skill-checker 0.1.2 → 0.1.4

package/dist/index.d.ts

@@ -11,6 +11,7 @@ interface CheckResult {
     message: string;
     line?: number;
     snippet?: string;
+    source?: string;
     reducedFrom?: Severity;
     occurrences?: number;
 }

package/dist/index.js

@@ -1,12 +1,5 @@
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-
 // src/parser.ts
-import { readFileSync, readdirSync, statSync, existsSync } from "fs";
+import { readFileSync, readdirSync, lstatSync, existsSync, openSync, readSync, closeSync } from "fs";
 import { join, extname, basename, resolve } from "path";
 import { parse as parseYaml } from "yaml";
 var BINARY_EXTENSIONS = /* @__PURE__ */ new Set([
@@ -134,52 +127,66 @@ function enumerateFiles(dirPath, warnings) {
     }
     for (const entry of entries) {
       const fullPath = join(currentDir, entry.name);
-      if (entry.isDirectory()) {
+      const relativePath = fullPath.slice(dirPath.length + 1);
+      let lstats;
+      try {
+        lstats = lstatSync(fullPath);
+      } catch {
+        continue;
+      }
+      if (lstats.isSymbolicLink()) {
+        warnings.push(`Skipped symlink: ${relativePath}`);
+        continue;
+      }
+      if (lstats.isDirectory()) {
         if (SKIP_DIRS.has(entry.name)) continue;
         if (WARN_SKIP_DIRS.has(entry.name)) {
-          const rel = fullPath.slice(dirPath.length + 1);
-          warnings.push(`Skipped directory: ${rel}. May contain unscanned files.`);
+          warnings.push(`Skipped directory: ${relativePath}. May contain unscanned files.`);
           continue;
         }
         walk(fullPath, depth + 1);
         continue;
       }
-      const ext = extname(entry.name).toLowerCase();
-      let stats;
-      try {
-        stats = statSync(fullPath);
-      } catch {
+      if (!lstats.isFile()) {
+        warnings.push(`Skipped special file: ${relativePath}`);
         continue;
       }
+      const ext = extname(entry.name).toLowerCase();
       const isBinary = BINARY_EXTENSIONS.has(ext);
-      const relativePath = fullPath.slice(dirPath.length + 1);
       let content;
       if (!isBinary) {
-        if (stats.size <= FULL_READ_LIMIT) {
+        if (lstats.size <= FULL_READ_LIMIT) {
           try {
             content = readFileSync(fullPath, "utf-8");
           } catch {
           }
-        } else if (stats.size <= 5e7) {
+        } else if (lstats.size <= 5e7) {
+          let fd;
           try {
-            const fd = __require("fs").openSync(fullPath, "r");
+            fd = openSync(fullPath, "r");
             const buf = Buffer.alloc(PARTIAL_READ_LIMIT);
-            const bytesRead = __require("fs").readSync(fd, buf, 0, PARTIAL_READ_LIMIT, 0);
-            __require("fs").closeSync(fd);
+            const bytesRead = readSync(fd, buf, 0, PARTIAL_READ_LIMIT, 0);
             content = buf.slice(0, bytesRead).toString("utf-8");
-            warnings.push(`Large file partially scanned (first ${PARTIAL_READ_LIMIT} bytes): ${relativePath} (${stats.size} bytes total)`);
+            warnings.push(`Large file partially scanned (first ${PARTIAL_READ_LIMIT} bytes): ${relativePath} (${lstats.size} bytes total)`);
           } catch {
-            warnings.push(`Large file could not be read: ${relativePath} (${stats.size} bytes)`);
+            warnings.push(`Large file could not be read: ${relativePath} (${lstats.size} bytes)`);
+          } finally {
+            if (fd !== void 0) {
+              try {
+                closeSync(fd);
+              } catch {
+              }
+            }
           }
         } else {
-          warnings.push(`File too large to scan: ${relativePath} (${stats.size} bytes). Content not checked.`);
+          warnings.push(`File too large to scan: ${relativePath} (${lstats.size} bytes). Content not checked.`);
         }
       }
       files.push({
         path: relativePath,
         name: basename(entry.name, ext),
         extension: ext,
-        sizeBytes: stats.size,
+        sizeBytes: lstats.size,
         isBinary,
         content
       });
@@ -271,7 +278,8 @@ var structuralChecks = {
           category: "STRUCT",
           severity: "HIGH",
           title: "Unexpected binary/executable file",
-          message: `Found unexpected file: ${file.path} (${ext})`
+          message: `Found unexpected file: ${file.path} (${ext})`,
+          source: file.path
         });
       }
     }
@@ -297,12 +305,14 @@ var structuralChecks = {
       }
     }
     for (const warning of skill.warnings) {
+      const pathMatch = warning.match(/:\s*(.+?)(?:\s*\(|$)/);
       results.push({
         id: "STRUCT-008",
         category: "STRUCT",
         severity: "MEDIUM",
         title: "Scan coverage warning",
-        message: warning
+        message: warning,
+        source: pathMatch?.[1]?.trim()
       });
     }
     return results;
@@ -1014,7 +1024,11 @@ function getHookAction(policy, severity) {
       LOW: "report"
     }
   };
-  return matrix[policy][severity];
+  const row = matrix[policy];
+  if (!row) {
+    return matrix.balanced[severity];
+  }
+  return row[severity];
 }
 
 // src/checks/code-safety.ts
@@ -1106,7 +1120,8 @@ var codeSafetyChecks = {
           severity: "CRITICAL",
           title: "eval/exec/Function constructor",
           loc,
-          lineNum
+          lineNum,
+          source
         });
         if (!SHELL_EXEC_FALSE_POSITIVES.some((p) => p.test(line))) {
           checkPatterns(results, line, SHELL_EXEC_PATTERNS, {
@@ -1114,7 +1129,8 @@ var codeSafetyChecks = {
             severity: "CRITICAL",
             title: "Shell/subprocess execution",
             loc,
-            lineNum
+            lineNum,
+            source
           });
         }
         checkPatterns(results, line, DESTRUCTIVE_PATTERNS, {
@@ -1123,6 +1139,7 @@ var codeSafetyChecks = {
           title: "Destructive file operation",
           loc,
           lineNum,
+          source,
           codeBlockCtx: cbCtx
         });
         checkPatterns(results, line, NETWORK_PATTERNS, {
@@ -1131,6 +1148,7 @@ var codeSafetyChecks = {
           title: "Hardcoded external URL/network request",
           loc,
           lineNum,
+          source,
           codeBlockCtx: cbCtx
         });
         checkPatterns(results, line, FILE_WRITE_PATTERNS, {
@@ -1138,7 +1156,8 @@ var codeSafetyChecks = {
           severity: "HIGH",
           title: "File write outside expected directory",
           loc,
-          lineNum
+          lineNum,
+          source
         });
         checkPatterns(results, line, ENV_ACCESS_PATTERNS, {
           id: "CODE-006",
@@ -1146,6 +1165,7 @@ var codeSafetyChecks = {
           title: "Environment variable access",
           loc,
           lineNum,
+          source,
           codeBlockCtx: cbCtx
         });
         checkPatterns(results, line, DYNAMIC_CODE_PATTERNS, {
@@ -1153,7 +1173,8 @@ var codeSafetyChecks = {
           severity: "HIGH",
           title: "Dynamic code generation pattern",
           loc,
-          lineNum
+          lineNum,
+          source
         });
         {
           const isDoc = isInDocumentationContext(lines, i);
@@ -1163,7 +1184,8 @@ var codeSafetyChecks = {
               severity: "HIGH",
               title: "Permission escalation",
               loc,
-              lineNum
+              lineNum,
+              source
             });
           }
         }
@@ -1194,6 +1216,7 @@ function checkPatterns(results, line, patterns, opts) {
         message: `At ${opts.loc}: ${line.trim().slice(0, 120)}${msgSuffix}`,
         line: opts.lineNum,
         snippet: line.trim().slice(0, 120),
+        source: opts.source,
         reducedFrom
       });
       return;
@@ -1225,7 +1248,8 @@ function scanEncodedStrings(results, text, source) {
         title: "Long encoded string",
         message: `${source}:${lineNum}: Found ${str.length}-char encoded string.`,
         line: lineNum,
-        snippet: str.slice(0, 80) + "..."
+        snippet: str.slice(0, 80) + "...",
+        source
       });
     }
   }
@@ -1240,7 +1264,8 @@ function scanEncodedStrings(results, text, source) {
         severity: "MEDIUM",
         title: "High entropy string",
         message: `${source}:${lineNum}: String "${match[0].slice(0, 30)}..." has entropy ${entropy.toFixed(2)} bits/char.`,
-        line: lineNum
+        line: lineNum,
+        source
       });
     }
   }
@@ -1257,7 +1282,8 @@ function scanEncodedStrings(results, text, source) {
         category: "CODE",
         severity: "CRITICAL",
         title: "Multi-layer encoding detected",
-        message: `${source}: Contains nested encoding/decoding operations.`
+        message: `${source}: Contains nested encoding/decoding operations.`,
+        source
       });
       break;
     }
@@ -1272,7 +1298,8 @@ function scanObfuscation(results, text, source) {
       category: "CODE",
       severity: "MEDIUM",
       title: "Obfuscated variable names",
-      message: `${source}: Found ${obfMatches.length} hex-style variable names (e.g. ${obfMatches[0]}). May indicate obfuscated code.`
+      message: `${source}: Found ${obfMatches.length} hex-style variable names (e.g. ${obfMatches[0]}). May indicate obfuscated code.`,
+      source
     });
   }
 }
@@ -1466,6 +1493,7 @@ var supplyChainChecks = {
           message: `${source}:${lineNum}: References an MCP server. Verify it is from a trusted source.${msgSuffix}`,
           line: lineNum,
           snippet: line.trim().slice(0, 120),
+          source,
           reducedFrom
         });
       }
@@ -1477,7 +1505,8 @@ var supplyChainChecks = {
           title: "npx -y auto-install",
           message: `${source}:${lineNum}: Uses npx -y which auto-installs packages without confirmation.`,
           line: lineNum,
-          snippet: line.trim().slice(0, 120)
+          snippet: line.trim().slice(0, 120),
+          source
         });
       }
       if (NPM_INSTALL_PATTERN.test(line) || PIP_INSTALL_PATTERN.test(line)) {
@@ -1507,6 +1536,7 @@ var supplyChainChecks = {
             message: `${source}:${lineNum}: Installs packages. Verify package names are legitimate.${msgSuffix}`,
             line: lineNum,
             snippet: line.trim().slice(0, 120),
+            source,
             reducedFrom
           });
         }
@@ -1519,7 +1549,8 @@ var supplyChainChecks = {
           title: "git clone command",
           message: `${source}:${lineNum}: Clones a git repository. Verify the source.`,
           line: lineNum,
-          snippet: line.trim().slice(0, 120)
+          snippet: line.trim().slice(0, 120),
+          source
         });
       }
       const urls = line.match(URL_PATTERN) || [];
@@ -1548,6 +1579,7 @@ var supplyChainChecks = {
               message: `${source}:${lineNum}: Uses insecure HTTP: ${url}${msgSuffix}`,
               line: lineNum,
               snippet: url,
+              source,
               reducedFrom
             });
           }
@@ -1561,7 +1593,8 @@ var supplyChainChecks = {
               title: "IP address used instead of domain",
               message: `${source}:${lineNum}: Uses raw IP address: ${url}. This may bypass DNS-based security.`,
               line: lineNum,
-              snippet: url
+              snippet: url,
+              source
             });
           }
         }
@@ -1575,7 +1608,8 @@ var supplyChainChecks = {
               title: "Suspicious domain detected",
               message: `${source}:${lineNum}: References suspicious domain "${domain}".`,
               line: lineNum,
-              snippet: url
+              snippet: url,
+              source
             });
             break;
           }
@@ -1775,7 +1809,7 @@ var resourceChecks = {
 
 // src/ioc/matcher.ts
 import { createHash } from "crypto";
-import { openSync, readSync, closeSync, statSync as statSync2 } from "fs";
+import { openSync as openSync2, readSync as readSync2, closeSync as closeSync2, statSync } from "fs";
 import { join as join3 } from "path";
 
 // src/utils/levenshtein.ts
@@ -1824,18 +1858,18 @@ function isPrivateIP(ip) {
 var HASH_CHUNK_SIZE = 64 * 1024;
 function computeFileHash(filePath) {
   const hash = createHash("sha256");
-  const fd = openSync(filePath, "r");
+  const fd = openSync2(filePath, "r");
   try {
     const buf = Buffer.alloc(HASH_CHUNK_SIZE);
     let bytesRead;
     do {
-      bytesRead = readSync(fd, buf, 0, HASH_CHUNK_SIZE, null);
+      bytesRead = readSync2(fd, buf, 0, HASH_CHUNK_SIZE, null);
       if (bytesRead > 0) {
         hash.update(buf.subarray(0, bytesRead));
       }
     } while (bytesRead > 0);
   } finally {
-    closeSync(fd);
+    closeSync2(fd);
   }
   return hash.digest("hex");
 }
@@ -1846,7 +1880,7 @@ function matchMaliciousHashes(skill, ioc) {
   for (const file of skill.files) {
     const filePath = join3(skill.dirPath, file.path);
     try {
-      const stat = statSync2(filePath);
+      const stat = statSync(filePath);
       if (stat.size === 0) continue;
       const hash = computeFileHash(filePath);
       if (hash === EMPTY_FILE_HASH) continue;
@@ -1937,7 +1971,8 @@ var iocChecks = {
         severity: "CRITICAL",
         title: "Known malicious file hash",
         message: `File "${match.file}" matches known malicious hash: ${match.description}`,
-        snippet: match.hash
+        snippet: match.hash,
+        source: match.file
       });
     }
     const ipMatches = matchC2IPs(skill, ioc);
@@ -1949,7 +1984,8 @@ var iocChecks = {
         title: "Known C2 IP address",
         message: `${match.source}:${match.line}: Contains known C2 server IP: ${match.ip}`,
         line: match.line,
-        snippet: match.snippet
+        snippet: match.snippet,
+        source: match.source
       });
     }
     const skillName = skill.frontmatter.name;
@@ -2046,8 +2082,8 @@ function deduplicateResults(results) {
     LOW: 1
   };
   for (const r of results) {
-    const sourceFile = extractSourceFile(r.message);
-    const key = `${r.id}::${sourceFile}`;
+    const sourceKey = r.source ?? `_no_source_:${r.category}:${r.line ?? ""}`;
+    const key = `${r.id}::${sourceKey}`;
     const group = groups.get(key);
     if (group) {
       group.push(r);
@@ -2061,16 +2097,13 @@ function deduplicateResults(results) {
     const best = { ...group[0] };
     if (group.length > 1) {
       best.occurrences = group.length;
-      best.message += ` (${group.length} occurrences in this file)`;
+      const suffix = best.source ? ` (${group.length} occurrences in this file)` : ` (${group.length} occurrences)`;
+      best.message += suffix;
     }
     deduped.push(best);
   }
   return deduped;
 }
-function extractSourceFile(message) {
-  const m = message.match(/^(?:At\s+)?([^:]+):\d+:/);
-  return m?.[1] ?? "unknown";
-}
 function calculateScore(results) {
   let score = 100;
   for (const r of results) {