skillshield 1.0.0 → 2.1.0

package/dist/shield/index.js

@@ -0,0 +1,88 @@
+/**
+ * SkillShield — Unified Runtime Security Engine
+ *
+ * Combines: Pre-scan (guard) + Network Policy + Filesystem Jail +
+ * Runtime Monitor + Kill Switch + Audit Trail
+ *
+ * This is what makes SkillShield unique:
+ * - Snyk/Cisco only scan before install
+ * - NVIDIA OpenShell needs Linux + enterprise infra
+ * - Aegis only intercepts LLM API calls
+ * - SkillShield does scan + runtime in one CLI, cross-platform
+ */
+export { NetworkPolicyEngine, parseNetworkPolicy } from './network-policy.js';
+export { FilesystemJail, parseFilesystemPolicy } from './filesystem-jail.js';
+export { RuntimeMonitor, getDefaultMonitorPolicy } from './runtime-monitor.js';
+export { AuditTrail } from './audit-trail.js';
+import { NetworkPolicyEngine, parseNetworkPolicy } from './network-policy.js';
+import { FilesystemJail, parseFilesystemPolicy } from './filesystem-jail.js';
+import { RuntimeMonitor, getDefaultMonitorPolicy } from './runtime-monitor.js';
+import { AuditTrail } from './audit-trail.js';
+/**
+ * The main Shield — orchestrates all security layers.
+ */
+export class SkillShield {
+    constructor(config) {
+        this.config = config;
+        const frontmatter = config.frontmatter || {};
+        const workDir = config.workDir || process.cwd();
+        // Initialize network policy
+        const baseNetPolicy = parseNetworkPolicy(frontmatter);
+        const netPolicy = { ...baseNetPolicy, ...config.networkPolicy };
+        this.network = new NetworkPolicyEngine(netPolicy);
+        // Initialize filesystem jail
+        const baseFsPolicy = parseFilesystemPolicy(frontmatter, workDir);
+        const fsPolicy = { ...baseFsPolicy, ...config.filesystemPolicy };
+        this.filesystem = new FilesystemJail(fsPolicy);
+        // Initialize runtime monitor
+        const baseMonPolicy = getDefaultMonitorPolicy();
+        const monPolicy = { ...baseMonPolicy, ...config.monitorPolicy };
+        this.monitor = new RuntimeMonitor(monPolicy);
+        // Initialize audit trail
+        this.audit = new AuditTrail(config.skillId);
+    }
+    /**
+     * Generate the combined enforcement code that wraps skill execution.
+     * This code is prepended to the skill's execution context.
+     */
+    generateEnforcementWrapper() {
+        const networkCode = this.network.generateEnforcementCode();
+        const filesystemCode = this.filesystem.generateEnforcementCode();
+        return `
+// ╔══════════════════════════════════════════════════════════════╗
+// ║              SKILLSHIELD RUNTIME ENFORCEMENT                ║
+// ║  Network Policy + Filesystem Jail + Output Monitoring       ║
+// ╚══════════════════════════════════════════════════════════════╝
+${networkCode}
+${filesystemCode}
+// ── SkillShield Ready ──
+console.error('[SkillShield] Runtime enforcement active');
+`;
+    }
+    /**
+     * Get the final shield report after execution.
+     */
+    getReport(scanScore, scanStatus, durationMs) {
+        const networkStats = this.network.getStats();
+        const fsStats = this.filesystem.getStats();
+        const monitorReport = this.monitor.getReport();
+        const auditVerification = this.audit.verify();
+        return {
+            skillId: this.config.skillId,
+            timestamp: new Date().toISOString(),
+            scanScore,
+            scanStatus,
+            killed: this.monitor.isKilled(),
+            killReason: monitorReport.killReason,
+            durationMs,
+            networkViolations: networkStats.violations,
+            filesystemViolations: fsStats.violations,
+            runtimeThreats: monitorReport.threatsDetected,
+            totalViolations: networkStats.violations + fsStats.violations + monitorReport.threatsDetected,
+            auditHash: this.audit.getLatestHash(),
+            auditLength: this.audit.getLength(),
+            auditVerified: auditVerification.valid,
+        };
+    }
+}
+//# sourceMappingURL=index.js.map

package/dist/shield/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/shield/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAG9E,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAE,MAAM,sBAAsB,CAAC;AAG7E,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAG/E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAG9C,OAAO,EAAE,mBAAmB,EAAE,kBAAkB,EAAsB,MAAM,qBAAqB,CAAC;AAClG,OAAO,EAAE,cAAc,EAAE,qBAAqB,EAAyB,MAAM,sBAAsB,CAAC;AACpG,OAAO,EAAE,cAAc,EAAE,uBAAuB,EAAsB,MAAM,sBAAsB,CAAC;AACnG,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAyC9C;;GAEG;AACH,MAAM,OAAO,WAAW;IAOtB,YAAY,MAAoB;QAC9B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,MAAM,WAAW,GAAG,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;QAEhD,4BAA4B;QAC5B,MAAM,aAAa,GAAG,kBAAkB,CAAC,WAAW,CAAC,CAAC;QACtD,MAAM,SAAS,GAAkB,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;QAC/E,IAAI,CAAC,OAAO,GAAG,IAAI,mBAAmB,CAAC,SAAS,CAAC,CAAC;QAElD,6BAA6B;QAC7B,MAAM,YAAY,GAAG,qBAAqB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,QAAQ,GAAqB,EAAE,GAAG,YAAY,EAAE,GAAG,MAAM,CAAC,gBAAgB,EAAE,CAAC;QACnF,IAAI,CAAC,UAAU,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC,CAAC;QAE/C,6BAA6B;QAC7B,MAAM,aAAa,GAAG,uBAAuB,EAAE,CAAC;QAChD,MAAM,SAAS,GAAkB,EAAE,GAAG,aAAa,EAAE,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;QAC/E,IAAI,CAAC,OAAO,GAAG,IAAI,cAAc,CAAC,SAAS,CAAC,CAAC;QAE7C,yBAAyB;QACzB,IAAI,CAAC,KAAK,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED;;;OAGG;IACH,0BAA0B;QACxB,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,uBAAuB,EAAE,CAAC;QAC3D,MAAM,cAAc,GAAG,IAAI,CAAC,UAAU,CAAC,uBAAuB,EAAE,CAAC;QAEjE,OAAO;;;;;EAKT,WAAW;EACX,cAAc;;;CAGf,CAAC;IACA,CAAC;IAED;;OAEG;IACH,SAAS,CAAC,SAAiB,EAAE,UAAkB,EAAE,UAAkB;QACjE,MAAM,YAAY,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE,CAAC;QAC7C,MAAM,OAAO,GAAG,IAAI,CAAC,UAAU,CAAC,QAAQ,EAAE,CAAC;QAC3C,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QAC/C,MAAM,iBAAiB,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAE9C,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,OAAO;YAC5B,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS;YACT,UAAU;YACV,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,EAAE;YAC/B,UAAU,EAAE,aAAa,CAAC,UAAU;YACpC,UAAU;YACV,iBAAiB,EAAE,YAAY,CAAC,UAAU;YAC1C,oBAAoB,EAAE,OAAO,CAAC,UAAU;YACxC,cAAc,EAAE,aAAa,CAAC,eAAe;YAC7C,eAAe,EAAE,YAAY,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,GAAG,aAAa,CAAC,eAAe;YAC7F,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,aAAa,EAAE;YACrC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE;YACnC,aAAa,EAAE,iBAAiB,CAAC,KAAK;SACvC,CAAC;IACJ,CAAC;CACF"}

package/dist/shield/network-policy.d.ts

@@ -0,0 +1,74 @@
+/**
+ * SkillShield — Network Policy Engine
+ *
+ * Per-skill domain allowlisting. Skills declare which domains they need,
+ * and SkillShield blocks everything else at the DNS resolution level.
+ *
+ * This is what Snyk and Cisco DON'T do — they scan before install,
+ * but can't stop a skill from phoning home at runtime.
+ */
+export interface NetworkPolicy {
+    /** Allowed domains (e.g., ["api.openai.com", "api.anthropic.com"]) */
+    allowedDomains: string[];
+    /** Allowed IP ranges in CIDR notation (e.g., ["10.0.0.0/8"]) */
+    allowedIPs?: string[];
+    /** Block all outbound by default? (true = default-deny) */
+    defaultDeny: boolean;
+    /** Max concurrent connections per skill */
+    maxConnections?: number;
+    /** Max data transfer in bytes (prevent exfiltration) */
+    maxTransferBytes?: number;
+    /** Block known malicious IPs/domains */
+    blockMalicious?: boolean;
+}
+export interface NetworkViolation {
+    timestamp: string;
+    type: 'DNS_BLOCKED' | 'CONNECTION_BLOCKED' | 'TRANSFER_EXCEEDED' | 'MALICIOUS_DOMAIN';
+    domain?: string;
+    ip?: string;
+    port?: number;
+    details: string;
+}
+export declare class NetworkPolicyEngine {
+    private policy;
+    private violations;
+    private connectionCount;
+    private transferredBytes;
+    private blockedDomains;
+    constructor(policy: NetworkPolicy);
+    /**
+     * Check if a domain is allowed by the policy.
+     * Returns true if allowed, false if blocked.
+     */
+    checkDomain(domain: string): boolean;
+    /**
+     * Check if a connection attempt is allowed.
+     */
+    checkConnection(domain: string, port: number): boolean;
+    /**
+     * Track data transfer and block if limit exceeded.
+     */
+    trackTransfer(bytes: number): boolean;
+    /**
+     * Generate the Node.js code that enforces this policy at runtime.
+     * This wraps the skill's execution with DNS/network interception.
+     */
+    generateEnforcementCode(): string;
+    private recordViolation;
+    getViolations(): NetworkViolation[];
+    getStats(): {
+        connections: number;
+        transferredBytes: number;
+        violations: number;
+    };
+    reset(): void;
+}
+/**
+ * Parse network policy from SKILL.md frontmatter.
+ * Expected format in frontmatter:
+ *   network:
+ *     allowed: ["api.openai.com", "api.anthropic.com"]
+ *     maxTransferMB: 10
+ */
+export declare function parseNetworkPolicy(frontmatter: Record<string, unknown>): NetworkPolicy;
+//# sourceMappingURL=network-policy.d.ts.map

package/dist/shield/network-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-policy.d.ts","sourceRoot":"","sources":["../../src/shield/network-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,MAAM,WAAW,aAAa;IAC5B,sEAAsE;IACtE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,gEAAgE;IAChE,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC;IACtB,2DAA2D;IAC3D,WAAW,EAAE,OAAO,CAAC;IACrB,2CAA2C;IAC3C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wCAAwC;IACxC,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAED,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,aAAa,GAAG,oBAAoB,GAAG,mBAAmB,GAAG,kBAAkB,CAAC;IACtF,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,CAAC;CACjB;AA0BD,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,UAAU,CAA0B;IAC5C,OAAO,CAAC,eAAe,CAAa;IACpC,OAAO,CAAC,gBAAgB,CAAa;IACrC,OAAO,CAAC,cAAc,CAAc;gBAExB,MAAM,EAAE,aAAa;IAQjC;;;OAGG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAgDpC;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO;IAqBtD;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAcrC;;;OAGG;IACH,uBAAuB,IAAI,MAAM;IA6DjC,OAAO,CAAC,eAAe;IAOvB,aAAa,IAAI,gBAAgB,EAAE;IAInC,QAAQ,IAAI;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,gBAAgB,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;IAQjF,KAAK,IAAI,IAAI;CAKd;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,aAAa,CAYtF"}

package/dist/shield/network-policy.js

@@ -0,0 +1,226 @@
+/**
+ * SkillShield — Network Policy Engine
+ *
+ * Per-skill domain allowlisting. Skills declare which domains they need,
+ * and SkillShield blocks everything else at the DNS resolution level.
+ *
+ * This is what Snyk and Cisco DON'T do — they scan before install,
+ * but can't stop a skill from phoning home at runtime.
+ */
+/** Known malicious domains commonly used in skill attacks */
+const MALICIOUS_DOMAINS = [
+    'evil.com',
+    'attacker.com',
+    'exfil.io',
+    'c2server.net',
+    'malware.download',
+    'ngrok.io', // Tunneling — often used for exfiltration
+    'requestbin.com', // Data capture
+    'webhook.site', // Data capture
+    'pipedream.net', // Data capture
+    'burpcollaborator.net', // Pentesting tool
+];
+/** Known mining pool domains */
+const MINING_DOMAINS = [
+    'pool.monero.cc',
+    'xmr.pool.minergate.com',
+    'cryptonight.usa.nicehash.com',
+    'mine.xmrpool.net',
+    'coinhive.com',
+    'authedmine.com',
+];
+export class NetworkPolicyEngine {
+    constructor(policy) {
+        this.violations = [];
+        this.connectionCount = 0;
+        this.transferredBytes = 0;
+        this.policy = policy;
+        this.blockedDomains = new Set([
+            ...MALICIOUS_DOMAINS,
+            ...(policy.blockMalicious !== false ? MINING_DOMAINS : []),
+        ]);
+    }
+    /**
+     * Check if a domain is allowed by the policy.
+     * Returns true if allowed, false if blocked.
+     */
+    checkDomain(domain) {
+        const normalizedDomain = domain.toLowerCase().trim();
+        // Check malicious domains first
+        if (this.blockedDomains.has(normalizedDomain)) {
+            this.recordViolation({
+                type: 'MALICIOUS_DOMAIN',
+                domain: normalizedDomain,
+                details: `Blocked known malicious domain: ${normalizedDomain}`,
+            });
+            return false;
+        }
+        // Check against subdomain patterns in malicious list
+        for (const malicious of this.blockedDomains) {
+            if (normalizedDomain.endsWith(`.${malicious}`)) {
+                this.recordViolation({
+                    type: 'MALICIOUS_DOMAIN',
+                    domain: normalizedDomain,
+                    details: `Blocked subdomain of malicious domain: ${normalizedDomain} (parent: ${malicious})`,
+                });
+                return false;
+            }
+        }
+        // Default deny mode — only allowlisted domains pass
+        if (this.policy.defaultDeny) {
+            const isAllowed = this.policy.allowedDomains.some((allowed) => {
+                const normalizedAllowed = allowed.toLowerCase().trim();
+                return (normalizedDomain === normalizedAllowed ||
+                    normalizedDomain.endsWith(`.${normalizedAllowed}`));
+            });
+            if (!isAllowed) {
+                this.recordViolation({
+                    type: 'DNS_BLOCKED',
+                    domain: normalizedDomain,
+                    details: `Domain not in allowlist: ${normalizedDomain}. Allowed: [${this.policy.allowedDomains.join(', ')}]`,
+                });
+                return false;
+            }
+        }
+        return true;
+    }
+    /**
+     * Check if a connection attempt is allowed.
+     */
+    checkConnection(domain, port) {
+        // Check domain first
+        if (!this.checkDomain(domain)) {
+            return false;
+        }
+        // Check max connections
+        if (this.policy.maxConnections && this.connectionCount >= this.policy.maxConnections) {
+            this.recordViolation({
+                type: 'CONNECTION_BLOCKED',
+                domain,
+                port,
+                details: `Max connections exceeded: ${this.connectionCount}/${this.policy.maxConnections}`,
+            });
+            return false;
+        }
+        this.connectionCount++;
+        return true;
+    }
+    /**
+     * Track data transfer and block if limit exceeded.
+     */
+    trackTransfer(bytes) {
+        this.transferredBytes += bytes;
+        if (this.policy.maxTransferBytes && this.transferredBytes > this.policy.maxTransferBytes) {
+            this.recordViolation({
+                type: 'TRANSFER_EXCEEDED',
+                details: `Transfer limit exceeded: ${this.transferredBytes}/${this.policy.maxTransferBytes} bytes`,
+            });
+            return false;
+        }
+        return true;
+    }
+    /**
+     * Generate the Node.js code that enforces this policy at runtime.
+     * This wraps the skill's execution with DNS/network interception.
+     */
+    generateEnforcementCode() {
+        const allowedJSON = JSON.stringify(this.policy.allowedDomains);
+        const blockedJSON = JSON.stringify([...this.blockedDomains]);
+        return `
+// ── SkillShield Network Policy Enforcement ──
+const __ss_allowed = new Set(${allowedJSON}.map(d => d.toLowerCase()));
+const __ss_blocked = new Set(${blockedJSON}.map(d => d.toLowerCase()));
+const __ss_defaultDeny = ${this.policy.defaultDeny};
+const __ss_maxTransfer = ${this.policy.maxTransferBytes || 0};
+let __ss_transferred = 0;
+
+const __ss_originalDnsLookup = require('dns').lookup;
+require('dns').lookup = function(hostname, options, callback) {
+  const domain = hostname.toLowerCase();
+
+  // Block malicious
+  for (const blocked of __ss_blocked) {
+    if (domain === blocked || domain.endsWith('.' + blocked)) {
+      const err = new Error('[SkillShield] BLOCKED: ' + domain + ' is a known malicious domain');
+      err.code = 'ENOTFOUND';
+      if (typeof options === 'function') return options(err);
+      return callback(err);
+    }
+  }
+
+  // Default deny check
+  if (__ss_defaultDeny) {
+    let allowed = false;
+    for (const a of __ss_allowed) {
+      if (domain === a || domain.endsWith('.' + a)) { allowed = true; break; }
+    }
+    if (!allowed) {
+      const err = new Error('[SkillShield] BLOCKED: ' + domain + ' not in network policy allowlist');
+      err.code = 'ENOTFOUND';
+      if (typeof options === 'function') return options(err);
+      return callback(err);
+    }
+  }
+
+  return __ss_originalDnsLookup.call(this, hostname, options, callback);
+};
+
+// Intercept http/https to track transfer size
+const __ss_origRequest = require('https').request;
+require('https').request = function(...args) {
+  const req = __ss_origRequest.apply(this, args);
+  req.on('response', (res) => {
+    res.on('data', (chunk) => {
+      __ss_transferred += chunk.length;
+      if (__ss_maxTransfer > 0 && __ss_transferred > __ss_maxTransfer) {
+        res.destroy(new Error('[SkillShield] Transfer limit exceeded: ' + __ss_transferred + ' bytes'));
+      }
+    });
+  });
+  return req;
+};
+// ── End SkillShield Network Policy ──
+`;
+    }
+    recordViolation(partial) {
+        this.violations.push({
+            ...partial,
+            timestamp: new Date().toISOString(),
+        });
+    }
+    getViolations() {
+        return [...this.violations];
+    }
+    getStats() {
+        return {
+            connections: this.connectionCount,
+            transferredBytes: this.transferredBytes,
+            violations: this.violations.length,
+        };
+    }
+    reset() {
+        this.violations = [];
+        this.connectionCount = 0;
+        this.transferredBytes = 0;
+    }
+}
+/**
+ * Parse network policy from SKILL.md frontmatter.
+ * Expected format in frontmatter:
+ *   network:
+ *     allowed: ["api.openai.com", "api.anthropic.com"]
+ *     maxTransferMB: 10
+ */
+export function parseNetworkPolicy(frontmatter) {
+    const network = (frontmatter.network || frontmatter.networking || {});
+    const allowed = (network.allowed || network.domains || []);
+    const maxTransferMB = (network.maxTransferMB || network.maxTransfer || 10);
+    return {
+        allowedDomains: allowed.length > 0 ? allowed : [],
+        defaultDeny: allowed.length > 0, // If skill declares domains, enforce them
+        maxConnections: network.maxConnections || 50,
+        maxTransferBytes: maxTransferMB * 1024 * 1024,
+        blockMalicious: true,
+    };
+}
+//# sourceMappingURL=network-policy.js.map

package/dist/shield/network-policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-policy.js","sourceRoot":"","sources":["../../src/shield/network-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AA0BH,6DAA6D;AAC7D,MAAM,iBAAiB,GAAa;IAClC,UAAU;IACV,cAAc;IACd,UAAU;IACV,cAAc;IACd,kBAAkB;IAClB,UAAU,EAAQ,0CAA0C;IAC5D,gBAAgB,EAAE,eAAe;IACjC,cAAc,EAAI,eAAe;IACjC,eAAe,EAAG,eAAe;IACjC,sBAAsB,EAAE,kBAAkB;CAC3C,CAAC;AAEF,gCAAgC;AAChC,MAAM,cAAc,GAAa;IAC/B,gBAAgB;IAChB,wBAAwB;IACxB,8BAA8B;IAC9B,kBAAkB;IAClB,cAAc;IACd,gBAAgB;CACjB,CAAC;AAEF,MAAM,OAAO,mBAAmB;IAO9B,YAAY,MAAqB;QALzB,eAAU,GAAuB,EAAE,CAAC;QACpC,oBAAe,GAAW,CAAC,CAAC;QAC5B,qBAAgB,GAAW,CAAC,CAAC;QAInC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,cAAc,GAAG,IAAI,GAAG,CAAC;YAC5B,GAAG,iBAAiB;YACpB,GAAG,CAAC,MAAM,CAAC,cAAc,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,MAAc;QACxB,MAAM,gBAAgB,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;QAErD,gCAAgC;QAChC,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;YAC9C,IAAI,CAAC,eAAe,CAAC;gBACnB,IAAI,EAAE,kBAAkB;gBACxB,MAAM,EAAE,gBAAgB;gBACxB,OAAO,EAAE,mCAAmC,gBAAgB,EAAE;aAC/D,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,qDAAqD;QACrD,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAC5C,IAAI,gBAAgB,CAAC,QAAQ,CAAC,IAAI,SAAS,EAAE,CAAC,EAAE,CAAC;gBAC/C,IAAI,CAAC,eAAe,CAAC;oBACnB,IAAI,EAAE,kBAAkB;oBACxB,MAAM,EAAE,gBAAgB;oBACxB,OAAO,EAAE,0CAA0C,gBAAgB,aAAa,SAAS,GAAG;iBAC7F,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,oDAAoD;QACpD,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;YAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE;gBAC5D,MAAM,iBAAiB,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;gBACvD,OAAO,CACL,gBAAgB,KAAK,iBAAiB;oBACtC,gBAAgB,CAAC,QAAQ,CAAC,IAAI,iBAAiB,EAAE,CAAC,CACnD,CAAC;YACJ,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,SAAS,EAAE,CAAC;gBACf,IAAI,CAAC,eAAe,CAAC;oBACnB,IAAI,EAAE,aAAa;oBACnB,MAAM,EAAE,gBAAgB;oBACxB,OAAO,EAAE,4BAA4B,gBAAgB,eAAe,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;iBAC7G,CAAC,CAAC;gBACH,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,MAAc,EAAE,IAAY;QAC1C,qBAAqB;QACrB,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC;QACf,CAAC;QAED,wBAAwB;QACxB,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,IAAI,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;YACrF,IAAI,CAAC,eAAe,CAAC;gBACnB,IAAI,EAAE,oBAAoB;gBAC1B,MAAM;gBACN,IAAI;gBACJ,OAAO,EAAE,6BAA6B,IAAI,CAAC,eAAe,IAAI,IAAI,CAAC,MAAM,CAAC,cAAc,EAAE;aAC3F,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,IAAI,CAAC,eAAe,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,KAAa;QACzB,IAAI,CAAC,gBAAgB,IAAI,KAAK,CAAC;QAE/B,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,MAAM,CAAC,gBAAgB,EAAE,CAAC;YACzF,IAAI,CAAC,eAAe,CAAC;gBACnB,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,4BAA4B,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,MAAM,CAAC,gBAAgB,QAAQ;aACnG,CAAC,CAAC;YACH,OAAO,KAAK,CAAC;QACf,CAAC;QAED,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;OAGG;IACH,uBAAuB;QACrB,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,cAAc,CAAC,CAAC;QAC/D,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC;QAE7D,OAAO;;+BAEoB,WAAW;+BACX,WAAW;2BACf,IAAI,CAAC,MAAM,CAAC,WAAW;2BACvB,IAAI,CAAC,MAAM,CAAC,gBAAgB,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiD3D,CAAC;IACA,CAAC;IAEO,eAAe,CAAC,OAA4C;QAClE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YACnB,GAAG,OAAO;YACV,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACpC,CAAC,CAAC;IACL,CAAC;IAED,aAAa;QACX,OAAO,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,CAAC;IAC9B,CAAC;IAED,QAAQ;QACN,OAAO;YACL,WAAW,EAAE,IAAI,CAAC,eAAe;YACjC,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,UAAU,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM;SACnC,CAAC;IACJ,CAAC;IAED,KAAK;QACH,IAAI,CAAC,UAAU,GAAG,EAAE,CAAC;QACrB,IAAI,CAAC,eAAe,GAAG,CAAC,CAAC;QACzB,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;IAC5B,CAAC;CACF;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,WAAoC;IACrE,MAAM,OAAO,GAAG,CAAC,WAAW,CAAC,OAAO,IAAI,WAAW,CAAC,UAAU,IAAI,EAAE,CAA4B,CAAC;IACjG,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,CAAa,CAAC;IACvE,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,WAAW,IAAI,EAAE,CAAW,CAAC;IAErF,OAAO;QACL,cAAc,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE;QACjD,WAAW,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,0CAA0C;QAC3E,cAAc,EAAG,OAAO,CAAC,cAAyB,IAAI,EAAE;QACxD,gBAAgB,EAAE,aAAa,GAAG,IAAI,GAAG,IAAI;QAC7C,cAAc,EAAE,IAAI;KACrB,CAAC;AACJ,CAAC"}

package/dist/shield/runtime-monitor.d.ts

@@ -0,0 +1,106 @@
+/**
+ * SkillShield — Runtime Monitor + Kill Switch
+ *
+ * Real-time monitoring of skill execution. Watches stdout/stderr
+ * for threat patterns, tracks resource consumption, and kills the
+ * process if anomalies are detected.
+ *
+ * This is the core differentiator: Snyk scans before install,
+ * SkillShield watches DURING execution.
+ */
+import { ChildProcess } from 'child_process';
+import { type ThreatCategory, type SeverityLevel } from '../guard/patterns.js';
+export interface MonitorPolicy {
+    /** Max execution time in ms (kill switch) */
+    maxExecutionTime: number;
+    /** Max memory in MB (kill switch) */
+    maxMemoryMB: number;
+    /** Max output size in bytes (prevent output flooding) */
+    maxOutputBytes: number;
+    /** Severity threshold to trigger kill (CRITICAL = kill immediately) */
+    killOnSeverity: SeverityLevel;
+    /** Re-scan output for threats in real-time */
+    enableOutputScanning: boolean;
+    /** Max violations before kill */
+    maxViolations: number;
+    /** Categories that trigger immediate kill */
+    criticalCategories: ThreatCategory[];
+}
+export interface RuntimeEvent {
+    timestamp: string;
+    type: 'STDOUT' | 'STDERR' | 'THREAT_DETECTED' | 'RESOURCE_LIMIT' | 'KILL_SWITCH' | 'ANOMALY' | 'EXIT';
+    severity: SeverityLevel;
+    details: string;
+    data?: unknown;
+}
+export interface MonitorReport {
+    startTime: string;
+    endTime?: string;
+    durationMs: number;
+    events: RuntimeEvent[];
+    threatsDetected: number;
+    killed: boolean;
+    killReason?: string;
+    resourceUsage: {
+        peakMemoryMB: number;
+        totalOutputBytes: number;
+        cpuTimeMs: number;
+    };
+}
+export declare class RuntimeMonitor {
+    private policy;
+    private events;
+    private startTime;
+    private outputBytes;
+    private threatsDetected;
+    private killed;
+    private killReason?;
+    private process?;
+    private killTimer?;
+    private memoryCheckInterval?;
+    /** Subset of patterns optimized for real-time output scanning */
+    private runtimePatterns;
+    constructor(policy: MonitorPolicy);
+    /**
+     * Attach the monitor to a running child process.
+     */
+    attach(childProcess: ChildProcess): void;
+    /**
+     * Process output from the skill and check for threats.
+     */
+    private onOutput;
+    /**
+     * Scan skill output for threat patterns in real-time.
+     * This catches skills that generate malicious output (e.g., writing
+     * shell commands to stdout that another tool might execute).
+     */
+    private scanOutput;
+    /**
+     * Check process memory usage.
+     */
+    private checkMemory;
+    /**
+     * Kill the child process — the kill switch.
+     */
+    killProcess(reason: string, details: string): void;
+    /**
+     * Clean up timers and intervals.
+     */
+    private cleanup;
+    /**
+     * Compare severity levels. Returns positive if a >= b.
+     */
+    private compareSeverity;
+    private recordEvent;
+    /**
+     * Generate the final monitoring report.
+     */
+    getReport(): MonitorReport;
+    isKilled(): boolean;
+    getEventCount(): number;
+}
+/**
+ * Default monitor policy — strict but reasonable for developer use.
+ */
+export declare function getDefaultMonitorPolicy(): MonitorPolicy;
+//# sourceMappingURL=runtime-monitor.d.ts.map

package/dist/shield/runtime-monitor.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime-monitor.d.ts","sourceRoot":"","sources":["../../src/shield/runtime-monitor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAA6C,KAAK,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAE1H,MAAM,WAAW,aAAa;IAC5B,6CAA6C;IAC7C,gBAAgB,EAAE,MAAM,CAAC;IACzB,qCAAqC;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,yDAAyD;IACzD,cAAc,EAAE,MAAM,CAAC;IACvB,uEAAuE;IACvE,cAAc,EAAE,aAAa,CAAC;IAC9B,8CAA8C;IAC9C,oBAAoB,EAAE,OAAO,CAAC;IAC9B,iCAAiC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,6CAA6C;IAC7C,kBAAkB,EAAE,cAAc,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,iBAAiB,GAAG,gBAAgB,GAAG,aAAa,GAAG,SAAS,GAAG,MAAM,CAAC;IACtG,QAAQ,EAAE,aAAa,CAAC;IACxB,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,OAAO,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,YAAY,EAAE,CAAC;IACvB,eAAe,EAAE,MAAM,CAAC;IACxB,MAAM,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE;QACb,YAAY,EAAE,MAAM,CAAC;QACrB,gBAAgB,EAAE,MAAM,CAAC;QACzB,SAAS,EAAE,MAAM,CAAC;KACnB,CAAC;CACH;AAED,qBAAa,cAAc;IACzB,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,MAAM,CAAsB;IACpC,OAAO,CAAC,SAAS,CAAa;IAC9B,OAAO,CAAC,WAAW,CAAa;IAChC,OAAO,CAAC,eAAe,CAAa;IACpC,OAAO,CAAC,MAAM,CAAkB;IAChC,OAAO,CAAC,UAAU,CAAC,CAAS;IAC5B,OAAO,CAAC,OAAO,CAAC,CAAe;IAC/B,OAAO,CAAC,SAAS,CAAC,CAAiB;IACnC,OAAO,CAAC,mBAAmB,CAAC,CAAiB;IAE7C,iEAAiE;IACjE,OAAO,CAAC,eAAe,CAAqB;gBAEhC,MAAM,EAAE,aAAa;IAQjC;;OAEG;IACH,MAAM,CAAC,YAAY,EAAE,YAAY,GAAG,IAAI;IAyCxC;;OAEG;IACH,OAAO,CAAC,QAAQ;IAahB;;;;OAIG;IACH,OAAO,CAAC,UAAU;IA+ClB;;OAEG;IACH,OAAO,CAAC,WAAW;IAmBnB;;OAEG;IACH,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,IAAI;IA0BlD;;OAEG;IACH,OAAO,CAAC,OAAO;IAWf;;OAEG;IACH,OAAO,CAAC,eAAe;IAUvB,OAAO,CAAC,WAAW;IAInB;;OAEG;IACH,SAAS,IAAI,aAAa;IAkB1B,QAAQ,IAAI,OAAO;IAInB,aAAa,IAAI,MAAM;CAGxB;AAED;;GAEG;AACH,wBAAgB,uBAAuB,IAAI,aAAa,CAevD"}