free-pi-cli 0.4.10 → 0.5.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (26) hide show
  1. package/dist/{index-xkn61g24.js → index-2s8fh2p0.js} +338 -403
  2. package/dist/index-n5qs9pq1.js +49 -0
  3. package/dist/index.js +4 -1
  4. package/dist/main-ha56pd31.js +24354 -0
  5. package/package.json +1 -1
  6. package/skills/security-audit/AI-AND-LLM.md +83 -0
  7. package/skills/security-audit/ATTACK-CLASSES.md +130 -0
  8. package/skills/security-audit/CLIENT-SIDE.md +83 -0
  9. package/skills/security-audit/CLOUD-AND-DEPLOYMENT.md +86 -0
  10. package/skills/security-audit/DATA-ISOLATION-AND-LIFECYCLE.md +84 -0
  11. package/skills/security-audit/DESKTOP-MOBILE-AND-LOCAL-IPC.md +89 -0
  12. package/skills/security-audit/HUNTING.md +172 -0
  13. package/skills/security-audit/LICENSE +21 -0
  14. package/skills/security-audit/MEMORY-SAFETY-AND-BINARY.md +101 -0
  15. package/skills/security-audit/PROTOCOLS-RPC-AND-MESSAGING.md +81 -0
  16. package/skills/security-audit/RECONNAISSANCE.md +140 -0
  17. package/skills/security-audit/RESOURCE-EXHAUSTION-AND-AVAILABILITY.md +78 -0
  18. package/skills/security-audit/SKILL.md +152 -0
  19. package/skills/security-audit/SUPPLY-CHAIN-AND-RELEASE.md +73 -0
  20. package/skills/security-audit/UPSTREAM.md +1 -0
  21. package/skills/security-audit/VALIDATION-AND-REPORTING.md +141 -0
  22. package/skills/security-audit/WEB-PROTOCOL-AND-AUTH.md +105 -0
  23. package/skills/security-audit/report-schema.json +461 -0
  24. package/skills/security-audit/validate-coverage-ledger.cjs +872 -0
  25. package/skills/security-audit/validate-findings.cjs +773 -0
  26. package/dist/main-m7w02sv8.js +0 -8280
package/skills/security-audit/report-schema.json ADDED
@@ -0,0 +1,461 @@
1
+ {
2
+ "$comment": "Top-level contract for findings.json. validate-findings.cjs interprets and checks this schema directly.",
3
+ "type": "array",
4
+ "items": {
5
+ "oneOf": [
6
+ {
7
+ "type": "object",
8
+ "description": "A source-grounded vulnerability that was independently demonstrated.",
9
+ "properties": {
10
+ "verdict": {
11
+ "type": "string",
12
+ "const": "confirmed"
13
+ },
14
+ "fingerprint": {
15
+ "type": "string",
16
+ "minLength": 1,
17
+ "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$",
18
+ "description": "A stable source-derived identifier that does not change between validation states."
19
+ },
20
+ "title": {
21
+ "type": "string",
22
+ "minLength": 1,
23
+ "visibleContent": true
24
+ },
25
+ "description": {
26
+ "type": "string",
27
+ "minLength": 1,
28
+ "visibleContent": true
29
+ },
30
+ "root_cause": {
31
+ "type": "string",
32
+ "minLength": 1,
33
+ "visibleContent": true
34
+ },
35
+ "intended_behavior": {
36
+ "type": "string",
37
+ "minLength": 1,
38
+ "visibleContent": true
39
+ },
40
+ "trace": {
41
+ "type": "array",
42
+ "minItems": 1,
43
+ "uniqueItems": true,
44
+ "items": {
45
+ "type": "object",
46
+ "properties": {
47
+ "kind": {
48
+ "type": "string",
49
+ "enum": ["entrypoint", "propagation", "sink"]
50
+ },
51
+ "file": {
52
+ "type": "string",
53
+ "minLength": 1
54
+ },
55
+ "line": {
56
+ "type": "integer",
57
+ "minimum": 1
58
+ },
59
+ "scope": {
60
+ "type": "string",
61
+ "minLength": 1,
62
+ "visibleContent": true
63
+ },
64
+ "description": {
65
+ "type": "string",
66
+ "minLength": 1,
67
+ "visibleContent": true
68
+ }
69
+ },
70
+ "required": ["kind", "file", "line", "scope", "description"],
71
+ "additionalProperties": false
72
+ }
73
+ },
74
+ "evidence": {
75
+ "type": "array",
76
+ "minItems": 1,
77
+ "uniqueItems": true,
78
+ "items": {
79
+ "type": "object",
80
+ "properties": {
81
+ "file": {
82
+ "type": "string",
83
+ "minLength": 1
84
+ },
85
+ "line": {
86
+ "type": "integer",
87
+ "minimum": 1
88
+ },
89
+ "description": {
90
+ "type": "string",
91
+ "minLength": 1,
92
+ "visibleContent": true
93
+ }
94
+ },
95
+ "required": ["file", "line", "description"],
96
+ "additionalProperties": false
97
+ }
98
+ },
99
+ "conditions": {
100
+ "type": "array",
101
+ "uniqueItems": true,
102
+ "items": {
103
+ "type": "object",
104
+ "properties": {
105
+ "kind": {
106
+ "type": "string",
107
+ "enum": ["authentication_level", "authorization_role", "user_interaction", "system_configuration", "network_routing", "environmental_dependency", "data_state", "timing_dependency", "third_party_dependency"]
108
+ },
109
+ "description": {
110
+ "type": "string",
111
+ "minLength": 1,
112
+ "visibleContent": true
113
+ }
114
+ },
115
+ "required": ["kind", "description"],
116
+ "additionalProperties": false
117
+ }
118
+ },
119
+ "execution": {
120
+ "type": "object",
121
+ "description": "Target-neutral reproduction in the target's native interface.",
122
+ "properties": {
123
+ "attacker_perspective": {
124
+ "type": "string",
125
+ "minLength": 1,
126
+ "visibleContent": true
127
+ },
128
+ "payloads": {
129
+ "type": "array",
130
+ "minItems": 1,
131
+ "uniqueItems": true,
132
+ "items": {
133
+ "type": "string"
134
+ }
135
+ },
136
+ "instructions": {
137
+ "type": "array",
138
+ "minItems": 1,
139
+ "items": {
140
+ "type": "string",
141
+ "minLength": 1,
142
+ "visibleContent": true
143
+ }
144
+ },
145
+ "observed_result": {
146
+ "type": "string",
147
+ "minLength": 1,
148
+ "visibleContent": true
149
+ }
150
+ },
151
+ "required": ["attacker_perspective", "payloads", "instructions", "observed_result"],
152
+ "additionalProperties": false
153
+ },
154
+ "remediation": {
155
+ "type": "object",
156
+ "properties": {
157
+ "strategy": {
158
+ "type": "string",
159
+ "minLength": 1,
160
+ "visibleContent": true
161
+ },
162
+ "code_changes": {
163
+ "type": "array",
164
+ "items": {
165
+ "type": "object",
166
+ "properties": {
167
+ "file_name": {
168
+ "type": "string",
169
+ "minLength": 1
170
+ },
171
+ "fixed_code": {
172
+ "type": "string"
173
+ }
174
+ },
175
+ "required": ["file_name", "fixed_code"],
176
+ "additionalProperties": false
177
+ }
178
+ }
179
+ },
180
+ "required": ["strategy"],
181
+ "additionalProperties": false
182
+ },
183
+ "severity": {
184
+ "type": "object",
185
+ "properties": {
186
+ "likelihood": {
187
+ "type": "object",
188
+ "properties": {
189
+ "score": {
190
+ "type": "string",
191
+ "enum": ["informational", "low", "medium", "high", "critical"]
192
+ },
193
+ "reason": {
194
+ "type": "string",
195
+ "minLength": 1,
196
+ "visibleContent": true
197
+ }
198
+ },
199
+ "required": ["score", "reason"],
200
+ "additionalProperties": false
201
+ },
202
+ "impact": {
203
+ "type": "object",
204
+ "properties": {
205
+ "score": {
206
+ "type": "string",
207
+ "enum": ["informational", "low", "medium", "high", "critical"]
208
+ },
209
+ "reason": {
210
+ "type": "string",
211
+ "minLength": 1,
212
+ "visibleContent": true
213
+ }
214
+ },
215
+ "required": ["score", "reason"],
216
+ "additionalProperties": false
217
+ },
218
+ "overall_severity": {
219
+ "type": "string",
220
+ "enum": ["informational", "low", "medium", "high", "critical"]
221
+ }
222
+ },
223
+ "required": ["likelihood", "impact", "overall_severity"],
224
+ "additionalProperties": false
225
+ },
226
+ "confidence": {
227
+ "type": "object",
228
+ "properties": {
229
+ "score": {
230
+ "type": "string",
231
+ "enum": ["low", "medium", "high"]
232
+ },
233
+ "reason": {
234
+ "type": "string",
235
+ "minLength": 1,
236
+ "visibleContent": true
237
+ }
238
+ },
239
+ "required": ["score", "reason"],
240
+ "additionalProperties": false
241
+ }
242
+ },
243
+ "required": ["verdict", "fingerprint", "title", "description", "root_cause", "intended_behavior", "trace", "evidence", "conditions", "execution", "remediation", "severity", "confidence"],
244
+ "additionalProperties": false
245
+ },
246
+ {
247
+ "type": "object",
248
+ "description": "A source-grounded candidate whose decisive validation is blocked.",
249
+ "properties": {
250
+ "verdict": {
251
+ "type": "string",
252
+ "const": "needs_validation"
253
+ },
254
+ "fingerprint": {
255
+ "type": "string",
256
+ "minLength": 1,
257
+ "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$"
258
+ },
259
+ "title": {
260
+ "type": "string",
261
+ "minLength": 1,
262
+ "visibleContent": true
263
+ },
264
+ "description": {
265
+ "type": "string",
266
+ "minLength": 1,
267
+ "visibleContent": true
268
+ },
269
+ "claimed_root_cause": {
270
+ "type": "string",
271
+ "minLength": 1,
272
+ "visibleContent": true
273
+ },
274
+ "trace": {
275
+ "type": "array",
276
+ "minItems": 1,
277
+ "uniqueItems": true,
278
+ "items": {
279
+ "type": "object",
280
+ "properties": {
281
+ "kind": {
282
+ "type": "string",
283
+ "enum": ["entrypoint", "propagation", "sink"]
284
+ },
285
+ "file": {
286
+ "type": "string",
287
+ "minLength": 1
288
+ },
289
+ "line": {
290
+ "type": "integer",
291
+ "minimum": 1
292
+ },
293
+ "scope": {
294
+ "type": "string",
295
+ "minLength": 1,
296
+ "visibleContent": true
297
+ },
298
+ "description": {
299
+ "type": "string",
300
+ "minLength": 1,
301
+ "visibleContent": true
302
+ }
303
+ },
304
+ "required": ["kind", "file", "line", "scope", "description"],
305
+ "additionalProperties": false
306
+ }
307
+ },
308
+ "evidence": {
309
+ "type": "array",
310
+ "minItems": 1,
311
+ "uniqueItems": true,
312
+ "items": {
313
+ "type": "object",
314
+ "properties": {
315
+ "file": {
316
+ "type": "string",
317
+ "minLength": 1
318
+ },
319
+ "line": {
320
+ "type": "integer",
321
+ "minimum": 1
322
+ },
323
+ "description": {
324
+ "type": "string",
325
+ "minLength": 1,
326
+ "visibleContent": true
327
+ }
328
+ },
329
+ "required": ["file", "line", "description"],
330
+ "additionalProperties": false
331
+ }
332
+ },
333
+ "blockers": {
334
+ "type": "array",
335
+ "minItems": 1,
336
+ "uniqueItems": true,
337
+ "items": {
338
+ "type": "string",
339
+ "minLength": 1,
340
+ "visibleContent": true
341
+ }
342
+ },
343
+ "validation_plan": {
344
+ "type": "object",
345
+ "properties": {
346
+ "local": {
347
+ "type": "string",
348
+ "minLength": 1,
349
+ "visibleContent": true
350
+ },
351
+ "deployment": {
352
+ "type": "string",
353
+ "minLength": 1,
354
+ "visibleContent": true
355
+ }
356
+ },
357
+ "additionalProperties": false
358
+ }
359
+ },
360
+ "required": ["verdict", "fingerprint", "title", "description", "claimed_root_cause", "trace", "evidence", "blockers", "validation_plan"],
361
+ "additionalProperties": false
362
+ },
363
+ {
364
+ "type": "object",
365
+ "description": "A source-grounded candidate refuted during validation.",
366
+ "properties": {
367
+ "verdict": {
368
+ "type": "string",
369
+ "const": "rejected"
370
+ },
371
+ "fingerprint": {
372
+ "type": "string",
373
+ "minLength": 1,
374
+ "pattern": "^[A-Za-z0-9][A-Za-z0-9._:/@+-]*$"
375
+ },
376
+ "title": {
377
+ "type": "string",
378
+ "minLength": 1,
379
+ "visibleContent": true
380
+ },
381
+ "description": {
382
+ "type": "string",
383
+ "minLength": 1,
384
+ "visibleContent": true
385
+ },
386
+ "claimed_root_cause": {
387
+ "type": "string",
388
+ "minLength": 1,
389
+ "visibleContent": true
390
+ },
391
+ "trace": {
392
+ "type": "array",
393
+ "minItems": 1,
394
+ "uniqueItems": true,
395
+ "items": {
396
+ "type": "object",
397
+ "properties": {
398
+ "kind": {
399
+ "type": "string",
400
+ "enum": ["entrypoint", "propagation", "sink"]
401
+ },
402
+ "file": {
403
+ "type": "string",
404
+ "minLength": 1
405
+ },
406
+ "line": {
407
+ "type": "integer",
408
+ "minimum": 1
409
+ },
410
+ "scope": {
411
+ "type": "string",
412
+ "minLength": 1,
413
+ "visibleContent": true
414
+ },
415
+ "description": {
416
+ "type": "string",
417
+ "minLength": 1,
418
+ "visibleContent": true
419
+ }
420
+ },
421
+ "required": ["kind", "file", "line", "scope", "description"],
422
+ "additionalProperties": false
423
+ }
424
+ },
425
+ "evidence": {
426
+ "type": "array",
427
+ "minItems": 1,
428
+ "uniqueItems": true,
429
+ "items": {
430
+ "type": "object",
431
+ "properties": {
432
+ "file": {
433
+ "type": "string",
434
+ "minLength": 1
435
+ },
436
+ "line": {
437
+ "type": "integer",
438
+ "minimum": 1
439
+ },
440
+ "description": {
441
+ "type": "string",
442
+ "minLength": 1,
443
+ "visibleContent": true
444
+ }
445
+ },
446
+ "required": ["file", "line", "description"],
447
+ "additionalProperties": false
448
+ }
449
+ },
450
+ "reason": {
451
+ "type": "string",
452
+ "minLength": 1,
453
+ "visibleContent": true
454
+ }
455
+ },
456
+ "required": ["verdict", "fingerprint", "title", "description", "claimed_root_cause", "trace", "evidence", "reason"],
457
+ "additionalProperties": false
458
+ }
459
+ ]
460
+ }
461
+ }