@skillsmith/core 0.8.2 → 0.10.0

package/dist/src/services/bundled-sibling-scan.js

@@ -0,0 +1,170 @@
+/**
+ * @fileoverview Bundled-sibling security scan for the local rescan path (SMI-5422 Phase 2).
+ * @module @skillsmith/core/services/bundled-sibling-scan
+ *
+ * Walks an installed skill's bundle directory and scans its sibling bundled
+ * files (`.mcp.json`, `.claude/settings*.json`, `package.json` lifecycle hooks,
+ * `config.json`, `scripts/*.sh` + top-level `*.sh`) so `skill_rescan` can
+ * quarantine a skill whose MALICIOUS sibling — not its `SKILL.md` — carries the
+ * threat (CVE-2025-59536 hook execution, `curl|bash` postinstall, a
+ * remote-fetch-execute install script).
+ *
+ * This is the local-FS rescan analogue of the Phase-1 install/validate helpers —
+ * NOT a duplicate. The three callers intentionally differ:
+ *   - install:  `skill-installation.io.ts` `fetchAndScanOptionalFiles` (fetch-by-path, no glob)
+ *   - validate: mcp-server `validate-bundled-scan.ts` `scanBundledSiblings` (returns ValidationError[])
+ *   - rescan (this): directory walk + symlink-safe reads + structured result.
+ *
+ * DELIBERATE FP-SAFE DIVERGENCE (Phase 2 review B1, verified empirically):
+ * install/validate reject via `isRejectableScan` (= `!report.passed` OR a
+ * `code_execution`/`obfuscated_directive` finding). The `!report.passed` clause
+ * fires on ANY high/critical finding, and sibling files are non-markdown so they
+ * get NO documentation-context downgrade — so routine, benign script idioms fire
+ * at full severity and would quarantine a working skill:
+ *   `chmod 755 ./bin/cli`     => privilege_escalation:critical => !passed
+ *   `cp .env.example .env`    => sensitive_path:high           => !passed
+ *   `source .env` / `export X=$1` / `cat ~/.ssh/...` => sensitive_path:high
+ * For an ALREADY-INSTALLED skill that false positive hides a working skill from
+ * local search. So this module drives the quarantine decision SOLELY from
+ * `code_execution`/`obfuscated_directive` presence (still catches `curl|bash`).
+ * The root cause — privilege_escalation/sensitive_path over-firing in
+ * non-markdown execution contexts (which is the SAME latent FP on the install
+ * path) — is tracked in SMI-5424; once those patterns are narrowed at the
+ * source, all three callers can safely share the broader criterion.
+ *
+ * INHERITED DETECTION GAPS (FN, tracked SMI-5424): bare-interpreter hook
+ * payloads (`node evil.js`, `python evil.py`, `bun`/`deno`), `&&`/`;`-chained
+ * fetch-then-exec, `npx`, and JSON `\uXXXX`-escaped commands inside raw-scanned
+ * structured files are NOT detected. `.js`/`.py`/`.mjs`/`.ts` payload files and
+ * nested/non-`scripts/` `.sh` are a Phase-3 follow-up (recursive bundle walk).
+ * COUNT-CAP DECOY-PADDING (FN): the fixed bundled files are cap-exempt, but the
+ * `.sh` glob is capped — an author can name the malicious script to sort last
+ * and pad `scripts/` with cap-many benign decoys so it lands in `droppedForCount`
+ * and is never scanned. This is surfaced (never a silent drop) but not blocked;
+ * a cumulative-resource bound is a Phase-3 follow-up.
+ *
+ * config.json IS scanned here (only doc-class siblings are skipped), whereas the
+ * Phase-1 validate helper (validate-bundled-scan.ts) also skips `config` — rescan
+ * is the deliberately stricter superset because it is a quarantine path.
+ */
+import { join } from 'path';
+import { safeFs, resolveSafeRealpath } from '../sources/LocalFilesystemAdapter.helpers.js';
+import { BUNDLED_SCAN_FILES, classifyBundledFile, extractPackageJsonLifecycleScripts, } from './skill-installation.policy.js';
+/** Max `.sh` glob files scanned per skill (fixed bundled files are exempt). */
+export const MAX_SIBLING_SH_FILES = 50;
+/** Per-file byte ceiling; larger siblings are skipped (recorded, never silent). */
+export const MAX_SIBLING_FILE_BYTES = 512 * 1024;
+/** A finding is a quarantine driver only if it is a direct execution threat. */
+function isExecutionThreat(finding) {
+    return finding.type === 'code_execution' || finding.type === 'obfuscated_directive';
+}
+/**
+ * Collect `*.sh` candidates: top-level then `scripts/`, regular files only
+ * (symlinked scripts are not followed by the glob — Phase 3). Sorted so the cap
+ * and `droppedForCount` are reproducible rather than dependent on readdir order.
+ * NOTE: sorting does NOT defeat decoy-padding — an author can name the malicious
+ * file to sort last; that residual FN is documented in the module header and the
+ * dropped names are always surfaced in `droppedForCount` (no silent drop).
+ */
+async function collectShFiles(skillDir) {
+    const out = [];
+    const top = await safeFs.readdir(skillDir);
+    if (top.ok) {
+        for (const e of top.value) {
+            if (e.isFile() && e.name.endsWith('.sh'))
+                out.push(e.name);
+        }
+    }
+    const scripts = await safeFs.readdir(join(skillDir, 'scripts'));
+    if (scripts.ok) {
+        for (const e of scripts.value) {
+            if (e.isFile() && e.name.endsWith('.sh'))
+                out.push(join('scripts', e.name));
+        }
+    }
+    return out.sort();
+}
+/**
+ * Scan a skill bundle's sibling files and return the structured result.
+ *
+ * Fixed {@link BUNDLED_SCAN_FILES} are always scanned (exempt from the count
+ * cap, so a decoy-padding attack on `scripts/` cannot push the primary hook /
+ * postinstall surface out of the scan window). The `.sh` glob is capped and
+ * any overflow is reported in `droppedForCount`.
+ *
+ * Doc-class siblings (`README.md`, `examples.md`) are intentionally NOT scanned:
+ * prose routinely quotes attack strings, so they can never drive a quarantine
+ * (Phase-1 H6 control). Every read is symlink-safe via `resolveSafeRealpath`
+ * (containment to `skillDir`, SMI-4287) and reads the resolved realpath.
+ *
+ * @param skillDir absolute path to the installed skill's bundle directory
+ * @param scanner  a constructed SecurityScanner (injected to keep this module DB-free)
+ * @param opts     optional caps
+ */
+export async function scanLocalBundleSiblings(skillDir, scanner, opts = {}) {
+    const maxShFiles = opts.maxShFiles ?? MAX_SIBLING_SH_FILES;
+    const maxBytes = opts.maxBytesPerFile ?? MAX_SIBLING_FILE_BYTES;
+    const result = {
+        findings: [],
+        rejectable: false,
+        rejectableFindings: [],
+        rejectableFiles: [],
+        scannedFiles: [],
+        maxSiblingRiskScore: 0,
+        droppedForCount: [],
+        skippedOversize: [],
+        skippedSymlinkEscape: [],
+    };
+    const shFiles = await collectShFiles(skillDir);
+    result.droppedForCount = shFiles.slice(maxShFiles);
+    // Fixed files first (cap-exempt), then the capped, sorted .sh glob.
+    const candidates = [...BUNDLED_SCAN_FILES, ...shFiles.slice(0, maxShFiles)];
+    for (const rel of candidates) {
+        const fileClass = classifyBundledFile(rel);
+        if (fileClass === 'doc')
+            continue; // prose quotes attack strings (H6) — never scanned
+        const abs = join(skillDir, rel);
+        const resolved = await resolveSafeRealpath(abs, skillDir, {});
+        if (!resolved.ok) {
+            // not-found = sibling absent (silent skip). symlink-escape = SMI-4287 guard.
+            // loop/permission/io = unreadable; skip (the file contributes no signal).
+            if (resolved.error.code === 'symlink-escape')
+                result.skippedSymlinkEscape.push(rel);
+            continue;
+        }
+        const realPath = resolved.value;
+        const st = await safeFs.stat(realPath);
+        if (!st.ok)
+            continue;
+        if (st.value.size > maxBytes) {
+            result.skippedOversize.push(rel);
+            continue;
+        }
+        const read = await safeFs.readFile(realPath);
+        if (!read.ok)
+            continue;
+        let textToScan = read.value;
+        if (fileClass === 'package-json') {
+            const lifecycle = extractPackageJsonLifecycleScripts(read.value);
+            if (lifecycle.length === 0)
+                continue; // no install-time hooks — nothing risky
+            textToScan = lifecycle;
+        }
+        const report = scanner.scan(`${skillDir}/${rel}`, textToScan);
+        result.scannedFiles.push(rel);
+        // Fresh objects (no mutation of the report's findings array) tagged with the file.
+        const tagged = report.findings.map((f) => ({ ...f, location: rel }));
+        result.findings.push(...tagged);
+        const drivers = tagged.filter(isExecutionThreat);
+        if (drivers.length > 0) {
+            result.rejectable = true;
+            result.rejectableFindings.push(...drivers);
+            result.rejectableFiles.push(rel);
+            // Only a REJECTING sibling contributes to the surfaced score, so a benign
+            // high-scoring sibling cannot mis-attribute the quarantine's riskScore.
+            result.maxSiblingRiskScore = Math.max(result.maxSiblingRiskScore, report.riskScore);
+        }
+    }
+    return result;
+}
+//# sourceMappingURL=bundled-sibling-scan.js.map

package/dist/src/services/bundled-sibling-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundled-sibling-scan.js","sourceRoot":"","sources":["../../../src/services/bundled-sibling-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgDG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAA;AAM3B,OAAO,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM,8CAA8C,CAAA;AAC1F,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kCAAkC,GACnC,MAAM,gCAAgC,CAAA;AAEvC,+EAA+E;AAC/E,MAAM,CAAC,MAAM,oBAAoB,GAAG,EAAE,CAAA;AACtC,mFAAmF;AACnF,MAAM,CAAC,MAAM,sBAAsB,GAAG,GAAG,GAAG,IAAI,CAAA;AAyChD,gFAAgF;AAChF,SAAS,iBAAiB,CAAC,OAAwB;IACjD,OAAO,OAAO,CAAC,IAAI,KAAK,gBAAgB,IAAI,OAAO,CAAC,IAAI,KAAK,sBAAsB,CAAA;AACrF,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,cAAc,CAAC,QAAgB;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAA;IAC1C,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YAC1B,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC5D,CAAC;IACH,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAA;IAC/D,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QACf,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,KAAK,EAAE,CAAC;YAC9B,IAAI,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAA;QAC7E,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC,IAAI,EAAE,CAAA;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,QAAgB,EAChB,OAAwB,EACxB,OAAkC,EAAE;IAEpC,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,oBAAoB,CAAA;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,eAAe,IAAI,sBAAsB,CAAA;IAE/D,MAAM,MAAM,GAA6B;QACvC,QAAQ,EAAE,EAAE;QACZ,UAAU,EAAE,KAAK;QACjB,kBAAkB,EAAE,EAAE;QACtB,eAAe,EAAE,EAAE;QACnB,YAAY,EAAE,EAAE;QAChB,mBAAmB,EAAE,CAAC;QACtB,eAAe,EAAE,EAAE;QACnB,eAAe,EAAE,EAAE;QACnB,oBAAoB,EAAE,EAAE;KACzB,CAAA;IAED,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,CAAC,eAAe,GAAG,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC,CAAA;IAClD,oEAAoE;IACpE,MAAM,UAAU,GAAG,CAAC,GAAG,kBAAkB,EAAE,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC,CAAA;IAE3E,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAA;QAC1C,IAAI,SAAS,KAAK,KAAK;YAAE,SAAQ,CAAC,mDAAmD;QAErF,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAA;QAC/B,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAC,GAAG,EAAE,QAAQ,EAAE,EAAE,CAAC,CAAA;QAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,6EAA6E;YAC7E,0EAA0E;YAC1E,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,gBAAgB;gBAAE,MAAM,CAAC,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YACnF,SAAQ;QACV,CAAC;QACD,MAAM,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAA;QAE/B,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACtC,IAAI,CAAC,EAAE,CAAC,EAAE;YAAE,SAAQ;QACpB,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YAC7B,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAChC,SAAQ;QACV,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAA;QAC5C,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,SAAQ;QAEtB,IAAI,UAAU,GAAW,IAAI,CAAC,KAAK,CAAA;QACnC,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;YACjC,MAAM,SAAS,GAAG,kCAAkC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;YAChE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC;gBAAE,SAAQ,CAAC,wCAAwC;YAC7E,UAAU,GAAG,SAAS,CAAA;QACxB,CAAC;QAED,MAAM,MAAM,GAAe,OAAO,CAAC,IAAI,CAAC,GAAG,QAAQ,IAAI,GAAG,EAAE,EAAE,UAAU,CAAC,CAAA;QACzE,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAE7B,mFAAmF;QACnF,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,QAAQ,EAAE,GAAG,EAAE,CAAC,CAAC,CAAA;QACpE,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,CAAA;QAE/B,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAA;QAChD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACvB,MAAM,CAAC,UAAU,GAAG,IAAI,CAAA;YACxB,MAAM,CAAC,kBAAkB,CAAC,IAAI,CAAC,GAAG,OAAO,CAAC,CAAA;YAC1C,MAAM,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;YAChC,0EAA0E;YAC1E,wEAAwE;YACxE,MAAM,CAAC,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,mBAAmB,EAAE,MAAM,CAAC,SAAS,CAAC,CAAA;QACrF,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAA;AACf,CAAC"}

package/dist/src/services/skill-installation.io.d.ts

@@ -33,11 +33,22 @@ export interface OptionalInstallFilesResult {
     }>;
 }
 /**
- * SMI-5359 Gap-1: fetch + scan the optional install files WITHOUT writing them.
- * The caller runs this BEFORE writeInstallFiles, rejects on any `failedScans`,
- * and only then writes `filesToWrite` (so a malicious optional file can never
- * leave a partially-installed skill on disk). A fetch/404 error is a silent
- * skip (NOT a scan failure); a config.json that fails scanning IS a rejection.
+ * SMI-5359 Gap-1 / SMI-5422 Phase 1: fetch + scan the optional install files
+ * WITHOUT writing them. The caller runs this BEFORE writeInstallFiles, rejects
+ * on any `failedScans`, and only then writes `filesToWrite` (so a malicious
+ * optional file can never leave a partially-installed skill on disk).
+ *
+ * Per-file policy (see skill-installation.policy.ts for the authoritative spec):
+ *   doc          – scan failure is a silent skip (FP control H6).
+ *   config       – hard-reject on scan failure (pre-existing behaviour).
+ *   structured   – hard-reject on scan failure, all trust tiers.
+ *   package-json – KEY-LEVEL: only lifecycle-hook script values are scanned.
+ *                  A package.json with no lifecycle hooks is never rejected.
+ *
+ * A fetch/404 error is always a silent skip (NOT a scan failure).
+ *
+ * Phase 3 follow-up: directory-glob scanning (e.g. scripts/*.sh) is out of
+ * scope here — fetchFromGitHub fetches by exact path only.
  */
 export declare function fetchAndScanOptionalFiles(owner: string, repo: string, basePath: string, branch: string, skillId: string, scannerOptions: ScannerOptions | null): Promise<OptionalInstallFilesResult>;
 //# sourceMappingURL=skill-installation.io.d.ts.map

package/dist/src/services/skill-installation.io.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-installation.io.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.io.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAGtE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQ1E;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAe,GACtB,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,MAAM,EACzB,aAAa,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,EAC3D,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,kBAAkB,CAAC,CA0E7B;AAED,MAAM,WAAW,0BAA0B;IACzC,uEAAuE;IACvE,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAAA;IACxD,4EAA4E;IAC5E,YAAY,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D;AASD;;;;;;GAMG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,cAAc,GAAG,IAAI,GACpC,OAAO,CAAC,0BAA0B,CAAC,CA+BrC"}
+{"version":3,"file":"skill-installation.io.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.io.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAOH,OAAO,KAAK,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAA;AAStE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAQ1E;AAED,wBAAsB,eAAe,CACnC,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,GAAE,MAAe,GACtB,OAAO,CAAC,MAAM,CAAC,CAuBjB;AAED,wBAAsB,qBAAqB,CACzC,SAAS,EAAE,MAAM,EACjB,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,OAAO,CAAC,CAkBlB;AAED,MAAM,WAAW,kBAAkB;IACjC,YAAY,EAAE,MAAM,EAAE,CAAA;IACtB,YAAY,CAAC,EAAE,MAAM,CAAA;CACtB;AAED,wBAAsB,iBAAiB,CACrC,WAAW,EAAE,MAAM,EACnB,SAAS,EAAE,MAAM,EACjB,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,MAAM,EACzB,aAAa,EAAE,KAAK,CAAC;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,EAC3D,eAAe,EAAE,MAAM,GAAG,SAAS,GAClC,OAAO,CAAC,kBAAkB,CAAC,CA0E7B;AAED,MAAM,WAAW,0BAA0B;IACzC,uEAAuE;IACvE,cAAc,EAAE,MAAM,EAAE,CAAA;IACxB;;;OAGG;IACH,WAAW,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,UAAU,CAAA;KAAE,CAAC,CAAA;IACxD,4EAA4E;IAC5E,YAAY,EAAE,KAAK,CAAC;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC3D;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,yBAAyB,CAC7C,KAAK,EAAE,MAAM,EACb,IAAI,EAAE,MAAM,EACZ,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,cAAc,EAAE,cAAc,GAAG,IAAI,GACpC,OAAO,CAAC,0BAA0B,CAAC,CAgDrC"}

package/dist/src/services/skill-installation.io.js

@@ -9,6 +9,7 @@ import * as os from 'os';
 import { safeWriteFile } from '../utils/safe-fs.js';
 import { SecurityScanner } from '../security/index.js';
 import { validateOptionalConfig } from './skill-installation.validate.js';
+import { BUNDLED_SCAN_FILES, classifyBundledFile, extractPackageJsonLifecycleScripts, isRejectableScan, } from './skill-installation.policy.js';
 export function assertNotEncrypted(content, filePath) {
     if (content.startsWith('\x00GITCRYPT')) {
         throw new Error('File "' +
@@ -126,41 +127,64 @@ export async function writeInstallFiles(installPath, skillsDir, skillName, final
     return { writtenFiles, subagentPath };
 }
 /**
- * Prose-documentation optional files: they routinely quote attack strings as
- * examples, so a scan failure on these is skipped (FP control, H6) rather than
- * rejecting the install. Non-doc optional files (config.json) DO hard-reject.
- */
-const DOC_OPTIONAL_FILES = new Set(['README.md', 'examples.md']);
-/**
- * SMI-5359 Gap-1: fetch + scan the optional install files WITHOUT writing them.
- * The caller runs this BEFORE writeInstallFiles, rejects on any `failedScans`,
- * and only then writes `filesToWrite` (so a malicious optional file can never
- * leave a partially-installed skill on disk). A fetch/404 error is a silent
- * skip (NOT a scan failure); a config.json that fails scanning IS a rejection.
+ * SMI-5359 Gap-1 / SMI-5422 Phase 1: fetch + scan the optional install files
+ * WITHOUT writing them. The caller runs this BEFORE writeInstallFiles, rejects
+ * on any `failedScans`, and only then writes `filesToWrite` (so a malicious
+ * optional file can never leave a partially-installed skill on disk).
+ *
+ * Per-file policy (see skill-installation.policy.ts for the authoritative spec):
+ *   doc          – scan failure is a silent skip (FP control H6).
+ *   config       – hard-reject on scan failure (pre-existing behaviour).
+ *   structured   – hard-reject on scan failure, all trust tiers.
+ *   package-json – KEY-LEVEL: only lifecycle-hook script values are scanned.
+ *                  A package.json with no lifecycle hooks is never rejected.
+ *
+ * A fetch/404 error is always a silent skip (NOT a scan failure).
+ *
+ * Phase 3 follow-up: directory-glob scanning (e.g. scripts/*.sh) is out of
+ * scope here — fetchFromGitHub fetches by exact path only.
  */
 export async function fetchAndScanOptionalFiles(owner, repo, basePath, branch, skillId, scannerOptions) {
     const optionalFileScanner = scannerOptions ? new SecurityScanner(scannerOptions) : null;
-    const optionalFiles = ['README.md', 'examples.md', 'config.json'];
     const configWarnings = [];
     const failedScans = [];
     const filesToWrite = [];
-    for (const file of optionalFiles) {
+    for (const file of BUNDLED_SCAN_FILES) {
         let content;
         try {
             content = await fetchFromGitHub(owner, repo, basePath + file, branch);
         }
         catch {
-            // Optional file absent / fetch failed — fine to skip (NOT a scan failure).
+            // Optional file absent / fetch failed — silent skip (NOT a scan failure).
             continue;
         }
         if (optionalFileScanner) {
-            const fileScan = optionalFileScanner.scan(skillId + '/' + file, content);
-            if (!fileScan.passed) {
-                // H6: prose docs quote attack strings — skip, never reject the install.
-                if (DOC_OPTIONAL_FILES.has(file))
+            const fileClass = classifyBundledFile(file);
+            // Determine the text to scan. For package-json, only lifecycle hook values;
+            // for everything else, the full file content.
+            let textToScan;
+            if (fileClass === 'package-json') {
+                const lifecycle = extractPackageJsonLifecycleScripts(content);
+                // Empty string means no install-time hooks — nothing risky to scan.
+                textToScan = lifecycle.length > 0 ? lifecycle : null;
+            }
+            else {
+                textToScan = content;
+            }
+            if (textToScan !== null) {
+                const fileScan = optionalFileScanner.scan(skillId + '/' + file, textToScan);
+                // Hard-reject classes also reject on a lone code_execution / obfuscated_
+                // directive finding (medium severity), which `passed` alone would miss —
+                // remote-fetch-execute / concealed directives have no place in a hook
+                // or config file (SMI-5422 Phase 1; isRejectableScan is FP-safe).
+                if (isRejectableScan(fileScan)) {
+                    // H6 FP control: prose docs quote attack strings — never hard-reject.
+                    if (fileClass === 'doc')
+                        continue;
+                    // config, structured, and package-json all hard-reject on failure.
+                    failedScans.push({ file, report: fileScan });
                     continue;
-                failedScans.push({ file, report: fileScan });
-                continue;
+                }
             }
         }
         if (file === 'config.json') {

package/dist/src/services/skill-installation.io.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill-installation.io.js","sourceRoot":"","sources":["../../../src/services/skill-installation.io.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AAEzE,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,QAAgB;IAClE,IAAI,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,QAAQ;YACN,QAAQ;YACR,sGAAsG,CACzG,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,SAAiB,MAAM;IAEvB,MAAM,GAAG,GACP,oCAAoC,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAA;IAC3F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IAEjC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,SAAS,GACb,oCAAoC,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,UAAU,GAAG,QAAQ,CAAA;YACnF,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAA;YAC7C,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;YACzE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAA;YAC9C,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YACxC,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAClC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAElE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACrC,IAAI,KAAK,CAAC,KAAK,GAAG,WAAW,EAAE,CAAC;oBAC9B,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,SAAiB,EACjB,SAAiB,EACjB,iBAAyB,EACzB,aAA2D,EAC3D,eAAmC;IAEnC,MAAM,YAAY,GAAa,EAAE,CAAA;IACjC,IAAI,YAAgC,CAAA;IACpC,mFAAmF;IACnF,gFAAgF;IAChF,kFAAkF;IAClF,mFAAmF;IACnF,6CAA6C;IAC7C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACjD,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACjD,IACE,eAAe,KAAK,iBAAiB;QACrC,CAAC,eAAe,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,EACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,WAAW,CAAC,CAAA;IACpF,CAAC;IACD,oFAAoF;IACpF,qFAAqF;IACrF,mFAAmF;IACnF,8BAA8B;IAC9B,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,uFAAuF;QACvF,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACtD,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;QACxF,IACE,CAAC,eAAe,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;YACtD,eAAe,KAAK,cAAc,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,GAAG,WAAW,CAAC,CAAA;QACrF,CAAC;QACD,aAAa,GAAG,IAAI,CAAA;QAEpB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;QACxD,MAAM,aAAa,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;QACrD,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAChC,+BAA+B;QAC/B,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;gBACzD,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAC9C,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC5B,CAAC,CAAC,CACH,CAAA;QACH,CAAC;QACD,wCAAwC;QACxC,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;YAC9D,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC9C,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,gBAAgB,CAAC,CAAA;YACjE,MAAM,aAAa,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;YAClD,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QACpB,8EAA8E;QAC9E,wCAAwC;QACxC,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;YACpC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC3C,CAAC;QACD,+EAA+E;QAC/E,oFAAoF;QACpF,8EAA8E;QAC9E,gFAAgF;QAChF,mFAAmF;QACnF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5E,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC7C,CAAC;QACD,MAAM,UAAU,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAA;AACvC,CAAC;AAcD;;;;GAIG;AACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC,CAAA;AAEhE;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,MAAc,EACd,OAAe,EACf,cAAqC;IAErC,MAAM,mBAAmB,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvF,MAAM,aAAa,GAAG,CAAC,WAAW,EAAE,aAAa,EAAE,aAAa,CAAC,CAAA;IACjE,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,MAAM,WAAW,GAAgD,EAAE,CAAA;IACnE,MAAM,YAAY,GAAiD,EAAE,CAAA;IACrE,KAAK,MAAM,IAAI,IAAI,aAAa,EAAE,CAAC;QACjC,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,MAAM,CAAC,CAAA;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,2EAA2E;YAC3E,SAAQ;QACV,CAAC;QACD,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;YACxE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;gBACrB,wEAAwE;gBACxE,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAQ;gBAC1C,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;gBAC5C,SAAQ;YACV,CAAC;QACH,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;YACnD,IAAI,CAAC,WAAW,CAAC,KAAK;gBAAE,SAAQ,CAAC,gCAAgC;YACjE,cAAc,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;QAC9C,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,CAAA;AACtD,CAAC"}
+{"version":3,"file":"skill-installation.io.js","sourceRoot":"","sources":["../../../src/services/skill-installation.io.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,EAAE,MAAM,aAAa,CAAA;AACjC,OAAO,KAAK,IAAI,MAAM,MAAM,CAAA;AAC5B,OAAO,KAAK,EAAE,MAAM,IAAI,CAAA;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAA;AACnD,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAA;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,kCAAkC,CAAA;AACzE,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,kCAAkC,EAClC,gBAAgB,GACjB,MAAM,gCAAgC,CAAA;AAEvC,MAAM,UAAU,kBAAkB,CAAC,OAAe,EAAE,QAAgB;IAClE,IAAI,OAAO,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CACb,QAAQ;YACN,QAAQ;YACR,sGAAsG,CACzG,CAAA;IACH,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,SAAiB,MAAM;IAEvB,MAAM,GAAG,GACP,oCAAoC,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,MAAM,GAAG,GAAG,GAAG,QAAQ,CAAA;IAC3F,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,CAAA;IAEjC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,SAAS,GACb,oCAAoC,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,GAAG,UAAU,GAAG,QAAQ,CAAA;YACnF,MAAM,cAAc,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAA;YAC7C,IAAI,CAAC,cAAc,CAAC,EAAE,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;YACzE,CAAC;YACD,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,IAAI,EAAE,CAAA;YAC9C,kBAAkB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAA;YACxC,OAAO,UAAU,CAAA;QACnB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kBAAkB,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAA;IACzE,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAA;IAClC,kBAAkB,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAA;IAClC,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,SAAiB,EACjB,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,IAAI,CAAC,WAAW,CAAC,CAAA;QACzC,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;QAElE,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;gBAClB,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,CAAA;gBAChD,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;gBACrC,IAAI,KAAK,CAAC,KAAK,GAAG,WAAW,EAAE,CAAC;oBAC9B,OAAO,IAAI,CAAA;gBACb,CAAC;YACH,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAA;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAOD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,WAAmB,EACnB,SAAiB,EACjB,SAAiB,EACjB,iBAAyB,EACzB,aAA2D,EAC3D,eAAmC;IAEnC,MAAM,YAAY,GAAa,EAAE,CAAA;IACjC,IAAI,YAAgC,CAAA;IACpC,mFAAmF;IACnF,gFAAgF;IAChF,kFAAkF;IAClF,mFAAmF;IACnF,6CAA6C;IAC7C,MAAM,eAAe,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,CAAA;IACjD,MAAM,iBAAiB,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAA;IACjD,IACE,eAAe,KAAK,iBAAiB;QACrC,CAAC,eAAe,CAAC,UAAU,CAAC,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,EACzD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,mDAAmD,GAAG,WAAW,CAAC,CAAA;IACpF,CAAC;IACD,oFAAoF;IACpF,qFAAqF;IACrF,mFAAmF;IACnF,8BAA8B;IAC9B,IAAI,aAAa,GAAG,KAAK,CAAA;IACzB,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;QAChD,uFAAuF;QACvF,MAAM,eAAe,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAA;QACtD,MAAM,cAAc,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,CAAA;QACxF,IACE,CAAC,eAAe,CAAC,UAAU,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,CAAC;YACtD,eAAe,KAAK,cAAc,EAClC,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,oDAAoD,GAAG,WAAW,CAAC,CAAA;QACrF,CAAC;QACD,aAAa,GAAG,IAAI,CAAA;QAEpB,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,UAAU,CAAC,CAAA;QACxD,MAAM,aAAa,CAAC,aAAa,EAAE,iBAAiB,CAAC,CAAA;QACrD,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QAChC,+BAA+B;QAC/B,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7B,MAAM,OAAO,CAAC,GAAG,CACf,aAAa,CAAC,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,EAAE;gBACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAA;gBACzD,MAAM,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAA;gBAC9C,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAA;YAC5B,CAAC,CAAC,CACH,CAAA;QACH,CAAC;QACD,wCAAwC;QACxC,IAAI,eAAe,EAAE,CAAC;YACpB,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAA;YAC9D,MAAM,EAAE,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;YAC9C,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,GAAG,gBAAgB,CAAC,CAAA;YACjE,MAAM,aAAa,CAAC,YAAY,EAAE,eAAe,CAAC,CAAA;YAClD,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACjC,CAAC;IACH,CAAC;IAAC,OAAO,UAAU,EAAE,CAAC;QACpB,8EAA8E;QAC9E,wCAAwC;QACxC,KAAK,MAAM,QAAQ,IAAI,YAAY,EAAE,CAAC;YACpC,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC3C,CAAC;QACD,+EAA+E;QAC/E,oFAAoF;QACpF,8EAA8E;QAC9E,gFAAgF;QAChF,mFAAmF;QACnF,IAAI,aAAa,EAAE,CAAC;YAClB,MAAM,EAAE,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC5E,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC7C,CAAC;QACD,MAAM,UAAU,CAAA;IAClB,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,CAAA;AACvC,CAAC;AAcD;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAa,EACb,IAAY,EACZ,QAAgB,EAChB,MAAc,EACd,OAAe,EACf,cAAqC;IAErC,MAAM,mBAAmB,GAAG,cAAc,CAAC,CAAC,CAAC,IAAI,eAAe,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAA;IACvF,MAAM,cAAc,GAAa,EAAE,CAAA;IACnC,MAAM,WAAW,GAAgD,EAAE,CAAA;IACnE,MAAM,YAAY,GAAiD,EAAE,CAAA;IACrE,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;QACtC,IAAI,OAAe,CAAA;QACnB,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,eAAe,CAAC,KAAK,EAAE,IAAI,EAAE,QAAQ,GAAG,IAAI,EAAE,MAAM,CAAC,CAAA;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,0EAA0E;YAC1E,SAAQ;QACV,CAAC;QACD,IAAI,mBAAmB,EAAE,CAAC;YACxB,MAAM,SAAS,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAA;YAC3C,4EAA4E;YAC5E,8CAA8C;YAC9C,IAAI,UAAyB,CAAA;YAC7B,IAAI,SAAS,KAAK,cAAc,EAAE,CAAC;gBACjC,MAAM,SAAS,GAAG,kCAAkC,CAAC,OAAO,CAAC,CAAA;gBAC7D,oEAAoE;gBACpE,UAAU,GAAG,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAA;YACtD,CAAC;iBAAM,CAAC;gBACN,UAAU,GAAG,OAAO,CAAA;YACtB,CAAC;YACD,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;gBACxB,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,CAAC,OAAO,GAAG,GAAG,GAAG,IAAI,EAAE,UAAU,CAAC,CAAA;gBAC3E,yEAAyE;gBACzE,yEAAyE;gBACzE,sEAAsE;gBACtE,kEAAkE;gBAClE,IAAI,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC;oBAC/B,sEAAsE;oBACtE,IAAI,SAAS,KAAK,KAAK;wBAAE,SAAQ;oBACjC,mEAAmE;oBACnE,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAA;oBAC5C,SAAQ;gBACV,CAAC;YACH,CAAC;QACH,CAAC;QACD,IAAI,IAAI,KAAK,aAAa,EAAE,CAAC;YAC3B,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,CAAC,CAAA;YACnD,IAAI,CAAC,WAAW,CAAC,KAAK;gBAAE,SAAQ,CAAC,gCAAgC;YACjE,cAAc,CAAC,IAAI,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,CAAA;QAC9C,CAAC;QACD,YAAY,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAA;IAChD,CAAC;IACD,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,CAAA;AACtD,CAAC"}

package/dist/src/services/skill-installation.policy.d.ts

@@ -0,0 +1,96 @@
+/**
+ * @fileoverview Scan policy for bundled optional files in the skill install path.
+ * @module @skillsmith/core/services/skill-installation.policy
+ * @see SMI-5422 Phase 1: widen the bundled-file scan corpus
+ *
+ * Kept in its own module so io.ts and mcp-server/validate.ts can share the
+ * policy without coupling to the full install service. The three exports —
+ * BUNDLED_SCAN_FILES, classifyBundledFile, extractPackageJsonLifecycleScripts —
+ * are the contract; everything else is implementation detail.
+ */
+/**
+ * Per-file scan policy classes for bundled optional install files.
+ *
+ *   doc          - Routine prose docs that routinely quote attack strings as
+ *                  examples (FP control H6). A scan failure is a SILENT SKIP —
+ *                  never a hard reject.
+ *   config       - Pre-existing skill config (config.json). Hard-reject on scan
+ *                  failure (pre-existing behaviour, no change in Phase 1).
+ *   structured   - Execution-environment files (.mcp.json, .claude/settings*).
+ *                  Hard-reject on scan failure, uniform across ALL trust tiers.
+ *   package-json - Only lifecycle-hook script VALUES are scanned, not the whole
+ *                  file. Hard-reject if that extracted text fails. A package.json
+ *                  with only test/lint scripts or dep ranges is never rejected.
+ */
+export type BundledFileClass = 'doc' | 'config' | 'structured' | 'package-json';
+/**
+ * Widened fixed-name file list for the install corpus (SMI-5422 Phase 1).
+ *
+ * The install path fetches each file by exact path via fetchFromGitHub — there
+ * is NO directory globbing. Files like scripts/*.sh are OUT of scope for Phase 1
+ * and are noted as a Phase 3 follow-up (directory-glob scanning).
+ */
+export declare const BUNDLED_SCAN_FILES: readonly ["README.md", "examples.md", "config.json", ".claude/settings.json", ".claude/settings.local.json", ".mcp.json", "package.json"];
+/** Union type of every file name in the bundled scan corpus. */
+export type BundledScanFile = (typeof BUNDLED_SCAN_FILES)[number];
+/**
+ * Return the scan-policy class for a bundled optional file.
+ *
+ * Unknown names fall back to 'structured' (hard-reject) so that a file added
+ * to BUNDLED_SCAN_FILES without a corresponding FILE_CLASS_MAP entry defaults
+ * to the conservative posture rather than silently skipped.
+ */
+export declare function classifyBundledFile(filename: string): BundledFileClass;
+/**
+ * Extract lifecycle-hook script values from raw package.json content.
+ *
+ * Returns a newline-joined string of all present lifecycle hook values, or ''
+ * when the file is malformed JSON or contains no lifecycle keys at all.
+ *
+ * An empty return means "no install-time execution risk" — the caller should
+ * write the file without scanning it. A package.json with only `scripts.test`,
+ * `scripts.lint`, dependency version ranges, or metadata fields will always
+ * produce '' here and is NEVER rejected.
+ *
+ * On JSON parse error: returns '' (silent skip). It is not the scanner's job
+ * to reject a malformed package.json — the npm toolchain handles that. A
+ * corrupt or non-JSON file simply contributes no risky text to scan.
+ */
+export declare function extractPackageJsonLifecycleScripts(content: string): string;
+/**
+ * SMI-5422 Phase 1: should a hard-reject-class file (config/structured/package-
+ * json) reject given its scan report?
+ *
+ * Rejects when the scan fails the standard gate (a high/critical finding OR
+ * score ≥ threshold) OR contains ANY `code_execution` / `obfuscated_directive`
+ * finding regardless of severity. Those two top-tier categories mean "remote
+ * fetch-and-execute" / "concealed directive". A lone such match scores only
+ * MEDIUM under the scanner's deliberate SKILL.md prose-FP-avoidance model — but
+ * inside a config / hook / lifecycle file there is no documentation-context
+ * excuse, so it must reject (this is the CVE-2025-59536 hook-execution threat).
+ *
+ * FP-safe: legit build commands (tsc, vitest, node-gyp rebuild, `rm -rf` of a
+ * cache dir) and the canonical `.mcp.json` shape (`{command:"node",args:[…]}`)
+ * do NOT match `code_execution` — it requires curl|wget piped to a shell with a
+ * real URL/domain target — so normal lifecycle scripts and server specs pass.
+ *
+ * KNOWN DETECTION GAPS (inherited from the scanner patterns, tracked in SMI-5424
+ * — these are scanner-pattern + edge-twin changes, out of scope for Phase 1's
+ * install plumbing): `&&`/`;`-chained or redirect-then-exec download+execute
+ * (`curl URL -o /tmp/s && bash /tmp/s`), `npx --yes <pkg>`, `fish`/`bun`/`deno`
+ * interpreter sinks, and JSON `\uXXXX`-escaped commands inside raw-scanned
+ * STRUCTURED files (.mcp.json / .claude/settings.json are scanned as raw text;
+ * package.json lifecycle values are JSON-parsed first, so they are escape-safe).
+ * Phase 1 catches what the scanner patterns detect across MORE files; it does
+ * not change the patterns.
+ *
+ * Typed structurally (not against ScanReport) to keep this policy module free of
+ * the scanner type graph.
+ */
+export declare function isRejectableScan(report: {
+    passed: boolean;
+    findings: ReadonlyArray<{
+        type: string;
+    }>;
+}): boolean;
+//# sourceMappingURL=skill-installation.policy.d.ts.map

package/dist/src/services/skill-installation.policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installation.policy.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH;;;;;;;;;;;;;GAaG;AACH,MAAM,MAAM,gBAAgB,GAAG,KAAK,GAAG,QAAQ,GAAG,YAAY,GAAG,cAAc,CAAA;AAE/E;;;;;;GAMG;AACH,eAAO,MAAM,kBAAkB,2IAQrB,CAAA;AAEV,gEAAgE;AAChE,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,kBAAkB,CAAC,CAAC,MAAM,CAAC,CAAA;AAoBjE;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,gBAAgB,CAEtE;AAqBD;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,kCAAkC,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAoB1E;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE;IACvC,MAAM,EAAE,OAAO,CAAA;IACf,QAAQ,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAC1C,GAAG,OAAO,CAKV"}

package/dist/src/services/skill-installation.policy.js

@@ -0,0 +1,144 @@
+/**
+ * @fileoverview Scan policy for bundled optional files in the skill install path.
+ * @module @skillsmith/core/services/skill-installation.policy
+ * @see SMI-5422 Phase 1: widen the bundled-file scan corpus
+ *
+ * Kept in its own module so io.ts and mcp-server/validate.ts can share the
+ * policy without coupling to the full install service. The three exports —
+ * BUNDLED_SCAN_FILES, classifyBundledFile, extractPackageJsonLifecycleScripts —
+ * are the contract; everything else is implementation detail.
+ */
+/**
+ * Widened fixed-name file list for the install corpus (SMI-5422 Phase 1).
+ *
+ * The install path fetches each file by exact path via fetchFromGitHub — there
+ * is NO directory globbing. Files like scripts/*.sh are OUT of scope for Phase 1
+ * and are noted as a Phase 3 follow-up (directory-glob scanning).
+ */
+export const BUNDLED_SCAN_FILES = [
+    'README.md',
+    'examples.md',
+    'config.json',
+    '.claude/settings.json',
+    '.claude/settings.local.json',
+    '.mcp.json',
+    'package.json',
+];
+/**
+ * Filename-to-class map for O(1) lookup.
+ *
+ * Design note: any name in BUNDLED_SCAN_FILES that lacks an entry here
+ * will fall through to the 'structured' default in classifyBundledFile —
+ * intentionally conservative so a future addition is hard-reject by default
+ * rather than silently skipped.
+ */
+const FILE_CLASS_MAP = {
+    'README.md': 'doc',
+    'examples.md': 'doc',
+    'config.json': 'config',
+    '.claude/settings.json': 'structured',
+    '.claude/settings.local.json': 'structured',
+    '.mcp.json': 'structured',
+    'package.json': 'package-json',
+};
+/**
+ * Return the scan-policy class for a bundled optional file.
+ *
+ * Unknown names fall back to 'structured' (hard-reject) so that a file added
+ * to BUNDLED_SCAN_FILES without a corresponding FILE_CLASS_MAP entry defaults
+ * to the conservative posture rather than silently skipped.
+ */
+export function classifyBundledFile(filename) {
+    return FILE_CLASS_MAP[filename] ?? 'structured';
+}
+/**
+ * npm lifecycle hook keys that run automatically during `npm install`.
+ *
+ * We scan ONLY the VALUES of these keys — not the whole package.json —
+ * to avoid false positives from dependency names, semver ranges, and HTTP
+ * URLs in other script fields (test, lint, format, etc.).
+ */
+const PKG_LIFECYCLE_KEYS = [
+    'preinstall',
+    'install',
+    'postinstall',
+    'prepare',
+    'prepublish',
+    'prepublishOnly',
+    'prepack',
+    'postpack',
+    'postpublish',
+];
+/**
+ * Extract lifecycle-hook script values from raw package.json content.
+ *
+ * Returns a newline-joined string of all present lifecycle hook values, or ''
+ * when the file is malformed JSON or contains no lifecycle keys at all.
+ *
+ * An empty return means "no install-time execution risk" — the caller should
+ * write the file without scanning it. A package.json with only `scripts.test`,
+ * `scripts.lint`, dependency version ranges, or metadata fields will always
+ * produce '' here and is NEVER rejected.
+ *
+ * On JSON parse error: returns '' (silent skip). It is not the scanner's job
+ * to reject a malformed package.json — the npm toolchain handles that. A
+ * corrupt or non-JSON file simply contributes no risky text to scan.
+ */
+export function extractPackageJsonLifecycleScripts(content) {
+    let parsed;
+    try {
+        parsed = JSON.parse(content);
+    }
+    catch {
+        return '';
+    }
+    if (typeof parsed !== 'object' || parsed === null)
+        return '';
+    const scripts = parsed.scripts;
+    if (typeof scripts !== 'object' || scripts === null)
+        return '';
+    const values = [];
+    for (const key of PKG_LIFECYCLE_KEYS) {
+        const val = scripts[key];
+        if (typeof val === 'string' && val.length > 0) {
+            values.push(val);
+        }
+    }
+    return values.join('\n');
+}
+/**
+ * SMI-5422 Phase 1: should a hard-reject-class file (config/structured/package-
+ * json) reject given its scan report?
+ *
+ * Rejects when the scan fails the standard gate (a high/critical finding OR
+ * score ≥ threshold) OR contains ANY `code_execution` / `obfuscated_directive`
+ * finding regardless of severity. Those two top-tier categories mean "remote
+ * fetch-and-execute" / "concealed directive". A lone such match scores only
+ * MEDIUM under the scanner's deliberate SKILL.md prose-FP-avoidance model — but
+ * inside a config / hook / lifecycle file there is no documentation-context
+ * excuse, so it must reject (this is the CVE-2025-59536 hook-execution threat).
+ *
+ * FP-safe: legit build commands (tsc, vitest, node-gyp rebuild, `rm -rf` of a
+ * cache dir) and the canonical `.mcp.json` shape (`{command:"node",args:[…]}`)
+ * do NOT match `code_execution` — it requires curl|wget piped to a shell with a
+ * real URL/domain target — so normal lifecycle scripts and server specs pass.
+ *
+ * KNOWN DETECTION GAPS (inherited from the scanner patterns, tracked in SMI-5424
+ * — these are scanner-pattern + edge-twin changes, out of scope for Phase 1's
+ * install plumbing): `&&`/`;`-chained or redirect-then-exec download+execute
+ * (`curl URL -o /tmp/s && bash /tmp/s`), `npx --yes <pkg>`, `fish`/`bun`/`deno`
+ * interpreter sinks, and JSON `\uXXXX`-escaped commands inside raw-scanned
+ * STRUCTURED files (.mcp.json / .claude/settings.json are scanned as raw text;
+ * package.json lifecycle values are JSON-parsed first, so they are escape-safe).
+ * Phase 1 catches what the scanner patterns detect across MORE files; it does
+ * not change the patterns.
+ *
+ * Typed structurally (not against ScanReport) to keep this policy module free of
+ * the scanner type graph.
+ */
+export function isRejectableScan(report) {
+    if (!report.passed)
+        return true;
+    return report.findings.some((f) => f.type === 'code_execution' || f.type === 'obfuscated_directive');
+}
+//# sourceMappingURL=skill-installation.policy.js.map

package/dist/src/services/skill-installation.policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-installation.policy.js","sourceRoot":"","sources":["../../../src/services/skill-installation.policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAkBH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,WAAW;IACX,aAAa;IACb,aAAa;IACb,uBAAuB;IACvB,6BAA6B;IAC7B,WAAW;IACX,cAAc;CACN,CAAA;AAKV;;;;;;;GAOG;AACH,MAAM,cAAc,GAAqC;IACvD,WAAW,EAAE,KAAK;IAClB,aAAa,EAAE,KAAK;IACpB,aAAa,EAAE,QAAQ;IACvB,uBAAuB,EAAE,YAAY;IACrC,6BAA6B,EAAE,YAAY;IAC3C,WAAW,EAAE,YAAY;IACzB,cAAc,EAAE,cAAc;CAC/B,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,cAAc,CAAC,QAAQ,CAAC,IAAI,YAAY,CAAA;AACjD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,kBAAkB,GAAG;IACzB,YAAY;IACZ,SAAS;IACT,aAAa;IACb,SAAS;IACT,YAAY;IACZ,gBAAgB;IAChB,SAAS;IACT,UAAU;IACV,aAAa;CACL,CAAA;AAEV;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kCAAkC,CAAC,OAAe;IAChE,IAAI,MAAe,CAAA;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAE5D,MAAM,OAAO,GAAI,MAAkC,CAAC,OAAO,CAAA;IAC3D,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAA;IAE9D,MAAM,MAAM,GAAa,EAAE,CAAA;IAC3B,KAAK,MAAM,GAAG,IAAI,kBAAkB,EAAE,CAAC;QACrC,MAAM,GAAG,GAAI,OAAmC,CAAC,GAAG,CAAC,CAAA;QACrD,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9C,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;QAClB,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC1B,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAGhC;IACC,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,IAAI,CAAA;IAC/B,OAAO,MAAM,CAAC,QAAQ,CAAC,IAAI,CACzB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,gBAAgB,IAAI,CAAC,CAAC,IAAI,KAAK,sBAAsB,CACxE,CAAA;AACH,CAAC"}

package/dist/src/services/skill-installation.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-installation.service.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.service.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACzE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAA;AAC7F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAA;AAC/F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,+BAA+B,CAAA;AA0BtC,MAAM,WAAW,8BAA8B;IAC7C,EAAE,EAAE,QAAQ,CAAA;IACZ,SAAS,EAAE,eAAe,CAAA;IAC1B,mBAAmB,EAAE,yBAAyB,CAAA;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAA;IACnC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,gBAAgB,GAAG,IAAI,CAAA;IAC/D,eAAe,CAAC,EAAE,0BAA0B,CAAA;IAC5C,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;CACtC;AACD,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAU;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA2B;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAgB;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAmB;IACtD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAU;IACnD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAA8C;IAChF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAA4B;IAC7D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAmB;gBAC1C,MAAM,EAAE,8BAA8B;IAc5C,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC;IAgW9E,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC;CAU7F"}
+{"version":3,"file":"skill-installation.service.d.ts","sourceRoot":"","sources":["../../../src/services/skill-installation.service.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,oCAAoC,CAAA;AACzE,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,8CAA8C,CAAA;AAC7F,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,+CAA+C,CAAA;AAC/F,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,6BAA6B,CAAA;AAC3D,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACvB,MAAM,+BAA+B,CAAA;AA0BtC,MAAM,WAAW,8BAA8B;IAC7C,EAAE,EAAE,QAAQ,CAAA;IACZ,SAAS,EAAE,eAAe,CAAA;IAC1B,mBAAmB,EAAE,yBAAyB,CAAA;IAC9C,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,UAAU,CAAC,EAAE,gBAAgB,CAAA;IAC7B,cAAc,CAAC,EAAE,cAAc,CAAA;IAC/B,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;IACrC,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAA;IACnC,gBAAgB,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,gBAAgB,GAAG,IAAI,CAAA;IAC/D,eAAe,CAAC,EAAE,0BAA0B,CAAA;IAC5C,iBAAiB,CAAC,EAAE,iBAAiB,CAAA;CACtC;AACD,qBAAa,wBAAwB;IACnC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAU;IAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAiB;IAC3C,OAAO,CAAC,QAAQ,CAAC,mBAAmB,CAA2B;IAC/D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAQ;IAClC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAiB;IAC1C,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAkB;IAC7C,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAgB;IAChD,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAmB;IACtD,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAU;IACnD,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAA8C;IAChF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAA4B;IAC7D,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAmB;gBAC1C,MAAM,EAAE,8BAA8B;IAc5C,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,cAAmB,GAAG,OAAO,CAAC,aAAa,CAAC;IAsW9E,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,eAAe,CAAC;CAU7F"}

package/dist/src/services/skill-installation.service.js

@@ -235,6 +235,9 @@ export class SkillInstallationService {
                 const first = optionalFiles.failedScans[0];
                 const crit = first.report.findings.filter((f) => f.severity === 'critical' || f.severity === 'high');
                 const others = optionalFiles.failedScans.slice(1).map((s) => s.file);
+                // SMI-5422: surface the matched finding type so the author knows what to fix.
+                const topFinding = crit[0] ?? first.report.findings[0];
+                const matchedLabel = topFinding ? (topFinding.category ?? topFinding.type) : 'unknown';
                 return buildInstallFailure('SCAN_REJECTED', {
                     skillId,
                     installPath,
@@ -246,11 +249,14 @@ export class SkillInstallationService {
                         crit.length +
                         ' critical/high finding(s) (risk score ' +
                         first.report.riskScore +
-                        ').',
+                        ', matched: ' +
+                        matchedLabel +
+                        '). See https://skillsmith.app/docs/security/scanner',
                     tips: [
-                        'Rejected optional file: ' + first.file,
+                        'Rejected file: ' + first.file + ' (matched: ' + matchedLabel + ')',
                         'Risk score: ' + first.report.riskScore,
-                        ...(others.length > 0 ? ['Other rejected optional files: ' + others.join(', ')] : []),
+                        'Security scanner docs: https://skillsmith.app/docs/security/scanner',
+                        ...(others.length > 0 ? ['Other rejected files: ' + others.join(', ')] : []),
                     ],
                 });
             }