asterscanner 1.0.0

package/README.md

@@ -0,0 +1,242 @@
+# asterscanner
+
+Security scanner for AI agent skills. Provides pattern-based security scanning and scoring for skill packages before they are published to the [ask](https://joinasterism.com) registry.
+
+## Installation
+
+```bash
+npm install asterscanner
+```
+
+## Quick Start
+
+```typescript
+import { scan } from "asterscanner";
+
+const content = `
+# My Skill
+
+Instructions for my skill...
+`;
+
+const result = scan(content);
+console.log(`Score: ${result.score}/100`);
+console.log(`Passed: ${result.passed}`);
+console.log(`Issues: ${result.issues.length}`);
+```
+
+## Usage
+
+### Basic Scanning
+
+```typescript
+import { Scanner, createScanner, scan } from "asterscanner";
+
+// Quick function
+const result = scan(content);
+
+// Or create a reusable scanner instance
+const scanner = createScanner();
+const result = scanner.scan(content);
+
+// Check if content passes
+if (scanner.passes(content)) {
+  console.log("Content is safe!");
+}
+```
+
+### Custom Options
+
+```typescript
+import { Scanner } from "asterscanner";
+
+const scanner = new Scanner({
+  // Minimum score to pass (default: 50)
+  minScore: 70,
+
+  // Categories to scan (default: all)
+  categories: ["secrets", "code_execution"],
+
+  // Severity levels to include (default: all)
+  severities: ["critical", "high"],
+
+  // Custom patterns
+  customPatterns: [
+    {
+      id: "custom-pattern",
+      pattern: /FORBIDDEN_WORD/gi,
+      type: "custom_issue",
+      category: "secrets",
+      severity: "high",
+      message: "Forbidden word detected",
+    },
+  ],
+});
+```
+
+### Scan Result
+
+```typescript
+interface ScanResult {
+  // Security score (0-100)
+  score: number;
+
+  // Pass/fail status
+  passed: boolean;
+
+  // List of detected issues
+  issues: SecurityIssue[];
+
+  // Counts by severity
+  summary: {
+    critical: number;
+    high: number;
+    medium: number;
+    low: number;
+    info: number;
+    total: number;
+  };
+
+  // Scan metadata
+  metadata: {
+    scannedAt: string;
+    contentLength: number;
+    lineCount: number;
+    scanDurationMs: number;
+  };
+}
+```
+
+### Security Issue
+
+```typescript
+interface SecurityIssue {
+  patternId: string;
+  type: string;
+  category: PatternCategory;
+  severity: Severity;
+  message: string;
+  line: number;
+  column?: number;
+  match: string;
+  recommendation?: string;
+}
+```
+
+## Security Patterns
+
+The scanner detects the following categories of issues:
+
+### Secrets
+
+- Hardcoded API keys
+- Hardcoded passwords
+- Tokens and secrets
+- AWS access keys
+- Private keys
+- GitHub tokens
+
+### Code Execution
+
+- `eval()` usage
+- `new Function()` constructor
+- Command injection
+- curl/wget pipe to shell
+
+### File System
+
+- Dangerous `rm -rf` commands
+- chmod 777 permissions
+- Filesystem formatting
+- Direct device writes
+
+### Credentials
+
+- /etc/passwd access
+- /etc/shadow access
+- SSH directory access
+- AWS credentials access
+- Kubernetes config access
+
+### Network
+
+- Listening on all interfaces
+- Disabled SSL verification
+- Hardcoded authentication
+
+### System
+
+- Privilege escalation
+- NOPASSWD sudo
+- Cron modification
+- Firewall changes
+
+## Scoring
+
+| Severity | Deduction |
+| -------- | --------- |
+| Critical | -25       |
+| High     | -15       |
+| Medium   | -10       |
+| Low      | -5        |
+| Info     | 0         |
+
+Score starts at 100 and cannot go below 0.
+
+### Score Ratings
+
+| Score  | Rating    |
+| ------ | --------- |
+| 90-100 | Excellent |
+| 70-89  | Good      |
+| 50-69  | Fair      |
+| 25-49  | Poor      |
+| 0-24   | Critical  |
+
+## API
+
+### `scan(content: string, options?: ScanOptions): ScanResult`
+
+Quick function to scan content.
+
+### `createScanner(options?: ScanOptions): Scanner`
+
+Create a new Scanner instance.
+
+### `class Scanner`
+
+- `scan(content: string): ScanResult` - Scan content
+- `passes(content: string): boolean` - Quick pass/fail check
+- `getOptions(): ScanOptions` - Get current options
+- `getPatterns(): SecurityPattern[]` - Get active patterns
+
+### `calculateScore(issues: SecurityIssue[]): number`
+
+Calculate security score from issues.
+
+### `SECURITY_PATTERNS: SecurityPattern[]`
+
+Array of built-in security patterns.
+
+## Development
+
+```bash
+# Install dependencies
+pnpm install
+
+# Build
+pnpm build
+
+# Run tests
+pnpm test
+
+# Watch mode
+pnpm test:watch
+
+# Coverage
+pnpm test:coverage
+```
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,15 @@
+/**
+ * asterscanner - Security Scanner for AI Agent Skills
+ *
+ * Provides pattern-based security scanning and scoring
+ * for skill packages before they are published.
+ */
+export { Scanner, createScanner, scan } from "./scanner.js";
+export { SECURITY_PATTERNS, PATTERN_CATEGORY_DESCRIPTIONS } from "./patterns.js";
+export { calculateScore, SEVERITY_WEIGHTS } from "./scoring.js";
+export type { SecurityIssue, ScanResult, ScanOptions, SecurityPattern, Severity, PatternCategory, } from "./types.js";
+export { validateManifest, parseSkillFrontmatter, isValidParameterType, isValidCapability, validateAnthropicName, validateAnthropicDescription, parseSkillDirectory, convertLegacySkill, } from "./skill-schema.js";
+export type { AnthropicSkillMetadata, SkillFile, SkillDirectory, LoadLevel, ProgressiveContent, AskSkillExtensions, ParameterType, SkillParameter, SkillContract, ContractExample, SkillCapability, CapabilityDeclaration, SkillReference, SkillComposition, SkillTestCase, SkillTestSuite, SkillVariant, SkillManifest, } from "./skill-schema.js";
+export { SkillTestRunner, validateTests, calculateCoverage, formatTestResults, } from "./skill-tester.js";
+export type { TestResult, TestSuiteResult, TestRunnerOptions, TestExecutor, } from "./skill-tester.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChE,YAAY,EACV,aAAa,EACb,UAAU,EACV,WAAW,EACX,eAAe,EACf,QAAQ,EACR,eAAe,GAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB,EAEjB,qBAAqB,EACrB,4BAA4B,EAE5B,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EAEV,sBAAsB,EACtB,SAAS,EACT,cAAc,EACd,SAAS,EACT,kBAAkB,EAElB,kBAAkB,EAClB,aAAa,EACb,cAAc,EACd,aAAa,EACb,eAAe,EACf,eAAe,EACf,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,aAAa,GACd,MAAM,mBAAmB,CAAC;AAG3B,OAAO,EACL,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC;AAC3B,YAAY,EACV,UAAU,EACV,eAAe,EACf,iBAAiB,EACjB,YAAY,GACb,MAAM,mBAAmB,CAAC"}

package/dist/index.js

@@ -0,0 +1,18 @@
+/**
+ * asterscanner - Security Scanner for AI Agent Skills
+ *
+ * Provides pattern-based security scanning and scoring
+ * for skill packages before they are published.
+ */
+export { Scanner, createScanner, scan } from "./scanner.js";
+export { SECURITY_PATTERNS, PATTERN_CATEGORY_DESCRIPTIONS } from "./patterns.js";
+export { calculateScore, SEVERITY_WEIGHTS } from "./scoring.js";
+// Skill Schema types and utilities
+export { validateManifest, parseSkillFrontmatter, isValidParameterType, isValidCapability, 
+// Anthropic spec validators
+validateAnthropicName, validateAnthropicDescription, 
+// Directory-based skill utilities
+parseSkillDirectory, convertLegacySkill, } from "./skill-schema.js";
+// Skill Testing framework
+export { SkillTestRunner, validateTests, calculateCoverage, formatTestResults, } from "./skill-tester.js";
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,cAAc,CAAC;AAC5D,OAAO,EAAE,iBAAiB,EAAE,6BAA6B,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAUhE,mCAAmC;AACnC,OAAO,EACL,gBAAgB,EAChB,qBAAqB,EACrB,oBAAoB,EACpB,iBAAiB;AACjB,4BAA4B;AAC5B,qBAAqB,EACrB,4BAA4B;AAC5B,kCAAkC;AAClC,mBAAmB,EACnB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAwB3B,0BAA0B;AAC1B,OAAO,EACL,eAAe,EACf,aAAa,EACb,iBAAiB,EACjB,iBAAiB,GAClB,MAAM,mBAAmB,CAAC"}

package/dist/patterns.d.ts

@@ -0,0 +1,18 @@
+import type { SecurityPattern, PatternCategory } from "./types.js";
+/**
+ * Pattern category descriptions
+ */
+export declare const PATTERN_CATEGORY_DESCRIPTIONS: Record<PatternCategory, string>;
+/**
+ * Security patterns for skill content scanning
+ */
+export declare const SECURITY_PATTERNS: SecurityPattern[];
+/**
+ * Get patterns filtered by category
+ */
+export declare function getPatternsByCategory(category: PatternCategory): SecurityPattern[];
+/**
+ * Get patterns filtered by severity
+ */
+export declare function getPatternsBySeverity(severity: SecurityPattern["severity"]): SecurityPattern[];
+//# sourceMappingURL=patterns.d.ts.map

package/dist/patterns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../src/patterns.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAEnE;;GAEG;AACH,eAAO,MAAM,6BAA6B,EAAE,MAAM,CAAC,eAAe,EAAE,MAAM,CAOzE,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,iBAAiB,EAAE,eAAe,EAsS9C,CAAC;AAEF;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,eAAe,GACxB,eAAe,EAAE,CAEnB;AAED;;GAEG;AACH,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,eAAe,CAAC,UAAU,CAAC,GACpC,eAAe,EAAE,CAEnB"}

package/dist/patterns.js

@@ -0,0 +1,314 @@
+/**
+ * Pattern category descriptions
+ */
+export const PATTERN_CATEGORY_DESCRIPTIONS = {
+    secrets: "Hardcoded secrets and credentials",
+    code_execution: "Dangerous code execution patterns",
+    file_system: "Dangerous file system operations",
+    network: "Suspicious network access",
+    credentials: "Credential file access",
+    system: "System-level operations",
+};
+/**
+ * Security patterns for skill content scanning
+ */
+export const SECURITY_PATTERNS = [
+    // === SECRETS ===
+    {
+        id: "secret-api-key",
+        pattern: /(?:api[_-]?key|apikey)\s*[:=]\s*['"][a-zA-Z0-9_\-]{16,}['"]/gi,
+        type: "hardcoded_secret",
+        category: "secrets",
+        severity: "critical",
+        message: "Hardcoded API key detected",
+        recommendation: "Use environment variables instead of hardcoded keys",
+    },
+    {
+        id: "secret-password",
+        pattern: /(?:password|passwd|pwd)\s*[:=]\s*['"][^'"]{4,}['"]/gi,
+        type: "hardcoded_secret",
+        category: "secrets",
+        severity: "critical",
+        message: "Hardcoded password detected",
+        recommendation: "Use environment variables or secure credential storage",
+    },
+    {
+        id: "secret-token",
+        pattern: /(?:secret|token|auth)\s*[:=]\s*['"][a-zA-Z0-9_\-]{8,}['"]/gi,
+        type: "hardcoded_secret",
+        category: "secrets",
+        severity: "critical",
+        message: "Hardcoded secret or token detected",
+        recommendation: "Use environment variables instead",
+    },
+    {
+        id: "secret-aws-key",
+        pattern: /AKIA[0-9A-Z]{16}/g,
+        type: "aws_access_key",
+        category: "secrets",
+        severity: "critical",
+        message: "AWS Access Key ID detected",
+        recommendation: "Remove AWS credentials and use IAM roles or environment variables",
+    },
+    {
+        id: "secret-private-key",
+        pattern: /-----BEGIN (?:RSA |DSA |EC |OPENSSH )?PRIVATE KEY-----/g,
+        type: "private_key",
+        category: "secrets",
+        severity: "critical",
+        message: "Private key detected",
+        recommendation: "Never include private keys in skill content",
+    },
+    {
+        id: "secret-github-token",
+        pattern: /gh[pousr]_[A-Za-z0-9_]{36,}/g,
+        type: "github_token",
+        category: "secrets",
+        severity: "critical",
+        message: "GitHub token detected",
+        recommendation: "Remove GitHub token and use secure credential storage",
+    },
+    // === CODE EXECUTION ===
+    {
+        id: "exec-eval",
+        pattern: /\beval\s*\(/gi,
+        type: "dangerous_eval",
+        category: "code_execution",
+        severity: "high",
+        message: "Use of eval() can execute arbitrary code",
+        recommendation: "Avoid eval() - use safer alternatives like JSON.parse()",
+    },
+    {
+        id: "exec-function-constructor",
+        pattern: /new\s+Function\s*\(/gi,
+        type: "dangerous_function",
+        category: "code_execution",
+        severity: "high",
+        message: "Function constructor can execute arbitrary code",
+        recommendation: "Avoid dynamic function creation",
+    },
+    {
+        id: "exec-shell-injection",
+        pattern: /\bexec\s*\(\s*['"`].*\$\{?/gi,
+        type: "command_injection",
+        category: "code_execution",
+        severity: "critical",
+        message: "Potential command injection vulnerability",
+        recommendation: "Sanitize all inputs before shell execution",
+    },
+    {
+        id: "exec-curl-pipe",
+        pattern: /curl\s+[^\|]*\|\s*(?:bash|sh|python|perl|ruby)/gi,
+        type: "remote_code_execution",
+        category: "code_execution",
+        severity: "critical",
+        message: "Remote code execution via curl pipe to shell",
+        recommendation: "Download files first and verify before execution",
+    },
+    {
+        id: "exec-wget-pipe",
+        pattern: /wget\s+[^\|]*\|\s*(?:bash|sh|python|perl|ruby)/gi,
+        type: "remote_code_execution",
+        category: "code_execution",
+        severity: "critical",
+        message: "Remote code execution via wget pipe to shell",
+        recommendation: "Download files first and verify before execution",
+    },
+    // === FILE SYSTEM ===
+    {
+        id: "fs-rm-rf-root",
+        pattern: /rm\s+-rf\s+\/(?!\w)/gi,
+        type: "dangerous_deletion",
+        category: "file_system",
+        severity: "critical",
+        message: "Dangerous recursive deletion of root filesystem",
+        recommendation: "Never delete from root - use specific paths",
+    },
+    {
+        id: "fs-rm-rf-home",
+        pattern: /rm\s+-rf\s+~\//gi,
+        type: "dangerous_deletion",
+        category: "file_system",
+        severity: "critical",
+        message: "Dangerous recursive deletion of home directory",
+        recommendation: "Be specific about what to delete",
+    },
+    {
+        id: "fs-rm-rf-path",
+        pattern: /rm\s+-rf\s+\/(?:var|usr|etc|home|opt|tmp)/gi,
+        type: "dangerous_deletion",
+        category: "file_system",
+        severity: "critical",
+        message: "Dangerous recursive deletion of system directory",
+        recommendation: "Avoid deleting system directories",
+    },
+    {
+        id: "fs-chmod-777",
+        pattern: /chmod\s+777/gi,
+        type: "insecure_permissions",
+        category: "file_system",
+        severity: "medium",
+        message: "Setting world-writable permissions (777)",
+        recommendation: "Use more restrictive permissions",
+    },
+    {
+        id: "fs-mkfs",
+        pattern: /mkfs\s+/gi,
+        type: "dangerous_format",
+        category: "file_system",
+        severity: "critical",
+        message: "Filesystem formatting command detected",
+        recommendation: "Avoid filesystem formatting operations",
+    },
+    {
+        id: "fs-dd-if",
+        pattern: /dd\s+if=.*of=\/dev\//gi,
+        type: "dangerous_write",
+        category: "file_system",
+        severity: "critical",
+        message: "Direct device write detected",
+        recommendation: "Avoid writing directly to device files",
+    },
+    // === SENSITIVE FILES ===
+    {
+        id: "file-etc-passwd",
+        pattern: /\/etc\/passwd/gi,
+        type: "sensitive_file_access",
+        category: "credentials",
+        severity: "high",
+        message: "Accessing /etc/passwd",
+        recommendation: "Avoid accessing system password file",
+    },
+    {
+        id: "file-etc-shadow",
+        pattern: /\/etc\/shadow/gi,
+        type: "sensitive_file_access",
+        category: "credentials",
+        severity: "critical",
+        message: "Accessing /etc/shadow",
+        recommendation: "Never access shadow password file",
+    },
+    {
+        id: "file-etc-sudoers",
+        pattern: /\/etc\/sudoers/gi,
+        type: "sensitive_file_access",
+        category: "credentials",
+        severity: "critical",
+        message: "Accessing sudoers file",
+        recommendation: "Avoid modifying sudo configuration",
+    },
+    {
+        id: "file-ssh-dir",
+        pattern: /\.ssh\//gi,
+        type: "credential_file_access",
+        category: "credentials",
+        severity: "high",
+        message: "Accessing SSH directory",
+        recommendation: "Avoid accessing SSH credentials",
+    },
+    {
+        id: "file-aws-dir",
+        pattern: /\.aws\//gi,
+        type: "credential_file_access",
+        category: "credentials",
+        severity: "high",
+        message: "Accessing AWS credentials directory",
+        recommendation: "Use IAM roles instead of stored credentials",
+    },
+    {
+        id: "file-kube-dir",
+        pattern: /\.kube\//gi,
+        type: "credential_file_access",
+        category: "credentials",
+        severity: "high",
+        message: "Accessing Kubernetes config directory",
+        recommendation: "Avoid accessing kubeconfig directly",
+    },
+    {
+        id: "file-env",
+        pattern: /cat\s+.*\.env/gi,
+        type: "env_file_access",
+        category: "credentials",
+        severity: "medium",
+        message: "Reading .env file contents",
+        recommendation: "Avoid exposing environment files",
+    },
+    // === NETWORK ===
+    {
+        id: "net-listen-all",
+        pattern: /listen\s*\(\s*['"]0\.0\.0\.0['"]/gi,
+        type: "network_exposure",
+        category: "network",
+        severity: "medium",
+        message: "Listening on all network interfaces",
+        recommendation: "Bind to specific interfaces when possible",
+    },
+    {
+        id: "net-disable-ssl",
+        pattern: /(?:ssl|tls)_?verify\s*[:=]\s*(?:false|0)/gi,
+        type: "insecure_ssl",
+        category: "network",
+        severity: "high",
+        message: "SSL/TLS verification disabled",
+        recommendation: "Always verify SSL certificates",
+    },
+    {
+        id: "net-http-basic-auth",
+        pattern: /Authorization:\s*Basic\s+[A-Za-z0-9+\/=]+/gi,
+        type: "exposed_credentials",
+        category: "network",
+        severity: "high",
+        message: "Hardcoded Basic authentication header",
+        recommendation: "Use environment variables for authentication",
+    },
+    // === SYSTEM ===
+    {
+        id: "sys-setuid",
+        pattern: /setuid\s*\(0\)/gi,
+        type: "privilege_escalation",
+        category: "system",
+        severity: "critical",
+        message: "Setting process UID to root",
+        recommendation: "Avoid privilege escalation",
+    },
+    {
+        id: "sys-sudo-nopasswd",
+        pattern: /NOPASSWD/gi,
+        type: "sudo_bypass",
+        category: "system",
+        severity: "high",
+        message: "NOPASSWD sudo configuration",
+        recommendation: "Require password for sudo commands",
+    },
+    {
+        id: "sys-cron-write",
+        pattern: /\/etc\/cron/gi,
+        type: "cron_modification",
+        category: "system",
+        severity: "medium",
+        message: "Accessing cron configuration",
+        recommendation: "Avoid modifying system cron jobs",
+    },
+    {
+        id: "sys-iptables",
+        pattern: /iptables\s+-[A-Z]/gi,
+        type: "firewall_modification",
+        category: "system",
+        severity: "medium",
+        message: "Modifying firewall rules",
+        recommendation: "Document any required firewall changes",
+    },
+];
+/**
+ * Get patterns filtered by category
+ */
+export function getPatternsByCategory(category) {
+    return SECURITY_PATTERNS.filter((p) => p.category === category);
+}
+/**
+ * Get patterns filtered by severity
+ */
+export function getPatternsBySeverity(severity) {
+    return SECURITY_PATTERNS.filter((p) => p.severity === severity);
+}
+//# sourceMappingURL=patterns.js.map

package/dist/patterns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"patterns.js","sourceRoot":"","sources":["../src/patterns.ts"],"names":[],"mappings":"AAEA;;GAEG;AACH,MAAM,CAAC,MAAM,6BAA6B,GAAoC;IAC5E,OAAO,EAAE,mCAAmC;IAC5C,cAAc,EAAE,mCAAmC;IACnD,WAAW,EAAE,kCAAkC;IAC/C,OAAO,EAAE,2BAA2B;IACpC,WAAW,EAAE,wBAAwB;IACrC,MAAM,EAAE,yBAAyB;CAClC,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,kBAAkB;IAClB;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EACL,+DAA+D;QACjE,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,4BAA4B;QACrC,cAAc,EAAE,qDAAqD;KACtE;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,OAAO,EACL,sDAAsD;QACxD,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,6BAA6B;QACtC,cAAc,EAAE,wDAAwD;KACzE;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EACL,6DAA6D;QAC/D,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,oCAAoC;QAC7C,cAAc,EAAE,mCAAmC;KACpD;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,mBAAmB;QAC5B,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,4BAA4B;QACrC,cAAc,EAAE,mEAAmE;KACpF;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,OAAO,EAAE,yDAAyD;QAClE,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,sBAAsB;QAC/B,cAAc,EAAE,6CAA6C;KAC9D;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,OAAO,EAAE,8BAA8B;QACvC,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,uBAAuB;QAChC,cAAc,EAAE,uDAAuD;KACxE;IAED,yBAAyB;IACzB;QACE,EAAE,EAAE,WAAW;QACf,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,0CAA0C;QACnD,cAAc,EAAE,yDAAyD;KAC1E;IACD;QACE,EAAE,EAAE,2BAA2B;QAC/B,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,iDAAiD;QAC1D,cAAc,EAAE,iCAAiC;KAClD;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,OAAO,EAAE,8BAA8B;QACvC,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,2CAA2C;QACpD,cAAc,EAAE,4CAA4C;KAC7D;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,kDAAkD;QAC3D,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,8CAA8C;QACvD,cAAc,EAAE,kDAAkD;KACnE;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,kDAAkD;QAC3D,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,gBAAgB;QAC1B,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,8CAA8C;QACvD,cAAc,EAAE,kDAAkD;KACnE;IAED,sBAAsB;IACtB;QACE,EAAE,EAAE,eAAe;QACnB,OAAO,EAAE,uBAAuB;QAChC,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,iDAAiD;QAC1D,cAAc,EAAE,6CAA6C;KAC9D;IACD;QACE,EAAE,EAAE,eAAe;QACnB,OAAO,EAAE,kBAAkB;QAC3B,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,gDAAgD;QACzD,cAAc,EAAE,kCAAkC;KACnD;IACD;QACE,EAAE,EAAE,eAAe;QACnB,OAAO,EAAE,6CAA6C;QACtD,IAAI,EAAE,oBAAoB;QAC1B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,kDAAkD;QAC3D,cAAc,EAAE,mCAAmC;KACpD;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,0CAA0C;QACnD,cAAc,EAAE,kCAAkC;KACnD;IACD;QACE,EAAE,EAAE,SAAS;QACb,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,wCAAwC;QACjD,cAAc,EAAE,wCAAwC;KACzD;IACD;QACE,EAAE,EAAE,UAAU;QACd,OAAO,EAAE,wBAAwB;QACjC,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,8BAA8B;QACvC,cAAc,EAAE,wCAAwC;KACzD;IAED,0BAA0B;IAC1B;QACE,EAAE,EAAE,iBAAiB;QACrB,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,uBAAuB;QAChC,cAAc,EAAE,sCAAsC;KACvD;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,uBAAuB;QAChC,cAAc,EAAE,mCAAmC;KACpD;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,OAAO,EAAE,kBAAkB;QAC3B,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,wBAAwB;QACjC,cAAc,EAAE,oCAAoC;KACrD;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,yBAAyB;QAClC,cAAc,EAAE,iCAAiC;KAClD;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,WAAW;QACpB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,qCAAqC;QAC9C,cAAc,EAAE,6CAA6C;KAC9D;IACD;QACE,EAAE,EAAE,eAAe;QACnB,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,wBAAwB;QAC9B,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,uCAAuC;QAChD,cAAc,EAAE,qCAAqC;KACtD;IACD;QACE,EAAE,EAAE,UAAU;QACd,OAAO,EAAE,iBAAiB;QAC1B,IAAI,EAAE,iBAAiB;QACvB,QAAQ,EAAE,aAAa;QACvB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,4BAA4B;QACrC,cAAc,EAAE,kCAAkC;KACnD;IAED,kBAAkB;IAClB;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,oCAAoC;QAC7C,IAAI,EAAE,kBAAkB;QACxB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,qCAAqC;QAC9C,cAAc,EAAE,2CAA2C;KAC5D;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,OAAO,EAAE,4CAA4C;QACrD,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,+BAA+B;QACxC,cAAc,EAAE,gCAAgC;KACjD;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,OAAO,EAAE,6CAA6C;QACtD,IAAI,EAAE,qBAAqB;QAC3B,QAAQ,EAAE,SAAS;QACnB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,uCAAuC;QAChD,cAAc,EAAE,8CAA8C;KAC/D;IAED,iBAAiB;IACjB;QACE,EAAE,EAAE,YAAY;QAChB,OAAO,EAAE,kBAAkB;QAC3B,IAAI,EAAE,sBAAsB;QAC5B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,6BAA6B;QACtC,cAAc,EAAE,4BAA4B;KAC7C;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,OAAO,EAAE,YAAY;QACrB,IAAI,EAAE,aAAa;QACnB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,6BAA6B;QACtC,cAAc,EAAE,oCAAoC;KACrD;IACD;QACE,EAAE,EAAE,gBAAgB;QACpB,OAAO,EAAE,eAAe;QACxB,IAAI,EAAE,mBAAmB;QACzB,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,8BAA8B;QACvC,cAAc,EAAE,kCAAkC;KACnD;IACD;QACE,EAAE,EAAE,cAAc;QAClB,OAAO,EAAE,qBAAqB;QAC9B,IAAI,EAAE,uBAAuB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,0BAA0B;QACnC,cAAc,EAAE,wCAAwC;KACzD;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAyB;IAEzB,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AAClE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,qBAAqB,CACnC,QAAqC;IAErC,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC;AAClE,CAAC"}

package/dist/scanner.d.ts

@@ -0,0 +1,46 @@
+import type { ScanResult, ScanOptions, SecurityPattern } from "./types.js";
+/**
+ * Security scanner for skill content
+ */
+export declare class Scanner {
+    private options;
+    private patterns;
+    constructor(options?: ScanOptions);
+    /**
+     * Build the list of patterns to use based on options
+     */
+    private buildPatternList;
+    /**
+     * Sanitize matched content for display (truncate and mask sensitive parts)
+     */
+    private sanitizeMatch;
+    /**
+     * Scan a single line for security issues
+     */
+    private scanLine;
+    /**
+     * Scan content for security issues
+     */
+    scan(content: string): ScanResult;
+    /**
+     * Quick check if content passes security requirements
+     */
+    passes(content: string): boolean;
+    /**
+     * Get the current options
+     */
+    getOptions(): Required<ScanOptions>;
+    /**
+     * Get the active patterns
+     */
+    getPatterns(): SecurityPattern[];
+}
+/**
+ * Create a new scanner instance
+ */
+export declare function createScanner(options?: ScanOptions): Scanner;
+/**
+ * Quick scan function for simple use cases
+ */
+export declare function scan(content: string, options?: ScanOptions): ScanResult;
+//# sourceMappingURL=scanner.d.ts.map

package/dist/scanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../src/scanner.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAEV,UAAU,EACV,WAAW,EACX,eAAe,EAGhB,MAAM,YAAY,CAAC;AAapB;;GAEG;AACH,qBAAa,OAAO;IAClB,OAAO,CAAC,OAAO,CAAwB;IACvC,OAAO,CAAC,QAAQ,CAAoB;gBAExB,OAAO,GAAE,WAAgB;IAKrC;;OAEG;IACH,OAAO,CAAC,gBAAgB;IAYxB;;OAEG;IACH,OAAO,CAAC,aAAa;IAerB;;OAEG;IACH,OAAO,CAAC,QAAQ;IAkChB;;OAEG;IACH,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,UAAU;IAoDjC;;OAEG;IACH,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO;IAIhC;;OAEG;IACH,UAAU,IAAI,QAAQ,CAAC,WAAW,CAAC;IAInC;;OAEG;IACH,WAAW,IAAI,eAAe,EAAE;CAGjC;AAED;;GAEG;AACH,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,OAAO,CAE5D;AAED;;GAEG;AACH,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,WAAW,GAAG,UAAU,CAEvE"}