@vibefoundry/vibe-shield 1.1.0 → 1.1.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (15) hide show
  1. package/README.md +45 -39
  2. package/SECURITY.md +1 -1
  3. package/SKILL.md +9 -9
  4. package/dist/bin/vibe-shield.d.ts +1 -1
  5. package/dist/bin/vibe-shield.js +545 -541
  6. package/dist/src/init/scaffold.d.ts +29 -31
  7. package/dist/src/init/scaffold.js +51 -68
  8. package/dist/src/mcp/server.js +1 -1
  9. package/dist/src/reporter/console-reporter.js +3 -3
  10. package/dist/src/reporter/patch-prompt-writer.js +2 -2
  11. package/dist/src/scanner/engine.js +5 -1
  12. package/dist/src/scanner/rules/database-exposure.js +1 -1
  13. package/dist/src/scanner/rules/shared.d.ts +1 -1
  14. package/dist/src/scanner/rules/shared.js +1 -1
  15. package/package.json +4 -1
package/README.md CHANGED
@@ -8,8 +8,8 @@ Your agent ships fast. It also ships `NEXT_PUBLIC_SUPABASE_SERVICE_ROLE_KEY`, a
8
8
 
9
9
  vibe-shield is a **static security scanner built for that failure mode**, plus an **Agent Skill** that makes Claude Code, Codex, Cursor and Windsurf audit before they say *"done"*.
10
10
 
11
- [![version](https://img.shields.io/github/package-json/v/avivgerz-hue/vibe-shield?style=flat-square&label=version&color=cb3837)](https://github.com/avivgerz-hue/vibe-shield/blob/main/package.json)
12
- [![install](https://img.shields.io/badge/install-github%3Aavivgerz--hue%2Fvibe--shield-cb3837?style=flat-square&logo=npm)](#-quick-start)
11
+ [![npm version](https://img.shields.io/npm/v/@vibefoundry/vibe-shield.svg)](https://www.npmjs.com/package/@vibefoundry/vibe-shield)
12
+ [![npm downloads](https://img.shields.io/npm/dm/@vibefoundry/vibe-shield.svg)](https://www.npmjs.com/package/@vibefoundry/vibe-shield)
13
13
  [![CI](https://img.shields.io/github/actions/workflow/status/avivgerz-hue/vibe-shield/ci.yml?branch=main&style=flat-square&logo=githubactions&label=CI)](https://github.com/avivgerz-hue/vibe-shield/actions/workflows/ci.yml)
14
14
  [![node](https://img.shields.io/badge/node-%E2%89%A518.17.0-5fa04e?style=flat-square&logo=nodedotjs)](#-requirements)
15
15
  [![license](https://img.shields.io/github/license/avivgerz-hue/vibe-shield?style=flat-square&color=blue)](./LICENSE)
@@ -18,7 +18,7 @@ vibe-shield is a **static security scanner built for that failure mode**, plus a
18
18
  [![self-scan](https://img.shields.io/badge/self--scan-100%2F100%20A%2B-16a34a?style=flat-square)](#-it-scans-itself)
19
19
 
20
20
  ```bash
21
- npx github:avivgerz-hue/vibe-shield scan
21
+ npx -y @vibefoundry/vibe-shield scan
22
22
  ```
23
23
 
24
24
  ![vibe-shield terminal preview](./assets/hero-terminal.svg)
@@ -42,7 +42,7 @@ export async function DELETE(req: Request) {
42
42
 
43
43
  It works. It also has **three critical vulnerabilities** — no authentication, SQL injection, and an IDOR that lets the caller choose whose data they delete. Nothing in a normal review loop catches all three, and the agent reported the task as complete.
44
44
 
45
- `npx github:avivgerz-hue/vibe-shield scan` catches all three in **17 milliseconds**:
45
+ `npx -y @vibefoundry/vibe-shield scan` catches all three in **17 milliseconds**:
46
46
 
47
47
  ```
48
48
  🛡️ vibe-shield v1.0.0 · security scan
@@ -64,15 +64,15 @@ app/api/users/route.ts
64
64
  7 files · 1 KiB · 412 files/s · 17 ms · 48 rules
65
65
 
66
66
  ⚠ 3 critical findings — rotate any exposed credential before anything else.
67
- Fix it npx github:avivgerz-hue/vibe-shield scan --fix-prompt # writes SECURITY_PATCH_PROMPT.md for your agent
68
- Explain npx github:avivgerz-hue/vibe-shield explain VSB-AUTH-001
69
- Gate CI npx github:avivgerz-hue/vibe-shield scan --fail-on critical --format github
67
+ Fix it npx -y @vibefoundry/vibe-shield scan --fix-prompt # writes SECURITY_PATCH_PROMPT.md for your agent
68
+ Explain npx -y @vibefoundry/vibe-shield explain VSB-AUTH-001
69
+ Gate CI npx -y @vibefoundry/vibe-shield scan --fail-on critical --format github
70
70
  ```
71
71
 
72
72
  Then hand the fix list to the agent that wrote the bug:
73
73
 
74
74
  ```bash
75
- npx github:avivgerz-hue/vibe-shield scan --fix-prompt # → SECURITY_PATCH_PROMPT.md
75
+ npx -y @vibefoundry/vibe-shield scan --fix-prompt # → SECURITY_PATCH_PROMPT.md
76
76
  ```
77
77
 
78
78
  That file contains, for every finding: the severity, the CWE id and link, the exact `file:line`, the vulnerable snippet, the ordered remediation steps, the target code shape, and a verification command. It is written for a machine to execute and a human to audit.
@@ -83,22 +83,23 @@ That file contains, for every finding: the severity, the CWE id and link, the ex
83
83
 
84
84
  ```bash
85
85
  # 1. Scan (no install, no config, no network calls)
86
- npx github:avivgerz-hue/vibe-shield scan
86
+ npx -y @vibefoundry/vibe-shield scan
87
87
 
88
88
  # 2. Give your agent the fix list
89
- npx github:avivgerz-hue/vibe-shield scan --fix-prompt
89
+ npx -y @vibefoundry/vibe-shield scan --fix-prompt
90
90
 
91
91
  # 3. Install the gate permanently — skill + CI + ignore file
92
- npx github:avivgerz-hue/vibe-shield init
92
+ npx -y @vibefoundry/vibe-shield init
93
93
  ```
94
94
 
95
- > **Why GitHub and not `npx vibe-shield`?** The name `vibe-shield` on the npm
96
- > registry belongs to a different project with no connection to this one. Running
97
- > `npx vibe-shield` installs *their* package, not this repository's. Install from
98
- > GitHub — the compiled CLI is committed, so it needs **no TypeScript** and starts
99
- > in milliseconds. A scoped npm release (`@vibefoundry/vibe-shield`) may follow.
95
+ > **Use the scoped name.** vibe-shield is published as
96
+ > [`@vibefoundry/vibe-shield`](https://www.npmjs.com/package/@vibefoundry/vibe-shield).
97
+ > The *unscoped* name `vibe-shield` on npm belongs to an unrelated project, so
98
+ > `npx vibe-shield` runs someone else's code. Always include the `@vibefoundry/`
99
+ > scope. The package ships a prebuilt `dist/`, needs **no TypeScript**, and
100
+ > starts in milliseconds.
100
101
 
101
- `npx github:avivgerz-hue/vibe-shield init` writes:
102
+ `npx -y @vibefoundry/vibe-shield init` writes:
102
103
 
103
104
  | File | What it does |
104
105
  | --- | --- |
@@ -131,7 +132,7 @@ vibe-shield encodes those specific shapes: 60 signatures across five families, e
131
132
 
132
133
  ## 📊 Vulnerability Coverage Matrix
133
134
 
134
- **48 code signatures + 12 agent-integrity signatures = 60.** Every rule has an id, a CWE, a vulnerable example, a fixed example, and ordered remediation steps — run `npx github:avivgerz-hue/vibe-shield rules` or `npx github:avivgerz-hue/vibe-shield explain <ID>`.
135
+ **48 code signatures + 12 agent-integrity signatures = 60.** Every rule has an id, a CWE, a vulnerable example, a fixed example, and ordered remediation steps — run `npx -y @vibefoundry/vibe-shield rules` or `npx -y @vibefoundry/vibe-shield explain <ID>`.
135
136
 
136
137
  ### Client-side secret & data exposure — `VSB-CLIENT-*`
137
138
 
@@ -234,7 +235,8 @@ Claude Code, Claude Desktop, Cursor and Codex can call the scanner as a tool
234
235
  instead of shelling out and parsing console output.
235
236
 
236
237
  ```bash
237
- npx github:avivgerz-hue/vibe-shield mcp # JSON-RPC 2.0 over stdio
238
+ npx -y @vibefoundry/vibe-shield mcp # JSON-RPC 2.0 over stdio
239
+ npx -y @vibefoundry/vibe-shield --mcp # same thing, if your client prefers a flag
238
240
  ```
239
241
 
240
242
  Three tools:
@@ -245,22 +247,26 @@ Three tools:
245
247
  | `vibe_shield_audit_skills` | Audits `.claude/skills`, `.cursor` rules, `AGENTS.md` and MCP configs for prompt injection and exfiltration traps |
246
248
  | `vibe_shield_explain_rule` | Full CWE detail, vulnerable/fixed examples and remediation for any rule id or slug |
247
249
 
248
- `npx github:avivgerz-hue/vibe-shield init` writes the config for you, merging into `.mcp.json`
250
+ `npx -y @vibefoundry/vibe-shield init` writes the config for you, merging into `.mcp.json`
249
251
  **without clobbering** servers you already have:
250
252
 
251
253
  ```jsonc
252
254
  {
253
255
  "mcpServers": {
254
256
  "github": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-github"] },
255
- "vibe-shield": { "command": "npx", "args": ["--yes", "github:avivgerz-hue/vibe-shield", "mcp"] }
257
+ "vibe-shield": { "command": "npx", "args": ["--yes", "@vibefoundry/vibe-shield@1.1.0", "mcp"] }
256
258
  }
257
259
  }
258
260
  ```
259
261
 
262
+ The version pin is not cosmetic: an unpinned `npx -y` server is exactly what
263
+ `VSB-AGENT-004` flags as high severity, so vibe-shield's own audit would write
264
+ itself a finding. `init` pins the running version automatically.
265
+
260
266
  Or add it by hand:
261
267
 
262
268
  ```bash
263
- claude mcp add vibe-shield -- npx --yes github:avivgerz-hue/vibe-shield mcp
269
+ claude mcp add vibe-shield -- npx -y @vibefoundry/vibe-shield mcp
264
270
  ```
265
271
 
266
272
  The server is zero-dependency, writes **only** JSON-RPC to stdout, honours
@@ -275,15 +281,15 @@ a scanner that says "clean" when it read nothing is worse than no scanner.
275
281
 
276
282
  ## 🤖 Use it as an Agent Skill
277
283
 
278
- `npx github:avivgerz-hue/vibe-shield init` installs the skill. Once it is in a repository, every
284
+ `npx -y @vibefoundry/vibe-shield init` installs the skill. Once it is in a repository, every
279
285
  agent session starts with a contract:
280
286
 
281
287
  > You are not allowed to say "done" until the code you just wrote passes a security audit.
282
288
 
283
289
  ```bash
284
- npx github:avivgerz-hue/vibe-shield init # Claude Code + Cursor + AGENTS.md + CI
285
- npx github:avivgerz-hue/vibe-shield init --agent claude # just the skill
286
- npx github:avivgerz-hue/vibe-shield init --no-workflow # skip the GitHub Action
290
+ npx -y @vibefoundry/vibe-shield init # Claude Code + Cursor + AGENTS.md + CI
291
+ npx -y @vibefoundry/vibe-shield init --agent claude # just the skill
292
+ npx -y @vibefoundry/vibe-shield init --no-workflow # skip the GitHub Action
287
293
  ```
288
294
 
289
295
  **Why this works better than a prompt snippet:** it names the three commands, gives the agent a reading guide for a finding (`line:col`, rule id, message, CWE), states five hard rules (never suppress, never weaken, always rotate, report honestly, re-verify), and defines "done" as an exit code rather than an opinion.
@@ -294,7 +300,7 @@ The skill itself is [SKILL.md](./SKILL.md) — read it, it is short.
294
300
 
295
301
  ```bash
296
302
  # marketplace-style install
297
- npx github:avivgerz-hue/vibe-shield init --agent claude
303
+ npx -y @vibefoundry/vibe-shield init --agent claude
298
304
  # → .claude/skills/vibe-shield/SKILL.md
299
305
 
300
306
  # or globally, for every project
@@ -308,7 +314,7 @@ curl -sL https://raw.githubusercontent.com/avivgerz-hue/vibe-shield/main/SKILL.m
308
314
 
309
315
  ### GitHub Actions (recommended)
310
316
 
311
- `npx github:avivgerz-hue/vibe-shield init` installs a workflow that runs the scan, uploads SARIF to
317
+ `npx -y @vibefoundry/vibe-shield init` installs a workflow that runs the scan, uploads SARIF to
312
318
  code scanning, audits the agent surface, and fails the job:
313
319
 
314
320
  ```yaml
@@ -329,7 +335,7 @@ jobs:
329
335
  node-version: 20
330
336
 
331
337
  - name: Scan and upload SARIF
332
- run: npx --yes github:avivgerz-hue/vibe-shield scan --format sarif --out vibe-shield.sarif --fail-on high
338
+ run: npx -y @vibefoundry/vibe-shield scan --format sarif --out vibe-shield.sarif --fail-on high
333
339
  continue-on-error: true
334
340
 
335
341
  - uses: github/codeql-action/upload-sarif@v3
@@ -339,7 +345,7 @@ jobs:
339
345
  category: vibe-shield
340
346
 
341
347
  - name: Enforce the gate
342
- run: npx --yes github:avivgerz-hue/vibe-shield scan --fail-on high
348
+ run: npx -y @vibefoundry/vibe-shield scan --fail-on high
343
349
  ```
344
350
 
345
351
  Findings appear **inline on the pull request diff** (GitHub annotations) and in
@@ -349,11 +355,11 @@ on the line that introduced it.
349
355
  ### Any other CI
350
356
 
351
357
  ```bash
352
- npx github:avivgerz-hue/vibe-shield scan --fail-on high # exit 1 on findings
353
- npx github:avivgerz-hue/vibe-shield scan --format compact # one line per finding
354
- npx github:avivgerz-hue/vibe-shield scan --format json > vibe-shield.json # full report
355
- npx github:avivgerz-hue/vibe-shield scan --format summary # JSON, counts + grade only
356
- npx github:avivgerz-hue/vibe-shield scan --format github # workflow annotations
358
+ npx -y @vibefoundry/vibe-shield scan --fail-on high # exit 1 on findings
359
+ npx -y @vibefoundry/vibe-shield scan --format compact # one line per finding
360
+ npx -y @vibefoundry/vibe-shield scan --format json > vibe-shield.json # full report
361
+ npx -y @vibefoundry/vibe-shield scan --format summary # JSON, counts + grade only
362
+ npx -y @vibefoundry/vibe-shield scan --format github # workflow annotations
357
363
  ```
358
364
 
359
365
  Exit codes: **0** clean · **1** findings at/above `--fail-on` · **2** usage error
@@ -385,7 +391,7 @@ Penalties per finding: critical −30, high −12, medium −5, low −2, info
385
391
  This repository runs its own gate on every commit and in CI:
386
392
 
387
393
  ```console
388
- $ npx github:avivgerz-hue/vibe-shield scan
394
+ $ npx -y @vibefoundry/vibe-shield scan
389
395
  🛡️ vibe-shield v1.0.0 · security scan
390
396
  target /you/vibe-shield
391
397
 
@@ -395,7 +401,7 @@ target /you/vibe-shield
395
401
 
396
402
  Nothing to fix. Keep the shield up. 🛡️
397
403
 
398
- $ npx github:avivgerz-hue/vibe-shield audit-skills
404
+ $ npx -y @vibefoundry/vibe-shield audit-skills
399
405
  🏆 GRADE A+ — 100/100
400
406
 
401
407
  1 file · 6 KiB · 14 files/s · 69 ms · 12 rules
@@ -447,7 +453,7 @@ Suppressed findings are **counted and reported** in the scorecard, never silentl
447
453
  2. **Honest.** Every finding carries the exact snippet the developer wrote. Nothing is inferred from a filename alone, and every suppression is counted, not hidden.
448
454
  3. **Composable.** `scanProject()` for the CLI, `runRulesOnFile()` for the auditor, `scoreFindings()` for anything that produces findings. The whole API is exported from `vibe-shield`.
449
455
 
450
- **Zero runtime dependencies.** No network calls, no telemetry, no language server, no native binaries. `npx github:avivgerz-hue/vibe-shield scan` works offline and in an air-gapped CI runner.
456
+ **Zero runtime dependencies.** No network calls, no telemetry, no language server, no native binaries. `npx -y @vibefoundry/vibe-shield scan` works offline and in an air-gapped CI runner.
451
457
 
452
458
  ---
453
459
 
@@ -567,5 +573,5 @@ Three tools for the same problem: agents move fast, and something has to keep th
567
573
  | 👻 | **[ghost-qa](https://github.com/avivgerz-hue/ghost-qa)** | Autonomous headless-browser QA & self-healing verification loop — stops agents from claiming a UI works when it does not |
568
574
 
569
575
  ```bash
570
- npx github:avivgerz-hue/vibe-shield init # security gate
576
+ npx -y @vibefoundry/vibe-shield init # security gate
571
577
  ```
package/SECURITY.md CHANGED
@@ -14,7 +14,7 @@
14
14
  Email **security@vibefoundry.dev** with:
15
15
 
16
16
  - a description of the issue and its impact
17
- - the affected version (`npx github:avivgerz-hue/vibe-shield version`)
17
+ - the affected version (`npx -y @vibefoundry/vibe-shield version`)
18
18
  - a minimal reproduction (a snippet, a repository, or a failing test)
19
19
  - whether you intend to publish, and any deadline you are working to
20
20
 
package/SKILL.md CHANGED
@@ -1,7 +1,7 @@
1
1
  ---
2
2
  name: vibe-shield
3
3
  description: Audit any change for AI-introduced security bugs (leaked keys, unguarded API routes, disabled Row Level Security, SQL injection, prompt injection, poisoned MCP servers) and fix them before reporting a task as done. Use whenever you write or modify application code, API routes, server actions, database migrations, auth logic, environment variables, LLM calls, webhook handlers, agent skills or MCP configuration.
4
- allowed-tools: Bash(npx github:avivgerz-hue/vibe-shield scan*), Bash(npx github:avivgerz-hue/vibe-shield audit-skills*), Bash(npx github:avivgerz-hue/vibe-shield explain*), Read(./**), Grep, Glob
4
+ allowed-tools: Bash(npx -y @vibefoundry/vibe-shield scan*), Bash(npx -y @vibefoundry/vibe-shield audit-skills*), Bash(npx -y @vibefoundry/vibe-shield explain*), Read(./**), Grep, Glob
5
5
  license: MIT
6
6
  metadata:
7
7
  author: VibeFoundry
@@ -32,17 +32,17 @@ If you did not touch any of those, you do not need to run it.
32
32
 
33
33
  ```bash
34
34
  # 1. Scan (a whole-repo scan finishes in well under a second)
35
- npx github:avivgerz-hue/vibe-shield scan --fail-on high
35
+ npx -y @vibefoundry/vibe-shield scan --fail-on high
36
36
 
37
37
  # 2. If it fails, generate the machine-readable fix list
38
- npx github:avivgerz-hue/vibe-shield scan --fix-prompt
38
+ npx -y @vibefoundry/vibe-shield scan --fix-prompt
39
39
 
40
40
  # 3. Read SECURITY_PATCH_PROMPT.md and fix every finding, critical first
41
41
  # Each entry has the exact file:line, the vulnerable snippet, the CWE and
42
42
  # the required change. Apply it literally.
43
43
 
44
44
  # 4. Re-run until it exits 0
45
- npx github:avivgerz-hue/vibe-shield scan --fail-on high
45
+ npx -y @vibefoundry/vibe-shield scan --fail-on high
46
46
  ```
47
47
 
48
48
  `--fail-on high` exits non-zero while any high or critical finding exists. That is the gate.
@@ -61,7 +61,7 @@ CRITICAL 47:15 VSB-CLIENT-001 Server-only secret exposed through a public en
61
61
  | message | why this specific line is exploitable |
62
62
  | `(CWE-200)` | bug class, for a deeper search if the fix is unclear |
63
63
 
64
- Need the full picture? `npx github:avivgerz-hue/vibe-shield explain VSB-CLIENT-001` prints the vulnerable shape, the fixed shape, remediation steps and references.
64
+ Need the full picture? `npx -y @vibefoundry/vibe-shield explain VSB-CLIENT-001` prints the vulnerable shape, the fixed shape, remediation steps and references.
65
65
 
66
66
  ## Hard rules
67
67
 
@@ -76,7 +76,7 @@ Need the full picture? `npx github:avivgerz-hue/vibe-shield explain VSB-CLIENT-0
76
76
  When you add or modify a skill, rule file, MCP server or instruction file, also run:
77
77
 
78
78
  ```bash
79
- npx github:avivgerz-hue/vibe-shield audit-skills
79
+ npx -y @vibefoundry/vibe-shield audit-skills
80
80
  ```
81
81
 
82
82
  Twelve `VSB-AGENT-*` rules check for hidden Unicode (zero-width and bidi characters used to smuggle instructions past review), `curl`/`wget` exfiltration of environment variables, credential-harvesting instructions (`.env`, `~/.ssh`, `~/.aws`), registry-tag or remote MCP servers, literal tokens in an `env` block, safety-override language, over-broad tool permissions, base64 `eval` payloads, remote-instruction fetching, wildcard `allowed-tools`, and shell injection in skill scripts.
@@ -106,8 +106,8 @@ return structured findings instead of text you have to parse.
106
106
 
107
107
  ## Definition of done
108
108
 
109
- - [ ] `npx github:avivgerz-hue/vibe-shield scan --fail-on high` exits `0`
110
- - [ ] `npx github:avivgerz-hue/vibe-shield audit-skills` exits `0` if you touched agent files
109
+ - [ ] `npx -y @vibefoundry/vibe-shield scan --fail-on high` exits `0`
110
+ - [ ] `npx -y @vibefoundry/vibe-shield audit-skills` exits `0` if you touched agent files
111
111
  - [ ] every credential the scan surfaced has been flagged to the user for rotation
112
112
  - [ ] no suppression directive was added
113
113
  - [ ] the feature still works and the existing tests still pass
@@ -115,7 +115,7 @@ return structured findings instead of text you have to parse.
115
115
  ## Install it into a repository
116
116
 
117
117
  ```bash
118
- npx github:avivgerz-hue/vibe-shield init
118
+ npx -y @vibefoundry/vibe-shield init
119
119
  ```
120
120
 
121
121
  That writes this file to `.claude/skills/vibe-shield/SKILL.md`, appends a security
package/dist/bin/vibe-shield.d.ts CHANGED
@@ -32,7 +32,7 @@ export declare const defaultIo: () => CliIo;
32
32
  export declare const EXIT_OK = 0;
33
33
  export declare const EXIT_FINDINGS = 1;
34
34
  export declare const EXIT_USAGE = 2;
35
- declare const HELP = "vibe-shield \u2014 security scanner for AI-generated code\n\nUSAGE\n vibe-shield <command> [options]\n\nCOMMANDS\n scan [paths...] Scan the project (default: current directory).\n audit-skills [paths...] Audit agent skills, Cursor rules, AGENTS.md and MCP configs.\n init Install the Agent Skill, AGENTS.md section and CI workflow.\n rules List every detection rule.\n explain <RULE_ID> Show full documentation for a rule.\n mcp Serve the Model Context Protocol tools over stdio.\n version Print the version.\n help Print this help.\n\nSCAN OPTIONS\n --format <fmt> console | compact | summary | json | sarif | github (console)\n --out <file> Write the report to a file instead of stdout.\n --fix-prompt Write SECURITY_PATCH_PROMPT.md with exact fix instructions.\n --fail-on <severity> Exit 1 when a finding at/above this severity exists. (critical)\n --severity <severity> Only report findings at/above this severity.\n --rules <ids> Comma-separated rule ids/slugs (supports VSB-DB-*).\n --ignore <glob> Extra gitignore-style pattern (repeatable).\n --include-tests Include test, spec and fixture files.\n --include-docs Include Markdown and docs/.\n --cache Reuse .vibe-shield-cache.json between runs.\n --max-findings <n> Limit the console list (0 = all). (50)\n --quiet Print only the verdict line and the exit code.\n --no-color Disable ANSI colour.\n --no-shield-ignore Ignore .vibe-shieldignore (e.g. to scan excluded fixtures).\n --json Shorthand for --format json.\n\nINIT OPTIONS\n --target <dir> Repository to install into. (cwd)\n --agent <kind> claude | cursor | generic | all. (all)\n --no-workflow Skip the GitHub Actions workflow.\n --force Overwrite existing files.\n --yes Accepted for non-interactive CI use (init never prompts).\n\nEXAMPLES\n npx github:avivgerz-hue/vibe-shield scan\n npx github:avivgerz-hue/vibe-shield scan --fail-on high --format github\n npx github:avivgerz-hue/vibe-shield scan --fix-prompt\n npx github:avivgerz-hue/vibe-shield init\n npx github:avivgerz-hue/vibe-shield explain VSB-DB-001\n npx github:avivgerz-hue/vibe-shield audit-skills .claude\n";
35
+ declare const HELP = "vibe-shield \u2014 security scanner for AI-generated code\n\nUSAGE\n vibe-shield <command> [options]\n\nCOMMANDS\n scan [paths...] Scan the project (default: current directory).\n audit-skills [paths...] Audit agent skills, Cursor rules, AGENTS.md and MCP configs.\n init Install the Agent Skill, AGENTS.md section and CI workflow.\n rules List every detection rule.\n explain <RULE_ID> Show full documentation for a rule.\n mcp Serve the Model Context Protocol tools over stdio.\n version Print the version.\n help Print this help.\n\nSCAN OPTIONS\n --format <fmt> console | compact | summary | json | sarif | github (console)\n --out <file> Write the report to a file instead of stdout.\n --fix-prompt Write SECURITY_PATCH_PROMPT.md with exact fix instructions.\n --fail-on <severity> Exit 1 when a finding at/above this severity exists. (critical)\n --severity <severity> Only report findings at/above this severity.\n --rules <ids> Comma-separated rule ids/slugs (supports VSB-DB-*).\n --ignore <glob> Extra gitignore-style pattern (repeatable).\n --include-tests Include test, spec and fixture files.\n --include-docs Include Markdown and docs/.\n --cache Reuse .vibe-shield-cache.json between runs.\n --max-findings <n> Limit the console list (0 = all). (50)\n --quiet Print only the verdict line and the exit code.\n --no-color Disable ANSI colour.\n --no-shield-ignore Ignore .vibe-shieldignore (e.g. to scan excluded fixtures).\n --json Shorthand for --format json.\n\nINIT OPTIONS\n --target <dir> Repository to install into. (cwd)\n --agent <kind> claude | cursor | generic | all. (all)\n --no-workflow Skip the GitHub Actions workflow.\n --force Overwrite existing files.\n --yes Accepted for non-interactive CI use (init never prompts).\n\nEXAMPLES\n npx -y @vibefoundry/vibe-shield scan\n npx -y @vibefoundry/vibe-shield scan --fail-on high --format github\n npx -y @vibefoundry/vibe-shield scan --fix-prompt\n npx -y @vibefoundry/vibe-shield init\n npx -y @vibefoundry/vibe-shield explain VSB-DB-001\n npx -y @vibefoundry/vibe-shield audit-skills .claude\n";
36
36
  interface ParsedArgs {
37
37
  command: string;
38
38
  positionals: string[];