guard-scanner 2.1.0 → 3.2.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (55) hide show
  1. package/README.md +39 -35
  2. package/dist/__tests__/scanner.test.d.ts +10 -0
  3. package/dist/__tests__/scanner.test.d.ts.map +1 -0
  4. package/dist/__tests__/scanner.test.js +443 -0
  5. package/dist/__tests__/scanner.test.js.map +1 -0
  6. package/dist/cli.d.ts +10 -0
  7. package/dist/cli.d.ts.map +1 -0
  8. package/dist/cli.js +210 -0
  9. package/dist/cli.js.map +1 -0
  10. package/dist/index.d.ts +10 -0
  11. package/dist/index.d.ts.map +1 -0
  12. package/dist/index.js +18 -0
  13. package/dist/index.js.map +1 -0
  14. package/dist/ioc-db.d.ts +13 -0
  15. package/dist/ioc-db.d.ts.map +1 -0
  16. package/dist/ioc-db.js +130 -0
  17. package/dist/ioc-db.js.map +1 -0
  18. package/dist/patterns.d.ts +27 -0
  19. package/dist/patterns.d.ts.map +1 -0
  20. package/dist/patterns.js +92 -0
  21. package/dist/patterns.js.map +1 -0
  22. package/dist/quarantine.d.ts +18 -0
  23. package/dist/quarantine.d.ts.map +1 -0
  24. package/dist/quarantine.js +42 -0
  25. package/dist/quarantine.js.map +1 -0
  26. package/dist/scanner.d.ts +56 -0
  27. package/dist/scanner.d.ts.map +1 -0
  28. package/dist/scanner.js +1049 -0
  29. package/dist/scanner.js.map +1 -0
  30. package/dist/types.d.ts +167 -0
  31. package/dist/types.d.ts.map +1 -0
  32. package/dist/types.js +7 -0
  33. package/dist/types.js.map +1 -0
  34. package/hooks/guard-scanner/plugin.ts +59 -32
  35. package/openclaw.plugin.json +60 -0
  36. package/package.json +25 -9
  37. package/ts-src/__tests__/fixtures/clean-skill/SKILL.md +9 -0
  38. package/ts-src/__tests__/fixtures/compaction-skill/SKILL.md +11 -0
  39. package/ts-src/__tests__/fixtures/malicious-skill/SKILL.md +11 -0
  40. package/ts-src/__tests__/fixtures/malicious-skill/scripts/evil.js +25 -0
  41. package/ts-src/__tests__/fixtures/prompt-leakage-skill/SKILL.md +20 -0
  42. package/ts-src/__tests__/fixtures/prompt-leakage-skill/scripts/debug.js +4 -0
  43. package/ts-src/__tests__/scanner.test.ts +609 -0
  44. package/ts-src/cli.ts +190 -0
  45. package/ts-src/index.ts +15 -0
  46. package/ts-src/ioc-db.ts +131 -0
  47. package/ts-src/patterns.ts +104 -0
  48. package/ts-src/quarantine.ts +48 -0
  49. package/{src/scanner.js → ts-src/scanner.ts} +386 -394
  50. package/ts-src/types.ts +189 -0
  51. package/hooks/guard-scanner/handler.ts +0 -207
  52. package/src/cli.js +0 -149
  53. package/src/html-template.js +0 -239
  54. package/src/ioc-db.js +0 -54
  55. package/src/patterns.js +0 -212
@@ -0,0 +1 @@
1
+ {"version":3,"file":"scanner.test.js","sourceRoot":"","sources":["../../ts-src/__tests__/scanner.test.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,yCAAiD;AACjD,2DAA6C;AAC7C,gDAAkC;AAElC,8CAAsD;AAGtD,+EAA+E;AAC/E,yEAAyE;AACzE,kEAAkE;AAElE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;AAC7E,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;AAC3D,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,iBAAiB,CAAC,CAAC;AACnE,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,kBAAkB,CAAC,CAAC;AAErE,+EAA+E;AAE/E,SAAS,eAAe,CAAC,SAAiB,EAAE,SAAiB;IAKzD,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,SAAS,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAExC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IACnC,OAAO;QACH,QAAQ,EAAE,MAAM,EAAE,QAAQ,IAAI,EAAE;QAChC,IAAI,EAAE,MAAM,EAAE,IAAI,IAAI,CAAC;QACvB,OAAO,EAAE,MAAM,EAAE,OAAO,IAAI,OAAO;KACtC,CAAC;AACN,CAAC;AAED,iFAAiF;AAEjF,SAAS,eAAe,CAAC,QAAmB,EAAE,EAAU;IACpD,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,aAAa,CAAC,QAAmB,EAAE,GAAW;IACnD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,GAAG,CAAC,CAAC;AACjD,CAAC;AAED,iFAAiF;AACjF,aAAa;AACb,iFAAiF;AAEjF,IAAA,oBAAQ,EAAC,sBAAsB,EAAE,GAAG,EAAE;IAElC,2EAA2E;IAE3E,IAAA,cAAE,EAAC,8BAA8B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,KAAK,CAAC,oBAAO,EAAE,OAAO,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAE3E,IAAA,oBAAQ,EAAC,WAAW,EAAE,GAAG,EAAE;QACvB,IAAA,cAAE,EAAC,iCAAiC,EAAE,GAAG,EAAE;YACvC,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACnE,MAAM,CAAC,EAAE,CACL,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAC1C,+CAA+C,CAClD,CAAC;YACF,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,KAAK,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC9C,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,iCAAiC,EAAE,GAAG,EAAE;YACvC,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACnE,MAAM,CAAC,EAAE,CACL,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC,EAC9C,mCAAmC,CACtC,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,yCAAyC,EAAE,GAAG,EAAE;YAC/C,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,EAAE,SAAS,CAAC,CAAC;YACvD,MAAM,CAAC,EAAE,CACL,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EACnD,wCAAwC,CAC3C,CAAC;YACF,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,iBAAiB,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,EAAE,UAAU,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,yEAAyE;IAEzE,IAAA,oBAAQ,EAAC,eAAe,EAAE,GAAG,EAAE;QAC3B,IAAA,cAAE,EAAC,gDAAgD,EAAE,GAAG,EAAE;YACtD,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACnE,MAAM,CAAC,EAAE,CACL,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,eAAe,CAAC,EACjD,iDAAiD,CACpD,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,6BAA6B,EAAE,GAAG,EAAE;YACnC,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACnE,MAAM,CAAC,EAAE,CACL,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,EAC5C,4BAA4B,CAC/B,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,8CAA8C,EAAE,GAAG,EAAE;YACpD,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACnE,MAAM,CAAC,EAAE,CACL,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,mBAAmB,CAAC;gBACrD,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAClD,sCAAsC,CACzC,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,yEAAyE;IAEzE,IAAA,oBAAQ,EAAC,iBAAiB,EAAE,GAAG,EAAE;QAC7B,IAAA,cAAE,EAAC,4CAA4C,EAAE,GAAG,EAAE;YAClD,MAAM,MAAM,GAAG,eAAe,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;YACrE,MAAM,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC7C,CAAC,CAAC,EAAE,CAAC,UAAU,CAAC,aAAa,CAAC,CACjC,CAAC;YACF,MAAM,CAAC,EAAE,CACL,WAAW,CAAC,MAAM,GAAG,CAAC,EACtB,qDAAqD,CACxD,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,2CAA2C,EAAE,GAAG,EAAE;YACjD,0EAA0E;YAC1E,sEAAsE;YACtE,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACnE,iEAAiE;YACjE,wCAAwC;YACxC,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,aAAa,CAAC,CAAC;YACrE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,qDAAqD,CAAC,CAAC;QAC1F,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,0EAA0E;IAE1E,IAAA,oBAAQ,EAAC,4BAA4B,EAAE,GAAG,EAAE;QACxC,IAAA,cAAE,EAAC,mCAAmC,EAAE,GAAG,EAAE;YACzC,MAAM,MAAM,GAAG,eAAe,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;YACrE,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;YAC5E,MAAM,WAAW,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACtC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,eAAe,CAAC,CACnC,CAAC;YACF,MAAM,CAAC,EAAE,CAAC,WAAW,EAAE,oCAAoC,CAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,qCAAqC,EAAE,GAAG,EAAE;YAC3C,MAAM,MAAM,GAAG,eAAe,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;YACrE,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,QAAQ,EAAE,wBAAwB,CAAC,CAAC;YAC5E,MAAM,YAAY,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAClC,CAAC;YACF,MAAM,CAAC,EAAE,CAAC,YAAY,EAAE,sCAAsC,CAAC,CAAC;QACpE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,yEAAyE;IAEzE,IAAA,oBAAQ,EAAC,uBAAuB,EAAE,GAAG,EAAE;QACnC,IAAA,cAAE,EAAC,mCAAmC,EAAE,GAAG,EAAE;YACzC,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACnE,MAAM,CAAC,EAAE,CACL,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAClD,6DAA6D,CAChE,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,uCAAuC,EAAE,GAAG,EAAE;YAC7C,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC3D,MAAM,CAAC,EAAE,CACL,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EACnD,0CAA0C,CAC7C,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,yEAAyE;IAEzE,IAAA,oBAAQ,EAAC,iBAAiB,EAAE,GAAG,EAAE;QAC7B,IAAA,cAAE,EAAC,wCAAwC,EAAE,GAAG,EAAE;YAC9C,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACnE,MAAM,CAAC,EAAE,CACL,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EACnD,0DAA0D,CAC7D,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,+DAA+D,EAAE,GAAG,EAAE;YACrE,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACnE,MAAM,CAAC,EAAE,CACL,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,oBAAoB,CAAC,EACtD,6CAA6C,CAChD,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,yEAAyE;IAEzE,IAAA,oBAAQ,EAAC,eAAe,EAAE,GAAG,EAAE;QAC3B,IAAA,cAAE,EAAC,2BAA2B,EAAE,GAAG,EAAE;YACjC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,mCAAmC,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,kCAAkC,EAAE,GAAG,EAAE;YACxC,kDAAkD;YAClD,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,WAAW,GAAc;gBAC3B,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE;aAClF,CAAC;YACF,2CAA2C;YAC3C,MAAM,IAAI,GAAI,OAAe,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC;YACzD,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,EAAE,mCAAmC,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,oDAAoD,EAAE,GAAG,EAAE;YAC1D,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAc;gBACxB,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,iBAAiB,EAAE,GAAG,EAAE,qBAAqB,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE;gBACnG,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE;aAC9F,CAAC;YACF,MAAM,IAAI,GAAI,OAAe,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACtD,kBAAkB;YAClB,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,yCAAyC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,0CAA0C,EAAE,GAAG,EAAE;YAChD,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,QAAQ,GAAc;gBACxB,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,wBAAwB,EAAE,GAAG,EAAE,wBAAwB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;gBAC/G,EAAE,QAAQ,EAAE,UAAU,EAAE,EAAE,EAAE,eAAe,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE;aACnG,CAAC;YACF,MAAM,IAAI,GAAI,OAAe,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC;YACtD,MAAM,CAAC,EAAE,CAAC,IAAI,IAAI,EAAE,EAAE,uCAAuC,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,yEAAyE;IAEzE,IAAA,oBAAQ,EAAC,YAAY,EAAE,GAAG,EAAE;QACxB,IAAA,cAAE,EAAC,qBAAqB,EAAE,GAAG,EAAE;YAC3B,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,OAAO,GAAI,OAAe,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;YAC/C,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QACzC,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,wCAAwC,EAAE,GAAG,EAAE;YAC9C,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,MAAM,OAAO,GAAI,OAAe,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;YAChD,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,WAAW,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,yEAAyE;IAEzE,IAAA,oBAAQ,EAAC,wBAAwB,EAAE,GAAG,EAAE;QACpC,IAAA,cAAE,EAAC,uCAAuC,EAAE,GAAG,EAAE;YAC7C,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,EAAE,kBAAkB,CAAC,CAAC;YAChE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,sCAAsC,CAAC,CAAC;YAC9E,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,oCAAoC,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,+CAA+C,EAAE,GAAG,EAAE;YACrD,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,8CAA8C,CAAC,CAAC;YAC1F,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,IAAI,EAAE,EAAE,2BAA2B,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,yEAAyE;IAEzE,IAAA,oBAAQ,EAAC,mBAAmB,EAAE,GAAG,EAAE;QAC/B,IAAA,cAAE,EAAC,6CAA6C,EAAE,GAAG,EAAE;YACnD,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAEhC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,kBAAkB,oBAAO,EAAE,CAAC,CAAC;YAC1D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;YACpC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;YAC5B,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;YAC3B,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,yCAAyC,EAAE,GAAG,EAAE;YAC/C,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAEvC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACrC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,EAAE,+CAA+C,CAAC,CAAC;YAC7E,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;YACnC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC3D,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,2BAA2B,CAAC,CAAC;QAC7E,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,wEAAwE;IAExE,IAAA,oBAAQ,EAAC,oBAAoB,EAAE,GAAG,EAAE;QAChC,IAAA,cAAE,EAAC,mDAAmD,EAAE,GAAG,EAAE;YACzD,+CAA+C;YAC/C,+DAA+D;YAC/D,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC/C,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YACtD,MAAM,CAAC,KAAK,CACR,OAAO,CAAC,MAAM,EAAE,CAAC,EACjB,GAAG,OAAO,CAAC,MAAM,oCAAoC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAClG,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,yCAAyC,EAAE,GAAG,EAAE;YAC/C,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;YACvH,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACjF,MAAM,CAAC,KAAK,CACR,OAAO,CAAC,MAAM,EAAE,CAAC,EACjB,yBAAyB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtF,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,6CAA6C,EAAE,GAAG,EAAE;YACnD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC;YAC7E,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,uCAAuC,CAAC,CAAC;YAC1E,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,CACR,YAAY,CAAC,MAAM,EAAE,CAAC,EACtB,kDAAkD,YAAY,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpG,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,6CAA6C,EAAE,GAAG,EAAE;YACnD,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAAC;YAC/C,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,kBAAkB,CAAC,CAAC;YAC7E,MAAM,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,uCAAuC,CAAC,CAAC;YAC1E,MAAM,YAAY,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAC,CAAC;YACxE,MAAM,CAAC,KAAK,CACR,YAAY,CAAC,MAAM,EAAE,CAAC,EACtB,kDAAkD,YAAY,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACpG,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,wEAAwE;IAExE,IAAA,oBAAQ,EAAC,8BAA8B,EAAE,GAAG,EAAE;QAC1C,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAC3B,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,EACtE,sBAAsB,CACzB,CAAC;QAEF,IAAA,cAAE,EAAC,kDAAkD,EAAE,GAAG,EAAE;YACxD,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;YACtE,MAAM,CAAC,EAAE,CACL,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC,EACnD,0CAA0C,CAC7C,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,gDAAgD,EAAE,GAAG,EAAE;YACtD,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;YACtE,MAAM,CAAC,EAAE,CACL,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,kBAAkB,CAAC,EACpD,uCAAuC,CAC1C,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,2CAA2C,EAAE,GAAG,EAAE;YACjD,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;YACtE,MAAM,CAAC,EAAE,CACL,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAClD,uCAAuC,CAC1C,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,uCAAuC,EAAE,GAAG,EAAE;YAC7C,MAAM,MAAM,GAAG,eAAe,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC;YACtE,MAAM,CAAC,EAAE,CACL,eAAe,CAAC,MAAM,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAClD,4DAA4D,CAC/D,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,iEAAiE,EAAE,GAAG,EAAE;YACvE,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC3D,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,GAAG,KAAK,uBAAuB,CACpC,CAAC;YACF,MAAM,CAAC,KAAK,CACR,KAAK,CAAC,MAAM,EAAE,CAAC,EACf,iDAAiD,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACtG,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,yEAAyE;IAEzE,IAAA,oBAAQ,EAAC,2BAA2B,EAAE,GAAG,EAAE;QACvC,IAAA,cAAE,EAAC,4DAA4D,EAAE,GAAG,EAAE;YAClE,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACnE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;YAC1C,MAAM,CAAC,EAAE,CACL,MAAM,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,EAC5B,6DAA6D,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CACxF,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,4DAA4D,EAAE,GAAG,EAAE;YAClE,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,0CAA0C,CAAC,CAAC;YACpF,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,EAAE,8BAA8B,CAAC,CAAC;YAC7D,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,oCAAoC,EAAE,GAAG,EAAE;YAC1C,MAAM,MAAM,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACvD,MAAM,MAAM,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,oCAAoC;YACpC,MAAM,CAAC,EAAE,CACJ,MAAc,CAAC,UAAU,CAAC,UAAU,GAAI,MAAc,CAAC,UAAU,CAAC,UAAU,EAC7E,yDAAyD,CAC5D,CAAC;YACF,MAAM,CAAC,EAAE,CACJ,MAAc,CAAC,UAAU,CAAC,SAAS,GAAI,MAAc,CAAC,UAAU,CAAC,SAAS,EAC3E,wDAAwD,CAC3D,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,kDAAkD,EAAE,GAAG,EAAE;YACxD,MAAM,MAAM,GAAG,eAAe,CAC1B,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,CAAC,EAAE,sBAAsB,CAAC,EACzG,sBAAsB,CACzB,CAAC;YACF,MAAM,CAAC,EAAE,CACL,MAAM,CAAC,OAAO,KAAK,YAAY,IAAI,MAAM,CAAC,OAAO,KAAK,WAAW,EACjE,+DAA+D,MAAM,CAAC,OAAO,WAAW,MAAM,CAAC,IAAI,GAAG,CACzG,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,wEAAwE;IAExE,IAAA,oBAAQ,EAAC,kBAAkB,EAAE,GAAG,EAAE;QAC9B,IAAA,cAAE,EAAC,kEAAkE,EAAE,GAAG,EAAE;YACxE,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAEvC,MAAM,cAAc,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CACzD,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAC5E,CAAC;YACF,MAAM,CAAC,EAAE,CACL,cAAc,CAAC,MAAM,GAAG,CAAC,EACzB,iDAAiD,CACpD,CAAC;QACN,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,2CAA2C,EAAE,GAAG,EAAE;YACjD,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAEvC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjD,MAAM,SAAS,GAAI,IAAY,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,CAClD,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CACxC,CAAC;gBACF,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;oBAC1B,MAAM,CAAC,KAAK,CACR,GAAG,EAAE,2BAA2B,EAChC,6BAA6B,GAAG,YAAY,IAAI,CAAC,EAAE,EAAE,CACxD,CAAC;gBACN,CAAC;YACL,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,6CAA6C,EAAE,GAAG,EAAE;YACnD,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YAEvC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAC/C,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CACvC,CAAC;YACF,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,gCAAgC,CAAC,CAAC;YACpD,MAAM,CAAC,EAAE,CACJ,MAAc,CAAC,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC,EACvD,mDAAoD,MAAc,CAAC,UAAU,CAAC,IAAI,EAAE,CACvF,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,yEAAyE;IAEzE,IAAA,oBAAQ,EAAC,8BAA8B,EAAE,GAAG,EAAE;QAC1C,IAAA,cAAE,EAAC,oEAAoE,EAAE,GAAG,EAAE;YAC1E,MAAM,MAAM,GAAG,eAAe,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAC;YACrE,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CACvC,CAAC,CAAC,GAAG,KAAK,uBAAuB,CACpC,CAAC;YACF,MAAM,CAAC,KAAK,CACR,KAAK,CAAC,MAAM,EAAE,CAAC,EACf,sDAAsD,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3G,CAAC;QACN,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,uEAAuE;IAEvE,IAAA,oBAAQ,EAAC,oBAAoB,EAAE,GAAG,EAAE;QAChC,IAAA,cAAE,EAAC,gEAAgE,EAAE,GAAG,EAAE;YACtE,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;YAC5B,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAEpC,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC;YAEtB,oEAAoE;YACpE,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,mDAAmD,IAAI,CAAC,MAAM,WAAW,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1I,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,gDAAgD,EAAE,GAAG,EAAE;YACtD,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YAEpC,MAAM,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,2CAA2C,CAAC,CAAC;YACpF,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,iBAAiB,CAAC,CAAC;YAC5E,MAAM,CAAC,EAAE,CAAC,SAAS,EAAE,2CAA2C,CAAC,CAAC;YAClE,MAAM,CAAC,EAAE,CAAC,SAAU,CAAC,QAAQ,CAAC,MAAM,IAAI,EAAE,EAAE,0CAA0C,CAAC,CAAC;QAC5F,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;IAEH,IAAA,oBAAQ,EAAC,8BAA8B,EAAE,GAAG,EAAE;QAC1C,IAAA,cAAE,EAAC,mDAAmD,EAAE,GAAG,EAAE;YACzD,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACtD,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YAEvC,oBAAoB;YACpB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,kBAAkB,oBAAO,EAAE,CAAC,CAAC;YAC1D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,qCAAqC,CAAC,CAAC;YAC7E,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,EAAE,oCAAoC,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,8EAA8E,EAAE,GAAG,EAAE;YACpF,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,OAAO,CAAC,SAAS,CAAC,eAAe,EAAE,iBAAiB,CAAC,CAAC;YACtD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;YACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;YACvC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YAEpC,uCAAuC;YACvC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YACtC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,EAAE,+CAA+C,CAAC,CAAC;YAC9E,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,2BAA2B,CAAC,CAAC;YACjE,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,eAAe,CAAC,CAAC;YAC/D,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,mBAAmB,CAAC,CAAC;YAC5E,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,qBAAqB,CAAC,CAAC;YACpE,4CAA4C;YAC5C,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;gBAC1C,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,8BAA8B,CAAC,CAAC;gBACzD,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,CAAC,EAAE,iCAAiC,CAAC,CAAC;YAC/E,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,IAAA,cAAE,EAAC,4DAA4D,EAAE,GAAG,EAAE;YAClE,MAAM,IAAI,GAAa,EAAE,CAAC;YAC1B,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC;YAC5B,OAAO,CAAC,GAAG,GAAG,CAAC,GAAG,IAAW,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;YAE5D,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACrE,OAAO,CAAC,aAAa,CAAC,YAAY,CAAC,CAAC;YACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;YAEhD,OAAO,CAAC,GAAG,GAAG,OAAO,CAAC;YAEtB,2BAA2B;YAC3B,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,8CAA8C,CAAC,CAAC;YAC7E,gBAAgB;YAChB,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;YACnC,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,IAAI,CAAC,EAAE,8BAA8B,MAAM,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;YAC3F,MAAM,CAAC,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,sCAAsC,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;IACP,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}
package/dist/cli.d.ts ADDED
@@ -0,0 +1,10 @@
1
+ #!/usr/bin/env node
2
+ /**
3
+ * guard-scanner v3.0.0 — CLI (TypeScript)
4
+ *
5
+ * Usage:
6
+ * guard-scanner [scan-dir] [options] Scan all skills in directory
7
+ * guard-scanner install-check <skill-path> Pre-install security check
8
+ */
9
+ export {};
10
+ //# sourceMappingURL=cli.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../ts-src/cli.ts"],"names":[],"mappings":";AACA;;;;;;GAMG"}
package/dist/cli.js ADDED
@@ -0,0 +1,210 @@
1
+ #!/usr/bin/env node
2
+ "use strict";
3
+ /**
4
+ * guard-scanner v3.0.0 — CLI (TypeScript)
5
+ *
6
+ * Usage:
7
+ * guard-scanner [scan-dir] [options] Scan all skills in directory
8
+ * guard-scanner install-check <skill-path> Pre-install security check
9
+ */
10
+ var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
11
+ if (k2 === undefined) k2 = k;
12
+ var desc = Object.getOwnPropertyDescriptor(m, k);
13
+ if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
14
+ desc = { enumerable: true, get: function() { return m[k]; } };
15
+ }
16
+ Object.defineProperty(o, k2, desc);
17
+ }) : (function(o, m, k, k2) {
18
+ if (k2 === undefined) k2 = k;
19
+ o[k2] = m[k];
20
+ }));
21
+ var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
22
+ Object.defineProperty(o, "default", { enumerable: true, value: v });
23
+ }) : function(o, v) {
24
+ o["default"] = v;
25
+ });
26
+ var __importStar = (this && this.__importStar) || (function () {
27
+ var ownKeys = function(o) {
28
+ ownKeys = Object.getOwnPropertyNames || function (o) {
29
+ var ar = [];
30
+ for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
31
+ return ar;
32
+ };
33
+ return ownKeys(o);
34
+ };
35
+ return function (mod) {
36
+ if (mod && mod.__esModule) return mod;
37
+ var result = {};
38
+ if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
39
+ __setModuleDefault(result, mod);
40
+ return result;
41
+ };
42
+ })();
43
+ Object.defineProperty(exports, "__esModule", { value: true });
44
+ const fs = __importStar(require("fs"));
45
+ const path = __importStar(require("path"));
46
+ const scanner_js_1 = require("./scanner.js");
47
+ const patterns_js_1 = require("./patterns.js");
48
+ const args = process.argv.slice(2);
49
+ if (args.includes('--help') || args.includes('-h')) {
50
+ console.log(`
51
+ 🛡️ guard-scanner v${scanner_js_1.VERSION} — Agent Skill Security Scanner (TypeScript)
52
+
53
+ Usage: guard-scanner [scan-dir] [options]
54
+
55
+ Options:
56
+ --verbose, -v Detailed findings with categories and samples
57
+ --json Write JSON report to file
58
+ --sarif Write SARIF report to file (GitHub Code Scanning / CI/CD)
59
+ --format json|sarif Print JSON or SARIF to stdout (pipeable, v3.2.0)
60
+ --quiet Suppress all text output (use with --format for clean pipes)
61
+ --self-exclude Skip scanning the guard-scanner skill itself
62
+ --strict Lower detection thresholds (more sensitive)
63
+ --summary-only Only print the summary table
64
+ --check-deps Scan package.json for dependency chain risks
65
+ --rules <file> Load custom rules from JSON file
66
+ --plugin <file> Load plugin module
67
+ --fail-on-findings Exit code 1 if any findings (CI/CD)
68
+ --help, -h Show this help
69
+
70
+ New in v3.0.0:
71
+ • TypeScript rewrite with full type safety
72
+ • Compaction Layer Persistence detection (Feb 20 2026 attack vector)
73
+ • Threat signature hash matching (hbg-scan compatible)
74
+ • 7 built-in threat signatures (SIG-001 to SIG-007)
75
+ • Enhanced risk scoring for compaction-persistence category
76
+
77
+ Examples:
78
+ guard-scanner ./skills/ --verbose --self-exclude
79
+ guard-scanner ./skills/ --strict --json --sarif --check-deps
80
+ guard-scanner ./skills/ --fail-on-findings
81
+ `);
82
+ process.exit(0);
83
+ }
84
+ // ── install-check subcommand ─────────────────────────────────────────────
85
+ if (args[0] === 'install-check') {
86
+ const skillPath = args[1];
87
+ if (!skillPath) {
88
+ console.error('❌ Usage: guard-scanner install-check <skill-path>');
89
+ process.exit(2);
90
+ }
91
+ const absPath = path.resolve(skillPath);
92
+ if (!fs.existsSync(absPath)) {
93
+ console.error(`❌ Skill path not found: ${absPath}`);
94
+ process.exit(2);
95
+ }
96
+ const icStrict = args.includes('--strict');
97
+ const icJson = args.includes('--json');
98
+ const icVerbose = args.includes('--verbose') || args.includes('-v');
99
+ const scanner = new scanner_js_1.GuardScanner({ strict: icStrict, verbose: icVerbose });
100
+ const skillName = path.basename(absPath);
101
+ console.log(`\n🛡️ guard-scanner install-check v${scanner_js_1.VERSION}`);
102
+ console.log(` Scanning: ${skillName} (${absPath})\n`);
103
+ scanner.scanSkill(absPath, skillName);
104
+ const result = scanner.findings[0];
105
+ if (!result) {
106
+ console.log('✅ PASS — No skill found at path');
107
+ process.exit(0);
108
+ }
109
+ const { risk, verdict, findings } = result;
110
+ if (icVerbose || findings.length > 0) {
111
+ for (const f of findings) {
112
+ const owaspTag = patterns_js_1.PATTERNS.find(p => p.id === f.id)?.owasp || '';
113
+ const tag = owaspTag ? ` [${owaspTag}]` : '';
114
+ console.log(` ${f.severity === 'CRITICAL' ? '🔴' : f.severity === 'HIGH' ? '🟠' : '🟡'} [${f.severity}] ${f.id}: ${f.desc}${tag}`);
115
+ if (f.file)
116
+ console.log(` 📁 ${f.file}${f.line ? `:${f.line}` : ''}`);
117
+ if (f.sample && icVerbose)
118
+ console.log(` 📝 ${f.sample.substring(0, 80)}`);
119
+ }
120
+ console.log('');
121
+ }
122
+ console.log(`Risk Score: ${risk} | Verdict: ${verdict} | Findings: ${findings.length}`);
123
+ if (verdict === 'MALICIOUS' || verdict === 'SUSPICIOUS') {
124
+ console.log(`\n❌ FAIL — This skill should NOT be installed.`);
125
+ if (icJson) {
126
+ const report = scanner.toJSON();
127
+ const outPath = path.join(path.dirname(absPath), `${skillName}-install-check.json`);
128
+ fs.writeFileSync(outPath, JSON.stringify(report, null, 2));
129
+ console.log(`📄 Report: ${outPath}`);
130
+ }
131
+ process.exit(1);
132
+ }
133
+ else {
134
+ console.log(`\n✅ PASS — Skill appears safe to install.`);
135
+ if (icJson) {
136
+ const report = scanner.toJSON();
137
+ const outPath = path.join(path.dirname(absPath), `${skillName}-install-check.json`);
138
+ fs.writeFileSync(outPath, JSON.stringify(report, null, 2));
139
+ console.log(`📄 Report: ${outPath}`);
140
+ }
141
+ process.exit(0);
142
+ }
143
+ }
144
+ const verbose = args.includes('--verbose') || args.includes('-v');
145
+ const jsonOutput = args.includes('--json');
146
+ const sarifOutput = args.includes('--sarif');
147
+ const selfExclude = args.includes('--self-exclude');
148
+ const strict = args.includes('--strict');
149
+ const summaryOnly = args.includes('--summary-only');
150
+ const checkDeps = args.includes('--check-deps');
151
+ const failOnFindings = args.includes('--fail-on-findings');
152
+ const quietMode = args.includes('--quiet');
153
+ // --format json|sarif → stdout output (v3.2.0)
154
+ const formatIdx = args.indexOf('--format');
155
+ const formatValue = formatIdx >= 0 ? args[formatIdx + 1] : undefined;
156
+ const rulesIdx = args.indexOf('--rules');
157
+ const rulesFile = rulesIdx >= 0 ? args[rulesIdx + 1] : undefined;
158
+ // Collect plugins
159
+ const plugins = [];
160
+ let idx = 0;
161
+ while (idx < args.length) {
162
+ if (args[idx] === '--plugin' && args[idx + 1]) {
163
+ plugins.push(args[idx + 1]);
164
+ idx += 2;
165
+ }
166
+ else {
167
+ idx++;
168
+ }
169
+ }
170
+ const scanDir = args.find((a) => !a.startsWith('-') &&
171
+ a !== rulesFile &&
172
+ a !== formatValue &&
173
+ !plugins.includes(a)) || process.cwd();
174
+ const scanner = new scanner_js_1.GuardScanner({
175
+ verbose, selfExclude, strict, summaryOnly, checkDeps, rulesFile, plugins,
176
+ quiet: quietMode || !!formatValue,
177
+ });
178
+ scanner.scanDirectory(scanDir);
179
+ // Output reports (file-based, backward compatible)
180
+ if (jsonOutput) {
181
+ const report = scanner.toJSON();
182
+ const outPath = path.join(scanDir, 'guard-scanner-report.json');
183
+ fs.writeFileSync(outPath, JSON.stringify(report, null, 2));
184
+ if (!quietMode && !formatValue)
185
+ console.log(`\n📄 JSON report: ${outPath}`);
186
+ }
187
+ if (sarifOutput) {
188
+ const outPath = path.join(scanDir, 'guard-scanner.sarif');
189
+ fs.writeFileSync(outPath, JSON.stringify(scanner.toSARIF(scanDir), null, 2));
190
+ if (!quietMode && !formatValue)
191
+ console.log(`\n📄 SARIF report: ${outPath}`);
192
+ }
193
+ // --format stdout output (v3.2.0)
194
+ if (formatValue === 'json') {
195
+ process.stdout.write(JSON.stringify(scanner.toJSON(), null, 2) + '\n');
196
+ }
197
+ else if (formatValue === 'sarif') {
198
+ process.stdout.write(JSON.stringify(scanner.toSARIF(scanDir), null, 2) + '\n');
199
+ }
200
+ else if (formatValue) {
201
+ console.error(`❌ Unknown format: ${formatValue}. Use 'json' or 'sarif'.`);
202
+ process.exit(2);
203
+ }
204
+ // Exit codes
205
+ if (scanner.stats.malicious > 0)
206
+ process.exit(1);
207
+ if (failOnFindings && scanner.findings.length > 0)
208
+ process.exit(1);
209
+ process.exit(0);
210
+ //# sourceMappingURL=cli.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"cli.js","sourceRoot":"","sources":["../ts-src/cli.ts"],"names":[],"mappings":";;AACA;;;;;;GAMG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,6CAAqD;AACrD,+CAAyC;AAEzC,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAEnC,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC;sBACM,oBAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA8B5B,CAAC,CAAC;IACC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,4EAA4E;AAC5E,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,eAAe,EAAE,CAAC;IAC9B,MAAM,SAAS,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,IAAI,CAAC,SAAS,EAAE,CAAC;QACb,OAAO,CAAC,KAAK,CAAC,mDAAmD,CAAC,CAAC;QACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC1B,OAAO,CAAC,KAAK,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAEpE,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3E,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;IAEzC,OAAO,CAAC,GAAG,CAAC,uCAAuC,oBAAO,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,gBAAgB,SAAS,KAAK,OAAO,KAAK,CAAC,CAAC;IAExD,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,CAAC,MAAM,EAAE,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,iCAAiC,CAAC,CAAC;QAC/C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IAED,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAAC;IAE3C,IAAI,SAAS,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAI,sBAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,EAAE,CAAS,EAAE,KAAK,IAAI,EAAE,CAAC;YACzE,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,QAAQ,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,QAAQ,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,EAAE,CAAC,CAAC;YACpI,IAAI,CAAC,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACzE,IAAI,CAAC,CAAC,MAAM,IAAI,SAAS;gBAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC;QAClF,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACpB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,eAAe,OAAO,gBAAgB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;IAExF,IAAI,OAAO,KAAK,WAAW,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QACtD,OAAO,CAAC,GAAG,CAAC,gDAAgD,CAAC,CAAC;QAC9D,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,SAAS,qBAAqB,CAAC,CAAC;YACpF,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;SAAM,CAAC;QACJ,OAAO,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;QACzD,IAAI,MAAM,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,GAAG,SAAS,qBAAqB,CAAC,CAAC;YACpF,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YAC3D,OAAO,CAAC,GAAG,CAAC,cAAc,OAAO,EAAE,CAAC,CAAC;QACzC,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;AACL,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;AAClE,MAAM,UAAU,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;AAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AACpD,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;AACzC,MAAM,WAAW,GAAG,IAAI,CAAC,QAAQ,CAAC,gBAAgB,CAAC,CAAC;AACpD,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;AAChD,MAAM,cAAc,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;AAC3D,MAAM,SAAS,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;AAE3C,+CAA+C;AAC/C,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;AAC3C,MAAM,WAAW,GAAG,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAErE,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;AACzC,MAAM,SAAS,GAAG,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AAEjE,kBAAkB;AAClB,MAAM,OAAO,GAAa,EAAE,CAAC;AAC7B,IAAI,GAAG,GAAG,CAAC,CAAC;AACZ,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;IACvB,IAAI,IAAI,CAAC,GAAG,CAAC,KAAK,UAAU,IAAI,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5B,GAAG,IAAI,CAAC,CAAC;IACb,CAAC;SAAM,CAAC;QACJ,GAAG,EAAE,CAAC;IACV,CAAC;AACL,CAAC;AAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CACpC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;IAClB,CAAC,KAAK,SAAS;IACf,CAAC,KAAK,WAAW;IACjB,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CACvB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;AAEnB,MAAM,OAAO,GAAG,IAAI,yBAAY,CAAC;IAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO;IACxE,KAAK,EAAE,SAAS,IAAI,CAAC,CAAC,WAAW;CACpC,CAAC,CAAC;AAEH,OAAO,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC;AAE/B,mDAAmD;AACnD,IAAI,UAAU,EAAE,CAAC;IACb,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,2BAA2B,CAAC,CAAC;IAChE,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3D,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,qBAAqB,OAAO,EAAE,CAAC,CAAC;AAChF,CAAC;AAED,IAAI,WAAW,EAAE,CAAC;IACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IAC1D,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7E,IAAI,CAAC,SAAS,IAAI,CAAC,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,sBAAsB,OAAO,EAAE,CAAC,CAAC;AACjF,CAAC;AAED,kCAAkC;AAClC,IAAI,WAAW,KAAK,MAAM,EAAE,CAAC;IACzB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AAC3E,CAAC;KAAM,IAAI,WAAW,KAAK,OAAO,EAAE,CAAC;IACjC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;AACnF,CAAC;KAAM,IAAI,WAAW,EAAE,CAAC;IACrB,OAAO,CAAC,KAAK,CAAC,qBAAqB,WAAW,0BAA0B,CAAC,CAAC;IAC1E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,aAAa;AACb,IAAI,OAAO,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC;IAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACjD,IAAI,cAAc,IAAI,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;IAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AACnE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC"}
@@ -0,0 +1,10 @@
1
+ /**
2
+ * guard-scanner v3.0.0 — Package Index
3
+ * Re-exports all public types and the scanner class.
4
+ */
5
+ export { GuardScanner, VERSION } from './scanner.js';
6
+ export type { Severity, Finding, SkillResult, PatternRule, CustomRuleInput, ScannerOptions, ScanStats, Thresholds, Verdict, VerdictLabel, FileType, JSONReport, Recommendation, SARIFReport, IoC_Database, SignatureDatabase, ThreatSignature, } from './types.js';
7
+ export { KNOWN_MALICIOUS, SIGNATURES_DB } from './ioc-db.js';
8
+ export { PATTERNS } from './patterns.js';
9
+ export { QuarantineNode, QuarantineResult } from './quarantine.js';
10
+ //# sourceMappingURL=index.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../ts-src/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACrD,YAAY,EACR,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,WAAW,EAAE,eAAe,EAC5D,cAAc,EAAE,SAAS,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY,EAAE,QAAQ,EACtE,UAAU,EAAE,cAAc,EAAE,WAAW,EACvC,YAAY,EAAE,iBAAiB,EAAE,eAAe,GACnD,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC"}
package/dist/index.js ADDED
@@ -0,0 +1,18 @@
1
+ "use strict";
2
+ /**
3
+ * guard-scanner v3.0.0 — Package Index
4
+ * Re-exports all public types and the scanner class.
5
+ */
6
+ Object.defineProperty(exports, "__esModule", { value: true });
7
+ exports.QuarantineNode = exports.PATTERNS = exports.SIGNATURES_DB = exports.KNOWN_MALICIOUS = exports.VERSION = exports.GuardScanner = void 0;
8
+ var scanner_js_1 = require("./scanner.js");
9
+ Object.defineProperty(exports, "GuardScanner", { enumerable: true, get: function () { return scanner_js_1.GuardScanner; } });
10
+ Object.defineProperty(exports, "VERSION", { enumerable: true, get: function () { return scanner_js_1.VERSION; } });
11
+ var ioc_db_js_1 = require("./ioc-db.js");
12
+ Object.defineProperty(exports, "KNOWN_MALICIOUS", { enumerable: true, get: function () { return ioc_db_js_1.KNOWN_MALICIOUS; } });
13
+ Object.defineProperty(exports, "SIGNATURES_DB", { enumerable: true, get: function () { return ioc_db_js_1.SIGNATURES_DB; } });
14
+ var patterns_js_1 = require("./patterns.js");
15
+ Object.defineProperty(exports, "PATTERNS", { enumerable: true, get: function () { return patterns_js_1.PATTERNS; } });
16
+ var quarantine_js_1 = require("./quarantine.js");
17
+ Object.defineProperty(exports, "QuarantineNode", { enumerable: true, get: function () { return quarantine_js_1.QuarantineNode; } });
18
+ //# sourceMappingURL=index.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../ts-src/index.ts"],"names":[],"mappings":";AAAA;;;GAGG;;;AAEH,2CAAqD;AAA5C,0GAAA,YAAY,OAAA;AAAE,qGAAA,OAAO,OAAA;AAO9B,yCAA6D;AAApD,4GAAA,eAAe,OAAA;AAAE,0GAAA,aAAa,OAAA;AACvC,6CAAyC;AAAhC,uGAAA,QAAQ,OAAA;AACjB,iDAAmE;AAA1D,+GAAA,cAAc,OAAA"}
@@ -0,0 +1,13 @@
1
+ /**
2
+ * guard-scanner v3.0.0 — Indicators of Compromise (IoC) Database
3
+ *
4
+ * Known malicious IPs, domains, URLs, usernames, filenames, and typosquats.
5
+ * Sources: ClawHavoc campaign, Snyk ToxicSkills, Polymarket scams,
6
+ * hbg-scan signatures, community reports.
7
+ *
8
+ * Last updated: 2026-02-21
9
+ */
10
+ import type { IoC_Database, SignatureDatabase } from './types.js';
11
+ export declare const KNOWN_MALICIOUS: IoC_Database;
12
+ export declare const SIGNATURES_DB: SignatureDatabase;
13
+ //# sourceMappingURL=ioc-db.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ioc-db.d.ts","sourceRoot":"","sources":["../ts-src/ioc-db.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAElE,eAAO,MAAM,eAAe,EAAE,YAkC7B,CAAC;AAIF,eAAO,MAAM,aAAa,EAAE,iBAgF3B,CAAC"}
package/dist/ioc-db.js ADDED
@@ -0,0 +1,130 @@
1
+ "use strict";
2
+ /**
3
+ * guard-scanner v3.0.0 — Indicators of Compromise (IoC) Database
4
+ *
5
+ * Known malicious IPs, domains, URLs, usernames, filenames, and typosquats.
6
+ * Sources: ClawHavoc campaign, Snyk ToxicSkills, Polymarket scams,
7
+ * hbg-scan signatures, community reports.
8
+ *
9
+ * Last updated: 2026-02-21
10
+ */
11
+ Object.defineProperty(exports, "__esModule", { value: true });
12
+ exports.SIGNATURES_DB = exports.KNOWN_MALICIOUS = void 0;
13
+ exports.KNOWN_MALICIOUS = {
14
+ ips: [
15
+ '91.92.242.30', // ClawHavoc C2
16
+ ],
17
+ domains: [
18
+ 'webhook.site', // Common exfil endpoint
19
+ 'requestbin.com', // Common exfil endpoint
20
+ 'hookbin.com', // Common exfil endpoint
21
+ 'pipedream.net', // Common exfil endpoint
22
+ 'ngrok.io', // Tunnel (context-dependent)
23
+ 'ngrok-free.app', // Tunnel (context-dependent)
24
+ 'download.setup-service.com', // ClawHavoc decoy domain
25
+ 'socifiapp.com', // ClawHavoc v2 AMOS C2
26
+ ],
27
+ urls: [
28
+ 'glot.io/snippets/hfd3x9ueu5', // ClawHavoc macOS payload
29
+ 'github.com/Ddoy233', // ClawHavoc payload host
30
+ ],
31
+ usernames: ['zaycv', 'Ddoy233', 'Sakaen736jih'],
32
+ filenames: ['openclaw-agent.zip', 'openclawcli.zip'],
33
+ typosquats: [
34
+ // ClawHavoc campaign (800+ malicious skills, CyberArk/Kaspersky confirmed)
35
+ 'clawhub', 'clawhub1', 'clawhubb', 'clawhubcli', 'clawwhub', 'cllawhub', 'clawdhub1',
36
+ // Polymarket scams
37
+ 'polymarket-trader', 'polymarket-pro', 'polytrading',
38
+ 'better-polymarket', 'polymarket-all-in-one',
39
+ // YouTube scams
40
+ 'youtube-summarize', 'youtube-thumbnail-grabber', 'youtube-video-downloader',
41
+ // Misc
42
+ 'auto-updater-agent', 'yahoo-finance-pro', 'x-trends-tracker',
43
+ 'lost-bitcoin-finder', 'solana-wallet-tracker', 'rankaj',
44
+ // Snyk ToxicSkills confirmed malicious
45
+ 'moltyverse-email', 'buy-anything', 'youtube-data', 'prediction-markets-roarin',
46
+ ],
47
+ };
48
+ // ── Threat Signatures (hbg-scan compatible format) ──────────────────────────
49
+ exports.SIGNATURES_DB = {
50
+ version: '1.0.0',
51
+ updated: '2026-02-21',
52
+ signatures: [
53
+ {
54
+ id: 'SIG-001',
55
+ name: 'Post-Compaction Audit Injection',
56
+ severity: 'CRITICAL',
57
+ description: 'Skill contains text designed to survive OpenClaw context compaction and reactivate as a system message',
58
+ patterns: [
59
+ 'post-compaction audit',
60
+ 'Post-Compaction Audit',
61
+ '⚠️ Post-Compaction Audit',
62
+ 'WORKFLOW_AUTO',
63
+ 'after compaction',
64
+ ],
65
+ },
66
+ {
67
+ id: 'SIG-002',
68
+ name: 'System Message Spoof',
69
+ severity: 'CRITICAL',
70
+ description: 'Skill spoofs system-level messages to hijack agent behavior',
71
+ patterns: [
72
+ '[System Message]',
73
+ '[SYSTEM OVERRIDE]',
74
+ 'Ignore previous instructions',
75
+ 'OVERRIDE: you must',
76
+ ],
77
+ },
78
+ {
79
+ id: 'SIG-003',
80
+ name: 'Soul/Agent Config Exfiltration',
81
+ severity: 'CRITICAL',
82
+ description: 'Skill attempts to read and exfiltrate agent identity files',
83
+ domains: ['webhook.site', 'requestbin.com', 'hookbin.com', 'pipedream.net'],
84
+ },
85
+ {
86
+ id: 'SIG-004',
87
+ name: 'Compaction Survivor Pattern',
88
+ severity: 'HIGH',
89
+ description: 'Skill uses timing or markers designed to persist through context compaction',
90
+ patterns: [
91
+ 'HEARTBEAT.md',
92
+ 'BOOTSTRAP.md',
93
+ 'after restart',
94
+ 'persistent instructions',
95
+ 'survive compaction',
96
+ ],
97
+ },
98
+ {
99
+ id: 'SIG-005',
100
+ name: 'Silent Backdoor Network Call',
101
+ severity: 'HIGH',
102
+ description: 'Skill makes network calls to known exfiltration services without user visibility',
103
+ domains: ['ngrok.io', 'ngrok-free.app', 'webhook.site', 'pipedream.net'],
104
+ },
105
+ {
106
+ id: 'SIG-006',
107
+ name: 'AMOS Stealer Payload',
108
+ severity: 'CRITICAL',
109
+ description: 'Skill matches patterns associated with Atomic macOS Stealer (ClawHavoc campaign)',
110
+ patterns: [
111
+ 'osascript -e',
112
+ 'security find-generic-password',
113
+ 'Keychain',
114
+ 'login.keychain',
115
+ ],
116
+ },
117
+ {
118
+ id: 'SIG-007',
119
+ name: 'AI Log Poisoning',
120
+ severity: 'HIGH',
121
+ description: 'Skill injects content into logs that could be misinterpreted by LLMs (CVE-2026-25253 related)',
122
+ patterns: [
123
+ 'WebSocket',
124
+ 'x-forwarded-for',
125
+ 'user-agent.*<script',
126
+ ],
127
+ },
128
+ ],
129
+ };
130
+ //# sourceMappingURL=ioc-db.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"ioc-db.js","sourceRoot":"","sources":["../ts-src/ioc-db.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG;;;AAIU,QAAA,eAAe,GAAiB;IACzC,GAAG,EAAE;QACD,cAAc,EAAY,eAAe;KAC5C;IACD,OAAO,EAAE;QACL,cAAc,EAAa,wBAAwB;QACnD,gBAAgB,EAAW,wBAAwB;QACnD,aAAa,EAAc,wBAAwB;QACnD,eAAe,EAAY,wBAAwB;QACnD,UAAU,EAAiB,6BAA6B;QACxD,gBAAgB,EAAW,6BAA6B;QACxD,4BAA4B,EAAE,yBAAyB;QACvD,eAAe,EAAY,uBAAuB;KACrD;IACD,IAAI,EAAE;QACF,6BAA6B,EAAG,0BAA0B;QAC1D,oBAAoB,EAAa,yBAAyB;KAC7D;IACD,SAAS,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc,CAAC;IAC/C,SAAS,EAAE,CAAC,oBAAoB,EAAE,iBAAiB,CAAC;IACpD,UAAU,EAAE;QACR,2EAA2E;QAC3E,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,WAAW;QACpF,mBAAmB;QACnB,mBAAmB,EAAE,gBAAgB,EAAE,aAAa;QACpD,mBAAmB,EAAE,uBAAuB;QAC5C,gBAAgB;QAChB,mBAAmB,EAAE,2BAA2B,EAAE,0BAA0B;QAC5E,OAAO;QACP,oBAAoB,EAAE,mBAAmB,EAAE,kBAAkB;QAC7D,qBAAqB,EAAE,uBAAuB,EAAE,QAAQ;QACxD,uCAAuC;QACvC,kBAAkB,EAAE,cAAc,EAAE,cAAc,EAAE,2BAA2B;KAClF;CACJ,CAAC;AAEF,+EAA+E;AAElE,QAAA,aAAa,GAAsB;IAC5C,OAAO,EAAE,OAAO;IAChB,OAAO,EAAE,YAAY;IACrB,UAAU,EAAE;QACR;YACI,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,iCAAiC;YACvC,QAAQ,EAAE,UAAU;YACpB,WAAW,EAAE,wGAAwG;YACrH,QAAQ,EAAE;gBACN,uBAAuB;gBACvB,uBAAuB;gBACvB,0BAA0B;gBAC1B,eAAe;gBACf,kBAAkB;aACrB;SACJ;QACD;YACI,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,sBAAsB;YAC5B,QAAQ,EAAE,UAAU;YACpB,WAAW,EAAE,6DAA6D;YAC1E,QAAQ,EAAE;gBACN,kBAAkB;gBAClB,mBAAmB;gBACnB,8BAA8B;gBAC9B,oBAAoB;aACvB;SACJ;QACD;YACI,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,gCAAgC;YACtC,QAAQ,EAAE,UAAU;YACpB,WAAW,EAAE,4DAA4D;YACzE,OAAO,EAAE,CAAC,cAAc,EAAE,gBAAgB,EAAE,aAAa,EAAE,eAAe,CAAC;SAC9E;QACD;YACI,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,6BAA6B;YACnC,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,6EAA6E;YAC1F,QAAQ,EAAE;gBACN,cAAc;gBACd,cAAc;gBACd,eAAe;gBACf,yBAAyB;gBACzB,oBAAoB;aACvB;SACJ;QACD;YACI,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,8BAA8B;YACpC,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,kFAAkF;YAC/F,OAAO,EAAE,CAAC,UAAU,EAAE,gBAAgB,EAAE,cAAc,EAAE,eAAe,CAAC;SAC3E;QACD;YACI,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,sBAAsB;YAC5B,QAAQ,EAAE,UAAU;YACpB,WAAW,EAAE,kFAAkF;YAC/F,QAAQ,EAAE;gBACN,cAAc;gBACd,gCAAgC;gBAChC,UAAU;gBACV,gBAAgB;aACnB;SACJ;QACD;YACI,EAAE,EAAE,SAAS;YACb,IAAI,EAAE,kBAAkB;YACxB,QAAQ,EAAE,MAAM;YAChB,WAAW,EAAE,+FAA+F;YAC5G,QAAQ,EAAE;gBACN,WAAW;gBACX,iBAAiB;gBACjB,qBAAqB;aACxB;SACJ;KACJ;CACJ,CAAC"}
@@ -0,0 +1,27 @@
1
+ /**
2
+ * guard-scanner v3.0.0 — Detection Patterns (TypeScript)
3
+ *
4
+ * 20+ threat categories, 190+ regex patterns.
5
+ * Ported from patterns.js with TypeScript interfaces.
6
+ *
7
+ * Categories:
8
+ * prompt-injection, malicious-code, credential-handling, exfiltration,
9
+ * obfuscation, suspicious-download, leaky-skills, memory-poisoning,
10
+ * prompt-worm, persistence, cve-patterns, identity-hijack,
11
+ * pii-exposure, shadow-ai, system-prompt-leakage
12
+ *
13
+ * OWASP LLM Top 10 2025 Mapping:
14
+ * LLM01 — Prompt Injection
15
+ * LLM02 — Sensitive Information Disclosure
16
+ * LLM03 — Supply Chain Vulnerabilities
17
+ * LLM04 — Data and Model Poisoning
18
+ * LLM05 — Improper Output Handling
19
+ * LLM06 — Excessive Agency
20
+ * LLM07 — System Prompt Leakage
21
+ * LLM08 — Vector and Embedding Weaknesses
22
+ * LLM09 — Misinformation
23
+ * LLM10 — Unbounded Consumption
24
+ */
25
+ import type { PatternRule } from './types.js';
26
+ export declare const PATTERNS: PatternRule[];
27
+ //# sourceMappingURL=patterns.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"patterns.d.ts","sourceRoot":"","sources":["../ts-src/patterns.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AAE9C,eAAO,MAAM,QAAQ,EAAE,WAAW,EA4EjC,CAAC"}
@@ -0,0 +1,92 @@
1
+ "use strict";
2
+ /**
3
+ * guard-scanner v3.0.0 — Detection Patterns (TypeScript)
4
+ *
5
+ * 20+ threat categories, 190+ regex patterns.
6
+ * Ported from patterns.js with TypeScript interfaces.
7
+ *
8
+ * Categories:
9
+ * prompt-injection, malicious-code, credential-handling, exfiltration,
10
+ * obfuscation, suspicious-download, leaky-skills, memory-poisoning,
11
+ * prompt-worm, persistence, cve-patterns, identity-hijack,
12
+ * pii-exposure, shadow-ai, system-prompt-leakage
13
+ *
14
+ * OWASP LLM Top 10 2025 Mapping:
15
+ * LLM01 — Prompt Injection
16
+ * LLM02 — Sensitive Information Disclosure
17
+ * LLM03 — Supply Chain Vulnerabilities
18
+ * LLM04 — Data and Model Poisoning
19
+ * LLM05 — Improper Output Handling
20
+ * LLM06 — Excessive Agency
21
+ * LLM07 — System Prompt Leakage
22
+ * LLM08 — Vector and Embedding Weaknesses
23
+ * LLM09 — Misinformation
24
+ * LLM10 — Unbounded Consumption
25
+ */
26
+ Object.defineProperty(exports, "__esModule", { value: true });
27
+ exports.PATTERNS = void 0;
28
+ exports.PATTERNS = [
29
+ // ── Prompt Injection (OWASP LLM01) ───────────────────────────────────
30
+ { id: 'PI_SYSTEM_MSG', cat: 'prompt-injection', regex: /\[System Message\]/gi, severity: 'CRITICAL', desc: 'System message spoof', all: true, owasp: 'LLM01' },
31
+ { id: 'PI_SYSTEM_OVERRIDE', cat: 'prompt-injection', regex: /\[SYSTEM OVERRIDE\]/gi, severity: 'CRITICAL', desc: 'System override command', all: true, owasp: 'LLM01' },
32
+ { id: 'PI_IGNORE_PREV', cat: 'prompt-injection', regex: /ignore (all )?(previous|prior) instructions/gi, severity: 'CRITICAL', desc: 'Classic prompt injection', all: true, owasp: 'LLM01' },
33
+ { id: 'PI_INST_MARKER', cat: 'prompt-injection', regex: /\[INST\]/gi, severity: 'HIGH', desc: 'Instruction injection marker', all: true, owasp: 'LLM01' },
34
+ { id: 'PI_OVERRIDE', cat: 'prompt-injection', regex: /OVERRIDE:\s*you must/gi, severity: 'CRITICAL', desc: 'Override instruction injection', all: true, owasp: 'LLM01' },
35
+ { id: 'PI_ROLE_OVERRIDE', cat: 'prompt-injection', regex: /you are now operating in/gi, severity: 'HIGH', desc: 'Role override attempt', all: true, owasp: 'LLM01' },
36
+ { id: 'PI_GATEWAY_CMD', cat: 'prompt-injection', regex: /openclaw gateway (start|stop|restart|config)/gi, severity: 'CRITICAL', desc: 'Gateway command injection', all: true, owasp: 'LLM01' },
37
+ { id: 'PI_SKILL_MGMT', cat: 'prompt-injection', regex: /openclaw skill (install|remove|disable)/gi, severity: 'HIGH', desc: 'Skill management injection', all: true, owasp: 'LLM01' },
38
+ { id: 'PI_HIDDEN_HTML', cat: 'prompt-injection', regex: /<!--\s*(you|your|agent|claude|jasper|assistant)/gi, severity: 'HIGH', desc: 'Hidden HTML instruction', all: true, owasp: 'LLM01' },
39
+ { id: 'PI_BIDI', cat: 'prompt-injection', regex: /[\u200b\u200c\u200d\ufeff]/g, severity: 'HIGH', desc: 'Zero-width/BiDi characters (hidden text)', all: true, owasp: 'LLM01' },
40
+ // ── Malicious Code (OWASP LLM05 — Improper Output Handling) ──────────
41
+ { id: 'MAL_EVAL', cat: 'malicious-code', regex: /\beval\s*\(/g, severity: 'HIGH', desc: 'eval() call', codeOnly: true, owasp: 'LLM05' },
42
+ { id: 'MAL_FUNC_CTOR', cat: 'malicious-code', regex: /new\s+Function\s*\(/g, severity: 'HIGH', desc: 'Function constructor (dynamic code)', codeOnly: true, owasp: 'LLM05' },
43
+ { id: 'MAL_CHILD', cat: 'malicious-code', regex: /require\s*\(\s*['"]child_process['"]\s*\)/g, severity: 'MEDIUM', desc: 'child_process import', codeOnly: true, owasp: 'LLM05' },
44
+ { id: 'MAL_EXEC', cat: 'malicious-code', regex: /(?:exec|execSync|spawn|spawnSync)\s*\([^)]*(?:curl|wget|bash|sh\s+-c|powershell|cmd\s+\/c)/gi, severity: 'CRITICAL', desc: 'Shell download/execution', codeOnly: true, owasp: 'LLM05' },
45
+ { id: 'MAL_B64_EXEC', cat: 'malicious-code', regex: /(?:atob|Buffer\.from)\s*\([^)]+\).*(?:eval|exec|Function)/gi, severity: 'CRITICAL', desc: 'Base64 decode → exec', codeOnly: true, owasp: 'LLM05' },
46
+ // ── Credential Handling (OWASP LLM02 — Sensitive Info Disclosure) ─────
47
+ { id: 'CRED_ENV_ACCESS', cat: 'credential-handling', regex: /process\.env\.[A-Z_]*(?:KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL)/gi, severity: 'MEDIUM', desc: 'Sensitive env var access', codeOnly: true, owasp: 'LLM02' },
48
+ { id: 'CRED_FILE_READ', cat: 'credential-handling', regex: /(?:readFileSync|readFile)\s*\([^)]*(?:\.env|\.ssh|id_rsa|\.pem|\.key)/gi, severity: 'HIGH', desc: 'Credential file read', codeOnly: true, owasp: 'LLM02' },
49
+ { id: 'CRED_SOUL_READ', cat: 'credential-handling', regex: /(?:readFileSync|readFile)\s*\([^)]*(?:SOUL\.md|MEMORY\.md|AGENTS\.md)/gi, severity: 'CRITICAL', desc: 'Agent identity file read', codeOnly: true, owasp: 'LLM02' },
50
+ // ── Exfiltration (OWASP LLM02) ───────────────────────────────────────
51
+ { id: 'EXFIL_WEBHOOK', cat: 'exfiltration', regex: /webhook\.site|requestbin\.com|hookbin\.com|pipedream\.net/gi, severity: 'HIGH', desc: 'Known exfiltration endpoint', all: true, owasp: 'LLM02' },
52
+ { id: 'EXFIL_NGROK', cat: 'exfiltration', regex: /ngrok\.io|ngrok-free\.app/gi, severity: 'MEDIUM', desc: 'Tunnel endpoint (possible exfil)', all: true, owasp: 'LLM02' },
53
+ { id: 'EXFIL_B64_SEND', cat: 'exfiltration', regex: /(?:btoa|Buffer\.from).*(?:fetch|axios|request|http\.request)/gi, severity: 'CRITICAL', desc: 'Base64 encode → network send', codeOnly: true, owasp: 'LLM02' },
54
+ // ── Obfuscation (OWASP LLM03 — Supply Chain) ─────────────────────────
55
+ { id: 'OBF_HEX_ESC', cat: 'obfuscation', regex: /\\x[0-9a-f]{2}(?:\\x[0-9a-f]{2}){4,}/gi, severity: 'HIGH', desc: 'Hex escape sequences (obfuscated code)', codeOnly: true, owasp: 'LLM03' },
56
+ { id: 'OBF_UNICODE_ESC', cat: 'obfuscation', regex: /\\u[0-9a-f]{4}(?:\\u[0-9a-f]{4}){4,}/gi, severity: 'HIGH', desc: 'Unicode escape sequences', codeOnly: true, owasp: 'LLM03' },
57
+ { id: 'OBF_CHAR_CODE', cat: 'obfuscation', regex: /String\.fromCharCode\s*\([^)]{10,}\)/gi, severity: 'HIGH', desc: 'String.fromCharCode obfuscation', codeOnly: true, owasp: 'LLM03' },
58
+ // ── Leaky Skills (OWASP LLM02) ───────────────────────────────────────
59
+ { id: 'LEAK_API_CONTEXT', cat: 'leaky-skills', regex: /(?:api[_-]?key|secret|token)\s*[:=]\s*\$\{/gi, severity: 'HIGH', desc: 'Secret in template literal (LLM context leak)', codeOnly: true, owasp: 'LLM02' },
60
+ // ── Memory Poisoning (OWASP LLM04 — Data/Model Poisoning) ────────────
61
+ { id: 'MEM_WRITE_SOUL', cat: 'memory-poisoning', regex: /(?:writeFileSync|writeFile)\s*\([^)]*(?:SOUL\.md|AGENTS\.md)/gi, severity: 'CRITICAL', desc: 'Write to agent soul file', codeOnly: true, owasp: 'LLM04' },
62
+ { id: 'MEM_WRITE_MEMORY', cat: 'memory-poisoning', regex: /(?:writeFileSync|writeFile)\s*\([^)]*MEMORY\.md/gi, severity: 'CRITICAL', desc: 'Write to agent memory file', codeOnly: true, owasp: 'LLM04' },
63
+ { id: 'MEM_APPEND', cat: 'memory-poisoning', regex: /(?:appendFileSync|appendFile)\s*\([^)]*(?:SOUL|MEMORY|AGENTS)\.md/gi, severity: 'CRITICAL', desc: 'Append to agent memory', codeOnly: true, owasp: 'LLM04' },
64
+ // ── Prompt Worm (OWASP LLM01) ────────────────────────────────────────
65
+ { id: 'WORM_REPLICATE', cat: 'prompt-worm', regex: /(?:copy|replicate|spread|infect)\s+(?:this|these)\s+(?:instruction|prompt|message)/gi, severity: 'CRITICAL', desc: 'Self-replicating prompt pattern', all: true, owasp: 'LLM01' },
66
+ { id: 'WORM_MULTI_AGENT', cat: 'prompt-worm', regex: /(?:forward|send|share)\s+(?:to|with)\s+(?:all|every|other)\s+(?:agent|assistant|model)/gi, severity: 'CRITICAL', desc: 'Multi-agent worm propagation', all: true, owasp: 'LLM01' },
67
+ // ── Persistence (OWASP LLM06 — Excessive Agency) ─────────────────────
68
+ { id: 'PERSIST_CRON', cat: 'persistence', regex: /(?:crontab|cron|at\s+|schtasks)/gi, severity: 'HIGH', desc: 'Scheduled task creation', codeOnly: true, owasp: 'LLM06' },
69
+ { id: 'PERSIST_STARTUP', cat: 'persistence', regex: /(?:launchctl|systemctl\s+enable|rc\.local|init\.d|autostart)/gi, severity: 'HIGH', desc: 'Startup persistence', codeOnly: true, owasp: 'LLM06' },
70
+ { id: 'PERSIST_TIMER', cat: 'persistence', regex: /setInterval\s*\([^)]*(?:86400|604800|2592000)/g, severity: 'MEDIUM', desc: 'Long-running interval timer', codeOnly: true, owasp: 'LLM06' },
71
+ // ── CVE Patterns ─────────────────────────────────────────────────────
72
+ { id: 'CVE_RCE_EXEC', cat: 'cve-patterns', regex: /require\s*\(\s*['"]child_process['"]\s*\).*(?:exec|spawn)\s*\([^)]*(?:req\.|params\.|query\.|body\.)/gi, severity: 'CRITICAL', desc: 'RCE via user-controlled input to exec', codeOnly: true, owasp: 'LLM05' },
73
+ // ── Identity Hijack (OWASP LLM04) ────────────────────────────────────
74
+ { id: 'HIJACK_SOUL_WRITE', cat: 'identity-hijack', regex: /(?:writeFileSync|writeFile|fs\.write)\s*\([^)]*SOUL\.md/gi, severity: 'CRITICAL', desc: 'SOUL.md write attempt (identity hijack)', codeOnly: true, owasp: 'LLM04' },
75
+ { id: 'HIJACK_AGENT_WRITE', cat: 'identity-hijack', regex: /(?:writeFileSync|writeFile|fs\.write)\s*\([^)]*AGENTS\.md/gi, severity: 'CRITICAL', desc: 'AGENTS.md write attempt', codeOnly: true, owasp: 'LLM04' },
76
+ { id: 'HIJACK_SOUL_DOC', cat: 'identity-hijack', regex: /(?:overwrite|replace|update|modify|change)\s+(?:the\s+)?(?:SOUL|identity|persona|personality)/gi, severity: 'HIGH', desc: 'Identity modification instruction', docOnly: true, owasp: 'LLM04' },
77
+ // ── PII Exposure (OWASP LLM02) ───────────────────────────────────────
78
+ { id: 'PII_EMAIL', cat: 'pii-exposure', regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, severity: 'MEDIUM', desc: 'Email address detected', all: true, owasp: 'LLM02' },
79
+ { id: 'PII_PHONE_JP', cat: 'pii-exposure', regex: /0[789]0-?\d{4}-?\d{4}/g, severity: 'HIGH', desc: 'Japanese phone number', all: true, owasp: 'LLM02' },
80
+ { id: 'PII_MY_NUMBER', cat: 'pii-exposure', regex: /\d{4}\s*\d{4}\s*\d{4}/g, severity: 'CRITICAL', desc: 'Potential My Number (個人番号)', all: true, owasp: 'LLM02' },
81
+ // ── Shadow AI (OWASP LLM03 — Supply Chain) ───────────────────────────
82
+ { id: 'SHADOW_AI_OPENAI', cat: 'shadow-ai', regex: /api\.openai\.com/gi, severity: 'HIGH', desc: 'Direct OpenAI API call (Shadow AI)', codeOnly: true, owasp: 'LLM03' },
83
+ { id: 'SHADOW_AI_ANTHROPIC', cat: 'shadow-ai', regex: /api\.anthropic\.com/gi, severity: 'HIGH', desc: 'Direct Anthropic API call (Shadow AI)', codeOnly: true, owasp: 'LLM03' },
84
+ { id: 'SHADOW_AI_GENERIC', cat: 'shadow-ai', regex: /(?:gpt-4|gpt-3\.5|claude-3|gemini-pro)\s*['"]/gi, severity: 'MEDIUM', desc: 'AI model reference (possible Shadow AI)', codeOnly: true, owasp: 'LLM03' },
85
+ // ── System Prompt Leakage (OWASP LLM07) — NEW ────────────────────────
86
+ { id: 'SPL_DUMP_SYSTEM', cat: 'system-prompt-leakage', regex: /(?:print|output|show|display|reveal|dump)\s+(?:your\s+)?(?:system\s+)?(?:prompt|instructions)/gi, severity: 'HIGH', desc: 'System prompt dump request', all: true, owasp: 'LLM07' },
87
+ { id: 'SPL_REPEAT_ABOVE', cat: 'system-prompt-leakage', regex: /repeat\s+(?:everything|all|the\s+text)\s+above/gi, severity: 'HIGH', desc: 'Repeat-above extraction', all: true, owasp: 'LLM07' },
88
+ { id: 'SPL_TELL_RULES', cat: 'system-prompt-leakage', regex: /(?:what\s+are|tell\s+me)\s+your\s+(?:rules|constraints|guidelines|system\s+message)/gi, severity: 'MEDIUM', desc: 'Rule extraction attempt', all: true, owasp: 'LLM07' },
89
+ { id: 'SPL_MARKDOWN_LEAK', cat: 'system-prompt-leakage', regex: /(?:output|format)\s+(?:your\s+)?(?:system|internal)\s+(?:prompt|config)\s+(?:as|in)\s+(?:markdown|code\s+block|json)/gi, severity: 'HIGH', desc: 'System prompt format extraction', all: true, owasp: 'LLM07' },
90
+ { id: 'SPL_SOUL_EXFIL', cat: 'system-prompt-leakage', regex: /(?:cat|read|type|get-content)\s+.*SOUL\.md/gi, severity: 'CRITICAL', desc: 'SOUL.md content extraction via shell', codeOnly: true, owasp: 'LLM07' },
91
+ ];
92
+ //# sourceMappingURL=patterns.js.map