opencode-gitlab-dap 1.16.6 → 1.17.0

package/README.md

@@ -279,6 +279,27 @@ Say **"bootstrap project memory"** to automatically inspect a project and build
 - **Remove an obsolete skill** — delete a skill and its associated snippet, automatically cleaning up the index entry
 - **Audit available skills** — list all published and draft skills with their descriptions to understand what automation is available for the project
 
+##### Security Audits for skills.sh Skills
+
+When discovering or installing skills from skills.sh, the plugin automatically checks security audit results from three independent providers:
+
+- **Gen Agent Trust Hub** — AI-powered threat detection for malware, data exfiltration, and prompt injection
+- **Socket** — Supply chain security analysis for suspicious patterns and anomalies
+- **Snyk** — Vulnerability scanning and risk assessment
+
+**Behavior:**
+
+- **Block on Fail** — if any audit provider reports a failure, installation is blocked with details and a link to review the audit findings
+- **Warn on Warn** — if any provider reports a warning, the skill is installed but warnings are displayed with links to the audit details
+- **Graceful degradation** — if skills.sh is unreachable or audit data is unavailable, installation proceeds with a note
+
+**Use cases:**
+
+- **Discover skills with security status** — `gitlab_skill_discover` shows audit results (Pass/Warn/Fail) inline for each skills.sh result, so you can assess risk before installing
+- **Block installation of risky skills** — skills with audit failures from any provider are automatically blocked with a link to the full audit report
+- **Review audit warnings before proceeding** — skills with warnings install successfully but display the warnings so you can make an informed decision
+- **Graceful handling of unavailable audit data** — if skills.sh is unreachable, install proceeds with a note rather than failing
+
 ### Dynamic Refresh
 
 After enabling or disabling an agent/flow, the plugin automatically refreshes the

package/dist/index.cjs

@@ -4052,7 +4052,16 @@ function searchSkillsSh(query) {
 function downloadSkillFromSkillsSh(identifier) {
   const tmp = (0, import_fs2.mkdtempSync)((0, import_path2.join)((0, import_os2.tmpdir)(), "skill-install-"));
   try {
-    (0, import_child_process.execSync)(`npx skills add ${JSON.stringify(identifier)} -y --copy`, {
+    const atIdx = identifier.indexOf("@");
+    let cmd;
+    if (atIdx !== -1) {
+      const repo = identifier.slice(0, atIdx);
+      const skill = identifier.slice(atIdx + 1);
+      cmd = `npx skills add ${JSON.stringify(repo)} --skill ${JSON.stringify(skill)} -y --copy`;
+    } else {
+      cmd = `npx skills add ${JSON.stringify(identifier)} -y --copy`;
+    }
+    (0, import_child_process.execSync)(cmd, {
       timeout: 6e4,
       cwd: tmp,
       encoding: "utf-8",
@@ -4105,6 +4114,73 @@ function downloadSkillFromSkillsSh(identifier) {
   }
 }
 
+// src/tools/skill-audit.ts
+var PROVIDER_NAMES = {
+  "agent-trust-hub": "Gen Agent Trust Hub",
+  socket: "Socket",
+  snyk: "Snyk"
+};
+function parseIdentifierToUrl(identifier) {
+  const atIdx = identifier.indexOf("@");
+  if (atIdx === -1) return null;
+  const ownerRepo = identifier.slice(0, atIdx);
+  const skillName = identifier.slice(atIdx + 1);
+  if (!ownerRepo.includes("/") || !skillName) return null;
+  return `https://skills.sh/${ownerRepo}/${skillName}`;
+}
+function parseAuditHtml(html, auditUrl) {
+  const secIdx = html.indexOf("Security Audits");
+  if (secIdx === -1) return null;
+  const section = html.slice(secIdx, secIdx + 5e3);
+  const providerPattern = /href="[^"]*\/security\/(agent-trust-hub|socket|snyk)"[\s\S]*?>(Pass|Fail|Warn)</g;
+  const results = [];
+  let match;
+  while ((match = providerPattern.exec(section)) !== null) {
+    const slug = match[1];
+    const status = match[2];
+    results.push({
+      provider: PROVIDER_NAMES[slug] ?? slug,
+      status,
+      detailUrl: `${auditUrl}/security/${slug}`
+    });
+  }
+  if (results.length === 0) return null;
+  return {
+    results,
+    hasFailure: results.some((r) => r.status === "Fail"),
+    hasWarning: results.some((r) => r.status === "Warn"),
+    auditUrl
+  };
+}
+async function fetchSkillAudit(identifier) {
+  const url = parseIdentifierToUrl(identifier);
+  if (!url) return null;
+  try {
+    const resp = await fetch(url, {
+      signal: AbortSignal.timeout(1e4),
+      headers: { Accept: "text/html" }
+    });
+    if (!resp.ok) return null;
+    const html = await resp.text();
+    return parseAuditHtml(html, url);
+  } catch {
+    return null;
+  }
+}
+function formatAuditLine(audit) {
+  return audit.results.map((r) => {
+    const icon = r.status === "Fail" ? "\u{1F534}" : r.status === "Warn" ? "\u{1F7E1}" : "\u{1F7E2}";
+    return `${icon} ${r.provider}: ${r.status}`;
+  }).join(" | ");
+}
+function formatAuditRate(audit) {
+  const total = audit.results.length;
+  const passed = audit.results.filter((r) => r.status === "Pass").length;
+  if (passed === total) return `Security: ${passed}/${total} audits passed \u2705`;
+  if (audit.hasFailure) return `Security: ${passed}/${total} audits passed \u274C`;
+  return `Security: ${passed}/${total} audits passed \u26A0\uFE0F`;
+}
+
 // src/tools/skill-tools.ts
 var z6 = import_plugin6.tool.schema;
 var PROJECT_ID_DESC2 = "Project path from git remote";
@@ -4389,14 +4465,32 @@ Install: \`gitlab_skill_install(name="${e.name}", source="group", group_id="${ar
         }
         const shResults = searchSkillsSh(args.query);
         if (shResults.length > 0) {
+          const audits = await Promise.all(shResults.map((r) => fetchSkillAudit(r.identifier)));
           sections.push(
             `### skills.sh (${shResults.length})
 
-` + shResults.map(
-              (r) => `**${r.identifier}** (${r.installs})
+` + shResults.map((r, i) => {
+              const audit = audits[i];
+              let line = `**${r.identifier}** (${r.installs})`;
+              if (audit) {
+                line += `
+${formatAuditRate(audit)}`;
+                line += `
+${formatAuditLine(audit)}`;
+                if (audit.hasFailure) {
+                  line += `
+\u26D4 BLOCKED \u2014 security audit failures detected. Review: ${audit.auditUrl}`;
+                  return line;
+                }
+              } else {
+                line += `
+Security: unknown (audit data unavailable)`;
+              }
+              line += `
 ${r.url}
-Install: \`gitlab_skill_install(name="${r.identifier}", source="skills.sh")\``
-            ).join("\n\n")
+Install: \`gitlab_skill_install(name="${r.identifier}", source="skills.sh")\``;
+              return line;
+            }).join("\n\n")
           );
         }
         if (sections.length === 0) {
@@ -4419,6 +4513,14 @@ Install: \`gitlab_skill_install(name="${r.identifier}", source="skills.sh")\``
         const projectScope = resolveScope2(args);
         const targetPrefix = args.draft ? DRAFTS_PREFIX : SKILLS_PREFIX;
         if (args.source === "skills.sh") {
+          const audit = await fetchSkillAudit(args.name);
+          if (audit?.hasFailure) {
+            const failures = audit.results.filter((r) => r.status === "Fail").map((r) => `  \u{1F534} ${r.provider}: Fail (${r.detailUrl})`).join("\n");
+            return `\u26D4 Installation BLOCKED \u2014 security audit failure(s) detected:
+${failures}
+
+Review the audit details before proceeding: ${audit.auditUrl}`;
+          }
           const downloaded = downloadSkillFromSkillsSh(args.name);
           if (!downloaded) {
             return `Failed to download skill "${args.name}" from skills.sh.`;
@@ -4470,7 +4572,19 @@ Install: \`gitlab_skill_install(name="${r.identifier}", source="skills.sh")\``
             }
             const parts = [`${wikiCount} wiki page(s)`];
             if (hasBundle) parts.push(`${scriptFiles.length} bundled script(s)`);
-            return `Installed skill "${downloaded.name}" from skills.sh. ${parts.join(", ")}. Use gitlab_skill_setup to extract scripts.`;
+            let result = `Installed skill "${downloaded.name}" from skills.sh. ${parts.join(", ")}. Use gitlab_skill_setup to extract scripts.`;
+            if (audit?.hasWarning) {
+              const warnings = audit.results.filter((r) => r.status === "Warn").map((r) => `  \u26A0\uFE0F ${r.provider}: Warn (${r.detailUrl})`).join("\n");
+              result += `
+
+\u26A0\uFE0F Security audit warnings:
+${warnings}`;
+            } else if (!audit) {
+              result += `
+
+(security audit data unavailable \u2014 skills.sh may be unreachable)`;
+            }
+            return result;
           } catch (err) {
             return `Error installing from skills.sh: ${err.message}`;
           }