promptgraph-mcp 2.4.5 → 2.4.7

package/registry/training/good/skills-store-validate.md

@@ -0,0 +1,135 @@
+---
+name: validate
+description: Validate a finding — runs 7-Question Gate + 4-gate checklist. Kills weak findings before report writing. Prevents N/A submissions that hurt validity ratio. Usage: /validate
+---
+
+# /validate
+
+Run full validation on the current finding before writing a report.
+
+## What This Does
+
+1. Runs 7-Question Gate (one wrong answer = kill it)
+2. Checks against the always-rejected list
+3. Runs 4 pre-submission gates
+4. Outputs: PASS (write the report) or KILL (move on)
+
+## Usage
+
+```
+/validate
+```
+
+Describe the finding when prompted. Include:
+- The endpoint
+- The bug class
+- What the PoC shows
+- The target program
+
+## The 7-Question Gate
+
+Answer each. ONE wrong answer = STOP.
+
+### Q1: Can I demonstrate this step-by-step RIGHT NOW?
+
+Write this out:
+```
+1. Setup:   I need [own account / another user's ID / no account]
+2. Request: [exact HTTP method, URL, headers, body]
+3. Result:  Response shows [exact data / action completed]
+4. Impact:  Real consequence is [account takeover / PII exposed / money stolen]
+5. Cost:    Time: [X min], Capital: [$0 / $X]
+```
+
+If step 2 is "I need to look at the code more" → KILL IT.
+
+### Q2: Is the impact accepted by this program?
+
+Check program scope page. Is your bug class listed? Is it excluded?
+
+### Q3: Is the vulnerable asset in scope?
+
+Exact domain in scope? Not staging/dev? Not a third-party service?
+
+### Q4: Does it need admin or privileged access that an attacker can't get?
+
+"Admin can do X" → KILL IT.
+"Regular user can do X that only admin should" → valid.
+
+### Q5: Is this known or documented behavior?
+
+Search disclosed reports + changelog + API docs.
+
+### Q6: Can you prove impact beyond "technically possible"?
+
+- XSS → actual cookie value in exfil request, not just alert()
+- SSRF → response body from internal service, not just DNS callback
+- IDOR → actual other-user's private data in response, not just 200 status
+
+### Q7: Is this on the never-submit list?
+
+```
+Missing headers, GraphQL introspection alone, clickjacking without PoC,
+self-XSS, open redirect alone, SSRF DNS-only, logout CSRF, banner disclosure,
+rate limit on non-critical forms, missing cookie flags alone...
+```
+
+If yes → KILL IT unless you have a chain.
+
+## Check: Conditionally Valid?
+
+If it's on the never-submit list, can you chain it?
+
+| You Have | Chain Available? |
+|---|---|
+| Open redirect | + OAuth code theft → ATO? |
+| SSRF DNS-only | + internal service data? |
+| Clickjacking | + sensitive action + PoC? |
+| CORS wildcard | + credentialed data exfil? |
+| Prompt injection | + IDOR → other user's data? |
+
+If no chain → KILL IT. If chain confirmed → report both together.
+
+## 4 Gates — All Must Pass
+
+**Gate 0 (30 sec):**
+```
+[ ] Confirmed with real HTTP requests (not just code reading)
+[ ] In scope (checked program page)
+[ ] Reproducible from scratch
+[ ] Evidence captured
+```
+
+**Gate 1 — Impact (2 min):**
+```
+[ ] Can answer "What does attacker walk away with?"
+[ ] More than "sees non-sensitive data"
+[ ] Real victim exists
+[ ] No unlikely preconditions
+```
+
+**Gate 2 — Dedup (5 min):**
+```
+[ ] Searched HackerOne Hacktivity for endpoint + bug class
+[ ] Searched GitHub issues
+[ ] Read 5 most recent disclosed reports
+[ ] Not in changelog as known issue
+```
+
+**Gate 3 — Report quality (10 min):**
+```
+[ ] Title formula: [Class] in [Endpoint] allows [actor] to [impact]
+[ ] Steps have exact HTTP request
+[ ] Evidence shows actual impact
+[ ] CVSS calculated
+[ ] Fix: 1-2 concrete sentences
+```
+
+## Output
+
+**PASS:** "All 7 questions pass. All 4 gates pass. Proceed to /report."
+
+**KILL:** "Q[N] fails because [reason]. Kill this finding. Reason: [explanation]. Move on."
+
+**DOWNGRADE:** "Q6 only shows technical possibility. Downgrade from High to Medium. Requires showing actual data exfil in PoC."
+

package/registry/training/good/skills-store-web3-audit.md

@@ -0,0 +1,217 @@
+---
+name: web3-audit
+description: Smart contract security audit — runs through 10 bug class checklist (accounting desync, access control, incomplete path, off-by-one, oracle errors, ERC4626, reentrancy, flash loan, signature replay, proxy/upgrade). Applies pre-dive kill signals first. Generates Foundry PoC template for confirmed findings. Usage: /web3-audit <contract.sol>
+---
+
+# /web3-audit
+
+Smart contract security audit using the 10-bug-class methodology.
+
+## Usage
+
+```
+/web3-audit VulnerableContract.sol
+/web3-audit https://github.com/protocol/contracts
+/web3-audit [paste contract code]
+```
+
+## Step 0: Pre-Dive Kill Signals
+
+ALWAYS check these BEFORE reading any code:
+
+```
+1. TVL < $500K → max payout too low for effort → SKIP
+2. 2+ top-tier audits (Halborn, ToB, Cyfrin, OZ) on simple protocol → SKIP
+3. Protocol < 500 lines, single A→B→C flow → minimal attack surface → SKIP
+4. max_payout = min(10% × TVL, program_cap) → if < $10K → SKIP
+
+Formula: Is [TVL * 10%] > [hours I'll spend * hourly rate]? If not, skip.
+```
+
+Only proceed if score >= 6/10:
+- TVL > $10M: +2
+- Immunefi Critical >= $50K: +2
+- No top-tier audit on current version: +2
+- < 30 days since deploy: +1
+- Protocol you've hunted before: +1
+- Upgradeable proxies present: +1
+
+## Step 1: Accounting State Desynchronization (28% of Criticals)
+
+```bash
+# Find accounting variables
+grep -rn "totalSupply\|totalShares\|totalAssets\|totalDebt\|cumulativeReward" contracts/
+
+# Find ALL early returns in critical functions
+grep -rn "\breturn\b" contracts/ -B3 | grep -B3 "if\b"
+```
+
+Check: For each early return in claim/redeem/withdraw functions:
+- Which state variables are updated in the normal path?
+- Are ALL of them also updated in the early return path?
+- If A updated but B isn't → potential desync bug
+
+## Step 2: Access Control (19% of Criticals)
+
+```bash
+# Sibling function families — do ALL have same modifier set?
+grep -rn "function vote\|function poke\|function reset\|function update\|function claim\|function harvest" contracts/ -A2
+
+# Ownership check: existence vs ownership
+grep -rn "_requireOwned\|ownerOf\|_isApprovedOrOwner" contracts/ -B5
+
+# Silent modifiers (if without revert)
+grep -rn "modifier\b" contracts/ -A8 | grep -B3 "if (" | grep -v "require\|revert"
+
+# Uninitialized proxy
+grep -rn "function initialize\b" contracts/ -A3
+grep -rn "_disableInitializers()" contracts/
+```
+
+Check: Does EVERY sibling function in a family have the SAME modifiers?
+
+## Step 3: Incomplete Code Path (17% of Criticals)
+
+The function family comparison test:
+```
+1. List all state changes in function A (deposit/place/create)
+2. List all state changes in function B (withdraw/update/cancel)
+3. For each state change in A: does B have the corresponding reverse?
+4. For each token transfer in A: does B have the corresponding refund?
+```
+
+```bash
+grep -rn "safeApprove\b" contracts/    # safeApprove without zero-reset?
+grep -rn "delete\b" contracts/ -B5     # delete before operation completes?
+grep -rn "function deposit\|function mint\|function withdraw\|function redeem" contracts/ -A10
+```
+
+## Step 4: Off-By-One (22% of Highs)
+
+Mental test: For EVERY `if (A > B)`: "What happens when A == B?" Is that correct?
+
+```bash
+# Boundary comparisons
+grep -rn "Period\|Epoch\|Deadline\|period\|epoch\|deadline" contracts/ -A3 | grep "[<>][^=]"
+
+# Loop breaks
+grep -rn "\bbreak\b" contracts/ -B10
+
+# Array bounds
+grep -rn "\.length\s*-\s*1\|i\s*<=\s*.*\.length\b" contracts/
+```
+
+## Step 5: Oracle / Price Manipulation
+
+```bash
+# Missing staleness check
+grep -rn "latestRoundData" contracts/ -A5 | grep -v "updatedAt\|timestamp"
+
+# Pyth confidence interval
+grep -rn "getPriceUnsafe\|getPrice\b" contracts/ -A8 | grep -v "conf\|confidence"
+
+# TWAP windows
+grep -rn "secondsAgo\|TWAP\|cardinality" contracts/ -A5
+```
+
+Check:
+- Is staleness checked? (`require(block.timestamp - updatedAt <= MAX_AGE)`)
+- Is Pyth confidence interval checked? (`require(conf * 10 <= price)`)
+- Is TWAP window > 1800 seconds (30 min)?
+
+## Step 6: ERC4626 Vaults
+
+```bash
+grep -rn "function deposit\|function mint\|function withdraw\|function redeem" contracts/ -A10
+grep -rn "function transfer\|function transferFrom" contracts/ -A15
+```
+
+Check:
+- Does `mint()` call the same validation as `deposit()`?
+- Does `transfer()` move lock records along with shares?
+- Is there a `_decimalsOffset()` virtual shares defense against first-depositor attack?
+
+## Step 7: Reentrancy
+
+```bash
+# Effects after interactions
+grep -rn "\.call{value\|safeTransfer\|transfer(" contracts/ -B10 | grep -v "require\|revert"
+
+# Missing nonReentrant
+grep -rn "function withdraw\|function redeem\|function claim" contracts/ -A2 | grep -v "nonReentrant"
+```
+
+Check: Does every function that transfers ETH or ERC20 follow CEI order?
+(Checks → Effects → Interactions)
+
+## Step 8: Flash Loan Oracle Manipulation
+
+```bash
+grep -rn "getReserves\|getAmountsOut\|slot0\b" contracts/ -A5
+```
+
+Check: Any spot price reading from Uniswap reserves/slot0? → flash loan manipulatable.
+
+## Step 9: Signature Replay
+
+```bash
+grep -rn "ecrecover\|ECDSA\.recover" contracts/ -B20
+grep -rn "nonce\|_nonces\|nonces\[" contracts/
+```
+
+Check: Does signed hash include: nonce + chainId + contract address?
+
+## Step 10: Proxy / Upgrade
+
+```bash
+grep -rn "function initialize\b\|_disableInitializers\|initializer" contracts/
+grep -rn "delegatecall\b" contracts/ -B3
+grep -rn "0x360894\|_IMPLEMENTATION_SLOT\|EIP1967" contracts/
+```
+
+Check:
+- `_disableInitializers()` in implementation constructor?
+- Implementation can't be initialized directly by attacker?
+- Storage layout compatible between versions?
+
+## Confirming a Finding
+
+Apply the 7-Question Gate:
+```
+1. Can I demonstrate this with a Foundry test?
+2. What is the financial impact (quantify in $)?
+3. Is this in the Immunefi scope?
+4. Is it a known issue or acknowledged behavior?
+5. Does my Foundry PoC actually run? (forge test -vvvv)
+```
+
+## Foundry PoC Template
+
+```solidity
+// SPDX-License-Identifier: MIT
+pragma solidity ^0.8.0;
+import "forge-std/Test.sol";
+import "../src/VulnerableContract.sol";
+
+contract ExploitTest is Test {
+    VulnerableContract target;
+    address attacker = makeAddr("attacker");
+
+    function setUp() public {
+        vm.createSelectFork("mainnet", BLOCK_NUMBER);
+        target = VulnerableContract(TARGET_ADDRESS);
+        deal(address(token), attacker, INITIAL_BALANCE);
+    }
+
+    function test_exploit() public {
+        uint256 before = token.balanceOf(attacker);
+        vm.startPrank(attacker);
+        // Execute exploit
+        vm.stopPrank();
+        assertGt(token.balanceOf(attacker), before, "Exploit failed");
+    }
+}
+```
+
+Run: `forge test --match-test test_exploit -vvvv`
+

package/src/filter/classifier.js

@@ -0,0 +1,88 @@
+import { cosineSimilarity } from '../../embedder.js';
+
+const SKILL_THRESHOLD = 0.35;
+const UNSURE_THRESHOLD = 0.15;
+
+const DOC_FIRST_HEADERS = /^(overview|introduction|about|background|welcome|getting started|what is|why |table of contents|toc|foreword|preface|readme)/i;
+const INSTRUCTION_HEADERS = /^#{1,3}\s+(steps?|usage|instructions?|how\s+to|when\s+to\s+use|workflow|process|procedure|example|examples?|commands?|output|result)/i;
+const IMPERATIVE_HEADERS = /\b(run|use|apply|execute|check|debug|fix|create|add|remove|deploy|test|write|generate|analyze|review|refactor|optimize|configure|setup|install|scan|audit|validate|search|find|extract|parse)\b/i;
+
+export function getFeatureVector(raw) {
+  const lines = raw.split('\n');
+  const nonEmpty = lines.filter(l => l.trim());
+  const headers = nonEmpty.filter(l => /^#{1,3}\s/.test(l));
+  const paragraphs = raw.split(/\n\n+/).filter(p => p.trim() && !p.trim().startsWith('#'));
+  const words = raw.toLowerCase().split(/\s+/).filter(w => w.length > 3);
+
+  const firstHeader = headers[0]?.replace(/^#+\s*/, '') || '';
+  const longProse = paragraphs.filter(p => p.split(' ').length > 60 && !/```/.test(p));
+  const wordRatio = words.length > 80 ? new Set(words).size / words.length : 1;
+
+  return [
+    Number(raw.length >= 150),
+    Number(headers.length >= 1),
+    Number(lines.some(l => INSTRUCTION_HEADERS.test(l))),
+    Number(headers.some(h => IMPERATIVE_HEADERS.test(h))),
+    Number(raw.includes('```') || raw.includes('    ')),
+    Number(nonEmpty.some(l => /^\d+\.\s/.test(l))),
+    Number(nonEmpty.some(l => /^[-*+]\s/.test(l))),
+    Number(headers.length >= 2),
+    Number(headers.length >= 4),
+    Number(DOC_FIRST_HEADERS.test(firstHeader)) ? 1 : 0,
+    Number(longProse.length > paragraphs.length * 0.6 && paragraphs.length > 3) ? 1 : 0,
+    Number(wordRatio >= 0.22) ? 0 : 1,
+    Number(raw.length < 150) ? 1 : 0,
+    Number(headers.length < 1) ? 1 : 0,
+  ];
+}
+
+/**
+ * Rule A override: if centroid says reject/unsure but file clearly looks like
+ * a skill by content (code + instructions + list + verbs, no SKILL in name/path),
+ * override to skill. Catches adversarial wrong-heading cases with 0 FP cost.
+ */
+function ruleA(rawVec, raw, filePath) {
+  const fv = getFeatureVector(raw);
+  const hasCode = fv[4];
+  const hasInstructions = fv[2];
+  const hasNumberedList = fv[5];
+  const hasVerb = fv[3];
+  const filename = filePath ? filePath.split(/[/\\]/).pop().replace(/\.md$/i, '').toUpperCase() : '';
+  const pathUpper = filePath ? filePath.toUpperCase() : '';
+  const hasSkillName = filename.includes('SKILL');
+  const hasSkillPath = /SKILL/.test(pathUpper);
+
+  if (hasCode && hasInstructions && hasNumberedList && hasVerb && !hasSkillName && !hasSkillPath) {
+    return { label: 'skill', score: 0.6, method: 'ruleA' };
+  }
+  return null;
+}
+
+export function classify(rawVec, centroids, raw, filePath) {
+  if (!centroids) {
+    return { label: 'skill', score: 1, method: 'fallback' };
+  }
+
+  const goodSim = centroids.good ? cosineSimilarity(rawVec, centroids.good) : 0;
+  const badSim = centroids.bad ? cosineSimilarity(rawVec, centroids.bad) : 0;
+
+  const rawScore = goodSim - badSim;
+  const score = (rawScore + 1) / 2;
+
+  if (score >= SKILL_THRESHOLD) {
+    return { label: 'skill', score, goodSim, badSim, method: 'centroid' };
+  }
+
+  // Below threshold — try Rule A content override
+  if (raw && filePath) {
+    const override = ruleA(rawVec, raw, filePath);
+    if (override) return override;
+  }
+
+  if (score >= UNSURE_THRESHOLD) {
+    return { label: 'unsure', score, goodSim, badSim, method: 'centroid' };
+  }
+  return { label: 'reject', score, goodSim, badSim, method: 'centroid' };
+}
+
+export { SKILL_THRESHOLD, UNSURE_THRESHOLD };

package/src/filter/cluster.js

@@ -0,0 +1,52 @@
+import { cosineSimilarity } from '../../embedder.js';
+
+const INFERENCE_THRESHOLD = 0.35;
+
+export function findClusters(skills, embeddings) {
+  if (!skills.length || !embeddings) return [];
+  const clusters = [];
+  const assigned = new Set();
+
+  for (let i = 0; i < skills.length; i++) {
+    if (assigned.has(i)) continue;
+    const cluster = { centroid: embeddings[i], members: [skills[i]], indices: [i] };
+    assigned.add(i);
+
+    for (let j = i + 1; j < skills.length; j++) {
+      if (assigned.has(j)) continue;
+      if (cosineSimilarity(embeddings[i], embeddings[j]) >= INFERENCE_THRESHOLD) {
+        cluster.members.push(skills[j]);
+        cluster.indices.push(j);
+        assigned.add(j);
+      }
+    }
+
+    clusters.push(cluster);
+  }
+
+  return clusters;
+}
+
+export function expandResults(annResults, db) {
+  if (!annResults || annResults.length === 0) return annResults;
+
+  const seenIds = new Set();
+  const expanded = [];
+
+  for (const r of annResults) {
+    if (!seenIds.has(r.skill_id)) {
+      seenIds.add(r.skill_id);
+      expanded.push(r);
+    }
+
+    const callees = db.prepare('SELECT to_skill FROM edges WHERE from_skill = ?').all(r.skill_id);
+    for (const c of callees) {
+      if (!seenIds.has(c.to_skill)) {
+        seenIds.add(c.to_skill);
+        expanded.push({ skill_id: c.to_skill, score: r.score * 0.85 });
+      }
+    }
+  }
+
+  return expanded.sort((a, b) => b.score - a.score);
+}

package/src/filter/dedup.js

@@ -0,0 +1,36 @@
+import { cosineSimilarity } from '../../embedder.js';
+
+const DEDUP_THRESHOLD = 0.97;
+
+export function dedup(skills, embeddings) {
+  if (!skills.length) return { skills: [], embeddings: [] };
+  if (embeddings && embeddings.length !== skills.length) {
+    throw new Error('embeddings length must match skills length');
+  }
+
+  const keep = [true]; // first skill always kept
+  const kept = [0];
+
+  for (let i = 1; i < skills.length; i++) {
+    let dup = false;
+    if (embeddings) {
+      for (const j of kept) {
+        if (cosineSimilarity(embeddings[i], embeddings[j]) >= DEDUP_THRESHOLD) {
+          dup = true;
+          break;
+        }
+      }
+    }
+    if (dup) {
+      keep.push(false);
+    } else {
+      keep.push(true);
+      kept.push(i);
+    }
+  }
+
+  return {
+    skills: skills.filter((_, i) => keep[i]),
+    embeddings: embeddings ? embeddings.filter((_, i) => keep[i]) : undefined,
+  };
+}

package/src/filter/hard-filter.js

@@ -0,0 +1,57 @@
+import fs from 'fs';
+
+const SKIP_FILENAMES = new Set([
+  'readme', 'changelog', 'license', 'contributing', 'code-of-conduct',
+  'security', 'authors', 'credits', 'install', 'installation', 'usage',
+  'engagements', 'contributors', 'maintainers', 'acknowledgements',
+  'faq', 'glossary', 'index', 'overview', 'summary', 'roadmap', 'todo',
+  'notes', 'template', 'example', 'sample', 'demo', 'getting-started',
+  'quickstart', 'guide', 'tutorial', 'walkthrough', 'architecture',
+  'design', 'spec', 'specification', 'requirements', 'privacy', 'terms',
+  'disclaimer', 'notice', 'copying', 'warranty', 'codeofconduct',
+  'pull_request_template', 'issue_template', 'funding',
+]);
+
+const SKIP_FILENAME_RE = /^(_|\.)|^v?\d+[\.\-]\d+|^\d{4}[\-_]\d{2}|^readme|^license|^changelog|^contributing|^code.of.conduct|^security|^authors|^credits|^disclaimer|^notice|^copying|^warranty|^promotion|^funding/i;
+
+const SKIP_DIRS = new Set([
+  '.github', 'docs', 'doc', 'documentation', 'examples', 'example',
+  'tests', 'test', '__tests__', 'spec', 'fixtures', 'assets', 'images',
+  'img', 'screenshots', 'media', 'static', 'public', 'dist', 'build',
+  'node_modules', 'vendor', 'third_party',
+]);
+
+const BADGE_RE = /!\[.*\]\(https?:\/\/(img\.shields\.io|badge\.fury|travis-ci|github\.com\/[^)]+\/badge)/i;
+const README_HEADER_RE = /^#\s*readme\b/i;
+
+export function hardFilter(filePath, raw) {
+  const parts = filePath.replace(/\\/g, '/').split('/');
+  const filename = parts[parts.length - 1];
+  const base = filename.replace(/\.md$/i, '').toLowerCase();
+
+  if (SKIP_FILENAMES.has(base)) {
+    return { pass: false, reason: `skip filename: ${base}` };
+  }
+
+  if (SKIP_FILENAME_RE.test(base)) {
+    return { pass: false, reason: `skip filename pattern: ${base}` };
+  }
+
+  for (const part of parts.slice(0, -1)) {
+    if (SKIP_DIRS.has(part.toLowerCase())) {
+      return { pass: false, reason: `skip dir: ${part}` };
+    }
+  }
+
+  if (raw) {
+    const firstLines = raw.trimStart().slice(0, 300);
+    if (README_HEADER_RE.test(firstLines)) {
+      return { pass: false, reason: 'starts with # Readme' };
+    }
+    if (BADGE_RE.test(firstLines)) {
+      return { pass: false, reason: 'badge-only content' };
+    }
+  }
+
+  return { pass: true };
+}

package/src/filter/train.js

@@ -0,0 +1,64 @@
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { globSync } from 'glob';
+import { embedBatch } from '../../embedder.js';
+
+const TRAINING_DIR = path.resolve(new URL('../../registry/training', import.meta.url).pathname);
+const MODEL_PATH = path.join(os.homedir(), '.claude', '.promptgraph', 'model.json');
+
+function readAllMd(dir) {
+  const files = globSync(`${dir}/**/*.md`);
+  return files.map(f => fs.readFileSync(f, 'utf8'));
+}
+
+function meanVector(vectors) {
+  if (!vectors.length) return null;
+  const dim = vectors[0].length;
+  const centroid = new Float32Array(dim);
+  for (const v of vectors) {
+    for (let i = 0; i < dim; i++) centroid[i] += v[i];
+  }
+  for (let i = 0; i < dim; i++) centroid[i] /= vectors.length;
+  return Array.from(centroid);
+}
+
+export async function train() {
+  const goodDir = path.join(TRAINING_DIR, 'good');
+  const badDir = path.join(TRAINING_DIR, 'bad');
+
+  const goodTexts = readAllMd(goodDir);
+  const badTexts = readAllMd(badDir);
+
+  if (goodTexts.length < 1 || badTexts.length < 1) {
+    throw new Error(`Need at least 1 good and 1 bad training example (good: ${goodTexts.length}, bad: ${badTexts.length})`);
+  }
+
+  const allTexts = [...goodTexts, ...badTexts];
+  const allVecs = await embedBatch(allTexts);
+
+  const goodVecs = allVecs.slice(0, goodTexts.length);
+  const badVecs = allVecs.slice(goodTexts.length);
+
+  const model = {
+    version: 1,
+    good: meanVector(goodVecs),
+    bad: meanVector(badVecs),
+    counts: { good: goodTexts.length, bad: badTexts.length },
+  };
+
+  fs.mkdirSync(path.dirname(MODEL_PATH), { recursive: true });
+  fs.writeFileSync(MODEL_PATH, JSON.stringify(model));
+  return model;
+}
+
+export function loadModel() {
+  try {
+    const raw = fs.readFileSync(MODEL_PATH, 'utf8');
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+
+export { MODEL_PATH };