ccbot-cli 2.0.0 → 2.1.0

package/skills/tools/verify-security/SKILL.md

@@ -0,0 +1,143 @@
+---
+name: verify-security
+description: 安全校验关卡。自动扫描代码安全漏洞，检测危险模式，确保安全决策有文档记录。当魔尊提到安全扫描、漏洞检测、安全审计、代码安全、OWASP、注入检测、敏感信息泄露时使用。在新建模块、安全相关变更、攻防任务、重构完成时自动触发。
+license: MIT
+compatibility: node>=18
+user-invocable: true
+disable-model-invocation: false
+allowed-tools: Bash, Read, Grep
+argument-hint: <扫描路径>
+---
+
+# ⚖ 校验关卡 · 安全校验
+
+
+## 核心原则
+
+```
+安全即道基，破则劫败
+安全决策必须可追溯
+Critical/High 问题必须修复后才能交付
+```
+
+## 自动扫描
+
+运行安全扫描脚本（跨平台）：
+
+```bash
+# 在 skill 目录下运行
+node scripts/security_scanner.js <扫描路径>
+node scripts/security_scanner.js <扫描路径> -v           # 详细模式
+node scripts/security_scanner.js <扫描路径> --json       # JSON 输出
+node scripts/security_scanner.js <扫描路径> --exclude vendor  # 排除目录
+```
+
+## 检测范围
+
+### 自动检测的漏洞类型
+
+| 类别 | 检测项 | 严重度 |
+|------|--------|--------|
+| **注入** | SQL 注入、命令注入、代码注入 | 🔴 Critical |
+| **敏感信息** | 硬编码密钥、AWS Key、私钥 | 🔴 Critical |
+| **XSS** | innerHTML、dangerouslySetInnerHTML | 🟠 High |
+| **反序列化** | pickle.loads、yaml.load | 🟠 High |
+| **路径遍历** | 未验证的文件路径操作 | 🟠 High |
+| **SSRF** | 未验证的 URL 请求 | 🟠 High |
+| **XXE** | 不安全的 XML 解析 | 🟠 High |
+| **弱加密** | MD5、SHA1 用于安全场景 | 🟡 Medium |
+| **不安全随机** | random 模块用于安全场景 | 🟡 Medium |
+| **调试代码** | console.log、print、debugger | 🔵 Low |
+
+### 文档层面检查
+
+安全相关代码必须在 DESIGN.md 中记录：
+
+- [ ] **威胁模型** — 防御哪些攻击
+- [ ] **安全决策** — 为何选择此方案
+- [ ] **安全边界** — 信任边界在哪里
+- [ ] **已知风险** — 接受了哪些风险
+
+## 危险模式速查
+
+### Python
+```python
+# 🔴 危险 - 触犯道基
+eval(), exec(), os.system()
+subprocess(..., shell=True)
+pickle.loads(), yaml.load()
+cursor.execute(f"SELECT * FROM t WHERE id = {id}")
+
+# ✅ 安全替代 - 道基稳固
+ast.literal_eval()
+subprocess([...], shell=False)
+yaml.safe_load()
+cursor.execute("SELECT * FROM t WHERE id = %s", (id,))
+```
+
+### JavaScript
+```javascript
+// 🔴 危险 - 触犯道基
+eval(), innerHTML, document.write()
+new Function(userInput)
+
+// ✅ 安全替代 - 道基稳固
+JSON.parse(), textContent
+模板引擎自动转义
+```
+
+### Go
+```go
+// 🔴 危险 - 触犯道基
+exec.Command("sh", "-c", userInput)
+template.HTML(userInput)
+
+// ✅ 安全替代 - 道基稳固
+exec.Command("cmd", args...)
+html/template 自动转义
+```
+
+## 校验流程
+
+```
+1. 运行 security_scanner.js 自动扫描
+2. 分析扫描结果，按严重度排序
+3. 检查安全决策是否有文档记录
+4. 输出安全校验报告
+5. Critical/High 问题必须修复后才能交付
+```
+
+## 自动触发时机
+
+| 场景 | 触发条件 |
+|------|----------|
+| 新建模块 | 模块创建完成时 |
+| 安全相关变更 | 涉及认证、授权、加密、输入处理 |
+| 攻防任务 | 红队/蓝队任务完成时 |
+| 重构完成 | 重构任务完成时 |
+| 提交前 | 代码提交前检查 |
+
+## 校验报告格式
+
+```
+## 安全校验报告
+
+✓ 通过 | ✗ 未通过
+
+- 🔴 Critical: N
+- 🟠 High: N
+- 🟡 Medium: N
+- 🔵 Low: N
+
+### 发现问题
+
+| 文件 | 行号 | 类型 | 严重度 | 描述 |
+|------|------|------|--------|------|
+| ... | ... | ... | ... | ... |
+
+### 结论
+
+可交付 / 需修复后交付
+```
+
+---

package/skills/tools/verify-security/scripts/security_scanner.js

@@ -0,0 +1,283 @@
+#!/usr/bin/env node
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+
+const SEVERITY_ORDER = { critical: 0, high: 1, medium: 2, low: 3, info: 4 };
+
+// prettier-ignore
+const SECURITY_RULES = [
+  {
+    id: 'SQL_INJECTION_DYNAMIC', category: '注入',
+    severity: 'critical',
+    pattern: new RegExp(
+      '\\b(execute|query|raw)\\s*\\(\\s*' +
+      '(f["\']|["\'][^"\'\\n]*["\']\\s*\\+\\s*|["\'][^"\'\\n]*["\']\\s*%\\s*[^,)]|["\'][^"\'\\n]*["\']' +
+      '\\.format\\s*\\()', 'i'),
+    extensions: ['.py', '.js', '.ts', '.go', '.java', '.php'],
+    message: '可能存在 SQL 注入风险',
+    recommendation: '使用参数化查询或 ORM',
+  },
+  {
+    id: 'SQL_INJECTION_FSTRING', category: '注入',
+    severity: 'critical',
+    pattern: /cursor\.(execute|executemany)\s*\(\s*f["']/i,
+    extensions: ['.py'],
+    message: '使用 f-string 构造 SQL 语句',
+    recommendation: '使用参数化查询',
+  },
+  {
+    id: 'COMMAND_INJECTION', category: '注入',
+    severity: 'critical',
+    pattern: /(os\.system|os\.popen|subprocess\.call|subprocess\.run|subprocess\.Popen)\s*\([^)]*shell\s*=\s*True/i,
+    extensions: ['.py'],
+    message: '使用 shell=True 可能导致命令注入',
+    recommendation: '避免 shell=True，使用列表参数',
+  },
+  {
+    id: 'COMMAND_INJECTION_EVAL', category: '注入',
+    severity: 'critical',
+    pattern: /\b(eval|exec)\s*\([^)]*\b(input|request|argv|args)/i,
+    extensions: ['.py'],
+    message: 'eval/exec 执行用户输入',
+    recommendation: '避免对用户输入使用 eval/exec',
+  },
+  {
+    id: 'HARDCODED_SECRET', category: '敏感信息',
+    severity: 'high',
+    pattern: /(?<!\w)(password|passwd|pwd|secret|api_key|apikey|token|auth_token)\s*=\s*["'][^"']{8,}["']/i,
+    excludePattern: /(example|placeholder|changeme|xxx|your[_-]|TODO|FIXME|<.*>|\*{3,})/i,
+    extensions: [
+      '.py', '.js', '.ts', '.go', '.java', '.php',
+      '.rb', '.yaml', '.yml', '.json', '.env',
+    ],
+    message: '可能存在硬编码密钥/密码',
+    recommendation: '使用环境变量或密钥管理服务',
+  },
+  {
+    id: 'HARDCODED_AWS_KEY', category: '敏感信息',
+    severity: 'critical',
+    pattern: /AKIA[0-9A-Z]{16}/,
+    extensions: ['*'],
+    message: '发现 AWS Access Key',
+    recommendation: '立即轮换密钥，使用 IAM 角色或环境变量',
+  },
+  {
+    id: 'HARDCODED_PRIVATE_KEY', category: '敏感信息',
+    severity: 'critical',
+    pattern: /-----BEGIN (RSA |EC |DSA |OPENSSH )?PRIVATE KEY-----/,
+    extensions: ['*'],
+    message: '发现私钥',
+    recommendation: '私钥不应提交到代码库',
+  },
+  {
+    id: 'XSS_INNERHTML', category: 'XSS', severity: 'high',
+    pattern: /\.innerHTML\s*=|\.outerHTML\s*=|document\.write\s*\(/i,
+    extensions: ['.js', '.ts', '.jsx', '.tsx', '.html'],
+    message: '直接操作 innerHTML 可能导致 XSS',
+    recommendation: '使用 textContent 或框架的安全绑定',
+  },
+  {
+    id: 'XSS_DANGEROUSLY', category: 'XSS',
+    severity: 'medium',
+    pattern: /dangerouslySetInnerHTML/i,
+    extensions: ['.js', '.ts', '.jsx', '.tsx'],
+    message: '使用 dangerouslySetInnerHTML',
+    recommendation: '确保内容已经过净化处理',
+  },
+  {
+    id: 'UNSAFE_PICKLE', category: '反序列化',
+    severity: 'high',
+    pattern: /pickle\.loads?\s*\(|yaml\.load\s*\([^)]*Loader\s*=\s*yaml\.Loader/i,
+    extensions: ['.py'],
+    message: '不安全的反序列化',
+    recommendation: '使用 yaml.safe_load() 或验证数据来源',
+  },
+  {
+    id: 'WEAK_CRYPTO_MD5', category: '加密',
+    severity: 'medium',
+    pattern: /\b(md5|MD5)\s*\(|hashlib\.md5\s*\(/i,
+    extensions: ['.py', '.js', '.ts', '.go', '.java', '.php'],
+    message: '使用弱哈希算法 MD5',
+    recommendation: '使用 bcrypt/argon2 或 SHA-256+',
+  },
+  {
+    id: 'WEAK_CRYPTO_SHA1', category: '加密',
+    severity: 'low',
+    pattern: /\b(sha1|SHA1)\s*\(|hashlib\.sha1\s*\(/i,
+    extensions: ['.py', '.js', '.ts', '.go', '.java', '.php'],
+    message: '使用弱哈希算法 SHA1',
+    recommendation: '使用 SHA-256 或更强的算法',
+  },
+  {
+    id: 'PATH_TRAVERSAL', category: '路径遍历',
+    severity: 'high',
+    pattern: new RegExp(
+      '(open|read|write|Path|os\\.path\\.join)\\s*\\([^\\n]*' +
+      '(request|input|argv|args|params|query|form|path_param)\\b', 'i'),
+    extensions: ['.py'],
+    message: '可能存在路径遍历风险',
+    recommendation: '验证并规范化用户输入的路径',
+  },
+  {
+    id: 'SSRF', category: 'SSRF', severity: 'high',
+    pattern: new RegExp(
+      '(requests\\.(get|post|put|delete|head)|urllib\\.request\\.urlopen)' +
+      '\\s*\\([^\\n]*(request|input|argv|args|params|query|url)\\b', 'i'),
+    extensions: ['.py'],
+    message: '可能存在 SSRF 风险',
+    recommendation: '验证并限制目标 URL',
+  },
+  {
+    id: 'DEBUG_CODE', category: '调试', severity: 'low',
+    pattern: /\b(console\.log|debugger|pdb\.set_trace|breakpoint)\s*\(/i,
+    extensions: ['.py', '.js', '.ts'],
+    message: '发现调试代码',
+    recommendation: '生产环境移除调试代码',
+  },
+  {
+    id: 'INSECURE_RANDOM', category: '加密',
+    severity: 'medium',
+    pattern: /\brandom\.(random|randint|choice|shuffle)\s*\(/i,
+    extensions: ['.py'],
+    message: '使用不安全的随机数生成器',
+    recommendation: '安全场景使用 secrets 模块',
+  },
+  {
+    id: 'XXE', category: 'XXE', severity: 'high',
+    pattern: /etree\.(parse|fromstring)\s*\([^)]*\)|xml\.dom\.minidom\.parse/i,
+    extensions: ['.py'],
+    message: 'XML 解析可能存在 XXE 风险',
+    recommendation: '禁用外部实体: XMLParser(resolve_entities=False)',
+  },
+];
+
+const CODE_EXTENSIONS = new Set([
+  '.py', '.js', '.ts', '.jsx', '.tsx', '.go',
+  '.java', '.php', '.rb', '.yaml', '.yml', '.json',
+]);
+const DEFAULT_EXCLUDES = [
+  '.git', 'node_modules', '__pycache__', '.venv', 'venv',
+  'dist', 'build', '.tox', 'tests', 'test', '__tests__', 'spec',
+];
+
+function scanFile(filePath, rules) {
+  const findings = [];
+  const ext = path.extname(filePath).toLowerCase();
+  let content;
+  try { content = fs.readFileSync(filePath, 'utf-8'); } catch { return findings; }
+  const lines = content.split('\n');
+
+  for (const rule of rules) {
+    const exts = rule.extensions;
+    if (!exts.includes('*') && !exts.includes(ext)) continue;
+
+    for (let i = 0; i < lines.length; i++) {
+      const line = lines[i];
+      const stripped = line.trim();
+      const isComment = stripped.startsWith('#') ||
+        stripped.startsWith('//') || stripped.startsWith('*') ||
+        stripped.startsWith('/*');
+      if (isComment) continue;
+      const ruleDefRe = /^\s*(id|pattern|severity|message|recommendation|extensions|excludePattern|category)\s*:/;
+      if (ruleDefRe.test(stripped)) continue;
+
+      if (rule.pattern.test(line)) {
+        rule.pattern.lastIndex = 0;
+        if (rule.excludePattern && rule.excludePattern.test(line)) {
+          rule.excludePattern.lastIndex = 0; continue;
+        }
+        findings.push({
+          severity: rule.severity, category: rule.category,
+          message: rule.message, file_path: filePath,
+          line_number: i + 1,
+          line_content: stripped.slice(0, 100),
+          recommendation: rule.recommendation,
+        });
+      }
+    }
+  }
+  return findings;
+}
+
+function walkDir(dir, excludeDirs) {
+  const results = [];
+  let entries;
+  try { entries = fs.readdirSync(dir, { withFileTypes: true }); } catch { return results; }
+  for (const entry of entries) {
+    if (excludeDirs.includes(entry.name)) continue;
+    const full = path.join(dir, entry.name);
+    if (entry.isDirectory()) { results.push(...walkDir(full, excludeDirs)); }
+    else if (entry.isFile()) {
+      if (CODE_EXTENSIONS.has(path.extname(entry.name).toLowerCase())) {
+        results.push(full);
+      }
+    }
+  }
+  return results;
+}
+
+function scanDirectory(scanPath, excludeDirs) {
+  const resolved = path.resolve(scanPath);
+  const findings = [];
+  const files = walkDir(resolved, excludeDirs);
+  for (const f of files) findings.push(...scanFile(f, SECURITY_RULES));
+  findings.sort((a, b) =>
+    (SEVERITY_ORDER[a.severity] ?? 9) - (SEVERITY_ORDER[b.severity] ?? 9));
+  const passed = !findings.some(
+    f => f.severity === 'critical' || f.severity === 'high'
+  );
+  return { scan_path: resolved, files_scanned: files.length, passed, findings };
+}
+
+const { buildReport, countBySeverity, parseCliArgs } = require(
+  path.join(__dirname, '..', '..', 'lib', 'shared.js')
+);
+
+function formatReport(result, verbose) {
+  const counts = countBySeverity(result.findings);
+  const fields = {
+    '扫描路径': result.scan_path,
+    '扫描文件': result.files_scanned,
+    '扫描结果': result.passed ? '\u2713 通过' : '\u2717 发现高危问题',
+    '统计': `严重: ${counts.critical || 0} | 高危: ${counts.high || 0}` +
+      ` | 中危: ${counts.medium || 0} | 低危: ${counts.low || 0}`,
+  };
+  return buildReport(
+    '代码安全扫描报告', fields, result.findings, verbose, 'category'
+  );
+}
+
+
+function main() {
+  const opts = parseCliArgs(process.argv, { exclude: [] });
+  if (opts.help) {
+    console.log('Usage: security_scanner.js [path] [-v] [--json] [--exclude dir1 dir2]');
+    process.exit(0);
+  }
+  const scanPath = opts.target;
+  const verbose = opts.verbose;
+  const jsonOut = opts.json;
+  const excludeDirs = [...DEFAULT_EXCLUDES, ...opts.exclude];
+  const result = scanDirectory(scanPath, excludeDirs);
+
+  if (jsonOut) {
+    console.log(JSON.stringify({
+      scan_path: result.scan_path,
+      files_scanned: result.files_scanned,
+      passed: result.passed,
+      counts: countBySeverity(result.findings),
+      findings: result.findings,
+    }, null, 2));
+  } else {
+    console.log(formatReport(result, verbose));
+  }
+  process.exit(result.passed ? 0 : 1);
+}
+
+if (require.main === module) {
+  main();
+}
+
+module.exports = { scanFile, SECURITY_RULES };

package/bin/lib/registry.js

@@ -1,61 +0,0 @@
-'use strict';
-
-/**
- * MCP Servers 预设注册表
- * 每项包含: name, pkg (npm包名), desc, args (启动参数生成函数)
- */
-const MCP_SERVERS = [
-  {
-    name: 'playwright',
-    desc: '浏览器自动化 (Playwright)',
-    args: () => ['npx', ['-y', '@playwright/mcp']],
-  },
-  {
-    name: 'filesystem',
-    desc: '文件系统访问',
-    args: (home) => ['npx', ['-y', '@modelcontextprotocol/server-filesystem', home]],
-  },
-  {
-    name: 'context7',
-    desc: '文档查询 (Context7)',
-    args: () => ['npx', ['-y', '@upstash/context7-mcp@latest']],
-  },
-  {
-    name: 'deepwiki',
-    desc: '深度Wiki知识库',
-    args: () => ['npx', ['-y', 'mcp-deepwiki']],
-  },
-  {
-    name: 'memory',
-    desc: '持久化记忆',
-    args: () => ['npx', ['-y', '@modelcontextprotocol/server-memory']],
-  },
-  {
-    name: 'sequential-thinking',
-    desc: '顺序推理',
-    args: () => ['npx', ['-y', '@modelcontextprotocol/server-sequential-thinking']],
-  },
-];
-
-/**
- * Skills / Plugins 预设注册表
- */
-const SKILLS = [
-  {
-    name: 'superpowers',
-    desc: '超能力插件集 (brainstorming, TDD, debugging...)',
-    cmd: 'claude plugins install claude-plugins-official/superpowers',
-  },
-  {
-    name: 'spec-workflow',
-    desc: 'Spec 工作流 MCP',
-    cmd: 'claude plugins install nicobailon/spec-workflow-mcp-server',
-  },
-  {
-    name: 'skill-creator',
-    desc: 'Skill 创建器',
-    cmd: 'claude plugins install anthropic/skill-creator',
-  },
-];
-
-module.exports = { MCP_SERVERS, SKILLS };

package/config/.claudeignore

@@ -1,11 +0,0 @@
-node_modules/
-dist/
-.env
-.env.*
-*.log
-coverage/
-.DS_Store
-Thumbs.db
-*.secret
-*.pem
-*.key