penthera 1.1.0 → 1.2.0

package/lib/retirejs.js

@@ -14,8 +14,13 @@
  *   https://raw.githubusercontent.com/nickvergessen/retire.js/master/repository/jsrepository.json
  */
 
-const DB_URL =
-  "https://raw.githubusercontent.com/nickvergessen/retire.js/master/repository/jsrepository.json";
+// Upstream RetireJS repository. This previously pointed at a personal fork that
+// now 404s, which made every scan silently report "no vulnerable libraries".
+// A vulnerability database that fails closed and quietly is worse than none.
+const DB_URLS = [
+  "https://raw.githubusercontent.com/RetireJS/retire.js/master/repository/jsrepository.json",
+  "https://cdn.jsdelivr.net/gh/RetireJS/retire.js@master/repository/jsrepository.json",
+];
 const DB_CACHE_MS = 3600_000; // 1 hour
 
 let cachedDb = null;
@@ -38,16 +43,22 @@ async function safeFetch(url, timeout = 15_000) {
 async function loadDb() {
   if (cachedDb && Date.now() - cachedAt < DB_CACHE_MS) return cachedDb;
 
-  const res = await safeFetch(DB_URL);
-  if (!res || !res.ok) return null;
-
-  try {
-    cachedDb = await res.json();
-    cachedAt = Date.now();
-    return cachedDb;
-  } catch {
-    return null;
+  // Try each mirror in turn so one host being down doesn't disable the check.
+  for (const url of DB_URLS) {
+    const res = await safeFetch(url);
+    if (!res || !res.ok) continue;
+    try {
+      const db = await res.json();
+      if (db && typeof db === "object" && Object.keys(db).length > 0) {
+        cachedDb = db;
+        cachedAt = Date.now();
+        return cachedDb;
+      }
+    } catch {
+      // Malformed response from this mirror; try the next.
+    }
   }
+  return null;
 }
 
 // ── Version comparison ───────────────────────────────────────────────────
@@ -149,8 +160,21 @@ export async function scanJsLibraries(baseUrl, opts = {}) {
   progress("Fetching Retire.js vulnerability database...");
   const db = await loadDb();
   if (!db) {
-    return result; // Can't check without DB
+    // Never return a silent "no vulnerable libraries" when the check could not
+    // run. Say so, and tell the caller the probe did not really execute.
+    result.dbLoaded = false;
+    result.findings.push({
+      severity: "info",
+      title: "JS dependency check did not run",
+      description: "Could not load the Retire.js vulnerability database (offline, or every mirror unreachable). Known-CVE checks on client-side JavaScript were skipped for this scan; this is not a clean result.",
+      url: baseUrl,
+      category: "config",
+      source: "retirejs",
+      confidence: "confirmed",
+    });
+    return result;
   }
+  result.dbLoaded = true;
 
   // Fetch the target page HTML
   const res = await safeFetch(baseUrl, timeout);

package/lib/templates.js

@@ -85,6 +85,24 @@ export async function executeTemplate(baseUrl, template) {
 /**
  * Run a single matcher against response data.
  */
+// Community templates are untrusted input: they arrive as YAML from a directory
+// the user points us at, and their regexes run against whole response bodies.
+// A catastrophically-backtracking pattern would hang the scanner, so bound both
+// the input and the pattern. This is a mitigation, not an immunity proof: real
+// guarantees need a non-backtracking engine or a killable worker.
+const REGEX_INPUT_CAP = 256 * 1024; // 256 KB is far past any real matcher's needs
+const NESTED_QUANTIFIER = /(\([^)]*[+*][^)]*\)|\[[^\]]*\][^)]*)[+*]\s*[+*]|\((?:\?:)?[^)]*[+*]\)[+*]/;
+
+function safeRegexTest(pattern, target, flags = "") {
+  if (NESTED_QUANTIFIER.test(String(pattern))) return false; // refuse the shape that blows up
+  try {
+    const input = target.length > REGEX_INPUT_CAP ? target.slice(0, REGEX_INPUT_CAP) : target;
+    return new RegExp(pattern, flags).test(input);
+  } catch {
+    return false; // invalid pattern in a template must not abort the scan
+  }
+}
+
 function runMatcher(matcher, ctx) {
   const part = matcher.part || "body";
   const target = part === "header" ? ctx.headers : ctx.body;
@@ -103,7 +121,7 @@ function runMatcher(matcher, ctx) {
 
     case "regex": {
       const patterns = matcher.regex || [];
-      const check = (p) => new RegExp(p, matcher.flags || "").test(target);
+      const check = (p) => safeRegexTest(p, target, matcher.flags);
       return matcher.condition === "and"
         ? patterns.every(check)
         : patterns.some(check);
@@ -116,7 +134,7 @@ function runMatcher(matcher, ctx) {
 
     case "negative-regex": {
       const patterns = matcher.regex || [];
-      return patterns.every(p => !new RegExp(p).test(target));
+      return patterns.every(p => !safeRegexTest(p, target));
     }
 
     default:
@@ -134,7 +152,9 @@ function runExtractor(extractor, ctx) {
   switch (extractor.type) {
     case "regex": {
       for (const pattern of extractor.regex || []) {
-        const match = target.match(new RegExp(pattern));
+        if (NESTED_QUANTIFIER.test(String(pattern))) continue;
+        const capped = target.length > REGEX_INPUT_CAP ? target.slice(0, REGEX_INPUT_CAP) : target;
+        const match = capped.match(new RegExp(pattern));
         if (match) return match[extractor.group || 0];
       }
       return null;
@@ -182,7 +202,11 @@ export const BUILT_IN_TEMPLATES = [
       method: "GET", path: "/.env.local",
       matchers: [
         { type: "status", status: [200] },
-        { type: "word", words: ["="], condition: "or" },
+        // Must look like a dotenv file, not just any 200 containing "=".
+        // SPAs serve index.html for unknown paths, and HTML is full of "=",
+        // which made this fire critical on healthy sites.
+        { type: "regex", regex: ["(?m)^[A-Z][A-Z0-9_]{2,}="] },
+        { type: "negative-word", words: ["<html", "<!DOCTYPE", "<script"] },
       ],
       "matchers-condition": "and",
     }],
@@ -247,7 +271,10 @@ export const BUILT_IN_TEMPLATES = [
       method: "GET", path: "/.json",
       matchers: [
         { type: "status", status: [200] },
-        { type: "negative-word", words: ["Permission denied", "error"] },
+        // Require an actual JSON body. Without this an SPA's index.html served
+        // at /.json counted as an open Firebase database.
+        { type: "regex", regex: ["^\\s*[\\{\\[]"] },
+        { type: "negative-word", words: ["Permission denied", "error", "<html", "<!DOCTYPE"] },
       ],
       "matchers-condition": "and",
     }],

package/lib/whitebox/secrets.js

@@ -21,7 +21,23 @@ const TEST_VALUE = /\b(?:placeholder|example|changeme|dummy|sample|redacted|inva
 const SECRET_PATTERNS = [
   { name: "AWS access key", pattern: /AKIA[0-9A-Z]{16}/, severity: "critical" },
   { name: "GitHub token", pattern: /ghp_[a-zA-Z0-9]{36,}/, severity: "critical" },
-  { name: "OpenAI API key", pattern: /sk-[a-zA-Z0-9]{20,}/, severity: "critical" },
+  // AI provider keys. Vibecoded apps leak these more than any other credential,
+  // often via a NEXT_PUBLIC_/VITE_ variable or a committed notebook. Specific
+  // prefixes come first so a key is reported under its real provider.
+  { name: "Anthropic API key", pattern: /sk-ant-(?:api|admin)\d{2}-[A-Za-z0-9_-]{32,}/, severity: "critical" },
+  { name: "OpenRouter API key", pattern: /sk-or-v1-[a-f0-9]{64}/, severity: "critical" },
+  { name: "OpenAI API key", pattern: /sk-(?:proj|svcacct|admin)-[A-Za-z0-9_-]{20,}/, severity: "critical" },
+  { name: "OpenAI API key (legacy format)", pattern: /sk-[a-zA-Z0-9]{20,}/, severity: "critical" },
+  // AIza keys are also Firebase web keys, which are public by design, so this
+  // is high rather than critical: it matters if the key has Gemini/Vertex access.
+  { name: "Google API key (Gemini / Firebase / Maps)", pattern: /AIza[0-9A-Za-z_-]{35}/, severity: "high" },
+  { name: "Groq API key", pattern: /gsk_[A-Za-z0-9]{48,}/, severity: "critical" },
+  { name: "Hugging Face token", pattern: /hf_[A-Za-z0-9]{34,}/, severity: "critical" },
+  { name: "Replicate API token", pattern: /r8_[A-Za-z0-9]{37,}/, severity: "critical" },
+  { name: "xAI API key", pattern: /xai-[A-Za-z0-9]{70,}/, severity: "critical" },
+  { name: "Perplexity API key", pattern: /pplx-[A-Za-z0-9]{40,}/, severity: "critical" },
+  { name: "LangSmith API key", pattern: /lsv2_(?:pt|sk)_[a-f0-9]{32}_[a-f0-9]{10}/, severity: "high" },
+  { name: "Pinecone API key", pattern: /pcsk_[A-Za-z0-9_]{50,}/, severity: "high" },
   { name: "Stripe secret key", pattern: /sk_live_[a-zA-Z0-9]{20,}/, severity: "critical" },
   {
     name: "Generic API key assignment",
@@ -35,8 +51,8 @@ const SECRET_PATTERNS = [
     severity: "high",
     skipIf: TEST_VALUE,
   },
-  { name: "Private key block", pattern: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/, severity: "critical" },
   { name: "GCP/Firebase service account", pattern: /"private_key"\s*:\s*"-----BEGIN/, severity: "critical" },
+  { name: "Private key block", pattern: /-----BEGIN (?:RSA |EC |OPENSSH )?PRIVATE KEY-----/, severity: "critical" },
   {
     name: "JWT secret assignment",
     pattern: /(?:jwt[_-]?secret|session[_-]?secret)\s*[:=]\s*['"][^'"\s]{8,}['"]/i,
@@ -48,6 +64,7 @@ const SECRET_PATTERNS = [
 const SCAN_EXTENSIONS = new Set([
   ".js", ".ts", ".jsx", ".tsx", ".mjs", ".cjs", ".py", ".rb", ".go", ".java",
   ".env", ".yaml", ".yml", ".json", ".toml", ".cfg", ".ini", ".sh",
+  ".ipynb", // notebooks are a classic place for a pasted provider key
 ]);
 
 function walkFiles(dir, files = []) {
@@ -69,9 +86,34 @@ function maskMatch(match) {
   return match.length <= 8 ? "***" : match.slice(0, 4) + "…" + match.slice(-4);
 }
 
+/**
+ * Find secrets in a string of text (a source file, a JS bundle, a config).
+ * Returns one hit per rule: `{ name, severity, match }`, with the raw match so
+ * callers decide how to mask it. At most one rule fires per provider key: once a
+ * specific AI-provider rule matches a span, broader rules skip that span.
+ */
+export function findSecretsInText(content) {
+  const hits = [];
+  const claimed = [];
+  for (const rule of SECRET_PATTERNS) {
+    const match = content.match(rule.pattern);
+    if (!match) continue;
+    // For assignment-style rules, test the placeholder/dummy filter against
+    // the assigned value only (not the whole `key = "value"` match), so a
+    // variable named e.g. `testToken` can't mask a real secret.
+    const value = (match[0].match(/['"]([^'"]+)['"]/) || [, match[0]])[1];
+    if (rule.skipIf && rule.skipIf.test(value)) continue;
+    const start = match.index;
+    const end = start + match[0].length;
+    if (claimed.some(([a, b]) => start < b && end > a)) continue;
+    claimed.push([start, end]);
+    hits.push({ name: rule.name, severity: rule.severity, match: match[0] });
+  }
+  return hits;
+}
+
 export function scanSecrets(repoPath) {
   const findings = [];
-  const seen = new Set();
 
   for (const filePath of walkFiles(repoPath)) {
     let content;
@@ -83,23 +125,11 @@ export function scanSecrets(repoPath) {
 
     const rel = relative(repoPath, filePath);
 
-    for (const rule of SECRET_PATTERNS) {
-      const match = content.match(rule.pattern);
-      if (!match) continue;
-      // For assignment-style rules, test the placeholder/dummy filter against
-      // the assigned value only (not the whole `key = "value"` match), so a
-      // variable named e.g. `testToken` can't mask a real secret.
-      const value = (match[0].match(/['"]([^'"]+)['"]/) || [, match[0]])[1];
-      if (rule.skipIf && rule.skipIf.test(value)) continue;
-
-      const key = `${rel}::${rule.name}`;
-      if (seen.has(key)) continue;
-      seen.add(key);
-
+    for (const hit of findSecretsInText(content)) {
       findings.push({
-        severity: rule.severity,
-        title: `${rule.name} in source`,
-        description: `Possible secret in \`${rel}\`: \`${maskMatch(match[0])}\``,
+        severity: hit.severity,
+        title: `${hit.name} in source`,
+        description: `Possible secret in \`${rel}\`: \`${maskMatch(hit.match)}\``,
         url: rel,
         category: "secrets",
         source: "secret-scan",

package/package.json

@@ -1,8 +1,8 @@
 {
   "name": "penthera",
-  "version": "1.1.0",
+  "version": "1.2.0",
   "type": "module",
-  "description": "Lightweight security scanner for web apps — scan URLs or repos from the CLI",
+  "description": "Security scanner for web apps and AI-built code: scan URLs and repos from Claude Code, Cursor or the CLI. OWASP-mapped, SARIF output, NIS2 evidence. Authorized testing only.",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/danoszz/penthera.git"
@@ -12,8 +12,8 @@
     "url": "https://github.com/danoszz/penthera/issues"
   },
   "bin": {
-    "penthera": "./bin/penthera.js",
-    "penthera-scan": "./bin/scan.js"
+    "penthera": "bin/penthera.js",
+    "penthera-scan": "bin/scan.js"
   },
   "files": [
     "bin",
@@ -21,7 +21,6 @@
     "lib",
     "skills",
     "docs",
-    "scripts/package-skill.sh",
     "pentest.config.example.js",
     "CHANGELOG.md",
     "LICENSE",
@@ -34,7 +33,7 @@
     "./wstg": "./lib/owasp-wstg.js"
   },
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "scripts": {
     "test": "vitest run --reporter=verbose",
@@ -42,7 +41,6 @@
     "scan:full": "node bin/scan.js",
     "pentest": "vitest run --reporter=verbose",
     "pentest:watch": "vitest --reporter=verbose",
-    "pentest:static": "vitest run tests/pentest-static.test.js --reporter=verbose",
     "pentest:live": "vitest run tests/pentest-live.test.js --reporter=verbose",
     "pentest:adaptive": "vitest run tests/pentest-adaptive.test.js --reporter=verbose",
     "pentest:recon": "vitest run tests/pentest-recon.test.js --reporter=verbose",
@@ -68,9 +66,9 @@
   ],
   "license": "MIT",
   "devDependencies": {
-    "vitest": "^3.1.1"
+    "vitest": "^5.0.5"
   },
   "dependencies": {
-    "yaml": "^2.8.3"
+    "yaml": "^2.9.1"
   }
 }

package/skills/penthera/SKILL.md

@@ -9,11 +9,11 @@ description: >
   against a baseline; or find hardcoded secrets before deploy. Do NOT use for targets
   without explicit authorization.
 license: MIT
-compatibility: Node.js 18+, network access to target, Penthera CLI (npm link or node bin/penthera.js from repo). macOS only for --machine.
+compatibility: Node.js 22+, network access to target, Penthera CLI (npm link or node bin/penthera.js from repo). macOS only for --machine.
 allowed-tools: "Bash(node:*) Bash(npm:*) Bash(penthera:*) Read Write Edit"
 metadata:
   author: danoszz
-  version: 1.1.0
+  version: 1.2.0
   category: security
 ---
 

package/skills/penthera/references/output-and-ci.md

@@ -44,59 +44,21 @@ Output includes: new findings count, resolved count, unchanged count. Use for we
 
 ## GitHub Actions
 
-**Penthera CI** (`.github/workflows/ci.yml`) runs on every push:
+**Penthera's own CI** (`.github/workflows/ci.yml`) runs on every push and PR:
 
-1. Unit + mock server tests
-2. Skill preflight check
-3. Scan against the local mock API → JSON + SARIF
-4. `validate-report.mjs` on the JSON output
-5. SARIF upload to GitHub Security tab
+1. The full test suite (`npm test`) on Node 22 and 24
+2. A scan of the deliberately vulnerable mock API, producing JSON + SARIF
+3. `validate-report.mjs` on the JSON output, plus the skill preflight
 
-For **your staging URL**, copy `.github/workflows/scan.example.yml` to `scan.yml`:
+The mock-server SARIF is kept as a build artifact, not uploaded to code scanning,
+because those findings are about the test fixture, not the repo.
 
-```yaml
-name: Security Scan
-
-on:
-  workflow_dispatch:
-  schedule:
-    - cron: "0 6 * * 1"
-
-jobs:
-  penthera:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-
-      - uses: actions/setup-node@v4
-        with:
-          node-version: 20
-          cache: npm
-
-      - run: npm ci
-
-      - name: Scan staging URL
-        env:
-          PENTEST_URL: ${{ secrets.PENTEST_STAGING_URL }}
-        run: |
-          node bin/penthera.js "$PENTEST_URL" \
-            --profile standard \
-            -o reports/scan.json \
-            --sarif reports/scan.sarif
-
-      - uses: github/codeql-action/upload-sarif@v3
-        if: always()
-        with:
-          sarif_file: reports/scan.sarif
-
-      - uses: actions/upload-artifact@v4
-        if: always()
-        with:
-          name: penthera-reports
-          path: reports/
-```
-
-Store `PENTEST_STAGING_URL` as a repository secret.
+**For your own staging URL**, copy
+[`docs/examples/github-actions-scan.yml`](https://github.com/danoszz/penthera/blob/main/docs/examples/github-actions-scan.yml)
+into your app's repo as `.github/workflows/penthera.yml` and add a
+`PENTEST_STAGING_URL` repository secret. It runs `npx penthera@<version>` on a
+weekly schedule and uploads SARIF to your Security tab. Pin the version so a
+scheduled run never picks up code you have not reviewed.
 
 ## Agent reporting workflow
 

package/skills/penthera/references/troubleshooting.md

@@ -21,7 +21,7 @@ penthera https://myapp.com --verbose --timeout 30000
 
 **Symptoms:** `node: command not found` or engine error
 
-**Solution:** Install Node.js 18+ from [nodejs.org](https://nodejs.org/). Verify:
+**Solution:** Install Node.js 22+ from [nodejs.org](https://nodejs.org/). Verify:
 
 ```bash
 node -v   # should be v18.x or higher

package/skills/penthera/scripts/preflight.sh

@@ -20,14 +20,14 @@ ok() {
   echo "preflight: OK: $*"
 }
 
-# Node.js 18+
+# Node.js 22+
 if ! command -v node >/dev/null 2>&1; then
-  fail "Node.js not found. Install Node.js 18+ from https://nodejs.org/"
+  fail "Node.js not found. Install Node.js 22+ from https://nodejs.org/"
 fi
 
 NODE_MAJOR=$(node -e "process.stdout.write(String(process.version).replace(/^v/, '').split('.')[0])")
-if [ "$NODE_MAJOR" -lt 18 ]; then
-  fail "Node.js $(node -v) is too old. Requires Node.js 18+."
+if [ "$NODE_MAJOR" -lt 22 ]; then
+  fail "Node.js $(node -v) is too old. Requires Node.js 22+."
 fi
 ok "Node.js $(node -v)"
 

package/src/cli/baseline.js

@@ -2,10 +2,13 @@
  * Compare scan findings against a previous JSON report.
  */
 import { readFileSync } from "node:fs";
+import { fingerprintFinding } from "../../lib/audit-loop.js";
 
-function findingKey(f) {
-  return `${f.severity}::${f.title}::${f.url || ""}::${f.source || ""}`;
-}
+// Shared with dedupe and the audit loop so one finding has one identity
+// everywhere. Deliberately excludes severity: a finding whose severity is
+// re-rated is the same finding, and keying on it made every re-rating show up
+// as one resolved plus one new.
+const findingKey = fingerprintFinding;
 
 export function compareWithBaseline(currentFindings, baselinePath) {
   let baseline;

package/src/cli/merge-results.js

@@ -3,6 +3,7 @@
  */
 import { enrichFindingsWithWstg } from "../../lib/owasp-wstg.js";
 import { stampProvenance } from "../../lib/provenance.js";
+import { fingerprintFinding } from "../../lib/audit-loop.js";
 
 export function mergeResults(results) {
   let merged;
@@ -63,7 +64,8 @@ function mergeEndpoints(results) {
 export function dedupeFindings(findings) {
   const seen = new Set();
   return findings.filter((f) => {
-    const key = `${f.severity}::${f.title}::${f.url || ""}::${f.source || ""}`;
+    // Same identity function as the baseline diff and the audit loop.
+    const key = fingerprintFinding(f);
     if (seen.has(key)) return false;
     seen.add(key);
     return true;

package/src/cli.js

@@ -453,7 +453,7 @@ export async function run() {
     if (!opts.quiet && !opts.json) {
       const s = merged.readiness.summary;
       process.stderr.write(
-        `  NIS2 readiness  ${s.met} met · ${s.partial} partial · ${s.gap} gap · ${s["n/a"]} n/a\n`,
+        `  NIS2 readiness  ${s.met} met · ${s.partial} partial · ${s.gap} gap · ${s["not-assessed"]} not assessed\n`,
       );
       process.stderr.write(`  Readiness report ${rdPath}\n`);
     }

package/src/reporter.js

@@ -319,7 +319,11 @@ export function printReport(result, opts = {}) {
     for (const f of sorted) {
       const colorFn = SEV_COLOR[f.severity] || c.dim;
       const label = SEV_LABEL[f.severity] || "    ";
-      w(`  ${colorFn(label)}  ${f.title}`);
+      // Flag the ones a scanner genuinely can't adjudicate, so nobody reads a
+      // heuristic as a confirmed break. Certainties stay unannotated.
+      const needsReview = f.confidence === "needs-human-review" || f.confidence === "potential";
+      const tag = needsReview ? c.dim(` [${f.confidence}]`) : "";
+      w(`  ${colorFn(label)}  ${f.title}${tag}`);
       if (f.url)  w(`  ${" ".repeat(6)} ${c.dim(f.url)}${f.status ? c.dim(` \u2192 ${f.status}`) : ""}`);
       if (f.description && opts.verbose) w(`  ${" ".repeat(6)} ${c.dim(f.description)}`);
     }
@@ -457,7 +461,12 @@ export function writeSarifReport(result, filePath) {
       }] : [],
       properties: {
         severity: f.severity,
+        // Provenance travels with the finding into GitHub code scanning, so a
+        // heuristic result stays labelled as one wherever it is consumed.
+        confidence: f.confidence,
         source: f.source,
+        method: f.method,
+        collectedAt: f.collected_at,
         url: f.url,
         httpStatus: f.status,
         wstg: f.wstg || resolveWstgTags(f),

package/src/scan-url.js

@@ -76,6 +76,8 @@ export async function scanUrl(rawTarget, opts = {}) {
   const startTime = Date.now();
 
   const local = isPrivateHost(target);
+  // Set false when the Retire.js database can't load, so we don't claim the probe ran.
+  let retireJsRan = false;
   const hostname = new URL(target).hostname;
   const isIpHost = /^\d{1,3}(\.\d{1,3}){3}$/.test(hostname) || hostname.includes(":");
 
@@ -385,6 +387,9 @@ export async function scanUrl(rawTarget, opts = {}) {
     progress("Scanning for vulnerable JS libraries (Retire.js)...");
     try {
       const jsResult = await scanJsLibraries(target, { onPhase: progress });
+      // Only count the probe as run when its database actually loaded, so the
+      // WSTG and compliance coverage can't claim a check that was skipped.
+      retireJsRan = jsResult.dbLoaded !== false;
       if (jsResult.libraries.length > 0) {
         result.jsLibraries = jsResult.libraries;
       }
@@ -500,6 +505,22 @@ export async function scanUrl(rawTarget, opts = {}) {
         severity: ["critical", "high", "medium"],
       });
       progress(`Loaded ${templates.length} templates, scanning...`);
+      // Templates needing Nuclei features this loader doesn't implement won't
+      // match even against a vulnerable target. Say so rather than letting the
+      // silence read as a clean result.
+      const limited = templates.filter((t) => t.unsupported?.length);
+      if (limited.length > 0) {
+        const reasons = [...new Set(limited.flatMap((t) => t.unsupported))];
+        progress(`${limited.length} template(s) use unsupported features and cannot match: ${reasons.join("; ")}`);
+        result.findings.push({
+          severity: "info",
+          title: `${limited.length} community template(s) could not run fully`,
+          description: `These templates rely on Nuclei features Penthera does not implement (${reasons.join("; ")}), so they cannot produce a match. Their silence is not a clean result. Templates affected: ${limited.slice(0, 5).map((t) => t.id).join(", ")}${limited.length > 5 ? ", ..." : ""}.`,
+          category: "config",
+          source: "plugin-loader",
+          confidence: "confirmed",
+        });
+      }
       const pluginFindings = await runTemplateScan(target, templates, { onPhase: progress });
       result.findings.push(...pluginFindings);
     } catch (e) {
@@ -547,7 +568,7 @@ export async function scanUrl(rawTarget, opts = {}) {
     ...(result.tls ? ["tls"] : []),
     ...(result.fingerprint?.headers ? ["security-headers"] : []),
     ...(auth.bearer ? ["jwt"] : []),
-    ...(!opts.skipRetireJs ? ["retirejs"] : []),
+    ...(!opts.skipRetireJs && retireJsRan ? ["retirejs"] : []),
     ...(!opts.skipParamDiscovery && hadEndpoints ? ["param-discovery"] : []),
     ...(opts.recon && !local ? ["recon"] : []),
     ...(opts.deep && hadEndpoints ? ["sqli", "ssti", "ssrf", "xss", "cmdi", "open-redirect"] : []),

package/scripts/package-skill.sh

@@ -1,16 +0,0 @@
-#!/usr/bin/env bash
-# Package the Agent Skill for Claude.ai upload or GitHub Releases.
-set -euo pipefail
-
-ROOT="$(cd "$(dirname "$0")/.." && pwd)"
-OUT="$ROOT/dist"
-ZIP="$OUT/penthera-skill.zip"
-
-mkdir -p "$OUT"
-rm -f "$ZIP"
-
-cd "$ROOT/skills"
-zip -r "$ZIP" penthera/ -x "*.DS_Store"
-
-echo "Created $ZIP"
-ls -lh "$ZIP"