@perrylink/dsh-skill-pack-security-provider 1.3.0 → 2.0.1

package/lib/vet/walk.js

@@ -0,0 +1,147 @@
+/**
+ * Bounded file collection: walks a local directory or normalizes an extracted
+ * tarball into one shared `ScannedFile` list. Everything is budget-capped so a
+ * hostile or simply huge target can never exhaust memory or wall time; caps are
+ * reported back as truncation, never hidden.
+ *
+ * @module dsh-skill-pack-security/vet/walk
+ */
+import { readdir, readFile, stat } from 'node:fs/promises';
+import { basename, join } from 'node:path';
+/** Directories never descended into (generated/third-party content). */
+const SKIPPED_DIRS = new Set([
+    'node_modules', '.git', '.hg', '.svn', '.pnpm-store',
+    'dist', 'build', '.next', '.nuxt', '.cache', '.parcel-cache', 'coverage',
+    'target', '.venv', 'venv', '__pycache__', '.tmp', '.idea', '.vscode', '.turbo',
+    'pack', 'out',
+]);
+/** File names never collected. */
+const SKIPPED_FILES = new Set(['.DS_Store', 'Thumbs.db', '.gitignore', '.npmignore', '.eslintcache']);
+/** Detect binary content cheaply: NUL bytes within the first 8 KiB. */
+function looksBinary(buffer) {
+    const probe = buffer.subarray(0, Math.min(buffer.byteLength, 8192));
+    return probe.includes(0);
+}
+/** Decode UTF-8 lossily; the decoder replaces invalid sequences instead of throwing. */
+function decodeText(buffer) {
+    return new TextDecoder('utf-8', { fatal: false }).decode(buffer);
+}
+/** Normalize an extracted tarball's file map into the shared scanned-file list. */
+export function filesFromMap(files, maxFileBytes) {
+    const scanned = [];
+    let bytesScanned = 0;
+    let skipped = 0;
+    let truncated = false;
+    let truncatedReason;
+    for (const [path, content] of files) {
+        const name = basename(path);
+        if (SKIPPED_FILES.has(name))
+            continue;
+        if (content.byteLength > maxFileBytes) {
+            skipped += 1;
+            truncated = true;
+            truncatedReason = `file ${path} exceeded the ${maxFileBytes}-byte per-file cap`;
+            scanned.push({ path, text: null, binary: false, skipped: 'too-large' });
+            continue;
+        }
+        if (looksBinary(content)) {
+            skipped += 1;
+            scanned.push({ path, text: null, binary: true, skipped: 'binary' });
+            continue;
+        }
+        scanned.push({ path, text: decodeText(content), binary: false, skipped: null });
+        bytesScanned += content.byteLength;
+    }
+    return {
+        files: scanned,
+        budget: { filesScanned: scanned.length, filesSkipped: skipped, bytesScanned, truncated, truncatedReason },
+    };
+}
+/** Walk a local directory with caps; symlinks are never followed. */
+export async function walkLocal(root, maxFiles, maxFileBytes) {
+    const scanned = [];
+    let skipped = 0;
+    let truncated = false;
+    let truncatedReason;
+    let bytesScanned = 0;
+    let seen = 0;
+    async function visit(dir, base) {
+        let entries;
+        try {
+            entries = await readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            return;
+        }
+        for (const entry of entries) {
+            if (truncated)
+                return;
+            const abs = join(dir, entry.name);
+            const rel = (base === '' ? entry.name : `${base}/${entry.name}`);
+            if (entry.isDirectory()) {
+                if (SKIPPED_DIRS.has(entry.name))
+                    continue;
+                await visit(abs, rel);
+                continue;
+            }
+            if (!entry.isFile())
+                continue;
+            seen += 1;
+            if (seen > maxFiles) {
+                truncated = true;
+                truncatedReason = `target exceeds the ${maxFiles}-file scan cap`;
+                return;
+            }
+            if (SKIPPED_FILES.has(entry.name))
+                continue;
+            let buffer;
+            try {
+                const info = await stat(abs);
+                if (info.size > maxFileBytes) {
+                    skipped += 1;
+                    scanned.push({ path: rel, text: null, binary: false, skipped: 'too-large' });
+                    continue;
+                }
+                buffer = await readFile(abs);
+            }
+            catch {
+                skipped += 1;
+                scanned.push({ path: rel, text: null, binary: false, skipped: 'decode' });
+                continue;
+            }
+            if (looksBinary(buffer)) {
+                skipped += 1;
+                scanned.push({ path: rel, text: null, binary: true, skipped: 'binary' });
+                continue;
+            }
+            scanned.push({ path: rel, text: decodeText(buffer), binary: false, skipped: null });
+            bytesScanned += buffer.byteLength;
+        }
+    }
+    await visit(root, '');
+    return {
+        files: scanned,
+        budget: {
+            filesScanned: scanned.length,
+            filesSkipped: skipped,
+            bytesScanned,
+            truncated: truncated || scanned.some(f => f.skipped === 'too-large'),
+            truncatedReason: truncatedReason ?? (scanned.some(f => f.skipped === 'too-large') ? 'some files exceeded the per-file byte cap' : undefined),
+        },
+    };
+}
+/** Resolve the strip-prefix of a codeload/npm tarball (its single top-level dir). */
+export function stripRoot(files) {
+    let prefix = '';
+    for (const path of files.keys()) {
+        const slash = path.indexOf('/');
+        if (slash === -1)
+            continue;
+        const candidate = path.slice(0, slash);
+        if (prefix === '')
+            prefix = candidate;
+        else if (candidate !== prefix)
+            return '';
+    }
+    return prefix;
+}

package/pack/skills/dependency-audit/SKILL.md

@@ -4,13 +4,17 @@ description: '依赖供应链审计：pnpm/npm audit 输出与退出码解读、
 whenToUse: '用户要求审计或盘点项目依赖安全（漏洞、license、投毒、锁文件漂移）、解读 audit 报告、判断某个依赖能否引入，或写依赖审计结论时使用；单个依赖的普通升级与纯功能开发不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 
 # 依赖审计（dependency-audit）
 
 目标：对仓库依赖面给出**每条结论都附命令证据**的审计结果。输出分七块：已知漏洞、license、投毒风险、锁文件漂移、多生态漏洞、SBOM 清单、provenance/签名。
 
+## 自动化预检：plugin_vet 工具
+
+`plugin_vet` 已自动执行本技能第 3/4/7 节的静态部分（license 判定、投毒清单、SBOM 依赖树），其结果逐条引用本技能小节编号。自动化命中后，按各节命令复核证据并排除误报。
+
 ## 1. 定位包管理器与锁文件
 
 ```sh

package/pack/skills/incident-response/SKILL.md

@@ -4,7 +4,7 @@ description: 'agent 环境安全事件响应：分类→控制蔓延→取证留
 whenToUse: 'agent 环境（DSH 会话、插件、MCP、CI）出现疑似安全事件——密钥泄露、被注入执行了未授权操作、依赖投毒、权限异常——需要响应、留证与复盘时使用；没有事件迹象的日常开发不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 
 # 事件响应（incident-response）

package/pack/skills/prompt-injection-review/SKILL.md

@@ -4,7 +4,7 @@ description: '面向 agent 项目的提示注入面审查：AGENTS.md、技能
 whenToUse: '审查 agent 项目的上下文注入面（AGENTS.md/CLAUDE.md、.agents/skills、工具描述、MCP server 来源、web 抓取链路）、评估间接注入风险或对 agent 项目做安全评审时使用；与模型上下文无关的普通代码评审不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 
 # 提示注入面审查（prompt-injection-review）

package/pack/skills/secret-scan/SKILL.md

@@ -4,7 +4,7 @@ description: '凭据/密钥暴露审计：gitleaks、trivy 全历史扫描命令
 whenToUse: '用户要求扫描或检查仓库的密钥泄露、排查某提交或某文件中的 token、给扫描告警定真伪、写脱敏泄露报告或规划密钥轮换时使用；纯功能开发与常规代码审查不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 
 # 凭据扫描（secret-scan）

package/pack/skills/security-audit/SKILL.md

@@ -4,7 +4,7 @@ description: '仓库/软件安全审计总览：范围界定→资产清单→
 whenToUse: '用户要求对代码仓库或项目做安全审计、制定审计计划、划分审计阶段、汇总多类发现成报告，或不确定该从哪个专项技能开始时使用；单一主题任务（只查密钥、只查依赖、只评审一个 PR、只查注入面）直接加载对应专项技能，不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 
 # 安全审计总览（security-audit）
@@ -12,6 +12,10 @@ metadata:
 本技能编排一次仓库安全审计的完整流程，产出**每条发现都能用一条命令复核**的报告。
 它只编排；四类主题的检查细节分别在 `secret-scan`（密钥）、`dependency-audit`（依赖）、`supply-chain-review`（新增依赖评审）、`prompt-injection-review`（agent 项目注入面）中。进入相应阶段时，用 `skill` 工具按需加载对应专项技能，不要在本文件里重写其细节。
 
+## 自动化预检：plugin_vet 工具
+
+本包 provider 同时注册 `plugin_vet` 工具（license 扫描 / SBOM / commit 锁定 / 恶意模式 / 五维评分）。它只做机器预检，结果中每条 finding 都标注本包对应技能小节，命中后按本技能流程继续人工审计；工具结果 fail 且门禁策略为 deny 时安装被阻断。
+
 ## 阶段 0：固定审计对象（不固定对象，报告不可复现）
 
 ```sh

package/pack/skills/supply-chain-review/SKILL.md

@@ -4,13 +4,17 @@ description: 'PR/新依赖快速供应链评审：危险 install/postinstall 脚
 whenToUse: '评审含新依赖（package.json/锁文件变更）的 PR、审查某包的 install 脚本行为、判断疑似 typosquat 包或验证构建可复现性时使用；纯业务代码、与新增依赖无关的 PR 评审不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 
 # 新增依赖快速评审（supply-chain-review）
 
 目标：在 PR 评审时间内（几分钟）对新增依赖给出 **通过 / 要求修改 / 阻断** 三档结论；每条结论必须附命令证据与误报排除说明。
 
+## 自动化预检：plugin_vet 工具
+
+`plugin_vet` 已自动执行本技能第 1/2/3 节的静态部分（危险 install 脚本、网络回传、混淆载荷、commit/action 锁定），其结果逐条引用本技能小节编号。自动化命中后，按各节的误报判据与放行判据人工确认，再下三档结论。
+
 ## 0. 确认范围
 
 ```sh

package/pack/skills/threat-model/SKILL.md

@@ -4,7 +4,7 @@ description: '新功能/新系统的轻量威胁建模：固定对象→划定
 whenToUse: '用户要求对新功能/新系统做威胁建模、设计阶段安全评审、STRIDE 分析、攻击树分析，或要求把安全考虑前置到设计阶段时使用；纯实现细节讨论、与信任边界无关的改动不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 
 # 威胁建模（threat-model）

package/pack/skills/vuln-intel/SKILL.md

@@ -4,7 +4,7 @@ description: '漏洞情报检索与判定：NVD/CISA-KEV/GHSA/OSV 四处权威
 whenToUse: '用户给出 CVE/GHSA 编号要求查详情与影响、判断漏洞是否被在野利用（KEV）、评估漏洞对当前项目/依赖的适用性或汇总漏洞情报简报时使用；没有具体编号的通用安全学习、与特定漏洞无关的讨论不触发本技能。'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 
 # 漏洞情报（vuln-intel）

package/pack/skills-en/dependency-audit/SKILL.md

@@ -4,12 +4,16 @@ description: 'Dependency supply-chain audit: reading pnpm/npm audit output and e
 whenToUse: 'Use when the user asks to audit or inventory project dependency security (vulnerabilities, licenses, poisoning, lockfile drift), to interpret an audit report, to judge whether a dependency may be introduced, or to write a dependency-audit conclusion. Upgrading a single dependency and plain feature development do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 # Dependency audit (dependency-audit)
 
 Goal: produce an audit of the repository's dependency surface in which **every conclusion carries command evidence**. The output has seven blocks: known vulnerabilities, licenses, poisoning risk, lockfile drift, multi-ecosystem vulnerabilities, the SBOM inventory, and provenance/signatures.
 
+## Automated pre-check: the plugin_vet tool
+
+`plugin_vet` already runs the static parts of sections 3/4/7 (license verdicts, the poisoning checklist, the SBOM dependency tree), and its findings cite those section numbers. After an automated hit, verify the evidence and rule out false positives with each section's commands.
+
 ## 1. Locate the package manager and lockfile
 
 ```sh

package/pack/skills-en/incident-response/SKILL.md

@@ -4,7 +4,7 @@ description: 'Security incident response for agent environments: a staged flow o
 whenToUse: 'Use when an agent environment (DSH sessions, plugins, MCP, CI) shows a suspected security incident — secret leak, injected execution of unauthorized actions, dependency poisoning, permission anomalies — and it needs response, evidence, and a postmortem. Day-to-day development without incident indicators does not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 
 # Incident response (incident-response)

package/pack/skills-en/prompt-injection-review/SKILL.md

@@ -4,7 +4,7 @@ description: 'Injection-surface review for agent projects: a checklist covering
 whenToUse: 'Use when reviewing the context injection surfaces of an agent project (AGENTS.md/CLAUDE.md, .agents/skills, tool descriptions, MCP server sources, web-fetch chains), assessing indirect-injection risk, or doing a security review of an agent project. Ordinary code review unrelated to model context does not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 # Prompt-injection surface review (prompt-injection-review)
 

package/pack/skills-en/secret-scan/SKILL.md

@@ -4,7 +4,7 @@ description: 'Credential/secret exposure audit: gitleaks and trivy full-history
 whenToUse: 'Use when the user asks to scan or inspect a repository for secret leaks, to hunt tokens in a commit or file, to tier scan alerts as real or false, to write a redacted leak report, or to plan secret rotation. Plain feature development and ordinary code review do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 # Secret scanning (secret-scan)
 

package/pack/skills-en/security-audit/SKILL.md

@@ -4,12 +4,16 @@ description: 'Repository/software security audit overview: a staged flow of scop
 whenToUse: 'Use when the user asks for a security audit of a code repository or project, an audit plan, staged audit steps, a consolidated findings report, or is unsure which specialist skill to start with. Single-topic tasks (only secrets, only dependencies, only one PR, only injection surfaces) load the matching specialist skill directly and do not trigger this overview.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 # Security audit overview (security-audit)
 
 This skill orchestrates the complete flow of one repository security audit and produces a report in which **every finding can be re-verified with a single command**. It only orchestrates; the check details for the four topics live in `secret-scan` (secrets), `dependency-audit` (dependencies), `supply-chain-review` (new-dependency review), and `prompt-injection-review` (injection surfaces of agent projects). When a stage is reached, load the matching specialist skill on demand with the `skill` tool — do not rewrite its details here.
 
+## Automated pre-check: the plugin_vet tool
+
+The pack's provider also registers the `plugin_vet` tool (license scan / SBOM / commit pinning / malicious patterns / five-dimension scoring). It performs only machine pre-checks; every finding cites the matching skill section of this pack, and after a hit you continue with this skill's manual audit flow. A FAIL verdict under a deny gate policy blocks installation.
+
 ## Stage 0: fix the audit target (an unfixed target makes the report unreproducible)
 
 ```sh

package/pack/skills-en/supply-chain-review/SKILL.md

@@ -4,12 +4,16 @@ description: 'Quick PR/new-dependency supply-chain review: dangerous install/pos
 whenToUse: 'Use when reviewing a PR that adds new dependencies (package.json/lockfile changes), inspecting a package install-script behavior, judging a suspected typosquat package, or verifying build reproducibility. Plain business-code PR reviews unrelated to new dependencies do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 # New-dependency quick review (supply-chain-review)
 
 Goal: within PR-review time (minutes), give each new dependency a **pass / request changes / block** verdict; every verdict must carry command evidence and a false-positive exclusion note.
 
+## Automated pre-check: the plugin_vet tool
+
+`plugin_vet` already runs the static parts of sections 1/2/3 (dangerous install scripts, network exfiltration, obfuscated payloads, commit/action pinning), and its findings cite those section numbers. After an automated hit, apply each section's false-positive and allowlist criteria manually before giving the three-tier verdict.
+
 ## 0. Confirm the scope
 
 ```sh

package/pack/skills-en/threat-model/SKILL.md

@@ -4,7 +4,7 @@ description: 'Lightweight threat modeling for new features/systems: fix the targ
 whenToUse: 'Use when the user asks for threat modeling of a new feature/system, design-stage security review, STRIDE analysis, attack-tree analysis, or wants security considered up front at design time. Pure implementation detail discussions and changes unrelated to trust boundaries do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 
 # Threat modeling (threat-model)

package/pack/skills-en/vuln-intel/SKILL.md

@@ -4,7 +4,7 @@ description: 'Vulnerability intelligence lookup and triage: query commands for t
 whenToUse: 'Use when the user gives a CVE/GHSA id and asks for details and impact, whether a vulnerability is actively exploited (KEV), its applicability to the current project/dependencies, or a vulnerability intelligence brief. General security learning without a specific id, and discussions unrelated to a specific vulnerability, do not trigger this skill.'
 metadata:
   pack: dsh-skill-pack-security
-  version: '1.3.0'
+  version: '2.0.1'
 ---
 
 # Vulnerability intelligence (vuln-intel)

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@perrylink/dsh-skill-pack-security-provider",
-  "version": "1.3.0",
-  "description": "Optional provider plugin for dsh-skill-pack-security: registers the pack's skills/ (zh) or skills-en/ (en) edition on ctx.skills. Ships both editions embedded in pack/.",
+  "version": "2.0.1",
+  "description": "Provider plugin for dsh-skill-pack-security: registers the pack's skills/ (zh) or skills-en/ (en) edition on ctx.skills AND the plugin_vet supply-chain gate tool on ctx.tools (license/SBOM/commit-lock/malware scans + five-dimension risk card). Ships both skill editions embedded in pack/.",
   "type": "module",
   "main": "lib/index.js",
   "types": "lib/types/index.d.ts",
@@ -12,6 +12,7 @@
   },
   "files": [
     "lib/index.js",
+    "lib/vet/**",
     "lib/types/**/*.d.ts",
     "pack/**",
     "cordis.patch.yml"
@@ -21,6 +22,45 @@
       "patch": "./cordis.patch.yml"
     }
   },
+  "dshWorkshop": {
+    "schema": "omdsh-workshop-package/v1",
+    "type": "plugin",
+    "integration": {
+      "protocol": "harness-profile",
+      "artifact": "cordis.patch.yml"
+    },
+    "install": {
+      "mode": "transactional",
+      "adapter": "profile-bundle",
+      "failurePolicy": "generation-rollback",
+      "touchesCurrentBeforeActivation": false
+    },
+    "lifecycle": {
+      "activation": "restart-profile",
+      "dispose": "supported"
+    },
+    "permissions": [
+      "files:read",
+      "network:fetch"
+    ],
+    "compatibility": {
+      "dshVersions": [
+        "0.1.0-rc.6"
+      ]
+    },
+    "capability": {
+      "id": "skill-pack-security",
+      "kind": "tool",
+      "invocation": "execute the plugin_vet tool against a GitHub owner/repo target",
+      "expected": "ctx.tools has plugin_vet and its report lists license/SBOM/commit-lock/malicious findings with skill-section citations for manual follow-up"
+    },
+    "evidence": {
+      "install": null,
+      "failureIsolation": null,
+      "hotReload": null,
+      "remove": null
+    }
+  },
   "license": "Apache-2.0",
   "keywords": [
     "dsh",
@@ -35,14 +75,17 @@
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
     "@deepseek-ai/dsh-skill-filesystem": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-tools": ">=0.0.1-rc.1 <0.2.0",
     "@deepseek-ai/schemastery": "^3.18.1"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
+    "@deepseek-ai/dsh-llm": "^0.1.0-rc.6",
     "@deepseek-ai/dsh-skill-filesystem": "0.1.0-rc.6",
+    "@deepseek-ai/dsh-tools": "0.1.0-rc.6",
     "@deepseek-ai/schemastery": "^3.18.1",
-    "@types/node": "^22.15.0",
-    "typescript": "^5.7.0"
+    "@types/node": "^26.2.0",
+    "typescript": "^7.0.2"
   },
   "scripts": {
     "build": "tsc --noEmitOnError",