@rhize/skill-forge 0.11.1 → 0.11.2

package/dist/cli.js

@@ -131,7 +131,32 @@ function collectNpxPackageSpecs(args) {
   }
   return { packageFlagSpecs, positionalSpec };
 }
+var ISO_TIMESTAMP_RE = /^\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2})?)?$/;
+var PATH_SEGMENT_RE = /^[A-Za-z0-9._-]+$/;
+function looksLikeFsPath(v) {
+  if (!/^(?:\/|~\/|\.\.?\/)/.test(v)) return false;
+  const segments = v.replace(/^~/, "").split("/").filter(Boolean);
+  return segments.length >= 2 && segments.every((seg) => PATH_SEGMENT_RE.test(seg));
+}
+function looksLikeBareUrl(v) {
+  let url;
+  try {
+    url = new URL(v);
+  } catch {
+    return false;
+  }
+  if (!["http:", "https:", "ws:", "wss:", "file:"].includes(url.protocol)) return false;
+  if (url.username !== "" || url.password !== "") return false;
+  if (url.search !== "") return false;
+  return true;
+}
+function looksStructuredNonSecret(value) {
+  const v = value.trim().replace(/^[[\s'"]+/, "").replace(/[\]\s'",]+$/, "");
+  if (v === "") return false;
+  return ISO_TIMESTAMP_RE.test(v) || looksLikeBareUrl(v) || looksLikeFsPath(v);
+}
 function looksHighEntropy(value) {
+  if (looksStructuredNonSecret(value)) return false;
   if (/\s/.test(value)) return false;
   if (value.length < 20) return false;
   const hasLower = /[a-z]/.test(value);
@@ -1243,14 +1268,22 @@ function scanJsonConfig(file, parsed) {
     }
     if (node.env && typeof node.env === "object" && !Array.isArray(node.env)) {
       for (const [key, value] of Object.entries(node.env)) {
-        if (typeof value !== "string" || isPlaceholderValue(value)) continue;
-        if (looksCredentialKey(key) || looksHighEntropy(value)) {
+        if (typeof value !== "string") continue;
+        const kind = classifyCredentialAssignment(key, value);
+        if (kind === "inline-secret") {
           findings.push({
             severity: "HIGH",
             rule: "mcp-inline-credential-value",
             file,
             detail: `env.${key} has an inline credential value \u2014 emit an empty string and document that the user must fill it in`
           });
+        } else if (kind === "file-path") {
+          findings.push({
+            severity: "LOW",
+            rule: "mcp-credential-file-path",
+            file,
+            detail: `env.${key} points at a credential file rather than an inline secret \u2014 the value leaks nothing, but keep that file out of version control`
+          });
         }
       }
     }
@@ -1262,15 +1295,29 @@ var DANGEROUS_FLAG_RE = /--dangerously-[\w-]+|--no-sandbox\b/g;
 var CREDENTIAL_ASSIGNMENT_RE = /["']?([A-Za-z][A-Za-z0-9_]*)["']?\s*[:=]\s*["']([^"']{6,})["']/g;
 var CREDENTIAL_ASSIGNMENT_UNQUOTED_RE = /^\s*(?:export\s+|-\s+)?([A-Za-z][A-Za-z0-9_]*)\s*[:=]\s*(\S+)/;
 var LEADING_QUOTE_RE = /^["']/;
+function classifyCredentialAssignment(key, value) {
+  if (isPlaceholderValue(value)) return "none";
+  const credentialKey = looksCredentialKey(key);
+  if (credentialKey && looksStructuredNonSecret(value) && !/^[a-z]+:\/\//i.test(value.trim())) return "file-path";
+  if (credentialKey || looksHighEntropy(value)) return "inline-secret";
+  return "none";
+}
 function pushCredentialFinding(findings, file, lineNo, varName, value) {
-  if (isPlaceholderValue(value)) return;
-  if (looksCredentialKey(varName) || looksHighEntropy(value)) {
+  const kind = classifyCredentialAssignment(varName, value);
+  if (kind === "inline-secret") {
     findings.push({
       severity: "HIGH",
       rule: "mcp-inline-credential-value",
       file,
       detail: `line ${lineNo}: inline credential value assigned to ${varName}`
     });
+  } else if (kind === "file-path") {
+    findings.push({
+      severity: "LOW",
+      rule: "mcp-credential-file-path",
+      file,
+      detail: `line ${lineNo}: ${varName} points at a credential file rather than an inline secret \u2014 the value leaks nothing, but keep that file out of version control`
+    });
   }
 }
 function scanTextFile(file, content, allowCredentialCheck) {