acidtest 0.5.2 → 0.7.0

package/.github/workflows/acidtest-example.yml

@@ -27,7 +27,7 @@ jobs:
         if: hashFiles('src/scanner.ts') != ''
         uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '20'
 
       - name: Run AcidTest
         run: |
@@ -51,7 +51,7 @@ jobs:
         if: hashFiles('src/scanner.ts') != ''
         uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '20'
 
       - name: Run AcidTest
         id: acidtest
@@ -112,7 +112,7 @@ jobs:
         if: hashFiles('src/scanner.ts') != ''
         uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '20'
 
       - name: Run AcidTest on all skills
         run: |
@@ -163,7 +163,7 @@ jobs:
         if: hashFiles('src/scanner.ts') != ''
         uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '20'
 
       - name: Run AcidTest
         id: scan

package/.github/workflows/acidtest-template.yml

@@ -22,7 +22,7 @@ jobs:
         if: hashFiles('src/scanner.ts') != ''
         uses: actions/setup-node@v4
         with:
-          node-version: '18'
+          node-version: '20'
 
       - name: Run AcidTest
         run: |

package/README.md

@@ -4,11 +4,21 @@ Security scanner for AI agent skills and MCP servers. Scan before you install.
 
 ## The Problem
 
-The AI agent ecosystem is growing rapidly with thousands of skills and MCP servers. Security concerns include:
-- **AgentSkills**: 66,000+ skills with 26% containing vulnerabilities
-- **230+** confirmed malicious skills uploaded to ClawHub in one week
-- **341** skills flagged in the ClawHavoc campaign
-- **MCP Servers**: New ecosystem with similar security risks
+The AI agent ecosystem is growing rapidly, but security lags behind adoption:
+
+- **No centralized vetting**: Unlike mobile app stores, there's no security review before skills are published
+- **Broad permissions**: Skills can request file system access, environment variables, and network calls
+- **Supply chain risks**: Dependencies and third-party code run with full skill permissions
+- **Prompt injection**: Malicious skills can manipulate AI behavior through carefully crafted prompts
+- **Credential harvesting**: Skills requesting API keys and tokens without proper justification
+
+Recent ecosystem incidents highlight these risks:
+- Mass uploads of malicious skills to public marketplaces
+- Skills with undeclared network calls exfiltrating data
+- Obfuscated code hiding malicious behavior
+- Permission escalation through dynamic imports
+
+**AcidTest provides security scanning before installation**, helping you identify risks before they reach your system.
 
 ## Quick Start
 ```bash
@@ -114,6 +124,16 @@ acidtest scan ./server/mcp.json        # Direct manifest path
 # Scan all skills/servers in a directory
 acidtest scan-all ./directory
 
+# Watch mode - re-scan on file changes
+acidtest scan ./my-skill --watch
+acidtest scan ./my-skill -w            # Short form
+
+# Show remediation suggestions
+acidtest scan ./my-skill --fix
+
+# Combine flags
+acidtest scan ./my-skill --watch --fix
+
 # JSON output for programmatic use
 acidtest scan ./my-skill --json
 
@@ -121,6 +141,51 @@ acidtest scan ./my-skill --json
 acidtest serve
 ```
 
+### CLI Options
+
+- `--watch`, `-w` - Watch for file changes and automatically re-scan
+  - Keyboard controls: `q` to quit, `r` to force re-scan, `c` to clear terminal
+  - Use `--no-clear` to preserve terminal history between scans
+- `--fix` - Show actionable remediation suggestions for each finding
+- `--json` - Output results as JSON for programmatic use
+- `--no-clear` - Don't clear terminal between scans (watch mode only)
+
+### Configuration File
+
+Create a `.acidtest.json` file in your skill directory to customize scanning behavior:
+
+```json
+{
+  "ignore": {
+    "patterns": ["di-008"],
+    "categories": ["obfuscation"],
+    "files": ["vendor/**", "*.min.js"]
+  },
+  "thresholds": {
+    "minScore": 80,
+    "failOn": ["CRITICAL", "HIGH"]
+  },
+  "output": {
+    "format": "detailed",
+    "showRemediation": true,
+    "colors": true
+  }
+}
+```
+
+**Configuration Options:**
+
+- `ignore.patterns` - Array of pattern IDs to suppress (e.g., `["di-001", "cp-006"]`)
+- `ignore.categories` - Array of categories to suppress (e.g., `["obfuscation"]`)
+- `ignore.files` - Array of glob patterns for files to skip scanning
+- `thresholds.minScore` - Minimum passing score (0-100). Exit with error if score is below this
+- `thresholds.failOn` - Array of severities that cause scan to fail (e.g., `["CRITICAL", "HIGH"]`)
+- `output.format` - Output format: `"detailed"`, `"compact"`, or `"json"`
+- `output.showRemediation` - Show remediation suggestions (boolean)
+- `output.colors` - Enable/disable colored output (boolean)
+
+CLI flags override config file settings.
+
 ### Use as MCP Server
 
 AcidTest can run as an MCP (Model Context Protocol) server, allowing AI agents like Claude to scan skills and MCP servers before installation.

package/dist/config.d.ts

@@ -0,0 +1,19 @@
+/**
+ * Configuration file loader
+ * Loads and validates .acidtest.json config files
+ */
+import type { AcidTestConfig } from './types.js';
+/**
+ * Load AcidTest configuration from directory
+ * Looks for .acidtest.json in the skill directory
+ */
+export declare function loadConfig(directory: string): AcidTestConfig;
+/**
+ * Get default configuration
+ */
+export declare function getDefaultConfig(): AcidTestConfig;
+/**
+ * Merge user config with defaults
+ */
+export declare function mergeConfig(userConfig: AcidTestConfig): AcidTestConfig;
+//# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAEjD;;;GAGG;AACH,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,GAAG,cAAc,CAe5D;AAED;;GAEG;AACH,wBAAgB,gBAAgB,IAAI,cAAc,CAiBjD;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,UAAU,EAAE,cAAc,GAAG,cAAc,CAmBtE"}

package/dist/config.js

@@ -0,0 +1,69 @@
+/**
+ * Configuration file loader
+ * Loads and validates .acidtest.json config files
+ */
+import { readFileSync, existsSync } from 'fs';
+import { join } from 'path';
+/**
+ * Load AcidTest configuration from directory
+ * Looks for .acidtest.json in the skill directory
+ */
+export function loadConfig(directory) {
+    const configPath = join(directory, '.acidtest.json');
+    if (!existsSync(configPath)) {
+        return {}; // No config, use defaults
+    }
+    try {
+        const content = readFileSync(configPath, 'utf-8');
+        const config = JSON.parse(content);
+        return config;
+    }
+    catch (error) {
+        console.warn(`Warning: Invalid .acidtest.json: ${error.message}`);
+        return {};
+    }
+}
+/**
+ * Get default configuration
+ */
+export function getDefaultConfig() {
+    return {
+        ignore: {
+            patterns: [],
+            categories: [],
+            files: []
+        },
+        thresholds: {
+            minScore: 0,
+            failOn: []
+        },
+        output: {
+            format: 'detailed',
+            showRemediation: false,
+            colors: true
+        }
+    };
+}
+/**
+ * Merge user config with defaults
+ */
+export function mergeConfig(userConfig) {
+    const defaults = getDefaultConfig();
+    return {
+        ignore: {
+            patterns: userConfig.ignore?.patterns ?? defaults.ignore.patterns,
+            categories: userConfig.ignore?.categories ?? defaults.ignore.categories,
+            files: userConfig.ignore?.files ?? defaults.ignore.files
+        },
+        thresholds: {
+            minScore: userConfig.thresholds?.minScore ?? defaults.thresholds.minScore,
+            failOn: userConfig.thresholds?.failOn ?? defaults.thresholds.failOn
+        },
+        output: {
+            format: userConfig.output?.format ?? defaults.output.format,
+            showRemediation: userConfig.output?.showRemediation ?? defaults.output.showRemediation,
+            colors: userConfig.output?.colors ?? defaults.output.colors
+        }
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,SAAiB;IAC1C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;IAErD,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC,CAAC,0BAA0B;IACvC,CAAC;IAED,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAmB,CAAC;QACrD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,CAAC,IAAI,CAAC,oCAAqC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QAC7E,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,MAAM,EAAE;YACN,QAAQ,EAAE,EAAE;YACZ,UAAU,EAAE,EAAE;YACd,KAAK,EAAE,EAAE;SACV;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,CAAC;YACX,MAAM,EAAE,EAAE;SACX;QACD,MAAM,EAAE;YACN,MAAM,EAAE,UAAU;YAClB,eAAe,EAAE,KAAK;YACtB,MAAM,EAAE,IAAI;SACb;KACF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,UAA0B;IACpD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IAEpC,OAAO;QACL,MAAM,EAAE;YACN,QAAQ,EAAE,UAAU,CAAC,MAAM,EAAE,QAAQ,IAAI,QAAQ,CAAC,MAAO,CAAC,QAAQ;YAClE,UAAU,EAAE,UAAU,CAAC,MAAM,EAAE,UAAU,IAAI,QAAQ,CAAC,MAAO,CAAC,UAAU;YACxE,KAAK,EAAE,UAAU,CAAC,MAAM,EAAE,KAAK,IAAI,QAAQ,CAAC,MAAO,CAAC,KAAK;SAC1D;QACD,UAAU,EAAE;YACV,QAAQ,EAAE,UAAU,CAAC,UAAU,EAAE,QAAQ,IAAI,QAAQ,CAAC,UAAW,CAAC,QAAQ;YAC1E,MAAM,EAAE,UAAU,CAAC,UAAU,EAAE,MAAM,IAAI,QAAQ,CAAC,UAAW,CAAC,MAAM;SACrE;QACD,MAAM,EAAE;YACN,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAO,CAAC,MAAM;YAC5D,eAAe,EAAE,UAAU,CAAC,MAAM,EAAE,eAAe,IAAI,QAAQ,CAAC,MAAO,CAAC,eAAe;YACvF,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,IAAI,QAAQ,CAAC,MAAO,CAAC,MAAM;SAC7D;KACF,CAAC;AACJ,CAAC"}

package/dist/config.test.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Tests for config loading
+ */
+export {};
+//# sourceMappingURL=config.test.d.ts.map

package/dist/config.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.test.d.ts","sourceRoot":"","sources":["../src/config.test.ts"],"names":[],"mappings":"AAAA;;GAEG"}

package/dist/config.test.js

@@ -0,0 +1,69 @@
+/**
+ * Tests for config loading
+ */
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { mkdirSync, writeFileSync, rmSync } from 'fs';
+import { join } from 'path';
+import { loadConfig, mergeConfig, getDefaultConfig } from './config.js';
+describe('Config Loading', () => {
+    const testDir = join(process.cwd(), 'test-config-temp');
+    beforeEach(() => {
+        mkdirSync(testDir, { recursive: true });
+    });
+    afterEach(() => {
+        rmSync(testDir, { recursive: true, force: true });
+    });
+    it('should return empty config when .acidtest.json does not exist', () => {
+        const config = loadConfig(testDir);
+        expect(config).toEqual({});
+    });
+    it('should load valid .acidtest.json config', () => {
+        const configData = {
+            ignore: {
+                patterns: ['di-001', 'di-002'],
+                categories: ['obfuscation']
+            },
+            thresholds: {
+                minScore: 80,
+                failOn: ['CRITICAL', 'HIGH']
+            }
+        };
+        writeFileSync(join(testDir, '.acidtest.json'), JSON.stringify(configData, null, 2));
+        const config = loadConfig(testDir);
+        expect(config).toEqual(configData);
+    });
+    it('should return empty config on invalid JSON', () => {
+        writeFileSync(join(testDir, '.acidtest.json'), 'invalid json {');
+        const config = loadConfig(testDir);
+        expect(config).toEqual({});
+    });
+    it('should merge user config with defaults', () => {
+        const userConfig = {
+            ignore: {
+                patterns: ['di-001']
+            },
+            thresholds: {
+                minScore: 90
+            }
+        };
+        const merged = mergeConfig(userConfig);
+        const defaults = getDefaultConfig();
+        expect(merged.ignore?.patterns).toEqual(['di-001']);
+        expect(merged.ignore?.categories).toEqual(defaults.ignore.categories);
+        expect(merged.thresholds?.minScore).toBe(90);
+        expect(merged.thresholds?.failOn).toEqual(defaults.thresholds.failOn);
+        expect(merged.output?.format).toBe(defaults.output.format);
+    });
+    it('should handle partial config', () => {
+        const userConfig = {
+            thresholds: {
+                failOn: ['CRITICAL']
+            }
+        };
+        const merged = mergeConfig(userConfig);
+        const defaults = getDefaultConfig();
+        expect(merged.ignore?.patterns).toEqual(defaults.ignore.patterns);
+        expect(merged.thresholds?.failOn).toEqual(['CRITICAL']);
+    });
+});
+//# sourceMappingURL=config.test.js.map

package/dist/config.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.test.js","sourceRoot":"","sources":["../src/config.test.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,QAAQ,CAAC;AACrE,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAGxE,QAAQ,CAAC,gBAAgB,EAAE,GAAG,EAAE;IAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,kBAAkB,CAAC,CAAC;IAExD,UAAU,CAAC,GAAG,EAAE;QACd,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,CAAC,CAAC,CAAC;IAEH,SAAS,CAAC,GAAG,EAAE;QACb,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+DAA+D,EAAE,GAAG,EAAE;QACvE,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,MAAM,UAAU,GAAG;YACjB,MAAM,EAAE;gBACN,QAAQ,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;gBAC9B,UAAU,EAAE,CAAC,aAAa,CAAC;aAC5B;YACD,UAAU,EAAE;gBACV,QAAQ,EAAE,EAAE;gBACZ,MAAM,EAAE,CAAC,UAAU,EAAE,MAAM,CAAe;aAC3C;SACF,CAAC;QAEF,aAAa,CACX,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAC/B,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,CACpC,CAAC;QAEF,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,aAAa,CACX,IAAI,CAAC,OAAO,EAAE,gBAAgB,CAAC,EAC/B,gBAAgB,CACjB,CAAC;QAEF,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;QACnC,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC7B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,UAAU,GAAG;YACjB,MAAM,EAAE;gBACN,QAAQ,EAAE,CAAC,QAAQ,CAAC;aACrB;YACD,UAAU,EAAE;gBACV,QAAQ,EAAE,EAAE;aACb;SACF,CAAC;QAEF,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QAEpC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAO,CAAC,UAAU,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAC7C,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAW,CAAC,MAAM,CAAC,CAAC;QACvE,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAO,CAAC,MAAM,CAAC,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,MAAM,UAAU,GAAG;YACjB,UAAU,EAAE;gBACV,MAAM,EAAE,CAAC,UAAsB,CAAC;aACjC;SACF,CAAC;QAEF,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QACvC,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;QAEpC,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAO,CAAC,QAAQ,CAAC,CAAC;QACnE,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/index.js

@@ -5,10 +5,11 @@
  */
 import { scanSkill, scanAllSkills } from "./scanner.js";
 import { reportToTerminal, reportAsJSON } from "./reporter.js";
+import { loadConfig, mergeConfig } from "./config.js";
 import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 import { spawn } from "child_process";
-const VERSION = "0.5.2";
+const VERSION = "0.7.0";
 /**
  * Main CLI function
  */
@@ -50,23 +51,50 @@ async function main() {
 async function handleScan(args) {
     // Parse flags
     const jsonOutput = args.includes("--json");
-    const paths = args.filter((arg) => !arg.startsWith("--"));
+    const watchMode = args.includes("--watch") || args.includes("-w");
+    const noClear = args.includes("--no-clear");
+    const showFix = args.includes("--fix");
+    const paths = args.filter((arg) => !arg.startsWith("--") && arg !== "-w");
     if (paths.length === 0) {
         console.error("Error: No skill path provided");
-        console.error("Usage: acidtest scan <path-to-skill> [--json]");
+        console.error("Usage: acidtest scan <path-to-skill> [--json] [--watch]");
         process.exit(1);
     }
     const skillPath = paths[0];
+    // Handle watch mode
+    if (watchMode) {
+        const { watchMode: startWatchMode } = await import('./watch.js');
+        await startWatchMode(skillPath, { noClear, jsonOutput, showRemediation: showFix });
+        return; // Watch mode handles its own exit
+    }
     try {
-        const result = await scanSkill(skillPath);
+        // Load config from skill directory
+        const userConfig = loadConfig(skillPath);
+        const config = mergeConfig(userConfig);
+        // Show progress spinner for CLI scans (not for JSON output)
+        const result = await scanSkill(skillPath, !jsonOutput);
         if (jsonOutput) {
             reportAsJSON(result);
         }
         else {
-            reportToTerminal(result);
+            // CLI flags override config
+            const showRemediation = showFix || (config.output?.showRemediation ?? false);
+            reportToTerminal(result, { showRemediation });
+        }
+        // Apply threshold checks from config
+        let shouldFail = result.status === "FAIL" || result.status === "DANGER";
+        // Check minScore threshold
+        if (config.thresholds?.minScore && result.score < config.thresholds.minScore) {
+            shouldFail = true;
         }
-        // Exit with non-zero code for FAIL or DANGER
-        if (result.status === "FAIL" || result.status === "DANGER") {
+        // Check failOn severity threshold
+        if (config.thresholds?.failOn && config.thresholds.failOn.length > 0) {
+            const hasFailSeverity = result.findings.some(f => config.thresholds.failOn.includes(f.severity));
+            if (hasFailSeverity) {
+                shouldFail = true;
+            }
+        }
+        if (shouldFail) {
             process.exit(1);
         }
     }
@@ -259,7 +287,7 @@ AcidTest v${VERSION}
 Security scanner for AI agent skills and MCP servers
 
 USAGE:
-  acidtest scan <path> [--json]
+  acidtest scan <path> [--json] [--watch] [--fix] [--no-clear]
   acidtest scan-all <directory> [--json]
   acidtest demo
   acidtest serve
@@ -274,6 +302,9 @@ COMMANDS:
 
 OPTIONS:
   --json        Output results as JSON
+  --watch, -w   Watch for file changes and re-scan automatically
+  --fix         Show actionable remediation suggestions for findings
+  --no-clear    Don't clear terminal between scans (watch mode only)
   --version     Print version number
   --help        Show this help message
 
@@ -290,6 +321,12 @@ EXAMPLES:
   # Scan with JSON output
   acidtest scan ./my-skill --json
 
+  # Show remediation suggestions for findings
+  acidtest scan ./my-skill --fix
+
+  # Watch for changes and re-scan automatically
+  acidtest scan ./my-skill --watch
+
   # Scan all skills/servers in a directory
   acidtest scan-all ./directory
 

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE/D,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB;;GAEG;AACH,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,wBAAwB;IACxB,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,qBAAqB;IACrB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gBAAgB;IAChB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAExB,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;SAAM,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,UAAU,CAAC,IAAc;IACtC,cAAc;IACd,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAE1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC/C,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,CAAC,CAAC;QAE1C,IAAI,UAAU,EAAE,CAAC;YACf,YAAY,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAED,6CAA6C;QAC7C,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,EAAE,CAAC;YACf,4CAA4C;YAC5C,MAAM,WAAW,GAAgB;gBAC/B,aAAa,EAAE,OAAO;gBACtB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,OAAO;gBACf,KAAK,EAAG,KAAe,CAAC,OAAO;aAChC,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAAC,IAAc;IACzC,cAAc;IACd,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAE1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;QAE/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,+BAA+B;YAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC1B,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBAEzB,qDAAqD;gBACrD,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;YAED,2BAA2B;YAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,cAAc,CAAC,CAAC;YAEvD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;YAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;YAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;YAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;YAEnE,IAAI,IAAI,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC;YAEnD,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,yCAAyC;QACzC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CACpD,CAAC;QAEF,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,EAAE,CAAC;YACf,4CAA4C;YAC5C,MAAM,WAAW,GAAgB;gBAC/B,aAAa,EAAE,OAAO;gBACtB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,OAAO;gBACf,KAAK,EAAG,KAAe,CAAC,OAAO;aAChC,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU,CAAC,IAAc;IACtC,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IAEnE,gDAAgD;IAChD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG;QACf,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE;QACzD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE;QACzD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE;QACzD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE;KAC9D,CAAC;IAEF,MAAM,OAAO,GAAG,EAAE,CAAC;IAEnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAEhD,OAAO,CAAC,GAAG,CAAC,IAAK,OAAO,CAAC,IAAK,WAAW,CAAC,CAAC;YAC3C,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAEzB,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,2BAA2B,OAAO,CAAC,IAAI,WAAW,EACjD,KAAe,CAAC,OAAO,CACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gBAAgB;IAChB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,CACT,wEAAwE,CACzE,CAAC;IAEF,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QAC1C,MAAM,WAAW,GACf,MAAM,CAAC,MAAM,KAAK,MAAM;YACtB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM;gBACxB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM;oBACxB,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,KAAK,CAAC;QAEhB,OAAO,CAAC,GAAG,CACT,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,WAAW,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,MAAc;IAC1C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,+CAA+C,CAAC;QACzD,KAAK,MAAM;YACT,OAAO,4CAA4C,CAAC;QACtD,KAAK,MAAM;YACT,OAAO,8CAA8C,CAAC;QACxD,KAAK,QAAQ;YACX,OAAO,+CAA+C,CAAC;QACzD;YACE,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,IAAc;IACvC,oDAAoD;IACpD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAEvD,0CAA0C;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,EAAE;QAC/C,KAAK,EAAE,SAAS,EAAE,+CAA+C;KAClE,CAAC,CAAC;IAEH,6BAA6B;IAC7B,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAC5B,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,gBAAgB;IAChB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAC9B,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;YACF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0ClB,CAAC,CAAC;AACH,CAAC;AAED,UAAU;AACV,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":";AAEA;;;GAGG;AAEH,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAE/D,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AACtD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAEtC,MAAM,OAAO,GAAG,OAAO,CAAC;AAExB;;GAEG;AACH,KAAK,UAAU,IAAI;IACjB,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAEnC,wBAAwB;IACxB,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,EAAE,CAAC,CAAC;QACpC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,qBAAqB;IACrB,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxE,SAAS,EAAE,CAAC;QACZ,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,gBAAgB;IAChB,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAExB,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAClC,MAAM,aAAa,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,CAAC;SAAM,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QAC9B,MAAM,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClC,CAAC;SAAM,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;QAC/B,MAAM,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,oBAAoB,OAAO,EAAE,CAAC,CAAC;QAC7C,OAAO,CAAC,KAAK,CAAC,8CAA8C,CAAC,CAAC;QAC9D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,UAAU,CAAC,IAAc;IACtC,cAAc;IACd,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC;IAC5C,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,GAAG,KAAK,IAAI,CAAC,CAAC;IAE1E,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;QAC/C,OAAO,CAAC,KAAK,CAAC,yDAAyD,CAAC,CAAC;QACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3B,oBAAoB;IACpB,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,EAAE,SAAS,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QACjE,MAAM,cAAc,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC,CAAC;QACnF,OAAO,CAAC,kCAAkC;IAC5C,CAAC;IAED,IAAI,CAAC;QACH,mCAAmC;QACnC,MAAM,UAAU,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,MAAM,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;QAEvC,4DAA4D;QAC5D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,SAAS,EAAE,CAAC,UAAU,CAAC,CAAC;QAEvD,IAAI,UAAU,EAAE,CAAC;YACf,YAAY,CAAC,MAAM,CAAC,CAAC;QACvB,CAAC;aAAM,CAAC;YACN,4BAA4B;YAC5B,MAAM,eAAe,GAAG,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,IAAI,KAAK,CAAC,CAAC;YAC7E,gBAAgB,CAAC,MAAM,EAAE,EAAE,eAAe,EAAE,CAAC,CAAC;QAChD,CAAC;QAED,qCAAqC;QACrC,IAAI,UAAU,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC;QAExE,2BAA2B;QAC3B,IAAI,MAAM,CAAC,UAAU,EAAE,QAAQ,IAAI,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;YAC7E,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QAED,kCAAkC;QAClC,IAAI,MAAM,CAAC,UAAU,EAAE,MAAM,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrE,MAAM,eAAe,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAC/C,MAAM,CAAC,UAAW,CAAC,MAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAChD,CAAC;YACF,IAAI,eAAe,EAAE,CAAC;gBACpB,UAAU,GAAG,IAAI,CAAC;YACpB,CAAC;QACH,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,EAAE,CAAC;YACf,4CAA4C;YAC5C,MAAM,WAAW,GAAgB;gBAC/B,aAAa,EAAE,OAAO;gBACtB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,OAAO;gBACf,KAAK,EAAG,KAAe,CAAC,OAAO;aAChC,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,uBAAuB,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;QACnE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,aAAa,CAAC,IAAc;IACzC,cAAc;IACd,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAC3C,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;IAE1D,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACnD,OAAO,CAAC,KAAK,CAAC,+CAA+C,CAAC,CAAC;QAC/D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,SAAS,CAAC,CAAC;QAE/C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,8BAA8B,CAAC,CAAC;YAC5C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAED,IAAI,UAAU,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QAChD,CAAC;aAAM,CAAC;YACN,+BAA+B;YAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;gBAC1B,gBAAgB,CAAC,MAAM,CAAC,CAAC;gBAEzB,qDAAqD;gBACrD,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;oBAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;YAED,2BAA2B;YAC3B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,CAAC,MAAM,cAAc,CAAC,CAAC;YAEvD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;YAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;YAC/D,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,MAAM,CAAC;YAC/D,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,MAAM,CAAC;YAEnE,IAAI,IAAI,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,IAAI,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;YAC/C,IAAI,MAAM,GAAG,CAAC;gBAAE,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,EAAE,CAAC,CAAC;YAEnD,OAAO,CAAC,GAAG,EAAE,CAAC;QAChB,CAAC;QAED,yCAAyC;QACzC,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,CAC9B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,QAAQ,CACpD,CAAC;QAEF,IAAI,WAAW,EAAE,CAAC;YAChB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,EAAE,CAAC;YACf,4CAA4C;YAC5C,MAAM,WAAW,GAAgB;gBAC/B,aAAa,EAAE,OAAO;gBACtB,IAAI,EAAE,UAAU;gBAChB,OAAO,EAAE,OAAO;gBAChB,MAAM,EAAE,OAAO;gBACf,KAAK,EAAG,KAAe,CAAC,OAAO;aAChC,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,2BAA2B,EAAG,KAAe,CAAC,OAAO,CAAC,CAAC;QACvE,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU,CAAC,IAAc;IACtC,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;IAEnE,gDAAgD;IAChD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,eAAe,CAAC,CAAC;IAE3D,MAAM,QAAQ,GAAG;QACf,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE;QACzD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE;QACzD,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,EAAE;QACzD,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,WAAW,EAAE,gBAAgB,CAAC,EAAE;KAC9D,CAAC;IAEF,MAAM,OAAO,GAAG,EAAE,CAAC;IAEnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACzC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QAE5B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC;YAEhD,OAAO,CAAC,GAAG,CAAC,IAAK,OAAO,CAAC,IAAK,WAAW,CAAC,CAAC;YAC3C,gBAAgB,CAAC,MAAM,CAAC,CAAC;YAEzB,IAAI,CAAC,GAAG,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC5B,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,CAAC,IAAI,CACV,2BAA2B,OAAO,CAAC,IAAI,WAAW,EACjD,KAAe,CAAC,OAAO,CACzB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,gBAAgB;IAChB,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC/B,OAAO,CAAC,GAAG,CACT,wEAAwE,CACzE,CAAC;IAEF,KAAK,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QAC1C,MAAM,WAAW,GACf,MAAM,CAAC,MAAM,KAAK,MAAM;YACtB,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM;gBACxB,CAAC,CAAC,QAAQ;gBACV,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM;oBACxB,CAAC,CAAC,KAAK;oBACP,CAAC,CAAC,KAAK,CAAC;QAEhB,OAAO,CAAC,GAAG,CACT,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,WAAW,oBAAoB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAC9F,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CACT,iEAAiE,CAClE,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,qDAAqD,CAAC,CAAC;AACrE,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,MAAc;IAC1C,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,MAAM;YACT,OAAO,+CAA+C,CAAC;QACzD,KAAK,MAAM;YACT,OAAO,4CAA4C,CAAC;QACtD,KAAK,MAAM;YACT,OAAO,8CAA8C,CAAC;QACxD,KAAK,QAAQ;YACX,OAAO,+CAA+C,CAAC;QACzD;YACE,OAAO,gBAAgB,CAAC;IAC5B,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CAAC,IAAc;IACvC,oDAAoD;IACpD,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACtC,MAAM,aAAa,GAAG,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;IAEvD,0CAA0C;IAC1C,MAAM,SAAS,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,aAAa,CAAC,EAAE;QAC/C,KAAK,EAAE,SAAS,EAAE,+CAA+C;KAClE,CAAC,CAAC;IAEH,6BAA6B;IAC7B,SAAS,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAC5B,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC1B,CAAC,CAAC,CAAC;IAEH,gBAAgB;IAChB,SAAS,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;QAC9B,OAAO,CAAC,KAAK,CAAC,6BAA6B,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,SAAS,SAAS;IAChB,OAAO,CAAC,GAAG,CAAC;YACF,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAmDlB,CAAC,CAAC;AACH,CAAC;AAED,UAAU;AACV,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;IACrB,OAAO,CAAC,KAAK,CAAC,mBAAmB,EAAE,KAAK,CAAC,CAAC;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC,CAAC,CAAC"}

package/dist/layers/code.js

@@ -65,7 +65,8 @@ function scanCodeWithRegex(codeFile, patterns) {
                 line: lineNumber,
                 detail: pattern.description || `Pattern match: ${pattern.name}`,
                 evidence: `Found ${matches.length} occurrence(s)`,
-                patternId: pattern.id
+                patternId: pattern.id,
+                ...(pattern.remediation && { remediation: pattern.remediation })
             });
         }
     }
@@ -137,6 +138,9 @@ function detectSuspiciousPatterns(sourceFile, filePath) {
     const findings = [];
     const dynamicRequires = [];
     const evals = [];
+    const functionConstructors = [];
+    const propertyAccessBypasses = [];
+    const stringConcatenations = [];
     function visit(node) {
         // Check for eval() calls
         if (ts.isCallExpression(node)) {
@@ -145,14 +149,42 @@ function detectSuspiciousPatterns(sourceFile, filePath) {
                 const lineNumber = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
                 evals.push(lineNumber);
             }
-            // Check for require() with non-literal arguments
+            // Check for require() with non-literal arguments (catches dynamic require, template literals, variables)
             if (ts.isIdentifier(expression) && expression.text === 'require') {
                 if (node.arguments.length > 0) {
                     const arg = node.arguments[0];
+                    // Catches: require(variable), require(obj.prop), require(`template${expr}`)
                     if (!ts.isStringLiteral(arg) && !ts.isNoSubstitutionTemplateLiteral(arg)) {
                         const lineNumber = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
                         dynamicRequires.push(lineNumber);
                     }
+                    // Check for string concatenation: require('child_' + 'process')
+                    if (ts.isBinaryExpression(arg) && arg.operatorToken.kind === ts.SyntaxKind.PlusToken) {
+                        const lineNumber = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                        stringConcatenations.push(lineNumber);
+                    }
+                }
+            }
+        }
+        // Check for Function constructor: new Function(...)
+        if (ts.isNewExpression(node)) {
+            const expression = node.expression;
+            if (ts.isIdentifier(expression) && expression.text === 'Function') {
+                const lineNumber = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                functionConstructors.push(lineNumber);
+            }
+        }
+        // Check for bracket notation property access on sensitive objects
+        // Catches: global['child_process'], process['env'], require['cache']
+        if (ts.isElementAccessExpression(node)) {
+            const expression = node.expression;
+            if (ts.isIdentifier(expression)) {
+                const objName = expression.text;
+                // Check if accessing sensitive global objects
+                const sensitiveObjects = ['global', 'process', 'require', 'module', 'exports'];
+                if (sensitiveObjects.includes(objName)) {
+                    const lineNumber = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;
+                    propertyAccessBypasses.push(lineNumber);
                 }
             }
         }
@@ -168,7 +200,8 @@ function detectSuspiciousPatterns(sourceFile, filePath) {
             file: filePath,
             line: dynamicRequires[0],
             detail: `Found ${dynamicRequires.length} dynamic require() call(s)`,
-            evidence: 'Dynamic imports can load arbitrary modules'
+            evidence: 'Dynamic imports can load arbitrary modules',
+            patternId: 'ast-dynamic-require'
         });
     }
     // Add findings for eval usage
@@ -180,7 +213,47 @@ function detectSuspiciousPatterns(sourceFile, filePath) {
             file: filePath,
             line: evals[0],
             detail: `Found ${evals.length} eval() call(s)`,
-            evidence: 'eval() can execute arbitrary code'
+            evidence: 'eval() can execute arbitrary code',
+            patternId: 'ast-eval'
+        });
+    }
+    // Add findings for Function constructor
+    if (functionConstructors.length > 0) {
+        findings.push({
+            severity: 'CRITICAL',
+            category: 'function-constructor',
+            title: 'Function constructor detected',
+            file: filePath,
+            line: functionConstructors[0],
+            detail: `Found ${functionConstructors.length} Function constructor call(s)`,
+            evidence: 'Function constructor can execute arbitrary code like eval()',
+            patternId: 'ast-function-constructor'
+        });
+    }
+    // Add findings for property access bypasses
+    if (propertyAccessBypasses.length > 0) {
+        findings.push({
+            severity: 'MEDIUM',
+            category: 'property-access-bypass',
+            title: 'Bracket notation on sensitive objects',
+            file: filePath,
+            line: propertyAccessBypasses[0],
+            detail: `Found ${propertyAccessBypasses.length} bracket notation access(es) on sensitive objects`,
+            evidence: 'Bracket notation can bypass static analysis: global["child_process"]',
+            patternId: 'ast-bracket-access'
+        });
+    }
+    // Add findings for string concatenation in require
+    if (stringConcatenations.length > 0) {
+        findings.push({
+            severity: 'HIGH',
+            category: 'string-concatenation',
+            title: 'String concatenation in require()',
+            file: filePath,
+            line: stringConcatenations[0],
+            detail: `Found ${stringConcatenations.length} concatenated string(s) in require()`,
+            evidence: 'String concatenation can hide malicious imports: require("child_" + "process")',
+            patternId: 'ast-string-concat'
         });
     }
     return findings;
@@ -206,6 +279,38 @@ function calculateEntropy(str) {
     }
     return entropy;
 }
+/**
+ * Check if string matches common legitimate high-entropy patterns
+ */
+function isLegitimateHighEntropyString(text) {
+    // JWT tokens (header.payload.signature format, starts with eyJ)
+    if (/^eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+$/.test(text)) {
+        return true;
+    }
+    // UUID/GUID (8-4-4-4-12 format)
+    if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(text)) {
+        return true;
+    }
+    // Hex hashes (SHA256: 64 chars, SHA1: 40 chars, MD5: 32 chars)
+    if (/^[0-9a-f]{32}$|^[0-9a-f]{40}$|^[0-9a-f]{64}$/i.test(text)) {
+        return true;
+    }
+    // Base64 strings (common in configs, keys)
+    // Must have padding OR be very long (>100 chars suggests real encoded data)
+    // Short base64-looking strings without padding are suspicious
+    if (/^[A-Za-z0-9+/]+=+$/.test(text) && text.length % 4 === 0) {
+        return true; // Has proper padding
+    }
+    if (/^[A-Za-z0-9+/]+$/.test(text) && text.length > 100) {
+        return true; // Very long, likely real encoded data
+    }
+    // API keys with common prefixes (Stripe, GitHub, etc.)
+    if (/^(sk_|pk_|gh[ps]_|AKIA|ya29\.|glpat-|xox[abp]-)[A-Za-z0-9_-]+$/i.test(text)) {
+        // These ARE suspicious, so return false to flag them
+        return false;
+    }
+    return false;
+}
 /**
  * Detect high-entropy strings that may indicate obfuscation
  */
@@ -218,16 +323,21 @@ function detectHighEntropyStrings(sourceFile, filePath) {
         // Check string literals and template literals
         if (ts.isStringLiteral(node) || ts.isNoSubstitutionTemplateLiteral(node)) {
             const text = node.text;
-            // Skip short strings and URLs (already detected elsewhere)
+            // Skip short strings
             if (text.length < MIN_LENGTH) {
                 ts.forEachChild(node, visit);
                 return;
             }
-            // Skip URLs, they naturally have high entropy
+            // Skip URLs (already detected elsewhere)
             if (/^https?:\/\//.test(text)) {
                 ts.forEachChild(node, visit);
                 return;
             }
+            // Skip legitimate high-entropy strings (JWTs, UUIDs, hashes)
+            if (isLegitimateHighEntropyString(text)) {
+                ts.forEachChild(node, visit);
+                return;
+            }
             const entropy = calculateEntropy(text);
             if (entropy > ENTROPY_THRESHOLD) {
                 const lineNumber = sourceFile.getLineAndCharacterOfPosition(node.getStart()).line + 1;