@panguard-ai/panguard-skill-auditor 1.8.14 → 1.8.19
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/checks/llm-auto-detect.d.ts.map +1 -1
- package/dist/checks/llm-auto-detect.js +40 -4
- package/dist/checks/llm-auto-detect.js.map +1 -1
- package/dist/index.d.ts.map +1 -1
- package/dist/index.js +7 -2
- package/dist/index.js.map +1 -1
- package/dist/types.d.ts +8 -0
- package/dist/types.d.ts.map +1 -1
- package/package.json +2 -2
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"llm-auto-detect.d.ts","sourceRoot":"","sources":["../../src/checks/llm-auto-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;
|
|
1
|
+
{"version":3,"file":"llm-auto-detect.d.ts","sourceRoot":"","sources":["../../src/checks/llm-auto-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAyBtD;;;;;GAKG;AACH,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC,CA2E3E"}
|
|
@@ -11,6 +11,27 @@
|
|
|
11
11
|
*/
|
|
12
12
|
/** Cache Ollama availability to avoid repeated HTTP calls that spam error logs */
|
|
13
13
|
let _ollamaCached;
|
|
14
|
+
/**
|
|
15
|
+
* Ask the local Ollama daemon which models are actually PULLED, and return the
|
|
16
|
+
* first one. The auditor previously hard-coded 'llama3' as the Ollama model and
|
|
17
|
+
* only checked that the Ollama *server* was up (not that the model existed), so
|
|
18
|
+
* any user who pulled a different model (qwen2.5, mistral, phi, …) got a silent
|
|
19
|
+
* 404 "model not found" at analyze time and the AI layer degraded to ATR-only.
|
|
20
|
+
* Returns null if Ollama is unreachable or has no models pulled.
|
|
21
|
+
*/
|
|
22
|
+
async function firstInstalledOllamaModel() {
|
|
23
|
+
const host = (process.env['OLLAMA_HOST'] ?? 'http://127.0.0.1:11434').replace(/\/+$/, '');
|
|
24
|
+
try {
|
|
25
|
+
const res = await fetch(`${host}/api/tags`, { signal: AbortSignal.timeout(2000) });
|
|
26
|
+
if (!res.ok)
|
|
27
|
+
return null;
|
|
28
|
+
const data = (await res.json());
|
|
29
|
+
return data.models?.find((m) => typeof m.name === 'string' && m.name.length > 0)?.name ?? null;
|
|
30
|
+
}
|
|
31
|
+
catch {
|
|
32
|
+
return null;
|
|
33
|
+
}
|
|
34
|
+
}
|
|
14
35
|
/**
|
|
15
36
|
* Attempt to auto-detect and create a SkillAnalysisLLM from available providers.
|
|
16
37
|
*
|
|
@@ -22,10 +43,9 @@ export async function autoDetectSkillLLM() {
|
|
|
22
43
|
const { createLLM } = await import('@panguard-ai/core');
|
|
23
44
|
let provider;
|
|
24
45
|
let apiKey;
|
|
25
|
-
const
|
|
46
|
+
const defaultCloudModels = {
|
|
26
47
|
claude: 'claude-sonnet-4-20250514',
|
|
27
48
|
openai: 'gpt-4o',
|
|
28
|
-
ollama: 'llama3',
|
|
29
49
|
};
|
|
30
50
|
// Check environment variables first (cloud providers), then fall back to Ollama
|
|
31
51
|
if (process.env['ANTHROPIC_API_KEY']) {
|
|
@@ -42,8 +62,24 @@ export async function autoDetectSkillLLM() {
|
|
|
42
62
|
if (_ollamaCached !== undefined)
|
|
43
63
|
return _ollamaCached;
|
|
44
64
|
}
|
|
45
|
-
//
|
|
46
|
-
|
|
65
|
+
// Resolve the model. An explicit PANGUARD_LLM_MODEL always wins. For Ollama,
|
|
66
|
+
// detect a model that is actually PULLED instead of assuming 'llama3' — if
|
|
67
|
+
// none is installed (or Ollama is unreachable), the AI layer is unavailable
|
|
68
|
+
// and we degrade to ATR-only rather than 404 on every analyze() call.
|
|
69
|
+
let model = process.env['PANGUARD_LLM_MODEL'];
|
|
70
|
+
if (!model) {
|
|
71
|
+
if (provider === 'ollama') {
|
|
72
|
+
const detected = await firstInstalledOllamaModel();
|
|
73
|
+
if (!detected) {
|
|
74
|
+
_ollamaCached = null;
|
|
75
|
+
return null;
|
|
76
|
+
}
|
|
77
|
+
model = detected;
|
|
78
|
+
}
|
|
79
|
+
else {
|
|
80
|
+
model = defaultCloudModels[provider];
|
|
81
|
+
}
|
|
82
|
+
}
|
|
47
83
|
const llmProvider = createLLM({ provider, model, apiKey, lang: 'en' });
|
|
48
84
|
const available = await llmProvider.isAvailable();
|
|
49
85
|
if (!available) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"llm-auto-detect.js","sourceRoot":"","sources":["../../src/checks/llm-auto-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,kFAAkF;AAClF,IAAI,aAAkD,CAAC;AAEvD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAIxD,IAAI,QAAsB,CAAC;QAC3B,IAAI,MAA0B,CAAC;QAE/B,MAAM,
|
|
1
|
+
{"version":3,"file":"llm-auto-detect.js","sourceRoot":"","sources":["../../src/checks/llm-auto-detect.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,kFAAkF;AAClF,IAAI,aAAkD,CAAC;AAEvD;;;;;;;GAOG;AACH,KAAK,UAAU,yBAAyB;IACtC,MAAM,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,wBAAwB,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1F,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,WAAW,EAAE,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QACnF,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA0C,CAAC;QACzE,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,EAAE,IAAI,IAAI,IAAI,CAAC;IACjG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB;IACtC,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,mBAAmB,CAAC,CAAC;QAIxD,IAAI,QAAsB,CAAC;QAC3B,IAAI,MAA0B,CAAC;QAE/B,MAAM,kBAAkB,GAAwC;YAC9D,MAAM,EAAE,0BAA0B;YAClC,MAAM,EAAE,QAAQ;SACjB,CAAC;QAEF,gFAAgF;QAChF,IAAI,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACrC,QAAQ,GAAG,QAAQ,CAAC;YACpB,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACzC,QAAQ,GAAG,QAAQ,CAAC;YACpB,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC;QACzC,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,QAAQ,CAAC;YACpB,sEAAsE;YACtE,IAAI,aAAa,KAAK,SAAS;gBAAE,OAAO,aAAa,CAAC;QACxD,CAAC;QAED,6EAA6E;QAC7E,2EAA2E;QAC3E,4EAA4E;QAC5E,sEAAsE;QACtE,IAAI,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC,CAAC;QAC9C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;gBAC1B,MAAM,QAAQ,GAAG,MAAM,yBAAyB,EAAE,CAAC;gBACnD,IAAI,CAAC,QAAQ,EAAE,CAAC;oBACd,aAAa,GAAG,IAAI,CAAC;oBACrB,OAAO,IAAI,CAAC;gBACd,CAAC;gBACD,KAAK,GAAG,QAAQ,CAAC;YACnB,CAAC;iBAAM,CAAC;gBACN,KAAK,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAC;YACvC,CAAC;QACH,CAAC;QAED,MAAM,WAAW,GAAG,SAAS,CAAC,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAEvE,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,WAAW,EAAE,CAAC;QAClD,IAAI,CAAC,SAAS,EAAE,CAAC;YACf,IAAI,QAAQ,KAAK,QAAQ;gBAAE,aAAa,GAAG,IAAI,CAAC;YAChD,OAAO,IAAI,CAAC;QACd,CAAC;QAED,2DAA2D;QAC3D,MAAM,OAAO,GAAqB;YAChC,KAAK,CAAC,OAAO,CAAC,MAAc,EAAE,OAAgB;gBAC5C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;gBAC1D,OAAO;oBACL,OAAO,EAAE,MAAM,CAAC,OAAO;oBACvB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,MAAM,CAAC,UAAU;oBAC7B,eAAe,EAAE,MAAM,CAAC,eAAe;iBACxC,CAAC;YACJ,CAAC;YACD,KAAK,CAAC,WAAW;gBACf,OAAO,WAAW,CAAC,WAAW,EAAE,CAAC;YACnC,CAAC;SACF,CAAC;QAEF,IAAI,QAAQ,KAAK,QAAQ;YAAE,aAAa,GAAG,OAAO,CAAC;QACnD,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,gDAAgD;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
|
package/dist/index.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAaH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAA6B,MAAM,YAAY,CAAC;AAEvF,YAAY,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,aAAa,EACb,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,
|
|
1
|
+
{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAaH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAA6B,MAAM,YAAY,CAAC;AAEvF,YAAY,EACV,WAAW,EACX,YAAY,EACZ,WAAW,EACX,aAAa,EACb,YAAY,GACb,MAAM,YAAY,CAAC;AACpB,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;GAMG;AACH,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,YAAY,GAAG,OAAO,CAAC,WAAW,CAAC,CAmF/F"}
|
package/dist/index.js
CHANGED
|
@@ -44,8 +44,13 @@ export async function auditSkill(skillDir, options) {
|
|
|
44
44
|
if (manifest && !options?.skipATR) {
|
|
45
45
|
checks.push(await checkWithATR(manifest, options?.cloudRules));
|
|
46
46
|
}
|
|
47
|
-
// Code security (SAST + secrets)
|
|
48
|
-
|
|
47
|
+
// Code security (SAST + secrets). Skippable for a fast bulk scan — the
|
|
48
|
+
// per-skill semgrep startup (~3-4s) makes it impractical to run across every
|
|
49
|
+
// installed skill (e.g. `pga up`); the full scan is available via
|
|
50
|
+
// `pga audit --deep <skill>`.
|
|
51
|
+
if (!options?.skipCode) {
|
|
52
|
+
checks.push(await checkCode(skillDir));
|
|
53
|
+
}
|
|
49
54
|
// Layer 2: AI semantic analysis (default-on, auto-detects LLM if not provided)
|
|
50
55
|
if (manifest && !options?.skipAI) {
|
|
51
56
|
let llm = options?.llm;
|
package/dist/index.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAW5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,OAAsB;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,oBAAoB;IACpB,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAEpD,oBAAoB;IACpB,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,oDAAoD;IACpD,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IAErC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,6FAA6F;IAC7F,IAAI,QAAQ,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,
|
|
1
|
+
{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC1D,OAAO,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3D,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACnD,OAAO,EAAE,iBAAiB,EAAE,MAAM,8BAA8B,CAAC;AACjE,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACnD,OAAO,EAAE,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACrD,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,oBAAoB,EAAE,MAAM,sBAAsB,CAAC;AAW5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAE1D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB,EAAE,OAAsB;IACvE,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAE7B,oBAAoB;IACpB,MAAM,QAAQ,GAAG,MAAM,kBAAkB,CAAC,QAAQ,CAAC,CAAC;IAEpD,oBAAoB;IACpB,MAAM,MAAM,GAAkB,EAAE,CAAC;IAEjC,oDAAoD;IACpD,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC;IAErC,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC;QACtD,MAAM,CAAC,IAAI,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC,CAAC;QACzC,MAAM,CAAC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC1C,CAAC;IAED,6FAA6F;IAC7F,IAAI,QAAQ,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,CAAC;QAClC,MAAM,CAAC,IAAI,CAAC,MAAM,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACjE,CAAC;IAED,uEAAuE;IACvE,6EAA6E;IAC7E,kEAAkE;IAClE,8BAA8B;IAC9B,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;QACvB,MAAM,CAAC,IAAI,CAAC,MAAM,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,+EAA+E;IAC/E,IAAI,QAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;QACjC,IAAI,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;QAEvB,uDAAuD;QACvD,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,CAAC,MAAM,kBAAkB,EAAE,CAAC,IAAI,SAAS,CAAC;QAClD,CAAC;QAED,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,CAAC;QACnF,CAAC;aAAM,CAAC;YACN,iEAAiE;YACjE,MAAM,YAAY,GAAiB;gBACjC,EAAE,EAAE,WAAW;gBACf,KAAK,EAAE,uCAAuC;gBAC9C,WAAW,EACT,sHAAsH;gBACxH,QAAQ,EAAE,MAAM;gBAChB,QAAQ,EAAE,aAAa;gBACvB,QAAQ,EAAE,aAAa;aACxB,CAAC;YACF,MAAM,CAAC,IAAI,CAAC;gBACV,MAAM,EAAE,MAAM;gBACd,KAAK,EAAE,yCAAyC;gBAChD,QAAQ,EAAE,CAAC,YAAY,CAAC;aACzB,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAEtD,uEAAuE;IACvE,MAAM,cAAc,GAAG,QAAQ;QAC7B,CAAC,CAAC,oBAAoB,CAAC,QAAQ,CAAC,YAAY,EAAE,QAAQ,CAAC;QACvD,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAErC,kDAAkD;IAClD,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,GAAG,kBAAkB,CAAC,WAAW,EAAE,cAAc,CAAC,UAAU,CAAC,CAAC;IAEpF,OAAO;QACL,SAAS,EAAE,QAAQ;QACnB,QAAQ;QACR,SAAS,EAAE,KAAK;QAChB,SAAS,EAAE,KAAK;QAChB,MAAM;QACN,QAAQ,EAAE,WAAW;QACrB,cAAc;QACd,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS;KACnC,CAAC;AACJ,CAAC"}
|
package/dist/types.d.ts
CHANGED
|
@@ -27,6 +27,14 @@ export interface AuditOptions {
|
|
|
27
27
|
skipAI?: boolean;
|
|
28
28
|
/** Skip ATR pattern detection */
|
|
29
29
|
skipATR?: boolean;
|
|
30
|
+
/**
|
|
31
|
+
* Skip the code security scan (SAST/semgrep + secrets file walk). Use for a
|
|
32
|
+
* FAST bulk scan (e.g. `pga up` across every installed skill) where the
|
|
33
|
+
* per-skill semgrep startup (~3-4s) and a project-style skill's file tree make
|
|
34
|
+
* the full scan impractical — the ATR pattern check on the manifest still runs.
|
|
35
|
+
* Users get the full code scan on demand via `pga audit --deep <skill>`.
|
|
36
|
+
*/
|
|
37
|
+
skipCode?: boolean;
|
|
30
38
|
/** Additional ATR rules fetched from Threat Cloud */
|
|
31
39
|
cloudRules?: Array<{
|
|
32
40
|
id: string;
|
package/dist/types.d.ts.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,YAAY,EACV,QAAQ,EACR,eAAe,EACf,aAAa,EACb,aAAa,EACb,SAAS,GACV,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAMjE,yDAAyD;AACzD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC;AAEnC,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,6BAA6B;AAC7B,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,sBAAsB,EAAE,gBAAgB,CAAC;IACtD,gCAAgC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,qDAAqD;IACrD,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/F;AAED,4BAA4B;AAC5B,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,wBAAwB,EAAE,aAAa,GAAG,IAAI,CAAC;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,mDAAmD;IACnD,cAAc,CAAC,EAAE;QACf,OAAO,EAAE,aAAa,CAAC;YACrB,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;YAC5B,KAAK,EAAE,MAAM,CAAC;YACd,MAAM,EAAE,MAAM,CAAC;SAChB,CAAC,CAAC;QACH,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB"}
|
|
1
|
+
{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,YAAY,EACV,QAAQ,EACR,eAAe,EACf,aAAa,EACb,aAAa,EACb,SAAS,GACV,MAAM,wBAAwB,CAAC;AAEhC,OAAO,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAMjE,yDAAyD;AACzD,MAAM,MAAM,YAAY,GAAG,OAAO,CAAC;AAEnC,wCAAwC;AACxC,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,CAAC;IAC1C,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED,6BAA6B;AAC7B,MAAM,WAAW,YAAY;IAC3B;;;OAGG;IACH,GAAG,CAAC,EAAE,OAAO,sBAAsB,EAAE,gBAAgB,CAAC;IACtD,gCAAgC;IAChC,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,iCAAiC;IACjC,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB;;;;;;OAMG;IACH,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,qDAAqD;IACrD,UAAU,CAAC,EAAE,KAAK,CAAC;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,OAAO,CAAC;QAAC,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/F;AAED,4BAA4B;AAC5B,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,OAAO,wBAAwB,EAAE,aAAa,GAAG,IAAI,CAAC;IAChE,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,SAAS,CAAC;IACrB,MAAM,EAAE,WAAW,EAAE,CAAC;IACtB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,mDAAmD;IACnD,cAAc,CAAC,EAAE;QACf,OAAO,EAAE,aAAa,CAAC;YACrB,EAAE,EAAE,MAAM,CAAC;YACX,IAAI,EAAE,SAAS,GAAG,SAAS,CAAC;YAC5B,KAAK,EAAE,MAAM,CAAC;YACd,MAAM,EAAE,MAAM,CAAC;SAChB,CAAC,CAAC;QACH,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;CACpB"}
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@panguard-ai/panguard-skill-auditor",
|
|
3
|
-
"version": "1.8.
|
|
3
|
+
"version": "1.8.19",
|
|
4
4
|
"license": "MIT",
|
|
5
5
|
"repository": {
|
|
6
6
|
"type": "git",
|
|
@@ -33,8 +33,8 @@
|
|
|
33
33
|
"agent-threat-rules": "^3.5.8",
|
|
34
34
|
"js-yaml": "^4.1.0",
|
|
35
35
|
"@panguard-ai/atr": "1.8.14",
|
|
36
|
-
"@panguard-ai/panguard-scan": "1.8.14",
|
|
37
36
|
"@panguard-ai/core": "1.8.14",
|
|
37
|
+
"@panguard-ai/panguard-scan": "1.8.19",
|
|
38
38
|
"@panguard-ai/scan-core": "1.8.14"
|
|
39
39
|
},
|
|
40
40
|
"devDependencies": {
|