clawvet 0.1.0

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 ClawGuard Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,86 @@
+# clawvet
+
+**Skill vetting & supply chain security for OpenClaw.**
+
+ClawVet scans OpenClaw `SKILL.md` files for prompt injection, credential theft, remote code execution, typosquatting, and social engineering — before they reach your agent.
+
+## Install
+
+```bash
+npm install -g clawvet
+```
+
+## Usage
+
+### Scan a local skill
+
+```bash
+clawvet scan ./my-skill/
+clawvet scan ./my-skill/SKILL.md
+```
+
+### JSON output (for CI/CD)
+
+```bash
+clawvet scan ./my-skill/ --format json
+```
+
+### Fail on severity threshold
+
+```bash
+clawvet scan ./my-skill/ --fail-on high
+# exits 1 if any high or critical findings
+```
+
+### Fetch and scan from ClawHub
+
+```bash
+clawvet scan weather-forecast --remote
+```
+
+### Audit all installed skills
+
+```bash
+clawvet audit
+```
+
+### Watch for new skill installs
+
+```bash
+clawvet watch --threshold 50
+```
+
+## What it detects
+
+ClawVet runs a 6-pass analysis on every skill:
+
+| Pass | What it checks |
+|------|---------------|
+| **Skill Parser** | Extracts YAML frontmatter, code blocks, URLs, IPs, domains |
+| **Static Analysis** | 21 regex patterns: curl-pipe-bash, credential access, C2 IPs, base64 payloads |
+| **Metadata Validator** | Undeclared binaries, env vars, missing descriptions, invalid semver |
+| **Dependency Checker** | `npx -y` auto-install, global `npm install`, risky packages |
+| **Typosquat Detector** | Levenshtein distance against popular skills, suspicious naming patterns |
+| **Semantic Analysis** | AI-powered detection of social engineering & prompt injection (optional) |
+
+## Risk Scoring
+
+| Score | Grade | Action |
+|-------|-------|--------|
+| 0-10 | A | Approve |
+| 11-25 | B | Approve |
+| 26-50 | C | Warn |
+| 51-75 | D | Warn |
+| 76-100 | F | Block |
+
+## CI/CD Integration
+
+```yaml
+# GitHub Actions example
+- name: Vet skill
+  run: npx clawvet scan ./my-skill --format json --fail-on high
+```
+
+## License
+
+MIT

package/dist/index.d.ts

@@ -0,0 +1,2 @@
+
+export {  }

package/dist/index.js

@@ -0,0 +1,802 @@
+#!/usr/bin/env node
+
+// src/index.ts
+import { Command } from "commander";
+
+// src/commands/scan.ts
+import { readFileSync, existsSync } from "fs";
+import { resolve, join } from "path";
+
+// ../shared/src/patterns.ts
+var THREAT_PATTERNS = [
+  // CRITICAL: Remote code execution
+  {
+    name: "CURL_PIPE_BASH",
+    pattern: /curl\s+.*\|\s*(ba)?sh/gi,
+    severity: "critical",
+    category: "remote_code_execution",
+    title: "Curl piped to shell",
+    description: "Downloads and executes remote code directly \u2014 classic supply chain attack vector."
+  },
+  {
+    name: "WGET_EXECUTE",
+    pattern: /wget\s+.*&&\s*(ba)?sh/gi,
+    severity: "critical",
+    category: "remote_code_execution",
+    title: "Wget with shell execution",
+    description: "Downloads and executes remote code via wget."
+  },
+  {
+    name: "EVAL_DYNAMIC",
+    pattern: /eval\s*\(/gi,
+    severity: "critical",
+    category: "remote_code_execution",
+    title: "Dynamic eval() usage",
+    description: "Uses eval() which can execute arbitrary code."
+  },
+  {
+    name: "BASE64_DECODE",
+    pattern: /base64\s+(-d|--decode)/gi,
+    severity: "critical",
+    category: "obfuscation",
+    title: "Base64 decode execution",
+    description: "Decodes base64 content, often used to hide malicious payloads."
+  },
+  {
+    name: "PYTHON_EXEC",
+    pattern: /python[3]?\s+-c/gi,
+    severity: "critical",
+    category: "remote_code_execution",
+    title: "Python inline execution",
+    description: "Executes inline Python code which may contain hidden payloads."
+  },
+  // HIGH: Credential theft
+  {
+    name: "ENV_FILE_READ",
+    pattern: /\.env|credentials|\.aws|\.ssh|keychain/gi,
+    severity: "high",
+    category: "credential_theft",
+    title: "Sensitive file access",
+    description: "Accesses credential files (.env, .aws, .ssh, keychain)."
+  },
+  {
+    name: "API_KEY_EXFIL",
+    pattern: /(ANTHROPIC|OPENAI|SLACK|DISCORD|TELEGRAM).*(_KEY|_TOKEN|_SECRET)/gi,
+    severity: "high",
+    category: "credential_theft",
+    title: "API key reference",
+    description: "References specific API keys/tokens that could be exfiltrated."
+  },
+  {
+    name: "DOTFILE_ACCESS",
+    pattern: /~\/\.(openclaw|clawdbot|moltbot)\//gi,
+    severity: "high",
+    category: "credential_theft",
+    title: "OpenClaw config access",
+    description: "Accesses OpenClaw/Clawdbot/Moltbot configuration directories."
+  },
+  {
+    name: "SESSION_THEFT",
+    pattern: /sessions\/\*\.jsonl/gi,
+    severity: "high",
+    category: "credential_theft",
+    title: "Session data access",
+    description: "Accesses session transcript files which may contain sensitive data."
+  },
+  // HIGH: Network exfiltration
+  {
+    name: "WEBHOOK_SEND",
+    pattern: /webhook\.(site|url)|discord\.com\/api\/webhooks/gi,
+    severity: "high",
+    category: "data_exfiltration",
+    title: "Webhook data exfiltration",
+    description: "Sends data to webhook endpoints (common exfiltration method)."
+  },
+  {
+    name: "BORE_TUNNEL",
+    pattern: /bore\.pub|ngrok|localtunnel/gi,
+    severity: "high",
+    category: "data_exfiltration",
+    title: "Tunnel service usage",
+    description: "Uses tunneling services to expose local services or exfiltrate data."
+  },
+  {
+    name: "SUSPICIOUS_IP",
+    pattern: /\b(?:91\.92\.242\.\d+|45\.61\.\d+\.\d+)\b/g,
+    severity: "high",
+    category: "data_exfiltration",
+    title: "Known malicious IP",
+    description: "Contains IP addresses associated with known ClawHavoc C2 infrastructure."
+  },
+  // MEDIUM: Social engineering
+  {
+    name: "PREREQUISITE_INSTALL",
+    pattern: /prerequisite|install.*first|run.*before|required.*dependency/gi,
+    severity: "medium",
+    category: "social_engineering",
+    title: "Prerequisite install trick",
+    description: "Instructs users to install prerequisites \u2014 common social engineering tactic."
+  },
+  {
+    name: "COPY_PASTE_COMMAND",
+    pattern: /copy.*paste.*terminal|run.*this.*command/gi,
+    severity: "medium",
+    category: "social_engineering",
+    title: "Copy-paste command instruction",
+    description: "Instructs users to copy-paste commands into their terminal."
+  },
+  {
+    name: "FAKE_DEPENDENCY",
+    pattern: /openclaw-core|moltbot-runtime|clawdbot-helper/gi,
+    severity: "medium",
+    category: "social_engineering",
+    title: "Fake dependency reference",
+    description: "References fake packages that mimic official OpenClaw components."
+  },
+  // MEDIUM: Prompt injection
+  {
+    name: "IGNORE_INSTRUCTIONS",
+    pattern: /ignore\s+(all\s+)?previous\s+instructions/gi,
+    severity: "medium",
+    category: "prompt_injection",
+    title: "Prompt injection \u2014 ignore instructions",
+    description: "Attempts to override the AI agent's existing instructions."
+  },
+  {
+    name: "SYSTEM_OVERRIDE",
+    pattern: /you\s+are\s+now|new\s+instructions|forget\s+everything/gi,
+    severity: "medium",
+    category: "prompt_injection",
+    title: "Prompt injection \u2014 system override",
+    description: "Attempts to redefine the AI agent's identity or instructions."
+  },
+  {
+    name: "MEMORY_MANIPULATION",
+    pattern: /SOUL\.md|MEMORY\.md|AGENTS\.md/gi,
+    severity: "medium",
+    category: "persistence",
+    title: "Memory/personality file manipulation",
+    description: "References core personality or memory files, may attempt persistence."
+  },
+  // LOW: Suspicious but not necessarily malicious
+  {
+    name: "SHELL_EXEC",
+    pattern: /child_process|exec\(|spawn\(/gi,
+    severity: "low",
+    category: "code_execution",
+    title: "Shell execution API",
+    description: "Uses shell execution APIs \u2014 legitimate but worth noting."
+  },
+  {
+    name: "NETWORK_REQUEST",
+    pattern: /fetch\(|axios|node-fetch|got\(/gi,
+    severity: "low",
+    category: "network",
+    title: "Network request API",
+    description: "Makes network requests \u2014 legitimate but worth reviewing targets."
+  },
+  {
+    name: "FILE_WRITE",
+    pattern: /fs\.write|writeFileSync/gi,
+    severity: "low",
+    category: "file_system",
+    title: "File write operation",
+    description: "Writes to the filesystem \u2014 check what files are being modified."
+  }
+];
+var POPULAR_SKILLS = [
+  "todoist-cli",
+  "github-manager",
+  "slack-assistant",
+  "email-composer",
+  "calendar-sync",
+  "weather-forecast",
+  "news-reader",
+  "code-reviewer",
+  "docker-helper",
+  "aws-manager",
+  "notion-sync",
+  "jira-tracker",
+  "spotify-controller",
+  "home-assistant",
+  "file-organizer",
+  "pdf-reader",
+  "translate-text",
+  "image-generator",
+  "web-scraper",
+  "database-query",
+  "git-assistant",
+  "linux-admin",
+  "python-helper",
+  "react-builder",
+  "api-tester",
+  "markdown-editor",
+  "csv-analyzer",
+  "ssh-manager",
+  "cron-scheduler",
+  "log-analyzer"
+];
+
+// ../shared/src/scanner/skill-parser.ts
+import { parse as parseYaml } from "yaml";
+var FRONTMATTER_RE = /^---\n([\s\S]*?)\n---/;
+var CODE_BLOCK_RE = /```(\w*)\n([\s\S]*?)```/g;
+var URL_RE = /https?:\/\/[^\s"'<>\])+]+/gi;
+var IP_RE = /\b(?:\d{1,3}\.){3}\d{1,3}\b/g;
+var DOMAIN_RE = /\b(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,}\b/gi;
+function parseSkill(content) {
+  let frontmatter = {};
+  let body = content;
+  const fmMatch = content.match(FRONTMATTER_RE);
+  if (fmMatch) {
+    try {
+      frontmatter = parseYaml(fmMatch[1]);
+    } catch {
+      frontmatter = {};
+    }
+    body = content.slice(fmMatch[0].length).trim();
+  }
+  const codeBlocks = [];
+  let match;
+  const cbRe = new RegExp(CODE_BLOCK_RE.source, CODE_BLOCK_RE.flags);
+  while ((match = cbRe.exec(content)) !== null) {
+    const before = content.slice(0, match.index);
+    const lineStart = before.split("\n").length;
+    const blockLines = match[0].split("\n").length;
+    codeBlocks.push({
+      language: match[1] || "unknown",
+      content: match[2],
+      lineStart,
+      lineEnd: lineStart + blockLines - 1
+    });
+  }
+  const urls = [...new Set(content.match(URL_RE) || [])];
+  const ipAddresses = [...new Set(content.match(IP_RE) || [])];
+  const domains = [...new Set(content.match(DOMAIN_RE) || [])];
+  return {
+    frontmatter,
+    body,
+    codeBlocks,
+    urls,
+    ipAddresses,
+    domains,
+    rawContent: content
+  };
+}
+
+// ../shared/src/scanner/static-analysis.ts
+function runStaticAnalysis(skill) {
+  const findings = [];
+  for (const threat of THREAT_PATTERNS) {
+    const re = new RegExp(threat.pattern.source, threat.pattern.flags);
+    let match;
+    while ((match = re.exec(skill.rawContent)) !== null) {
+      const before = skill.rawContent.slice(0, match.index);
+      const lineNumber = before.split("\n").length;
+      findings.push({
+        category: threat.category,
+        severity: threat.severity,
+        title: threat.title,
+        description: threat.description,
+        evidence: match[0],
+        lineNumber,
+        analysisPass: "static-analysis"
+      });
+    }
+  }
+  return findings;
+}
+
+// ../shared/src/scanner/metadata-validator.ts
+var SEMVER_RE = /^\d+\.\d+\.\d+/;
+var KNOWN_BINS = [
+  "curl",
+  "wget",
+  "git",
+  "python",
+  "python3",
+  "node",
+  "npm",
+  "npx",
+  "brew",
+  "apt",
+  "pip",
+  "docker",
+  "kubectl",
+  "ssh",
+  "scp",
+  "rsync",
+  "ffmpeg",
+  "jq",
+  "sed",
+  "awk",
+  "grep",
+  "find"
+];
+function validateMetadata(skill) {
+  const findings = [];
+  const fm = skill.frontmatter;
+  const pass = "metadata-validator";
+  if (!fm.name) {
+    findings.push({
+      category: "metadata",
+      severity: "medium",
+      title: "Missing skill name",
+      description: "SKILL.md frontmatter does not declare a name.",
+      analysisPass: pass
+    });
+  }
+  if (!fm.description) {
+    findings.push({
+      category: "metadata",
+      severity: "medium",
+      title: "Missing description",
+      description: "SKILL.md frontmatter does not declare a description.",
+      analysisPass: pass
+    });
+  } else if (fm.description.length < 10) {
+    findings.push({
+      category: "metadata",
+      severity: "low",
+      title: "Vague description",
+      description: "Skill description is suspiciously short.",
+      evidence: fm.description,
+      analysisPass: pass
+    });
+  }
+  if (fm.version && !SEMVER_RE.test(fm.version)) {
+    findings.push({
+      category: "metadata",
+      severity: "low",
+      title: "Invalid version format",
+      description: "Version does not follow semver format.",
+      evidence: fm.version,
+      analysisPass: pass
+    });
+  }
+  const declaredBins = new Set(fm.metadata?.openclaw?.requires?.bins || []);
+  for (const bin of KNOWN_BINS) {
+    const binRe = new RegExp(`\\b${bin}\\b`, "i");
+    if (binRe.test(skill.rawContent) && !declaredBins.has(bin)) {
+      const usedInCode = skill.codeBlocks.some((cb) => binRe.test(cb.content));
+      if (usedInCode) {
+        findings.push({
+          category: "metadata",
+          severity: "low",
+          title: `Undeclared binary: ${bin}`,
+          description: `Skill uses '${bin}' in code but does not declare it in requires.bins.`,
+          analysisPass: pass
+        });
+      }
+    }
+  }
+  const declaredEnv = new Set(fm.metadata?.openclaw?.requires?.env || []);
+  const envRe = /\$\{?([A-Z][A-Z0-9_]+)\}?/g;
+  let match;
+  while ((match = envRe.exec(skill.rawContent)) !== null) {
+    const envVar = match[1];
+    if (!declaredEnv.has(envVar) && envVar.length > 2) {
+      findings.push({
+        category: "metadata",
+        severity: "low",
+        title: `Undeclared env var: ${envVar}`,
+        description: `References environment variable $${envVar} but does not declare it in requires.env.`,
+        evidence: match[0],
+        analysisPass: pass
+      });
+    }
+  }
+  return findings;
+}
+
+// ../shared/src/scanner/dependency-checker.ts
+var NPX_AUTO_INSTALL_RE = /npx\s+-y\s+/gi;
+var NPM_INSTALL_RE = /npm\s+install\s+(-g\s+)?(\S+)/gi;
+function checkDependencies(skill) {
+  const findings = [];
+  const pass = "dependency-checker";
+  let match;
+  const npxRe = new RegExp(NPX_AUTO_INSTALL_RE.source, NPX_AUTO_INSTALL_RE.flags);
+  while ((match = npxRe.exec(skill.rawContent)) !== null) {
+    const before = skill.rawContent.slice(0, match.index);
+    const lineNumber = before.split("\n").length;
+    findings.push({
+      category: "dependency_risk",
+      severity: "medium",
+      title: "npx auto-install (-y flag)",
+      description: "Uses 'npx -y' which auto-installs packages without user confirmation.",
+      evidence: match[0],
+      lineNumber,
+      analysisPass: pass
+    });
+  }
+  const npmRe = new RegExp(NPM_INSTALL_RE.source, NPM_INSTALL_RE.flags);
+  while ((match = npmRe.exec(skill.rawContent)) !== null) {
+    if (match[1]) {
+      findings.push({
+        category: "dependency_risk",
+        severity: "medium",
+        title: "Global npm package install",
+        description: `Installs npm package globally: ${match[2]}`,
+        evidence: match[0],
+        analysisPass: pass
+      });
+    }
+  }
+  return findings;
+}
+
+// ../shared/src/scanner/typosquat-detector.ts
+import { distance } from "fastest-levenshtein";
+var MAX_EDIT_DISTANCE = 2;
+function detectTyposquats(skillName) {
+  if (!skillName) return [];
+  const findings = [];
+  const normalized = skillName.toLowerCase().trim();
+  for (const popular of POPULAR_SKILLS) {
+    if (normalized === popular) continue;
+    const d = distance(normalized, popular);
+    if (d > 0 && d <= MAX_EDIT_DISTANCE) {
+      findings.push({
+        category: "typosquatting",
+        severity: "high",
+        title: `Possible typosquat of "${popular}"`,
+        description: `Skill name "${skillName}" is ${d} edit(s) away from popular skill "${popular}". This may be an attempt to impersonate a trusted skill.`,
+        evidence: `"${skillName}" \u2248 "${popular}" (distance: ${d})`,
+        analysisPass: "typosquat-detector"
+      });
+    }
+  }
+  const patterns = [
+    { re: /-+/, desc: "extra hyphens" },
+    { re: /(.)\1{2,}/, desc: "repeated characters" }
+  ];
+  for (const p of patterns) {
+    if (p.re.test(normalized) && !POPULAR_SKILLS.includes(normalized)) {
+      findings.push({
+        category: "typosquatting",
+        severity: "medium",
+        title: `Suspicious naming pattern: ${p.desc}`,
+        description: `Skill name "${skillName}" has ${p.desc}, which is a common typosquatting technique.`,
+        analysisPass: "typosquat-detector"
+      });
+    }
+  }
+  return findings;
+}
+
+// ../shared/src/scanner/risk-scorer.ts
+var SEVERITY_WEIGHTS = {
+  critical: 30,
+  high: 15,
+  medium: 7,
+  low: 3
+};
+function calculateRiskScore(findings) {
+  let score = 0;
+  for (const f of findings) {
+    score += SEVERITY_WEIGHTS[f.severity];
+  }
+  return Math.min(score, 100);
+}
+function getRiskGrade(score) {
+  if (score <= 10) return "A";
+  if (score <= 25) return "B";
+  if (score <= 50) return "C";
+  if (score <= 75) return "D";
+  return "F";
+}
+function countFindings(findings) {
+  const counts = { critical: 0, high: 0, medium: 0, low: 0 };
+  for (const f of findings) {
+    counts[f.severity]++;
+  }
+  return counts;
+}
+
+// ../shared/src/scanner/index.ts
+async function scanSkill(content, options = {}) {
+  const skill = parseSkill(content);
+  const allFindings = [];
+  allFindings.push(...runStaticAnalysis(skill));
+  allFindings.push(...validateMetadata(skill));
+  if (options.semantic && options.semanticAnalyzer) {
+    const semanticFindings = await options.semanticAnalyzer(content);
+    allFindings.push(...semanticFindings);
+  }
+  allFindings.push(...checkDependencies(skill));
+  if (skill.frontmatter.name) {
+    allFindings.push(...detectTyposquats(skill.frontmatter.name));
+  }
+  const riskScore = calculateRiskScore(allFindings);
+  const riskGrade = getRiskGrade(riskScore);
+  const findingsCount = countFindings(allFindings);
+  const recommendation = riskScore >= 76 ? "block" : riskScore >= 26 ? "warn" : "approve";
+  return {
+    skillName: skill.frontmatter.name || "unknown",
+    skillVersion: skill.frontmatter.version,
+    skillSource: "local",
+    status: "complete",
+    riskScore,
+    riskGrade,
+    findingsCount,
+    findings: allFindings,
+    recommendation
+  };
+}
+
+// src/output/terminal.ts
+import chalk from "chalk";
+var SEVERITY_COLORS = {
+  critical: chalk.bgRed.white.bold,
+  high: chalk.red.bold,
+  medium: chalk.yellow,
+  low: chalk.blue
+};
+var GRADE_COLORS = {
+  A: chalk.green.bold,
+  B: chalk.greenBright,
+  C: chalk.yellow.bold,
+  D: chalk.redBright.bold,
+  F: chalk.bgRed.white.bold
+};
+function printScanResult(result) {
+  console.log();
+  console.log(chalk.bold("\u2501".repeat(60)));
+  console.log(chalk.bold("  ClawVet Scan Report"));
+  console.log(chalk.bold("\u2501".repeat(60)));
+  console.log();
+  console.log(`  Skill:   ${chalk.bold(result.skillName)}`);
+  if (result.skillVersion) {
+    console.log(`  Version: ${result.skillVersion}`);
+  }
+  console.log();
+  const gradeColor = GRADE_COLORS[result.riskGrade] || chalk.white;
+  console.log(
+    `  Risk Score: ${gradeColor(`${result.riskScore}/100`)}  Grade: ${gradeColor(result.riskGrade)}`
+  );
+  console.log();
+  const fc = result.findingsCount;
+  console.log("  Findings:");
+  if (fc.critical)
+    console.log(
+      `    ${SEVERITY_COLORS.critical(` CRITICAL `)} ${fc.critical}`
+    );
+  if (fc.high)
+    console.log(`    ${SEVERITY_COLORS.high("HIGH")}     ${fc.high}`);
+  if (fc.medium)
+    console.log(`    ${SEVERITY_COLORS.medium("MEDIUM")}   ${fc.medium}`);
+  if (fc.low) console.log(`    ${SEVERITY_COLORS.low("LOW")}      ${fc.low}`);
+  if (!fc.critical && !fc.high && !fc.medium && !fc.low) {
+    console.log(`    ${chalk.green("No findings \u2014 skill looks clean!")}`);
+  }
+  console.log();
+  if (result.findings.length > 0) {
+    console.log(chalk.bold("  Details:"));
+    console.log();
+    for (const f of result.findings) {
+      const color = SEVERITY_COLORS[f.severity];
+      console.log(`  ${color(`[${f.severity.toUpperCase()}]`)} ${f.title}`);
+      console.log(`    ${chalk.dim(f.description)}`);
+      if (f.evidence) {
+        console.log(`    Evidence: ${chalk.italic(f.evidence)}`);
+      }
+      if (f.lineNumber) {
+        console.log(`    Line: ${f.lineNumber}`);
+      }
+      console.log();
+    }
+  }
+  const recColors = {
+    block: chalk.bgRed.white.bold,
+    warn: chalk.bgYellow.black.bold,
+    approve: chalk.bgGreen.black.bold
+  };
+  const rec = result.recommendation || "approve";
+  console.log(
+    `  Recommendation: ${(recColors[rec] || chalk.white)(` ${rec.toUpperCase()} `)}`
+  );
+  console.log();
+  console.log(chalk.bold("\u2501".repeat(60)));
+  console.log();
+}
+
+// src/output/json.ts
+function printJsonResult(result) {
+  console.log(JSON.stringify(result, null, 2));
+}
+
+// src/commands/scan.ts
+async function fetchRemoteSkill(slug) {
+  const urls = [
+    `https://raw.githubusercontent.com/openclaw/skills/main/${slug}/SKILL.md`,
+    `https://clawhub.com/api/v1/skills/${slug}/raw`
+  ];
+  for (const url of urls) {
+    try {
+      const res = await fetch(url, { signal: AbortSignal.timeout(1e4) });
+      if (res.ok) {
+        return await res.text();
+      }
+    } catch {
+    }
+  }
+  throw new Error(
+    `Could not fetch skill "${slug}" from ClawHub. Check the skill name and try again.`
+  );
+}
+async function scanCommand(target, options) {
+  let content;
+  if (options.remote) {
+    try {
+      process.stderr.write(`Fetching "${target}" from ClawHub...
+`);
+      content = await fetchRemoteSkill(target);
+    } catch (err) {
+      console.error(
+        err instanceof Error ? err.message : "Failed to fetch remote skill"
+      );
+      process.exit(1);
+    }
+  } else {
+    const skillPath = resolve(target);
+    let skillFile = skillPath;
+    if (existsSync(skillPath) && !skillPath.endsWith(".md") && existsSync(join(skillPath, "SKILL.md"))) {
+      skillFile = join(skillPath, "SKILL.md");
+    }
+    if (!existsSync(skillFile)) {
+      console.error(`Error: Cannot find SKILL.md at ${skillFile}`);
+      process.exit(1);
+    }
+    content = readFileSync(skillFile, "utf-8");
+  }
+  const result = await scanSkill(content, { semantic: false });
+  if (options.format === "json") {
+    printJsonResult(result);
+  } else {
+    printScanResult(result);
+  }
+  if (options.failOn) {
+    const severityOrder = ["low", "medium", "high", "critical"];
+    const threshold = severityOrder.indexOf(options.failOn);
+    const hasFailure = result.findings.some(
+      (f) => severityOrder.indexOf(f.severity) >= threshold
+    );
+    if (hasFailure) {
+      process.exit(1);
+    }
+  }
+}
+
+// src/commands/audit.ts
+import { readdirSync, existsSync as existsSync2, readFileSync as readFileSync2 } from "fs";
+import { join as join2 } from "path";
+import { homedir } from "os";
+import chalk2 from "chalk";
+var SKILL_DIRS = [
+  join2(homedir(), ".openclaw", "skills"),
+  join2(homedir(), ".openclaw", "workspace", "skills")
+];
+async function auditCommand() {
+  console.log(chalk2.bold("\nClawVet Audit \u2014 Scanning all installed skills\n"));
+  let totalScanned = 0;
+  let totalThreats = 0;
+  for (const dir of SKILL_DIRS) {
+    if (!existsSync2(dir)) continue;
+    const entries = readdirSync(dir, { withFileTypes: true });
+    for (const entry of entries) {
+      if (!entry.isDirectory()) continue;
+      const skillFile = join2(dir, entry.name, "SKILL.md");
+      if (!existsSync2(skillFile)) continue;
+      const content = readFileSync2(skillFile, "utf-8");
+      const result = await scanSkill(content);
+      totalScanned++;
+      totalThreats += result.findings.length;
+      printScanResult(result);
+    }
+  }
+  console.log(chalk2.bold(`
+Audit complete: ${totalScanned} skills scanned, ${totalThreats} findings
+`));
+}
+
+// src/commands/watch.ts
+import { readFileSync as readFileSync3, existsSync as existsSync3, watch } from "fs";
+import { join as join3 } from "path";
+import { homedir as homedir2 } from "os";
+import chalk3 from "chalk";
+var SKILL_DIRS2 = [
+  join3(homedir2(), ".openclaw", "skills"),
+  join3(homedir2(), ".openclaw", "workspace", "skills")
+];
+async function watchCommand(options) {
+  const threshold = options.threshold || 50;
+  console.log(
+    chalk3.bold(
+      `
+ClawVet Watch \u2014 monitoring skill directories (threshold: ${threshold})
+`
+    )
+  );
+  const watchDirs = [];
+  for (const dir of SKILL_DIRS2) {
+    if (existsSync3(dir)) {
+      watchDirs.push(dir);
+    }
+  }
+  if (watchDirs.length === 0) {
+    console.log(
+      chalk3.yellow(
+        "No OpenClaw skill directories found. Watching will start when directories are created.\n"
+      )
+    );
+    console.log(chalk3.dim("Expected directories:"));
+    for (const dir of SKILL_DIRS2) {
+      console.log(chalk3.dim(`  ${dir}`));
+    }
+    console.log();
+    return;
+  }
+  console.log(chalk3.dim("Watching:"));
+  for (const dir of watchDirs) {
+    console.log(chalk3.dim(`  ${dir}`));
+  }
+  console.log();
+  for (const dir of watchDirs) {
+    const watcher = watch(dir, { recursive: true }, async (event, filename) => {
+      if (!filename?.endsWith("SKILL.md")) return;
+      const skillFile = join3(dir, filename);
+      if (!existsSync3(skillFile)) return;
+      console.log(chalk3.dim(`
+Detected change: ${filename}`));
+      try {
+        const content = readFileSync3(skillFile, "utf-8");
+        const result = await scanSkill(content);
+        printScanResult(result);
+        if (result.riskScore > threshold) {
+          console.log(
+            chalk3.bgRed.white.bold(
+              ` BLOCKED \u2014 Risk score ${result.riskScore} exceeds threshold ${threshold} `
+            )
+          );
+          console.log(
+            chalk3.red(
+              `This skill should not be installed. Run 'clawvet scan ${skillFile}' for details.
+`
+            )
+          );
+        }
+      } catch (err) {
+        console.error(chalk3.red(`Error scanning ${filename}:`), err);
+      }
+    });
+    process.on("SIGINT", () => {
+      watcher.close();
+      console.log(chalk3.dim("\nWatch stopped."));
+      process.exit(0);
+    });
+  }
+  console.log(chalk3.dim("Press Ctrl+C to stop watching.\n"));
+  await new Promise(() => {
+  });
+}
+
+// src/index.ts
+var program = new Command();
+program.name("clawvet").description("Skill vetting & supply chain security for OpenClaw").version("0.1.0");
+program.command("scan").description("Scan a skill for security threats").argument("<target>", "Path to skill folder or SKILL.md file").option("--format <format>", "Output format: terminal or json", "terminal").option("--fail-on <severity>", "Exit 1 if findings at this severity or above").option("--semantic", "Enable AI semantic analysis (requires ANTHROPIC_API_KEY)").option("--remote", "Fetch skill from ClawHub by name instead of local path").action(async (target, opts) => {
+  await scanCommand(target, {
+    format: opts.format,
+    failOn: opts.failOn,
+    semantic: opts.semantic,
+    remote: opts.remote
+  });
+});
+program.command("audit").description("Scan all installed OpenClaw skills").action(async () => {
+  await auditCommand();
+});
+program.command("watch").description("Pre-install hook \u2014 blocks risky skill installs").option("--threshold <score>", "Risk score threshold (default 50)", "50").action(async (opts) => {
+  await watchCommand({ threshold: parseInt(opts.threshold) });
+});
+program.parse();
+//# sourceMappingURL=index.js.map

package/dist/index.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/index.ts","../src/commands/scan.ts","../../shared/src/patterns.ts","../../shared/src/scanner/skill-parser.ts","../../shared/src/scanner/static-analysis.ts","../../shared/src/scanner/metadata-validator.ts","../../shared/src/scanner/dependency-checker.ts","../../shared/src/scanner/typosquat-detector.ts","../../shared/src/scanner/risk-scorer.ts","../../shared/src/scanner/index.ts","../src/output/terminal.ts","../src/output/json.ts","../src/commands/audit.ts","../src/commands/watch.ts"],"sourcesContent":["import { Command } from \"commander\";\nimport { scanCommand } from \"./commands/scan.js\";\nimport { auditCommand } from \"./commands/audit.js\";\nimport { watchCommand } from \"./commands/watch.js\";\n\nconst program = new Command();\n\nprogram\n  .name(\"clawvet\")\n  .description(\"Skill vetting & supply chain security for OpenClaw\")\n  .version(\"0.1.0\");\n\nprogram\n  .command(\"scan\")\n  .description(\"Scan a skill for security threats\")\n  .argument(\"<target>\", \"Path to skill folder or SKILL.md file\")\n  .option(\"--format <format>\", \"Output format: terminal or json\", \"terminal\")\n  .option(\"--fail-on <severity>\", \"Exit 1 if findings at this severity or above\")\n  .option(\"--semantic\", \"Enable AI semantic analysis (requires ANTHROPIC_API_KEY)\")\n  .option(\"--remote\", \"Fetch skill from ClawHub by name instead of local path\")\n  .action(async (target, opts) => {\n    await scanCommand(target, {\n      format: opts.format,\n      failOn: opts.failOn,\n      semantic: opts.semantic,\n      remote: opts.remote,\n    });\n  });\n\nprogram\n  .command(\"audit\")\n  .description(\"Scan all installed OpenClaw skills\")\n  .action(async () => {\n    await auditCommand();\n  });\n\nprogram\n  .command(\"watch\")\n  .description(\"Pre-install hook — blocks risky skill installs\")\n  .option(\"--threshold <score>\", \"Risk score threshold (default 50)\", \"50\")\n  .action(async (opts) => {\n    await watchCommand({ threshold: parseInt(opts.threshold) });\n  });\n\nprogram.parse();\n","import { readFileSync, existsSync } from \"node:fs\";\nimport { resolve, join } from \"node:path\";\nimport { scanSkill } from \"@clawguard/shared\";\nimport { printScanResult } from \"../output/terminal.js\";\nimport { printJsonResult } from \"../output/json.js\";\n\nexport interface ScanOptions {\n  format?: \"terminal\" | \"json\";\n  failOn?: \"critical\" | \"high\" | \"medium\" | \"low\";\n  semantic?: boolean;\n  remote?: boolean;\n}\n\nasync function fetchRemoteSkill(slug: string): Promise<string> {\n  const urls = [\n    `https://raw.githubusercontent.com/openclaw/skills/main/${slug}/SKILL.md`,\n    `https://clawhub.com/api/v1/skills/${slug}/raw`,\n  ];\n\n  for (const url of urls) {\n    try {\n      const res = await fetch(url, { signal: AbortSignal.timeout(10000) });\n      if (res.ok) {\n        return await res.text();\n      }\n    } catch {\n      // try next\n    }\n  }\n\n  throw new Error(\n    `Could not fetch skill \"${slug}\" from ClawHub. Check the skill name and try again.`\n  );\n}\n\nexport async function scanCommand(\n  target: string,\n  options: ScanOptions\n): Promise<void> {\n  let content: string;\n\n  if (options.remote) {\n    try {\n      process.stderr.write(`Fetching \"${target}\" from ClawHub...\\n`);\n      content = await fetchRemoteSkill(target);\n    } catch (err) {\n      console.error(\n        err instanceof Error ? err.message : \"Failed to fetch remote skill\"\n      );\n      process.exit(1);\n    }\n  } else {\n    const skillPath = resolve(target);\n    let skillFile = skillPath;\n\n    if (\n      existsSync(skillPath) &&\n      !skillPath.endsWith(\".md\") &&\n      existsSync(join(skillPath, \"SKILL.md\"))\n    ) {\n      skillFile = join(skillPath, \"SKILL.md\");\n    }\n\n    if (!existsSync(skillFile)) {\n      console.error(`Error: Cannot find SKILL.md at ${skillFile}`);\n      process.exit(1);\n    }\n\n    content = readFileSync(skillFile, \"utf-8\");\n  }\n\n  const result = await scanSkill(content, { semantic: false });\n\n  if (options.format === \"json\") {\n    printJsonResult(result);\n  } else {\n    printScanResult(result);\n  }\n\n  if (options.failOn) {\n    const severityOrder = [\"low\", \"medium\", \"high\", \"critical\"];\n    const threshold = severityOrder.indexOf(options.failOn);\n    const hasFailure = result.findings.some(\n      (f) => severityOrder.indexOf(f.severity) >= threshold\n    );\n    if (hasFailure) {\n      process.exit(1);\n    }\n  }\n}\n","import type { ThreatPattern } from \"./types.js\";\n\nexport const THREAT_PATTERNS: ThreatPattern[] = [\n  // CRITICAL: Remote code execution\n  {\n    name: \"CURL_PIPE_BASH\",\n    pattern: /curl\\s+.*\\|\\s*(ba)?sh/gi,\n    severity: \"critical\",\n    category: \"remote_code_execution\",\n    title: \"Curl piped to shell\",\n    description: \"Downloads and executes remote code directly — classic supply chain attack vector.\",\n  },\n  {\n    name: \"WGET_EXECUTE\",\n    pattern: /wget\\s+.*&&\\s*(ba)?sh/gi,\n    severity: \"critical\",\n    category: \"remote_code_execution\",\n    title: \"Wget with shell execution\",\n    description: \"Downloads and executes remote code via wget.\",\n  },\n  {\n    name: \"EVAL_DYNAMIC\",\n    pattern: /eval\\s*\\(/gi,\n    severity: \"critical\",\n    category: \"remote_code_execution\",\n    title: \"Dynamic eval() usage\",\n    description: \"Uses eval() which can execute arbitrary code.\",\n  },\n  {\n    name: \"BASE64_DECODE\",\n    pattern: /base64\\s+(-d|--decode)/gi,\n    severity: \"critical\",\n    category: \"obfuscation\",\n    title: \"Base64 decode execution\",\n    description: \"Decodes base64 content, often used to hide malicious payloads.\",\n  },\n  {\n    name: \"PYTHON_EXEC\",\n    pattern: /python[3]?\\s+-c/gi,\n    severity: \"critical\",\n    category: \"remote_code_execution\",\n    title: \"Python inline execution\",\n    description: \"Executes inline Python code which may contain hidden payloads.\",\n  },\n\n  // HIGH: Credential theft\n  {\n    name: \"ENV_FILE_READ\",\n    pattern: /\\.env|credentials|\\.aws|\\.ssh|keychain/gi,\n    severity: \"high\",\n    category: \"credential_theft\",\n    title: \"Sensitive file access\",\n    description: \"Accesses credential files (.env, .aws, .ssh, keychain).\",\n  },\n  {\n    name: \"API_KEY_EXFIL\",\n    pattern: /(ANTHROPIC|OPENAI|SLACK|DISCORD|TELEGRAM).*(_KEY|_TOKEN|_SECRET)/gi,\n    severity: \"high\",\n    category: \"credential_theft\",\n    title: \"API key reference\",\n    description: \"References specific API keys/tokens that could be exfiltrated.\",\n  },\n  {\n    name: \"DOTFILE_ACCESS\",\n    pattern: /~\\/\\.(openclaw|clawdbot|moltbot)\\//gi,\n    severity: \"high\",\n    category: \"credential_theft\",\n    title: \"OpenClaw config access\",\n    description: \"Accesses OpenClaw/Clawdbot/Moltbot configuration directories.\",\n  },\n  {\n    name: \"SESSION_THEFT\",\n    pattern: /sessions\\/\\*\\.jsonl/gi,\n    severity: \"high\",\n    category: \"credential_theft\",\n    title: \"Session data access\",\n    description: \"Accesses session transcript files which may contain sensitive data.\",\n  },\n\n  // HIGH: Network exfiltration\n  {\n    name: \"WEBHOOK_SEND\",\n    pattern: /webhook\\.(site|url)|discord\\.com\\/api\\/webhooks/gi,\n    severity: \"high\",\n    category: \"data_exfiltration\",\n    title: \"Webhook data exfiltration\",\n    description: \"Sends data to webhook endpoints (common exfiltration method).\",\n  },\n  {\n    name: \"BORE_TUNNEL\",\n    pattern: /bore\\.pub|ngrok|localtunnel/gi,\n    severity: \"high\",\n    category: \"data_exfiltration\",\n    title: \"Tunnel service usage\",\n    description: \"Uses tunneling services to expose local services or exfiltrate data.\",\n  },\n  {\n    name: \"SUSPICIOUS_IP\",\n    pattern: /\\b(?:91\\.92\\.242\\.\\d+|45\\.61\\.\\d+\\.\\d+)\\b/g,\n    severity: \"high\",\n    category: \"data_exfiltration\",\n    title: \"Known malicious IP\",\n    description: \"Contains IP addresses associated with known ClawHavoc C2 infrastructure.\",\n  },\n\n  // MEDIUM: Social engineering\n  {\n    name: \"PREREQUISITE_INSTALL\",\n    pattern: /prerequisite|install.*first|run.*before|required.*dependency/gi,\n    severity: \"medium\",\n    category: \"social_engineering\",\n    title: \"Prerequisite install trick\",\n    description: \"Instructs users to install prerequisites — common social engineering tactic.\",\n  },\n  {\n    name: \"COPY_PASTE_COMMAND\",\n    pattern: /copy.*paste.*terminal|run.*this.*command/gi,\n    severity: \"medium\",\n    category: \"social_engineering\",\n    title: \"Copy-paste command instruction\",\n    description: \"Instructs users to copy-paste commands into their terminal.\",\n  },\n  {\n    name: \"FAKE_DEPENDENCY\",\n    pattern: /openclaw-core|moltbot-runtime|clawdbot-helper/gi,\n    severity: \"medium\",\n    category: \"social_engineering\",\n    title: \"Fake dependency reference\",\n    description: \"References fake packages that mimic official OpenClaw components.\",\n  },\n\n  // MEDIUM: Prompt injection\n  {\n    name: \"IGNORE_INSTRUCTIONS\",\n    pattern: /ignore\\s+(all\\s+)?previous\\s+instructions/gi,\n    severity: \"medium\",\n    category: \"prompt_injection\",\n    title: \"Prompt injection — ignore instructions\",\n    description: \"Attempts to override the AI agent's existing instructions.\",\n  },\n  {\n    name: \"SYSTEM_OVERRIDE\",\n    pattern: /you\\s+are\\s+now|new\\s+instructions|forget\\s+everything/gi,\n    severity: \"medium\",\n    category: \"prompt_injection\",\n    title: \"Prompt injection — system override\",\n    description: \"Attempts to redefine the AI agent's identity or instructions.\",\n  },\n  {\n    name: \"MEMORY_MANIPULATION\",\n    pattern: /SOUL\\.md|MEMORY\\.md|AGENTS\\.md/gi,\n    severity: \"medium\",\n    category: \"persistence\",\n    title: \"Memory/personality file manipulation\",\n    description: \"References core personality or memory files, may attempt persistence.\",\n  },\n\n  // LOW: Suspicious but not necessarily malicious\n  {\n    name: \"SHELL_EXEC\",\n    pattern: /child_process|exec\\(|spawn\\(/gi,\n    severity: \"low\",\n    category: \"code_execution\",\n    title: \"Shell execution API\",\n    description: \"Uses shell execution APIs — legitimate but worth noting.\",\n  },\n  {\n    name: \"NETWORK_REQUEST\",\n    pattern: /fetch\\(|axios|node-fetch|got\\(/gi,\n    severity: \"low\",\n    category: \"network\",\n    title: \"Network request API\",\n    description: \"Makes network requests — legitimate but worth reviewing targets.\",\n  },\n  {\n    name: \"FILE_WRITE\",\n    pattern: /fs\\.write|writeFileSync/gi,\n    severity: \"low\",\n    category: \"file_system\",\n    title: \"File write operation\",\n    description: \"Writes to the filesystem — check what files are being modified.\",\n  },\n];\n\n// Top 100 popular ClawHub skills for typosquat detection\nexport const POPULAR_SKILLS = [\n  \"todoist-cli\",\n  \"github-manager\",\n  \"slack-assistant\",\n  \"email-composer\",\n  \"calendar-sync\",\n  \"weather-forecast\",\n  \"news-reader\",\n  \"code-reviewer\",\n  \"docker-helper\",\n  \"aws-manager\",\n  \"notion-sync\",\n  \"jira-tracker\",\n  \"spotify-controller\",\n  \"home-assistant\",\n  \"file-organizer\",\n  \"pdf-reader\",\n  \"translate-text\",\n  \"image-generator\",\n  \"web-scraper\",\n  \"database-query\",\n  \"git-assistant\",\n  \"linux-admin\",\n  \"python-helper\",\n  \"react-builder\",\n  \"api-tester\",\n  \"markdown-editor\",\n  \"csv-analyzer\",\n  \"ssh-manager\",\n  \"cron-scheduler\",\n  \"log-analyzer\",\n];\n","import { parse as parseYaml } from \"yaml\";\nimport type { ParsedSkill, SkillFrontmatter, CodeBlock } from \"../types.js\";\n\nconst FRONTMATTER_RE = /^---\\n([\\s\\S]*?)\\n---/;\nconst CODE_BLOCK_RE = /```(\\w*)\\n([\\s\\S]*?)```/g;\nconst URL_RE = /https?:\\/\\/[^\\s\"'<>\\])+]+/gi;\nconst IP_RE = /\\b(?:\\d{1,3}\\.){3}\\d{1,3}\\b/g;\nconst DOMAIN_RE = /\\b(?:[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\\.)+[a-z]{2,}\\b/gi;\n\nexport function parseSkill(content: string): ParsedSkill {\n  let frontmatter: SkillFrontmatter = {};\n  let body = content;\n\n  const fmMatch = content.match(FRONTMATTER_RE);\n  if (fmMatch) {\n    try {\n      frontmatter = parseYaml(fmMatch[1]) as SkillFrontmatter;\n    } catch {\n      frontmatter = {};\n    }\n    body = content.slice(fmMatch[0].length).trim();\n  }\n\n  const codeBlocks: CodeBlock[] = [];\n  let match: RegExpExecArray | null;\n  const cbRe = new RegExp(CODE_BLOCK_RE.source, CODE_BLOCK_RE.flags);\n\n  while ((match = cbRe.exec(content)) !== null) {\n    const before = content.slice(0, match.index);\n    const lineStart = before.split(\"\\n\").length;\n    const blockLines = match[0].split(\"\\n\").length;\n    codeBlocks.push({\n      language: match[1] || \"unknown\",\n      content: match[2],\n      lineStart,\n      lineEnd: lineStart + blockLines - 1,\n    });\n  }\n\n  const urls = [...new Set(content.match(URL_RE) || [])];\n  const ipAddresses = [...new Set(content.match(IP_RE) || [])];\n  const domains = [...new Set(content.match(DOMAIN_RE) || [])];\n\n  return {\n    frontmatter,\n    body,\n    codeBlocks,\n    urls,\n    ipAddresses,\n    domains,\n    rawContent: content,\n  };\n}\n","import { THREAT_PATTERNS } from \"../patterns.js\";\nimport type { Finding, ParsedSkill } from \"../types.js\";\n\nexport function runStaticAnalysis(skill: ParsedSkill): Finding[] {\n  const findings: Finding[] = [];\n\n  for (const threat of THREAT_PATTERNS) {\n    const re = new RegExp(threat.pattern.source, threat.pattern.flags);\n    let match: RegExpExecArray | null;\n\n    while ((match = re.exec(skill.rawContent)) !== null) {\n      const before = skill.rawContent.slice(0, match.index);\n      const lineNumber = before.split(\"\\n\").length;\n\n      findings.push({\n        category: threat.category,\n        severity: threat.severity,\n        title: threat.title,\n        description: threat.description,\n        evidence: match[0],\n        lineNumber,\n        analysisPass: \"static-analysis\",\n      });\n    }\n  }\n\n  return findings;\n}\n","import type { Finding, ParsedSkill } from \"../types.js\";\n\nconst SEMVER_RE = /^\\d+\\.\\d+\\.\\d+/;\n\nconst KNOWN_BINS = [\n  \"curl\", \"wget\", \"git\", \"python\", \"python3\", \"node\", \"npm\", \"npx\",\n  \"brew\", \"apt\", \"pip\", \"docker\", \"kubectl\", \"ssh\", \"scp\", \"rsync\",\n  \"ffmpeg\", \"jq\", \"sed\", \"awk\", \"grep\", \"find\",\n];\n\nexport function validateMetadata(skill: ParsedSkill): Finding[] {\n  const findings: Finding[] = [];\n  const fm = skill.frontmatter;\n  const pass = \"metadata-validator\";\n\n  if (!fm.name) {\n    findings.push({\n      category: \"metadata\",\n      severity: \"medium\",\n      title: \"Missing skill name\",\n      description: \"SKILL.md frontmatter does not declare a name.\",\n      analysisPass: pass,\n    });\n  }\n\n  if (!fm.description) {\n    findings.push({\n      category: \"metadata\",\n      severity: \"medium\",\n      title: \"Missing description\",\n      description: \"SKILL.md frontmatter does not declare a description.\",\n      analysisPass: pass,\n    });\n  } else if (fm.description.length < 10) {\n    findings.push({\n      category: \"metadata\",\n      severity: \"low\",\n      title: \"Vague description\",\n      description: \"Skill description is suspiciously short.\",\n      evidence: fm.description,\n      analysisPass: pass,\n    });\n  }\n\n  if (fm.version && !SEMVER_RE.test(fm.version)) {\n    findings.push({\n      category: \"metadata\",\n      severity: \"low\",\n      title: \"Invalid version format\",\n      description: \"Version does not follow semver format.\",\n      evidence: fm.version,\n      analysisPass: pass,\n    });\n  }\n\n  const declaredBins = new Set(fm.metadata?.openclaw?.requires?.bins || []);\n\n  for (const bin of KNOWN_BINS) {\n    const binRe = new RegExp(`\\\\b${bin}\\\\b`, \"i\");\n    if (binRe.test(skill.rawContent) && !declaredBins.has(bin)) {\n      const usedInCode = skill.codeBlocks.some((cb) => binRe.test(cb.content));\n      if (usedInCode) {\n        findings.push({\n          category: \"metadata\",\n          severity: \"low\",\n          title: `Undeclared binary: ${bin}`,\n          description: `Skill uses '${bin}' in code but does not declare it in requires.bins.`,\n          analysisPass: pass,\n        });\n      }\n    }\n  }\n\n  const declaredEnv = new Set(fm.metadata?.openclaw?.requires?.env || []);\n  const envRe = /\\$\\{?([A-Z][A-Z0-9_]+)\\}?/g;\n  let match: RegExpExecArray | null;\n\n  while ((match = envRe.exec(skill.rawContent)) !== null) {\n    const envVar = match[1];\n    if (!declaredEnv.has(envVar) && envVar.length > 2) {\n      findings.push({\n        category: \"metadata\",\n        severity: \"low\",\n        title: `Undeclared env var: ${envVar}`,\n        description: `References environment variable $${envVar} but does not declare it in requires.env.`,\n        evidence: match[0],\n        analysisPass: pass,\n      });\n    }\n  }\n\n  return findings;\n}\n","import type { Finding, ParsedSkill } from \"../types.js\";\n\nconst NPX_AUTO_INSTALL_RE = /npx\\s+-y\\s+/gi;\nconst NPM_INSTALL_RE = /npm\\s+install\\s+(-g\\s+)?(\\S+)/gi;\n\nexport function checkDependencies(skill: ParsedSkill): Finding[] {\n  const findings: Finding[] = [];\n  const pass = \"dependency-checker\";\n\n  let match: RegExpExecArray | null;\n  const npxRe = new RegExp(NPX_AUTO_INSTALL_RE.source, NPX_AUTO_INSTALL_RE.flags);\n\n  while ((match = npxRe.exec(skill.rawContent)) !== null) {\n    const before = skill.rawContent.slice(0, match.index);\n    const lineNumber = before.split(\"\\n\").length;\n\n    findings.push({\n      category: \"dependency_risk\",\n      severity: \"medium\",\n      title: \"npx auto-install (-y flag)\",\n      description: \"Uses 'npx -y' which auto-installs packages without user confirmation.\",\n      evidence: match[0],\n      lineNumber,\n      analysisPass: pass,\n    });\n  }\n\n  const npmRe = new RegExp(NPM_INSTALL_RE.source, NPM_INSTALL_RE.flags);\n  while ((match = npmRe.exec(skill.rawContent)) !== null) {\n    if (match[1]) {\n      findings.push({\n        category: \"dependency_risk\",\n        severity: \"medium\",\n        title: \"Global npm package install\",\n        description: `Installs npm package globally: ${match[2]}`,\n        evidence: match[0],\n        analysisPass: pass,\n      });\n    }\n  }\n\n  return findings;\n}\n","import { distance } from \"fastest-levenshtein\";\nimport { POPULAR_SKILLS } from \"../patterns.js\";\nimport type { Finding } from \"../types.js\";\n\nconst MAX_EDIT_DISTANCE = 2;\n\nexport function detectTyposquats(skillName: string): Finding[] {\n  if (!skillName) return [];\n\n  const findings: Finding[] = [];\n  const normalized = skillName.toLowerCase().trim();\n\n  for (const popular of POPULAR_SKILLS) {\n    if (normalized === popular) continue;\n\n    const d = distance(normalized, popular);\n    if (d > 0 && d <= MAX_EDIT_DISTANCE) {\n      findings.push({\n        category: \"typosquatting\",\n        severity: \"high\",\n        title: `Possible typosquat of \"${popular}\"`,\n        description: `Skill name \"${skillName}\" is ${d} edit(s) away from popular skill \"${popular}\". This may be an attempt to impersonate a trusted skill.`,\n        evidence: `\"${skillName}\" ≈ \"${popular}\" (distance: ${d})`,\n        analysisPass: \"typosquat-detector\",\n      });\n    }\n  }\n\n  const patterns = [\n    { re: /-+/, desc: \"extra hyphens\" },\n    { re: /(.)\\1{2,}/, desc: \"repeated characters\" },\n  ];\n\n  for (const p of patterns) {\n    if (p.re.test(normalized) && !POPULAR_SKILLS.includes(normalized)) {\n      findings.push({\n        category: \"typosquatting\",\n        severity: \"medium\",\n        title: `Suspicious naming pattern: ${p.desc}`,\n        description: `Skill name \"${skillName}\" has ${p.desc}, which is a common typosquatting technique.`,\n        analysisPass: \"typosquat-detector\",\n      });\n    }\n  }\n\n  return findings;\n}\n","import type { Finding, FindingsCount, RiskGrade } from \"../types.js\";\n\nconst SEVERITY_WEIGHTS = {\n  critical: 30,\n  high: 15,\n  medium: 7,\n  low: 3,\n} as const;\n\nexport function calculateRiskScore(findings: Finding[]): number {\n  let score = 0;\n  for (const f of findings) {\n    score += SEVERITY_WEIGHTS[f.severity];\n  }\n  return Math.min(score, 100);\n}\n\nexport function getRiskGrade(score: number): RiskGrade {\n  if (score <= 10) return \"A\";\n  if (score <= 25) return \"B\";\n  if (score <= 50) return \"C\";\n  if (score <= 75) return \"D\";\n  return \"F\";\n}\n\nexport function countFindings(findings: Finding[]): FindingsCount {\n  const counts: FindingsCount = { critical: 0, high: 0, medium: 0, low: 0 };\n  for (const f of findings) {\n    counts[f.severity]++;\n  }\n  return counts;\n}\n","import type { Finding, ScanResult } from \"../types.js\";\nimport { parseSkill } from \"./skill-parser.js\";\nimport { runStaticAnalysis } from \"./static-analysis.js\";\nimport { validateMetadata } from \"./metadata-validator.js\";\nimport { checkDependencies } from \"./dependency-checker.js\";\nimport { detectTyposquats } from \"./typosquat-detector.js\";\nimport { calculateRiskScore, getRiskGrade, countFindings } from \"./risk-scorer.js\";\n\nexport interface ScanOptions {\n  semantic?: boolean;\n  semanticAnalyzer?: (content: string) => Promise<Finding[]>;\n}\n\nexport async function scanSkill(\n  content: string,\n  options: ScanOptions = {}\n): Promise<ScanResult> {\n  const skill = parseSkill(content);\n  const allFindings: Finding[] = [];\n\n  allFindings.push(...runStaticAnalysis(skill));\n  allFindings.push(...validateMetadata(skill));\n\n  if (options.semantic && options.semanticAnalyzer) {\n    const semanticFindings = await options.semanticAnalyzer(content);\n    allFindings.push(...semanticFindings);\n  }\n\n  allFindings.push(...checkDependencies(skill));\n\n  if (skill.frontmatter.name) {\n    allFindings.push(...detectTyposquats(skill.frontmatter.name));\n  }\n\n  const riskScore = calculateRiskScore(allFindings);\n  const riskGrade = getRiskGrade(riskScore);\n  const findingsCount = countFindings(allFindings);\n\n  const recommendation =\n    riskScore >= 76 ? \"block\" : riskScore >= 26 ? \"warn\" : \"approve\";\n\n  return {\n    skillName: skill.frontmatter.name || \"unknown\",\n    skillVersion: skill.frontmatter.version,\n    skillSource: \"local\",\n    status: \"complete\",\n    riskScore,\n    riskGrade,\n    findingsCount,\n    findings: allFindings,\n    recommendation,\n  };\n}\n\nexport { parseSkill } from \"./skill-parser.js\";\nexport { runStaticAnalysis } from \"./static-analysis.js\";\nexport { validateMetadata } from \"./metadata-validator.js\";\nexport { checkDependencies } from \"./dependency-checker.js\";\nexport { detectTyposquats } from \"./typosquat-detector.js\";\nexport { calculateRiskScore, getRiskGrade, countFindings } from \"./risk-scorer.js\";\n","import chalk from \"chalk\";\nimport type { ScanResult, Finding, Severity } from \"@clawguard/shared\";\n\nconst SEVERITY_COLORS: Record<Severity, (s: string) => string> = {\n  critical: chalk.bgRed.white.bold,\n  high: chalk.red.bold,\n  medium: chalk.yellow,\n  low: chalk.blue,\n};\n\nconst GRADE_COLORS: Record<string, (s: string) => string> = {\n  A: chalk.green.bold,\n  B: chalk.greenBright,\n  C: chalk.yellow.bold,\n  D: chalk.redBright.bold,\n  F: chalk.bgRed.white.bold,\n};\n\nexport function printScanResult(result: ScanResult): void {\n  console.log();\n  console.log(chalk.bold(\"━\".repeat(60)));\n  console.log(chalk.bold(\"  ClawVet Scan Report\"));\n  console.log(chalk.bold(\"━\".repeat(60)));\n  console.log();\n\n  console.log(`  Skill:   ${chalk.bold(result.skillName)}`);\n  if (result.skillVersion) {\n    console.log(`  Version: ${result.skillVersion}`);\n  }\n  console.log();\n\n  // Risk score\n  const gradeColor = GRADE_COLORS[result.riskGrade] || chalk.white;\n  console.log(\n    `  Risk Score: ${gradeColor(`${result.riskScore}/100`)}  Grade: ${gradeColor(result.riskGrade)}`\n  );\n  console.log();\n\n  // Findings summary\n  const fc = result.findingsCount;\n  console.log(\"  Findings:\");\n  if (fc.critical)\n    console.log(\n      `    ${SEVERITY_COLORS.critical(` CRITICAL `)} ${fc.critical}`\n    );\n  if (fc.high)\n    console.log(`    ${SEVERITY_COLORS.high(\"HIGH\")}     ${fc.high}`);\n  if (fc.medium)\n    console.log(`    ${SEVERITY_COLORS.medium(\"MEDIUM\")}   ${fc.medium}`);\n  if (fc.low) console.log(`    ${SEVERITY_COLORS.low(\"LOW\")}      ${fc.low}`);\n  if (!fc.critical && !fc.high && !fc.medium && !fc.low) {\n    console.log(`    ${chalk.green(\"No findings — skill looks clean!\")}`);\n  }\n  console.log();\n\n  // Detailed findings\n  if (result.findings.length > 0) {\n    console.log(chalk.bold(\"  Details:\"));\n    console.log();\n    for (const f of result.findings) {\n      const color = SEVERITY_COLORS[f.severity];\n      console.log(`  ${color(`[${f.severity.toUpperCase()}]`)} ${f.title}`);\n      console.log(`    ${chalk.dim(f.description)}`);\n      if (f.evidence) {\n        console.log(`    Evidence: ${chalk.italic(f.evidence)}`);\n      }\n      if (f.lineNumber) {\n        console.log(`    Line: ${f.lineNumber}`);\n      }\n      console.log();\n    }\n  }\n\n  // Recommendation\n  const recColors: Record<string, (s: string) => string> = {\n    block: chalk.bgRed.white.bold,\n    warn: chalk.bgYellow.black.bold,\n    approve: chalk.bgGreen.black.bold,\n  };\n  const rec = result.recommendation || \"approve\";\n  console.log(\n    `  Recommendation: ${(recColors[rec] || chalk.white)(` ${rec.toUpperCase()} `)}`\n  );\n  console.log();\n  console.log(chalk.bold(\"━\".repeat(60)));\n  console.log();\n}\n","import type { ScanResult } from \"@clawguard/shared\";\n\nexport function printJsonResult(result: ScanResult): void {\n  console.log(JSON.stringify(result, null, 2));\n}\n","import { readdirSync, existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { homedir } from \"node:os\";\nimport { scanSkill } from \"@clawguard/shared\";\nimport { printScanResult } from \"../output/terminal.js\";\nimport chalk from \"chalk\";\n\nconst SKILL_DIRS = [\n  join(homedir(), \".openclaw\", \"skills\"),\n  join(homedir(), \".openclaw\", \"workspace\", \"skills\"),\n];\n\nexport async function auditCommand(): Promise<void> {\n  console.log(chalk.bold(\"\\nClawVet Audit — Scanning all installed skills\\n\"));\n\n  let totalScanned = 0;\n  let totalThreats = 0;\n\n  for (const dir of SKILL_DIRS) {\n    if (!existsSync(dir)) continue;\n\n    const entries = readdirSync(dir, { withFileTypes: true });\n    for (const entry of entries) {\n      if (!entry.isDirectory()) continue;\n      const skillFile = join(dir, entry.name, \"SKILL.md\");\n      if (!existsSync(skillFile)) continue;\n\n      const content = readFileSync(skillFile, \"utf-8\");\n      const result = await scanSkill(content);\n      totalScanned++;\n      totalThreats += result.findings.length;\n\n      printScanResult(result);\n    }\n  }\n\n  console.log(chalk.bold(`\\nAudit complete: ${totalScanned} skills scanned, ${totalThreats} findings\\n`));\n}\n","import { readFileSync, existsSync, watch } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { homedir } from \"node:os\";\nimport chalk from \"chalk\";\nimport { scanSkill } from \"@clawguard/shared\";\nimport { printScanResult } from \"../output/terminal.js\";\n\nconst SKILL_DIRS = [\n  join(homedir(), \".openclaw\", \"skills\"),\n  join(homedir(), \".openclaw\", \"workspace\", \"skills\"),\n];\n\nexport async function watchCommand(options: {\n  threshold?: number;\n}): Promise<void> {\n  const threshold = options.threshold || 50;\n  console.log(\n    chalk.bold(\n      `\\nClawVet Watch — monitoring skill directories (threshold: ${threshold})\\n`\n    )\n  );\n\n  const watchDirs: string[] = [];\n  for (const dir of SKILL_DIRS) {\n    if (existsSync(dir)) {\n      watchDirs.push(dir);\n    }\n  }\n\n  if (watchDirs.length === 0) {\n    console.log(\n      chalk.yellow(\n        \"No OpenClaw skill directories found. Watching will start when directories are created.\\n\"\n      )\n    );\n    console.log(chalk.dim(\"Expected directories:\"));\n    for (const dir of SKILL_DIRS) {\n      console.log(chalk.dim(`  ${dir}`));\n    }\n    console.log();\n    return;\n  }\n\n  console.log(chalk.dim(\"Watching:\"));\n  for (const dir of watchDirs) {\n    console.log(chalk.dim(`  ${dir}`));\n  }\n  console.log();\n\n  for (const dir of watchDirs) {\n    const watcher = watch(dir, { recursive: true }, async (event, filename) => {\n      if (!filename?.endsWith(\"SKILL.md\")) return;\n\n      const skillFile = join(dir, filename);\n      if (!existsSync(skillFile)) return;\n\n      console.log(chalk.dim(`\\nDetected change: ${filename}`));\n\n      try {\n        const content = readFileSync(skillFile, \"utf-8\");\n        const result = await scanSkill(content);\n\n        printScanResult(result);\n\n        if (result.riskScore > threshold) {\n          console.log(\n            chalk.bgRed.white.bold(\n              ` BLOCKED — Risk score ${result.riskScore} exceeds threshold ${threshold} `\n            )\n          );\n          console.log(\n            chalk.red(\n              `This skill should not be installed. Run 'clawvet scan ${skillFile}' for details.\\n`\n            )\n          );\n        }\n      } catch (err) {\n        console.error(chalk.red(`Error scanning ${filename}:`), err);\n      }\n    });\n\n    process.on(\"SIGINT\", () => {\n      watcher.close();\n      console.log(chalk.dim(\"\\nWatch stopped.\"));\n      process.exit(0);\n    });\n  }\n\n  console.log(chalk.dim(\"Press Ctrl+C to stop watching.\\n\"));\n  await new Promise(() => {});\n}\n"],"mappings":";;;AAAA,SAAS,eAAe;;;ACAxB,SAAS,cAAc,kBAAkB;AACzC,SAAS,SAAS,YAAY;;;ACCvB,IAAM,kBAAmC;AAAA;AAAA,EAE9C;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA;AAAA,EAGA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,SAAS;AAAA,IACT,UAAU;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AACF;AAGO,IAAM,iBAAiB;AAAA,EAC5B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;;;ACxNA,SAAS,SAAS,iBAAiB;AAGnC,IAAM,iBAAiB;AACvB,IAAM,gBAAgB;AACtB,IAAM,SAAS;AACf,IAAM,QAAQ;AACd,IAAM,YAAY;AAEX,SAAS,WAAW,SAA8B;AACvD,MAAI,cAAgC,CAAC;AACrC,MAAI,OAAO;AAEX,QAAM,UAAU,QAAQ,MAAM,cAAc;AAC5C,MAAI,SAAS;AACX,QAAI;AACF,oBAAc,UAAU,QAAQ,CAAC,CAAC;AAAA,IACpC,QAAQ;AACN,oBAAc,CAAC;AAAA,IACjB;AACA,WAAO,QAAQ,MAAM,QAAQ,CAAC,EAAE,MAAM,EAAE,KAAK;AAAA,EAC/C;AAEA,QAAM,aAA0B,CAAC;AACjC,MAAI;AACJ,QAAM,OAAO,IAAI,OAAO,cAAc,QAAQ,cAAc,KAAK;AAEjE,UAAQ,QAAQ,KAAK,KAAK,OAAO,OAAO,MAAM;AAC5C,UAAM,SAAS,QAAQ,MAAM,GAAG,MAAM,KAAK;AAC3C,UAAM,YAAY,OAAO,MAAM,IAAI,EAAE;AACrC,UAAM,aAAa,MAAM,CAAC,EAAE,MAAM,IAAI,EAAE;AACxC,eAAW,KAAK;AAAA,MACd,UAAU,MAAM,CAAC,KAAK;AAAA,MACtB,SAAS,MAAM,CAAC;AAAA,MAChB;AAAA,MACA,SAAS,YAAY,aAAa;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,CAAC,GAAG,IAAI,IAAI,QAAQ,MAAM,MAAM,KAAK,CAAC,CAAC,CAAC;AACrD,QAAM,cAAc,CAAC,GAAG,IAAI,IAAI,QAAQ,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC;AAC3D,QAAM,UAAU,CAAC,GAAG,IAAI,IAAI,QAAQ,MAAM,SAAS,KAAK,CAAC,CAAC,CAAC;AAE3D,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY;AAAA,EACd;AACF;;;ACjDO,SAAS,kBAAkB,OAA+B;AAC/D,QAAM,WAAsB,CAAC;AAE7B,aAAW,UAAU,iBAAiB;AACpC,UAAM,KAAK,IAAI,OAAO,OAAO,QAAQ,QAAQ,OAAO,QAAQ,KAAK;AACjE,QAAI;AAEJ,YAAQ,QAAQ,GAAG,KAAK,MAAM,UAAU,OAAO,MAAM;AACnD,YAAM,SAAS,MAAM,WAAW,MAAM,GAAG,MAAM,KAAK;AACpD,YAAM,aAAa,OAAO,MAAM,IAAI,EAAE;AAEtC,eAAS,KAAK;AAAA,QACZ,UAAU,OAAO;AAAA,QACjB,UAAU,OAAO;AAAA,QACjB,OAAO,OAAO;AAAA,QACd,aAAa,OAAO;AAAA,QACpB,UAAU,MAAM,CAAC;AAAA,QACjB;AAAA,QACA,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;;;ACzBA,IAAM,YAAY;AAElB,IAAM,aAAa;AAAA,EACjB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAU;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAO;AAAA,EAC3D;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAAU;AAAA,EAAW;AAAA,EAAO;AAAA,EAAO;AAAA,EACzD;AAAA,EAAU;AAAA,EAAM;AAAA,EAAO;AAAA,EAAO;AAAA,EAAQ;AACxC;AAEO,SAAS,iBAAiB,OAA+B;AAC9D,QAAM,WAAsB,CAAC;AAC7B,QAAM,KAAK,MAAM;AACjB,QAAM,OAAO;AAEb,MAAI,CAAC,GAAG,MAAM;AACZ,aAAS,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,OAAO;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,MAAI,CAAC,GAAG,aAAa;AACnB,aAAS,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,OAAO;AAAA,MACP,aAAa;AAAA,MACb,cAAc;AAAA,IAChB,CAAC;AAAA,EACH,WAAW,GAAG,YAAY,SAAS,IAAI;AACrC,aAAS,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,OAAO;AAAA,MACP,aAAa;AAAA,MACb,UAAU,GAAG;AAAA,MACb,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,MAAI,GAAG,WAAW,CAAC,UAAU,KAAK,GAAG,OAAO,GAAG;AAC7C,aAAS,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,OAAO;AAAA,MACP,aAAa;AAAA,MACb,UAAU,GAAG;AAAA,MACb,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,QAAM,eAAe,IAAI,IAAI,GAAG,UAAU,UAAU,UAAU,QAAQ,CAAC,CAAC;AAExE,aAAW,OAAO,YAAY;AAC5B,UAAM,QAAQ,IAAI,OAAO,MAAM,GAAG,OAAO,GAAG;AAC5C,QAAI,MAAM,KAAK,MAAM,UAAU,KAAK,CAAC,aAAa,IAAI,GAAG,GAAG;AAC1D,YAAM,aAAa,MAAM,WAAW,KAAK,CAAC,OAAO,MAAM,KAAK,GAAG,OAAO,CAAC;AACvE,UAAI,YAAY;AACd,iBAAS,KAAK;AAAA,UACZ,UAAU;AAAA,UACV,UAAU;AAAA,UACV,OAAO,sBAAsB,GAAG;AAAA,UAChC,aAAa,eAAe,GAAG;AAAA,UAC/B,cAAc;AAAA,QAChB,CAAC;AAAA,MACH;AAAA,IACF;AAAA,EACF;AAEA,QAAM,cAAc,IAAI,IAAI,GAAG,UAAU,UAAU,UAAU,OAAO,CAAC,CAAC;AACtE,QAAM,QAAQ;AACd,MAAI;AAEJ,UAAQ,QAAQ,MAAM,KAAK,MAAM,UAAU,OAAO,MAAM;AACtD,UAAM,SAAS,MAAM,CAAC;AACtB,QAAI,CAAC,YAAY,IAAI,MAAM,KAAK,OAAO,SAAS,GAAG;AACjD,eAAS,KAAK;AAAA,QACZ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO,uBAAuB,MAAM;AAAA,QACpC,aAAa,oCAAoC,MAAM;AAAA,QACvD,UAAU,MAAM,CAAC;AAAA,QACjB,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;;;AC1FA,IAAM,sBAAsB;AAC5B,IAAM,iBAAiB;AAEhB,SAAS,kBAAkB,OAA+B;AAC/D,QAAM,WAAsB,CAAC;AAC7B,QAAM,OAAO;AAEb,MAAI;AACJ,QAAM,QAAQ,IAAI,OAAO,oBAAoB,QAAQ,oBAAoB,KAAK;AAE9E,UAAQ,QAAQ,MAAM,KAAK,MAAM,UAAU,OAAO,MAAM;AACtD,UAAM,SAAS,MAAM,WAAW,MAAM,GAAG,MAAM,KAAK;AACpD,UAAM,aAAa,OAAO,MAAM,IAAI,EAAE;AAEtC,aAAS,KAAK;AAAA,MACZ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,OAAO;AAAA,MACP,aAAa;AAAA,MACb,UAAU,MAAM,CAAC;AAAA,MACjB;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,QAAM,QAAQ,IAAI,OAAO,eAAe,QAAQ,eAAe,KAAK;AACpE,UAAQ,QAAQ,MAAM,KAAK,MAAM,UAAU,OAAO,MAAM;AACtD,QAAI,MAAM,CAAC,GAAG;AACZ,eAAS,KAAK;AAAA,QACZ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,QACP,aAAa,kCAAkC,MAAM,CAAC,CAAC;AAAA,QACvD,UAAU,MAAM,CAAC;AAAA,QACjB,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;;;AC1CA,SAAS,gBAAgB;AAIzB,IAAM,oBAAoB;AAEnB,SAAS,iBAAiB,WAA8B;AAC7D,MAAI,CAAC,UAAW,QAAO,CAAC;AAExB,QAAM,WAAsB,CAAC;AAC7B,QAAM,aAAa,UAAU,YAAY,EAAE,KAAK;AAEhD,aAAW,WAAW,gBAAgB;AACpC,QAAI,eAAe,QAAS;AAE5B,UAAM,IAAI,SAAS,YAAY,OAAO;AACtC,QAAI,IAAI,KAAK,KAAK,mBAAmB;AACnC,eAAS,KAAK;AAAA,QACZ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO,0BAA0B,OAAO;AAAA,QACxC,aAAa,eAAe,SAAS,QAAQ,CAAC,qCAAqC,OAAO;AAAA,QAC1F,UAAU,IAAI,SAAS,aAAQ,OAAO,gBAAgB,CAAC;AAAA,QACvD,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,QAAM,WAAW;AAAA,IACf,EAAE,IAAI,MAAM,MAAM,gBAAgB;AAAA,IAClC,EAAE,IAAI,aAAa,MAAM,sBAAsB;AAAA,EACjD;AAEA,aAAW,KAAK,UAAU;AACxB,QAAI,EAAE,GAAG,KAAK,UAAU,KAAK,CAAC,eAAe,SAAS,UAAU,GAAG;AACjE,eAAS,KAAK;AAAA,QACZ,UAAU;AAAA,QACV,UAAU;AAAA,QACV,OAAO,8BAA8B,EAAE,IAAI;AAAA,QAC3C,aAAa,eAAe,SAAS,SAAS,EAAE,IAAI;AAAA,QACpD,cAAc;AAAA,MAChB,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;;;AC5CA,IAAM,mBAAmB;AAAA,EACvB,UAAU;AAAA,EACV,MAAM;AAAA,EACN,QAAQ;AAAA,EACR,KAAK;AACP;AAEO,SAAS,mBAAmB,UAA6B;AAC9D,MAAI,QAAQ;AACZ,aAAW,KAAK,UAAU;AACxB,aAAS,iBAAiB,EAAE,QAAQ;AAAA,EACtC;AACA,SAAO,KAAK,IAAI,OAAO,GAAG;AAC5B;AAEO,SAAS,aAAa,OAA0B;AACrD,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,MAAI,SAAS,GAAI,QAAO;AACxB,SAAO;AACT;AAEO,SAAS,cAAc,UAAoC;AAChE,QAAM,SAAwB,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,EAAE;AACxE,aAAW,KAAK,UAAU;AACxB,WAAO,EAAE,QAAQ;AAAA,EACnB;AACA,SAAO;AACT;;;AClBA,eAAsB,UACpB,SACA,UAAuB,CAAC,GACH;AACrB,QAAM,QAAQ,WAAW,OAAO;AAChC,QAAM,cAAyB,CAAC;AAEhC,cAAY,KAAK,GAAG,kBAAkB,KAAK,CAAC;AAC5C,cAAY,KAAK,GAAG,iBAAiB,KAAK,CAAC;AAE3C,MAAI,QAAQ,YAAY,QAAQ,kBAAkB;AAChD,UAAM,mBAAmB,MAAM,QAAQ,iBAAiB,OAAO;AAC/D,gBAAY,KAAK,GAAG,gBAAgB;AAAA,EACtC;AAEA,cAAY,KAAK,GAAG,kBAAkB,KAAK,CAAC;AAE5C,MAAI,MAAM,YAAY,MAAM;AAC1B,gBAAY,KAAK,GAAG,iBAAiB,MAAM,YAAY,IAAI,CAAC;AAAA,EAC9D;AAEA,QAAM,YAAY,mBAAmB,WAAW;AAChD,QAAM,YAAY,aAAa,SAAS;AACxC,QAAM,gBAAgB,cAAc,WAAW;AAE/C,QAAM,iBACJ,aAAa,KAAK,UAAU,aAAa,KAAK,SAAS;AAEzD,SAAO;AAAA,IACL,WAAW,MAAM,YAAY,QAAQ;AAAA,IACrC,cAAc,MAAM,YAAY;AAAA,IAChC,aAAa;AAAA,IACb,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU;AAAA,IACV;AAAA,EACF;AACF;;;ACpDA,OAAO,WAAW;AAGlB,IAAM,kBAA2D;AAAA,EAC/D,UAAU,MAAM,MAAM,MAAM;AAAA,EAC5B,MAAM,MAAM,IAAI;AAAA,EAChB,QAAQ,MAAM;AAAA,EACd,KAAK,MAAM;AACb;AAEA,IAAM,eAAsD;AAAA,EAC1D,GAAG,MAAM,MAAM;AAAA,EACf,GAAG,MAAM;AAAA,EACT,GAAG,MAAM,OAAO;AAAA,EAChB,GAAG,MAAM,UAAU;AAAA,EACnB,GAAG,MAAM,MAAM,MAAM;AACvB;AAEO,SAAS,gBAAgB,QAA0B;AACxD,UAAQ,IAAI;AACZ,UAAQ,IAAI,MAAM,KAAK,SAAI,OAAO,EAAE,CAAC,CAAC;AACtC,UAAQ,IAAI,MAAM,KAAK,uBAAuB,CAAC;AAC/C,UAAQ,IAAI,MAAM,KAAK,SAAI,OAAO,EAAE,CAAC,CAAC;AACtC,UAAQ,IAAI;AAEZ,UAAQ,IAAI,cAAc,MAAM,KAAK,OAAO,SAAS,CAAC,EAAE;AACxD,MAAI,OAAO,cAAc;AACvB,YAAQ,IAAI,cAAc,OAAO,YAAY,EAAE;AAAA,EACjD;AACA,UAAQ,IAAI;AAGZ,QAAM,aAAa,aAAa,OAAO,SAAS,KAAK,MAAM;AAC3D,UAAQ;AAAA,IACN,iBAAiB,WAAW,GAAG,OAAO,SAAS,MAAM,CAAC,YAAY,WAAW,OAAO,SAAS,CAAC;AAAA,EAChG;AACA,UAAQ,IAAI;AAGZ,QAAM,KAAK,OAAO;AAClB,UAAQ,IAAI,aAAa;AACzB,MAAI,GAAG;AACL,YAAQ;AAAA,MACN,OAAO,gBAAgB,SAAS,YAAY,CAAC,IAAI,GAAG,QAAQ;AAAA,IAC9D;AACF,MAAI,GAAG;AACL,YAAQ,IAAI,OAAO,gBAAgB,KAAK,MAAM,CAAC,QAAQ,GAAG,IAAI,EAAE;AAClE,MAAI,GAAG;AACL,YAAQ,IAAI,OAAO,gBAAgB,OAAO,QAAQ,CAAC,MAAM,GAAG,MAAM,EAAE;AACtE,MAAI,GAAG,IAAK,SAAQ,IAAI,OAAO,gBAAgB,IAAI,KAAK,CAAC,SAAS,GAAG,GAAG,EAAE;AAC1E,MAAI,CAAC,GAAG,YAAY,CAAC,GAAG,QAAQ,CAAC,GAAG,UAAU,CAAC,GAAG,KAAK;AACrD,YAAQ,IAAI,OAAO,MAAM,MAAM,uCAAkC,CAAC,EAAE;AAAA,EACtE;AACA,UAAQ,IAAI;AAGZ,MAAI,OAAO,SAAS,SAAS,GAAG;AAC9B,YAAQ,IAAI,MAAM,KAAK,YAAY,CAAC;AACpC,YAAQ,IAAI;AACZ,eAAW,KAAK,OAAO,UAAU;AAC/B,YAAM,QAAQ,gBAAgB,EAAE,QAAQ;AACxC,cAAQ,IAAI,KAAK,MAAM,IAAI,EAAE,SAAS,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE;AACpE,cAAQ,IAAI,OAAO,MAAM,IAAI,EAAE,WAAW,CAAC,EAAE;AAC7C,UAAI,EAAE,UAAU;AACd,gBAAQ,IAAI,iBAAiB,MAAM,OAAO,EAAE,QAAQ,CAAC,EAAE;AAAA,MACzD;AACA,UAAI,EAAE,YAAY;AAChB,gBAAQ,IAAI,aAAa,EAAE,UAAU,EAAE;AAAA,MACzC;AACA,cAAQ,IAAI;AAAA,IACd;AAAA,EACF;AAGA,QAAM,YAAmD;AAAA,IACvD,OAAO,MAAM,MAAM,MAAM;AAAA,IACzB,MAAM,MAAM,SAAS,MAAM;AAAA,IAC3B,SAAS,MAAM,QAAQ,MAAM;AAAA,EAC/B;AACA,QAAM,MAAM,OAAO,kBAAkB;AACrC,UAAQ;AAAA,IACN,sBAAsB,UAAU,GAAG,KAAK,MAAM,OAAO,IAAI,IAAI,YAAY,CAAC,GAAG,CAAC;AAAA,EAChF;AACA,UAAQ,IAAI;AACZ,UAAQ,IAAI,MAAM,KAAK,SAAI,OAAO,EAAE,CAAC,CAAC;AACtC,UAAQ,IAAI;AACd;;;ACpFO,SAAS,gBAAgB,QAA0B;AACxD,UAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC7C;;;AVSA,eAAe,iBAAiB,MAA+B;AAC7D,QAAM,OAAO;AAAA,IACX,0DAA0D,IAAI;AAAA,IAC9D,qCAAqC,IAAI;AAAA,EAC3C;AAEA,aAAW,OAAO,MAAM;AACtB,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,KAAK,EAAE,QAAQ,YAAY,QAAQ,GAAK,EAAE,CAAC;AACnE,UAAI,IAAI,IAAI;AACV,eAAO,MAAM,IAAI,KAAK;AAAA,MACxB;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR,0BAA0B,IAAI;AAAA,EAChC;AACF;AAEA,eAAsB,YACpB,QACA,SACe;AACf,MAAI;AAEJ,MAAI,QAAQ,QAAQ;AAClB,QAAI;AACF,cAAQ,OAAO,MAAM,aAAa,MAAM;AAAA,CAAqB;AAC7D,gBAAU,MAAM,iBAAiB,MAAM;AAAA,IACzC,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,eAAe,QAAQ,IAAI,UAAU;AAAA,MACvC;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,OAAO;AACL,UAAM,YAAY,QAAQ,MAAM;AAChC,QAAI,YAAY;AAEhB,QACE,WAAW,SAAS,KACpB,CAAC,UAAU,SAAS,KAAK,KACzB,WAAW,KAAK,WAAW,UAAU,CAAC,GACtC;AACA,kBAAY,KAAK,WAAW,UAAU;AAAA,IACxC;AAEA,QAAI,CAAC,WAAW,SAAS,GAAG;AAC1B,cAAQ,MAAM,kCAAkC,SAAS,EAAE;AAC3D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,cAAU,aAAa,WAAW,OAAO;AAAA,EAC3C;AAEA,QAAM,SAAS,MAAM,UAAU,SAAS,EAAE,UAAU,MAAM,CAAC;AAE3D,MAAI,QAAQ,WAAW,QAAQ;AAC7B,oBAAgB,MAAM;AAAA,EACxB,OAAO;AACL,oBAAgB,MAAM;AAAA,EACxB;AAEA,MAAI,QAAQ,QAAQ;AAClB,UAAM,gBAAgB,CAAC,OAAO,UAAU,QAAQ,UAAU;AAC1D,UAAM,YAAY,cAAc,QAAQ,QAAQ,MAAM;AACtD,UAAM,aAAa,OAAO,SAAS;AAAA,MACjC,CAAC,MAAM,cAAc,QAAQ,EAAE,QAAQ,KAAK;AAAA,IAC9C;AACA,QAAI,YAAY;AACd,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF;AACF;;;AWzFA,SAAS,aAAa,cAAAA,aAAY,gBAAAC,qBAAoB;AACtD,SAAS,QAAAC,aAAY;AACrB,SAAS,eAAe;AAGxB,OAAOC,YAAW;AAElB,IAAM,aAAa;AAAA,EACjBC,MAAK,QAAQ,GAAG,aAAa,QAAQ;AAAA,EACrCA,MAAK,QAAQ,GAAG,aAAa,aAAa,QAAQ;AACpD;AAEA,eAAsB,eAA8B;AAClD,UAAQ,IAAID,OAAM,KAAK,wDAAmD,CAAC;AAE3E,MAAI,eAAe;AACnB,MAAI,eAAe;AAEnB,aAAW,OAAO,YAAY;AAC5B,QAAI,CAACE,YAAW,GAAG,EAAG;AAEtB,UAAM,UAAU,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC;AACxD,eAAW,SAAS,SAAS;AAC3B,UAAI,CAAC,MAAM,YAAY,EAAG;AAC1B,YAAM,YAAYD,MAAK,KAAK,MAAM,MAAM,UAAU;AAClD,UAAI,CAACC,YAAW,SAAS,EAAG;AAE5B,YAAM,UAAUC,cAAa,WAAW,OAAO;AAC/C,YAAM,SAAS,MAAM,UAAU,OAAO;AACtC;AACA,sBAAgB,OAAO,SAAS;AAEhC,sBAAgB,MAAM;AAAA,IACxB;AAAA,EACF;AAEA,UAAQ,IAAIH,OAAM,KAAK;AAAA,kBAAqB,YAAY,oBAAoB,YAAY;AAAA,CAAa,CAAC;AACxG;;;ACrCA,SAAS,gBAAAI,eAAc,cAAAC,aAAY,aAAa;AAChD,SAAS,QAAAC,aAAY;AACrB,SAAS,WAAAC,gBAAe;AACxB,OAAOC,YAAW;AAIlB,IAAMC,cAAa;AAAA,EACjBC,MAAKC,SAAQ,GAAG,aAAa,QAAQ;AAAA,EACrCD,MAAKC,SAAQ,GAAG,aAAa,aAAa,QAAQ;AACpD;AAEA,eAAsB,aAAa,SAEjB;AAChB,QAAM,YAAY,QAAQ,aAAa;AACvC,UAAQ;AAAA,IACNC,OAAM;AAAA,MACJ;AAAA,gEAA8D,SAAS;AAAA;AAAA,IACzE;AAAA,EACF;AAEA,QAAM,YAAsB,CAAC;AAC7B,aAAW,OAAOH,aAAY;AAC5B,QAAII,YAAW,GAAG,GAAG;AACnB,gBAAU,KAAK,GAAG;AAAA,IACpB;AAAA,EACF;AAEA,MAAI,UAAU,WAAW,GAAG;AAC1B,YAAQ;AAAA,MACND,OAAM;AAAA,QACJ;AAAA,MACF;AAAA,IACF;AACA,YAAQ,IAAIA,OAAM,IAAI,uBAAuB,CAAC;AAC9C,eAAW,OAAOH,aAAY;AAC5B,cAAQ,IAAIG,OAAM,IAAI,KAAK,GAAG,EAAE,CAAC;AAAA,IACnC;AACA,YAAQ,IAAI;AACZ;AAAA,EACF;AAEA,UAAQ,IAAIA,OAAM,IAAI,WAAW,CAAC;AAClC,aAAW,OAAO,WAAW;AAC3B,YAAQ,IAAIA,OAAM,IAAI,KAAK,GAAG,EAAE,CAAC;AAAA,EACnC;AACA,UAAQ,IAAI;AAEZ,aAAW,OAAO,WAAW;AAC3B,UAAM,UAAU,MAAM,KAAK,EAAE,WAAW,KAAK,GAAG,OAAO,OAAO,aAAa;AACzE,UAAI,CAAC,UAAU,SAAS,UAAU,EAAG;AAErC,YAAM,YAAYF,MAAK,KAAK,QAAQ;AACpC,UAAI,CAACG,YAAW,SAAS,EAAG;AAE5B,cAAQ,IAAID,OAAM,IAAI;AAAA,mBAAsB,QAAQ,EAAE,CAAC;AAEvD,UAAI;AACF,cAAM,UAAUE,cAAa,WAAW,OAAO;AAC/C,cAAM,SAAS,MAAM,UAAU,OAAO;AAEtC,wBAAgB,MAAM;AAEtB,YAAI,OAAO,YAAY,WAAW;AAChC,kBAAQ;AAAA,YACNF,OAAM,MAAM,MAAM;AAAA,cAChB,8BAAyB,OAAO,SAAS,sBAAsB,SAAS;AAAA,YAC1E;AAAA,UACF;AACA,kBAAQ;AAAA,YACNA,OAAM;AAAA,cACJ,yDAAyD,SAAS;AAAA;AAAA,YACpE;AAAA,UACF;AAAA,QACF;AAAA,MACF,SAAS,KAAK;AACZ,gBAAQ,MAAMA,OAAM,IAAI,kBAAkB,QAAQ,GAAG,GAAG,GAAG;AAAA,MAC7D;AAAA,IACF,CAAC;AAED,YAAQ,GAAG,UAAU,MAAM;AACzB,cAAQ,MAAM;AACd,cAAQ,IAAIA,OAAM,IAAI,kBAAkB,CAAC;AACzC,cAAQ,KAAK,CAAC;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,UAAQ,IAAIA,OAAM,IAAI,kCAAkC,CAAC;AACzD,QAAM,IAAI,QAAQ,MAAM;AAAA,EAAC,CAAC;AAC5B;;;AbrFA,IAAM,UAAU,IAAI,QAAQ;AAE5B,QACG,KAAK,SAAS,EACd,YAAY,oDAAoD,EAChE,QAAQ,OAAO;AAElB,QACG,QAAQ,MAAM,EACd,YAAY,mCAAmC,EAC/C,SAAS,YAAY,uCAAuC,EAC5D,OAAO,qBAAqB,mCAAmC,UAAU,EACzE,OAAO,wBAAwB,8CAA8C,EAC7E,OAAO,cAAc,0DAA0D,EAC/E,OAAO,YAAY,wDAAwD,EAC3E,OAAO,OAAO,QAAQ,SAAS;AAC9B,QAAM,YAAY,QAAQ;AAAA,IACxB,QAAQ,KAAK;AAAA,IACb,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,IACf,QAAQ,KAAK;AAAA,EACf,CAAC;AACH,CAAC;AAEH,QACG,QAAQ,OAAO,EACf,YAAY,oCAAoC,EAChD,OAAO,YAAY;AAClB,QAAM,aAAa;AACrB,CAAC;AAEH,QACG,QAAQ,OAAO,EACf,YAAY,qDAAgD,EAC5D,OAAO,uBAAuB,qCAAqC,IAAI,EACvE,OAAO,OAAO,SAAS;AACtB,QAAM,aAAa,EAAE,WAAW,SAAS,KAAK,SAAS,EAAE,CAAC;AAC5D,CAAC;AAEH,QAAQ,MAAM;","names":["existsSync","readFileSync","join","chalk","join","existsSync","readFileSync","readFileSync","existsSync","join","homedir","chalk","SKILL_DIRS","join","homedir","chalk","existsSync","readFileSync"]}

package/package.json

@@ -0,0 +1,57 @@
+{
+  "name": "clawvet",
+  "version": "0.1.0",
+  "description": "Skill vetting & supply chain security for OpenClaw. Scans SKILL.md files for prompt injection, credential theft, RCE, typosquatting, and social engineering.",
+  "type": "module",
+  "bin": {
+    "clawvet": "dist/index.js"
+  },
+  "main": "dist/index.js",
+  "types": "dist/index.d.ts",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "build": "tsup",
+    "dev": "tsx src/index.ts",
+    "prepublishOnly": "npm run build"
+  },
+  "keywords": [
+    "openclaw",
+    "clawvet",
+    "security",
+    "scanner",
+    "skill",
+    "supply-chain",
+    "prompt-injection",
+    "ai-agent",
+    "malware",
+    "cli"
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/MohibShaikh/clawvet.git"
+  },
+  "homepage": "https://github.com/MohibShaikh/clawvet#readme",
+  "bugs": {
+    "url": "https://github.com/MohibShaikh/clawvet/issues"
+  },
+  "dependencies": {
+    "chalk": "^5.4.0",
+    "commander": "^13.0.0",
+    "fastest-levenshtein": "^1.0.16",
+    "yaml": "^2.6.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "tsup": "^8.5.1",
+    "tsx": "^4.19.0",
+    "typescript": "^5.7.0"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  }
+}