@skaleagents/swarm 0.6.11 → 0.6.13

package/dist/iac/parse.d.ts

@@ -1,4 +1,4 @@
-export type IacFormat = "terraform" | "cloudformation" | "kubernetes" | "pulumi" | "compose" | "dockerfile" | "github" | "helm" | "ansible" | "bicep" | "arm";
+export type IacFormat = "terraform" | "cloudformation" | "kubernetes" | "pulumi" | "compose" | "dockerfile" | "github" | "helm" | "ansible" | "bicep" | "arm" | "gitlab" | "azure-pipelines" | "cloudbuild" | "tfvars" | "serverless" | "iam";
 export type Path = (string | number)[];
 export type Location = {
     line: number;
@@ -33,3 +33,5 @@ export declare function looksLikeBicep(content: string): boolean;
 export declare function looksLikeArm(content: string): boolean;
 export declare function looksLikePulumiYaml(content: string): boolean;
 export declare function parseIac(content: string, requested?: IacFormat | "auto"): ParsedIac;
+export declare function looksLikeServerless(content: string): boolean;
+export declare function looksLikeIamPolicy(content: string): boolean;

package/dist/iac/parse.js

@@ -30,6 +30,8 @@ export function looksLikeIac(content) {
             const value = object(JSON.parse(content));
             if (value.resource || value.Resources || (value.apiVersion && value.kind))
                 return true;
+            if (looksLikeIamPolicy(content))
+                return true;
         }
         catch {
             /* Other format detection still applies to incomplete input. */
@@ -46,7 +48,11 @@ export function looksLikeIac(content) {
         looksLikeHelm(content) ||
         looksLikeAnsible(content) ||
         looksLikeBicep(content) ||
-        looksLikeArm(content));
+        looksLikeArm(content) ||
+        looksLikePipeline(content) !== undefined ||
+        looksLikeTfvars(content) ||
+        looksLikeServerless(content) ||
+        looksLikeIamPolicy(content));
 }
 export function looksLikePulumiProgram(content) {
     return /(?:^|\n)\s*(?:import\s+\*\s+as\s+pulumi\b|import\s+pulumi\b|from\s+["']@pulumi\/)/.test(content);
@@ -133,6 +139,7 @@ export function looksLikePulumiYaml(content) {
     return (/^\s*resources\s*:/m.test(content) &&
         /^\s+type\s*:\s*[A-Za-z0-9_.-]+:\S+/m.test(content));
 }
+const terraformExpressionWarning = "Terraform expressions are not evaluated. Findings use literal values and declared settings.";
 export function parseIac(content, requested = "auto") {
     if (!content.trim())
         throw new ScanInputError("Content must not be empty or whitespace.");
@@ -154,6 +161,28 @@ export function parseIac(content, requested = "auto") {
         (requested === "auto" && looksLikeHelm(content))) {
         return parseHelm(content);
     }
+    if (requested === "serverless" ||
+        (requested === "auto" && looksLikeServerless(content))) {
+        return parseServerless(content);
+    }
+    if (requested === "iam" ||
+        (requested === "auto" && looksLikeIamPolicy(content))) {
+        return parseIamPolicy(content);
+    }
+    const pipeline = requested === "gitlab" ||
+        requested === "azure-pipelines" ||
+        requested === "cloudbuild"
+        ? requested
+        : requested === "auto"
+            ? looksLikePipeline(content)
+            : undefined;
+    if (pipeline) {
+        if (!pipelineMatches(content, pipeline))
+            throw new ScanInputError(pipelineShapeError(pipeline));
+        return parsePipeline(content, pipeline);
+    }
+    if (requested === "tfvars")
+        return parseTfvars(content);
     if (requested === "bicep" || (requested === "auto" && looksLikeBicep(content))) {
         if (!looksLikeBicep(content))
             throw new ScanInputError("A Bicep file requires a Microsoft resource declaration.");
@@ -206,14 +235,70 @@ export function parseIac(content, requested = "auto") {
                 });
             }
         }
+        for (const [name, blocks] of Object.entries(object(object(data).module))) {
+            const declaration = new RegExp(`\\bmodule\\s+"${escapeRegex(name)}"`).exec(searchable);
+            const offset = declaration?.index ?? 0;
+            const before = content.slice(0, offset);
+            resources.push({
+                id: `module.${name}`,
+                type: "terraform:module",
+                value: object(array(blocks)[0]),
+                locate: (path = []) => ({
+                    line: before.split("\n").length,
+                    column: offset - before.lastIndexOf("\n"),
+                    path: ["module", name, ...path].join("."),
+                }),
+            });
+        }
+        for (const [name, blocks] of Object.entries(object(object(data).variable))) {
+            const body = object(array(blocks)[0]);
+            if (!("default" in body))
+                continue;
+            const declaration = new RegExp(`\\bvariable\\s+"${escapeRegex(name)}"`).exec(searchable);
+            const offset = declaration?.index ?? 0;
+            const before = content.slice(0, offset);
+            resources.push({
+                id: `variable.${name}`,
+                type: "terraform:variable",
+                value: { name, default: body.default },
+                locate: (path = []) => ({
+                    line: before.split("\n").length,
+                    column: offset - before.lastIndexOf("\n"),
+                    path: ["variable", name, ...path].join("."),
+                }),
+            });
+        }
         if (object(data).module)
-            warnings.push("External Terraform modules are not expanded. Scan their source separately.");
+            warnings.push("External modules are not expanded. The module body was not loaded, and the module source is not fetched or evaluated.");
+        const localBlocks = terraformLocalBlocks(data);
+        const localDeclarations = [
+            ...searchable.matchAll(/\blocals\s*(?:"[^"]+"\s*)?\{/g),
+        ];
+        localBlocks.forEach((block, index) => {
+            const offset = localDeclarations[index]?.index ?? 0;
+            const before = content.slice(0, offset);
+            resources.push({
+                id: `locals.${index + 1}`,
+                type: "terraform:local",
+                value: block,
+                locate: (path = []) => ({
+                    line: before.split("\n").length,
+                    column: offset - before.lastIndexOf("\n"),
+                    path: ["locals", index, ...path].join("."),
+                }),
+            });
+        });
         if (JSON.stringify(data).includes("${"))
-            warnings.push("Terraform expressions are not evaluated. Findings use literal values and declared settings.");
-        if (!resources.length)
-            warnings.push("No resource declarations found. Variables, data sources, and outputs are not scanned as resources.");
+            warnings.push(terraformExpressionWarning);
+        if (localBlocks.length > 0 &&
+            !warnings.some((warning) => warning.includes("expressions are not evaluated")))
+            warnings.push(terraformExpressionWarning);
+        if (!resources.some((item) => item.type !== "terraform:module" && item.type !== "terraform:variable"))
+            warnings.push("No resource declarations found. Data sources and outputs are not scanned as resources.");
         return { format: "terraform", resources, warnings };
     }
+    if (requested === "auto" && looksLikeTfvars(content))
+        return parseTfvars(content);
     const lines = new LineCounter();
     const tags = [
         "Ref",
@@ -379,7 +464,7 @@ export function parseIac(content, requested = "auto") {
         }
     }
     if (!format)
-        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, Pulumi, Docker Compose, a Dockerfile, a GitHub Actions workflow, a Helm template, an Ansible playbook, Bicep, or an ARM template.");
+        throw new ScanInputError("No IaC document found. Choose Terraform, CloudFormation, Kubernetes, Pulumi, Docker Compose, a Dockerfile, a GitHub Actions workflow, a Helm template, an Ansible playbook, Bicep, an ARM template, Serverless Framework, or a standalone IAM policy.");
     if (!resources.length)
         warnings.push("No resources found in the submitted document.");
     if (/(?:!(?:Ref|Sub|GetAtt|If)\b|"(?:Ref|Fn::\w+)"\s*:|\$\{)/.test(content))
@@ -616,6 +701,254 @@ function workflowEnvIsLiteral(value) {
 function lineLocation(line, path) {
     return { line, column: 1, path };
 }
+function stolenPipelineInput(content) {
+    return (looksLikeGithubWorkflow(content) ||
+        looksLikeAnsible(content) ||
+        looksLikeHelm(content) ||
+        (topLevelKey(content, "apiVersion") && topLevelKey(content, "kind")));
+}
+function azurePipelineShape(content) {
+    const poolOrTrigger = topLevelKey(content, "pool") || topLevelKey(content, "trigger");
+    const stepsOrStages = topLevelKey(content, "steps") || topLevelKey(content, "stages");
+    return poolOrTrigger && stepsOrStages;
+}
+function gitlabShape(content) {
+    if (!/\bimage\s*:/.test(content))
+        return false;
+    if (topLevelKey(content, "stages"))
+        return true;
+    return /^\s*script\s*:/m.test(content);
+}
+function cloudBuildShape(content) {
+    if (!topLevelKey(content, "steps"))
+        return false;
+    if (topLevelKey(content, "on") && topLevelKey(content, "jobs"))
+        return false;
+    return /^\s*-\s*name\s*:/m.test(content);
+}
+function looksLikePipeline(content) {
+    if (stolenPipelineInput(content) || looksLikeServerless(content))
+        return undefined;
+    const visible = maskIaCComments(content);
+    if (azurePipelineShape(visible))
+        return "azure-pipelines";
+    if (gitlabShape(visible))
+        return "gitlab";
+    if (cloudBuildShape(visible))
+        return "cloudbuild";
+    return undefined;
+}
+function pipelineMatches(content, format) {
+    if (stolenPipelineInput(content))
+        return false;
+    const visible = maskIaCComments(content);
+    if (format === "azure-pipelines")
+        return azurePipelineShape(visible);
+    if (format === "gitlab")
+        return gitlabShape(visible);
+    return cloudBuildShape(visible);
+}
+function pipelineShapeError(format) {
+    if (format === "gitlab")
+        return "GitLab CI requires top-level stages or a job with script, and an image.";
+    if (format === "azure-pipelines")
+        return "Azure Pipelines requires a top-level pool or trigger, plus steps or stages.";
+    return "Cloud Build requires top-level steps whose items have a name.";
+}
+const pipelineWarning = "The pipeline is not executed. Only literal text outside comments is checked.";
+function scriptText(value) {
+    if (typeof value === "string")
+        return value;
+    if (Array.isArray(value) && value.every((item) => typeof item === "string"))
+        return value.join("\n");
+    return undefined;
+}
+function pipelineScriptKey(key) {
+    return (key === "script" ||
+        key === "before_script" ||
+        key === "after_script" ||
+        key === "bash" ||
+        key === "pwsh" ||
+        key === "powershell");
+}
+function pipelinePrintsSecret(script) {
+    return script.split(/\n/).some((line) => {
+        const code = line.replace(/(^|\s)#.*$/, "").trim();
+        if (!/\b(?:echo|printf|print)\b/i.test(code))
+            return false;
+        return /CI_JOB_TOKEN|secrets\.|\$\(secret|(?:^|[^A-Za-z0-9_])(?:password|passwd|api_key|apikey|auth_token|access_key|private_key|token)(?:[^A-Za-z0-9_]|$)/i.test(code);
+    });
+}
+function collectPipelineHits(value, path, format, hits) {
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => collectPipelineHits(item, [...path, index], format, hits));
+        return;
+    }
+    if (value === null || typeof value !== "object")
+        return;
+    for (const [key, child] of Object.entries(object(value))) {
+        const childPath = [...path, key];
+        if ((key === "image" || key === "container") && typeof child === "string")
+            hits.push({ kind: "image", path: childPath, image: child });
+        else if (key === "image" &&
+            typeof object(child).name === "string")
+            hits.push({
+                kind: "image",
+                path: [...childPath, "name"],
+                image: String(object(child).name),
+            });
+        if (key === "privileged" && child === true)
+            hits.push({ kind: "privileged", path: childPath });
+        const script = pipelineScriptKey(key) ? scriptText(child) : undefined;
+        if (script)
+            hits.push({ kind: "script", path: childPath, script });
+        if (format === "cloudbuild" && key === "steps" && Array.isArray(child)) {
+            child.forEach((step, index) => {
+                const name = object(step).name;
+                if (typeof name === "string")
+                    hits.push({
+                        kind: "image",
+                        path: [...childPath, index, "name"],
+                        image: name,
+                    });
+                const args = scriptText(object(step).args);
+                if (args)
+                    hits.push({
+                        kind: "script",
+                        path: [...childPath, index, "args"],
+                        script: args,
+                    });
+            });
+        }
+        collectPipelineHits(child, childPath, format, hits);
+    }
+}
+function parsePipeline(content, format) {
+    const lines = new LineCounter();
+    let documents;
+    try {
+        documents = parseAllDocuments(content, {
+            lineCounter: lines,
+            prettyErrors: false,
+        });
+    }
+    catch {
+        throw new ScanInputError(pipelineShapeError(format));
+    }
+    const resources = [];
+    let found = false;
+    for (const [documentIndex, doc] of documents.entries()) {
+        if (doc.errors.length)
+            throw new ScanInputError(pipelineShapeError(format));
+        let data;
+        try {
+            data = doc.toJS({ maxAliasCount: 0 });
+        }
+        catch {
+            throw new ScanInputError("YAML aliases are not supported. Expand anchors before scanning.");
+        }
+        if (data == null)
+            continue;
+        checkShape(data);
+        found = true;
+        const hits = [];
+        collectPipelineHits(data, [], format, hits);
+        const position = (path) => {
+            let node = doc.getIn(path, true);
+            if (!node?.range)
+                node = doc.getIn([], true);
+            const at = lines.linePos(node?.range?.[0] ?? doc.range?.[0] ?? 0);
+            return {
+                line: at.line,
+                column: at.col,
+                path: [documentIndex, ...path].join("."),
+            };
+        };
+        hits.forEach((hit, index) => {
+            if (hit.kind === "image" && hit.image)
+                resources.push({
+                    id: `pipeline.image.${index + 1}`,
+                    type: "pipeline:image",
+                    value: { unpinned: imageIsUnpinned(hit.image.trim(), new Set()) },
+                    locate: () => position(hit.path),
+                });
+            else if (hit.kind === "script" && hit.script)
+                resources.push({
+                    id: `pipeline.script.${index + 1}`,
+                    type: "pipeline:script",
+                    value: { printsSecret: pipelinePrintsSecret(hit.script) },
+                    locate: () => position(hit.path),
+                });
+            else if (hit.kind === "privileged")
+                resources.push({
+                    id: `pipeline.privileged.${index + 1}`,
+                    type: "pipeline:privileged",
+                    value: { present: true },
+                    locate: () => position(hit.path),
+                });
+        });
+    }
+    if (!found)
+        throw new ScanInputError(pipelineShapeError(format));
+    return { format, resources, warnings: [pipelineWarning] };
+}
+function looksLikeTfvars(content) {
+    const visible = maskIaCComments(content);
+    if (/^\s*(?:resource|module|provider)\s+["']/m.test(visible))
+        return false;
+    if (/^\s*(?:terraform|provider|module)\s*\{/m.test(visible))
+        return false;
+    return /^\s*[A-Za-z_][A-Za-z0-9_]*\s*=\s*\S/m.test(visible);
+}
+function parseTfvars(content) {
+    let data;
+    try {
+        const [parsed, error] = hcl.parseToObject(content);
+        if (error || !parsed)
+            throw new Error("parse");
+        data = parsed;
+    }
+    catch {
+        throw new ScanInputError("Invalid tfvars. Check assignment syntax.");
+    }
+    checkShape(data);
+    const searchable = maskIaCComments(content);
+    const resources = [];
+    const skipped = new Set([
+        "resource",
+        "module",
+        "terraform",
+        "provider",
+        "variable",
+        "data",
+        "output",
+        "locals",
+    ]);
+    for (const [name, value] of Object.entries(object(data))) {
+        if (skipped.has(name))
+            continue;
+        const declaration = new RegExp(`(^|\\n)\\s*${escapeRegex(name)}\\s*=`).exec(searchable);
+        const offset = declaration?.index ?? 0;
+        const before = content.slice(0, offset);
+        resources.push({
+            id: `tfvars.${name}`,
+            type: "tfvars:assignment",
+            value: { name, value },
+            locate: (path = []) => ({
+                line: before.split("\n").length,
+                column: 1,
+                path: ["tfvars", name, ...path].join("."),
+            }),
+        });
+    }
+    return {
+        format: "tfvars",
+        resources,
+        warnings: [
+            "Terraform variable references are not evaluated. Findings use literal values.",
+        ],
+    };
+}
 function parseDockerfile(content) {
     const instructions = logicalDockerfileLines(content);
     const froms = instructions.flatMap((instruction) => {
@@ -1070,3 +1403,229 @@ function parseAzure(content, format) {
         warnings: [azureExpressionWarning],
     };
 }
+function terraformLocalBlocks(data) {
+    const raw = object(data).locals;
+    if (Array.isArray(raw))
+        return raw.map((block) => object(block));
+    if (raw && typeof raw === "object") {
+        return Object.values(object(raw)).flatMap((blocks) => array(blocks).map((block) => object(block)));
+    }
+    return [];
+}
+export function looksLikeServerless(content) {
+    if (looksLikeGithubWorkflow(content) || looksLikeCompose(content))
+        return false;
+    if (topLevelKey(content, "apiVersion") && topLevelKey(content, "kind"))
+        return false;
+    if (!topLevelKey(content, "service") || !topLevelKey(content, "provider"))
+        return false;
+    return topLevelKey(content, "functions") || topLevelKey(content, "plugins");
+}
+export function looksLikeIamPolicy(content) {
+    const trimmed = content.trim();
+    if (!trimmed.startsWith("{"))
+        return false;
+    let value;
+    try {
+        value = JSON.parse(trimmed);
+    }
+    catch {
+        return false;
+    }
+    const root = object(value);
+    if (typeof root.AWSTemplateFormatVersion === "string")
+        return false;
+    if ("resource" in root)
+        return false;
+    const version = root.Version ?? root.version;
+    if (typeof version !== "string" || !version.includes("2012-10-17"))
+        return false;
+    const statement = root.Statement ?? root.statement;
+    return Array.isArray(statement);
+}
+const serverlessWarning = "The Serverless Framework config is not executed. Conditions are not evaluated.";
+const iamPolicyWarning = "The IAM policy is not executed. Conditions are not evaluated.";
+function serverlessShapeError() {
+    return "Serverless Framework config requires top-level service and provider, plus functions or plugins.";
+}
+function iamShapeError() {
+    return "An IAM policy requires Version 2012-10-17 and a Statement array.";
+}
+function effectAllows(body) {
+    const effect = body.Effect ?? body.effect;
+    if (effect == null || String(effect).trim() === "")
+        return true;
+    return String(effect).trim().toLowerCase() === "allow";
+}
+function actionIsOnlyWildcard(body) {
+    const action = body.Action ?? body.action ?? body.actions ?? body.Actions;
+    if (typeof action === "string")
+        return action.trim() === "*";
+    return (Array.isArray(action) &&
+        action.length > 0 &&
+        action.every((item) => typeof item === "string" && item.trim() === "*"));
+}
+function serverlessReference(value) {
+    return /^\$\{[\s\S]+\}$/.test(value.trim());
+}
+function yamlLocation(doc, lines, path) {
+    const node = doc.getIn(path, true);
+    const position = lines.linePos(node?.range?.[0] ?? doc.range?.[0] ?? 0);
+    return {
+        line: position.line,
+        column: position.col,
+        path: path.join("."),
+    };
+}
+function statementGroups(root) {
+    const groups = [];
+    const seen = new Set();
+    const add = (statements, path) => {
+        if (!Array.isArray(statements) || seen.has(statements))
+            return;
+        seen.add(statements);
+        groups.push({ path, statements });
+    };
+    const provider = object(root.provider);
+    add(provider.iamRoleStatements, ["provider", "iamRoleStatements"]);
+    add(root.iamRoleStatements, ["iamRoleStatements"]);
+    add(object(object(provider.iam).role).statements, ["provider", "iam", "role", "statements"]);
+    add(object(object(root.iam).role).statements, ["iam", "role", "statements"]);
+    if (Array.isArray(provider.iam))
+        add(provider.iam, ["provider", "iam"]);
+    else
+        add(object(provider.iam).statements, ["provider", "iam", "statements"]);
+    return groups;
+}
+function parseServerless(content) {
+    if (!looksLikeServerless(content))
+        throw new ScanInputError(serverlessShapeError());
+    const lines = new LineCounter();
+    let documents;
+    try {
+        documents = parseAllDocuments(content, {
+            lineCounter: lines,
+            prettyErrors: false,
+        });
+    }
+    catch {
+        throw new ScanInputError(serverlessShapeError());
+    }
+    const doc = documents.find((item) => item.toJS() != null);
+    if (!doc || doc.errors.length)
+        throw new ScanInputError(serverlessShapeError());
+    let data;
+    try {
+        data = doc.toJS({ maxAliasCount: 0 });
+    }
+    catch {
+        throw new ScanInputError("YAML aliases are not supported. Expand anchors before scanning.");
+    }
+    const root = object(data);
+    if (root.service == null ||
+        root.provider == null ||
+        (root.functions == null && root.plugins == null))
+        throw new ScanInputError(serverlessShapeError());
+    const resources = [];
+    let iamCount = 0;
+    for (const group of statementGroups(root)) {
+        group.statements.forEach((statement, index) => {
+            const body = object(statement);
+            if (!effectAllows(body) || !actionIsOnlyWildcard(body))
+                return;
+            iamCount += 1;
+            const path = [...group.path, index, "Action"];
+            resources.push({
+                id: `serverless.iam.${iamCount}`,
+                type: "serverless:iam",
+                value: { wildcard: true },
+                locate: () => yamlLocation(doc, lines, path),
+            });
+        });
+    }
+    if (iamCount === 0) {
+        resources.push({
+            id: "serverless.iam",
+            type: "serverless:iam",
+            value: { wildcard: false },
+            locate: () => yamlLocation(doc, lines, ["provider", "iamRoleStatements"]),
+        });
+    }
+    const envHits = [];
+    for (const [key, value] of Object.entries(object(object(root.provider).environment))) {
+        if (secretVariableName(key))
+            envHits.push({ path: ["provider", "environment", key], key, value });
+    }
+    for (const [name, raw] of Object.entries(object(root.functions))) {
+        for (const [key, value] of Object.entries(object(object(raw).environment))) {
+            if (secretVariableName(key))
+                envHits.push({ path: ["functions", name, "environment", key], key, value });
+        }
+    }
+    if (envHits.length === 0) {
+        resources.push({
+            id: "serverless.environment",
+            type: "serverless:env",
+            value: { literal: false },
+            locate: () => yamlLocation(doc, lines, ["provider", "environment"]),
+        });
+    }
+    else {
+        envHits.forEach((hit, index) => {
+            const literal = typeof hit.value === "string" &&
+                hit.value.trim() !== "" &&
+                !serverlessReference(hit.value);
+            resources.push({
+                id: `serverless.env.${index + 1}`,
+                type: "serverless:env",
+                value: { literal },
+                locate: () => yamlLocation(doc, lines, hit.path),
+            });
+        });
+    }
+    return { format: "serverless", resources, warnings: [serverlessWarning] };
+}
+function parseIamPolicy(content) {
+    if (!looksLikeIamPolicy(content))
+        throw new ScanInputError(iamShapeError());
+    let root;
+    try {
+        root = object(JSON.parse(content));
+    }
+    catch {
+        throw new ScanInputError(iamShapeError());
+    }
+    const statements = array(root.Statement ?? root.statement);
+    const resources = [];
+    statements.forEach((statement, index) => {
+        const body = object(statement);
+        if (!effectAllows(body) || !actionIsOnlyWildcard(body))
+            return;
+        const line = iamStatementLine(content, index);
+        resources.push({
+            id: `iam.statement.${index + 1}`,
+            type: "iam:statement",
+            value: { wildcard: true },
+            locate: () => lineLocation(line, `Statement.${index}.Action`),
+        });
+    });
+    if (!resources.length) {
+        resources.push({
+            id: "iam.policy",
+            type: "iam:statement",
+            value: { wildcard: false },
+            locate: () => lineLocation(1, "Statement"),
+        });
+    }
+    return { format: "iam", resources, warnings: [iamPolicyWarning] };
+}
+function iamStatementLine(content, index) {
+    const matches = [...content.matchAll(/"Statement"\s*:/g)];
+    const start = matches[0]?.index ?? 0;
+    const region = content.slice(start);
+    const actions = [...region.matchAll(/"Action"\s*:/g)];
+    const action = actions[index];
+    if (!action || action.index == null)
+        return lineAt(content, start);
+    return lineAt(content, start + action.index);
+}

package/dist/iac/rules.js

@@ -323,6 +323,48 @@ export const rules = {
         detail: "A cidr or source allows 0.0.0.0/0.",
         remediation: "Restrict the cidr or source to approved addresses.",
     },
+    PIPE001: {
+        category: "security",
+        severity: "medium",
+        title: "Unpinned container image",
+        detail: "An image or step name uses the latest tag, or it has no tag and no digest.",
+        remediation: "Pin a release tag or an image digest.",
+    },
+    PIPE002: {
+        category: "security",
+        severity: "high",
+        title: "Pipeline prints a secret",
+        detail: "A script line echoes or prints a secret-like variable.",
+        remediation: "Remove the printed secret from the script. Pass secrets through a variable the script does not print.",
+    },
+    PIPE003: {
+        category: "security",
+        severity: "critical",
+        title: "Elevated container privileges",
+        detail: "The pipeline sets privileged to true.",
+        remediation: "Set privileged to false. Isolate workloads that genuinely require elevated privileges.",
+    },
+    TF001: {
+        category: "security",
+        severity: "high",
+        title: "Secret assigned in a Terraform variable",
+        detail: "A Terraform variable default or tfvars assignment gives a non-empty literal to a secret-like name.",
+        remediation: "Pass the value from a secret store or leave the default empty. Do not commit a literal secret.",
+    },
+    TF002: {
+        category: "security",
+        severity: "high",
+        title: "Secret assigned in a Terraform local",
+        detail: "A Terraform local assigns a non-empty literal to a secret-like name.",
+        remediation: "Pass the value from a secret store or a variable reference. Do not commit a literal secret in locals.",
+    },
+    SLS001: {
+        category: "security",
+        severity: "high",
+        title: "Secret assigned in serverless environment",
+        detail: "A Serverless Framework environment entry assigns a non-empty literal to a secret-like name.",
+        remediation: "Reference the value with a Serverless variable such as ${env:TOKEN}. Do not commit a literal secret.",
+    },
 };
 export function resourceFindings(resources, format) {
     const findings = [];
@@ -358,6 +400,36 @@ export function resourceFindings(resources, format) {
             checkAzure(resource, check);
             continue;
         }
+        if (format === "gitlab" ||
+            format === "azure-pipelines" ||
+            format === "cloudbuild") {
+            checkPipeline(resource, check);
+            continue;
+        }
+        if (format === "serverless") {
+            checkServerless(resource, check);
+            continue;
+        }
+        if (format === "iam") {
+            check("IAM001", resource.value.wildcard === true, ["Action"]);
+            continue;
+        }
+        if (resource.type === "terraform:local") {
+            checkTerraformLiterals(resource.value, "local", check, []);
+            continue;
+        }
+        if (resource.type === "terraform:module") {
+            checkTerraformLiterals(resource.value, "module", check, []);
+            continue;
+        }
+        if (resource.type === "terraform:variable") {
+            checkTerraformLiterals({ [String(resource.value.name ?? "default")]: resource.value.default }, "assignment", check, ["default"]);
+            continue;
+        }
+        if (format === "tfvars" || resource.type === "tfvars:assignment") {
+            checkTerraformLiterals({ [String(resource.value.name ?? "value")]: resource.value.value }, "assignment", check, []);
+            continue;
+        }
         walk(resource.value, (key, value, path, parent) => {
             if (typeof value !== "string")
                 return;
@@ -419,6 +491,58 @@ function checkAnsible(resource, check) {
     else if (resource.type === "ansible:cidr")
         check("ANS002", resource.value.present === true, ["cidr"]);
 }
+function checkPipeline(resource, check) {
+    if (resource.type === "pipeline:image")
+        check("PIPE001", resource.value.unpinned === true, ["image"]);
+    else if (resource.type === "pipeline:script")
+        check("PIPE002", resource.value.printsSecret === true, ["script"]);
+    else if (resource.type === "pipeline:privileged")
+        check("PIPE003", resource.value.present === true, ["privileged"]);
+}
+function checkServerless(resource, check) {
+    if (resource.type === "serverless:iam")
+        check("IAM001", resource.value.wildcard === true, ["Action"]);
+    else if (resource.type === "serverless:env")
+        check("SLS001", resource.value.literal === true, ["environment"]);
+}
+function terraformReference(value) {
+    const trimmed = value.trim();
+    return trimmed.includes("${") || /^var\./.test(trimmed);
+}
+function secretAssignmentName(name) {
+    const normalized = name.replace(/-/g, "_");
+    return (/(?:^|_)(?:password|passwd|secret|token)$/i.test(normalized) ||
+        /(?:^|_)(?:api_?key|auth_token|access_key|private_key)$/i.test(normalized));
+}
+function moduleCidrExempt(name) {
+    const normalized = name.trim().toLowerCase().replace(/[\s-]+/g, "_");
+    return (normalized === "egress" ||
+        normalized === "destination" ||
+        normalized === "ipv6_egress");
+}
+function checkTerraformLiterals(value, mode, check, path, name = "") {
+    if (typeof value === "string" || typeof value === "boolean") {
+        const open = value === "0.0.0.0/0" || value === "::/0";
+        const exempt = mode === "assignment" ? name.toLowerCase() === "egress" : moduleCidrExempt(name);
+        if (typeof value === "string")
+            check("NET001", open && name !== "" && !exempt, path);
+        if (name === "publicly_accessible")
+            check("DB001", value === true, path);
+        if (mode === "assignment" && typeof value === "string" && secretAssignmentName(name))
+            check("TF001", value.trim() !== "" && !terraformReference(value), path);
+        if (mode === "local" && typeof value === "string" && secretAssignmentName(name))
+            check("TF002", value.trim() !== "" && !terraformReference(value), path);
+        return;
+    }
+    if (Array.isArray(value)) {
+        value.forEach((item, index) => checkTerraformLiterals(item, mode, check, [...path, index], name));
+        return;
+    }
+    if (value && typeof value === "object") {
+        for (const [key, child] of Object.entries(value))
+            checkTerraformLiterals(child, mode, check, [...path, key], key);
+    }
+}
 function checkAzure(resource, check) {
     if (resource.type === "azure:exposure")
         check("AZ001", resource.value.present === true, ["sourceAddressPrefix"]);

package/dist/server.js

@@ -79,12 +79,18 @@ export function createServer(remote = false) {
                 "ansible",
                 "bicep",
                 "arm",
+                "gitlab",
+                "azure-pipelines",
+                "cloudbuild",
+                "tfvars",
+                "serverless",
+                "iam",
                 "application",
                 "auto",
             ])
                 .optional()
                 .default("auto")
-                .describe("Content format: terraform, cloudformation, kubernetes, pulumi, compose, dockerfile, github, helm, ansible, bicep, arm, application, auto."),
+                .describe("Content format: terraform, cloudformation, kubernetes, pulumi, compose, dockerfile, github, helm, ansible, bicep, arm, gitlab, azure-pipelines, cloudbuild, tfvars, serverless, iam, application, auto."),
         },
     }, async ({ content, focus, format, minSeverity, maxFindings }) => {
         const botHints = fetchPublicBotHints();
@@ -132,7 +138,7 @@ export function createServer(remote = false) {
             description: (name === "scan_iac_stub"
                 ? "Compatibility alias for scan_iac; runs the full scanner. "
                 : "") +
-                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes manifests, Pulumi YAML, Pulumi programs, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, Ansible playbooks, Bicep files, and ARM templates. Helm templates, Ansible facts, Bicep modules, and ARM expressions are not executed. Check security, reliability and cost rules with resource locations and remediation. Pulumi programs are scanned as text.",
+                "Parse Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes manifests, Pulumi YAML, Pulumi programs, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, Ansible playbooks, Bicep files, ARM templates, GitLab CI, Azure Pipelines, Cloud Build, tfvars, Serverless Framework, and a standalone IAM policy. Helm templates, Ansible facts, Bicep modules, ARM expressions, pipelines, Serverless Framework config, and IAM policies are not executed. Conditions are not evaluated. Terraform module sources are not fetched. Check security, reliability and cost rules with resource locations and remediation. Pulumi programs are scanned as text.",
             annotations: {
                 readOnlyHint: true,
                 destructiveHint: false,
@@ -140,7 +146,7 @@ export function createServer(remote = false) {
             },
             _meta: { securitySchemes: [{ type: "oauth2", scopes: ["mcp"] }] },
             inputSchema: {
-                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes YAML/JSON, Pulumi YAML or program text, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, Ansible playbooks, Bicep files, and ARM templates."),
+                content: contentSchema.describe("Terraform HCL/JSON, CloudFormation YAML/JSON, Kubernetes YAML/JSON, Pulumi YAML or program text, or Docker Compose. Includes Dockerfile, GitHub Actions, Helm templates, Ansible playbooks, Bicep files, ARM templates, GitLab CI, Azure Pipelines, Cloud Build, tfvars, Serverless Framework, and a standalone IAM policy."),
                 format: z
                     .enum([
                     "terraform",
@@ -154,6 +160,12 @@ export function createServer(remote = false) {
                     "ansible",
                     "bicep",
                     "arm",
+                    "gitlab",
+                    "azure-pipelines",
+                    "cloudbuild",
+                    "tfvars",
+                    "serverless",
+                    "iam",
                     "auto",
                 ])
                     .default("auto"),

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "0.6.11";
+export declare const VERSION = "0.6.13";

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = "0.6.11";
+export const VERSION = "0.6.13";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skaleagents/swarm",
-  "version": "0.6.11",
+  "version": "0.6.13",
   "private": false,
   "publishConfig": {
     "access": "public"