@panguard-ai/panguard-skill-auditor 1.7.3 → 1.8.2
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +18 -0
- package/dist/checks/atr-check.d.ts.map +1 -1
- package/dist/checks/atr-check.js +11 -2
- package/dist/checks/atr-check.js.map +1 -1
- package/dist/checks/cloud-rule-guard.d.ts +44 -0
- package/dist/checks/cloud-rule-guard.d.ts.map +1 -0
- package/dist/checks/cloud-rule-guard.js +196 -0
- package/dist/checks/cloud-rule-guard.js.map +1 -0
- package/package.json +6 -6
package/README.md
ADDED
|
@@ -0,0 +1,18 @@
|
|
|
1
|
+
# @panguard-ai/panguard-skill-auditor
|
|
2
|
+
|
|
3
|
+
Security auditor for OpenClaw and AgentSkills SKILL.md files — audit before deployment.
|
|
4
|
+
|
|
5
|
+
Analyze skill security:
|
|
6
|
+
|
|
7
|
+
- Pre-deployment vulnerability scanning
|
|
8
|
+
- SKILL.md format validation
|
|
9
|
+
- Risk categorization and reporting
|
|
10
|
+
- Integration with Panguard Guard and Scanner
|
|
11
|
+
|
|
12
|
+
Part of the **PanGuard Community** suite — 100% free and open source (MIT).
|
|
13
|
+
|
|
14
|
+
```bash
|
|
15
|
+
npm install @panguard-ai/panguard-skill-auditor
|
|
16
|
+
```
|
|
17
|
+
|
|
18
|
+
**License**: MIT
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"atr-check.d.ts","sourceRoot":"","sources":["../../src/checks/atr-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,KAAK,EAAgB,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"atr-check.d.ts","sourceRoot":"","sources":["../../src/checks/atr-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAMH,OAAO,KAAK,EAAgB,WAAW,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAmK5E;;;;;;;;;;GAUG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,aAAa,EACvB,UAAU,CAAC,EAAE,KAAK,CAAC;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,OAAO,CAAC;IAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;CAAE,CAAC,GAC5F,OAAO,CAAC,WAAW,CAAC,CAuJtB"}
|
package/dist/checks/atr-check.js
CHANGED
|
@@ -13,6 +13,7 @@ import { resolve, dirname } from 'node:path';
|
|
|
13
13
|
import { fileURLToPath } from 'node:url';
|
|
14
14
|
import { existsSync } from 'node:fs';
|
|
15
15
|
import { createRequire } from 'node:module';
|
|
16
|
+
import { filterInjectableCloudRules } from './cloud-rule-guard.js';
|
|
16
17
|
const CHECK_LABEL = 'ATR Pattern Detection';
|
|
17
18
|
// ---------------------------------------------------------------------------
|
|
18
19
|
// Capability declaration detection (mirrors scan-core context-signals logic)
|
|
@@ -188,9 +189,17 @@ export async function checkWithATR(manifest, cloudRules) {
|
|
|
188
189
|
engineConfig['fingerprintStore'] = fingerprintStore;
|
|
189
190
|
const engine = new ATREngine(engineConfig);
|
|
190
191
|
let ruleCount = await engine.loadRules();
|
|
191
|
-
// Inject cloud rules from Threat Cloud (flywheel: community rules enhance
|
|
192
|
+
// Inject cloud rules from Threat Cloud (flywheel: community rules enhance
|
|
193
|
+
// audits). These are network-delivered, community-authored detection logic
|
|
194
|
+
// whose regex the engine compiles and runs against the skill under audit, so
|
|
195
|
+
// they are executable trust. Defense-in-depth (regardless of caller): before
|
|
196
|
+
// any engine.addRule(), enforce the same MAX_CLOUD_RULES capacity cap and
|
|
197
|
+
// ReDoS pattern gate as the guard daemon's GuardATREngine.addCloudRule(),
|
|
198
|
+
// dropping any rule with an unsafe/oversized/catastrophic-backtracking regex.
|
|
199
|
+
// (Signature verification is enforced upstream in the CLI fetch loop.)
|
|
192
200
|
if (cloudRules && cloudRules.length > 0) {
|
|
193
|
-
|
|
201
|
+
const safeCloudRules = filterInjectableCloudRules(cloudRules);
|
|
202
|
+
for (const rule of safeCloudRules) {
|
|
194
203
|
try {
|
|
195
204
|
engine.addRule(rule);
|
|
196
205
|
ruleCount++;
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"atr-check.js","sourceRoot":"","sources":["../../src/checks/atr-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;
|
|
1
|
+
{"version":3,"file":"atr-check.js","sourceRoot":"","sources":["../../src/checks/atr-check.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAG5C,OAAO,EAAE,0BAA0B,EAAE,MAAM,uBAAuB,CAAC;AAEnE,MAAM,WAAW,GAAG,uBAAuB,CAAC;AAE5C,8EAA8E;AAC9E,6EAA6E;AAC7E,8EAA8E;AAE9E,MAAM,qBAAqB,GACzB,qFAAqF,CAAC;AAExF,MAAM,uBAAuB,GAAG,6BAA6B,CAAC;AAE9D,MAAM,oBAAoB,GACxB,+LAA+L,CAAC;AAIlM,SAAS,sBAAsB,CAAC,QAAuB;IACrD,MAAM,GAAG,GAAyC;QAChD,QAAQ,EAAE,QAAQ;QAClB,IAAI,EAAE,KAAK;QACX,MAAM,EAAE,KAAK;QACb,GAAG,EAAE,MAAM;QACX,IAAI,EAAE,MAAM;KACb,CAAC;IACF,OAAO,GAAG,CAAC,QAAQ,CAAC,IAAI,MAAM,CAAC;AACjC,CAAC;AAED;;;GAGG;AACH,SAAS,uBAAuB,CAAC,QAAuB;IAItD,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,IAAI,EAAE,CAAC;IAC5C,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;IAChC,MAAM,OAAO,GAAG,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC;IACvC,MAAM,aAAa,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,WAAW,GAAG,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,WAAW,GACf,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;IAE9F,OAAO;QACL,uBAAuB,EAAE,OAAO,IAAI,OAAO,IAAI,aAAa,IAAI,WAAW;QAC3E,mBAAmB,EAAE,WAAW;KACjC,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,MAAM,YAAY,GAA6C;IAC7D,kBAAkB,EAAE,kBAAkB;IACtC,gBAAgB,EAAE,gBAAgB;IAClC,sBAAsB,EAAE,sBAAsB;IAC9C,oBAAoB,EAAE,oBAAoB;IAC1C,sBAAsB,EAAE,sBAAsB;IAC9C,oBAAoB,EAAE,oBAAoB;IAC1C,gBAAgB,EAAE,gBAAgB;IAClC,aAAa,EAAE,aAAa;IAC5B,kBAAkB,EAAE,kBAAkB;CACvC,CAAC;AAEF;;;GAGG;AACH,SAAS,eAAe;IACtB,uDAAuD;IACvD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,CAAC,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,CAAC;QAChD,IAAI,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAAE,OAAO,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC9E,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IACxD,IAAI,GAAG,GAAG,OAAO,CAAC;IAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE,cAAc,EAAE,oBAAoB,EAAE,OAAO,CAAC,CAAC;QAC9E,IAAI,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;QAC5C,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;;;GASG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO;QACP,MAAM,EAAE;YACN,UAAU,EAAE,OAAO;SACpB;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,kBAAkB,CACzB,QAAgB,EAChB,WAAmB,EACnB,WAAqB;IAErB,OAAO;QACL,IAAI,EAAE,WAAW;QACjB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,WAAW;QACpB,MAAM,EAAE;YACN,SAAS,EAAE,QAAQ;YACnB,SAAS,EAAE,OAAO,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,IAAI,EAAE,CAAC;SAC7F;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,SAAS,iBAAiB,CAAC,OAA4B;IACrD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,SAAS;QAC/B,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAEjB,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC;QACjE,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC,QAAQ,KAAK,eAAe,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC;QAEvF,QAAQ,CAAC,IAAI,CAAC;YACZ,EAAE,EAAE,OAAO,MAAM,EAAE;YACnB,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK;YACvB,WAAW,EAAE,KAAK,CAAC,IAAI,CAAC,WAAW;YACnC,QAAQ;YACR,QAAQ;YACR,QAAQ,EACN,KAAK,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC;gBAC9B,CAAC,CAAC,YAAY,KAAK,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAC5D,CAAC,CAAC,SAAS;SAChB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAuB,EACvB,UAA6F;IAE7F,wDAAwD;IACxD,IAAI,SAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QAC7C,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,WAAW;YAClB,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,eAAe,EAAE,CAAC;QAEnC,0DAA0D;QAC1D,IAAI,gBAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,MAAM,EAAE,qBAAqB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YACnE,gBAAgB,GAAG,IAAI,qBAAqB,EAAE,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,sDAAsD;QACxD,CAAC;QAED,MAAM,YAAY,GAA4B,EAAE,QAAQ,EAAE,CAAC;QAC3D,IAAI,gBAAgB;YAAE,YAAY,CAAC,kBAAkB,CAAC,GAAG,gBAAgB,CAAC;QAC1E,MAAM,MAAM,GAAG,IAAI,SAAS,CAAC,YAA8D,CAAC,CAAC;QAC7F,IAAI,SAAS,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;QAEzC,0EAA0E;QAC1E,2EAA2E;QAC3E,6EAA6E;QAC7E,6EAA6E;QAC7E,0EAA0E;QAC1E,0EAA0E;QAC1E,8EAA8E;QAC9E,uEAAuE;QACvE,IAAI,UAAU,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,MAAM,cAAc,GAAG,0BAA0B,CAAC,UAAU,CAAC,CAAC;YAC9D,KAAK,MAAM,IAAI,IAAI,cAAc,EAAE,CAAC;gBAClC,IAAI,CAAC;oBACH,MAAM,CAAC,OAAO,CAAC,IAAqD,CAAC,CAAC;oBACtE,SAAS,EAAE,CAAC;gBACd,CAAC;gBAAC,MAAM,CAAC;oBACP,oCAAoC;gBACtC,CAAC;YACH,CAAC;QACH,CAAC;QAED,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,OAAO;gBACL,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,GAAG,WAAW,mBAAmB;gBACxC,QAAQ,EAAE,EAAE;aACb,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAe,EAAE,CAAC;QAElC,yEAAyE;QACzE,uEAAuE;QACvE,yEAAyE;QACzE,sEAAsE;QACtE,mEAAmE;QACnE,yEAAyE;QACzE,yEAAyE;QACzE,0EAA0E;QAC1E,yEAAyE;QACzE,mCAAmC;QACnC,EAAE;QACF,wEAAwE;QACxE,6EAA6E;QAC7E,6EAA6E;QAC7E,2EAA2E;QAC3E,uEAAuE;QACvE,wDAAwD;QACxD,IAAI,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1B,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;YAC5D,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QACjF,CAAC;QAED,kDAAkD;QAClD,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC;YACzB,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,SAAS,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC;YAC3D,UAAU,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,kBAAkB,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;QAChF,CAAC;QAED,4DAA4D;QAC5D,MAAM,QAAQ,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC,WAAW,CAAC,CAAC;QAClD,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;gBAC5B,MAAM,CAAC,GAAG,IAA+B,CAAC;gBAC1C,IAAI,OAAO,CAAC,CAAC,aAAa,CAAC,KAAK,QAAQ,EAAE,CAAC;oBACzC,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CACjC,kBAAkB,CACf,CAAC,CAAC,MAAM,CAAY,IAAI,EAAE,EAC3B,CAAC,CAAC,aAAa,CAAW,EAC1B,CAAC,CAAC,aAAa,CAAC,CACjB,CACF,CAAC;oBACF,UAAU,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,CAAC;gBAClC,CAAC;YACH,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,IAAI,QAAQ,GAAG,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAE7C,kDAAkD;QAClD,MAAM,MAAM,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,MAAM,CAAC,uBAAuB,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;YACjE,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;gBAC5B,IAAI,QAAQ,GAAG,CAAC,CAAC,QAAyB,CAAC;gBAC3C,IAAI,MAAM,CAAC,uBAAuB,EAAE,CAAC;oBACnC,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;gBAC9C,CAAC;gBACD,IAAI,MAAM,CAAC,mBAAmB,EAAE,CAAC;oBAC/B,QAAQ,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;gBAC9C,CAAC;gBACD,OAAO,QAAQ,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YAC1D,CAAC,CAAC,CAAC;QACL,CAAC;QAED,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;QACpE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC;QAE5D,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC;QAE/F,MAAM,KAAK,GACT,QAAQ,CAAC,MAAM,KAAK,CAAC;YACnB,CAAC,CAAC,GAAG,WAAW,YAAY,SAAS,mBAAmB;YACxD,CAAC,CAAC,GAAG,WAAW,KAAK,QAAQ,CAAC,MAAM,qBAAqB,CAAC;QAE9D,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,MAAM,EAAE,MAAM;YACd,KAAK,EAAE,GAAG,WAAW,gBAAgB;YACrC,QAAQ,EAAE;gBACR;oBACE,EAAE,EAAE,kBAAkB;oBACtB,KAAK,EAAE,iCAAiC;oBACxC,WAAW,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;oBAC7D,QAAQ,EAAE,MAAM;oBAChB,QAAQ,EAAE,KAAK;iBAChB;aACF;SACF,CAAC;IACJ,CAAC;AACH,CAAC"}
|
|
@@ -0,0 +1,44 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* cloud-rule-guard.ts - Trust gate for community ("cloud") ATR rules before they
|
|
3
|
+
* are injected into the audit engine.
|
|
4
|
+
*
|
|
5
|
+
* Cloud rules are network-delivered, community-authored detection logic. The
|
|
6
|
+
* engine compiles their `detection` regex and runs it against the skill under
|
|
7
|
+
* audit, so an unbounded or ReDoS-crafted rule is executable trust — a malicious
|
|
8
|
+
* or malformed rule can hang the auditor or exhaust its resources. This module
|
|
9
|
+
* mirrors the guard-daemon's GuardATREngine.validatePatterns() ReDoS gate and its
|
|
10
|
+
* MAX_CLOUD_RULES capacity cap so the skill-auditor path shares the SAME trust
|
|
11
|
+
* boundary as the daemon (see rule-loader.ts / atr-engine.ts in panguard-guard).
|
|
12
|
+
*
|
|
13
|
+
* Signature verification (Ed25519, fail-closed) is enforced upstream in the CLI
|
|
14
|
+
* fetch loop before rules reach this module; this is the defense-in-depth layer
|
|
15
|
+
* that protects any programmatic caller of checkWithATR() regardless of source.
|
|
16
|
+
*
|
|
17
|
+
* @module @panguard-ai/panguard-skill-auditor/checks/cloud-rule-guard
|
|
18
|
+
*/
|
|
19
|
+
/** Cap on how many cloud rules may be injected (mirrors daemon MAX_CLOUD_RULES). */
|
|
20
|
+
export declare const MAX_CLOUD_RULES = 500;
|
|
21
|
+
/** Minimal shape of an injectable cloud rule (detection carries the patterns). */
|
|
22
|
+
export interface CloudRuleShape {
|
|
23
|
+
readonly id?: unknown;
|
|
24
|
+
readonly title?: unknown;
|
|
25
|
+
readonly detection?: unknown;
|
|
26
|
+
readonly [key: string]: unknown;
|
|
27
|
+
}
|
|
28
|
+
/**
|
|
29
|
+
* Validate every regex pattern in a cloud rule's detection block. Returns false
|
|
30
|
+
* (reject the whole rule) on the first unsafe pattern. Covers both condition
|
|
31
|
+
* shapes used by ATR rules:
|
|
32
|
+
* - array-format: detection.conditions[].value (operator regex)
|
|
33
|
+
* - named/grouped: detection.conditions[].patterns[] (string list)
|
|
34
|
+
* A rule with no regex patterns is accepted (nothing unsafe to execute).
|
|
35
|
+
*/
|
|
36
|
+
export declare function isCloudRuleSafe(rule: CloudRuleShape): boolean;
|
|
37
|
+
/**
|
|
38
|
+
* Filter an incoming list of cloud rules down to those that are safe to inject:
|
|
39
|
+
* enforce the capacity cap FIRST (truncate to MAX_CLOUD_RULES) and drop any rule
|
|
40
|
+
* whose detection carries an unsafe/ReDoS/oversized pattern. Pure function —
|
|
41
|
+
* returns a NEW array, never mutates the input.
|
|
42
|
+
*/
|
|
43
|
+
export declare function filterInjectableCloudRules<T extends CloudRuleShape>(rules: readonly T[]): T[];
|
|
44
|
+
//# sourceMappingURL=cloud-rule-guard.d.ts.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cloud-rule-guard.d.ts","sourceRoot":"","sources":["../../src/checks/cloud-rule-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,oFAAoF;AACpF,eAAO,MAAM,eAAe,MAAM,CAAC;AAKnC,kFAAkF;AAClF,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,EAAE,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACjC;AAuHD;;;;;;;GAOG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAuB7D;AAED;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,CAAC,SAAS,cAAc,EAAE,KAAK,EAAE,SAAS,CAAC,EAAE,GAAG,CAAC,EAAE,CAE7F"}
|
|
@@ -0,0 +1,196 @@
|
|
|
1
|
+
/**
|
|
2
|
+
* cloud-rule-guard.ts - Trust gate for community ("cloud") ATR rules before they
|
|
3
|
+
* are injected into the audit engine.
|
|
4
|
+
*
|
|
5
|
+
* Cloud rules are network-delivered, community-authored detection logic. The
|
|
6
|
+
* engine compiles their `detection` regex and runs it against the skill under
|
|
7
|
+
* audit, so an unbounded or ReDoS-crafted rule is executable trust — a malicious
|
|
8
|
+
* or malformed rule can hang the auditor or exhaust its resources. This module
|
|
9
|
+
* mirrors the guard-daemon's GuardATREngine.validatePatterns() ReDoS gate and its
|
|
10
|
+
* MAX_CLOUD_RULES capacity cap so the skill-auditor path shares the SAME trust
|
|
11
|
+
* boundary as the daemon (see rule-loader.ts / atr-engine.ts in panguard-guard).
|
|
12
|
+
*
|
|
13
|
+
* Signature verification (Ed25519, fail-closed) is enforced upstream in the CLI
|
|
14
|
+
* fetch loop before rules reach this module; this is the defense-in-depth layer
|
|
15
|
+
* that protects any programmatic caller of checkWithATR() regardless of source.
|
|
16
|
+
*
|
|
17
|
+
* @module @panguard-ai/panguard-skill-auditor/checks/cloud-rule-guard
|
|
18
|
+
*/
|
|
19
|
+
/** Cap on how many cloud rules may be injected (mirrors daemon MAX_CLOUD_RULES). */
|
|
20
|
+
export const MAX_CLOUD_RULES = 500;
|
|
21
|
+
/** Longest single regex pattern we will compile (resource bound). */
|
|
22
|
+
const MAX_PATTERN_LEN = 2000;
|
|
23
|
+
/**
|
|
24
|
+
* True when the token that begins at `src[i]` is followed by an UNBOUNDED
|
|
25
|
+
* quantifier (`+`, `*`, or `{n,}` with no upper bound). Bounded quantifiers like
|
|
26
|
+
* `{2,4}` cannot drive exponential backtracking, so they are treated as safe.
|
|
27
|
+
*/
|
|
28
|
+
function hasUnboundedQuantifierAt(src, i) {
|
|
29
|
+
const next = src[i];
|
|
30
|
+
if (next === '+' || next === '*')
|
|
31
|
+
return true;
|
|
32
|
+
if (next === '{')
|
|
33
|
+
return /^\{\d*,\}/.test(src.slice(i));
|
|
34
|
+
return false;
|
|
35
|
+
}
|
|
36
|
+
/**
|
|
37
|
+
* Scan the interior of a group for a quantified atom or a quantified inner
|
|
38
|
+
* group — the ingredient that, when the whole group is itself quantified,
|
|
39
|
+
* produces catastrophic backtracking (e.g. the inner `+` of `(([a-z])+)+`).
|
|
40
|
+
* Character classes and escapes are skipped so their contents are not mistaken
|
|
41
|
+
* for quantifiable structure.
|
|
42
|
+
*/
|
|
43
|
+
function interiorHasQuantifiedAtom(interior) {
|
|
44
|
+
for (let i = 0; i < interior.length; i++) {
|
|
45
|
+
const c = interior[i];
|
|
46
|
+
if (c === '\\') {
|
|
47
|
+
i++;
|
|
48
|
+
continue;
|
|
49
|
+
}
|
|
50
|
+
if (c === '[') {
|
|
51
|
+
i++;
|
|
52
|
+
while (i < interior.length && interior[i] !== ']') {
|
|
53
|
+
if (interior[i] === '\\')
|
|
54
|
+
i++;
|
|
55
|
+
i++;
|
|
56
|
+
}
|
|
57
|
+
if (hasUnboundedQuantifierAt(interior, i + 1))
|
|
58
|
+
return true;
|
|
59
|
+
continue;
|
|
60
|
+
}
|
|
61
|
+
if (c === ')') {
|
|
62
|
+
if (hasUnboundedQuantifierAt(interior, i + 1))
|
|
63
|
+
return true;
|
|
64
|
+
continue;
|
|
65
|
+
}
|
|
66
|
+
if (c === '+' || c === '*')
|
|
67
|
+
return true;
|
|
68
|
+
if (c === '{' && /^\{\d*,\}/.test(interior.slice(i)))
|
|
69
|
+
return true;
|
|
70
|
+
}
|
|
71
|
+
return false;
|
|
72
|
+
}
|
|
73
|
+
/**
|
|
74
|
+
* Structurally detect catastrophic nested-quantifier regexes: any group `(...)`
|
|
75
|
+
* that is itself quantified by an unbounded quantifier AND whose interior
|
|
76
|
+
* contains a quantified atom or quantified subgroup. This is the `(a+)+` /
|
|
77
|
+
* `(([a-z])+)+` / `((ab)*)*` / `(a*)*b` class. A flat `/\([^)]*[+*]\)[+*{]/`
|
|
78
|
+
* heuristic cannot see an INNER quantified group (its `[^)]*` cannot cross a
|
|
79
|
+
* nested `)`), so it accepted `(([a-z])+)+` despite clean exponential blowup.
|
|
80
|
+
* Walks the source via a paren stack (honoring escapes + char classes) and
|
|
81
|
+
* checks each quantified group's interior at any nesting depth. Mirrors the
|
|
82
|
+
* guard daemon's GuardATREngine gate so both paths share the same trust bound.
|
|
83
|
+
*/
|
|
84
|
+
function hasNestedQuantifier(src) {
|
|
85
|
+
const openStack = [];
|
|
86
|
+
const groups = [];
|
|
87
|
+
for (let i = 0; i < src.length; i++) {
|
|
88
|
+
const c = src[i];
|
|
89
|
+
if (c === '\\') {
|
|
90
|
+
i++;
|
|
91
|
+
continue;
|
|
92
|
+
}
|
|
93
|
+
if (c === '[') {
|
|
94
|
+
i++;
|
|
95
|
+
while (i < src.length && src[i] !== ']') {
|
|
96
|
+
if (src[i] === '\\')
|
|
97
|
+
i++;
|
|
98
|
+
i++;
|
|
99
|
+
}
|
|
100
|
+
continue;
|
|
101
|
+
}
|
|
102
|
+
if (c === '(')
|
|
103
|
+
openStack.push(i);
|
|
104
|
+
else if (c === ')') {
|
|
105
|
+
const start = openStack.pop();
|
|
106
|
+
if (start !== undefined)
|
|
107
|
+
groups.push({ start, end: i });
|
|
108
|
+
}
|
|
109
|
+
}
|
|
110
|
+
for (const g of groups) {
|
|
111
|
+
if (!hasUnboundedQuantifierAt(src, g.end + 1))
|
|
112
|
+
continue;
|
|
113
|
+
if (interiorHasQuantifiedAtom(src.slice(g.start + 1, g.end)))
|
|
114
|
+
return true;
|
|
115
|
+
}
|
|
116
|
+
return false;
|
|
117
|
+
}
|
|
118
|
+
/**
|
|
119
|
+
* ReDoS safety check for the cloud-rule compile gate. Detects
|
|
120
|
+
* catastrophic-backtracking structures that compile fine but hang on
|
|
121
|
+
* non-matching input: nested quantifiers at ANY depth (structural walk),
|
|
122
|
+
* overlapping alternations like (a|a)+, and star-of-star like .*.*.*.
|
|
123
|
+
* Kept in lockstep with panguard-guard's GuardATREngine.isSafeRegex.
|
|
124
|
+
*/
|
|
125
|
+
function isSafeRegex(re) {
|
|
126
|
+
const src = re.source;
|
|
127
|
+
if (hasNestedQuantifier(src))
|
|
128
|
+
return false;
|
|
129
|
+
if (/\(([^|)]+)\|\1\)[+*]/.test(src))
|
|
130
|
+
return false;
|
|
131
|
+
if (/(\.\*){3,}/.test(src))
|
|
132
|
+
return false;
|
|
133
|
+
return true;
|
|
134
|
+
}
|
|
135
|
+
/** A single pattern is safe iff it is a bounded string, compiles, and is ReDoS-safe. */
|
|
136
|
+
function isPatternSafe(pattern) {
|
|
137
|
+
if (typeof pattern !== 'string')
|
|
138
|
+
return false;
|
|
139
|
+
if (pattern.length > MAX_PATTERN_LEN)
|
|
140
|
+
return false;
|
|
141
|
+
try {
|
|
142
|
+
// Strip the (?i) inline flag (unsupported in JS) exactly like the compiler does.
|
|
143
|
+
const hasInlineIgnoreCase = /\(\?i\)/.test(pattern);
|
|
144
|
+
const cleaned = hasInlineIgnoreCase ? pattern.replace(/\(\?i\)/g, '') : pattern;
|
|
145
|
+
const flags = hasInlineIgnoreCase ? 'i' : '';
|
|
146
|
+
const re = new RegExp(cleaned, flags);
|
|
147
|
+
return isSafeRegex(re);
|
|
148
|
+
}
|
|
149
|
+
catch {
|
|
150
|
+
return false;
|
|
151
|
+
}
|
|
152
|
+
}
|
|
153
|
+
/**
|
|
154
|
+
* Validate every regex pattern in a cloud rule's detection block. Returns false
|
|
155
|
+
* (reject the whole rule) on the first unsafe pattern. Covers both condition
|
|
156
|
+
* shapes used by ATR rules:
|
|
157
|
+
* - array-format: detection.conditions[].value (operator regex)
|
|
158
|
+
* - named/grouped: detection.conditions[].patterns[] (string list)
|
|
159
|
+
* A rule with no regex patterns is accepted (nothing unsafe to execute).
|
|
160
|
+
*/
|
|
161
|
+
export function isCloudRuleSafe(rule) {
|
|
162
|
+
const detection = rule.detection;
|
|
163
|
+
if (!detection || typeof detection !== 'object')
|
|
164
|
+
return true;
|
|
165
|
+
const conditions = detection.conditions;
|
|
166
|
+
if (!Array.isArray(conditions))
|
|
167
|
+
return true;
|
|
168
|
+
for (const cond of conditions) {
|
|
169
|
+
if (!cond || typeof cond !== 'object')
|
|
170
|
+
continue;
|
|
171
|
+
const patterns = cond.patterns;
|
|
172
|
+
if (Array.isArray(patterns)) {
|
|
173
|
+
for (const p of patterns) {
|
|
174
|
+
if (!isPatternSafe(p))
|
|
175
|
+
return false;
|
|
176
|
+
}
|
|
177
|
+
}
|
|
178
|
+
const operator = cond.operator;
|
|
179
|
+
if (operator === 'regex') {
|
|
180
|
+
const value = cond.value;
|
|
181
|
+
if (!isPatternSafe(value))
|
|
182
|
+
return false;
|
|
183
|
+
}
|
|
184
|
+
}
|
|
185
|
+
return true;
|
|
186
|
+
}
|
|
187
|
+
/**
|
|
188
|
+
* Filter an incoming list of cloud rules down to those that are safe to inject:
|
|
189
|
+
* enforce the capacity cap FIRST (truncate to MAX_CLOUD_RULES) and drop any rule
|
|
190
|
+
* whose detection carries an unsafe/ReDoS/oversized pattern. Pure function —
|
|
191
|
+
* returns a NEW array, never mutates the input.
|
|
192
|
+
*/
|
|
193
|
+
export function filterInjectableCloudRules(rules) {
|
|
194
|
+
return rules.slice(0, MAX_CLOUD_RULES).filter((r) => isCloudRuleSafe(r));
|
|
195
|
+
}
|
|
196
|
+
//# sourceMappingURL=cloud-rule-guard.js.map
|
|
@@ -0,0 +1 @@
|
|
|
1
|
+
{"version":3,"file":"cloud-rule-guard.js","sourceRoot":"","sources":["../../src/checks/cloud-rule-guard.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,oFAAoF;AACpF,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AAEnC,qEAAqE;AACrE,MAAM,eAAe,GAAG,IAAI,CAAC;AAU7B;;;;GAIG;AACH,SAAS,wBAAwB,CAAC,GAAW,EAAE,CAAS;IACtD,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACpB,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACxD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,yBAAyB,CAAC,QAAgB;IACjD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBAClD,IAAI,QAAQ,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,EAAE,CAAC;gBAC9B,CAAC,EAAE,CAAC;YACN,CAAC;YACD,IAAI,wBAAwB,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,IAAI,wBAAwB,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;gBAAE,OAAO,IAAI,CAAC;YAC3D,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACxC,IAAI,CAAC,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACpE,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAS,mBAAmB,CAAC,GAAW;IACtC,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,MAAM,GAA0C,EAAE,CAAC;IACzD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACf,CAAC,EAAE,CAAC;YACJ,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACd,CAAC,EAAE,CAAC;YACJ,OAAO,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;gBACxC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,IAAI;oBAAE,CAAC,EAAE,CAAC;gBACzB,CAAC,EAAE,CAAC;YACN,CAAC;YACD,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,GAAG;YAAE,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aAC5B,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACnB,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,EAAE,CAAC;YAC9B,IAAI,KAAK,KAAK,SAAS;gBAAE,MAAM,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC;YAAE,SAAS;QACxD,IAAI,yBAAyB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IAC5E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,EAAU;IAC7B,MAAM,GAAG,GAAG,EAAE,CAAC,MAAM,CAAC;IACtB,IAAI,mBAAmB,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,sBAAsB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACzC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,wFAAwF;AACxF,SAAS,aAAa,CAAC,OAAgB;IACrC,IAAI,OAAO,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,IAAI,OAAO,CAAC,MAAM,GAAG,eAAe;QAAE,OAAO,KAAK,CAAC;IACnD,IAAI,CAAC;QACH,iFAAiF;QACjF,MAAM,mBAAmB,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpD,MAAM,OAAO,GAAG,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAChF,MAAM,KAAK,GAAG,mBAAmB,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,WAAW,CAAC,EAAE,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,IAAoB;IAClD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;IACjC,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC7D,MAAM,UAAU,GAAI,SAAsC,CAAC,UAAU,CAAC;IACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAS;QAEhD,MAAM,QAAQ,GAAI,IAA+B,CAAC,QAAQ,CAAC;QAC3D,IAAI,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC5B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;gBACzB,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;oBAAE,OAAO,KAAK,CAAC;YACtC,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAI,IAA+B,CAAC,QAAQ,CAAC;QAC3D,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;YACzB,MAAM,KAAK,GAAI,IAA4B,CAAC,KAAK,CAAC;YAClD,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC;gBAAE,OAAO,KAAK,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,0BAA0B,CAA2B,KAAmB;IACtF,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@panguard-ai/panguard-skill-auditor",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.8.2",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -30,12 +30,12 @@
|
|
|
30
30
|
"LICENSE"
|
|
31
31
|
],
|
|
32
32
|
"dependencies": {
|
|
33
|
-
"agent-threat-rules": "^3.5.
|
|
33
|
+
"agent-threat-rules": "^3.5.6",
|
|
34
34
|
"js-yaml": "^4.1.0",
|
|
35
|
-
"@panguard-ai/atr": "1.
|
|
36
|
-
"@panguard-ai/core": "1.
|
|
37
|
-
"@panguard-ai/
|
|
38
|
-
"@panguard-ai/scan
|
|
35
|
+
"@panguard-ai/atr": "1.8.2",
|
|
36
|
+
"@panguard-ai/scan-core": "1.8.2",
|
|
37
|
+
"@panguard-ai/core": "1.8.2",
|
|
38
|
+
"@panguard-ai/panguard-scan": "1.8.2"
|
|
39
39
|
},
|
|
40
40
|
"devDependencies": {
|
|
41
41
|
"@types/js-yaml": "^4.0.9",
|