@rhize/skill-forge 0.11.2 → 0.11.3

package/dist/cli.js

@@ -1049,6 +1049,37 @@ import { execFile } from "child_process";
 import { delimiter as delimiter2, join as join9 } from "path";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
+var RM_RF_TARGET_RE = /\brm\s+(?:-[a-z]+\s+)+("[^"]*"|'[^']*'|[^\s;|&)"'`]+)/i;
+function refineRmRf(line) {
+  const match = line.match(RM_RF_TARGET_RE);
+  if (!match) {
+    return { severity: "HIGH", message: "recursive force-delete (rm -rf) with an unparseable target \u2014 verify the path is scoped" };
+  }
+  const target = match[1].replace(/^["']|["']$/g, "").trim();
+  if (target.includes("$") || target.includes("`")) {
+    return {
+      severity: "HIGH",
+      message: `recursive force-delete of "${target}" \u2014 the target is a shell expansion; if it is empty or unset this can delete far more than intended`
+    };
+  }
+  if (target === "/" || target === "/*" || target === "*" || target === "." || target === ".." || target === "~" || target === "~/") {
+    return { severity: "HIGH", message: `recursive force-delete of "${target}" \u2014 this targets the filesystem root, the home directory, or everything in the working directory` };
+  }
+  if (target.startsWith("~")) {
+    return { severity: "HIGH", message: `recursive force-delete of "${target}" \u2014 targets a path inside the home directory, outside any project` };
+  }
+  if (target.split("/").includes("..")) {
+    return { severity: "HIGH", message: `recursive force-delete of "${target}" \u2014 the target escapes the current directory via ".."` };
+  }
+  if (target.startsWith("/")) {
+    const segments = target.split("/").filter(Boolean);
+    if (segments.length < 3) {
+      return { severity: "HIGH", message: `recursive force-delete of "${target}" \u2014 a shallow absolute path like this is a system directory` };
+    }
+    return { severity: "MEDIUM", message: `recursive force-delete of "${target}" \u2014 an absolute path outside any project directory` };
+  }
+  return null;
+}
 var DENY_RULES = [
   {
     rule: "curl-pipe-shell",
@@ -1072,7 +1103,8 @@ var DENY_RULES = [
     rule: "destructive-rm-rf",
     severity: "HIGH",
     pattern: /\brm\s+-[a-z]*r[a-z]*f[a-z]*\b|\brm\s+-[a-z]*f[a-z]*r[a-z]*\b/i,
-    message: "recursive force-delete (rm -rf) \u2014 verify the target path is scoped"
+    message: "recursive force-delete (rm -rf) \u2014 verify the target path is scoped",
+    refine: refineRmRf
   },
   {
     rule: "credential-file-access",
@@ -1127,11 +1159,13 @@ function scanStaticRules(targetPath) {
     for (const rule of DENY_RULES) {
       for (let i = 0; i < lines.length; i++) {
         if (rule.pattern.test(lines[i])) {
+          const refined = rule.refine ? rule.refine(lines[i]) : { severity: rule.severity, message: rule.message };
+          if (!refined) continue;
           findings.push({
-            severity: rule.severity,
+            severity: refined.severity,
             rule: rule.rule,
             file,
-            detail: `line ${i + 1}: ${rule.message}`
+            detail: `line ${i + 1}: ${refined.message}`
           });
         }
       }