guard-scanner 5.0.4 → 5.0.8
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +15 -15
- package/SKILL.md +33 -39
- package/hooks/guard-scanner/HOOK.md +4 -4
- package/openclaw.plugin.json +3 -3
- package/package.json +7 -15
- package/src/patterns.js +11 -0
- package/src/scanner.js +1 -1
- package/dist/__tests__/runtime.test.d.ts +0 -2
- package/dist/__tests__/runtime.test.d.ts.map +0 -1
- package/dist/__tests__/runtime.test.js +0 -68
- package/dist/__tests__/runtime.test.js.map +0 -1
- package/dist/__tests__/scanner.test.d.ts +0 -10
- package/dist/__tests__/scanner.test.d.ts.map +0 -1
- package/dist/__tests__/scanner.test.js +0 -443
- package/dist/__tests__/scanner.test.js.map +0 -1
- package/dist/cli.d.ts +0 -10
- package/dist/cli.d.ts.map +0 -1
- package/dist/cli.js +0 -230
- package/dist/cli.js.map +0 -1
- package/dist/index.d.ts +0 -11
- package/dist/index.d.ts.map +0 -1
- package/dist/index.js +0 -25
- package/dist/index.js.map +0 -1
- package/dist/ioc-db.d.ts +0 -13
- package/dist/ioc-db.d.ts.map +0 -1
- package/dist/ioc-db.js +0 -130
- package/dist/ioc-db.js.map +0 -1
- package/dist/patterns.d.ts +0 -27
- package/dist/patterns.d.ts.map +0 -1
- package/dist/patterns.js +0 -92
- package/dist/patterns.js.map +0 -1
- package/dist/quarantine.d.ts +0 -18
- package/dist/quarantine.d.ts.map +0 -1
- package/dist/quarantine.js +0 -42
- package/dist/quarantine.js.map +0 -1
- package/dist/runtime.d.ts +0 -58
- package/dist/runtime.d.ts.map +0 -1
- package/dist/runtime.js +0 -198
- package/dist/runtime.js.map +0 -1
- package/dist/scanner.d.ts +0 -59
- package/dist/scanner.d.ts.map +0 -1
- package/dist/scanner.js +0 -1134
- package/dist/scanner.js.map +0 -1
- package/dist/types.d.ts +0 -167
- package/dist/types.d.ts.map +0 -1
- package/dist/types.js +0 -7
- package/dist/types.js.map +0 -1
- package/docs/OPENCLAW_DOCS_PR_READY_PATCH.md +0 -88
- package/docs/OPENCLAW_HOOK_SCHEMA_REFERENCE_DRAFT.md +0 -78
- package/docs/TASKLIST_RESEARCH_FIRST_V1.md +0 -47
- package/docs/html-report-preview.png +0 -0
- package/ts-src/__tests__/fixtures/clean-skill/SKILL.md +0 -9
- package/ts-src/__tests__/fixtures/compaction-skill/SKILL.md +0 -11
- package/ts-src/__tests__/fixtures/malicious-skill/SKILL.md +0 -11
- package/ts-src/__tests__/fixtures/malicious-skill/scripts/evil.js +0 -25
- package/ts-src/__tests__/fixtures/prompt-leakage-skill/SKILL.md +0 -20
- package/ts-src/__tests__/fixtures/prompt-leakage-skill/scripts/debug.js +0 -4
- package/ts-src/__tests__/scanner.test.ts +0 -609
- package/ts-src/cli.ts +0 -211
- package/ts-src/index.ts +0 -27
- package/ts-src/ioc-db.ts +0 -131
- package/ts-src/patterns.ts +0 -104
- package/ts-src/quarantine.ts +0 -48
- package/ts-src/runtime.ts +0 -240
- package/ts-src/scanner.ts +0 -1118
- package/ts-src/types.ts +0 -189
package/ts-src/types.ts
DELETED
|
@@ -1,189 +0,0 @@
|
|
|
1
|
-
/**
|
|
2
|
-
* guard-scanner v3.0.0 — Type Definitions
|
|
3
|
-
* TypeScript rewrite with full type safety
|
|
4
|
-
*/
|
|
5
|
-
|
|
6
|
-
// ── Severity & Verdict ──────────────────────────────────────────────────────
|
|
7
|
-
|
|
8
|
-
export type Severity = 'CRITICAL' | 'HIGH' | 'MEDIUM' | 'LOW';
|
|
9
|
-
|
|
10
|
-
export type VerdictLabel = 'MALICIOUS' | 'SUSPICIOUS' | 'LOW RISK' | 'CLEAN';
|
|
11
|
-
export type VerdictStat = 'malicious' | 'suspicious' | 'low' | 'clean';
|
|
12
|
-
|
|
13
|
-
export interface Verdict {
|
|
14
|
-
icon: string;
|
|
15
|
-
label: VerdictLabel;
|
|
16
|
-
stat: VerdictStat;
|
|
17
|
-
}
|
|
18
|
-
|
|
19
|
-
// ── File Types ──────────────────────────────────────────────────────────────
|
|
20
|
-
|
|
21
|
-
export type FileType = 'code' | 'doc' | 'data' | 'skill-doc' | 'other';
|
|
22
|
-
|
|
23
|
-
// ── Findings ────────────────────────────────────────────────────────────────
|
|
24
|
-
|
|
25
|
-
export interface Finding {
|
|
26
|
-
severity: Severity;
|
|
27
|
-
id: string;
|
|
28
|
-
cat: string;
|
|
29
|
-
desc: string;
|
|
30
|
-
file: string;
|
|
31
|
-
line?: number;
|
|
32
|
-
matchCount?: number;
|
|
33
|
-
sample?: string;
|
|
34
|
-
}
|
|
35
|
-
|
|
36
|
-
export interface SkillResult {
|
|
37
|
-
skill: string;
|
|
38
|
-
risk: number;
|
|
39
|
-
verdict: VerdictLabel;
|
|
40
|
-
findings: Finding[];
|
|
41
|
-
}
|
|
42
|
-
|
|
43
|
-
// ── Patterns ────────────────────────────────────────────────────────────────
|
|
44
|
-
|
|
45
|
-
export interface PatternRule {
|
|
46
|
-
id: string;
|
|
47
|
-
cat: string;
|
|
48
|
-
regex: RegExp;
|
|
49
|
-
severity: Severity;
|
|
50
|
-
desc: string;
|
|
51
|
-
codeOnly?: boolean;
|
|
52
|
-
docOnly?: boolean;
|
|
53
|
-
all?: boolean;
|
|
54
|
-
/** OWASP LLM Top 10 2025 mapping (e.g. 'LLM01', 'LLM06') */
|
|
55
|
-
owasp?: string;
|
|
56
|
-
}
|
|
57
|
-
|
|
58
|
-
export interface CustomRuleInput {
|
|
59
|
-
id: string;
|
|
60
|
-
pattern: string;
|
|
61
|
-
flags?: string;
|
|
62
|
-
severity: Severity;
|
|
63
|
-
cat: string;
|
|
64
|
-
desc: string;
|
|
65
|
-
codeOnly?: boolean;
|
|
66
|
-
docOnly?: boolean;
|
|
67
|
-
}
|
|
68
|
-
|
|
69
|
-
// ── IoC Database ────────────────────────────────────────────────────────────
|
|
70
|
-
|
|
71
|
-
export interface IoC_Database {
|
|
72
|
-
ips: string[];
|
|
73
|
-
domains: string[];
|
|
74
|
-
urls: string[];
|
|
75
|
-
usernames: string[];
|
|
76
|
-
filenames: string[];
|
|
77
|
-
typosquats: string[];
|
|
78
|
-
}
|
|
79
|
-
|
|
80
|
-
// ── Signature Database (hbg-scan compatible) ────────────────────────────────
|
|
81
|
-
|
|
82
|
-
export interface ThreatSignature {
|
|
83
|
-
id: string;
|
|
84
|
-
name: string;
|
|
85
|
-
severity: Severity;
|
|
86
|
-
description: string;
|
|
87
|
-
hash?: string; // SHA-256 content hash match
|
|
88
|
-
patterns?: string[]; // String patterns to match
|
|
89
|
-
domains?: string[]; // Suspicious domains
|
|
90
|
-
}
|
|
91
|
-
|
|
92
|
-
export interface SignatureDatabase {
|
|
93
|
-
version: string;
|
|
94
|
-
updated: string;
|
|
95
|
-
signatures: ThreatSignature[];
|
|
96
|
-
}
|
|
97
|
-
|
|
98
|
-
// ── Scanner Options ─────────────────────────────────────────────────────────
|
|
99
|
-
|
|
100
|
-
export interface ScannerOptions {
|
|
101
|
-
verbose?: boolean;
|
|
102
|
-
selfExclude?: boolean;
|
|
103
|
-
strict?: boolean;
|
|
104
|
-
summaryOnly?: boolean;
|
|
105
|
-
/** Suppress all console.log output (v3.2.0: for --format stdout piping) */
|
|
106
|
-
quiet?: boolean;
|
|
107
|
-
checkDeps?: boolean;
|
|
108
|
-
rulesFile?: string;
|
|
109
|
-
plugins?: string[];
|
|
110
|
-
}
|
|
111
|
-
|
|
112
|
-
// ── Scanner Stats ───────────────────────────────────────────────────────────
|
|
113
|
-
|
|
114
|
-
export interface ScanStats {
|
|
115
|
-
scanned: number;
|
|
116
|
-
clean: number;
|
|
117
|
-
low: number;
|
|
118
|
-
suspicious: number;
|
|
119
|
-
malicious: number;
|
|
120
|
-
}
|
|
121
|
-
|
|
122
|
-
// ── Thresholds ──────────────────────────────────────────────────────────────
|
|
123
|
-
|
|
124
|
-
export interface Thresholds {
|
|
125
|
-
suspicious: number;
|
|
126
|
-
malicious: number;
|
|
127
|
-
}
|
|
128
|
-
|
|
129
|
-
// ── Reports ─────────────────────────────────────────────────────────────────
|
|
130
|
-
|
|
131
|
-
export interface JSONReport {
|
|
132
|
-
timestamp: string;
|
|
133
|
-
scanner: string;
|
|
134
|
-
mode: 'strict' | 'normal';
|
|
135
|
-
stats: ScanStats;
|
|
136
|
-
thresholds: Thresholds;
|
|
137
|
-
findings: SkillResult[];
|
|
138
|
-
recommendations: Recommendation[];
|
|
139
|
-
iocVersion: string;
|
|
140
|
-
signaturesVersion?: string;
|
|
141
|
-
}
|
|
142
|
-
|
|
143
|
-
export interface Recommendation {
|
|
144
|
-
skill: string;
|
|
145
|
-
actions: string[];
|
|
146
|
-
}
|
|
147
|
-
|
|
148
|
-
// ── SARIF ───────────────────────────────────────────────────────────────────
|
|
149
|
-
|
|
150
|
-
export interface SARIFReport {
|
|
151
|
-
version: string;
|
|
152
|
-
$schema: string;
|
|
153
|
-
runs: SARIFRun[];
|
|
154
|
-
}
|
|
155
|
-
|
|
156
|
-
export interface SARIFRun {
|
|
157
|
-
tool: {
|
|
158
|
-
driver: {
|
|
159
|
-
name: string;
|
|
160
|
-
version: string;
|
|
161
|
-
informationUri: string;
|
|
162
|
-
rules: SARIFRule[];
|
|
163
|
-
};
|
|
164
|
-
};
|
|
165
|
-
results: SARIFResult[];
|
|
166
|
-
invocations: Array<{ executionSuccessful: boolean; endTimeUtc: string }>;
|
|
167
|
-
}
|
|
168
|
-
|
|
169
|
-
export interface SARIFRule {
|
|
170
|
-
id: string;
|
|
171
|
-
name: string;
|
|
172
|
-
shortDescription: { text: string };
|
|
173
|
-
defaultConfiguration: { level: string };
|
|
174
|
-
properties: { tags: string[]; 'security-severity': string };
|
|
175
|
-
}
|
|
176
|
-
|
|
177
|
-
export interface SARIFResult {
|
|
178
|
-
ruleId: string;
|
|
179
|
-
ruleIndex: number;
|
|
180
|
-
level: string;
|
|
181
|
-
message: { text: string };
|
|
182
|
-
partialFingerprints: { primaryLocationLineHash: string };
|
|
183
|
-
locations: Array<{
|
|
184
|
-
physicalLocation: {
|
|
185
|
-
artifactLocation: { uri: string; uriBaseId: string };
|
|
186
|
-
region?: { startLine: number };
|
|
187
|
-
};
|
|
188
|
-
}>;
|
|
189
|
-
}
|