@skillctl/security 0.3.1 → 0.4.0

package/dist/index.d.ts

@@ -1,3 +1,4 @@
 export { runAudit, auditExitCode } from './runner.js';
+export { validateSkillDir } from './validate-skill.js';
 export type { AuditReport, AuditFinding, AuditSeverity } from './types.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACvD,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC"}

package/dist/index.js

@@ -1,2 +1,3 @@
 export { runAudit, auditExitCode } from './runner.js';
+export { validateSkillDir } from './validate-skill.js';
 //# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC"}

package/dist/test/validate-skill.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=validate-skill.test.d.ts.map

package/dist/test/validate-skill.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-skill.test.d.ts","sourceRoot":"","sources":["../../src/test/validate-skill.test.ts"],"names":[],"mappings":""}

package/dist/test/validate-skill.test.js

@@ -0,0 +1,35 @@
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { validateSkillDir } from '../validate-skill.js';
+test('validateSkillDir passes for valid skill directory', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'validate-skill-'));
+    const skillDir = join(root, 'demo-skill');
+    try {
+        await mkdir(skillDir, { recursive: true });
+        await writeFile(join(skillDir, 'SKILL.md'), '---\nname: demo-skill\n---\n# Demo\n');
+        const report = await validateSkillDir(skillDir);
+        assert.equal(report.status, 'ok');
+        assert.equal(report.scanned, 1);
+        assert.equal(report.findings.length, 0);
+    }
+    finally {
+        await rm(root, { recursive: true, force: true });
+    }
+});
+test('validateSkillDir errors when SKILL.md is missing', async () => {
+    const root = await mkdtemp(join(tmpdir(), 'validate-skill-'));
+    const skillDir = join(root, 'empty-skill');
+    try {
+        await mkdir(skillDir, { recursive: true });
+        const report = await validateSkillDir(skillDir);
+        assert.equal(report.status, 'errors');
+        assert.ok(report.findings.some((f) => f.rule === 'skill-md-missing'));
+    }
+    finally {
+        await rm(root, { recursive: true, force: true });
+    }
+});
+//# sourceMappingURL=validate-skill.test.js.map

package/dist/test/validate-skill.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-skill.test.js","sourceRoot":"","sources":["../../src/test/validate-skill.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,MAAM,MAAM,oBAAoB,CAAC;AACxC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACjE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAExD,IAAI,CAAC,mDAAmD,EAAE,KAAK,IAAI,EAAE;IACnE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,sCAAsC,CAAC,CAAC;QACpF,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAClC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAChC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;IAC1C,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC,CAAC,CAAC;AAEH,IAAI,CAAC,kDAAkD,EAAE,KAAK,IAAI,EAAE;IAClE,MAAM,IAAI,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAChD,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACtC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC;IACxE,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,CAAC;AACH,CAAC,CAAC,CAAC"}

package/dist/validate-skill.d.ts

@@ -0,0 +1,4 @@
+import type { AuditReport } from './types.js';
+/** Validate a single skill directory (SKILL.md layout) without a project lockfile. */
+export declare function validateSkillDir(skillPath: string): Promise<AuditReport>;
+//# sourceMappingURL=validate-skill.d.ts.map

package/dist/validate-skill.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-skill.d.ts","sourceRoot":"","sources":["../src/validate-skill.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAgB,WAAW,EAAE,MAAM,YAAY,CAAC;AAkB5D,sFAAsF;AACtF,wBAAsB,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAkE9E"}

package/dist/validate-skill.js

@@ -0,0 +1,83 @@
+import { stat } from 'node:fs/promises';
+import { basename, join, resolve } from 'node:path';
+import { canonicalizeName } from '@skillctl/core';
+import { checkNameDirMatch } from './rules/name-dir-match.js';
+import { checkScriptHeuristics } from './rules/script-heuristics.js';
+import { checkPathTraversal } from './rules/path-traversal.js';
+import { checkSizeLimits } from './rules/size-limits.js';
+async function findSkillMarkdown(skillPath) {
+    for (const f of ['SKILL.md', 'skill.md']) {
+        try {
+            await stat(join(skillPath, f));
+            return true;
+        }
+        catch {
+            // continue
+        }
+    }
+    return false;
+}
+/** Validate a single skill directory (SKILL.md layout) without a project lockfile. */
+export async function validateSkillDir(skillPath) {
+    const abs = resolve(skillPath);
+    let dirStat;
+    try {
+        dirStat = await stat(abs);
+    }
+    catch {
+        const name = canonicalizeName(basename(abs));
+        return {
+            status: 'errors',
+            scanned: 0,
+            findings: [
+                {
+                    rule: 'skill-dir-missing',
+                    severity: 'error',
+                    skill: name,
+                    message: `Skill directory not found: ${abs}`,
+                    path: abs,
+                },
+            ],
+        };
+    }
+    if (!dirStat.isDirectory()) {
+        const name = canonicalizeName(basename(abs));
+        return {
+            status: 'errors',
+            scanned: 0,
+            findings: [
+                {
+                    rule: 'skill-dir-missing',
+                    severity: 'error',
+                    skill: name,
+                    message: 'Path is not a directory',
+                    path: abs,
+                },
+            ],
+        };
+    }
+    const name = canonicalizeName(basename(abs));
+    const findings = [];
+    if (!(await findSkillMarkdown(abs))) {
+        findings.push({
+            rule: 'skill-md-missing',
+            severity: 'error',
+            skill: name,
+            message: 'SKILL.md (or skill.md) not found',
+            path: abs,
+        });
+        return { status: 'errors', findings, scanned: 0 };
+    }
+    findings.push(...(await checkNameDirMatch(name, abs)));
+    findings.push(...(await checkScriptHeuristics(name, abs)));
+    findings.push(...(await checkPathTraversal(name, abs)));
+    findings.push(...(await checkSizeLimits(name, abs)));
+    const hasError = findings.some((f) => f.severity === 'error');
+    const hasWarning = findings.some((f) => f.severity === 'warning');
+    return {
+        status: hasError ? 'errors' : hasWarning ? 'warnings' : 'ok',
+        findings,
+        scanned: 1,
+    };
+}
+//# sourceMappingURL=validate-skill.js.map

package/dist/validate-skill.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validate-skill.js","sourceRoot":"","sources":["../src/validate-skill.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,qBAAqB,EAAE,MAAM,8BAA8B,CAAC;AACrE,OAAO,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAC/D,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAEzD,KAAK,UAAU,iBAAiB,CAAC,SAAiB;IAChD,KAAK,MAAM,CAAC,IAAI,CAAC,UAAU,EAAE,UAAU,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC;YAC/B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,WAAW;QACb,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,SAAiB;IACtD,MAAM,GAAG,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,OAAO;oBACjB,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,8BAA8B,GAAG,EAAE;oBAC5C,IAAI,EAAE,GAAG;iBACV;aACF;SACF,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7C,OAAO;YACL,MAAM,EAAE,QAAQ;YAChB,OAAO,EAAE,CAAC;YACV,QAAQ,EAAE;gBACR;oBACE,IAAI,EAAE,mBAAmB;oBACzB,QAAQ,EAAE,OAAO;oBACjB,KAAK,EAAE,IAAI;oBACX,OAAO,EAAE,yBAAyB;oBAClC,IAAI,EAAE,GAAG;iBACV;aACF;SACF,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAmB,EAAE,CAAC;IAEpC,IAAI,CAAC,CAAC,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACpC,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,kCAAkC;YAC3C,IAAI,EAAE,GAAG;SACV,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,EAAE,CAAC;IACpD,CAAC;IAED,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,qBAAqB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAC3D,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC;IAErD,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC;IAC9D,MAAM,UAAU,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC;IAElE,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI;QAC5D,QAAQ;QACR,OAAO,EAAE,CAAC;KACX,CAAC;AACJ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@skillctl/security",
-  "version": "0.3.1",
+  "version": "0.4.0",
   "description": "Security scanner and audit for skillctl skills",
   "license": "MIT",
   "author": "xFurti & Gabry848",
@@ -11,8 +11,8 @@
     "dist"
   ],
   "dependencies": {
-    "@skillctl/core": "0.3.1",
-    "@skillctl/lockfile": "0.3.1"
+    "@skillctl/core": "0.4.0",
+    "@skillctl/lockfile": "0.4.0"
   },
   "devDependencies": {
     "@types/node": "^20.14.0",