@skillsmith/core 0.5.4 → 0.5.6

package/dist/security/scanner/SecurityScanner.js

@@ -0,0 +1,371 @@
+/**
+ * Security Scanner - SMI-587, SMI-685, SMI-882, SMI-1189
+ *
+ * Security scanning for skill content with advanced pattern detection.
+ */
+import { DEFAULT_ALLOWED_DOMAINS, SENSITIVE_PATH_PATTERNS, JAILBREAK_PATTERNS, SUSPICIOUS_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, AI_DEFENCE_PATTERNS, PII_PATTERNS, } from './patterns.js';
+import { safeRegexTest, safeRegexCheck } from './regex-utils.js';
+import { isMultilinePattern, analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, calculateRiskScore, scanPatternsWithMultilineSupport, } from './SecurityScanner.helpers.js';
+// Import SSRF scanner
+import { scanSsrfPatterns } from './SecurityScanner.ssrf.js';
+// Import formatters (used for both re-export and static methods)
+import { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary, } from './SecurityScanner.formatters.js';
+// Re-export helpers and formatters for public API
+export { isMultilinePattern, analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, calculateRiskScore, };
+export { scanSsrfPatterns };
+export { toMinimalRefs, toSARIF, toGitHubAnnotations, toSummary };
+export class SecurityScanner {
+    allowedDomains;
+    blockedPatterns;
+    maxContentLength;
+    riskThreshold;
+    constructor(options = {}) {
+        this.allowedDomains = new Set(options.allowedDomains ?? DEFAULT_ALLOWED_DOMAINS);
+        this.blockedPatterns = options.blockedPatterns ?? [];
+        this.maxContentLength = options.maxContentLength ?? 1_000_000; // 1MB
+        this.riskThreshold = options.riskThreshold ?? 40;
+    }
+    extractUrls(content) {
+        const urlPattern = /https?:\/\/[^\s<>"')\]]+/gi;
+        const lines = content.split('\n');
+        const results = [];
+        lines.forEach((line, index) => {
+            let match;
+            while ((match = urlPattern.exec(line)) !== null) {
+                results.push({ url: match[0], line: index + 1 });
+            }
+        });
+        return results;
+    }
+    isAllowedDomain(url) {
+        try {
+            const parsed = new URL(url);
+            const hostname = parsed.hostname.toLowerCase();
+            return Array.from(this.allowedDomains).some((domain) => hostname === domain || hostname.endsWith('.' + domain));
+        }
+        catch {
+            return false;
+        }
+    }
+    scanUrls(content) {
+        const findings = [];
+        const urls = this.extractUrls(content);
+        for (const { url, line } of urls) {
+            if (!this.isAllowedDomain(url)) {
+                findings.push({
+                    type: 'url',
+                    severity: 'medium',
+                    message: `External URL not in allowlist: ${url}`,
+                    location: url,
+                    lineNumber: line,
+                });
+            }
+        }
+        return findings;
+    }
+    scanSensitivePaths(content, lineContexts) {
+        const findings = [];
+        const lines = content.split('\n');
+        const contexts = lineContexts ?? analyzeMarkdownContext(content);
+        lines.forEach((line, index) => {
+            const ctx = contexts[index];
+            for (const pattern of SENSITIVE_PATH_PATTERNS) {
+                if (safeRegexCheck(pattern, line)) {
+                    const match = safeRegexTest(pattern, line);
+                    const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match?.index ?? 0);
+                    const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
+                    const confidence = inDocContext ? 'low' : 'high';
+                    const severity = inDocContext ? 'medium' : 'high';
+                    findings.push({
+                        type: 'sensitive_path',
+                        severity,
+                        message: `Reference to potentially sensitive path: ${pattern.source}`,
+                        location: line.trim().slice(0, 100),
+                        lineNumber: index + 1,
+                        inDocumentationContext: inDocContext,
+                        confidence,
+                    });
+                    break;
+                }
+            }
+        });
+        return findings;
+    }
+    scanJailbreakPatterns(content, lineContexts) {
+        return scanPatternsWithMultilineSupport(content, {
+            type: 'jailbreak',
+            messagePrefix: 'Potential jailbreak pattern detected',
+            patterns: JAILBREAK_PATTERNS,
+            severities: ['high', 'critical'],
+        }, lineContexts);
+    }
+    scanSuspiciousPatterns(content) {
+        const findings = [];
+        const lines = content.split('\n');
+        lines.forEach((line, index) => {
+            for (const pattern of SUSPICIOUS_PATTERNS) {
+                const match = safeRegexTest(pattern, line);
+                if (match) {
+                    findings.push({
+                        type: 'suspicious_pattern',
+                        severity: 'medium',
+                        message: `Suspicious pattern detected: "${match[0]}"`,
+                        location: line.trim().slice(0, 100),
+                        lineNumber: index + 1,
+                    });
+                    break;
+                }
+            }
+            for (const pattern of this.blockedPatterns) {
+                const match = safeRegexTest(pattern, line);
+                if (match) {
+                    findings.push({
+                        type: 'suspicious_pattern',
+                        severity: 'high',
+                        message: `Blocked pattern detected: "${match[0]}"`,
+                        location: line.trim().slice(0, 100),
+                        lineNumber: index + 1,
+                    });
+                    break;
+                }
+            }
+        });
+        return findings;
+    }
+    scanSocialEngineering(content, lineContexts) {
+        const findings = [];
+        const lines = content.split('\n');
+        const contexts = lineContexts ?? analyzeMarkdownContext(content);
+        lines.forEach((line, index) => {
+            const ctx = contexts[index];
+            for (const pattern of SOCIAL_ENGINEERING_PATTERNS) {
+                const match = safeRegexTest(pattern, line);
+                if (match) {
+                    const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match.index ?? 0);
+                    const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
+                    const confidence = inDocContext ? 'low' : 'high';
+                    const severity = inDocContext ? 'medium' : 'high';
+                    findings.push({
+                        type: 'social_engineering',
+                        severity,
+                        message: `Social engineering attempt detected: "${match[0]}"`,
+                        location: line.trim().slice(0, 100),
+                        lineNumber: index + 1,
+                        category: 'social_engineering',
+                        inDocumentationContext: inDocContext,
+                        confidence,
+                    });
+                    break;
+                }
+            }
+        });
+        return findings;
+    }
+    scanPromptLeaking(content, lineContexts) {
+        const findings = [];
+        const lines = content.split('\n');
+        const contexts = lineContexts ?? analyzeMarkdownContext(content);
+        lines.forEach((line, index) => {
+            const ctx = contexts[index];
+            for (const pattern of PROMPT_LEAKING_PATTERNS) {
+                const match = safeRegexTest(pattern, line);
+                if (match) {
+                    const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match.index ?? 0);
+                    const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
+                    const confidence = inDocContext ? 'low' : 'high';
+                    const severity = inDocContext ? 'high' : 'critical';
+                    findings.push({
+                        type: 'prompt_leaking',
+                        severity,
+                        message: `Prompt leaking attempt detected: "${match[0]}"`,
+                        location: line.trim().slice(0, 100),
+                        lineNumber: index + 1,
+                        category: 'prompt_leaking',
+                        inDocumentationContext: inDocContext,
+                        confidence,
+                    });
+                    break;
+                }
+            }
+        });
+        return findings;
+    }
+    scanDataExfiltration(content, lineContexts) {
+        const findings = [];
+        const lines = content.split('\n');
+        const contexts = lineContexts ?? analyzeMarkdownContext(content);
+        lines.forEach((line, index) => {
+            const ctx = contexts[index];
+            for (const pattern of DATA_EXFILTRATION_PATTERNS) {
+                const match = safeRegexTest(pattern, line);
+                if (match) {
+                    const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match.index ?? 0);
+                    const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
+                    const confidence = inDocContext ? 'low' : 'high';
+                    const severity = inDocContext ? 'medium' : 'high';
+                    findings.push({
+                        type: 'data_exfiltration',
+                        severity,
+                        message: `Potential data exfiltration pattern: "${match[0]}"`,
+                        location: line.trim().slice(0, 100),
+                        lineNumber: index + 1,
+                        category: 'data_exfiltration',
+                        inDocumentationContext: inDocContext,
+                        confidence,
+                    });
+                    break;
+                }
+            }
+        });
+        return findings;
+    }
+    scanPrivilegeEscalation(content, lineContexts) {
+        const findings = [];
+        const lines = content.split('\n');
+        const contexts = lineContexts ?? analyzeMarkdownContext(content);
+        lines.forEach((line, index) => {
+            const ctx = contexts[index];
+            for (const pattern of PRIVILEGE_ESCALATION_PATTERNS) {
+                const match = safeRegexTest(pattern, line);
+                if (match) {
+                    const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match.index ?? 0);
+                    const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
+                    const confidence = inDocContext ? 'low' : 'high';
+                    const severity = inDocContext ? 'high' : 'critical';
+                    findings.push({
+                        type: 'privilege_escalation',
+                        severity,
+                        message: `Privilege escalation pattern detected: "${match[0]}"`,
+                        location: line.trim().slice(0, 100),
+                        lineNumber: index + 1,
+                        category: 'privilege_escalation',
+                        inDocumentationContext: inDocContext,
+                        confidence,
+                    });
+                    break;
+                }
+            }
+        });
+        return findings;
+    }
+    /** SMI-3864: Detect PII patterns. Email in YAML frontmatter gets low severity. */
+    scanPiiPatterns(content, lineContexts) {
+        const findings = [];
+        const lines = content.split('\n');
+        const contexts = lineContexts ?? analyzeMarkdownContext(content);
+        let frontmatterEnd = -1;
+        if (lines[0]?.trim() === '---') {
+            for (let i = 1; i < lines.length; i++) {
+                if (lines[i].trim() === '---') {
+                    frontmatterEnd = i;
+                    break;
+                }
+            }
+        }
+        const emailPatternIndex = 7;
+        lines.forEach((line, index) => {
+            const ctx = contexts[index];
+            const inFrontmatter = index > 0 && index < frontmatterEnd;
+            for (let pi = 0; pi < PII_PATTERNS.length; pi++) {
+                const pattern = PII_PATTERNS[pi];
+                const match = safeRegexTest(pattern, line);
+                if (match) {
+                    const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match.index ?? 0);
+                    const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
+                    const isEmailPattern = pi === emailPatternIndex;
+                    const isAuthorLine = /^\s*(?:author|contact|support|email)\s*:/i.test(line);
+                    const inEmailSafeContext = isEmailPattern && (inFrontmatter || isAuthorLine);
+                    let severity;
+                    if (inEmailSafeContext)
+                        severity = 'low';
+                    else if (inDocContext)
+                        severity = 'medium';
+                    else if (pi <= 2 || pi === 9)
+                        severity = 'critical';
+                    else
+                        severity = 'high';
+                    const confidence = inDocContext || inEmailSafeContext ? 'low' : 'high';
+                    findings.push({
+                        type: 'pii',
+                        severity,
+                        message: `PII detected: ${match[0].slice(0, 40)}${match[0].length > 40 ? '...' : ''}`,
+                        location: line.trim().slice(0, 100),
+                        lineNumber: index + 1,
+                        category: 'pii',
+                        inDocumentationContext: inDocContext || inEmailSafeContext,
+                        confidence,
+                    });
+                    break;
+                }
+            }
+        });
+        return findings;
+    }
+    scanAIDefenceVulnerabilities(content, lineContexts) {
+        return scanPatternsWithMultilineSupport(content, {
+            type: 'ai_defence',
+            messagePrefix: 'AI injection pattern detected',
+            patterns: AI_DEFENCE_PATTERNS,
+            severities: ['high', 'critical'],
+        }, lineContexts);
+    }
+    /** @deprecated Use standalone calculateRiskScore function for new code */
+    calculateRiskScore = calculateRiskScore;
+    scan(skillId, content) {
+        const startTime = performance.now();
+        const findings = [];
+        const lineContexts = analyzeMarkdownContext(content);
+        if (content.length > this.maxContentLength) {
+            findings.push({
+                type: 'suspicious_pattern',
+                severity: 'low',
+                message: `Content exceeds maximum length (${this.maxContentLength} bytes)`,
+            });
+        }
+        findings.push(...this.scanUrls(content));
+        findings.push(...this.scanSensitivePaths(content, lineContexts));
+        findings.push(...this.scanJailbreakPatterns(content, lineContexts));
+        findings.push(...this.scanSuspiciousPatterns(content));
+        findings.push(...this.scanSocialEngineering(content, lineContexts));
+        findings.push(...this.scanPromptLeaking(content, lineContexts));
+        findings.push(...this.scanDataExfiltration(content, lineContexts));
+        findings.push(...this.scanPrivilegeEscalation(content, lineContexts));
+        findings.push(...this.scanAIDefenceVulnerabilities(content, lineContexts));
+        findings.push(...scanSsrfPatterns(content, lineContexts));
+        findings.push(...this.scanPiiPatterns(content, lineContexts));
+        const endTime = performance.now();
+        const { total: riskScore, breakdown: riskBreakdown } = calculateRiskScore(findings);
+        const hasCritical = findings.some((f) => f.severity === 'critical');
+        const hasHigh = findings.some((f) => f.severity === 'high');
+        const exceedsThreshold = riskScore >= this.riskThreshold;
+        return {
+            skillId,
+            passed: !hasCritical && !hasHigh && !exceedsThreshold,
+            findings,
+            scannedAt: new Date(),
+            scanDurationMs: endTime - startTime,
+            riskScore,
+            riskBreakdown,
+        };
+    }
+    quickCheck(content) {
+        for (const pattern of JAILBREAK_PATTERNS) {
+            if (safeRegexCheck(pattern, content))
+                return false;
+        }
+        return true;
+    }
+    addAllowedDomain(domain) {
+        this.allowedDomains.add(domain.toLowerCase());
+    }
+    addBlockedPattern(pattern) {
+        this.blockedPatterns.push(pattern);
+    }
+    // Static methods delegate to formatters for backwards compatibility
+    static toMinimalRefs = toMinimalRefs;
+    static toSARIF = toSARIF;
+    static toGitHubAnnotations = toGitHubAnnotations;
+    static toSummary = toSummary;
+}
+export default SecurityScanner;
+//# sourceMappingURL=SecurityScanner.js.map

package/dist/security/scanner/SecurityScanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.js","sourceRoot":"","sources":["../../../src/security/scanner/SecurityScanner.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,YAAY,GACb,MAAM,eAAe,CAAA;AACtB,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAIhE,OAAO,EACL,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,gCAAgC,GACjC,MAAM,8BAA8B,CAAA;AAErC,sBAAsB;AACtB,OAAO,EAAE,gBAAgB,EAAE,MAAM,2BAA2B,CAAA;AAE5D,iEAAiE;AACjE,OAAO,EACL,aAAa,EACb,OAAO,EACP,mBAAmB,EACnB,SAAS,GACV,MAAM,iCAAiC,CAAA;AAExC,kDAAkD;AAClD,OAAO,EAEL,kBAAkB,EAClB,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,CAAA;AACD,OAAO,EAAE,gBAAgB,EAAE,CAAA;AAC3B,OAAO,EAAE,aAAa,EAAE,OAAO,EAAE,mBAAmB,EAAE,SAAS,EAAE,CAAA;AAEjE,MAAM,OAAO,eAAe;IAClB,cAAc,CAAa;IAC3B,eAAe,CAAU;IACzB,gBAAgB,CAAQ;IACxB,aAAa,CAAQ;IAE7B,YAAY,UAA0B,EAAE;QACtC,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,uBAAuB,CAAC,CAAA;QAChF,IAAI,CAAC,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,EAAE,CAAA;QACpD,IAAI,CAAC,gBAAgB,GAAG,OAAO,CAAC,gBAAgB,IAAI,SAAS,CAAA,CAAC,MAAM;QACpE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,EAAE,CAAA;IAClD,CAAC;IAEO,WAAW,CAAC,OAAe;QACjC,MAAM,UAAU,GAAG,4BAA4B,CAAA;QAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,OAAO,GAAyC,EAAE,CAAA;QAExD,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,IAAI,KAAK,CAAA;YACT,OAAO,CAAC,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBAChD,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAA;YAClD,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,OAAO,CAAA;IAChB,CAAC;IAEO,eAAe,CAAC,GAAW;QACjC,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;YAC3B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;YAC9C,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,CACzC,CAAC,MAAM,EAAE,EAAE,CAAC,QAAQ,KAAK,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,GAAG,GAAG,MAAM,CAAC,CACnE,CAAA;QACH,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAA;QACd,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,OAAe;QAC9B,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,CAAA;QAEtC,KAAK,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC;YACjC,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,KAAK;oBACX,QAAQ,EAAE,QAAQ;oBAClB,OAAO,EAAE,kCAAkC,GAAG,EAAE;oBAChD,QAAQ,EAAE,GAAG;oBACb,UAAU,EAAE,IAAI;iBACjB,CAAC,CAAA;YACJ,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,kBAAkB,CAAC,OAAe,EAAE,YAA4B;QACtE,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;gBAC9C,IAAI,cAAc,CAAC,OAAO,EAAE,IAAI,CAAC,EAAE,CAAC;oBAClC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;oBAC1C,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC,CAAC,CAAA;oBACrF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;oBAEjD,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,gBAAgB;wBACtB,QAAQ;wBACR,OAAO,EAAE,4CAA4C,OAAO,CAAC,MAAM,EAAE;wBACrE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,qBAAqB,CAAC,OAAe,EAAE,YAA4B;QACzE,OAAO,gCAAgC,CACrC,OAAO,EACP;YACE,IAAI,EAAE,WAAW;YACjB,aAAa,EAAE,sCAAsC;YACrD,QAAQ,EAAE,kBAAkB;YAC5B,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;SACjC,EACD,YAAY,CACb,CAAA;IACH,CAAC;IAEO,sBAAsB,CAAC,OAAe;QAC5C,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QAEjC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,KAAK,MAAM,OAAO,IAAI,mBAAmB,EAAE,CAAC;gBAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ,EAAE,QAAQ;wBAClB,OAAO,EAAE,iCAAiC,KAAK,CAAC,CAAC,CAAC,GAAG;wBACrD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;qBACtB,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;YAED,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,eAAe,EAAE,CAAC;gBAC3C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ,EAAE,MAAM;wBAChB,OAAO,EAAE,8BAA8B,KAAK,CAAC,CAAC,CAAC,GAAG;wBAClD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;qBACtB,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,qBAAqB,CAAC,OAAe,EAAE,YAA4B;QACzE,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAE3B,KAAK,MAAM,OAAO,IAAI,2BAA2B,EAAE,CAAC;gBAClD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;oBAEjD,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ;wBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;wBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,oBAAoB;wBAC9B,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,iBAAiB,CAAC,OAAe,EAAE,YAA4B;QACrE,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAE3B,KAAK,MAAM,OAAO,IAAI,uBAAuB,EAAE,CAAC;gBAC9C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;oBAEnD,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,gBAAgB;wBACtB,QAAQ;wBACR,OAAO,EAAE,qCAAqC,KAAK,CAAC,CAAC,CAAC,GAAG;wBACzD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,gBAAgB;wBAC1B,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,oBAAoB,CAAC,OAAe,EAAE,YAA4B;QACxE,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAE3B,KAAK,MAAM,OAAO,IAAI,0BAA0B,EAAE,CAAC;gBACjD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;oBAEjD,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,mBAAmB;wBACzB,QAAQ;wBACR,OAAO,EAAE,yCAAyC,KAAK,CAAC,CAAC,CAAC,GAAG;wBAC7D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,mBAAmB;wBAC7B,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,uBAAuB,CAC7B,OAAe,EACf,YAA4B;QAE5B,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAEhE,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAE3B,KAAK,MAAM,OAAO,IAAI,6BAA6B,EAAE,CAAC;gBACpD,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,CAAA;oBAEnD,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,sBAAsB;wBAC5B,QAAQ;wBACR,OAAO,EAAE,2CAA2C,KAAK,CAAC,CAAC,CAAC,GAAG;wBAC/D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,sBAAsB;wBAChC,sBAAsB,EAAE,YAAY;wBACpC,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QAEF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAED,kFAAkF;IAC1E,eAAe,CAAC,OAAe,EAAE,YAA4B;QACnE,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;QACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAChE,IAAI,cAAc,GAAG,CAAC,CAAC,CAAA;QACvB,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;YAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACtC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,KAAK,EAAE,CAAC;oBAC9B,cAAc,GAAG,CAAC,CAAA;oBAClB,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,iBAAiB,GAAG,CAAC,CAAA;QAC3B,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;YAC5B,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;YAC3B,MAAM,aAAa,GAAG,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,cAAc,CAAA;YACzD,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,YAAY,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,CAAC;gBAChD,MAAM,OAAO,GAAG,YAAY,CAAC,EAAE,CAAC,CAAA;gBAChC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;gBAC1C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;oBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;oBAC9E,MAAM,cAAc,GAAG,EAAE,KAAK,iBAAiB,CAAA;oBAC/C,MAAM,YAAY,GAAG,2CAA2C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;oBAC3E,MAAM,kBAAkB,GAAG,cAAc,IAAI,CAAC,aAAa,IAAI,YAAY,CAAC,CAAA;oBAC5E,IAAI,QAAgD,CAAA;oBACpD,IAAI,kBAAkB;wBAAE,QAAQ,GAAG,KAAK,CAAA;yBACnC,IAAI,YAAY;wBAAE,QAAQ,GAAG,QAAQ,CAAA;yBACrC,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;wBAAE,QAAQ,GAAG,UAAU,CAAA;;wBAC9C,QAAQ,GAAG,MAAM,CAAA;oBACtB,MAAM,UAAU,GAAsB,YAAY,IAAI,kBAAkB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;oBACzF,QAAQ,CAAC,IAAI,CAAC;wBACZ,IAAI,EAAE,KAAK;wBACX,QAAQ;wBACR,OAAO,EAAE,iBAAiB,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE;wBACrF,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;wBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;wBACrB,QAAQ,EAAE,KAAK;wBACf,sBAAsB,EAAE,YAAY,IAAI,kBAAkB;wBAC1D,UAAU;qBACX,CAAC,CAAA;oBACF,MAAK;gBACP,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAA;QACF,OAAO,QAAQ,CAAA;IACjB,CAAC;IAEO,4BAA4B,CAClC,OAAe,EACf,YAA4B;QAE5B,OAAO,gCAAgC,CACrC,OAAO,EACP;YACE,IAAI,EAAE,YAAY;YAClB,aAAa,EAAE,+BAA+B;YAC9C,QAAQ,EAAE,mBAAmB;YAC7B,UAAU,EAAE,CAAC,MAAM,EAAE,UAAU,CAAC;SACjC,EACD,YAAY,CACb,CAAA;IACH,CAAC;IAED,0EAA0E;IAC1E,kBAAkB,GAAG,kBAAkB,CAAA;IAEvC,IAAI,CAAC,OAAe,EAAE,OAAe;QACnC,MAAM,SAAS,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACnC,MAAM,QAAQ,GAAsB,EAAE,CAAA;QACtC,MAAM,YAAY,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAEpD,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;YAC3C,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,oBAAoB;gBAC1B,QAAQ,EAAE,KAAK;gBACf,OAAO,EAAE,mCAAmC,IAAI,CAAC,gBAAgB,SAAS;aAC3E,CAAC,CAAA;QACJ,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAA;QACxC,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,kBAAkB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAChE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACnE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,sBAAsB,CAAC,OAAO,CAAC,CAAC,CAAA;QACtD,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,qBAAqB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACnE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,iBAAiB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC/D,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,oBAAoB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAClE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACrE,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,4BAA4B,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAC1E,QAAQ,CAAC,IAAI,CAAC,GAAG,gBAAgB,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QACzD,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,eAAe,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC,CAAA;QAE7D,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAA;QACjC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,kBAAkB,CAAC,QAAQ,CAAC,CAAA;QAEnF,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAA;QACnE,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAA;QAC3D,MAAM,gBAAgB,GAAG,SAAS,IAAI,IAAI,CAAC,aAAa,CAAA;QAExD,OAAO;YACL,OAAO;YACP,MAAM,EAAE,CAAC,WAAW,IAAI,CAAC,OAAO,IAAI,CAAC,gBAAgB;YACrD,QAAQ;YACR,SAAS,EAAE,IAAI,IAAI,EAAE;YACrB,cAAc,EAAE,OAAO,GAAG,SAAS;YACnC,SAAS;YACT,aAAa;SACd,CAAA;IACH,CAAC;IAED,UAAU,CAAC,OAAe;QACxB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;YACzC,IAAI,cAAc,CAAC,OAAO,EAAE,OAAO,CAAC;gBAAE,OAAO,KAAK,CAAA;QACpD,CAAC;QACD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,gBAAgB,CAAC,MAAc;QAC7B,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC,CAAA;IAC/C,CAAC;IAED,iBAAiB,CAAC,OAAe;QAC/B,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;IACpC,CAAC;IAED,oEAAoE;IACpE,MAAM,CAAC,aAAa,GAAG,aAAa,CAAA;IACpC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAA;IACxB,MAAM,CAAC,mBAAmB,GAAG,mBAAmB,CAAA;IAChD,MAAM,CAAC,SAAS,GAAG,SAAS,CAAA;;AAG9B,eAAe,eAAe,CAAA"}

package/dist/security/scanner/SecurityScanner.ssrf.d.ts

@@ -0,0 +1,15 @@
+/**
+ * SSRF Pattern Scanning - SMI-3509
+ *
+ * Detects SSRF instructions in skill content.
+ * Extracted from SecurityScanner to keep file sizes under 500 lines.
+ */
+import type { SecurityFinding } from './types.js';
+import type { LineContext } from './SecurityScanner.helpers.js';
+/**
+ * Scan content for SSRF instruction patterns.
+ * Uses documentation context to reduce severity for patterns in code blocks/tables.
+ * SMI-3522: Supports multi-line patterns via scanPatternsWithMultilineSupport approach.
+ */
+export declare function scanSsrfPatterns(content: string, lineContexts?: LineContext[]): SecurityFinding[];
+//# sourceMappingURL=SecurityScanner.ssrf.d.ts.map

package/dist/security/scanner/SecurityScanner.ssrf.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.ssrf.d.ts","sourceRoot":"","sources":["../../../src/security/scanner/SecurityScanner.ssrf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAqB,MAAM,YAAY,CAAA;AACpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,8BAA8B,CAAA;AAU/D;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,GAAG,eAAe,EAAE,CA+DjG"}

package/dist/security/scanner/SecurityScanner.ssrf.js

@@ -0,0 +1,76 @@
+/**
+ * SSRF Pattern Scanning - SMI-3509
+ *
+ * Detects SSRF instructions in skill content.
+ * Extracted from SecurityScanner to keep file sizes under 500 lines.
+ */
+import { analyzeMarkdownContext, isDocumentationContext, isWithinInlineCode, isMultilinePattern, } from './SecurityScanner.helpers.js';
+import { SSRF_INSTRUCTION_PATTERNS } from './patterns.js';
+import { safeRegexTest } from './regex-utils.js';
+/**
+ * Scan content for SSRF instruction patterns.
+ * Uses documentation context to reduce severity for patterns in code blocks/tables.
+ * SMI-3522: Supports multi-line patterns via scanPatternsWithMultilineSupport approach.
+ */
+export function scanSsrfPatterns(content, lineContexts) {
+    const findings = [];
+    const lines = content.split('\n');
+    const contexts = lineContexts ?? analyzeMarkdownContext(content);
+    const flaggedLines = new Set();
+    // SMI-3522: First pass — multi-line SSRF patterns against full content
+    for (const pattern of SSRF_INSTRUCTION_PATTERNS) {
+        if (!isMultilinePattern(pattern))
+            continue;
+        const match = safeRegexTest(pattern, content);
+        if (match) {
+            const matchIndex = content.indexOf(match[0]);
+            const lineNumber = content.slice(0, matchIndex).split('\n').length;
+            const ctx = contexts[lineNumber - 1];
+            const inDocContext = ctx ? isDocumentationContext(ctx) : false;
+            const confidence = inDocContext ? 'low' : 'high';
+            const severity = inDocContext ? 'medium' : 'high';
+            const truncated = match[0].slice(0, 50);
+            findings.push({
+                type: 'ssrf',
+                severity,
+                message: `SSRF instruction pattern detected: "${truncated}${match[0].length > 50 ? '...' : ''}"`,
+                location: match[0].trim().slice(0, 100),
+                lineNumber,
+                category: 'ssrf',
+                inDocumentationContext: inDocContext,
+                confidence,
+            });
+            flaggedLines.add(lineNumber);
+        }
+    }
+    // Second pass — single-line SSRF patterns per-line
+    lines.forEach((line, index) => {
+        if (flaggedLines.has(index + 1))
+            return;
+        const ctx = contexts[index];
+        for (const pattern of SSRF_INSTRUCTION_PATTERNS) {
+            if (isMultilinePattern(pattern))
+                continue;
+            const match = safeRegexTest(pattern, line);
+            if (match) {
+                const inInlineCode = ctx?.isInlineCode && isWithinInlineCode(line, match.index ?? 0);
+                const inDocContext = ctx ? isDocumentationContext(ctx) || inInlineCode : false;
+                const confidence = inDocContext ? 'low' : 'high';
+                const severity = inDocContext ? 'medium' : 'high';
+                findings.push({
+                    type: 'ssrf',
+                    severity,
+                    message: `SSRF instruction pattern detected: "${match[0]}"`,
+                    location: line.trim().slice(0, 100),
+                    lineNumber: index + 1,
+                    category: 'ssrf',
+                    inDocumentationContext: inDocContext,
+                    confidence,
+                });
+                break;
+            }
+        }
+    });
+    return findings;
+}
+//# sourceMappingURL=SecurityScanner.ssrf.js.map

package/dist/security/scanner/SecurityScanner.ssrf.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SecurityScanner.ssrf.js","sourceRoot":"","sources":["../../../src/security/scanner/SecurityScanner.ssrf.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EACL,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,GACnB,MAAM,8BAA8B,CAAA;AACrC,OAAO,EAAE,yBAAyB,EAAE,MAAM,eAAe,CAAA;AACzD,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAA;AAEhD;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,YAA4B;IAC5E,MAAM,QAAQ,GAAsB,EAAE,CAAA;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,QAAQ,GAAG,YAAY,IAAI,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAChE,MAAM,YAAY,GAAG,IAAI,GAAG,EAAU,CAAA;IAEtC,uEAAuE;IACvE,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;QAChD,IAAI,CAAC,kBAAkB,CAAC,OAAO,CAAC;YAAE,SAAQ;QAC1C,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,CAAA;QAC7C,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAA;YAC5C,MAAM,UAAU,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;YAClE,MAAM,GAAG,GAAG,QAAQ,CAAC,UAAU,GAAG,CAAC,CAAC,CAAA;YACpC,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAA;YAC9D,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;YACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;YACjD,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YAEvC,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,MAAM;gBACZ,QAAQ;gBACR,OAAO,EAAE,uCAAuC,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG;gBAChG,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACvC,UAAU;gBACV,QAAQ,EAAE,MAAM;gBAChB,sBAAsB,EAAE,YAAY;gBACpC,UAAU;aACX,CAAC,CAAA;YACF,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;QAC9B,CAAC;IACH,CAAC;IAED,mDAAmD;IACnD,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QAC5B,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC;YAAE,OAAM;QACvC,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAA;QAE3B,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;YAChD,IAAI,kBAAkB,CAAC,OAAO,CAAC;gBAAE,SAAQ;YACzC,MAAM,KAAK,GAAG,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,CAAA;YAC1C,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,YAAY,GAAG,GAAG,EAAE,YAAY,IAAI,kBAAkB,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,CAAA;gBACpF,MAAM,YAAY,GAAG,GAAG,CAAC,CAAC,CAAC,sBAAsB,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,CAAA;gBAC9E,MAAM,UAAU,GAAsB,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAA;gBACnE,MAAM,QAAQ,GAAG,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAA;gBAEjD,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,MAAM;oBACZ,QAAQ;oBACR,OAAO,EAAE,uCAAuC,KAAK,CAAC,CAAC,CAAC,GAAG;oBAC3D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;oBACnC,UAAU,EAAE,KAAK,GAAG,CAAC;oBACrB,QAAQ,EAAE,MAAM;oBAChB,sBAAsB,EAAE,YAAY;oBACpC,UAAU;iBACX,CAAC,CAAA;gBACF,MAAK;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAA;IAEF,OAAO,QAAQ,CAAA;AACjB,CAAC"}

package/dist/security/scanner/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Security Scanner Module - SMI-587, SMI-685, SMI-882, SMI-1189
+ *
+ * Re-exports for security scanning functionality.
+ */
+export type { SecurityFindingType, SecuritySeverity, SecurityFinding, RiskScoreBreakdown, ScanReport, ScannerOptions, } from './types.js';
+export { DEFAULT_ALLOWED_DOMAINS, SENSITIVE_PATH_PATTERNS, JAILBREAK_PATTERNS, SUSPICIOUS_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, AI_DEFENCE_PATTERNS, SSRF_INSTRUCTION_PATTERNS, PII_PATTERNS, } from './patterns.js';
+export { SEVERITY_WEIGHTS, CATEGORY_WEIGHTS } from './weights.js';
+export { MAX_LINE_LENGTH_FOR_REGEX, safeRegexTest, safeRegexCheck } from './regex-utils.js';
+export { SecurityScanner, default } from './SecurityScanner.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/security/scanner/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,YAAY,EACV,mBAAmB,EACnB,gBAAgB,EAChB,eAAe,EACf,kBAAkB,EAClB,UAAU,EACV,cAAc,GACf,MAAM,YAAY,CAAA;AAGnB,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,GACb,MAAM,eAAe,CAAA;AAGtB,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAGjE,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAG3F,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/security/scanner/index.js

@@ -0,0 +1,14 @@
+/**
+ * Security Scanner Module - SMI-587, SMI-685, SMI-882, SMI-1189
+ *
+ * Re-exports for security scanning functionality.
+ */
+// Patterns (for testing/extending)
+export { DEFAULT_ALLOWED_DOMAINS, SENSITIVE_PATH_PATTERNS, JAILBREAK_PATTERNS, SUSPICIOUS_PATTERNS, SOCIAL_ENGINEERING_PATTERNS, PROMPT_LEAKING_PATTERNS, DATA_EXFILTRATION_PATTERNS, PRIVILEGE_ESCALATION_PATTERNS, AI_DEFENCE_PATTERNS, SSRF_INSTRUCTION_PATTERNS, PII_PATTERNS, } from './patterns.js';
+// Weights (for testing/extending)
+export { SEVERITY_WEIGHTS, CATEGORY_WEIGHTS } from './weights.js';
+// Regex utilities (for testing/extending)
+export { MAX_LINE_LENGTH_FOR_REGEX, safeRegexTest, safeRegexCheck } from './regex-utils.js';
+// Main class
+export { SecurityScanner, default } from './SecurityScanner.js';
+//# sourceMappingURL=index.js.map

package/dist/security/scanner/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/security/scanner/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,mCAAmC;AACnC,OAAO,EACL,uBAAuB,EACvB,uBAAuB,EACvB,kBAAkB,EAClB,mBAAmB,EACnB,2BAA2B,EAC3B,uBAAuB,EACvB,0BAA0B,EAC1B,6BAA6B,EAC7B,mBAAmB,EACnB,yBAAyB,EACzB,YAAY,GACb,MAAM,eAAe,CAAA;AAEtB,kCAAkC;AAClC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAA;AAEjE,0CAA0C;AAC1C,OAAO,EAAE,yBAAyB,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAA;AAE3F,aAAa;AACb,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAA"}

package/dist/security/scanner/patterns.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Security Scanner Patterns - SMI-587, SMI-685, SMI-1189
+ *
+ * Pattern definitions for security scanning.
+ */
+export declare const DEFAULT_ALLOWED_DOMAINS: string[];
+export declare const SENSITIVE_PATH_PATTERNS: RegExp[];
+export declare const JAILBREAK_PATTERNS: RegExp[];
+export declare const SUSPICIOUS_PATTERNS: RegExp[];
+export declare const SOCIAL_ENGINEERING_PATTERNS: RegExp[];
+export declare const PROMPT_LEAKING_PATTERNS: RegExp[];
+export declare const DATA_EXFILTRATION_PATTERNS: RegExp[];
+export declare const PRIVILEGE_ESCALATION_PATTERNS: RegExp[];
+/**
+ * SMI-3509: SSRF instruction patterns
+ * Detects content instructing fetches to internal/dangerous endpoints.
+ * These are text-oriented patterns for skill content scanning (not URL validators).
+ */
+export declare const SSRF_INSTRUCTION_PATTERNS: RegExp[];
+/**
+ * SMI-1532: AIDefence CVE-hardened injection patterns
+ * Optimized for sub-10ms scan time with compiled regex and no backtracking
+ *
+ * These patterns detect sophisticated prompt injection attacks based on
+ * known CVEs and security research findings.
+ *
+ * References:
+ * - OWASP LLM Top 10: LLM01 Prompt Injection
+ * - Anthropic Responsible Disclosure Program findings
+ * - Academic research on prompt injection attacks
+ */
+/**
+ * SMI-3864: PII detection patterns
+ * Detects personally identifiable information and credentials in skill content.
+ * Complements AIDefence's aidefence_has_pii() for offline/local scanning.
+ */
+export declare const PII_PATTERNS: RegExp[];
+export declare const AI_DEFENCE_PATTERNS: RegExp[];
+//# sourceMappingURL=patterns.d.ts.map

package/dist/security/scanner/patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../../../src/security/scanner/patterns.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,eAAO,MAAM,uBAAuB,UAanC,CAAA;AAOD,eAAO,MAAM,uBAAuB,UAsBnC,CAAA;AAGD,eAAO,MAAM,kBAAkB,UAkB9B,CAAA;AAGD,eAAO,MAAM,mBAAmB,UAY/B,CAAA;AAGD,eAAO,MAAM,2BAA2B,UAavC,CAAA;AAGD,eAAO,MAAM,uBAAuB,UAenC,CAAA;AAGD,eAAO,MAAM,0BAA0B,UAuCtC,CAAA;AAGD,eAAO,MAAM,6BAA6B,UAkCzC,CAAA;AAED;;;;GAIG;AACH,eAAO,MAAM,yBAAyB,UAuBrC,CAAA;AAED;;;;;;;;;;;GAWG;AACH;;;;GAIG;AACH,eAAO,MAAM,YAAY,UAwBxB,CAAA;AAED,eAAO,MAAM,mBAAmB,UAwD/B,CAAA"}