type: 'string', description: 'URL to check (e.g. "https://kernel.chat")', required: true },
+        },
+        tier: 'free',
+        timeout: 15_000,
+        async execute(args) {
+            const url = String(args.url);
+            const fullUrl = url.startsWith('http') ? url : `https://${url}`;
+            const res = await fetch(fullUrl, {
+                method: 'HEAD',
+                signal: AbortSignal.timeout(10_000),
+                redirect: 'follow',
+            });
+            const EXPECTED_HEADERS = [
+                { name: 'Content-Security-Policy', header: 'content-security-policy', description: 'Prevents XSS by controlling allowed script sources', severity: 'HIGH' },
+                { name: 'Strict-Transport-Security', header: 'strict-transport-security', description: 'Forces HTTPS, prevents downgrade attacks', severity: 'HIGH' },
+                { name: 'X-Content-Type-Options', header: 'x-content-type-options', description: 'Prevents MIME type sniffing', severity: 'MEDIUM' },
+                { name: 'X-Frame-Options', header: 'x-frame-options', description: 'Prevents clickjacking via iframes', severity: 'MEDIUM' },
+                { name: 'X-XSS-Protection', header: 'x-xss-protection', description: 'Legacy XSS filter (useful for older browsers)', severity: 'LOW' },
+                { name: 'Referrer-Policy', header: 'referrer-policy', description: 'Controls what info is sent in Referer header', severity: 'LOW' },
+                { name: 'Permissions-Policy', header: 'permissions-policy', description: 'Controls browser features (camera, mic, geolocation)', severity: 'LOW' },
+                { name: 'Cross-Origin-Opener-Policy', header: 'cross-origin-opener-policy', description: 'Isolates browsing context from cross-origin popups', severity: 'LOW' },
+            ];
+            const lines = [
+                `## Security Headers: ${fullUrl}`,
+                `**Status**: ${res.status} ${res.statusText}`,
+                '',
+                '| Header | Status | Severity | Value |',
+                '|--------|--------|----------|-------|',
+            ];
+            let missing = 0;
+            for (const h of EXPECTED_HEADERS) {
+                const value = res.headers.get(h.header);
+                if (value) {
+                    lines.push(`| ${h.name} | ✅ Present | ${h.severity} | \`${value.slice(0, 50)}\` |`);
+                }
+                else {
+                    lines.push(`| ${h.name} | ❌ Missing | ${h.severity} | ${h.description} |`);
+                    missing++;
+                }
+            }
+            const score = Math.round(((EXPECTED_HEADERS.length - missing) / EXPECTED_HEADERS.length) * 100);
+            lines.push('');
+            lines.push(`**Score**: ${score}% (${EXPECTED_HEADERS.length - missing}/${EXPECTED_HEADERS.length} headers present)`);
+            if (missing > 0)
+                lines.push(`**Missing**: ${missing} header(s) — see table above for recommendations`);
+            return lines.join('\n');
+        },
+    });
+    // ─── CVE Lookup ───
+    registerTool({
+        name: 'cve_lookup',
+        description: 'Look up a CVE by ID or search for vulnerabilities affecting a specific package/product. Uses the NVD (National Vulnerability Database) API.',
+        parameters: {
+            query: { type: 'string', description: 'CVE ID (e.g. "CVE-2024-1234") or package name (e.g. "log4j", "openssl")', required: true },
+        },
+        tier: 'free',
+        timeout: 15_000,
+        async execute(args) {
+            const query = String(args.query).trim();
+            // Direct CVE lookup
+            if (/^CVE-\d{4}-\d+$/i.test(query)) {
+                const url = `https://services.nvd.nist.gov/rest/json/cves/2.0?cveId=${query.toUpperCase()}`;
+                const res = await fetch(url, { signal: AbortSignal.timeout(10_000) });
+                if (!res.ok)
+                    return `NVD API error: ${res.status}`;
+                const data = await res.json();
+                const vuln = data.vulnerabilities?.[0]?.cve;
+                if (!vuln)
+                    return `CVE "${query}" not found.`;
+                const desc = vuln.descriptions?.find((d) => d.lang === 'en')?.value || '?';
+                const metrics = vuln.metrics?.cvssMetricV31?.[0]?.cvssData || vuln.metrics?.cvssMetricV2?.[0]?.cvssData;
+                const score = metrics?.baseScore || '?';
+                const severity = metrics?.baseSeverity || '?';
+                const published = vuln.published?.split('T')[0] || '?';
+                return [
+                    `## ${query.toUpperCase()}`,
+                    '',
+                    `**Severity**: ${severity} (${score}/10)`,
+                    `**Published**: ${published}`,
+                    '',
+                    desc,
+                    '',
+                    `**NVD**: https://nvd.nist.gov/vuln/detail/${query.toUpperCase()}`,
+                ].join('\n');
+            }
+            // Keyword search
+            const url = `https://services.nvd.nist.gov/rest/json/cves/2.0?keywordSearch=${encodeURIComponent(query)}&resultsPerPage=10`;
+            const res = await fetch(url, { signal: AbortSignal.timeout(10_000) });
+            if (!res.ok)
+                return `NVD API error: ${res.status}`;
+            const data = await res.json();
+            const vulns = data.vulnerabilities || [];
+            if (!vulns.length)
+                return `No CVEs found for "${query}".`;
+            const lines = [
+                `## CVE Search: "${query}" (${data.totalResults} results)`,
+                '',
+                '| CVE | Severity | Score | Published | Description |',
+                '|-----|----------|-------|-----------|-------------|',
+            ];
+            for (const v of vulns.slice(0, 10)) {
+                const cve = v.cve;
+                const id = cve.id;
+                const desc = (cve.descriptions?.find((d) => d.lang === 'en')?.value || '?').slice(0, 80);
+                const metrics = cve.metrics?.cvssMetricV31?.[0]?.cvssData || cve.metrics?.cvssMetricV2?.[0]?.cvssData;
+                const score = metrics?.baseScore || '?';
+                const severity = metrics?.baseSeverity || '?';
+                const published = cve.published?.split('T')[0] || '?';
+                lines.push(`| ${id} | ${severity} | ${score} | ${published} | ${desc} |`);
+            }
+            return lines.join('\n');
+        },
+    });
+    // ─── Port Scanner ───
+    registerTool({
+        name: 'port_scan',
+        description: 'Scan common ports on a host to find open services. Checks the top 20 most common ports (HTTP, HTTPS, SSH, MySQL, Postgres, Redis, etc).',
+        parameters: {
+            host: { type: 'string', description: 'Hostname or IP to scan (e.g. "localhost", "192.168.1.1")', required: true },
+        },
+        tier: 'free',
+        timeout: 30_000,
+        async execute(args) {
+            const host = String(args.host);
+            const PORTS = [
+                { port: 21, service: 'FTP' },
+                { port: 22, service: 'SSH' },
+                { port: 25, service: 'SMTP' },
+                { port: 53, service: 'DNS' },
+                { port: 80, service: 'HTTP' },
+                { port: 443, service: 'HTTPS' },
+                { port: 3000, service: 'Dev Server' },
+                { port: 3306, service: 'MySQL' },
+                { port: 5173, service: 'Vite' },
+                { port: 5432, service: 'PostgreSQL' },
+                { port: 5900, service: 'VNC' },
+                { port: 6379, service: 'Redis' },
+                { port: 8080, service: 'HTTP Alt' },
+                { port: 8443, service: 'HTTPS Alt' },
+                { port: 8888, service: 'Jupyter' },
+                { port: 9090, service: 'Prometheus' },
+                { port: 11434, service: 'Ollama' },
+                { port: 27017, service: 'MongoDB' },
+            ];
+            const results = [];
+            await Promise.all(PORTS.map(async ({ port, service }) => {
+                try {
+                    const controller = new AbortController();
+                    const timeout = setTimeout(() => controller.abort(), 2000);
+                    await fetch(`http://${host}:${port}`, { signal: controller.signal, method: 'HEAD' }).catch(() => { });
+                    clearTimeout(timeout);
+                    // If we get here without abort, port is likely open
+                    // Use a more reliable TCP check
+                    const check = execSync(`nc -z -w 2 ${host} ${port} 2>/dev/null && echo "open" || echo "closed"`, { timeout: 3000 }).toString().trim();
+                    results.push({ port, service, open: check === 'open' });
+                }
+                catch {
+                    results.push({ port, service, open: false });
+                }
+            }));
+            results.sort((a, b) => a.port - b.port);
+            const openPorts = results.filter(r => r.open);
+            const lines = [
+                `## Port Scan: ${host}`,
+                '',
+                `**Open ports**: ${openPorts.length} / ${PORTS.length} scanned`,
+                '',
+            ];
+            if (openPorts.length > 0) {
+                lines.push('| Port | Service | Status |', '|------|---------|--------|');
+                for (const r of openPorts) {
+                    lines.push(`| ${r.port} | ${r.service} | OPEN |`);
+                }
+                // Security warnings
+                const risky = openPorts.filter(r => [21, 25, 3306, 5432, 6379, 27017, 5900].includes(r.port));
+                if (risky.length > 0) {
+                    lines.push('');
+                    lines.push('**Security Warnings:**');
+                    for (const r of risky) {
+                        lines.push(`- **Port ${r.port} (${r.service})** — should not be publicly exposed. Use firewall rules or bind to localhost.`);
+                    }
+                }
+            }
+            else {
+                lines.push('No open ports found (or host is unreachable).');
+            }
+            return lines.join('\n');
+        },
+    });
+    // ─── OWASP Quick Check ───
+    registerTool({
+        name: 'owasp_check',
+        description: 'Quick OWASP Top 10 check against a codebase. Scans for common vulnerability patterns: SQL injection, XSS, command injection, path traversal, hardcoded secrets, insecure deserialization.',
+        parameters: {
+            path: { type: 'string', description: 'Directory to scan (default: current directory)' },
+        },
+        tier: 'free',
+        timeout: 30_000,
+        async execute(args) {
+            const dir = String(args.path || process.cwd());
+            const CHECKS = [
+                {
+                    name: 'SQL Injection',
+                    owasp: 'A03:2021',
+                    patterns: [
+                        /`\s*(?:SELECT|INSERT|UPDATE|DELETE|DROP)\s+.*\$\{/i,
+                        /['"]?\s*\+\s*(?:req|params|query|body)\./i,
+                        /\.query\(\s*['"`].*\+/i,
+                    ],
+                    severity: 'CRITICAL',
+                    extensions: ['.ts', '.js', '.py', '.rb', '.php'],
+                },
+                {
+                    name: 'Command Injection',
+                    owasp: 'A03:2021',
+                    patterns: [
+                        /exec(?:Sync)?\(\s*[`'"].*\$\{/,
+                        /exec(?:Sync)?\(\s*.*\+\s*(?:req|params|query|body|args|input)/,
+                        /child_process.*exec.*\+/,
+                    ],
+                    severity: 'CRITICAL',
+                    extensions: ['.ts', '.js', '.py'],
+                },
+                {
+                    name: 'XSS (Cross-Site Scripting)',
+                    owasp: 'A03:2021',
+                    patterns: [
+                        /innerHTML\s*=\s*(?!['"]<)/,
+                        /dangerouslySetInnerHTML/,
+                        /document\.write\(/,
+                        /\.html\(\s*(?:req|params|query|body)/,
+                    ],
+                    severity: 'HIGH',
+                    extensions: ['.ts', '.tsx', '.js', '.jsx', '.html'],
+                },
+                {
+                    name: 'Path Traversal',
+                    owasp: 'A01:2021',
+                    patterns: [
+                        /(?:readFile|readFileSync|createReadStream)\(\s*(?:req|params|query|body)/,
+                        /path\.join\(\s*.*(?:req|params|query|body)/,
+                        /\.\.\/.*(?:req|params|query)/,
+                    ],
+                    severity: 'HIGH',
+                    extensions: ['.ts', '.js', '.py'],
+                },
+                {
+                    name: 'Insecure Deserialization',
+                    owasp: 'A08:2021',
+                    patterns: [
+                        /JSON\.parse\(\s*(?:req|body|params|query)/,
+                        /eval\(\s*JSON/,
+                        /yaml\.load\(\s*(?!.*Loader)/,
+                        /pickle\.loads?\(/,
+                    ],
+                    severity: 'HIGH',
+                    extensions: ['.ts', '.js', '.py'],
+                },
+                {
+                    name: 'Broken Access Control',
+                    owasp: 'A01:2021',
+                    patterns: [
+                        /(?:isAdmin|is_admin|role)\s*===?\s*['"](?:true|admin)['"]/,
+                        /req\.headers\[['"]x-forwarded-for['"]\]/,
+                    ],
+                    severity: 'MEDIUM',
+                    extensions: ['.ts', '.js', '.py'],
+                },
+            ];
+            const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', '.next', '__pycache__', 'target']);
+            const findings = [];
+            function scanDir(dirPath, depth) {
+                if (depth > 5)
+                    return;
+                try {
+                    for (const entry of readdirSync(dirPath)) {
+                        if (SKIP_DIRS.has(entry))
+                            continue;
+                        const fullPath = join(dirPath, entry);
+                        try {
+                            const stat = statSync(fullPath);
+                            if (stat.isDirectory()) {
+                                scanDir(fullPath, depth + 1);
+                                continue;
+                            }
+                            if (!stat.isFile() || stat.size > 200_000)
+                                continue;
+                            const ext = entry.slice(entry.lastIndexOf('.'));
+                            for (const check of CHECKS) {
+                                if (!check.extensions.includes(ext))
+                                    continue;
+                                try {
+                                    const content = readFileSync(fullPath, 'utf-8');
+                                    const lines = content.split('\n');
+                                    for (let i = 0; i < lines.length; i++) {
+                                        for (const pattern of check.patterns) {
+                                            if (pattern.test(lines[i])) {
+                                                findings.push({
+                                                    check: check.name,
+                                                    owasp: check.owasp,
+                                                    file: fullPath.replace(dir + '/', ''),
+                                                    line: i + 1,
+                                                    severity: check.severity,
+                                                    code: lines[i].trim().slice(0, 80),
+                                                });
+                                            }
+                                        }
+                                    }
+                                }
+                                catch { /* unreadable */ }
+                            }
+                        }
+                        catch { /* permission */ }
+                    }
+                }
+                catch { /* unreadable dir */ }
+            }
+            scanDir(dir, 0);
+            const lines = ['## OWASP Top 10 Quick Check', ''];
+            if (findings.length === 0) {
+                lines.push('**No OWASP patterns detected.** This is a static scan — it catches common patterns but not all vulnerabilities.');
+            }
+            else {
+                const bySeverity = { CRITICAL: 0, HIGH: 0, MEDIUM: 0 };
+                for (const f of findings)
+                    bySeverity[f.severity]++;
+                lines.push(`**${findings.length} potential issue(s) found:**`);
+                if (bySeverity.CRITICAL)
+                    lines.push(`- **CRITICAL**: ${bySeverity.CRITICAL}`);
+                if (bySeverity.HIGH)
+                    lines.push(`- **HIGH**: ${bySeverity.HIGH}`);
+                if (bySeverity.MEDIUM)
+                    lines.push(`- **MEDIUM**: ${bySeverity.MEDIUM}`);
+                lines.push('');
+                lines.push('| OWASP | Issue | File:Line | Severity | Code |');
+                lines.push('|-------|-------|-----------|----------|------|');
+                for (const f of findings.slice(0, 20)) {
+                    lines.push(`| ${f.owasp} | ${f.check} | ${f.file}:${f.line} | ${f.severity} | \`${f.code.slice(0, 50)}\` |`);
+                }
+                if (findings.length > 20)
+                    lines.push('', `*...and ${findings.length - 20} more*`);
+                lines.push('');
+                lines.push('*Static analysis — verify each finding manually. Some may be false positives.*');
+            }
+            return lines.join('\n');
+        },
+    });
+}
+//# sourceMappingURL=security.js.map