qlogicagent 0.1.0

package/dist/skills/skill-frontmatter.js

@@ -0,0 +1,345 @@
+// ---------------------------------------------------------------------------
+// SKILL.md frontmatter parser — portable, zero external dependencies.
+// Mirrors openclaw/src/markdown/frontmatter.ts + src/agents/skills/frontmatter.ts
+// but without YAML library (uses simple line parser + JSON5-free metadata).
+// ---------------------------------------------------------------------------
+// ---------------------------------------------------------------------------
+// Block extraction
+// ---------------------------------------------------------------------------
+function extractFrontmatterBlock(content) {
+    const normalized = content.replace(/\r\n/g, "\n").replace(/\r/g, "\n");
+    if (!normalized.startsWith("---")) {
+        return undefined;
+    }
+    const endIndex = normalized.indexOf("\n---", 3);
+    if (endIndex === -1) {
+        return undefined;
+    }
+    return normalized.slice(4, endIndex);
+}
+// ---------------------------------------------------------------------------
+// Line parser (handles both inline and multi-line values)
+// ---------------------------------------------------------------------------
+function stripQuotes(value) {
+    if ((value.startsWith('"') && value.endsWith('"')) ||
+        (value.startsWith("'") && value.endsWith("'"))) {
+        return value.slice(1, -1);
+    }
+    return value;
+}
+function extractMultiLineValue(lines, startIndex) {
+    const valueLines = [];
+    let i = startIndex + 1;
+    while (i < lines.length) {
+        const line = lines[i];
+        if (line.length > 0 && !line.startsWith(" ") && !line.startsWith("\t")) {
+            break;
+        }
+        valueLines.push(line);
+        i += 1;
+    }
+    return { value: valueLines.join("\n").trim(), linesConsumed: i - startIndex };
+}
+/**
+ * Parse a YAML-like frontmatter block into a flat key→value record.
+ * Uses a lightweight line parser to avoid a YAML library dependency.
+ */
+export function parseFrontmatter(content) {
+    const block = extractFrontmatterBlock(content);
+    if (!block) {
+        return {};
+    }
+    const result = {};
+    const lines = block.split("\n");
+    let i = 0;
+    while (i < lines.length) {
+        const line = lines[i];
+        const match = line.match(/^([\w-]+):\s*(.*)$/);
+        if (!match) {
+            i += 1;
+            continue;
+        }
+        const key = match[1];
+        const inlineValue = match[2].trim();
+        if (!key) {
+            i += 1;
+            continue;
+        }
+        // Check for multi-line value
+        if (!inlineValue && i + 1 < lines.length) {
+            const nextLine = lines[i + 1];
+            if (nextLine.startsWith(" ") || nextLine.startsWith("\t")) {
+                const { value, linesConsumed } = extractMultiLineValue(lines, i);
+                if (value) {
+                    result[key] = value;
+                }
+                i += linesConsumed;
+                continue;
+            }
+        }
+        const value = stripQuotes(inlineValue);
+        if (value) {
+            result[key] = value;
+        }
+        i += 1;
+    }
+    return result;
+}
+// ---------------------------------------------------------------------------
+// Metadata resolver (from `metadata:` JSON block)
+// ---------------------------------------------------------------------------
+function parseMetadataJson(raw) {
+    // Try direct JSON first: `metadata: {"openclaw": {...}}`
+    try {
+        const parsed = JSON.parse(raw);
+        if (parsed && typeof parsed === "object") {
+            const obj = parsed;
+            const nested = obj["openclaw"];
+            if (nested && typeof nested === "object") {
+                return nested;
+            }
+            return obj;
+        }
+    }
+    catch {
+        // Not JSON — fall through to YAML-like parser
+    }
+    // Handle YAML-like multi-line: `key: value` per line
+    return parseYamlLikeMetadata(raw);
+}
+/**
+ * Parse simple YAML-like `key: value` lines where values may be JSON
+ * literals (objects, arrays, booleans, numbers) or plain strings.
+ */
+function parseYamlLikeMetadata(raw) {
+    const result = {};
+    let found = false;
+    for (const line of raw.split("\n")) {
+        const trimmed = line.trim();
+        if (!trimmed)
+            continue;
+        const m = trimmed.match(/^([\w-]+):\s*(.+)$/);
+        if (!m)
+            continue;
+        const key = m[1];
+        const val = m[2].trim();
+        found = true;
+        // Try JSON parse for objects / arrays / booleans / numbers
+        try {
+            result[key] = JSON.parse(val);
+        }
+        catch {
+            // Plain string — normalise booleans / numbers
+            if (val === "true")
+                result[key] = true;
+            else if (val === "false")
+                result[key] = false;
+            else if (/^-?\d+(\.\d+)?$/.test(val))
+                result[key] = Number(val);
+            else
+                result[key] = val;
+        }
+    }
+    return found ? result : undefined;
+}
+function normalizeStringList(input) {
+    if (!input)
+        return [];
+    if (Array.isArray(input)) {
+        return input.map((v) => String(v).trim()).filter(Boolean);
+    }
+    if (typeof input === "string") {
+        return input
+            .split(",")
+            .map((v) => v.trim())
+            .filter(Boolean);
+    }
+    return [];
+}
+function parseBool(value, fallback) {
+    if (value === undefined)
+        return fallback;
+    const lower = value.toLowerCase().trim();
+    if (lower === "true" || lower === "1" || lower === "yes")
+        return true;
+    if (lower === "false" || lower === "0" || lower === "no")
+        return false;
+    return fallback;
+}
+// ---------------------------------------------------------------------------
+// Install spec validation (safe input normalization)
+// ---------------------------------------------------------------------------
+const BREW_FORMULA_PATTERN = /^[A-Za-z0-9][A-Za-z0-9@+._/-]*$/;
+const GO_MODULE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._~+\-/]*(?:@[A-Za-z0-9][A-Za-z0-9._~+\-/]*)?$/;
+const UV_PACKAGE_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._\-[\]=<>!~+,]*$/;
+const NPM_SPEC_PATTERN = /^(@[a-z0-9][\w.\-]*\/)?[a-z0-9][\w.\-]*(@[~^]?[\d.*]+[\w.\-+]*)?$/;
+function normalizeSafeBrewFormula(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    const formula = raw.trim();
+    if (!formula || formula.startsWith("-") || formula.includes("\\") || formula.includes("..")) {
+        return undefined;
+    }
+    return BREW_FORMULA_PATTERN.test(formula) ? formula : undefined;
+}
+function normalizeSafeNpmSpec(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    const spec = raw.trim();
+    if (!spec || spec.startsWith("-"))
+        return undefined;
+    return NPM_SPEC_PATTERN.test(spec) ? spec : undefined;
+}
+function normalizeSafeGoModule(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    const mod = raw.trim();
+    if (!mod || mod.startsWith("-") || mod.includes("\\") || mod.includes("://"))
+        return undefined;
+    return GO_MODULE_PATTERN.test(mod) ? mod : undefined;
+}
+function normalizeSafeUvPackage(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    const pkg = raw.trim();
+    if (!pkg || pkg.startsWith("-") || pkg.includes("\\") || pkg.includes("://"))
+        return undefined;
+    return UV_PACKAGE_PATTERN.test(pkg) ? pkg : undefined;
+}
+function normalizeSafeDownloadUrl(raw) {
+    if (typeof raw !== "string")
+        return undefined;
+    const value = raw.trim();
+    if (!value || /\s/.test(value))
+        return undefined;
+    try {
+        const parsed = new URL(value);
+        if (parsed.protocol !== "http:" && parsed.protocol !== "https:")
+            return undefined;
+        return parsed.toString();
+    }
+    catch {
+        return undefined;
+    }
+}
+function parseInstallSpec(input) {
+    if (!input || typeof input !== "object")
+        return undefined;
+    const raw = input;
+    const kindRaw = typeof raw.kind === "string" ? raw.kind : typeof raw.type === "string" ? raw.type : "";
+    const kind = kindRaw.trim().toLowerCase();
+    const ALLOWED_KINDS = ["brew", "node", "go", "uv", "download"];
+    if (!ALLOWED_KINDS.includes(kind))
+        return undefined;
+    const spec = { kind: kind };
+    if (typeof raw.id === "string")
+        spec.id = raw.id;
+    if (typeof raw.label === "string")
+        spec.label = raw.label;
+    const bins = normalizeStringList(raw.bins);
+    if (bins.length > 0)
+        spec.bins = bins;
+    const osList = normalizeStringList(raw.os);
+    if (osList.length > 0)
+        spec.os = osList;
+    // Kind-specific fields
+    const formula = normalizeSafeBrewFormula(raw.formula) ?? normalizeSafeBrewFormula(raw.cask);
+    if (formula)
+        spec.formula = formula;
+    if (kind === "node") {
+        const pkg = normalizeSafeNpmSpec(raw.package);
+        if (pkg)
+            spec.package = pkg;
+    }
+    else if (kind === "uv") {
+        const pkg = normalizeSafeUvPackage(raw.package);
+        if (pkg)
+            spec.package = pkg;
+    }
+    const mod = normalizeSafeGoModule(raw.module);
+    if (mod)
+        spec.module = mod;
+    const url = normalizeSafeDownloadUrl(raw.url);
+    if (url)
+        spec.url = url;
+    if (typeof raw.archive === "string")
+        spec.archive = raw.archive;
+    if (typeof raw.extract === "boolean")
+        spec.extract = raw.extract;
+    if (typeof raw.stripComponents === "number")
+        spec.stripComponents = raw.stripComponents;
+    if (typeof raw.targetDir === "string")
+        spec.targetDir = raw.targetDir;
+    // Validate required field per kind
+    if (kind === "brew" && !spec.formula)
+        return undefined;
+    if (kind === "node" && !spec.package)
+        return undefined;
+    if (kind === "go" && !spec.module)
+        return undefined;
+    if (kind === "uv" && !spec.package)
+        return undefined;
+    if (kind === "download" && !spec.url)
+        return undefined;
+    return spec;
+}
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Resolve structured metadata from the `metadata:` frontmatter field.
+ * Expects `metadata: {"openclaw": {...}}` (JSON format).
+ */
+export function resolveSkillMetadata(frontmatter) {
+    const raw = frontmatter["metadata"];
+    if (!raw)
+        return undefined;
+    const metadataObj = parseMetadataJson(raw);
+    if (!metadataObj)
+        return undefined;
+    const requiresRaw = typeof metadataObj.requires === "object" && metadataObj.requires !== null
+        ? metadataObj.requires
+        : undefined;
+    const requires = requiresRaw
+        ? {
+            bins: normalizeStringList(requiresRaw.bins),
+            anyBins: normalizeStringList(requiresRaw.anyBins),
+            env: normalizeStringList(requiresRaw.env),
+            config: normalizeStringList(requiresRaw.config),
+        }
+        : undefined;
+    const installRaw = Array.isArray(metadataObj.install)
+        ? metadataObj.install
+        : [];
+    const install = installRaw
+        .map((entry) => parseInstallSpec(entry))
+        .filter((entry) => Boolean(entry));
+    const osRaw = normalizeStringList(metadataObj.os);
+    return {
+        always: typeof metadataObj.always === "boolean" ? metadataObj.always : undefined,
+        emoji: typeof metadataObj.emoji === "string" ? metadataObj.emoji : undefined,
+        homepage: typeof metadataObj.homepage === "string" ? metadataObj.homepage : undefined,
+        skillKey: typeof metadataObj.skillKey === "string" ? metadataObj.skillKey : undefined,
+        primaryEnv: typeof metadataObj.primaryEnv === "string" ? metadataObj.primaryEnv : undefined,
+        os: osRaw.length > 0 ? osRaw : undefined,
+        category: typeof metadataObj.category === "string" ? metadataObj.category : undefined,
+        requires,
+        install: install.length > 0 ? install : undefined,
+    };
+}
+/**
+ * Resolve invocation policy from frontmatter fields.
+ */
+export function resolveSkillInvocationPolicy(frontmatter) {
+    return {
+        userInvocable: parseBool(frontmatter["user-invocable"], true),
+        disableModelInvocation: parseBool(frontmatter["disable-model-invocation"], false),
+    };
+}
+/**
+ * Get the canonical key for a skill (metadata.skillKey or skill.name).
+ */
+export function resolveSkillKey(skillName, metadata) {
+    return metadata?.skillKey ?? skillName;
+}
+//# sourceMappingURL=skill-frontmatter.js.map

package/dist/skills/skill-frontmatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-frontmatter.js","sourceRoot":"","sources":["../../src/skills/skill-frontmatter.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,sEAAsE;AACtE,kFAAkF;AAClF,4EAA4E;AAC5E,8EAA8E;AAS9E,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACvE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;IAChD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;QACpB,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;AACvC,CAAC;AAED,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,SAAS,WAAW,CAAC,KAAa;IAChC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;QACD,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAC5B,KAAe,EACf,UAAkB;IAElB,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,CAAC,GAAG,UAAU,GAAG,CAAC,CAAC;IACvB,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvE,MAAM;QACR,CAAC;QACD,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtB,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,aAAa,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,KAAK,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG,CAAC,CAAC;IAEV,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;QACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC/C,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QAED,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,CAAC,IAAI,CAAC,CAAC;YACP,SAAS;QACX,CAAC;QAED,6BAA6B;QAC7B,IAAI,CAAC,WAAW,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;YACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9B,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1D,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,GAAG,qBAAqB,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;gBACjE,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;gBACtB,CAAC;gBACD,CAAC,IAAI,aAAa,CAAC;gBACnB,SAAS;YACX,CAAC;QACH,CAAC;QAED,MAAM,KAAK,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;QACvC,IAAI,KAAK,EAAE,CAAC;YACV,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACtB,CAAC;QACD,CAAC,IAAI,CAAC,CAAC;IACT,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E,SAAS,iBAAiB,CAAC,GAAW;IACpC,yDAAyD;IACzD,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,GAAG,GAAG,MAAiC,CAAC;YAC9C,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC;YAC/B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;gBACzC,OAAO,MAAiC,CAAC;YAC3C,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IAED,qDAAqD;IACrD,OAAO,qBAAqB,CAAC,GAAG,CAAC,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,GAAW;IACxC,MAAM,MAAM,GAA4B,EAAE,CAAC;IAC3C,IAAI,KAAK,GAAG,KAAK,CAAC;IAElB,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO;YAAE,SAAS;QACvB,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,oBAAoB,CAAC,CAAC;QAC9C,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACjB,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACxB,KAAK,GAAG,IAAI,CAAC;QAEb,2DAA2D;QAC3D,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAChC,CAAC;QAAC,MAAM,CAAC;YACP,8CAA8C;YAC9C,IAAI,GAAG,KAAK,MAAM;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;iBAClC,IAAI,GAAG,KAAK,OAAO;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;iBACzC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAC3D,MAAM,CAAC,GAAG,CAAC,GAAG,GAAG,CAAC;QACzB,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AACpC,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACzC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,CAAC;IACtB,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,KAAK;aACT,KAAK,CAAC,GAAG,CAAC;aACV,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,SAAS,SAAS,CAAC,KAAyB,EAAE,QAAiB;IAC7D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IACzC,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IACzC,IAAI,KAAK,KAAK,MAAM,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACtE,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,GAAG,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACvE,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,qDAAqD;AACrD,8EAA8E;AAE9E,MAAM,oBAAoB,GAAG,iCAAiC,CAAC;AAC/D,MAAM,iBAAiB,GACrB,sEAAsE,CAAC;AACzE,MAAM,kBAAkB,GAAG,yCAAyC,CAAC;AACrE,MAAM,gBAAgB,GAAG,mEAAmE,CAAC;AAE7F,SAAS,wBAAwB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC5F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;AAClE,CAAC;AAED,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IACpD,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAY;IACzC,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/F,OAAO,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACvD,CAAC;AAED,SAAS,sBAAsB,CAAC,GAAY;IAC1C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,GAAG,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACvB,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC/F,OAAO,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;AACxD,CAAC;AAED,SAAS,wBAAwB,CAAC,GAAY;IAC5C,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC9C,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACzB,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAAE,OAAO,SAAS,CAAC;QAClF,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,MAAM,GAAG,GAAG,KAAgC,CAAC;IAC7C,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IACvG,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC1C,MAAM,aAAa,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;IAC/D,IAAI,CAAC,aAAa,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,OAAO,SAAS,CAAC;IAEpD,MAAM,IAAI,GAAqB,EAAE,IAAI,EAAE,IAAgC,EAAE,CAAC;IAC1E,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ;QAAE,IAAI,CAAC,EAAE,GAAG,GAAG,CAAC,EAAE,CAAC;IACjD,IAAI,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ;QAAE,IAAI,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC;IAC1D,MAAM,IAAI,GAAG,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACtC,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,EAAE,GAAG,MAAM,CAAC;IAExC,uBAAuB;IACvB,MAAM,OAAO,GAAG,wBAAwB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC5F,IAAI,OAAO;QAAE,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IAEpC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QACpB,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,GAAG;YAAE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;IAC9B,CAAC;SAAM,IAAI,IAAI,KAAK,IAAI,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,GAAG;YAAE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC;IAC9B,CAAC;IACD,MAAM,GAAG,GAAG,qBAAqB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,GAAG;QAAE,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;IAC3B,MAAM,GAAG,GAAG,wBAAwB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC9C,IAAI,GAAG;QAAE,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC;IACxB,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ;QAAE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IAChE,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,SAAS;QAAE,IAAI,CAAC,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC;IACjE,IAAI,OAAO,GAAG,CAAC,eAAe,KAAK,QAAQ;QAAE,IAAI,CAAC,eAAe,GAAG,GAAG,CAAC,eAAe,CAAC;IACxF,IAAI,OAAO,GAAG,CAAC,SAAS,KAAK,QAAQ;QAAE,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;IAEtE,mCAAmC;IACnC,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACvD,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACvD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACpD,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IACrD,IAAI,IAAI,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAEvD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAClC,WAAmC;IAEnC,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,SAAS,CAAC;IAE3B,MAAM,WAAW,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,WAAW;QAAE,OAAO,SAAS,CAAC;IAEnC,MAAM,WAAW,GACf,OAAO,WAAW,CAAC,QAAQ,KAAK,QAAQ,IAAI,WAAW,CAAC,QAAQ,KAAK,IAAI;QACvE,CAAC,CAAE,WAAW,CAAC,QAAoC;QACnD,CAAC,CAAC,SAAS,CAAC;IAEhB,MAAM,QAAQ,GAAG,WAAW;QAC1B,CAAC,CAAC;YACE,IAAI,EAAE,mBAAmB,CAAC,WAAW,CAAC,IAAI,CAAC;YAC3C,OAAO,EAAE,mBAAmB,CAAC,WAAW,CAAC,OAAO,CAAC;YACjD,GAAG,EAAE,mBAAmB,CAAC,WAAW,CAAC,GAAG,CAAC;YACzC,MAAM,EAAE,mBAAmB,CAAC,WAAW,CAAC,MAAM,CAAC;SAChD;QACH,CAAC,CAAC,SAAS,CAAC;IAEd,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO,CAAC;QACnD,CAAC,CAAE,WAAW,CAAC,OAAqB;QACpC,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,OAAO,GAAG,UAAU;SACvB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,gBAAgB,CAAC,KAAK,CAAC,CAAC;SACvC,MAAM,CAAC,CAAC,KAAK,EAA6B,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAEhE,MAAM,KAAK,GAAG,mBAAmB,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAElD,OAAO;QACL,MAAM,EAAE,OAAO,WAAW,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QAChF,KAAK,EAAE,OAAO,WAAW,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QAC5E,QAAQ,EAAE,OAAO,WAAW,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACrF,QAAQ,EAAE,OAAO,WAAW,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACrF,UAAU,EAAE,OAAO,WAAW,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;QAC3F,EAAE,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS;QACxC,QAAQ,EAAE,OAAO,WAAW,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC,CAAC,SAAS;QACrF,QAAQ;QACR,OAAO,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;KAClD,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,4BAA4B,CAC1C,WAAmC;IAEnC,OAAO;QACL,aAAa,EAAE,SAAS,CAAC,WAAW,CAAC,gBAAgB,CAAC,EAAE,IAAI,CAAC;QAC7D,sBAAsB,EAAE,SAAS,CAAC,WAAW,CAAC,0BAA0B,CAAC,EAAE,KAAK,CAAC;KAClF,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,SAAiB,EACjB,QAAwB;IAExB,OAAO,QAAQ,EAAE,QAAQ,IAAI,SAAS,CAAC;AACzC,CAAC"}

package/dist/skills/skill-guard.d.ts

@@ -0,0 +1,24 @@
+import type { SkillFsDeps, SkillPathDeps, SkillScanFinding, SkillScanOptions, SkillScanSummary } from "./skill-types.js";
+/**
+ * Scan a source string for security findings.
+ * This is a pure function — no file I/O.
+ */
+export declare function scanSource(source: string, filePath: string): SkillScanFinding[];
+export interface SkillGuardDeps {
+    fs: SkillFsDeps;
+    path: SkillPathDeps;
+}
+/**
+ * Scan an entire skill directory for security issues.
+ * Returns a summary with per-file findings.
+ */
+export declare function scanSkillDirectory(deps: SkillGuardDeps, skillDir: string, opts?: SkillScanOptions): Promise<SkillScanSummary>;
+/**
+ * Quick check: does this source have any critical findings?
+ */
+export declare function hasCriticalFindings(source: string, filePath: string): boolean;
+/**
+ * Check if a file extension is scannable by the guard.
+ */
+export declare function isScannable(filePath: string, pathDeps: SkillPathDeps): boolean;
+//# sourceMappingURL=skill-guard.d.ts.map

package/dist/skills/skill-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-guard.d.ts","sourceRoot":"","sources":["../../src/skills/skill-guard.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EACV,WAAW,EACX,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAEhB,gBAAgB,EACjB,MAAM,kBAAkB,CAAC;AAsG1B;;;GAGG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,gBAAgB,EAAE,CAoE/E;AAMD,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,WAAW,CAAC;IAChB,IAAI,EAAE,aAAa,CAAC;CACrB;AAqCD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,IAAI,EAAE,cAAc,EACpB,QAAQ,EAAE,MAAM,EAChB,IAAI,CAAC,EAAE,gBAAgB,GACtB,OAAO,CAAC,gBAAgB,CAAC,CAuC3B;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE7E;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,aAAa,GAAG,OAAO,CAE9E"}

package/dist/skills/skill-guard.js

@@ -0,0 +1,230 @@
+// ---------------------------------------------------------------------------
+// Skill security scanner — portable, zero external dependencies.
+// Mirrors openclaw/src/security/skill-scanner.ts rules but uses DI deps
+// instead of Node.js fs/path directly.
+// ---------------------------------------------------------------------------
+const LINE_RULES = [
+    {
+        ruleId: "dangerous-exec",
+        severity: "critical",
+        message: "Shell command execution detected (child_process)",
+        pattern: /\b(exec|execSync|spawn|spawnSync|execFile|execFileSync)\s*\(/,
+        requiresContext: /child_process/,
+    },
+    {
+        ruleId: "dynamic-code-execution",
+        severity: "critical",
+        message: "Dynamic code execution detected",
+        pattern: /\beval\s*\(|new\s+Function\s*\(/,
+    },
+    {
+        ruleId: "crypto-mining",
+        severity: "critical",
+        message: "Possible crypto-mining reference detected",
+        pattern: /stratum\+tcp|stratum\+ssl|coinhive|cryptonight|xmrig/i,
+    },
+    {
+        ruleId: "suspicious-network",
+        severity: "warn",
+        message: "WebSocket connection to non-standard port",
+        pattern: /new\s+WebSocket\s*\(\s*["']wss?:\/\/[^"']*:(\d+)/,
+    },
+];
+const STANDARD_PORTS = new Set([80, 443, 8080, 8443, 3000]);
+const SOURCE_RULES = [
+    {
+        ruleId: "potential-exfiltration",
+        severity: "warn",
+        message: "File read combined with network send — possible data exfiltration",
+        pattern: /readFileSync|readFile/,
+        requiresContext: /\bfetch\b|\bpost\b|http\.request/i,
+    },
+    {
+        ruleId: "obfuscated-code",
+        severity: "warn",
+        message: "Hex-encoded string sequence detected (possible obfuscation)",
+        pattern: /(\\x[0-9a-fA-F]{2}){6,}/,
+    },
+    {
+        ruleId: "obfuscated-code",
+        severity: "warn",
+        message: "Large base64 payload with decode call detected (possible obfuscation)",
+        pattern: /(?:atob|Buffer\.from)\s*\(\s*["'][A-Za-z0-9+/=]{200,}["']/,
+    },
+    {
+        ruleId: "env-harvesting",
+        severity: "critical",
+        message: "Environment variable access combined with network send — possible credential harvesting",
+        pattern: /process\.env/,
+        requiresContext: /\bfetch\b|\bpost\b|http\.request/i,
+    },
+];
+// ---------------------------------------------------------------------------
+// Scannable extensions
+// ---------------------------------------------------------------------------
+const SCANNABLE_EXTENSIONS = new Set([
+    ".js", ".ts", ".mjs", ".cjs", ".mts", ".cts", ".jsx", ".tsx",
+]);
+const DEFAULT_MAX_SCAN_FILES = 500;
+const DEFAULT_MAX_FILE_BYTES = 1024 * 1024;
+// ---------------------------------------------------------------------------
+// Core scanner (operates on source text — no FS dependency)
+// ---------------------------------------------------------------------------
+function truncateEvidence(evidence, maxLen = 120) {
+    return evidence.length <= maxLen ? evidence : `${evidence.slice(0, maxLen)}…`;
+}
+/**
+ * Scan a source string for security findings.
+ * This is a pure function — no file I/O.
+ */
+export function scanSource(source, filePath) {
+    const findings = [];
+    const lines = source.split("\n");
+    const matchedLineRules = new Set();
+    // Line rules
+    for (const rule of LINE_RULES) {
+        if (matchedLineRules.has(rule.ruleId))
+            continue;
+        if (rule.requiresContext && !rule.requiresContext.test(source))
+            continue;
+        for (let i = 0; i < lines.length; i++) {
+            const line = lines[i];
+            const match = rule.pattern.exec(line);
+            if (!match)
+                continue;
+            // Special: suspicious-network checks port number
+            if (rule.ruleId === "suspicious-network") {
+                const port = parseInt(match[1], 10);
+                if (STANDARD_PORTS.has(port))
+                    continue;
+            }
+            findings.push({
+                ruleId: rule.ruleId,
+                severity: rule.severity,
+                file: filePath,
+                line: i + 1,
+                message: rule.message,
+                evidence: truncateEvidence(line.trim()),
+            });
+            matchedLineRules.add(rule.ruleId);
+            break; // one finding per line-rule per file
+        }
+    }
+    // Source rules
+    const matchedSourceRules = new Set();
+    for (const rule of SOURCE_RULES) {
+        const ruleKey = `${rule.ruleId}::${rule.message}`;
+        if (matchedSourceRules.has(ruleKey))
+            continue;
+        if (!rule.pattern.test(source))
+            continue;
+        if (rule.requiresContext && !rule.requiresContext.test(source))
+            continue;
+        let matchLine = 0;
+        let matchEvidence = "";
+        for (let i = 0; i < lines.length; i++) {
+            if (rule.pattern.test(lines[i])) {
+                matchLine = i + 1;
+                matchEvidence = lines[i].trim();
+                break;
+            }
+        }
+        if (matchLine === 0) {
+            matchLine = 1;
+            matchEvidence = source.slice(0, 120);
+        }
+        findings.push({
+            ruleId: rule.ruleId,
+            severity: rule.severity,
+            file: filePath,
+            line: matchLine,
+            message: rule.message,
+            evidence: truncateEvidence(matchEvidence),
+        });
+        matchedSourceRules.add(ruleKey);
+    }
+    return findings;
+}
+async function walkDirWithLimit(deps, dirPath, maxFiles) {
+    const files = [];
+    const stack = [dirPath];
+    while (stack.length > 0 && files.length < maxFiles) {
+        const currentDir = stack.pop();
+        if (!currentDir)
+            break;
+        let entries;
+        try {
+            entries = deps.fs.readdirSync(currentDir, { withFileTypes: true });
+        }
+        catch {
+            continue;
+        }
+        for (const entry of entries) {
+            if (files.length >= maxFiles)
+                break;
+            if (entry.name.startsWith(".") || entry.name === "node_modules")
+                continue;
+            const fullPath = deps.path.join(currentDir, entry.name);
+            if (entry.isDirectory()) {
+                stack.push(fullPath);
+            }
+            else if (SCANNABLE_EXTENSIONS.has(deps.path.extname(entry.name).toLowerCase())) {
+                files.push(fullPath);
+            }
+        }
+    }
+    return files;
+}
+/**
+ * Scan an entire skill directory for security issues.
+ * Returns a summary with per-file findings.
+ */
+export async function scanSkillDirectory(deps, skillDir, opts) {
+    const maxFiles = Math.max(1, opts?.maxFiles ?? DEFAULT_MAX_SCAN_FILES);
+    const maxFileBytes = Math.max(1, opts?.maxFileBytes ?? DEFAULT_MAX_FILE_BYTES);
+    const files = opts?.includeFiles && opts.includeFiles.length > 0
+        ? opts.includeFiles
+        : await walkDirWithLimit(deps, skillDir, maxFiles);
+    const allFindings = [];
+    let scannedFiles = 0;
+    for (const filePath of files) {
+        try {
+            const stat = deps.fs.statSync(filePath);
+            if (stat.size > maxFileBytes)
+                continue;
+        }
+        catch {
+            continue;
+        }
+        let source;
+        try {
+            source = await deps.fs.readFile(filePath, "utf-8");
+        }
+        catch {
+            continue;
+        }
+        scannedFiles += 1;
+        const findings = scanSource(source, filePath);
+        allFindings.push(...findings);
+    }
+    return {
+        scannedFiles,
+        critical: allFindings.filter((f) => f.severity === "critical").length,
+        warn: allFindings.filter((f) => f.severity === "warn").length,
+        info: allFindings.filter((f) => f.severity === "info").length,
+        findings: allFindings,
+    };
+}
+/**
+ * Quick check: does this source have any critical findings?
+ */
+export function hasCriticalFindings(source, filePath) {
+    return scanSource(source, filePath).some((f) => f.severity === "critical");
+}
+/**
+ * Check if a file extension is scannable by the guard.
+ */
+export function isScannable(filePath, pathDeps) {
+    return SCANNABLE_EXTENSIONS.has(pathDeps.extname(filePath).toLowerCase());
+}
+//# sourceMappingURL=skill-guard.js.map

package/dist/skills/skill-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-guard.js","sourceRoot":"","sources":["../../src/skills/skill-guard.ts"],"names":[],"mappings":"AAAA,8EAA8E;AAC9E,iEAAiE;AACjE,wEAAwE;AACxE,uCAAuC;AACvC,8EAA8E;AAgC9E,MAAM,UAAU,GAAe;IAC7B;QACE,MAAM,EAAE,gBAAgB;QACxB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,kDAAkD;QAC3D,OAAO,EAAE,8DAA8D;QACvE,eAAe,EAAE,eAAe;KACjC;IACD;QACE,MAAM,EAAE,wBAAwB;QAChC,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,iCAAiC;QAC1C,OAAO,EAAE,iCAAiC;KAC3C;IACD;QACE,MAAM,EAAE,eAAe;QACvB,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,2CAA2C;QACpD,OAAO,EAAE,uDAAuD;KACjE;IACD;QACE,MAAM,EAAE,oBAAoB;QAC5B,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,2CAA2C;QACpD,OAAO,EAAE,kDAAkD;KAC5D;CACF,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;AAE5D,MAAM,YAAY,GAAiB;IACjC;QACE,MAAM,EAAE,wBAAwB;QAChC,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,mEAAmE;QAC5E,OAAO,EAAE,uBAAuB;QAChC,eAAe,EAAE,mCAAmC;KACrD;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,6DAA6D;QACtE,OAAO,EAAE,yBAAyB;KACnC;IACD;QACE,MAAM,EAAE,iBAAiB;QACzB,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,uEAAuE;QAChF,OAAO,EAAE,2DAA2D;KACrE;IACD;QACE,MAAM,EAAE,gBAAgB;QACxB,QAAQ,EAAE,UAAU;QACpB,OAAO,EACL,yFAAyF;QAC3F,OAAO,EAAE,cAAc;QACvB,eAAe,EAAE,mCAAmC;KACrD;CACF,CAAC;AAEF,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;CAC7D,CAAC,CAAC;AAEH,MAAM,sBAAsB,GAAG,GAAG,CAAC;AACnC,MAAM,sBAAsB,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,8EAA8E;AAC9E,4DAA4D;AAC5D,8EAA8E;AAE9E,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAM,GAAG,GAAG;IACtD,OAAO,QAAQ,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,CAAC;AAChF,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,QAAgB;IACzD,MAAM,QAAQ,GAAuB,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,gBAAgB,GAAG,IAAI,GAAG,EAAU,CAAC;IAE3C,aAAa;IACb,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QAChD,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QAEzE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,CAAC,KAAK;gBAAE,SAAS;YAErB,iDAAiD;YACjD,IAAI,IAAI,CAAC,MAAM,KAAK,oBAAoB,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACpC,IAAI,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,SAAS;YACzC,CAAC;YAED,QAAQ,CAAC,IAAI,CAAC;gBACZ,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;gBACvB,IAAI,EAAE,QAAQ;gBACd,IAAI,EAAE,CAAC,GAAG,CAAC;gBACX,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,QAAQ,EAAE,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aACxC,CAAC,CAAC;YACH,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YAClC,MAAM,CAAC,qCAAqC;QAC9C,CAAC;IACH,CAAC;IAED,eAAe;IACf,MAAM,kBAAkB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7C,KAAK,MAAM,IAAI,IAAI,YAAY,EAAE,CAAC;QAChC,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC;QAClD,IAAI,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC;YAAE,SAAS;QAC9C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QACzC,IAAI,IAAI,CAAC,eAAe,IAAI,CAAC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC;YAAE,SAAS;QAEzE,IAAI,SAAS,GAAG,CAAC,CAAC;QAClB,IAAI,aAAa,GAAG,EAAE,CAAC;QACvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACtC,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChC,SAAS,GAAG,CAAC,GAAG,CAAC,CAAC;gBAClB,aAAa,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;gBAChC,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,SAAS,KAAK,CAAC,EAAE,CAAC;YACpB,SAAS,GAAG,CAAC,CAAC;YACd,aAAa,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACvC,CAAC;QAED,QAAQ,CAAC,IAAI,CAAC;YACZ,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,QAAQ,EAAE,gBAAgB,CAAC,aAAa,CAAC;SAC1C,CAAC,CAAC;QACH,kBAAkB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAWD,KAAK,UAAU,gBAAgB,CAC7B,IAAoB,EACpB,OAAe,EACf,QAAgB;IAEhB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,KAAK,GAAa,CAAC,OAAO,CAAC,CAAC;IAElC,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QACnD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC;QAC/B,IAAI,CAAC,UAAU;YAAE,MAAM;QAEvB,IAAI,OAAmF,CAAC;QACxF,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,UAAU,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACrE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,IAAI,KAAK,CAAC,MAAM,IAAI,QAAQ;gBAAE,MAAM;YACpC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,IAAI,KAAK,cAAc;gBAAE,SAAS;YAE1E,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;YACxD,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACxB,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;iBAAM,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;gBACjF,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,IAAoB,EACpB,QAAgB,EAChB,IAAuB;IAEvB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,IAAI,sBAAsB,CAAC,CAAC;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,IAAI,sBAAsB,CAAC,CAAC;IAE/E,MAAM,KAAK,GACT,IAAI,EAAE,YAAY,IAAI,IAAI,CAAC,YAAY,CAAC,MAAM,GAAG,CAAC;QAChD,CAAC,CAAC,IAAI,CAAC,YAAY;QACnB,CAAC,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAEvD,MAAM,WAAW,GAAuB,EAAE,CAAC;IAC3C,IAAI,YAAY,GAAG,CAAC,CAAC;IAErB,KAAK,MAAM,QAAQ,IAAI,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,IAAI,GAAG,YAAY;gBAAE,SAAS;QACzC,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;QAED,YAAY,IAAI,CAAC,CAAC;QAClB,MAAM,QAAQ,GAAG,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QAC9C,WAAW,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,CAAC;IAChC,CAAC;IAED,OAAO;QACL,YAAY;QACZ,QAAQ,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;QACrE,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;QAC7D,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;QAC7D,QAAQ,EAAE,WAAW;KACtB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,QAAgB;IAClE,OAAO,UAAU,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC;AAC7E,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,QAAgB,EAAE,QAAuB;IACnE,OAAO,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;AAC5E,CAAC"}

package/dist/skills/skill-loader.d.ts

@@ -0,0 +1,17 @@
+import type { SkillEntry, SkillLoadLimits, SkillLoaderDeps, SkillSnapshot } from "./skill-types.js";
+/**
+ * Discover all skills from configured search paths, applying precedence merge
+ * and size/count limits. Returns fully parsed `SkillEntry` objects.
+ */
+export declare function loadSkillEntries(deps: SkillLoaderDeps): SkillEntry[];
+/**
+ * Filter skill entries by a name-based filter list.
+ * If filter is undefined or empty, returns all entries.
+ */
+export declare function filterSkillEntries(entries: SkillEntry[], skillFilter?: string[]): SkillEntry[];
+/**
+ * Build a system-prompt-embeddable skill snapshot.
+ * Applies count and character limits from the provided config.
+ */
+export declare function buildSkillSnapshot(entries: SkillEntry[], limits?: SkillLoadLimits, skillFilter?: string[]): SkillSnapshot;
+//# sourceMappingURL=skill-loader.d.ts.map

package/dist/skills/skill-loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-loader.d.ts","sourceRoot":"","sources":["../../src/skills/skill-loader.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,eAAe,EACf,aAAa,EAEd,MAAM,kBAAkB,CAAC;AAwM1B;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,UAAU,EAAE,CAyDpE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,UAAU,EAAE,EACrB,WAAW,CAAC,EAAE,MAAM,EAAE,GACrB,UAAU,EAAE,CAKd;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,OAAO,EAAE,UAAU,EAAE,EACrB,MAAM,CAAC,EAAE,eAAe,EACxB,WAAW,CAAC,EAAE,MAAM,EAAE,GACrB,aAAa,CAmDf"}