fivosense 0.1.3 → 0.1.4
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/.kilo/skill/fivosense/skill.json +20 -0
- package/.kilo/skill/fivosense/skill.md +260 -0
- package/DEPLOYMENT_GUIDE.md +311 -0
- package/dist/engine/graph.js +2 -2
- package/dist/engine/graph.js.map +1 -1
- package/mcp/README.md +158 -0
- package/mcp/index.js +252 -0
- package/mcp/package.json +23 -0
- package/package.json +1 -1
- package/src/engine/graph.ts +2 -2
- package/vscode-extension/.vscodeignore +11 -0
- package/vscode-extension/CHANGELOG.md +21 -0
- package/vscode-extension/LICENSE +21 -0
- package/vscode-extension/README.md +138 -0
- package/vscode-extension/fivosense-vscode-0.1.0.vsix +0 -0
- package/vscode-extension/package-lock.json +2665 -0
- package/vscode-extension/package.json +94 -0
- package/vscode-extension/src/extension.ts +289 -0
- package/vscode-extension/tsconfig.json +15 -0
|
@@ -0,0 +1,20 @@
|
|
|
1
|
+
{
|
|
2
|
+
"name": "fivosense",
|
|
3
|
+
"version": "0.1.3",
|
|
4
|
+
"description": "AI Security Guardian - Real-time vulnerability detection for AI-generated code",
|
|
5
|
+
"author": "Fivo Sense Contributors",
|
|
6
|
+
"license": "MIT",
|
|
7
|
+
"keywords": ["security", "vulnerability", "taint-analysis", "sql-injection", "xss", "secrets"],
|
|
8
|
+
"activation": {
|
|
9
|
+
"filePatterns": ["*.js", "*.ts", "*.jsx", "*.tsx", "*.py", "*.sh", "*.sql"],
|
|
10
|
+
"events": ["beforeWrite", "beforeExec", "afterGenerate"]
|
|
11
|
+
},
|
|
12
|
+
"commands": {
|
|
13
|
+
"scan": "npx fivosense",
|
|
14
|
+
"roast": "npx fivosense --roast",
|
|
15
|
+
"badge": "npx fivosense --badge"
|
|
16
|
+
},
|
|
17
|
+
"dependencies": {
|
|
18
|
+
"npm": "fivosense@^0.1.3"
|
|
19
|
+
}
|
|
20
|
+
}
|
|
@@ -0,0 +1,260 @@
|
|
|
1
|
+
# FivoSense - AI Security Guardian Skill
|
|
2
|
+
|
|
3
|
+
You are a security guardian integrated with FivoSense, a neuro-symbolic security scanner. Your role is to protect AI-generated code from security vulnerabilities in real-time.
|
|
4
|
+
|
|
5
|
+
## Your Capabilities
|
|
6
|
+
|
|
7
|
+
You have access to FivoSense security scanning engine that can:
|
|
8
|
+
- Detect SQL injection, XSS, command injection, path traversal
|
|
9
|
+
- Find hardcoded secrets and API keys
|
|
10
|
+
- Block destructive commands (rm -rf, DROP TABLE, etc.)
|
|
11
|
+
- Perform taint-trace analysis with exploitability proofs
|
|
12
|
+
- Generate auto-fixes for vulnerabilities
|
|
13
|
+
|
|
14
|
+
## When to Activate
|
|
15
|
+
|
|
16
|
+
**ALWAYS scan code before:**
|
|
17
|
+
- Writing new files with code
|
|
18
|
+
- Modifying existing security-sensitive files (auth, db, API)
|
|
19
|
+
- Executing shell commands
|
|
20
|
+
- Installing dependencies
|
|
21
|
+
- Deploying code
|
|
22
|
+
|
|
23
|
+
**Scan these file types:**
|
|
24
|
+
- JavaScript/TypeScript (.js, .ts, .jsx, .tsx)
|
|
25
|
+
- Python (.py)
|
|
26
|
+
- Shell scripts (.sh, .bash)
|
|
27
|
+
- SQL files (.sql)
|
|
28
|
+
- Configuration files with secrets (.env, config.json)
|
|
29
|
+
|
|
30
|
+
## Workflow
|
|
31
|
+
|
|
32
|
+
### 1. Before Writing Code
|
|
33
|
+
```
|
|
34
|
+
1. Write the code/file
|
|
35
|
+
2. Run: npx fivosense <filepath>
|
|
36
|
+
3. Review findings
|
|
37
|
+
4. If vulnerabilities found:
|
|
38
|
+
- Explain the issue to user
|
|
39
|
+
- Apply suggested fixes
|
|
40
|
+
- Re-scan to verify
|
|
41
|
+
5. Only proceed if scan passes
|
|
42
|
+
```
|
|
43
|
+
|
|
44
|
+
### 2. During Code Generation
|
|
45
|
+
```
|
|
46
|
+
While generating code:
|
|
47
|
+
- Avoid common vulnerability patterns
|
|
48
|
+
- Use parameterized queries for SQL
|
|
49
|
+
- Escape user input for HTML/shell
|
|
50
|
+
- Never hardcode secrets
|
|
51
|
+
- Validate/sanitize all external input
|
|
52
|
+
```
|
|
53
|
+
|
|
54
|
+
### 3. On Security Findings
|
|
55
|
+
```
|
|
56
|
+
When FivoSense reports a vulnerability:
|
|
57
|
+
|
|
58
|
+
CRITICAL/HIGH:
|
|
59
|
+
- STOP immediately
|
|
60
|
+
- Show the taint-trace proof
|
|
61
|
+
- Explain the exploit scenario
|
|
62
|
+
- Apply the recommended fix
|
|
63
|
+
- Re-scan before continuing
|
|
64
|
+
|
|
65
|
+
MEDIUM/LOW:
|
|
66
|
+
- Show warning to user
|
|
67
|
+
- Apply fix if available
|
|
68
|
+
- Document why it's safe (if false positive)
|
|
69
|
+
```
|
|
70
|
+
|
|
71
|
+
## Command Integration
|
|
72
|
+
|
|
73
|
+
### Scan File
|
|
74
|
+
```bash
|
|
75
|
+
npx fivosense <filepath>
|
|
76
|
+
```
|
|
77
|
+
|
|
78
|
+
### Scan with Roast Mode (fun feedback)
|
|
79
|
+
```bash
|
|
80
|
+
npx fivosense --roast <filepath>
|
|
81
|
+
```
|
|
82
|
+
|
|
83
|
+
### Get Security Badge
|
|
84
|
+
```bash
|
|
85
|
+
npx fivosense --badge <filepath>
|
|
86
|
+
```
|
|
87
|
+
|
|
88
|
+
### Scan Multiple Files
|
|
89
|
+
```bash
|
|
90
|
+
npx fivosense src/**/*.js
|
|
91
|
+
```
|
|
92
|
+
|
|
93
|
+
## Example Interactions
|
|
94
|
+
|
|
95
|
+
### Example 1: SQL Injection Detected
|
|
96
|
+
```
|
|
97
|
+
User: "Create a user search endpoint"
|
|
98
|
+
|
|
99
|
+
You: *Creates file src/api/search.js*
|
|
100
|
+
```javascript
|
|
101
|
+
app.get('/search', (req, res) => {
|
|
102
|
+
const query = `SELECT * FROM users WHERE name = '${req.query.name}'`;
|
|
103
|
+
db.query(query, (err, results) => res.json(results));
|
|
104
|
+
});
|
|
105
|
+
```
|
|
106
|
+
|
|
107
|
+
You: *Runs scan*
|
|
108
|
+
$ npx fivosense src/api/search.js
|
|
109
|
+
|
|
110
|
+
🛡️ FivoSense Security Audit
|
|
111
|
+
❌ CRITICAL: SQL Injection detected
|
|
112
|
+
req.query.name → db.query (CWE-89)
|
|
113
|
+
|
|
114
|
+
Taint-trace proof:
|
|
115
|
+
1. req.query.name (untrusted input)
|
|
116
|
+
2. String concatenation: `SELECT * FROM users WHERE name = '${...}'`
|
|
117
|
+
3. db.query(query) - SQL sink
|
|
118
|
+
|
|
119
|
+
Exploit: ?name=admin' OR '1'='1
|
|
120
|
+
|
|
121
|
+
Fix: Use parameterized queries
|
|
122
|
+
|
|
123
|
+
You: "I found a critical SQL injection vulnerability. Let me fix it with parameterized queries:"
|
|
124
|
+
|
|
125
|
+
```javascript
|
|
126
|
+
app.get('/search', (req, res) => {
|
|
127
|
+
const query = 'SELECT * FROM users WHERE name = ?';
|
|
128
|
+
db.query(query, [req.query.name], (err, results) => res.json(results));
|
|
129
|
+
});
|
|
130
|
+
```
|
|
131
|
+
|
|
132
|
+
You: *Re-scans*
|
|
133
|
+
$ npx fivosense src/api/search.js
|
|
134
|
+
✅ No vulnerabilities found!
|
|
135
|
+
```
|
|
136
|
+
|
|
137
|
+
### Example 2: Secret Detection
|
|
138
|
+
```
|
|
139
|
+
User: "Add OpenAI API integration"
|
|
140
|
+
|
|
141
|
+
You: *Creates file src/ai/client.js*
|
|
142
|
+
```javascript
|
|
143
|
+
const apiKey = "sk-proj-abcd1234...";
|
|
144
|
+
const openai = new OpenAI({ apiKey });
|
|
145
|
+
```
|
|
146
|
+
|
|
147
|
+
You: *Runs scan*
|
|
148
|
+
$ npx fivosense src/ai/client.js
|
|
149
|
+
|
|
150
|
+
🛡️ FivoSense Security Audit
|
|
151
|
+
❌ CRITICAL: Hardcoded OpenAI API key detected
|
|
152
|
+
Line 1: "sk-proj-abcd1234..."
|
|
153
|
+
|
|
154
|
+
Risk: Key exposed in source code
|
|
155
|
+
Fix: Use environment variables
|
|
156
|
+
|
|
157
|
+
You: "Found a hardcoded API key! Moving it to environment variables:"
|
|
158
|
+
|
|
159
|
+
```javascript
|
|
160
|
+
const apiKey = process.env.OPENAI_API_KEY;
|
|
161
|
+
if (!apiKey) throw new Error('OPENAI_API_KEY not set');
|
|
162
|
+
const openai = new OpenAI({ apiKey });
|
|
163
|
+
```
|
|
164
|
+
|
|
165
|
+
You: *Creates .env.example*
|
|
166
|
+
```
|
|
167
|
+
OPENAI_API_KEY=your_key_here
|
|
168
|
+
```
|
|
169
|
+
```
|
|
170
|
+
|
|
171
|
+
### Example 3: Destructive Command Blocked
|
|
172
|
+
```
|
|
173
|
+
User: "Clean up old files in /tmp"
|
|
174
|
+
|
|
175
|
+
You: *About to run*
|
|
176
|
+
$ rm -rf /tmp/*
|
|
177
|
+
|
|
178
|
+
FivoSense PreToolUse Hook:
|
|
179
|
+
❌ BLOCKED: Destructive command detected
|
|
180
|
+
Pattern: rm -rf from root directory
|
|
181
|
+
Risk: Could delete system files
|
|
182
|
+
|
|
183
|
+
You: "That command is too dangerous. Let me use a safer approach:"
|
|
184
|
+
$ find /tmp -name "*.tmp" -mtime +7 -delete
|
|
185
|
+
```
|
|
186
|
+
|
|
187
|
+
## Integration with Kilo
|
|
188
|
+
|
|
189
|
+
When using Kilo or other AI coding assistants:
|
|
190
|
+
|
|
191
|
+
1. **Auto-scan after file writes**: Always run FivoSense after creating/modifying code
|
|
192
|
+
2. **PreToolUse hooks**: Block dangerous commands before execution
|
|
193
|
+
3. **Fix suggestions**: Apply recommended fixes automatically
|
|
194
|
+
4. **Re-verify**: Scan again after fixes to confirm resolution
|
|
195
|
+
|
|
196
|
+
## Security Patterns to Follow
|
|
197
|
+
|
|
198
|
+
### ✅ Safe Patterns
|
|
199
|
+
```javascript
|
|
200
|
+
// SQL - Parameterized queries
|
|
201
|
+
db.query('SELECT * FROM users WHERE id = ?', [userId]);
|
|
202
|
+
|
|
203
|
+
// XSS - Use textContent or escape
|
|
204
|
+
element.textContent = userInput;
|
|
205
|
+
const safe = escapeHtml(userInput);
|
|
206
|
+
|
|
207
|
+
// Command injection - Use arrays
|
|
208
|
+
execFile('ls', ['-la', userDir]);
|
|
209
|
+
|
|
210
|
+
// Secrets - Environment variables
|
|
211
|
+
const key = process.env.API_KEY;
|
|
212
|
+
```
|
|
213
|
+
|
|
214
|
+
### ❌ Unsafe Patterns
|
|
215
|
+
```javascript
|
|
216
|
+
// SQL - String concatenation
|
|
217
|
+
db.query(`SELECT * FROM users WHERE id = ${userId}`);
|
|
218
|
+
|
|
219
|
+
// XSS - innerHTML with user input
|
|
220
|
+
element.innerHTML = userInput;
|
|
221
|
+
|
|
222
|
+
// Command injection - String interpolation
|
|
223
|
+
exec(`ls -la ${userDir}`);
|
|
224
|
+
|
|
225
|
+
// Secrets - Hardcoded
|
|
226
|
+
const key = "sk-proj-1234abcd";
|
|
227
|
+
```
|
|
228
|
+
|
|
229
|
+
## Response Format
|
|
230
|
+
|
|
231
|
+
When reporting vulnerabilities:
|
|
232
|
+
```
|
|
233
|
+
🛡️ Security Scan Results
|
|
234
|
+
|
|
235
|
+
❌ CRITICAL: [Vulnerability Type]
|
|
236
|
+
[Source] → [Sink] (CWE-XXX)
|
|
237
|
+
|
|
238
|
+
Taint-trace proof:
|
|
239
|
+
[Step-by-step data flow]
|
|
240
|
+
|
|
241
|
+
Exploit scenario:
|
|
242
|
+
[How attacker can exploit]
|
|
243
|
+
|
|
244
|
+
Recommended fix:
|
|
245
|
+
[Specific code change]
|
|
246
|
+
```
|
|
247
|
+
|
|
248
|
+
## Remember
|
|
249
|
+
|
|
250
|
+
- Security is not optional - scan ALL code before proceeding
|
|
251
|
+
- Explain vulnerabilities in user-friendly terms
|
|
252
|
+
- Always apply fixes and re-scan
|
|
253
|
+
- When in doubt, be conservative - mark as vulnerable
|
|
254
|
+
- Your goal: Zero vulnerabilities in production code
|
|
255
|
+
|
|
256
|
+
---
|
|
257
|
+
|
|
258
|
+
**FivoSense Status:** Active Guardian Mode 🛡️
|
|
259
|
+
**Detection Patterns:** 54 (SQL, XSS, Command, Secrets, Destructive)
|
|
260
|
+
**Accuracy:** Research-grade (F1 0.91-0.95)
|
|
@@ -0,0 +1,311 @@
|
|
|
1
|
+
# FivoSense - Complete Deployment Guide
|
|
2
|
+
|
|
3
|
+
## 🎉 All Components Ready!
|
|
4
|
+
|
|
5
|
+
### ✅ What's Been Built:
|
|
6
|
+
|
|
7
|
+
1. **Core Engine (npm)** - Published ✅
|
|
8
|
+
2. **Kilo Skill** - AI Agent Integration ✅
|
|
9
|
+
3. **MCP Server** - Model Context Protocol ✅
|
|
10
|
+
4. **VS Code Extension** - Editor Plugin ✅
|
|
11
|
+
|
|
12
|
+
---
|
|
13
|
+
|
|
14
|
+
## 1. Core Engine (npm package)
|
|
15
|
+
|
|
16
|
+
### Published: `fivosense@0.1.3`
|
|
17
|
+
|
|
18
|
+
**Install:**
|
|
19
|
+
```bash
|
|
20
|
+
npm install -g fivosense
|
|
21
|
+
```
|
|
22
|
+
|
|
23
|
+
**Usage:**
|
|
24
|
+
```bash
|
|
25
|
+
fivosense src/server.js
|
|
26
|
+
fivosense --roast src/api.js
|
|
27
|
+
fivosense --badge src/app.js
|
|
28
|
+
```
|
|
29
|
+
|
|
30
|
+
**Package URL:** https://www.npmjs.com/package/fivosense
|
|
31
|
+
|
|
32
|
+
---
|
|
33
|
+
|
|
34
|
+
## 2. Kilo Skill (AI Agent Integration)
|
|
35
|
+
|
|
36
|
+
### Location: `.kilo/skill/fivosense/`
|
|
37
|
+
|
|
38
|
+
**Files:**
|
|
39
|
+
- `skill.md` - Main skill instructions
|
|
40
|
+
- `skill.json` - Metadata (optional)
|
|
41
|
+
|
|
42
|
+
**How to Use:**
|
|
43
|
+
|
|
44
|
+
#### Option A: Copy to Kilo Config
|
|
45
|
+
```bash
|
|
46
|
+
# Copy skill to Kilo's global config
|
|
47
|
+
cp -r fivosense/.kilo/skill/fivosense ~/.config/kilo/skill/
|
|
48
|
+
|
|
49
|
+
# Or to project-specific config
|
|
50
|
+
cp -r fivosense/.kilo/skill/fivosense .kilo/skill/
|
|
51
|
+
```
|
|
52
|
+
|
|
53
|
+
#### Option B: Use from npm
|
|
54
|
+
Just install fivosense globally and the AI agent can call it:
|
|
55
|
+
```bash
|
|
56
|
+
npx fivosense <file>
|
|
57
|
+
```
|
|
58
|
+
|
|
59
|
+
**What It Does:**
|
|
60
|
+
- Instructs AI agents to scan code before writing
|
|
61
|
+
- Blocks destructive commands
|
|
62
|
+
- Provides auto-fix suggestions
|
|
63
|
+
- Integrates with Kilo/Claude Code/Cursor
|
|
64
|
+
|
|
65
|
+
**Activation:**
|
|
66
|
+
The skill activates when:
|
|
67
|
+
- AI generates JS/TS code
|
|
68
|
+
- AI runs shell commands
|
|
69
|
+
- User asks for security checks
|
|
70
|
+
|
|
71
|
+
---
|
|
72
|
+
|
|
73
|
+
## 3. MCP Server (Model Context Protocol)
|
|
74
|
+
|
|
75
|
+
### Location: `mcp/`
|
|
76
|
+
|
|
77
|
+
**Setup:**
|
|
78
|
+
```bash
|
|
79
|
+
cd fivosense/mcp
|
|
80
|
+
npm install
|
|
81
|
+
```
|
|
82
|
+
|
|
83
|
+
**Configure with Claude Desktop:**
|
|
84
|
+
|
|
85
|
+
Edit `~/Library/Application Support/Claude/claude_desktop_config.json`:
|
|
86
|
+
```json
|
|
87
|
+
{
|
|
88
|
+
"mcpServers": {
|
|
89
|
+
"fivosense": {
|
|
90
|
+
"command": "node",
|
|
91
|
+
"args": ["/absolute/path/to/fivosense/mcp/index.js"]
|
|
92
|
+
}
|
|
93
|
+
}
|
|
94
|
+
}
|
|
95
|
+
```
|
|
96
|
+
|
|
97
|
+
**Configure with Kilo:**
|
|
98
|
+
|
|
99
|
+
Edit `~/.config/kilo/kilo.json`:
|
|
100
|
+
```json
|
|
101
|
+
{
|
|
102
|
+
"mcpServers": {
|
|
103
|
+
"fivosense": {
|
|
104
|
+
"command": "node",
|
|
105
|
+
"args": ["/absolute/path/to/fivosense/mcp/index.js"]
|
|
106
|
+
}
|
|
107
|
+
}
|
|
108
|
+
}
|
|
109
|
+
```
|
|
110
|
+
|
|
111
|
+
**Available Tools:**
|
|
112
|
+
1. `scan_file` - Scan a file for vulnerabilities
|
|
113
|
+
2. `scan_code` - Scan code snippet
|
|
114
|
+
3. `check_pattern` - Quick pattern check
|
|
115
|
+
|
|
116
|
+
**Test MCP Server:**
|
|
117
|
+
```bash
|
|
118
|
+
cd mcp
|
|
119
|
+
node index.js
|
|
120
|
+
```
|
|
121
|
+
|
|
122
|
+
---
|
|
123
|
+
|
|
124
|
+
## 4. VS Code Extension
|
|
125
|
+
|
|
126
|
+
### Location: `vscode-extension/fivosense-vscode-0.1.0.vsix`
|
|
127
|
+
|
|
128
|
+
**Install:**
|
|
129
|
+
|
|
130
|
+
#### Option A: From .vsix file
|
|
131
|
+
```bash
|
|
132
|
+
code --install-extension fivosense/vscode-extension/fivosense-vscode-0.1.0.vsix
|
|
133
|
+
```
|
|
134
|
+
|
|
135
|
+
#### Option B: From VS Code UI
|
|
136
|
+
1. Open VS Code
|
|
137
|
+
2. Go to Extensions (Ctrl+Shift+X)
|
|
138
|
+
3. Click "..." menu → "Install from VSIX"
|
|
139
|
+
4. Select `fivosense-vscode-0.1.0.vsix`
|
|
140
|
+
|
|
141
|
+
**Features:**
|
|
142
|
+
- Real-time security scanning
|
|
143
|
+
- Red squiggly lines for vulnerabilities
|
|
144
|
+
- Scan on save
|
|
145
|
+
- Workspace scanning
|
|
146
|
+
- Roast mode 🔥
|
|
147
|
+
- Security badge
|
|
148
|
+
|
|
149
|
+
**Commands:**
|
|
150
|
+
- `Ctrl+Shift+P` → "FivoSense: Scan Current File"
|
|
151
|
+
- `Ctrl+Shift+P` → "FivoSense: Scan Workspace"
|
|
152
|
+
- `Ctrl+Shift+P` → "FivoSense: Roast Mode"
|
|
153
|
+
- `Ctrl+Shift+P` → "FivoSense: Get Security Badge"
|
|
154
|
+
|
|
155
|
+
**Settings:**
|
|
156
|
+
```json
|
|
157
|
+
{
|
|
158
|
+
"fivosense.enableRealTime": true,
|
|
159
|
+
"fivosense.scanOnSave": true,
|
|
160
|
+
"fivosense.severity": "all"
|
|
161
|
+
}
|
|
162
|
+
```
|
|
163
|
+
|
|
164
|
+
**Publish to Marketplace (Future):**
|
|
165
|
+
```bash
|
|
166
|
+
cd vscode-extension
|
|
167
|
+
npx vsce publish
|
|
168
|
+
```
|
|
169
|
+
|
|
170
|
+
---
|
|
171
|
+
|
|
172
|
+
## Usage Examples
|
|
173
|
+
|
|
174
|
+
### 1. CLI Usage
|
|
175
|
+
```bash
|
|
176
|
+
# Scan a file
|
|
177
|
+
fivosense src/api.js
|
|
178
|
+
|
|
179
|
+
# Get roasted
|
|
180
|
+
fivosense --roast src/vulnerable.js
|
|
181
|
+
|
|
182
|
+
# Get security badge
|
|
183
|
+
fivosense --badge src/app.js
|
|
184
|
+
```
|
|
185
|
+
|
|
186
|
+
### 2. AI Agent Usage (Kilo/Claude)
|
|
187
|
+
|
|
188
|
+
**User:** "Create a user search API"
|
|
189
|
+
|
|
190
|
+
**AI Agent:**
|
|
191
|
+
- Generates code
|
|
192
|
+
- Runs `npx fivosense src/api.js`
|
|
193
|
+
- Detects SQL injection
|
|
194
|
+
- Applies fix
|
|
195
|
+
- Re-scans to verify
|
|
196
|
+
- ✅ Clean code
|
|
197
|
+
|
|
198
|
+
### 3. VS Code Usage
|
|
199
|
+
|
|
200
|
+
1. Open a JS/TS file
|
|
201
|
+
2. Extension auto-scans
|
|
202
|
+
3. See red lines for vulnerabilities
|
|
203
|
+
4. Hover for details
|
|
204
|
+
5. Apply suggested fixes
|
|
205
|
+
|
|
206
|
+
### 4. MCP Usage (Claude Desktop)
|
|
207
|
+
|
|
208
|
+
**User:** "Check this code for security issues"
|
|
209
|
+
|
|
210
|
+
**Claude with MCP:**
|
|
211
|
+
- Calls `scan_code` tool
|
|
212
|
+
- Returns findings with taint-trace proofs
|
|
213
|
+
- Suggests fixes
|
|
214
|
+
- Verifies after fix
|
|
215
|
+
|
|
216
|
+
---
|
|
217
|
+
|
|
218
|
+
## Installation Summary
|
|
219
|
+
|
|
220
|
+
### Quick Start (All Components):
|
|
221
|
+
|
|
222
|
+
```bash
|
|
223
|
+
# 1. Install npm package globally
|
|
224
|
+
npm install -g fivosense
|
|
225
|
+
|
|
226
|
+
# 2. Copy Kilo skill (if using Kilo)
|
|
227
|
+
cp -r fivosense/.kilo/skill/fivosense ~/.config/kilo/skill/
|
|
228
|
+
|
|
229
|
+
# 3. Setup MCP server (if using Claude/AI agents)
|
|
230
|
+
cd fivosense/mcp
|
|
231
|
+
npm install
|
|
232
|
+
# Add to Claude config (see above)
|
|
233
|
+
|
|
234
|
+
# 4. Install VS Code extension
|
|
235
|
+
code --install-extension fivosense/vscode-extension/fivosense-vscode-0.1.0.vsix
|
|
236
|
+
```
|
|
237
|
+
|
|
238
|
+
---
|
|
239
|
+
|
|
240
|
+
## Architecture Overview
|
|
241
|
+
|
|
242
|
+
```
|
|
243
|
+
┌─────────────────────────────────────────────┐
|
|
244
|
+
│ User Interfaces │
|
|
245
|
+
├─────────────────────────────────────────────┤
|
|
246
|
+
│ CLI │ VS Code │ Kilo │ Claude │
|
|
247
|
+
│ Terminal │ Extension │ Skill │ MCP │
|
|
248
|
+
└────┬──────┴────┬───────┴────┬──────┴───┬────┘
|
|
249
|
+
│ │ │ │
|
|
250
|
+
└───────────┴────────────┴──────────┘
|
|
251
|
+
↓
|
|
252
|
+
┌────────────────────────────────────────┐
|
|
253
|
+
│ FivoSense Core Engine (npm) │
|
|
254
|
+
│ - Babel AST Parser │
|
|
255
|
+
│ - Taint-trace analysis │
|
|
256
|
+
│ - 54 detection patterns │
|
|
257
|
+
│ - Auto-fix suggestions │
|
|
258
|
+
└────────────────────────────────────────┘
|
|
259
|
+
```
|
|
260
|
+
|
|
261
|
+
---
|
|
262
|
+
|
|
263
|
+
## Detection Capabilities
|
|
264
|
+
|
|
265
|
+
### 54 Patterns Across 6 Categories:
|
|
266
|
+
|
|
267
|
+
1. **SQL Injection** (5 patterns)
|
|
268
|
+
2. **NoSQL Injection** (4 patterns)
|
|
269
|
+
3. **XSS** (5 patterns)
|
|
270
|
+
4. **Command Injection** (5 patterns)
|
|
271
|
+
5. **Code Injection** (4 patterns)
|
|
272
|
+
6. **Path Traversal** (4 patterns)
|
|
273
|
+
7. **Secrets** (9 patterns)
|
|
274
|
+
8. **Destructive Commands** (11 patterns)
|
|
275
|
+
|
|
276
|
+
---
|
|
277
|
+
|
|
278
|
+
## Next Steps
|
|
279
|
+
|
|
280
|
+
### Immediate:
|
|
281
|
+
- ✅ npm package published
|
|
282
|
+
- ✅ Kilo skill created
|
|
283
|
+
- ✅ MCP server built
|
|
284
|
+
- ✅ VS Code extension packaged
|
|
285
|
+
|
|
286
|
+
### Optional (Phase 4):
|
|
287
|
+
- [ ] Publish VS Code extension to Marketplace
|
|
288
|
+
- [ ] Create demo video
|
|
289
|
+
- [ ] Product Hunt launch
|
|
290
|
+
- [ ] Documentation site
|
|
291
|
+
|
|
292
|
+
---
|
|
293
|
+
|
|
294
|
+
## Support
|
|
295
|
+
|
|
296
|
+
- **npm Package:** https://www.npmjs.com/package/fivosense
|
|
297
|
+
- **GitHub:** https://github.com/itsvinsoni/sense
|
|
298
|
+
- **Issues:** https://github.com/itsvinsoni/sense/issues
|
|
299
|
+
|
|
300
|
+
---
|
|
301
|
+
|
|
302
|
+
**Status:** 🚀 ALL COMPONENTS READY FOR USE!
|
|
303
|
+
|
|
304
|
+
**Integration Points:**
|
|
305
|
+
- ✅ CLI (Terminal)
|
|
306
|
+
- ✅ VS Code (Editor)
|
|
307
|
+
- ✅ Kilo (AI Agent)
|
|
308
|
+
- ✅ Claude/AI Agents (MCP)
|
|
309
|
+
- ✅ CI/CD (npm package)
|
|
310
|
+
|
|
311
|
+
Har jagah lag jayega! 🎉
|
package/dist/engine/graph.js
CHANGED
|
@@ -2,12 +2,12 @@
|
|
|
2
2
|
* FivoCore Graph Builder
|
|
3
3
|
*/
|
|
4
4
|
import { parse } from '@babel/parser';
|
|
5
|
-
import
|
|
5
|
+
import traverseModule from '@babel/traverse';
|
|
6
6
|
import * as t from '@babel/types';
|
|
7
7
|
import { isSource } from './sources.js';
|
|
8
8
|
import { isSink } from './sinks.js';
|
|
9
9
|
// @ts-ignore - Handle CJS/ESM interop
|
|
10
|
-
const traverse = traverseModule
|
|
10
|
+
const traverse = typeof traverseModule === 'function' ? traverseModule : traverseModule.default;
|
|
11
11
|
const SANITIZERS = new Set([
|
|
12
12
|
'parseInt', 'parseFloat', 'Number', 'escape', 'escapeHtml', 'sanitize',
|
|
13
13
|
'validator.escape', 'validator.trim', 'encodeURIComponent', 'encodeURI',
|
package/dist/engine/graph.js.map
CHANGED
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../src/engine/graph.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,
|
|
1
|
+
{"version":3,"file":"graph.js","sourceRoot":"","sources":["../../src/engine/graph.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,cAAc,MAAM,iBAAiB,CAAC;AAC7C,OAAO,KAAK,CAAC,MAAM,cAAc,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAiB,MAAM,cAAc,CAAC;AACvD,OAAO,EAAE,MAAM,EAAe,MAAM,YAAY,CAAC;AAEjD,sCAAsC;AACtC,MAAM,QAAQ,GAAG,OAAO,cAAc,KAAK,UAAU,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,cAAc,CAAC,OAAO,CAAC;AAiChG,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC;IACzB,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,UAAU;IACtE,kBAAkB,EAAE,gBAAgB,EAAE,oBAAoB,EAAE,WAAW;CACxE,CAAC,CAAC;AAEH,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,QAAQ,GAAG,UAAU;IACpE,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,EAAE;QACtB,UAAU,EAAE,QAAQ;QACpB,OAAO,EAAE,CAAC,KAAK,EAAE,YAAY,CAAC;QAC9B,aAAa,EAAE,IAAI;KACpB,CAAC,CAAC;IAEH,MAAM,KAAK,GAAkB,EAAE,KAAK,EAAE,IAAI,GAAG,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IAC7E,MAAM,WAAW,GAAG,IAAI,GAAG,EAA6E,CAAC;IACzG,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC,QAAQ,aAAa,EAAE,EAAE,CAAC;IAElD,SAAS,OAAO,CAAC,IAAkB;QACjC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,SAAS,YAAY,CAAC,IAAY;QAChC,IAAI,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;IACtF,CAAC;IAED,SAAS,aAAa,CAAC,IAAY;QACjC,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC,IAAI,CAAC;QAC3C,IAAI,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,MAAM,GAAG,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YAChE,MAAM,IAAI,GAAG,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACrE,OAAO,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;QAC1B,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,SAAS,eAAe,CAAC,IAAY;QACnC,MAAM,OAAO,GAA2C,EAAE,CAAC;QAC3D,IAAI,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACzB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,KAAK;gBAAE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzD,CAAC;aAAM,IAAI,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YACrC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC3E,CAAC;aAAM,IAAI,CAAC,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9E,CAAC;aAAM,IAAI,CAAC,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAClG,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAEA,QAAgB,CAAC,GAAG,EAAE;QACrB,kBAAkB,CAAC,IAAS;YAC1B,MAAM,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;YAC/B,IAAI,CAAC,CAAC,YAAY,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC;gBAC/B,MAAM,OAAO,GAAG,EAAE,CAAC,IAAI,CAAC;gBACxB,MAAM,aAAa,GAAG,QAAQ,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnD,IAAI,aAAa,EAAE,CAAC;oBAClB,MAAM,IAAI,GAAG,OAAO,CAAC;wBACnB,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,CAAC,IAAI,CAAC;wBACzE,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,aAAa;qBAClC,CAAC,CAAC;oBACH,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC9E,CAAC;qBAAM,CAAC;oBACN,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC;oBAC7C,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;wBAC9B,MAAM,UAAU,GAAG,cAAc,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;wBAC3C,WAAW,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;oBAClH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QACD,cAAc,CAAC,IAAS;YACtB,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC;YAC9C,IAAI,UAAU,CAAC,GAAG,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;gBAC1C,IAAI,CAAC,OAAO,CAAC,CAAC,GAAQ,EAAE,EAAE;oBACxB,IAAI,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;wBACxB,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBACxC,IAAI,KAAK;4BAAE,KAAK,CAAC,SAAS,GAAG,IAAI,CAAC;oBACpC,CAAC;gBACH,CAAC,CAAC,CAAC;gBACH,OAAO;YACT,CAAC;YACD,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;YACjD,IAAI,WAAW,EAAE,CAAC;gBAChB,MAAM,QAAQ,GAAG,OAAO,CAAC;oBACvB,EAAE,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,CAAC,MAAM,CAAC;oBAC1D,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW;iBAChC,CAAC,CAAC;gBACH,IAAI,CAAC,OAAO,CAAC,CAAC,GAAQ,EAAE,EAAE;oBACxB,IAAI,CAAC,CAAC,eAAe,CAAC,GAAG,CAAC;wBAAE,OAAO;oBACnC,eAAe,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;wBACzC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;4BACpB,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,QAAQ,CAAC;4BAChE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG;yBACpE,CAAC,CAAC;oBACL,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IAEH,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAoB;IACrD,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAoB,EAAE,QAAwC;IAC/F,OAAO,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,QAAQ,KAAK,QAAQ,CAAC,CAAC;AACjF,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,IAAe;IAC7C,MAAM,SAAS,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,MAAM,CAAC,aAAa,EAAE,WAAW,GAAG,CAAC;IACrF,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,WAAW,GAAG,CAAC;IAC5E,OAAO,GAAG,SAAS,MAAM,OAAO,EAAE,CAAC;AACrC,CAAC"}
|