@rune-kit/rune 2.8.0 → 2.11.0

package/skills/sast/SKILL.md

@@ -1,190 +1,190 @@
----
-name: sast
-description: "Static analysis tool runner. Wraps ESLint, Semgrep, Bandit, Clippy, and language-specific analyzers with unified severity output. Use when deeper code analysis needed beyond pattern matching."
-metadata:
-  author: runedev
-  version: "1.0.0"
-  layer: L3
-  model: haiku
-  group: validation
-  tools: "Read, Bash, Glob, Grep"
----
-
-# sast
-
-## Purpose
-
-Unified static analysis tool runner. While `sentinel` does regex-based security pattern matching and `verification` runs lint/type/test/build, SAST goes deeper — running dedicated static analysis tools that understand data flow, taint tracking, and language-specific vulnerability patterns.
-
-Sentinel catches obvious patterns (hardcoded secrets, SQL string concat). SAST catches subtle ones (tainted data flowing through 3 function calls to a sink, unsafe deserialization behind a wrapper).
-
-## Triggers
-
-- Called by `sentinel` (L2) when deep analysis needed beyond pattern matching
-- Called by `audit` (L2) during security dimension assessment
-- Called by `cook` (L1) on security-sensitive code (auth, crypto, payments)
-- `/rune sast` — manual static analysis scan
-
-## Calls (outbound)
-
-None — pure runner using Bash for all tools.
-
-## Called By (inbound)
-
-- `sentinel` (L2): deep analysis beyond regex patterns
-- `audit` (L2): security dimension in full audit
-- `cook` (L1): security-sensitive code paths
-- `review` (L2): when security patterns detected in diff
-
-## Execution
-
-### Step 1 — Detect Language and Tools
-
-Use `Glob` to detect project language and available tools:
-
-| Indicator | Language | Primary Tool | Fallback |
-|---|---|---|---|
-| `package.json` | JavaScript/TypeScript | `npx eslint --ext .js,.ts,.tsx` | `npx oxlint` |
-| `tsconfig.json` | TypeScript | `npx tsc --noEmit` + ESLint | — |
-| `pyproject.toml` / `setup.py` | Python | `bandit -r . -f json` | `ruff check --select S .` |
-| `Cargo.toml` | Rust | `cargo clippy -- -D warnings` | `cargo audit` |
-| `go.mod` | Go | `govulncheck ./...` | `go vet ./...` |
-| `.semgrep.yml` / any | Any | `semgrep --config auto` | — |
-
-Check tool availability:
-```
-Bash: command -v <tool> 2>/dev/null
-→ If not installed: mark as SKIP with install instruction
-→ If installed: proceed with scan
-```
-
-### Step 2 — Run Primary Analysis
-
-Run the detected primary tool on changed files (or full project if no diff):
-
-```
-For each available tool:
-  Bash: <tool command> 2>&1
-  → Capture stdout + stderr
-  → Parse output into unified format (see Step 4)
-  → Record: exit code, finding count, execution time
-```
-
-**Tool-specific commands:**
-
-```bash
-# ESLint (JS/TS) — security-focused rules
-npx eslint --no-eslintrc --rule '{"no-eval": "error", "no-implied-eval": "error"}' <files>
-
-# Bandit (Python) — security scanner
-bandit -r <path> -f json -ll  # medium+ severity only
-
-# Semgrep (any language) — pattern-based analysis
-semgrep --config auto --json --severity ERROR --severity WARNING <path>
-
-# Clippy (Rust) — lint + security
-cargo clippy --all-targets -- -D warnings -W clippy::unwrap_used
-
-# govulncheck (Go) — vulnerability check
-govulncheck ./...
-```
-
-### Step 3 — Run Semgrep (If Available)
-
-Semgrep provides cross-language analysis with community rules. Run regardless of primary language tool:
-
-```
-IF semgrep is installed:
-  Bash: semgrep --config auto --json <changed-files-or-project>
-  → Parse JSON output
-  → Map severity: error→BLOCK, warning→WARN, info→INFO
-```
-
-If semgrep is NOT installed, log INFO: "semgrep not installed — install with `pip install semgrep` for deeper cross-language analysis."
-
-### Step 4 — Normalize to Unified Format
-
-Map all tool outputs to unified severity:
-
-```
-BLOCK (must fix):
-  - Bandit: HIGH confidence + HIGH severity
-  - ESLint: error-level security rules
-  - Semgrep: ERROR severity
-  - Clippy: deny-level warnings
-  - govulncheck: any known vulnerability
-
-WARN (should fix):
-  - Bandit: MEDIUM confidence or MEDIUM severity
-  - ESLint: warning-level rules
-  - Semgrep: WARNING severity
-  - Clippy: warn-level suggestions
-
-INFO (informational):
-  - Bandit: LOW severity
-  - Semgrep: INFO severity
-  - Style/convention suggestions
-```
-
-### Step 5 — Report
-
-```
-## SAST Report
-- **Status**: PASS | WARN | BLOCK
-- **Tools Run**: [list with versions]
-- **Tools Skipped**: [list with install instructions]
-- **Files Scanned**: [count]
-- **Findings**: [count by severity]
-
-### BLOCK (must fix)
-- `path/to/file.py:42` — [tool] Possible SQL injection via string formatting (B608)
-- `path/to/auth.ts:15` — [semgrep] JWT token not verified before use
-
-### WARN (should fix)
-- `path/to/utils.py:88` — [bandit] Use of `subprocess` with shell=True (B602)
-
-### INFO
-- `path/to/config.ts:10` — [eslint] Prefer `const` over `let` for unchanging variable
-
-### Tool Coverage
-| Tool | Status | Findings | Duration |
-|------|--------|----------|----------|
-| ESLint | RAN | 2 WARN | 1.2s |
-| Semgrep | SKIPPED | — | — (not installed) |
-| Bandit | N/A | — | — (not Python) |
-```
-
-## Output Format
-
-SAST Report with status (PASS/WARN/BLOCK), tools run, files scanned, findings by severity (BLOCK/WARN/INFO), and tool coverage table. See Step 5 Report above for full template.
-
-## Constraints
-
-1. MUST run all available tools for the detected language — not just one
-2. MUST attempt Semgrep regardless of primary language (if installed)
-3. MUST normalize all outputs to unified BLOCK/WARN/INFO — don't dump raw tool output
-4. MUST show install instructions for missing tools — not silently skip
-5. MUST report which tools ran and which were skipped — transparency
-6. MUST NOT block on missing tools — SKIP with instruction, not FAIL
-
-## Sharp Edges
-
-| Failure Mode | Severity | Mitigation |
-|---|---|---|
-| Tool not installed → entire scan skipped silently | HIGH | Constraint 4: show install instruction, continue with available tools |
-| Raw tool output dumped without normalization | MEDIUM | Step 4: always normalize to unified format |
-| Only running one tool when multiple apply | MEDIUM | Constraint 1: run ALL available tools for the language |
-| Semgrep community rules producing noise | LOW | Filter to ERROR+WARNING severity only — skip INFO-level Semgrep |
-| Long-running scan on large codebase | MEDIUM | Run on changed files only when diff available, full scan only on manual invocation |
-
-## Done When
-
-- Language detected from project config files
-- All available tools executed (or SKIP with install instruction)
-- Findings normalized to unified BLOCK/WARN/INFO format
-- Tool coverage table showing what ran and what was skipped
-- SAST Report emitted with overall verdict
-
-## Cost Profile
-
-~300-800 tokens input, ~200-500 tokens output. Haiku + Bash commands. Tool execution time varies (1-30s depending on project size).
+---
+name: sast
+description: "Static analysis tool runner. Wraps ESLint, Semgrep, Bandit, Clippy, and language-specific analyzers with unified severity output. Use when deeper code analysis needed beyond pattern matching."
+metadata:
+  author: runedev
+  version: "1.0.0"
+  layer: L3
+  model: haiku
+  group: validation
+  tools: "Read, Bash, Glob, Grep"
+---
+
+# sast
+
+## Purpose
+
+Unified static analysis tool runner. While `sentinel` does regex-based security pattern matching and `verification` runs lint/type/test/build, SAST goes deeper — running dedicated static analysis tools that understand data flow, taint tracking, and language-specific vulnerability patterns.
+
+Sentinel catches obvious patterns (hardcoded secrets, SQL string concat). SAST catches subtle ones (tainted data flowing through 3 function calls to a sink, unsafe deserialization behind a wrapper).
+
+## Triggers
+
+- Called by `sentinel` (L2) when deep analysis needed beyond pattern matching
+- Called by `audit` (L2) during security dimension assessment
+- Called by `cook` (L1) on security-sensitive code (auth, crypto, payments)
+- `/rune sast` — manual static analysis scan
+
+## Calls (outbound)
+
+None — pure runner using Bash for all tools.
+
+## Called By (inbound)
+
+- `sentinel` (L2): deep analysis beyond regex patterns
+- `audit` (L2): security dimension in full audit
+- `cook` (L1): security-sensitive code paths
+- `review` (L2): when security patterns detected in diff
+
+## Execution
+
+### Step 1 — Detect Language and Tools
+
+Use `Glob` to detect project language and available tools:
+
+| Indicator | Language | Primary Tool | Fallback |
+|---|---|---|---|
+| `package.json` | JavaScript/TypeScript | `npx eslint --ext .js,.ts,.tsx` | `npx oxlint` |
+| `tsconfig.json` | TypeScript | `npx tsc --noEmit` + ESLint | — |
+| `pyproject.toml` / `setup.py` | Python | `bandit -r . -f json` | `ruff check --select S .` |
+| `Cargo.toml` | Rust | `cargo clippy -- -D warnings` | `cargo audit` |
+| `go.mod` | Go | `govulncheck ./...` | `go vet ./...` |
+| `.semgrep.yml` / any | Any | `semgrep --config auto` | — |
+
+Check tool availability:
+```
+Bash: command -v <tool> 2>/dev/null
+→ If not installed: mark as SKIP with install instruction
+→ If installed: proceed with scan
+```
+
+### Step 2 — Run Primary Analysis
+
+Run the detected primary tool on changed files (or full project if no diff):
+
+```
+For each available tool:
+  Bash: <tool command> 2>&1
+  → Capture stdout + stderr
+  → Parse output into unified format (see Step 4)
+  → Record: exit code, finding count, execution time
+```
+
+**Tool-specific commands:**
+
+```bash
+# ESLint (JS/TS) — security-focused rules
+npx eslint --no-eslintrc --rule '{"no-eval": "error", "no-implied-eval": "error"}' <files>
+
+# Bandit (Python) — security scanner
+bandit -r <path> -f json -ll  # medium+ severity only
+
+# Semgrep (any language) — pattern-based analysis
+semgrep --config auto --json --severity ERROR --severity WARNING <path>
+
+# Clippy (Rust) — lint + security
+cargo clippy --all-targets -- -D warnings -W clippy::unwrap_used
+
+# govulncheck (Go) — vulnerability check
+govulncheck ./...
+```
+
+### Step 3 — Run Semgrep (If Available)
+
+Semgrep provides cross-language analysis with community rules. Run regardless of primary language tool:
+
+```
+IF semgrep is installed:
+  Bash: semgrep --config auto --json <changed-files-or-project>
+  → Parse JSON output
+  → Map severity: error→BLOCK, warning→WARN, info→INFO
+```
+
+If semgrep is NOT installed, log INFO: "semgrep not installed — install with `pip install semgrep` for deeper cross-language analysis."
+
+### Step 4 — Normalize to Unified Format
+
+Map all tool outputs to unified severity:
+
+```
+BLOCK (must fix):
+  - Bandit: HIGH confidence + HIGH severity
+  - ESLint: error-level security rules
+  - Semgrep: ERROR severity
+  - Clippy: deny-level warnings
+  - govulncheck: any known vulnerability
+
+WARN (should fix):
+  - Bandit: MEDIUM confidence or MEDIUM severity
+  - ESLint: warning-level rules
+  - Semgrep: WARNING severity
+  - Clippy: warn-level suggestions
+
+INFO (informational):
+  - Bandit: LOW severity
+  - Semgrep: INFO severity
+  - Style/convention suggestions
+```
+
+### Step 5 — Report
+
+```
+## SAST Report
+- **Status**: PASS | WARN | BLOCK
+- **Tools Run**: [list with versions]
+- **Tools Skipped**: [list with install instructions]
+- **Files Scanned**: [count]
+- **Findings**: [count by severity]
+
+### BLOCK (must fix)
+- `path/to/file.py:42` — [tool] Possible SQL injection via string formatting (B608)
+- `path/to/auth.ts:15` — [semgrep] JWT token not verified before use
+
+### WARN (should fix)
+- `path/to/utils.py:88` — [bandit] Use of `subprocess` with shell=True (B602)
+
+### INFO
+- `path/to/config.ts:10` — [eslint] Prefer `const` over `let` for unchanging variable
+
+### Tool Coverage
+| Tool | Status | Findings | Duration |
+|------|--------|----------|----------|
+| ESLint | RAN | 2 WARN | 1.2s |
+| Semgrep | SKIPPED | — | — (not installed) |
+| Bandit | N/A | — | — (not Python) |
+```
+
+## Output Format
+
+SAST Report with status (PASS/WARN/BLOCK), tools run, files scanned, findings by severity (BLOCK/WARN/INFO), and tool coverage table. See Step 5 Report above for full template.
+
+## Constraints
+
+1. MUST run all available tools for the detected language — not just one
+2. MUST attempt Semgrep regardless of primary language (if installed)
+3. MUST normalize all outputs to unified BLOCK/WARN/INFO — don't dump raw tool output
+4. MUST show install instructions for missing tools — not silently skip
+5. MUST report which tools ran and which were skipped — transparency
+6. MUST NOT block on missing tools — SKIP with instruction, not FAIL
+
+## Sharp Edges
+
+| Failure Mode | Severity | Mitigation |
+|---|---|---|
+| Tool not installed → entire scan skipped silently | HIGH | Constraint 4: show install instruction, continue with available tools |
+| Raw tool output dumped without normalization | MEDIUM | Step 4: always normalize to unified format |
+| Only running one tool when multiple apply | MEDIUM | Constraint 1: run ALL available tools for the language |
+| Semgrep community rules producing noise | LOW | Filter to ERROR+WARNING severity only — skip INFO-level Semgrep |
+| Long-running scan on large codebase | MEDIUM | Run on changed files only when diff available, full scan only on manual invocation |
+
+## Done When
+
+- Language detected from project config files
+- All available tools executed (or SKIP with install instruction)
+- Findings normalized to unified BLOCK/WARN/INFO format
+- Tool coverage table showing what ran and what was skipped
+- SAST Report emitted with overall verdict
+
+## Cost Profile
+
+~300-800 tokens input, ~200-500 tokens output. Haiku + Bash commands. Tool execution time varies (1-30s depending on project size).