@rulemetric/skills-registry 0.7.4 → 0.7.6
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/discovered-sources.json +215 -211
- package/package.json +1 -1
- package/dist/security-scanner.d.ts +0 -26
- package/dist/security-scanner.js +0 -290
package/discovered-sources.json
CHANGED
|
@@ -109,22 +109,22 @@
|
|
|
109
109
|
"license": "MIT"
|
|
110
110
|
},
|
|
111
111
|
{
|
|
112
|
-
"repo": "
|
|
112
|
+
"repo": "rtk-ai/rtk",
|
|
113
113
|
"patterns": [
|
|
114
114
|
"**/*.md"
|
|
115
115
|
],
|
|
116
116
|
"defaultTool": "claude_code",
|
|
117
117
|
"defaultCategory": "language",
|
|
118
|
-
"license": "
|
|
118
|
+
"license": "Apache-2.0"
|
|
119
119
|
},
|
|
120
120
|
{
|
|
121
|
-
"repo": "
|
|
121
|
+
"repo": "shareAI-lab/learn-claude-code",
|
|
122
122
|
"patterns": [
|
|
123
123
|
"**/*.md"
|
|
124
124
|
],
|
|
125
125
|
"defaultTool": "claude_code",
|
|
126
126
|
"defaultCategory": "language",
|
|
127
|
-
"license": "
|
|
127
|
+
"license": "MIT"
|
|
128
128
|
},
|
|
129
129
|
{
|
|
130
130
|
"repo": "gsd-build/get-shit-done",
|
|
@@ -174,7 +174,8 @@
|
|
|
174
174
|
{
|
|
175
175
|
"repo": "headroomlabs-ai/headroom",
|
|
176
176
|
"patterns": [
|
|
177
|
-
"
|
|
177
|
+
"agents/**/*.md",
|
|
178
|
+
"**/AGENTS.md"
|
|
178
179
|
],
|
|
179
180
|
"defaultTool": "claude_code",
|
|
180
181
|
"defaultCategory": "language",
|
|
@@ -481,6 +482,16 @@
|
|
|
481
482
|
"defaultTool": "cursor",
|
|
482
483
|
"defaultCategory": "language"
|
|
483
484
|
},
|
|
485
|
+
{
|
|
486
|
+
"repo": "iOfficeAI/OfficeCLI",
|
|
487
|
+
"patterns": [
|
|
488
|
+
"agents/**/*.md",
|
|
489
|
+
"**/AGENTS.md"
|
|
490
|
+
],
|
|
491
|
+
"defaultTool": "claude_code",
|
|
492
|
+
"defaultCategory": "workflow",
|
|
493
|
+
"license": "Apache-2.0"
|
|
494
|
+
},
|
|
484
495
|
{
|
|
485
496
|
"repo": "openimsdk/open-im-server",
|
|
486
497
|
"patterns": [
|
|
@@ -500,16 +511,6 @@
|
|
|
500
511
|
"defaultCategory": "framework",
|
|
501
512
|
"license": "MIT"
|
|
502
513
|
},
|
|
503
|
-
{
|
|
504
|
-
"repo": "iOfficeAI/OfficeCLI",
|
|
505
|
-
"patterns": [
|
|
506
|
-
"agents/**/*.md",
|
|
507
|
-
"**/AGENTS.md"
|
|
508
|
-
],
|
|
509
|
-
"defaultTool": "claude_code",
|
|
510
|
-
"defaultCategory": "workflow",
|
|
511
|
-
"license": "Apache-2.0"
|
|
512
|
-
},
|
|
513
514
|
{
|
|
514
515
|
"repo": "MemoriLabs/Memori",
|
|
515
516
|
"patterns": [
|
|
@@ -857,22 +858,21 @@
|
|
|
857
858
|
"license": "MIT"
|
|
858
859
|
},
|
|
859
860
|
{
|
|
860
|
-
"repo": "
|
|
861
|
+
"repo": "JuneYaooo/nihaisha-nishi-tcm",
|
|
861
862
|
"patterns": [
|
|
862
|
-
"
|
|
863
|
+
"**/*.md"
|
|
863
864
|
],
|
|
864
865
|
"defaultTool": "claude_code",
|
|
865
|
-
"defaultCategory": "workflow"
|
|
866
|
-
"license": "Apache-2.0"
|
|
866
|
+
"defaultCategory": "workflow"
|
|
867
867
|
},
|
|
868
868
|
{
|
|
869
|
-
"repo": "
|
|
869
|
+
"repo": "specstoryai/getspecstory",
|
|
870
870
|
"patterns": [
|
|
871
871
|
"skills/**/*.md"
|
|
872
872
|
],
|
|
873
873
|
"defaultTool": "claude_code",
|
|
874
874
|
"defaultCategory": "workflow",
|
|
875
|
-
"license": "
|
|
875
|
+
"license": "Apache-2.0"
|
|
876
876
|
},
|
|
877
877
|
{
|
|
878
878
|
"repo": "agent0ai/dox",
|
|
@@ -885,23 +885,24 @@
|
|
|
885
885
|
"license": "MIT"
|
|
886
886
|
},
|
|
887
887
|
{
|
|
888
|
-
"repo": "
|
|
888
|
+
"repo": "daymade/claude-code-skills",
|
|
889
889
|
"patterns": [
|
|
890
|
-
"
|
|
891
|
-
"**/AGENTS.md",
|
|
892
|
-
"**/*.md"
|
|
890
|
+
"skills/**/*.md"
|
|
893
891
|
],
|
|
894
|
-
"defaultTool": "
|
|
892
|
+
"defaultTool": "claude_code",
|
|
895
893
|
"defaultCategory": "workflow",
|
|
896
894
|
"license": "MIT"
|
|
897
895
|
},
|
|
898
896
|
{
|
|
899
|
-
"repo": "
|
|
897
|
+
"repo": "dyoshikawa/rulesync",
|
|
900
898
|
"patterns": [
|
|
899
|
+
"agents/**/*.md",
|
|
900
|
+
"**/AGENTS.md",
|
|
901
901
|
"**/*.md"
|
|
902
902
|
],
|
|
903
|
-
"defaultTool": "
|
|
904
|
-
"defaultCategory": "workflow"
|
|
903
|
+
"defaultTool": "universal",
|
|
904
|
+
"defaultCategory": "workflow",
|
|
905
|
+
"license": "MIT"
|
|
905
906
|
},
|
|
906
907
|
{
|
|
907
908
|
"repo": "caliber-ai-org/ai-setup",
|
|
@@ -942,6 +943,14 @@
|
|
|
942
943
|
"defaultCategory": "workflow",
|
|
943
944
|
"license": "MIT"
|
|
944
945
|
},
|
|
946
|
+
{
|
|
947
|
+
"repo": "aiwithremy/claude-skills-llm-council",
|
|
948
|
+
"patterns": [
|
|
949
|
+
"skills/**/*.md"
|
|
950
|
+
],
|
|
951
|
+
"defaultTool": "claude_code",
|
|
952
|
+
"defaultCategory": "workflow"
|
|
953
|
+
},
|
|
945
954
|
{
|
|
946
955
|
"repo": "hoangnb24/repository-harness",
|
|
947
956
|
"patterns": [
|
|
@@ -962,12 +971,14 @@
|
|
|
962
971
|
"license": "Apache-2.0"
|
|
963
972
|
},
|
|
964
973
|
{
|
|
965
|
-
"repo": "
|
|
974
|
+
"repo": "alookai/alook",
|
|
966
975
|
"patterns": [
|
|
967
|
-
"
|
|
976
|
+
"agents/**/*.md",
|
|
977
|
+
"**/AGENTS.md"
|
|
968
978
|
],
|
|
969
979
|
"defaultTool": "claude_code",
|
|
970
|
-
"defaultCategory": "workflow"
|
|
980
|
+
"defaultCategory": "workflow",
|
|
981
|
+
"license": "Apache-2.0"
|
|
971
982
|
},
|
|
972
983
|
{
|
|
973
984
|
"repo": "Pantheon-Security/medusa",
|
|
@@ -996,16 +1007,6 @@
|
|
|
996
1007
|
"defaultCategory": "framework",
|
|
997
1008
|
"license": "MIT"
|
|
998
1009
|
},
|
|
999
|
-
{
|
|
1000
|
-
"repo": "alookai/alook",
|
|
1001
|
-
"patterns": [
|
|
1002
|
-
"agents/**/*.md",
|
|
1003
|
-
"**/AGENTS.md"
|
|
1004
|
-
],
|
|
1005
|
-
"defaultTool": "claude_code",
|
|
1006
|
-
"defaultCategory": "workflow",
|
|
1007
|
-
"license": "Apache-2.0"
|
|
1008
|
-
},
|
|
1009
1010
|
{
|
|
1010
1011
|
"repo": "jiweiyeah/Skills-Manager",
|
|
1011
1012
|
"patterns": [
|
|
@@ -1015,14 +1016,6 @@
|
|
|
1015
1016
|
"defaultCategory": "framework",
|
|
1016
1017
|
"license": "MIT"
|
|
1017
1018
|
},
|
|
1018
|
-
{
|
|
1019
|
-
"repo": "perrypixel/10x-Tool-Calls",
|
|
1020
|
-
"patterns": [
|
|
1021
|
-
"**/*.md"
|
|
1022
|
-
],
|
|
1023
|
-
"defaultTool": "cursor",
|
|
1024
|
-
"defaultCategory": "workflow"
|
|
1025
|
-
},
|
|
1026
1019
|
{
|
|
1027
1020
|
"repo": "Kulaxyz/self-learning-skills",
|
|
1028
1021
|
"patterns": [
|
|
@@ -1034,6 +1027,14 @@
|
|
|
1034
1027
|
"defaultCategory": "workflow",
|
|
1035
1028
|
"license": "MIT"
|
|
1036
1029
|
},
|
|
1030
|
+
{
|
|
1031
|
+
"repo": "perrypixel/10x-Tool-Calls",
|
|
1032
|
+
"patterns": [
|
|
1033
|
+
"**/*.md"
|
|
1034
|
+
],
|
|
1035
|
+
"defaultTool": "cursor",
|
|
1036
|
+
"defaultCategory": "workflow"
|
|
1037
|
+
},
|
|
1037
1038
|
{
|
|
1038
1039
|
"repo": "superiorlu/AITreasureBox",
|
|
1039
1040
|
"patterns": [
|
|
@@ -1095,6 +1096,16 @@
|
|
|
1095
1096
|
"defaultTool": "claude_code",
|
|
1096
1097
|
"defaultCategory": "workflow"
|
|
1097
1098
|
},
|
|
1099
|
+
{
|
|
1100
|
+
"repo": "bitjaru/styleseed",
|
|
1101
|
+
"patterns": [
|
|
1102
|
+
"skills/**/*.md",
|
|
1103
|
+
"**/*.md"
|
|
1104
|
+
],
|
|
1105
|
+
"defaultTool": "claude_code",
|
|
1106
|
+
"defaultCategory": "framework",
|
|
1107
|
+
"license": "MIT"
|
|
1108
|
+
},
|
|
1098
1109
|
{
|
|
1099
1110
|
"repo": "decebals/claude-code-java",
|
|
1100
1111
|
"patterns": [
|
|
@@ -1105,14 +1116,15 @@
|
|
|
1105
1116
|
"license": "MIT"
|
|
1106
1117
|
},
|
|
1107
1118
|
{
|
|
1108
|
-
"repo": "
|
|
1119
|
+
"repo": "infragate/capa",
|
|
1109
1120
|
"patterns": [
|
|
1110
1121
|
"skills/**/*.md",
|
|
1122
|
+
"agents/**/*.md",
|
|
1123
|
+
"**/AGENTS.md",
|
|
1111
1124
|
"**/*.md"
|
|
1112
1125
|
],
|
|
1113
|
-
"defaultTool": "
|
|
1114
|
-
"defaultCategory": "
|
|
1115
|
-
"license": "MIT"
|
|
1126
|
+
"defaultTool": "cursor",
|
|
1127
|
+
"defaultCategory": "workflow"
|
|
1116
1128
|
},
|
|
1117
1129
|
{
|
|
1118
1130
|
"repo": "grapeot/context-infrastructure",
|
|
@@ -1147,15 +1159,13 @@
|
|
|
1147
1159
|
"license": "Apache-2.0"
|
|
1148
1160
|
},
|
|
1149
1161
|
{
|
|
1150
|
-
"repo": "
|
|
1162
|
+
"repo": "laolaoshiren/claude-code-skills-zh",
|
|
1151
1163
|
"patterns": [
|
|
1152
|
-
"skills/**/*.md"
|
|
1153
|
-
"agents/**/*.md",
|
|
1154
|
-
"**/AGENTS.md",
|
|
1155
|
-
"**/*.md"
|
|
1164
|
+
"skills/**/*.md"
|
|
1156
1165
|
],
|
|
1157
|
-
"defaultTool": "
|
|
1158
|
-
"defaultCategory": "workflow"
|
|
1166
|
+
"defaultTool": "claude_code",
|
|
1167
|
+
"defaultCategory": "workflow",
|
|
1168
|
+
"license": "MIT"
|
|
1159
1169
|
},
|
|
1160
1170
|
{
|
|
1161
1171
|
"repo": "sno-ai/mda",
|
|
@@ -1168,15 +1178,6 @@
|
|
|
1168
1178
|
"defaultCategory": "workflow",
|
|
1169
1179
|
"license": "Apache-2.0"
|
|
1170
1180
|
},
|
|
1171
|
-
{
|
|
1172
|
-
"repo": "laolaoshiren/claude-code-skills-zh",
|
|
1173
|
-
"patterns": [
|
|
1174
|
-
"skills/**/*.md"
|
|
1175
|
-
],
|
|
1176
|
-
"defaultTool": "claude_code",
|
|
1177
|
-
"defaultCategory": "workflow",
|
|
1178
|
-
"license": "MIT"
|
|
1179
|
-
},
|
|
1180
1181
|
{
|
|
1181
1182
|
"repo": "fjb040911/ai-rules",
|
|
1182
1183
|
"patterns": [
|
|
@@ -1261,6 +1262,17 @@
|
|
|
1261
1262
|
"defaultCategory": "language",
|
|
1262
1263
|
"license": "MIT"
|
|
1263
1264
|
},
|
|
1265
|
+
{
|
|
1266
|
+
"repo": "WorldFlowAI/everything-claude-code",
|
|
1267
|
+
"patterns": [
|
|
1268
|
+
"skills/**/*.md",
|
|
1269
|
+
"agents/**/*.md",
|
|
1270
|
+
"**/AGENTS.md",
|
|
1271
|
+
"**/*.md"
|
|
1272
|
+
],
|
|
1273
|
+
"defaultTool": "claude_code",
|
|
1274
|
+
"defaultCategory": "workflow"
|
|
1275
|
+
},
|
|
1264
1276
|
{
|
|
1265
1277
|
"repo": "aj-geddes/claude-code-bmad-skills",
|
|
1266
1278
|
"patterns": [
|
|
@@ -1298,17 +1310,6 @@
|
|
|
1298
1310
|
"defaultTool": "universal",
|
|
1299
1311
|
"defaultCategory": "workflow"
|
|
1300
1312
|
},
|
|
1301
|
-
{
|
|
1302
|
-
"repo": "WorldFlowAI/everything-claude-code",
|
|
1303
|
-
"patterns": [
|
|
1304
|
-
"skills/**/*.md",
|
|
1305
|
-
"agents/**/*.md",
|
|
1306
|
-
"**/AGENTS.md",
|
|
1307
|
-
"**/*.md"
|
|
1308
|
-
],
|
|
1309
|
-
"defaultTool": "claude_code",
|
|
1310
|
-
"defaultCategory": "workflow"
|
|
1311
|
-
},
|
|
1312
1313
|
{
|
|
1313
1314
|
"repo": "rampstackco/claude-skills",
|
|
1314
1315
|
"patterns": [
|
|
@@ -1376,21 +1377,21 @@
|
|
|
1376
1377
|
"license": "MIT"
|
|
1377
1378
|
},
|
|
1378
1379
|
{
|
|
1379
|
-
"repo": "
|
|
1380
|
+
"repo": "chenxiachan/xhs-claude-skills",
|
|
1380
1381
|
"patterns": [
|
|
1381
|
-
"
|
|
1382
|
+
"skills/**/*.md"
|
|
1382
1383
|
],
|
|
1383
|
-
"defaultTool": "
|
|
1384
|
-
"defaultCategory": "
|
|
1384
|
+
"defaultTool": "claude_code",
|
|
1385
|
+
"defaultCategory": "workflow",
|
|
1385
1386
|
"license": "MIT"
|
|
1386
1387
|
},
|
|
1387
1388
|
{
|
|
1388
|
-
"repo": "
|
|
1389
|
+
"repo": "matank001/cursor-security-rules",
|
|
1389
1390
|
"patterns": [
|
|
1390
|
-
"
|
|
1391
|
+
"**/*.md"
|
|
1391
1392
|
],
|
|
1392
|
-
"defaultTool": "
|
|
1393
|
-
"defaultCategory": "
|
|
1393
|
+
"defaultTool": "cursor",
|
|
1394
|
+
"defaultCategory": "security",
|
|
1394
1395
|
"license": "MIT"
|
|
1395
1396
|
},
|
|
1396
1397
|
{
|
|
@@ -1453,45 +1454,45 @@
|
|
|
1453
1454
|
"license": "MIT"
|
|
1454
1455
|
},
|
|
1455
1456
|
{
|
|
1456
|
-
"repo": "
|
|
1457
|
+
"repo": "zhukunpenglinyutong/ai-max",
|
|
1457
1458
|
"patterns": [
|
|
1459
|
+
"skills/**/*.md",
|
|
1460
|
+
"agents/**/*.md",
|
|
1461
|
+
"**/AGENTS.md",
|
|
1458
1462
|
"**/*.md"
|
|
1459
1463
|
],
|
|
1460
1464
|
"defaultTool": "universal",
|
|
1461
|
-
"defaultCategory": "
|
|
1462
|
-
"license": "
|
|
1465
|
+
"defaultCategory": "workflow",
|
|
1466
|
+
"license": "MIT"
|
|
1463
1467
|
},
|
|
1464
1468
|
{
|
|
1465
|
-
"repo": "
|
|
1469
|
+
"repo": "marcusquinn/aidevops",
|
|
1466
1470
|
"patterns": [
|
|
1467
|
-
"skills/**/*.md",
|
|
1468
|
-
"agents/**/*.md",
|
|
1469
|
-
"**/AGENTS.md",
|
|
1470
1471
|
"**/*.md"
|
|
1471
1472
|
],
|
|
1472
1473
|
"defaultTool": "universal",
|
|
1473
|
-
"defaultCategory": "
|
|
1474
|
+
"defaultCategory": "security",
|
|
1474
1475
|
"license": "MIT"
|
|
1475
1476
|
},
|
|
1476
1477
|
{
|
|
1477
|
-
"repo": "
|
|
1478
|
+
"repo": "perrystreetsoftware/Harmonize",
|
|
1478
1479
|
"patterns": [
|
|
1479
|
-
"agents/**/*.md",
|
|
1480
|
-
"**/AGENTS.md",
|
|
1481
1480
|
"**/*.md"
|
|
1482
1481
|
],
|
|
1483
1482
|
"defaultTool": "universal",
|
|
1484
|
-
"defaultCategory": "
|
|
1485
|
-
"license": "
|
|
1483
|
+
"defaultCategory": "testing",
|
|
1484
|
+
"license": "Apache-2.0"
|
|
1486
1485
|
},
|
|
1487
1486
|
{
|
|
1488
|
-
"repo": "
|
|
1487
|
+
"repo": "huanchong-99/SoloDawn",
|
|
1489
1488
|
"patterns": [
|
|
1489
|
+
"agents/**/*.md",
|
|
1490
|
+
"**/AGENTS.md",
|
|
1490
1491
|
"**/*.md"
|
|
1491
1492
|
],
|
|
1492
1493
|
"defaultTool": "universal",
|
|
1493
|
-
"defaultCategory": "
|
|
1494
|
-
"license": "
|
|
1494
|
+
"defaultCategory": "workflow",
|
|
1495
|
+
"license": "NOASSERTION"
|
|
1495
1496
|
},
|
|
1496
1497
|
{
|
|
1497
1498
|
"repo": "molyswu/hand_detection",
|
|
@@ -1548,13 +1549,16 @@
|
|
|
1548
1549
|
"defaultCategory": "workflow"
|
|
1549
1550
|
},
|
|
1550
1551
|
{
|
|
1551
|
-
"repo": "
|
|
1552
|
+
"repo": "niaka3dayo/agent-skills-vrc-udon",
|
|
1552
1553
|
"patterns": [
|
|
1554
|
+
"skills/**/*.md",
|
|
1555
|
+
"agents/**/*.md",
|
|
1556
|
+
"**/AGENTS.md",
|
|
1553
1557
|
"**/*.md"
|
|
1554
1558
|
],
|
|
1555
|
-
"defaultTool": "
|
|
1556
|
-
"defaultCategory": "
|
|
1557
|
-
"license": "
|
|
1559
|
+
"defaultTool": "claude_code",
|
|
1560
|
+
"defaultCategory": "workflow",
|
|
1561
|
+
"license": "MIT"
|
|
1558
1562
|
},
|
|
1559
1563
|
{
|
|
1560
1564
|
"repo": "LessUp/awesome-cursorrules-zh",
|
|
@@ -1567,15 +1571,6 @@
|
|
|
1567
1571
|
"defaultCategory": "devops",
|
|
1568
1572
|
"license": "MIT"
|
|
1569
1573
|
},
|
|
1570
|
-
{
|
|
1571
|
-
"repo": "SebastienDegodez/copilot-instructions",
|
|
1572
|
-
"patterns": [
|
|
1573
|
-
"**/*.md"
|
|
1574
|
-
],
|
|
1575
|
-
"defaultTool": "copilot",
|
|
1576
|
-
"defaultCategory": "testing",
|
|
1577
|
-
"license": "Apache-2.0"
|
|
1578
|
-
},
|
|
1579
1574
|
{
|
|
1580
1575
|
"repo": "yzhao062/anywhere-agents",
|
|
1581
1576
|
"patterns": [
|
|
@@ -1587,6 +1582,15 @@
|
|
|
1587
1582
|
"defaultCategory": "workflow",
|
|
1588
1583
|
"license": "Apache-2.0"
|
|
1589
1584
|
},
|
|
1585
|
+
{
|
|
1586
|
+
"repo": "SebastienDegodez/copilot-instructions",
|
|
1587
|
+
"patterns": [
|
|
1588
|
+
"**/*.md"
|
|
1589
|
+
],
|
|
1590
|
+
"defaultTool": "copilot",
|
|
1591
|
+
"defaultCategory": "testing",
|
|
1592
|
+
"license": "Apache-2.0"
|
|
1593
|
+
},
|
|
1590
1594
|
{
|
|
1591
1595
|
"repo": "DengShiyingA/harmonyos-ai-skill",
|
|
1592
1596
|
"patterns": [
|
|
@@ -1655,6 +1659,14 @@
|
|
|
1655
1659
|
"defaultTool": "cursor",
|
|
1656
1660
|
"defaultCategory": "workflow"
|
|
1657
1661
|
},
|
|
1662
|
+
{
|
|
1663
|
+
"repo": "handsomeZR-netizen/mathmodel-skill",
|
|
1664
|
+
"patterns": [
|
|
1665
|
+
"**/*.md"
|
|
1666
|
+
],
|
|
1667
|
+
"defaultTool": "claude_code",
|
|
1668
|
+
"defaultCategory": "testing"
|
|
1669
|
+
},
|
|
1658
1670
|
{
|
|
1659
1671
|
"repo": "NickCirv/engram",
|
|
1660
1672
|
"patterns": [
|
|
@@ -1675,14 +1687,6 @@
|
|
|
1675
1687
|
"defaultCategory": "workflow",
|
|
1676
1688
|
"license": "MIT"
|
|
1677
1689
|
},
|
|
1678
|
-
{
|
|
1679
|
-
"repo": "handsomeZR-netizen/mathmodel-skill",
|
|
1680
|
-
"patterns": [
|
|
1681
|
-
"**/*.md"
|
|
1682
|
-
],
|
|
1683
|
-
"defaultTool": "claude_code",
|
|
1684
|
-
"defaultCategory": "testing"
|
|
1685
|
-
},
|
|
1686
1690
|
{
|
|
1687
1691
|
"repo": "Goldziher/ai-rulez",
|
|
1688
1692
|
"patterns": [
|
|
@@ -1837,6 +1841,15 @@
|
|
|
1837
1841
|
"defaultCategory": "devops",
|
|
1838
1842
|
"license": "MIT"
|
|
1839
1843
|
},
|
|
1844
|
+
{
|
|
1845
|
+
"repo": "smixs/visual-skills",
|
|
1846
|
+
"patterns": [
|
|
1847
|
+
"skills/**/*.md"
|
|
1848
|
+
],
|
|
1849
|
+
"defaultTool": "claude_code",
|
|
1850
|
+
"defaultCategory": "workflow",
|
|
1851
|
+
"license": "MIT"
|
|
1852
|
+
},
|
|
1840
1853
|
{
|
|
1841
1854
|
"repo": "ivangrynenko/cursorrules",
|
|
1842
1855
|
"patterns": [
|
|
@@ -1866,15 +1879,6 @@
|
|
|
1866
1879
|
"defaultCategory": "workflow",
|
|
1867
1880
|
"license": "MIT"
|
|
1868
1881
|
},
|
|
1869
|
-
{
|
|
1870
|
-
"repo": "smixs/visual-skills",
|
|
1871
|
-
"patterns": [
|
|
1872
|
-
"skills/**/*.md"
|
|
1873
|
-
],
|
|
1874
|
-
"defaultTool": "claude_code",
|
|
1875
|
-
"defaultCategory": "workflow",
|
|
1876
|
-
"license": "MIT"
|
|
1877
|
-
},
|
|
1878
1882
|
{
|
|
1879
1883
|
"repo": "jparkerweb/ai-assist-skills",
|
|
1880
1884
|
"patterns": [
|
|
@@ -1928,6 +1932,14 @@
|
|
|
1928
1932
|
"defaultCategory": "workflow",
|
|
1929
1933
|
"license": "MIT"
|
|
1930
1934
|
},
|
|
1935
|
+
{
|
|
1936
|
+
"repo": "ZapDos7/lakera-gandalf",
|
|
1937
|
+
"patterns": [
|
|
1938
|
+
"**/*.md"
|
|
1939
|
+
],
|
|
1940
|
+
"defaultTool": "universal",
|
|
1941
|
+
"defaultCategory": "workflow"
|
|
1942
|
+
},
|
|
1931
1943
|
{
|
|
1932
1944
|
"repo": "0xfnzero/AI-Code-Tutorials",
|
|
1933
1945
|
"patterns": [
|
|
@@ -1938,14 +1950,6 @@
|
|
|
1938
1950
|
"defaultCategory": "workflow",
|
|
1939
1951
|
"license": "MIT"
|
|
1940
1952
|
},
|
|
1941
|
-
{
|
|
1942
|
-
"repo": "ZapDos7/lakera-gandalf",
|
|
1943
|
-
"patterns": [
|
|
1944
|
-
"**/*.md"
|
|
1945
|
-
],
|
|
1946
|
-
"defaultTool": "universal",
|
|
1947
|
-
"defaultCategory": "workflow"
|
|
1948
|
-
},
|
|
1949
1953
|
{
|
|
1950
1954
|
"repo": "KbWen/agentic-os",
|
|
1951
1955
|
"patterns": [
|
|
@@ -1967,22 +1971,22 @@
|
|
|
1967
1971
|
"license": "CC-BY-4.0"
|
|
1968
1972
|
},
|
|
1969
1973
|
{
|
|
1970
|
-
"repo": "
|
|
1974
|
+
"repo": "gpt-img-2/ai-image-prompt-cookbook",
|
|
1971
1975
|
"patterns": [
|
|
1972
1976
|
"**/*.md"
|
|
1973
1977
|
],
|
|
1974
1978
|
"defaultTool": "universal",
|
|
1975
|
-
"defaultCategory": "
|
|
1976
|
-
"license": "
|
|
1979
|
+
"defaultCategory": "workflow",
|
|
1980
|
+
"license": "NOASSERTION"
|
|
1977
1981
|
},
|
|
1978
1982
|
{
|
|
1979
|
-
"repo": "
|
|
1983
|
+
"repo": "nomie7/nano-banana-slides-prompter",
|
|
1980
1984
|
"patterns": [
|
|
1981
1985
|
"**/*.md"
|
|
1982
1986
|
],
|
|
1983
1987
|
"defaultTool": "universal",
|
|
1984
|
-
"defaultCategory": "
|
|
1985
|
-
"license": "
|
|
1988
|
+
"defaultCategory": "framework",
|
|
1989
|
+
"license": "GPL-3.0"
|
|
1986
1990
|
},
|
|
1987
1991
|
{
|
|
1988
1992
|
"repo": "seojoonkim/agentlinter",
|
|
@@ -2042,25 +2046,25 @@
|
|
|
2042
2046
|
"license": "MIT"
|
|
2043
2047
|
},
|
|
2044
2048
|
{
|
|
2045
|
-
"repo": "
|
|
2049
|
+
"repo": "netresearch/agent-rules-skill",
|
|
2046
2050
|
"patterns": [
|
|
2047
2051
|
"agents/**/*.md",
|
|
2048
|
-
"**/AGENTS.md"
|
|
2052
|
+
"**/AGENTS.md",
|
|
2053
|
+
"**/*.md"
|
|
2049
2054
|
],
|
|
2050
2055
|
"defaultTool": "claude_code",
|
|
2051
2056
|
"defaultCategory": "workflow",
|
|
2052
|
-
"license": "
|
|
2057
|
+
"license": "NOASSERTION"
|
|
2053
2058
|
},
|
|
2054
2059
|
{
|
|
2055
|
-
"repo": "
|
|
2060
|
+
"repo": "escoffier-labs/brigade",
|
|
2056
2061
|
"patterns": [
|
|
2057
2062
|
"agents/**/*.md",
|
|
2058
|
-
"**/AGENTS.md"
|
|
2059
|
-
"**/*.md"
|
|
2063
|
+
"**/AGENTS.md"
|
|
2060
2064
|
],
|
|
2061
2065
|
"defaultTool": "claude_code",
|
|
2062
2066
|
"defaultCategory": "workflow",
|
|
2063
|
-
"license": "
|
|
2067
|
+
"license": "MIT"
|
|
2064
2068
|
},
|
|
2065
2069
|
{
|
|
2066
2070
|
"repo": "fielding/copilot-instructions",
|
|
@@ -2253,19 +2257,19 @@
|
|
|
2253
2257
|
"license": "MIT"
|
|
2254
2258
|
},
|
|
2255
2259
|
{
|
|
2256
|
-
"repo": "
|
|
2260
|
+
"repo": "nedcodes-ok/cursorrules-collection",
|
|
2257
2261
|
"patterns": [
|
|
2262
|
+
"**/*.cursorrules",
|
|
2263
|
+
"**/*.mdc",
|
|
2258
2264
|
"**/*.md"
|
|
2259
2265
|
],
|
|
2260
2266
|
"defaultTool": "cursor",
|
|
2261
|
-
"defaultCategory": "
|
|
2267
|
+
"defaultCategory": "testing",
|
|
2262
2268
|
"license": "MIT"
|
|
2263
2269
|
},
|
|
2264
2270
|
{
|
|
2265
|
-
"repo": "
|
|
2271
|
+
"repo": "razbakov/ai-secretary",
|
|
2266
2272
|
"patterns": [
|
|
2267
|
-
"**/*.cursorrules",
|
|
2268
|
-
"**/*.mdc",
|
|
2269
2273
|
"**/*.md"
|
|
2270
2274
|
],
|
|
2271
2275
|
"defaultTool": "cursor",
|
|
@@ -2273,14 +2277,14 @@
|
|
|
2273
2277
|
"license": "MIT"
|
|
2274
2278
|
},
|
|
2275
2279
|
{
|
|
2276
|
-
"repo": "
|
|
2280
|
+
"repo": "barisercan/cursorrules",
|
|
2277
2281
|
"patterns": [
|
|
2278
2282
|
"**/*.cursorrules",
|
|
2279
2283
|
"**/*.mdc",
|
|
2280
2284
|
"**/*.md"
|
|
2281
2285
|
],
|
|
2282
2286
|
"defaultTool": "cursor",
|
|
2283
|
-
"defaultCategory": "
|
|
2287
|
+
"defaultCategory": "workflow",
|
|
2284
2288
|
"license": "MIT"
|
|
2285
2289
|
},
|
|
2286
2290
|
{
|
|
@@ -2411,25 +2415,25 @@
|
|
|
2411
2415
|
"defaultCategory": "workflow"
|
|
2412
2416
|
},
|
|
2413
2417
|
{
|
|
2414
|
-
"repo": "
|
|
2418
|
+
"repo": "ItamarZand88/awesome-agent-conventions",
|
|
2415
2419
|
"patterns": [
|
|
2416
2420
|
"agents/**/*.md",
|
|
2417
2421
|
"**/AGENTS.md",
|
|
2418
2422
|
"**/*.md"
|
|
2419
2423
|
],
|
|
2420
|
-
"defaultTool": "
|
|
2421
|
-
"defaultCategory": "workflow"
|
|
2424
|
+
"defaultTool": "claude_code",
|
|
2425
|
+
"defaultCategory": "workflow",
|
|
2426
|
+
"license": "MIT"
|
|
2422
2427
|
},
|
|
2423
2428
|
{
|
|
2424
|
-
"repo": "
|
|
2429
|
+
"repo": "SixArm/ai-agents-tips",
|
|
2425
2430
|
"patterns": [
|
|
2426
2431
|
"agents/**/*.md",
|
|
2427
2432
|
"**/AGENTS.md",
|
|
2428
2433
|
"**/*.md"
|
|
2429
2434
|
],
|
|
2430
|
-
"defaultTool": "
|
|
2431
|
-
"defaultCategory": "workflow"
|
|
2432
|
-
"license": "MIT"
|
|
2435
|
+
"defaultTool": "cursor",
|
|
2436
|
+
"defaultCategory": "workflow"
|
|
2433
2437
|
},
|
|
2434
2438
|
{
|
|
2435
2439
|
"repo": "tomdwipo/claude-soul",
|
|
@@ -2548,6 +2552,17 @@
|
|
|
2548
2552
|
"defaultTool": "windsurf",
|
|
2549
2553
|
"defaultCategory": "workflow"
|
|
2550
2554
|
},
|
|
2555
|
+
{
|
|
2556
|
+
"repo": "fockus/skill-memory-bank",
|
|
2557
|
+
"patterns": [
|
|
2558
|
+
"agents/**/*.md",
|
|
2559
|
+
"**/AGENTS.md",
|
|
2560
|
+
"**/*.md"
|
|
2561
|
+
],
|
|
2562
|
+
"defaultTool": "claude_code",
|
|
2563
|
+
"defaultCategory": "testing",
|
|
2564
|
+
"license": "MIT"
|
|
2565
|
+
},
|
|
2551
2566
|
{
|
|
2552
2567
|
"repo": "nirholas/auto-kill-terminal",
|
|
2553
2568
|
"patterns": [
|
|
@@ -2557,7 +2572,7 @@
|
|
|
2557
2572
|
],
|
|
2558
2573
|
"defaultTool": "cursor",
|
|
2559
2574
|
"defaultCategory": "workflow",
|
|
2560
|
-
"license": "
|
|
2575
|
+
"license": "NOASSERTION"
|
|
2561
2576
|
},
|
|
2562
2577
|
{
|
|
2563
2578
|
"repo": "tugkanboz/awesome-cursorrules",
|
|
@@ -2588,17 +2603,6 @@
|
|
|
2588
2603
|
"defaultCategory": "framework",
|
|
2589
2604
|
"license": "MIT"
|
|
2590
2605
|
},
|
|
2591
|
-
{
|
|
2592
|
-
"repo": "fockus/skill-memory-bank",
|
|
2593
|
-
"patterns": [
|
|
2594
|
-
"agents/**/*.md",
|
|
2595
|
-
"**/AGENTS.md",
|
|
2596
|
-
"**/*.md"
|
|
2597
|
-
],
|
|
2598
|
-
"defaultTool": "claude_code",
|
|
2599
|
-
"defaultCategory": "testing",
|
|
2600
|
-
"license": "MIT"
|
|
2601
|
-
},
|
|
2602
2606
|
{
|
|
2603
2607
|
"repo": "tiandee/awesome-skills-hub",
|
|
2604
2608
|
"patterns": [
|
|
@@ -2775,30 +2779,30 @@
|
|
|
2775
2779
|
"defaultCategory": "workflow"
|
|
2776
2780
|
},
|
|
2777
2781
|
{
|
|
2778
|
-
"repo": "
|
|
2782
|
+
"repo": "madebyaris/agent-orchestration",
|
|
2779
2783
|
"patterns": [
|
|
2784
|
+
"agents/**/*.md",
|
|
2785
|
+
"**/AGENTS.md",
|
|
2780
2786
|
"**/*.md"
|
|
2781
2787
|
],
|
|
2782
2788
|
"defaultTool": "cursor",
|
|
2783
2789
|
"defaultCategory": "workflow",
|
|
2784
|
-
"license": "
|
|
2790
|
+
"license": "MIT"
|
|
2785
2791
|
},
|
|
2786
2792
|
{
|
|
2787
|
-
"repo": "
|
|
2793
|
+
"repo": "Renvia-code/best-cursor-rules",
|
|
2788
2794
|
"patterns": [
|
|
2789
|
-
"**/*.cursorrules",
|
|
2790
|
-
"**/*.mdc",
|
|
2791
2795
|
"**/*.md"
|
|
2792
2796
|
],
|
|
2793
2797
|
"defaultTool": "cursor",
|
|
2794
2798
|
"defaultCategory": "workflow",
|
|
2795
|
-
"license": "
|
|
2799
|
+
"license": "CC0-1.0"
|
|
2796
2800
|
},
|
|
2797
2801
|
{
|
|
2798
|
-
"repo": "
|
|
2802
|
+
"repo": "Zenobia000/CursorGod-cursorrules-buff",
|
|
2799
2803
|
"patterns": [
|
|
2800
|
-
"
|
|
2801
|
-
"
|
|
2804
|
+
"**/*.cursorrules",
|
|
2805
|
+
"**/*.mdc",
|
|
2802
2806
|
"**/*.md"
|
|
2803
2807
|
],
|
|
2804
2808
|
"defaultTool": "cursor",
|
|
@@ -2806,7 +2810,7 @@
|
|
|
2806
2810
|
"license": "MIT"
|
|
2807
2811
|
},
|
|
2808
2812
|
{
|
|
2809
|
-
"repo": "
|
|
2813
|
+
"repo": "nedcodes-ok/rule-porter",
|
|
2810
2814
|
"patterns": [
|
|
2811
2815
|
"agents/**/*.md",
|
|
2812
2816
|
"**/AGENTS.md",
|
|
@@ -2896,6 +2900,15 @@
|
|
|
2896
2900
|
"defaultTool": "copilot",
|
|
2897
2901
|
"defaultCategory": "workflow"
|
|
2898
2902
|
},
|
|
2903
|
+
{
|
|
2904
|
+
"repo": "caioribeiroclw-pixel/pluribus",
|
|
2905
|
+
"patterns": [
|
|
2906
|
+
"**/*.md"
|
|
2907
|
+
],
|
|
2908
|
+
"defaultTool": "claude_code",
|
|
2909
|
+
"defaultCategory": "workflow",
|
|
2910
|
+
"license": "MIT"
|
|
2911
|
+
},
|
|
2899
2912
|
{
|
|
2900
2913
|
"repo": "mupengi-bot/mupengism",
|
|
2901
2914
|
"patterns": [
|
|
@@ -3035,15 +3048,6 @@
|
|
|
3035
3048
|
"defaultTool": "claude_code",
|
|
3036
3049
|
"defaultCategory": "workflow"
|
|
3037
3050
|
},
|
|
3038
|
-
{
|
|
3039
|
-
"repo": "caioribeiroclw-pixel/pluribus",
|
|
3040
|
-
"patterns": [
|
|
3041
|
-
"**/*.md"
|
|
3042
|
-
],
|
|
3043
|
-
"defaultTool": "claude_code",
|
|
3044
|
-
"defaultCategory": "workflow",
|
|
3045
|
-
"license": "MIT"
|
|
3046
|
-
},
|
|
3047
3051
|
{
|
|
3048
3052
|
"repo": "UserAd/cursorrules",
|
|
3049
3053
|
"patterns": [
|
|
@@ -3161,40 +3165,40 @@
|
|
|
3161
3165
|
"license": "MIT"
|
|
3162
3166
|
},
|
|
3163
3167
|
{
|
|
3164
|
-
"repo": "
|
|
3168
|
+
"repo": "Bridgetamana/cool-copilot-instructions",
|
|
3165
3169
|
"patterns": [
|
|
3166
3170
|
"**/*.md"
|
|
3167
3171
|
],
|
|
3168
|
-
"defaultTool": "
|
|
3172
|
+
"defaultTool": "copilot",
|
|
3169
3173
|
"defaultCategory": "workflow",
|
|
3170
3174
|
"license": "MIT"
|
|
3171
3175
|
},
|
|
3172
3176
|
{
|
|
3173
|
-
"repo": "
|
|
3177
|
+
"repo": "manojmallick/sigmap-vscode",
|
|
3174
3178
|
"patterns": [
|
|
3175
3179
|
"**/*.md"
|
|
3176
3180
|
],
|
|
3177
|
-
"defaultTool": "
|
|
3181
|
+
"defaultTool": "cursor",
|
|
3178
3182
|
"defaultCategory": "workflow",
|
|
3179
3183
|
"license": "MIT"
|
|
3180
3184
|
},
|
|
3181
3185
|
{
|
|
3182
|
-
"repo": "
|
|
3186
|
+
"repo": "ClawCap/Mimic",
|
|
3183
3187
|
"patterns": [
|
|
3184
3188
|
"**/*.md"
|
|
3185
3189
|
],
|
|
3186
|
-
"defaultTool": "
|
|
3190
|
+
"defaultTool": "openclaw",
|
|
3187
3191
|
"defaultCategory": "workflow",
|
|
3188
|
-
"license": "
|
|
3192
|
+
"license": "MIT"
|
|
3189
3193
|
},
|
|
3190
3194
|
{
|
|
3191
|
-
"repo": "
|
|
3195
|
+
"repo": "sandoreclegane/covenant.md",
|
|
3192
3196
|
"patterns": [
|
|
3193
3197
|
"**/*.md"
|
|
3194
3198
|
],
|
|
3195
|
-
"defaultTool": "
|
|
3199
|
+
"defaultTool": "universal",
|
|
3196
3200
|
"defaultCategory": "workflow",
|
|
3197
|
-
"license": "
|
|
3201
|
+
"license": "NOASSERTION"
|
|
3198
3202
|
},
|
|
3199
3203
|
{
|
|
3200
3204
|
"repo": "trevor-nichols/cursorrules-tools",
|
package/package.json
CHANGED
|
@@ -1,26 +0,0 @@
|
|
|
1
|
-
import type { SkillEntry } from './types.js';
|
|
2
|
-
/** Severity levels for security findings. */
|
|
3
|
-
export type Severity = 'critical' | 'high' | 'medium' | 'low';
|
|
4
|
-
/** A single security finding in a skill. */
|
|
5
|
-
export interface SecurityFinding {
|
|
6
|
-
rule: string;
|
|
7
|
-
severity: Severity;
|
|
8
|
-
message: string;
|
|
9
|
-
/** The matched text (truncated) */
|
|
10
|
-
match: string;
|
|
11
|
-
/** Line number (1-indexed) where the match was found */
|
|
12
|
-
line: number;
|
|
13
|
-
}
|
|
14
|
-
/** Result of scanning a single skill. */
|
|
15
|
-
export interface ScanResult {
|
|
16
|
-
skillId: string;
|
|
17
|
-
passed: boolean;
|
|
18
|
-
findings: SecurityFinding[];
|
|
19
|
-
}
|
|
20
|
-
/** Scan a single skill's content for security issues. */
|
|
21
|
-
export declare function scanSkill(skill: SkillEntry): ScanResult;
|
|
22
|
-
/** Scan all skills in a registry. Returns results sorted by severity. */
|
|
23
|
-
export declare function scanRegistry(skills: SkillEntry[]): ScanResult[];
|
|
24
|
-
/** Format scan results for console output. */
|
|
25
|
-
export declare function formatScanResults(results: ScanResult[]): string;
|
|
26
|
-
//# sourceMappingURL=security-scanner.d.ts.map
|
package/dist/security-scanner.js
DELETED
|
@@ -1,290 +0,0 @@
|
|
|
1
|
-
const RULES = [
|
|
2
|
-
// ── Critical: Prompt Injection ──
|
|
3
|
-
{
|
|
4
|
-
id: 'prompt-injection-ignore',
|
|
5
|
-
severity: 'critical',
|
|
6
|
-
description: 'Prompt injection: instruction to ignore previous instructions',
|
|
7
|
-
patterns: [
|
|
8
|
-
/ignore\s+(all\s+)?(previous|prior|above|earlier)\s+(instructions?|rules?|prompts?|context)/i,
|
|
9
|
-
/disregard\s+(all\s+)?(previous|prior|above)\s+(instructions?|rules?)/i,
|
|
10
|
-
/forget\s+(everything|all)\s+(you|that)\s+(were|was|have)/i,
|
|
11
|
-
],
|
|
12
|
-
},
|
|
13
|
-
{
|
|
14
|
-
id: 'prompt-injection-roleplay',
|
|
15
|
-
severity: 'critical',
|
|
16
|
-
description: 'Prompt injection: role override or jailbreak attempt',
|
|
17
|
-
patterns: [
|
|
18
|
-
/you\s+are\s+now\s+(DAN|evil|unrestricted|unfiltered|jailbroken)/i,
|
|
19
|
-
/entering?\s+(DAN|developer|god)\s+mode/i,
|
|
20
|
-
/act\s+as\s+(if|though)\s+you\s+(have\s+no|don.?t\s+have)\s+(restrictions|filters|limits)/i,
|
|
21
|
-
/from\s+now\s+on,?\s+you\s+(will|must|should)\s+(always|never)\s+(obey|follow|listen)/i,
|
|
22
|
-
],
|
|
23
|
-
},
|
|
24
|
-
{
|
|
25
|
-
id: 'prompt-injection-system',
|
|
26
|
-
severity: 'critical',
|
|
27
|
-
description: 'Prompt injection: fake system message or hidden instruction',
|
|
28
|
-
patterns: [
|
|
29
|
-
/<\/?system[-_]?(message|prompt|instruction|reminder)>/i,
|
|
30
|
-
/\[SYSTEM\]\s*:/i,
|
|
31
|
-
/\[INST\]|\[\/INST\]/i,
|
|
32
|
-
/<<\s*SYS\s*>>|<<\s*\/SYS\s*>>/i,
|
|
33
|
-
],
|
|
34
|
-
},
|
|
35
|
-
// ── High: Dangerous Commands ──
|
|
36
|
-
{
|
|
37
|
-
id: 'dangerous-command-rm',
|
|
38
|
-
severity: 'high',
|
|
39
|
-
description: 'Dangerous shell command: recursive delete',
|
|
40
|
-
patterns: [
|
|
41
|
-
/rm\s+-[a-z]*r[a-z]*f|rm\s+-[a-z]*f[a-z]*r/i,
|
|
42
|
-
/rm\s+-rf\s+[\/~]/i,
|
|
43
|
-
/rm\s+-rf\s+\*/i,
|
|
44
|
-
],
|
|
45
|
-
},
|
|
46
|
-
{
|
|
47
|
-
id: 'dangerous-command-eval',
|
|
48
|
-
severity: 'high',
|
|
49
|
-
description: 'Dangerous command: eval/exec of remote content',
|
|
50
|
-
patterns: [
|
|
51
|
-
/curl\s+.*\|\s*(bash|sh|python|node|eval)/i,
|
|
52
|
-
/wget\s+.*\|\s*(bash|sh|python|node|eval)/i,
|
|
53
|
-
/\beval\s*\(\s*(fetch|require|import)\b/i,
|
|
54
|
-
],
|
|
55
|
-
},
|
|
56
|
-
{
|
|
57
|
-
id: 'dangerous-command-env',
|
|
58
|
-
severity: 'high',
|
|
59
|
-
description: 'Command that accesses or exfiltrates environment variables',
|
|
60
|
-
patterns: [
|
|
61
|
-
/printenv\s*\|/i,
|
|
62
|
-
/env\s*\|\s*(curl|wget|nc|ncat)/i,
|
|
63
|
-
/\$\{?\w*(SECRET|TOKEN|KEY|PASSWORD|CREDENTIAL)\w*\}?\s*.*\b(curl|wget|nc|fetch)\b/i,
|
|
64
|
-
],
|
|
65
|
-
},
|
|
66
|
-
{
|
|
67
|
-
id: 'dangerous-command-reverse-shell',
|
|
68
|
-
severity: 'critical',
|
|
69
|
-
description: 'Reverse shell or network backdoor pattern',
|
|
70
|
-
patterns: [
|
|
71
|
-
/\bnc\s+-[a-z]*e\s/i,
|
|
72
|
-
/\bncat\b.*\b-e\b/i,
|
|
73
|
-
/\/dev\/(tcp|udp)\//i,
|
|
74
|
-
/mkfifo\s+.*\bsh\b/i,
|
|
75
|
-
/bash\s+-i\s+>&?\s*\/dev\/(tcp|udp)/i,
|
|
76
|
-
],
|
|
77
|
-
},
|
|
78
|
-
// ── High: Data Exfiltration ──
|
|
79
|
-
{
|
|
80
|
-
id: 'exfil-curl-post',
|
|
81
|
-
severity: 'high',
|
|
82
|
-
description: 'Potential data exfiltration via HTTP POST',
|
|
83
|
-
patterns: [
|
|
84
|
-
/curl\s+.*-X\s*POST\s+https?:\/\/(?!localhost|127\.0\.0\.1)/i,
|
|
85
|
-
/curl\s+.*--data.*https?:\/\/(?!localhost|127\.0\.0\.1)/i,
|
|
86
|
-
/fetch\s*\(\s*['"]https?:\/\/(?!localhost).*['"].*method:\s*['"]POST['"]/i,
|
|
87
|
-
],
|
|
88
|
-
},
|
|
89
|
-
{
|
|
90
|
-
id: 'exfil-webhook',
|
|
91
|
-
severity: 'high',
|
|
92
|
-
description: 'Webhook or external callback URL',
|
|
93
|
-
patterns: [
|
|
94
|
-
/https?:\/\/[^\s]*webhook[^\s]*/i,
|
|
95
|
-
/https?:\/\/[^\s]*\.ngrok\.[^\s]*/i,
|
|
96
|
-
/https?:\/\/[^\s]*requestbin[^\s]*/i,
|
|
97
|
-
/https?:\/\/[^\s]*pipedream[^\s]*/i,
|
|
98
|
-
/https?:\/\/[^\s]*burpcollaborator[^\s]*/i,
|
|
99
|
-
],
|
|
100
|
-
},
|
|
101
|
-
// ── Medium: Suspicious Patterns ──
|
|
102
|
-
{
|
|
103
|
-
id: 'base64-blob',
|
|
104
|
-
severity: 'medium',
|
|
105
|
-
description: 'Large base64-encoded blob (potential obfuscated payload)',
|
|
106
|
-
patterns: [
|
|
107
|
-
/[A-Za-z0-9+/]{100,}={0,2}/,
|
|
108
|
-
],
|
|
109
|
-
},
|
|
110
|
-
{
|
|
111
|
-
id: 'obfuscated-code',
|
|
112
|
-
severity: 'medium',
|
|
113
|
-
description: 'Obfuscated or encoded script content',
|
|
114
|
-
patterns: [
|
|
115
|
-
/\\x[0-9a-f]{2}(\\x[0-9a-f]{2}){10,}/i,
|
|
116
|
-
/\\u[0-9a-f]{4}(\\u[0-9a-f]{4}){10,}/i,
|
|
117
|
-
/String\.fromCharCode\s*\(/i,
|
|
118
|
-
/atob\s*\(\s*['"][A-Za-z0-9+/]/i,
|
|
119
|
-
],
|
|
120
|
-
},
|
|
121
|
-
{
|
|
122
|
-
id: 'hidden-text',
|
|
123
|
-
severity: 'medium',
|
|
124
|
-
description: 'Hidden content via HTML comments, zero-width chars, or invisible unicode',
|
|
125
|
-
patterns: [
|
|
126
|
-
/<!--[\s\S]{50,}?-->/,
|
|
127
|
-
/[\u200B\u200C\u200D\uFEFF]{3,}/,
|
|
128
|
-
/\u2060{3,}/,
|
|
129
|
-
],
|
|
130
|
-
multiline: true,
|
|
131
|
-
},
|
|
132
|
-
{
|
|
133
|
-
id: 'suspicious-url',
|
|
134
|
-
severity: 'medium',
|
|
135
|
-
description: 'URL pointing to non-standard domain (potential phishing or C2)',
|
|
136
|
-
patterns: [
|
|
137
|
-
/https?:\/\/\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}/,
|
|
138
|
-
/https?:\/\/[^\s]*\.(tk|ml|ga|cf|gq|top|xyz|pw|cc)\b/i,
|
|
139
|
-
],
|
|
140
|
-
},
|
|
141
|
-
// ── Medium: Privilege Escalation ──
|
|
142
|
-
{
|
|
143
|
-
id: 'privilege-escalation',
|
|
144
|
-
severity: 'medium',
|
|
145
|
-
description: 'Instructions to bypass safety, skip verification, or escalate permissions',
|
|
146
|
-
patterns: [
|
|
147
|
-
/--no-verify/i,
|
|
148
|
-
/--force\s+(push|delete|remove)/i,
|
|
149
|
-
/chmod\s+777/i,
|
|
150
|
-
/sudo\s+/i,
|
|
151
|
-
/disable\s+(security|auth|verification|checking|linting)/i,
|
|
152
|
-
],
|
|
153
|
-
},
|
|
154
|
-
// ── Low: Suspicious Instructions ──
|
|
155
|
-
{
|
|
156
|
-
id: 'credential-request',
|
|
157
|
-
severity: 'low',
|
|
158
|
-
description: 'Instruction requesting or handling credentials',
|
|
159
|
-
patterns: [
|
|
160
|
-
/\b(paste|enter|provide|share)\s+(your\s+)?(api[- ]?key|token|password|secret|credential)/i,
|
|
161
|
-
/hardcode\s+(the\s+)?(api[- ]?key|token|password|secret)/i,
|
|
162
|
-
],
|
|
163
|
-
},
|
|
164
|
-
{
|
|
165
|
-
id: 'file-system-access',
|
|
166
|
-
severity: 'low',
|
|
167
|
-
description: 'Access to sensitive system paths',
|
|
168
|
-
patterns: [
|
|
169
|
-
/\/etc\/(passwd|shadow|hosts)/,
|
|
170
|
-
/~\/\.(ssh|gnupg|aws|config)/,
|
|
171
|
-
/\$HOME\/\.(ssh|gnupg|aws)/,
|
|
172
|
-
],
|
|
173
|
-
},
|
|
174
|
-
];
|
|
175
|
-
// ── Allowlist ────────────────────────────────────────────────────────────────
|
|
176
|
-
/** Patterns that are false positives in legitimate skill content. */
|
|
177
|
-
const ALLOWLIST = [
|
|
178
|
-
// Security review checklists naturally mention these concepts
|
|
179
|
-
{ rule: 'credential-request', pattern: /checklist|review|verify|never\s+hardcode/i },
|
|
180
|
-
// Git convention skills mention --no-verify in a "don't do this" context
|
|
181
|
-
{ rule: 'privilege-escalation', pattern: /never|don.?t|avoid|anti.?pattern/i },
|
|
182
|
-
];
|
|
183
|
-
// ── Scanner ──────────────────────────────────────────────────────────────────
|
|
184
|
-
/** Scan a single skill's content for security issues. */
|
|
185
|
-
export function scanSkill(skill) {
|
|
186
|
-
const findings = [];
|
|
187
|
-
const content = skill.content;
|
|
188
|
-
const lines = content.split('\n');
|
|
189
|
-
for (const rule of RULES) {
|
|
190
|
-
if (rule.multiline) {
|
|
191
|
-
// Match against full content
|
|
192
|
-
for (const pattern of rule.patterns) {
|
|
193
|
-
const match = content.match(pattern);
|
|
194
|
-
if (match) {
|
|
195
|
-
// Check allowlist
|
|
196
|
-
const lineIdx = content.substring(0, match.index ?? 0).split('\n').length;
|
|
197
|
-
const lineText = lines[lineIdx - 1] ?? '';
|
|
198
|
-
if (isAllowlisted(rule.id, lineText))
|
|
199
|
-
continue;
|
|
200
|
-
findings.push({
|
|
201
|
-
rule: rule.id,
|
|
202
|
-
severity: rule.severity,
|
|
203
|
-
message: rule.description,
|
|
204
|
-
match: match[0].slice(0, 100),
|
|
205
|
-
line: lineIdx,
|
|
206
|
-
});
|
|
207
|
-
}
|
|
208
|
-
}
|
|
209
|
-
}
|
|
210
|
-
else {
|
|
211
|
-
// Match per-line
|
|
212
|
-
for (let i = 0; i < lines.length; i++) {
|
|
213
|
-
const line = lines[i];
|
|
214
|
-
// Skip content inside code blocks that are clearly examples
|
|
215
|
-
// (but still flag dangerous commands even in code blocks)
|
|
216
|
-
for (const pattern of rule.patterns) {
|
|
217
|
-
const match = line.match(pattern);
|
|
218
|
-
if (match) {
|
|
219
|
-
if (isAllowlisted(rule.id, line))
|
|
220
|
-
continue;
|
|
221
|
-
findings.push({
|
|
222
|
-
rule: rule.id,
|
|
223
|
-
severity: rule.severity,
|
|
224
|
-
message: rule.description,
|
|
225
|
-
match: match[0].slice(0, 100),
|
|
226
|
-
line: i + 1,
|
|
227
|
-
});
|
|
228
|
-
break; // One finding per rule per line
|
|
229
|
-
}
|
|
230
|
-
}
|
|
231
|
-
}
|
|
232
|
-
}
|
|
233
|
-
}
|
|
234
|
-
// Dedupe findings by rule+line
|
|
235
|
-
const seen = new Set();
|
|
236
|
-
const deduped = findings.filter(f => {
|
|
237
|
-
const key = `${f.rule}:${f.line}`;
|
|
238
|
-
if (seen.has(key))
|
|
239
|
-
return false;
|
|
240
|
-
seen.add(key);
|
|
241
|
-
return true;
|
|
242
|
-
});
|
|
243
|
-
const hasCritical = deduped.some(f => f.severity === 'critical');
|
|
244
|
-
const hasHigh = deduped.some(f => f.severity === 'high');
|
|
245
|
-
return {
|
|
246
|
-
skillId: skill.id,
|
|
247
|
-
passed: !hasCritical && !hasHigh,
|
|
248
|
-
findings: deduped,
|
|
249
|
-
};
|
|
250
|
-
}
|
|
251
|
-
function isAllowlisted(ruleId, lineText) {
|
|
252
|
-
return ALLOWLIST.some(a => a.rule === ruleId && a.pattern.test(lineText));
|
|
253
|
-
}
|
|
254
|
-
/** Scan all skills in a registry. Returns results sorted by severity. */
|
|
255
|
-
export function scanRegistry(skills) {
|
|
256
|
-
const results = skills.map(scanSkill);
|
|
257
|
-
// Sort: failed first, then by finding count
|
|
258
|
-
results.sort((a, b) => {
|
|
259
|
-
if (a.passed !== b.passed)
|
|
260
|
-
return a.passed ? 1 : -1;
|
|
261
|
-
return b.findings.length - a.findings.length;
|
|
262
|
-
});
|
|
263
|
-
return results;
|
|
264
|
-
}
|
|
265
|
-
/** Format scan results for console output. */
|
|
266
|
-
export function formatScanResults(results) {
|
|
267
|
-
const lines = [];
|
|
268
|
-
const passed = results.filter(r => r.passed).length;
|
|
269
|
-
const failed = results.filter(r => !r.passed).length;
|
|
270
|
-
const total = results.length;
|
|
271
|
-
lines.push(`\nSecurity Scan: ${total} skills scanned`);
|
|
272
|
-
lines.push(` ${passed} passed, ${failed} failed\n`);
|
|
273
|
-
for (const result of results) {
|
|
274
|
-
if (result.findings.length === 0)
|
|
275
|
-
continue;
|
|
276
|
-
const icon = result.passed ? '⚠' : '✗';
|
|
277
|
-
lines.push(`${icon} ${result.skillId}:`);
|
|
278
|
-
for (const f of result.findings) {
|
|
279
|
-
const sevLabel = f.severity.toUpperCase().padEnd(8);
|
|
280
|
-
lines.push(` [${sevLabel}] L${f.line}: ${f.message}`);
|
|
281
|
-
lines.push(` match: "${f.match}"`);
|
|
282
|
-
}
|
|
283
|
-
lines.push('');
|
|
284
|
-
}
|
|
285
|
-
if (failed > 0) {
|
|
286
|
-
lines.push(`BLOCKED: ${failed} skill(s) have critical/high findings and will not be included.`);
|
|
287
|
-
}
|
|
288
|
-
return lines.join('\n');
|
|
289
|
-
}
|
|
290
|
-
//# sourceMappingURL=security-scanner.js.map
|