guard-scanner 2.1.0 → 3.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (55) hide show
  1. package/README.md +39 -35
  2. package/dist/__tests__/scanner.test.d.ts +10 -0
  3. package/dist/__tests__/scanner.test.d.ts.map +1 -0
  4. package/dist/__tests__/scanner.test.js +374 -0
  5. package/dist/__tests__/scanner.test.js.map +1 -0
  6. package/dist/cli.d.ts +10 -0
  7. package/dist/cli.d.ts.map +1 -0
  8. package/dist/cli.js +189 -0
  9. package/dist/cli.js.map +1 -0
  10. package/dist/index.d.ts +10 -0
  11. package/dist/index.d.ts.map +1 -0
  12. package/dist/index.js +18 -0
  13. package/dist/index.js.map +1 -0
  14. package/dist/ioc-db.d.ts +13 -0
  15. package/dist/ioc-db.d.ts.map +1 -0
  16. package/dist/ioc-db.js +130 -0
  17. package/dist/ioc-db.js.map +1 -0
  18. package/dist/patterns.d.ts +27 -0
  19. package/dist/patterns.d.ts.map +1 -0
  20. package/dist/patterns.js +92 -0
  21. package/dist/patterns.js.map +1 -0
  22. package/dist/quarantine.d.ts +18 -0
  23. package/dist/quarantine.d.ts.map +1 -0
  24. package/dist/quarantine.js +42 -0
  25. package/dist/quarantine.js.map +1 -0
  26. package/dist/scanner.d.ts +54 -0
  27. package/dist/scanner.d.ts.map +1 -0
  28. package/dist/scanner.js +1043 -0
  29. package/dist/scanner.js.map +1 -0
  30. package/dist/types.d.ts +165 -0
  31. package/dist/types.d.ts.map +1 -0
  32. package/dist/types.js +7 -0
  33. package/dist/types.js.map +1 -0
  34. package/hooks/guard-scanner/plugin.ts +59 -32
  35. package/openclaw.plugin.json +60 -0
  36. package/package.json +25 -9
  37. package/ts-src/__tests__/fixtures/clean-skill/SKILL.md +9 -0
  38. package/ts-src/__tests__/fixtures/compaction-skill/SKILL.md +11 -0
  39. package/ts-src/__tests__/fixtures/malicious-skill/SKILL.md +11 -0
  40. package/ts-src/__tests__/fixtures/malicious-skill/scripts/evil.js +25 -0
  41. package/ts-src/__tests__/fixtures/prompt-leakage-skill/SKILL.md +20 -0
  42. package/ts-src/__tests__/fixtures/prompt-leakage-skill/scripts/debug.js +4 -0
  43. package/ts-src/__tests__/scanner.test.ts +525 -0
  44. package/ts-src/cli.ts +171 -0
  45. package/ts-src/index.ts +15 -0
  46. package/ts-src/ioc-db.ts +131 -0
  47. package/ts-src/patterns.ts +104 -0
  48. package/ts-src/quarantine.ts +48 -0
  49. package/{src/scanner.js → ts-src/scanner.ts} +372 -385
  50. package/ts-src/types.ts +187 -0
  51. package/hooks/guard-scanner/handler.ts +0 -207
  52. package/src/cli.js +0 -149
  53. package/src/html-template.js +0 -239
  54. package/src/ioc-db.js +0 -54
  55. package/src/patterns.js +0 -212
@@ -0,0 +1,54 @@
1
+ /**
2
+ * guard-scanner v3.0.0 — Core Scanner (TypeScript)
3
+ *
4
+ * Full TypeScript rewrite of guard-scanner v2.1.0 + hbg-scan features.
5
+ * Adds: Compaction Persistence check, Signature hash matching, typed interfaces.
6
+ *
7
+ * Zero dependencies. MIT License.
8
+ */
9
+ import type { SkillResult, ScannerOptions, ScanStats, Thresholds, JSONReport, SARIFReport } from './types.js';
10
+ export declare const VERSION = "3.0.0";
11
+ export declare class GuardScanner {
12
+ readonly verbose: boolean;
13
+ readonly selfExclude: boolean;
14
+ readonly strict: boolean;
15
+ readonly summaryOnly: boolean;
16
+ readonly checkDeps: boolean;
17
+ readonly thresholds: Thresholds;
18
+ findings: SkillResult[];
19
+ stats: ScanStats;
20
+ private scannerDir;
21
+ private ignoredSkills;
22
+ private ignoredPatterns;
23
+ private customRules;
24
+ constructor(options?: ScannerOptions);
25
+ loadPlugin(pluginPath: string): void;
26
+ loadCustomRules(rulesFile: string): void;
27
+ private loadIgnoreFile;
28
+ scanDirectory(dir: string): SkillResult[];
29
+ scanSkill(skillPath: string, skillName: string): void;
30
+ private classifyFile;
31
+ private checkIoCs;
32
+ private checkPatterns;
33
+ /** NEW: hbg-scan compatible signature matching (hash + pattern + domain) */
34
+ private checkSignatures;
35
+ /** NEW: Compaction Layer Persistence check (hbg-scan Check 5) */
36
+ private checkCompactionPersistence;
37
+ private checkHardcodedSecrets;
38
+ private shannonEntropy;
39
+ private checkStructure;
40
+ private checkDependencies;
41
+ private checkSkillManifest;
42
+ private checkComplexity;
43
+ private checkConfigImpact;
44
+ private checkHiddenFiles;
45
+ private checkJSDataFlow;
46
+ private checkCrossFile;
47
+ private calculateRisk;
48
+ private getVerdict;
49
+ private getFiles;
50
+ printSummary(): void;
51
+ toJSON(): JSONReport;
52
+ toSARIF(scanDir: string): SARIFReport;
53
+ }
54
+ //# sourceMappingURL=scanner.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../ts-src/scanner.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,OAAO,KAAK,EACW,WAAW,EAC9B,cAAc,EAAE,SAAS,EAAE,UAAU,EACrC,UAAU,EAAkB,WAAW,EAE1C,MAAM,YAAY,CAAC;AAOpB,eAAO,MAAM,OAAO,UAAU,CAAC;AA4B/B,qBAAa,YAAY;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,UAAU,CAAC;IAEhC,QAAQ,EAAE,WAAW,EAAE,CAAM;IAC7B,KAAK,EAAE,SAAS,CAAiE;IAEjF,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,aAAa,CAAqB;IAC1C,OAAO,CAAC,eAAe,CAAqB;IAC5C,OAAO,CAAC,WAAW,CAAqB;gBAE5B,OAAO,GAAE,cAAmB;IAqBxC,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IAmBpC,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI;IAuCxC,OAAO,CAAC,cAAc;IA0BtB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,WAAW,EAAE;IAyCzC,SAAS,CAAC,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IA2FrD,OAAO,CAAC,YAAY;IASpB,OAAO,CAAC,SAAS;IA+BjB,OAAO,CAAC,aAAa;IA+BrB,4EAA4E;IAC5E,OAAO,CAAC,eAAe;IA8CvB,iEAAiE;IACjE,OAAO,CAAC,0BAA0B;IA8ClC,OAAO,CAAC,qBAAqB;IA0B7B,OAAO,CAAC,cAAc;IAYtB,OAAO,CAAC,cAAc;IAmBtB,OAAO,CAAC,iBAAiB;IAuCzB,OAAO,CAAC,kBAAkB;IAqD1B,OAAO,CAAC,eAAe;IAwCvB,OAAO,CAAC,iBAAiB;IAqCzB,OAAO,CAAC,gBAAgB;IAoBxB,OAAO,CAAC,eAAe;IAsDvB,OAAO,CAAC,cAAc;IA6CtB,OAAO,CAAC,aAAa;IA4CrB,OAAO,CAAC,UAAU;IASlB,OAAO,CAAC,QAAQ;IAoBhB,YAAY,IAAI,IAAI;IAuBpB,MAAM,IAAI,UAAU;IAqCpB,OAAO,CAAC,OAAO,EAAE,MAAM,GAAG,WAAW;CAwDxC"}