cyberaudit-skill 3.1.5 → 3.2.0

package/dist/report/generator.js

@@ -0,0 +1,260 @@
+function calculateScore(findings) {
+    let score = 100;
+    for (const f of findings) {
+        switch (f.severity) {
+            case 'CRITICAL':
+                score -= 20;
+                break;
+            case 'HIGH':
+                score -= 10;
+                break;
+            case 'MEDIUM':
+                score -= 5;
+                break;
+            case 'LOW':
+                score -= 1;
+                break;
+            case 'INFO':
+                score -= 0;
+                break;
+        }
+    }
+    // Extra penalty for many findings
+    if (findings.length > 10)
+        score -= Math.min(20, findings.length - 10);
+    return Math.max(0, Math.min(100, score));
+}
+function getVerdict(score, hasCritical) {
+    if (hasCritical || score <= 20)
+        return 'CRITICAL';
+    if (score <= 40)
+        return 'HIGH';
+    if (score <= 60)
+        return 'MODERATE';
+    if (score <= 80)
+        return 'GOOD';
+    return 'EXCELLENT';
+}
+function verdictIcon(v) {
+    switch (v) {
+        case 'CRITICAL': return '🔴 CRITICAL';
+        case 'HIGH': return '🟠 HIGH';
+        case 'MODERATE': return '🟡 MODERATE';
+        case 'GOOD': return '🟢 GOOD';
+        case 'EXCELLENT': return '✅ EXCELLENT';
+        default: return v;
+    }
+}
+function groupBySeverity(findings) {
+    const map = { CRITICAL: 0, HIGH: 0, MEDIUM: 0, LOW: 0, INFO: 0 };
+    for (const f of findings) {
+        map[f.severity] = (map[f.severity] || 0) + 1;
+    }
+    return map;
+}
+function owaspComplianceFromFindings(findings) {
+    // Simplified mapping based on patternId -> OWASP
+    const owaspMap = {
+        'A01 — Broken Access Control': ['CORS', 'IDOR', 'BOLA', 'MASS_ASSIGNMENT'],
+        'A02 — Cryptographic Failures': ['JWT', 'CRYPTO', 'PRIVATE_KEY'],
+        'A03 — Injection': ['SQLI', 'XSS', 'INJECTION', 'EVAL', 'EXEC', 'NOSQL', 'XXE', 'DESERIAL'],
+        'A04 — Insecure Design': ['LOGIC', 'BUSINESS'],
+        'A05 — Security Misconfiguration': ['HELMET', 'HEADERS', 'DEBUG', 'CORS'],
+        'A06 — Vulnerable Components': ['DEPS', 'SUPPLY'],
+        'A07 — Auth Failures': ['AUTH', 'SECRET', 'AWS', 'GITHUB', 'STRIPE', 'JWT'],
+        'A08 — Data Integrity': ['DESERIAL', 'SUPPLY'],
+        'A09 — Logging & Monitoring': [],
+        'A10 — SSRF': ['SSRF'],
+    };
+    const result = {};
+    for (const [owasp, keywords] of Object.entries(owaspMap)) {
+        const hasFindings = findings.some(f => {
+            const pid = f.patternId.toUpperCase();
+            return keywords.some(k => pid.includes(k.toUpperCase()));
+        });
+        if (hasFindings)
+            result[owasp] = '❌ FAIL';
+        else
+            result[owasp] = '✅ PASS';
+    }
+    // If no findings at all, all PASS
+    return result;
+}
+function bar(score) {
+    const filled = Math.round(score / 5); // 20 chars max
+    const empty = 20 - filled;
+    return `[${'█'.repeat(filled)}${'░'.repeat(empty)}] ${score}%`;
+}
+export function generateReport(input) {
+    const { target, findings, type, version, framework } = input;
+    const date = input.date || new Date().toISOString().split('T')[0];
+    const score = calculateScore(findings);
+    const hasCritical = findings.some(f => f.severity === 'CRITICAL');
+    const verdict = getVerdict(score, hasCritical);
+    const dashboard = groupBySeverity(findings);
+    const owasp = owaspComplianceFromFindings(findings);
+    // Sort findings by severity then file
+    const order = { CRITICAL: 0, HIGH: 1, MEDIUM: 2, LOW: 3, INFO: 4 };
+    const sorted = [...findings].sort((a, b) => {
+        const oa = order[a.severity];
+        const ob = order[b.severity];
+        if (oa !== ob)
+            return oa - ob;
+        return a.file.localeCompare(b.file);
+    });
+    const groupedBySeverity = {};
+    for (const f of sorted) {
+        if (!groupedBySeverity[f.severity])
+            groupedBySeverity[f.severity] = [];
+        groupedBySeverity[f.severity].push(f);
+    }
+    let md = `# 🛡️ SECURITY AUDIT REPORT — ${type.toUpperCase()}\n`;
+    md += `# Generated by CyberAudit v${version} — Deterministic Scanner\n\n`;
+    md += `═══════════════════════════════════════════════════════════════\n`;
+    md += `              REPORT HEADER\n`;
+    md += `═══════════════════════════════════════════════════════════════\n\n`;
+    md += `Application     : ${target}\n`;
+    md += `Framework(s)    : ${framework || 'auto-detected'}\n`;
+    md += `Audit type      : ${type} — deterministic (secrets + web)\n`;
+    md += `Audit level     : Standard (deterministic)\n`;
+    md += `Date            : ${date}\n`;
+    md += `Auditor         : CyberAudit Intelligence v${version} (deterministic scanner)\n`;
+    md += `Confidentiality : 🔴 CONFIDENTIAL — Internal use only\n\n`;
+    md += `═══════════════════════════════════════════════════════════════\n`;
+    md += `              EXECUTIVE SUMMARY\n`;
+    md += `═══════════════════════════════════════════════════════════════\n\n`;
+    md += `OVERALL VERDICT: ${verdictIcon(verdict)}\n\n`;
+    md += `SECURITY SCORE: ${score}/100\n\n`;
+    md += `  ${bar(score)}\n\n`;
+    md += `  0-20  : 🔴 Critical — Do not deploy\n`;
+    md += `  21-40 : 🟠 High — Major fixes required\n`;
+    md += `  41-60 : 🟡 Moderate — Significant fixes before prod\n`;
+    md += `  61-80 : 🟢 Good — Some fixes recommended\n`;
+    md += `  81-100: ✅ Excellent — Ready for production\n\n`;
+    md += `VULNERABILITY DASHBOARD\n`;
+    md += `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n`;
+    md += `  🔴 CRITICAL : ${dashboard.CRITICAL || 0} → Block deployment\n`;
+    md += `  🟠 HIGH     : ${dashboard.HIGH || 0} → Fix before deployment\n`;
+    md += `  🟡 MEDIUM   : ${dashboard.MEDIUM || 0} → Fix within 30 days\n`;
+    md += `  🟢 LOW      : ${dashboard.LOW || 0} → Security backlog\n`;
+    md += `  ℹ️  INFO     : ${dashboard.INFO || 0} → Recommendations\n\n`;
+    md += `  TOTAL : ${findings.length} findings (deterministic)\n\n`;
+    if (findings.length > 0) {
+        md += `IDENTIFIED BUSINESS RISKS\n`;
+        md += `━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+        if (dashboard.CRITICAL > 0)
+            md += `  → Immediate compromise possible via ${sorted.filter(f => f.severity === 'CRITICAL').slice(0, 2).map(f => f.patternId).join(', ')}\n`;
+        if (findings.some(f => f.patternId.includes('SECRET') || f.patternId.includes('AWS')))
+            md += `  → Credential leak → account takeover, data breach\n`;
+        if (findings.some(f => f.patternId.includes('SQLI') || f.patternId.includes('XSS')))
+            md += `  → Injection → data exfiltration, user session hijack\n`;
+        if (findings.some(f => f.patternId.includes('JWT')))
+            md += `  → Auth bypass via JWT flaw\n`;
+        md += `\n`;
+        md += `IMMEDIATE ACTIONS REQUIRED\n`;
+        md += `━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+        sorted.filter(f => f.severity === 'CRITICAL').slice(0, 3).forEach((f, i) => {
+            md += `  ${i + 1}. Fix ${f.patternId} in ${f.file}:${f.line} — ${f.severity}\n`;
+        });
+        if (dashboard.CRITICAL === 0 && dashboard.HIGH > 0) {
+            sorted.filter(f => f.severity === 'HIGH').slice(0, 3).forEach((f, i) => {
+                md += `  ${i + 1}. Fix ${f.patternId} in ${f.file}:${f.line}\n`;
+            });
+        }
+        md += `\n`;
+    }
+    else {
+        md += `✅ No deterministic findings. Good baseline, proceed to manual audit for business logic.\n\n`;
+    }
+    md += `═══════════════════════════════════════════════════════════════\n`;
+    md += `              DETAILED FINDINGS\n`;
+    md += `═══════════════════════════════════════════════════════════════\n\n`;
+    if (sorted.length === 0) {
+        md += `No findings from deterministic scanners.\n\n`;
+    }
+    else {
+        let counter = 1;
+        for (const sev of ['CRITICAL', 'HIGH', 'MEDIUM', 'LOW', 'INFO']) {
+            const group = groupedBySeverity[sev];
+            if (!group || group.length === 0)
+                continue;
+            md += `━━ ${sev} (${group.length}) ━━\n\n`;
+            for (const f of group) {
+                md += `[VULN-${String(counter).padStart(3, '0')}] — ${f.patternId}\n`;
+                md += `─────────────────────────────────────────────\n`;
+                md += `  Severity      : ${sev === 'CRITICAL' ? '🔴' : sev === 'HIGH' ? '🟠' : sev === 'MEDIUM' ? '🟡' : '🟢'} ${sev}\n`;
+                md += `  CVSS Score    : ${f.cvss} (${f.cvssVector})\n`;
+                md += `  Scanner       : ${f.scanner}\n`;
+                md += `  OWASP         : ${f.owasp || 'N/A'}\n`;
+                md += `  CWE           : ${f.cwe || 'N/A'}\n`;
+                md += `  File          : ${f.file}\n`;
+                md += `  Line          : ${f.line}\n`;
+                md += `\n`;
+                md += `  ┌─ MATCH ─────────────────────────────────────────────\n`;
+                md += `  │ ${f.match.slice(0, 200)}\n`;
+                md += `  └─────────────────────────────────────────────────────\n\n`;
+                md += `  DESCRIPTION\n`;
+                md += `  ───────────\n`;
+                md += `  ${f.description}\n\n`;
+                md += `  REMEDIATION (ready to copy-paste)\n`;
+                md += `  ───────────\n`;
+                md += `  ${f.remediation}\n\n`;
+                md += `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n\n`;
+                counter++;
+            }
+        }
+    }
+    md += `═══════════════════════════════════════════════════════════════\n`;
+    md += `              OWASP TOP 10 2023 COMPLIANCE\n`;
+    md += `═══════════════════════════════════════════════════════════════\n\n`;
+    for (const [k, v] of Object.entries(owasp)) {
+        md += `  ${k.padEnd(35)} : ${v}\n`;
+    }
+    md += `\n`;
+    md += `═══════════════════════════════════════════════════════════════\n`;
+    md += `              PRIORITISED REMEDIATION PLAN\n`;
+    md += `═══════════════════════════════════════════════════════════════\n\n`;
+    const phases = {
+        'PHASE 1 — IMMEDIATE (Week 1)': groupedBySeverity['CRITICAL'] || [],
+        'PHASE 2 — SHORT TERM (Weeks 2-4)': groupedBySeverity['HIGH'] || [],
+        'PHASE 3 — MEDIUM TERM (Months 2-3)': groupedBySeverity['MEDIUM'] || [],
+        'PHASE 4 — LONG TERM (Backlog)': [...(groupedBySeverity['LOW'] || []), ...(groupedBySeverity['INFO'] || [])],
+    };
+    for (const [phase, items] of Object.entries(phases)) {
+        if (items.length === 0)
+            continue;
+        md += `${phase}\n`;
+        md += `  Objective: ${phase.includes('IMMEDIATE') ? 'Eliminate critical risks' : phase.includes('SHORT') ? 'Eliminate high risks' : phase.includes('MEDIUM') ? 'Address medium risks' : 'Polish'}\n`;
+        for (const f of items.slice(0, 10)) {
+            md += `  □ ${f.patternId} : ${f.file}:${f.line} (${f.severity})\n`;
+        }
+        if (items.length > 10)
+            md += `  ... and ${items.length - 10} more\n`;
+        md += `\n`;
+    }
+    md += `═══════════════════════════════════════════════════════════════\n`;
+    md += `              CONCLUSION\n`;
+    md += `═══════════════════════════════════════════════════════════════\n\n`;
+    if (verdict === 'CRITICAL')
+        md += `🔴 NO-GO for production. Critical findings must be fixed. Score ${score}/100.\n`;
+    else if (verdict === 'HIGH')
+        md += `🟠 NO-GO for production without fixing HIGH findings. Score ${score}/100.\n`;
+    else if (verdict === 'MODERATE')
+        md += `🟡 Conditional GO with remediation plan. Score ${score}/100.\n`;
+    else if (verdict === 'GOOD')
+        md += `🟢 GO with minor fixes in backlog. Score ${score}/100.\n`;
+    else
+        md += `✅ GO for production. Excellent posture. Score ${score}/100.\n`;
+    md += `\n━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+    md += `Report generated by CyberAudit v${version} — Deterministic Scanner\n`;
+    md += `Findings are deterministic (regex + patterns), not LLM hallucinations.\n`;
+    md += `For full manual audit, run /audit:web, /audit:api, etc. via skill.\n`;
+    md += `━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━\n`;
+    return {
+        markdown: md,
+        score,
+        verdict,
+        dashboard,
+        owaspCompliance: owasp,
+    };
+}

package/dist/report/generator.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/report/generator.test.js

@@ -0,0 +1,73 @@
+import { describe, it, expect } from 'vitest';
+import { generateReport } from './generator.js';
+describe('Report Generator', () => {
+    it('should generate empty report with 100 score when no findings', () => {
+        const out = generateReport({
+            target: './src',
+            version: '3.1.5',
+            type: 'web',
+            findings: [],
+        });
+        expect(out.score).toBe(100);
+        expect(out.verdict).toBe('EXCELLENT');
+        expect(out.markdown).toContain('No deterministic findings');
+        expect(out.markdown).toContain('100/100');
+    });
+    it('should calculate score based on severity', () => {
+        const findings = [
+            { id: '1', patternId: 'AWS_ACCESS_KEY', scanner: 'secrets', severity: 'CRITICAL', cvss: 9.1, cvssVector: 'CVSS:3.1/...', file: 'a.js', line: 1, match: 'AKIA...', description: 'desc', remediation: 'fix', owasp: 'A07' },
+            { id: '2', patternId: 'WEB_XSS', scanner: 'web', severity: 'HIGH', cvss: 7.5, cvssVector: 'CVSS:3.1/...', file: 'b.js', line: 2, match: 'innerHTML', description: 'desc', remediation: 'fix', owasp: 'A03' },
+        ];
+        const out = generateReport({
+            target: './app',
+            version: '3.1.5',
+            type: 'web',
+            findings,
+        });
+        // 100 -20 -10 =70
+        expect(out.score).toBe(70);
+        expect(out.dashboard.CRITICAL).toBe(1);
+        expect(out.dashboard.HIGH).toBe(1);
+        expect(out.markdown).toContain('CRITICAL');
+        expect(out.markdown).toContain('AWS_ACCESS_KEY');
+    });
+    it('should produce markdown with required sections', () => {
+        const findings = [
+            { id: 'VULN-001', patternId: 'WEB_SQLI_CONCAT', scanner: 'web', severity: 'CRITICAL', cvss: 9.8, cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H', file: 'db.js', line: 10, match: 'db.query("SELECT "+req.query.id)', description: 'SQLi via concat', remediation: 'Use param query', owasp: 'A03', cwe: 'CWE-89' },
+        ];
+        const out = generateReport({
+            target: 'myapp',
+            version: '3.1.5',
+            type: 'web',
+            findings,
+            framework: 'Express',
+        });
+        expect(out.markdown).toContain('REPORT HEADER');
+        expect(out.markdown).toContain('EXECUTIVE SUMMARY');
+        expect(out.markdown).toContain('DETAILED FINDINGS');
+        expect(out.markdown).toContain('OWASP TOP 10');
+        expect(out.markdown).toContain('PRIORITISED REMEDIATION PLAN');
+        expect(out.markdown).toContain('CONCLUSION');
+        expect(out.markdown).toContain('myapp');
+        expect(out.markdown).toContain('Express');
+    });
+    it('should set NO-GO for critical', () => {
+        const findings = [
+            { id: '1', patternId: 'WEB_EVAL', scanner: 'web', severity: 'CRITICAL', cvss: 9.8, cvssVector: 'CVSS:3.1/...', file: 'bad.js', line: 1, match: 'eval(', description: 'eval', remediation: 'remove', owasp: 'A03' },
+        ];
+        const out = generateReport({ target: '.', version: '3.1.5', type: 'web', findings });
+        expect(out.verdict).toBe('CRITICAL');
+        expect(out.markdown).toContain('NO-GO');
+    });
+    it('should contain bar visualization', () => {
+        const out = generateReport({ target: '.', version: '3.1.5', type: 'web', findings: [] });
+        expect(out.markdown).toContain('█');
+        // For 100% score, bar is fully filled, no ░ expected. Test with non-100 score for both chars
+        const findings = [
+            { id: '1', patternId: 'WEB_EVAL', scanner: 'web', severity: 'MEDIUM', cvss: 5.0, cvssVector: 'CVSS:3.1/...', file: 'a.js', line: 1, match: 'eval(', description: 'eval', remediation: 'remove', owasp: 'A03' },
+        ];
+        const out2 = generateReport({ target: '.', version: '3.1.5', type: 'web', findings });
+        expect(out2.markdown).toContain('█');
+        expect(out2.markdown).toContain('░');
+    });
+});

package/dist/report/types.d.ts

@@ -0,0 +1,31 @@
+export interface UnifiedFinding {
+    id: string;
+    patternId: string;
+    scanner: 'secrets' | 'web' | 'api' | 'cloud' | 'manual';
+    severity: 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW' | 'INFO';
+    cvss: number;
+    cvssVector: string;
+    file: string;
+    line: number;
+    match: string;
+    description: string;
+    remediation: string;
+    owasp?: string;
+    cwe?: string;
+    framework?: string;
+}
+export interface ReportInput {
+    target: string;
+    version: string;
+    type: 'web' | 'api' | 'mobile' | 'cloud' | 'full';
+    findings: UnifiedFinding[];
+    framework?: string;
+    date?: string;
+}
+export interface ReportOutput {
+    markdown: string;
+    score: number;
+    verdict: 'CRITICAL' | 'HIGH' | 'MODERATE' | 'GOOD' | 'EXCELLENT';
+    dashboard: Record<string, number>;
+    owaspCompliance: Record<string, string>;
+}

package/dist/report/types.js

@@ -0,0 +1 @@
+export {};

package/dist/scanners/secrets.d.ts

@@ -0,0 +1,32 @@
+import { SecretFinding, ScanOptions, Severity } from './types.js';
+type Pattern = {
+    id: string;
+    name: string;
+    regex: RegExp;
+    severity: Severity;
+    cvss: number;
+    cvssVector: string;
+    description: string;
+    remediation: string;
+    owasp: string;
+    cwe: string;
+    redact?: (m: string) => string;
+};
+declare const PATTERNS: Pattern[];
+export declare function scanSecrets(targetPath: string, opts?: ScanOptions): SecretFinding[];
+export declare function formatFindingsText(findings: SecretFinding[], target: string): string;
+export declare function formatFindingsJson(findings: SecretFinding[]): {
+    id: string;
+    patternId: string;
+    severity: Severity;
+    cvss: number;
+    cvssVector: string;
+    file: string;
+    line: number;
+    match: string;
+    description: string;
+    remediation: string;
+    owasp: string | undefined;
+    cwe: string | undefined;
+}[];
+export { PATTERNS };