clawvet 0.2.3 → 0.4.0

package/LICENSE

@@ -1,21 +1,21 @@
-MIT License
-
-Copyright (c) 2026 ClawVet Contributors
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+MIT License
+
+Copyright (c) 2026 ClawVet Contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -1,86 +1,86 @@
-# clawvet
-
-**Skill vetting & supply chain security for OpenClaw.**
-
-ClawVet scans OpenClaw `SKILL.md` files for prompt injection, credential theft, remote code execution, typosquatting, and social engineering — before they reach your agent.
-
-## Install
-
-```bash
-npm install -g clawvet
-```
-
-## Usage
-
-### Scan a local skill
-
-```bash
-clawvet scan ./my-skill/
-clawvet scan ./my-skill/SKILL.md
-```
-
-### JSON output (for CI/CD)
-
-```bash
-clawvet scan ./my-skill/ --format json
-```
-
-### Fail on severity threshold
-
-```bash
-clawvet scan ./my-skill/ --fail-on high
-# exits 1 if any high or critical findings
-```
-
-### Fetch and scan from ClawHub
-
-```bash
-clawvet scan weather-forecast --remote
-```
-
-### Audit all installed skills
-
-```bash
-clawvet audit
-```
-
-### Watch for new skill installs
-
-```bash
-clawvet watch --threshold 50
-```
-
-## What it detects
-
-ClawVet runs a 6-pass analysis on every skill:
-
-| Pass | What it checks |
-|------|---------------|
-| **Skill Parser** | Extracts YAML frontmatter, code blocks, URLs, IPs, domains |
-| **Static Analysis** | 54 regex patterns: RCE, reverse shells, credential theft, obfuscation, DNS exfil, privilege escalation |
-| **Metadata Validator** | Undeclared binaries, env vars, missing descriptions, invalid semver |
-| **Dependency Checker** | `npx -y` auto-install, global `npm install`, risky packages |
-| **Typosquat Detector** | Levenshtein distance against popular skills, suspicious naming patterns |
-| **Semantic Analysis** | AI-powered detection of social engineering & prompt injection (optional) |
-
-## Risk Scoring
-
-| Score | Grade | Action |
-|-------|-------|--------|
-| 0-10 | A | Approve |
-| 11-25 | B | Approve |
-| 26-50 | C | Warn |
-| 51-75 | D | Warn |
-| 76-100 | F | Block |
-
-## CI/CD Integration
-
-```yaml
-# GitHub Actions example
-- name: Vet skill
-  run: npx clawvet scan ./my-skill --format json --fail-on high
-```
-
-## License
-
-MIT
+# clawvet
+
+**Skill vetting & supply chain security for OpenClaw.**
+
+ClawVet scans OpenClaw `SKILL.md` files for prompt injection, credential theft, remote code execution, typosquatting, and social engineering — before they reach your agent.
+
+## Install
+
+```bash
+npm install -g clawvet
+```
+
+## Usage
+
+### Scan a local skill
+
+```bash
+clawvet scan ./my-skill/
+clawvet scan ./my-skill/SKILL.md
+```
+
+### JSON output (for CI/CD)
+
+```bash
+clawvet scan ./my-skill/ --format json
+```
+
+### Fail on severity threshold
+
+```bash
+clawvet scan ./my-skill/ --fail-on high
+# exits 1 if any high or critical findings
+```
+
+### Fetch and scan from ClawHub
+
+```bash
+clawvet scan weather-forecast --remote
+```
+
+### Audit all installed skills
+
+```bash
+clawvet audit
+```
+
+### Watch for new skill installs
+
+```bash
+clawvet watch --threshold 50
+```
+
+## What it detects
+
+ClawVet runs a 6-pass analysis on every skill:
+
+| Pass | What it checks |
+|------|---------------|
+| **Skill Parser** | Extracts YAML frontmatter, code blocks, URLs, IPs, domains |
+| **Static Analysis** | 54 regex patterns: RCE, reverse shells, credential theft, obfuscation, DNS exfil, privilege escalation |
+| **Metadata Validator** | Undeclared binaries, env vars, missing descriptions, invalid semver |
+| **Dependency Checker** | `npx -y` auto-install, global `npm install`, risky packages |
+| **Typosquat Detector** | Levenshtein distance against popular skills, suspicious naming patterns |
+| **Semantic Analysis** | AI-powered detection of social engineering & prompt injection (optional) |
+
+## Risk Scoring
+
+| Score | Grade | Action |
+|-------|-------|--------|
+| 0-10 | A | Approve |
+| 11-25 | B | Approve |
+| 26-50 | C | Warn |
+| 51-75 | D | Warn |
+| 76-100 | F | Block |
+
+## CI/CD Integration
+
+```yaml
+# GitHub Actions example
+- name: Vet skill
+  run: npx clawvet scan ./my-skill --format json --fail-on high
+```
+
+## License
+
+MIT