@promptci/core 0.1.0 → 0.2.1

package/dist/skill-supply-chain.d.ts

@@ -0,0 +1,132 @@
+/**
+ * Skill supply-chain scan
+ *
+ * An Agent Skill is instructions (SKILL.md plus reference docs) and bundled
+ * scripts that an agent loads on demand and runs with the user's permissions.
+ * Installing a third-party skill is installing code. The structural skills
+ * detector (skills-detector.ts) checks that a skill *loads*; this detector
+ * reads the same skill — and every file bundled in its directory — as plain
+ * text and flags content characteristic of supply-chain abuse.
+ *
+ * Static only. Nothing here executes, imports, fetches or resolves anything:
+ * skill content is matched against fixed patterns, so the same files always
+ * produce the same findings (no network, no clock, no LLM).
+ *
+ * Rules (tag `skill-supply-chain` + the rule id below):
+ *
+ *   remote-exec            fetched content piped into a shell (`curl … |
+ *                          bash`, by path, via env/sudo/busybox/xargs — an
+ *                          `env A=…` assignment of any length — in a
+ *                          subshell, through any number of pipe stages),
+ *                          into `tee >(bash)`, into an interpreter that runs
+ *                          its own stdin (`node -e "eval(readFileSync(0))"`,
+ *                          `python -c 'exec(sys.stdin.read())'`, `ruby -e`,
+ *                          `perl -e`, `node /dev/stdin`), or into a `while
+ *                          read l; do eval "$l"; done` loop; process/here-
+ *                          string substitution, `iex (iwr …)`, or a
+ *                          downloaded file executed later in the same
+ *                          command without first being verified           high
+ *   encoded-exec           decoded or transformed content executed (`base64
+ *                          -d | sh`, `xxd -r -p | sh`, `rev | sh`, a rot13
+ *                          `tr`, `base32 -d`, a run of `\x63\x75…` escapes,
+ *                          decode-to-file then run, `eval "$(… | base64
+ *                          -d)"`, `exec(b64decode(…))`, `powershell -enc`) high
+ *   remote-eval            eval of fetched code (also in SKILL.md code,
+ *                          including a fetch function imported under another
+ *                          name: `urlopen as u`, `import requests as r`), or
+ *                          a script that both evaluates dynamic code AND
+ *                          makes network calls                            high
+ *   dynamic-eval           eval/exec/new Function/iex, no network call   warning
+ *   credential-exfil       credential-store read or environment dump AND
+ *                          network calls in the same file                 high
+ *   exfil-instruction      prose sending secrets to a destination  high/warning
+ *   instruction-override   prompt-injection text                          high
+ *   conceal-from-user      prose hiding actions from the user      high/warning
+ *   permission-bypass      flags/prose disabling permission prompts    warning
+ *   hidden-unicode         tag characters, bidi controls (high); other
+ *                          invisible/format/control characters       (warning)
+ *   hidden-html-comment    agent-directed text inside an HTML comment  warning
+ *   hidden-html-element    text hidden by `display:none`/`hidden`      warning
+ *   encoded-blob           a large base64 blob in instruction text     warning
+ *   unpinned-remote-dep    a remote dependency with no pinned version  warning
+ *   missing-script         the SKILL.md runs a script that exists nowhere
+ *                                                          warning, ai_config
+ *   unscanned-files        content this scan could not fully read, named:
+ *                          binaries/archives/executables, compiled-language
+ *                          sources, files over the cap or budget, oversized
+ *                          files (head and tail read), overlong continuation
+ *                          chains (warning); dependency directories and
+ *                          include-filtered files (info)
+ *
+ * Hostile input: every regex uses bounded quantifiers and runs over lines in
+ * overlapping 2000-character windows behind cheap prefilters, and every rule
+ * whose span can exceed the window overlap (pipes, command chains) is matched
+ * procedurally over the whole logical command, so results do not depend on
+ * window alignment. HTML comments and tags are found with indexOf walks. A
+ * rule keeps scanning past its evidence cap (a flood of low-severity matches
+ * cannot hide a later high-severity one). Documents are loaded, scanned and
+ * dropped one at a time under a per-scan byte, file and line budget, SKILL.md
+ * files and scripts/executables first; a priority file the budget cannot
+ * reach is reported at HIGH (fail closed). There is deliberately no
+ * wall-clock budget: output must not depend on the clock.
+ *
+ * Documentation vs directive (the false-positive controls). Outside fenced
+ * code — prose, inline code, table rows — a negation or discussion word only
+ * counts when it directly GOVERNS the match: an imperative negation with
+ * nothing or one executing verb between ("never run `curl … | bash`"), a
+ * discussion word right before it ("this skill detects `curl | bash`" — a
+ * `Label:` is not governance), or a predicate right after it ("… is
+ * dangerous"). Governance ends at but / and / then / instead / so and at
+ * clause punctuation; "never forget/hesitate/stop/skip/fail/neglect/mind" is
+ * not a negation. Even then, context NEVER drops a match, or lowers its
+ * severity, when the match names a concrete target — a URL, a host (dotted,
+ * IPv4/IPv6, host:port, defanged or quote-split), a host/path, a `$VARIABLE`
+ * or `$(…)`, or any address-like argument or config/list flag given to
+ * curl/wget/iwr, or a dot-less host (`wget intranet`) that is the fetcher's
+ * first non-flag argument while the same text pipes into a shell or runs the
+ * download (a bare word elsewhere is prose: "pipe curl into bash") — it only
+ * lowers confidence (0.4) and notes "looks like documentation". Target-less
+ * exec documentation ("never run `curl | bash`")
+ * is dropped; target-less override/concealment/bypass text is dropped only
+ * when the governed phrase is itself set off in a code span, quotes or a
+ * table cell (otherwise it is kept at low confidence), and quoted text after
+ * an adoption phrase ("your new rule is \"…\"") is never data. The trade-off: a
+ * security skill quoting a real installer URL is reported (high, low
+ * confidence); the escape hatch is the baseline or a config `exclude`. A
+ * documented example whose governing word the rules do not recognise ("Instead
+ * of `curl URL | bash`", a table of risky patterns, a "bad example" fence)
+ * stays at full confidence; the benign-documentation corpus in
+ * skill-supply-chain.test.ts pins both behaviours.
+ * Other controls: one named API key sent to an API is not exfiltration;
+ * dynamic require/import only counts next to network access; emoji ZWJ, a
+ * single variation selector after a non-ASCII character, flag tag sequences,
+ * RTL marks in RTL text, a leading BOM and `data:` URIs are ignored; `npx
+ * tool` without a version is not flagged; a table row whose first cell is just
+ * a flag, and whose other cells direct nothing, documents that flag.
+ *
+ * Findings list the file they were found in plus the owning SKILL.md in
+ * `filePaths`, with `locations` at the exact line. Inline `promptci-ignore`
+ * annotations inside a skill directory never suppress these findings
+ * (scan.ts). Evidence quotes the matched text with every invisible or control
+ * character shown as `<U+XXXX>` and tag-character payloads decoded. No finding
+ * is auto-fixable: repairing a skill needs a human-reviewed diff.
+ */
+import type { RepoContext } from './repo-context.js';
+import type { PromptCiIssue } from './types.js';
+/** First entry of every finding's `tags`. */
+export declare const SKILL_SUPPLY_CHAIN_TAG = "skill-supply-chain";
+/** Total bytes of skill content read per scan; the rest is reported, not read. */
+export declare const MAX_SCAN_BYTES: number;
+/** Total skill files read per scan. */
+export declare const MAX_SCAN_FILES = 2000;
+export type SkillSupplyChainRule = 'remote-exec' | 'encoded-exec' | 'remote-eval' | 'dynamic-eval' | 'credential-exfil' | 'exfil-instruction' | 'instruction-override' | 'conceal-from-user' | 'permission-bypass' | 'hidden-unicode' | 'hidden-html-comment' | 'hidden-html-element' | 'encoded-blob' | 'unpinned-remote-dep' | 'missing-script' | 'unscanned-files';
+/** Total lines examined per scan: bounds per-line work however the bytes are shaped (e.g. megabytes of newlines). */
+export declare const MAX_SCAN_LINES = 3000000;
+/** Per-scan budget overrides (tests exercise budget exhaustion without generating gigabytes). */
+export type SkillScanLimits = Partial<{
+    bytes: number;
+    files: number;
+    lines: number;
+}>;
+export declare function detectSkillSupplyChain(context: RepoContext, limits?: SkillScanLimits): PromptCiIssue[];
+//# sourceMappingURL=skill-supply-chain.d.ts.map

package/dist/skill-supply-chain.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-supply-chain.d.ts","sourceRoot":"","sources":["../src/skill-supply-chain.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgHG;AAIH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,KAAK,EAAgC,aAAa,EAAE,MAAM,YAAY,CAAC;AAgB9E,6CAA6C;AAC7C,eAAO,MAAM,sBAAsB,uBAAuB,CAAC;AAE3D,kFAAkF;AAClF,eAAO,MAAM,cAAc,QAAmB,CAAC;AAC/C,uCAAuC;AACvC,eAAO,MAAM,cAAc,OAAO,CAAC;AAiCnC,MAAM,MAAM,oBAAoB,GAC5B,aAAa,GACb,cAAc,GACd,aAAa,GACb,cAAc,GACd,kBAAkB,GAClB,mBAAmB,GACnB,sBAAsB,GACtB,mBAAmB,GACnB,mBAAmB,GACnB,gBAAgB,GAChB,qBAAqB,GACrB,qBAAqB,GACrB,cAAc,GACd,qBAAqB,GACrB,gBAAgB,GAChB,iBAAiB,CAAC;AAq9EtB,qHAAqH;AACrH,eAAO,MAAM,cAAc,UAAY,CAAC;AA+OxC,iGAAiG;AACjG,MAAM,MAAM,eAAe,GAAG,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AAEvF,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,WAAW,EAAE,MAAM,GAAE,eAAoB,GAAG,aAAa,EAAE,CAqG1G"}