specweave 2.3.0 → 3.0.1

package/dist/src/core/skill-refine/ledger.d.ts

@@ -1,34 +0,0 @@
-/**
- * Append-only ledger for applied/rejected skill refinements.
- *
- * File lives at `.specweave/state/skill-refinements.json`. Missing/corrupt
- * files degrade to an empty ledger — readers never throw.
- *
- * @module core/skill-refine/ledger
- */
-import { EMPTY_LEDGER, type RefinementLedger, type RefinementLedgerEntry, type RefinementStatus } from '../../types/skill-refinements';
-export interface AppendAppliedInput {
-    targetSkill: string;
-    author: string;
-    signalIds: string[];
-    diffSha: string;
-    rationale: string;
-    /** Override appliedAt (mainly for tests). */
-    appliedAt?: string;
-    /** Override id (mainly for tests). */
-    id?: string;
-}
-export interface AppendRejectedInput {
-    targetSkill: string;
-    author: string;
-    signalIds: string[];
-    rationale: string;
-    rejectionReason: string;
-    appliedAt?: string;
-    id?: string;
-}
-export declare function readLedger(filePath: string): Promise<RefinementLedger>;
-export declare function appendApplied(filePath: string, input: AppendAppliedInput): Promise<RefinementLedgerEntry>;
-export declare function appendRejected(filePath: string, input: AppendRejectedInput): Promise<RefinementLedgerEntry>;
-export { EMPTY_LEDGER, type RefinementLedger, type RefinementLedgerEntry, type RefinementStatus };
-//# sourceMappingURL=ledger.d.ts.map

package/dist/src/core/skill-refine/ledger.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"ledger.d.ts","sourceRoot":"","sources":["../../../../src/core/skill-refine/ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH,OAAO,EACL,YAAY,EAEZ,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,EAC1B,KAAK,gBAAgB,EACtB,MAAM,+BAA+B,CAAC;AAEvC,MAAM,WAAW,kBAAkB;IACjC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,sCAAsC;IACtC,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,MAAM,WAAW,mBAAmB;IAClC,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,EAAE,CAAC,EAAE,MAAM,CAAC;CACb;AAED,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAkB5E;AAED,wBAAsB,aAAa,CACjC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,kBAAkB,GACxB,OAAO,CAAC,qBAAqB,CAAC,CAahC;AAED,wBAAsB,cAAc,CAClC,QAAQ,EAAE,MAAM,EAChB,KAAK,EAAE,mBAAmB,GACzB,OAAO,CAAC,qBAAqB,CAAC,CAchC;AA2BD,OAAO,EAAE,YAAY,EAAE,KAAK,gBAAgB,EAAE,KAAK,qBAAqB,EAAE,KAAK,gBAAgB,EAAE,CAAC"}

package/dist/src/core/skill-refine/ledger.js

@@ -1,81 +0,0 @@
-/**
- * Append-only ledger for applied/rejected skill refinements.
- *
- * File lives at `.specweave/state/skill-refinements.json`. Missing/corrupt
- * files degrade to an empty ledger — readers never throw.
- *
- * @module core/skill-refine/ledger
- */
-import { randomUUID } from 'crypto';
-import { mkdir, readFile, writeFile, copyFile } from 'fs/promises';
-import { dirname } from 'path';
-import { EMPTY_LEDGER, RefinementLedgerSchema, } from '../../types/skill-refinements';
-export async function readLedger(filePath) {
-    let raw;
-    try {
-        const content = await readFile(filePath, 'utf-8');
-        raw = JSON.parse(content);
-    }
-    catch (err) {
-        if (err?.code === 'ENOENT') {
-            return { refinements: [] };
-        }
-        await backup(filePath);
-        return { refinements: [] };
-    }
-    const parsed = RefinementLedgerSchema.safeParse(raw);
-    if (parsed.success)
-        return parsed.data;
-    await backup(filePath);
-    return { refinements: [] };
-}
-export async function appendApplied(filePath, input) {
-    const entry = {
-        id: input.id ?? generateRefinementId(),
-        targetSkill: input.targetSkill,
-        author: input.author,
-        signalIds: [...input.signalIds],
-        diffSha: input.diffSha,
-        rationale: input.rationale,
-        appliedAt: input.appliedAt ?? new Date().toISOString(),
-        status: 'applied',
-    };
-    await persistAppend(filePath, entry);
-    return entry;
-}
-export async function appendRejected(filePath, input) {
-    const entry = {
-        id: input.id ?? generateRefinementId(),
-        targetSkill: input.targetSkill,
-        author: input.author,
-        signalIds: [...input.signalIds],
-        diffSha: '',
-        rationale: input.rationale,
-        appliedAt: input.appliedAt ?? new Date().toISOString(),
-        status: 'rejected',
-        rejectionReason: input.rejectionReason,
-    };
-    await persistAppend(filePath, entry);
-    return entry;
-}
-// ── Internals ────────────────────────────────────────────────────────
-async function persistAppend(filePath, entry) {
-    const current = await readLedger(filePath);
-    current.refinements.push(entry);
-    await mkdir(dirname(filePath), { recursive: true });
-    await writeFile(filePath, JSON.stringify(current, null, 2), 'utf-8');
-}
-async function backup(filePath) {
-    try {
-        await copyFile(filePath, filePath + '.bak');
-    }
-    catch {
-        // best-effort
-    }
-}
-function generateRefinementId() {
-    return `ref_${randomUUID().replace(/-/g, '').slice(0, 20).toUpperCase()}`;
-}
-// Re-export for convenience.
-export { EMPTY_LEDGER };
-//# sourceMappingURL=ledger.js.map

package/dist/src/core/skill-refine/ledger.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ledger.js","sourceRoot":"","sources":["../../../../src/core/skill-refine/ledger.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACnE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EACL,YAAY,EACZ,sBAAsB,GAIvB,MAAM,+BAA+B,CAAC;AAwBvC,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC/C,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAClD,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,EAAE,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAC7B,CAAC;QACD,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACvB,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IAC7B,CAAC;IAED,MAAM,MAAM,GAAG,sBAAsB,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAEvC,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;IACvB,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;AAC7B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,KAAyB;IAEzB,MAAM,KAAK,GAA0B;QACnC,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,oBAAoB,EAAE;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;QAC/B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtD,MAAM,EAAE,SAAS;KAClB,CAAC;IACF,MAAM,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,QAAgB,EAChB,KAA0B;IAE1B,MAAM,KAAK,GAA0B;QACnC,EAAE,EAAE,KAAK,CAAC,EAAE,IAAI,oBAAoB,EAAE;QACtC,WAAW,EAAE,KAAK,CAAC,WAAW;QAC9B,MAAM,EAAE,KAAK,CAAC,MAAM;QACpB,SAAS,EAAE,CAAC,GAAG,KAAK,CAAC,SAAS,CAAC;QAC/B,OAAO,EAAE,EAAE;QACX,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACtD,MAAM,EAAE,UAAU;QAClB,eAAe,EAAE,KAAK,CAAC,eAAe;KACvC,CAAC;IACF,MAAM,aAAa,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACrC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AAExE,KAAK,UAAU,aAAa,CAC1B,QAAgB,EAChB,KAA4B;IAE5B,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC3C,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChC,MAAM,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACpD,MAAM,SAAS,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,MAAM,CAAC,QAAgB;IACpC,IAAI,CAAC;QACH,MAAM,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,MAAM,CAAC,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,cAAc;IAChB,CAAC;AACH,CAAC;AAED,SAAS,oBAAoB;IAC3B,OAAO,OAAO,UAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,6BAA6B;AAC7B,OAAO,EAAE,YAAY,EAA4E,CAAC"}

package/dist/src/core/skill-security/index.d.ts

@@ -1,9 +0,0 @@
-export { SKILL_SECURITY_RULES } from './rules.js';
-export type { SkillSecurityRule } from './rules.js';
-export { extractCodeBlocks, extractBashBlocks } from './parser.js';
-export type { CodeBlock } from './parser.js';
-export { scanSkillMd } from './scanner.js';
-export type { SkillFinding, SkillScanResult } from './scanner.js';
-export { printScanReport, printBatchReport, toBatchJson } from './reporter.js';
-export type { BatchScanEntry } from './reporter.js';
-//# sourceMappingURL=index.d.ts.map

package/dist/src/core/skill-security/index.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/core/skill-security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAClD,YAAY,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AACpD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AACnE,YAAY,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAC7C,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,YAAY,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,cAAc,CAAC;AAClE,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC/E,YAAY,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}

package/dist/src/core/skill-security/index.js

@@ -1,5 +0,0 @@
-export { SKILL_SECURITY_RULES } from './rules.js';
-export { extractCodeBlocks, extractBashBlocks } from './parser.js';
-export { scanSkillMd } from './scanner.js';
-export { printScanReport, printBatchReport, toBatchJson } from './reporter.js';
-//# sourceMappingURL=index.js.map

package/dist/src/core/skill-security/index.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/core/skill-security/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAEnE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAE3C,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC"}

package/dist/src/core/skill-security/parser.d.ts

@@ -1,27 +0,0 @@
-/**
- * SKILL.md parser — extracts fenced code blocks with line numbers.
- */
-export interface CodeBlock {
-    /** Language specifier (e.g., "bash", "sh", "shell") */
-    lang: string;
-    /** Code block content (without fence lines) */
-    content: string;
-    /** 1-based line number of the opening fence (``` lang) */
-    startLine: number;
-}
-/**
- * Extracts all fenced code blocks from markdown content.
- *
- * Given:
- *   ```bash
- *   curl $URL
- *   ```
- *
- * Returns: [{ lang: "bash", content: "curl $URL\n", startLine: 1 }]
- */
-export declare function extractCodeBlocks(markdown: string): CodeBlock[];
-/**
- * Returns only bash/shell code blocks (lang is "bash", "sh", "shell", or empty).
- */
-export declare function extractBashBlocks(markdown: string): CodeBlock[];
-//# sourceMappingURL=parser.d.ts.map

package/dist/src/core/skill-security/parser.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"parser.d.ts","sourceRoot":"","sources":["../../../../src/core/skill-security/parser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,MAAM,WAAW,SAAS;IACxB,uDAAuD;IACvD,IAAI,EAAE,MAAM,CAAC;IACb,+CAA+C;IAC/C,OAAO,EAAE,MAAM,CAAC;IAChB,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;;;;;;;GASG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,CAsC/D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,CAI/D"}

package/dist/src/core/skill-security/parser.js

@@ -1,55 +0,0 @@
-/**
- * SKILL.md parser — extracts fenced code blocks with line numbers.
- */
-/**
- * Extracts all fenced code blocks from markdown content.
- *
- * Given:
- *   ```bash
- *   curl $URL
- *   ```
- *
- * Returns: [{ lang: "bash", content: "curl $URL\n", startLine: 1 }]
- */
-export function extractCodeBlocks(markdown) {
-    const lines = markdown.split('\n');
-    const blocks = [];
-    let inBlock = false;
-    let currentLang = '';
-    let currentLines = [];
-    let blockStartLine = 0;
-    for (let i = 0; i < lines.length; i++) {
-        const line = lines[i];
-        const fenceMatch = line.match(/^```(\w*)\s*$/);
-        if (!inBlock && fenceMatch) {
-            inBlock = true;
-            currentLang = fenceMatch[1] || '';
-            currentLines = [];
-            blockStartLine = i + 1; // 1-based
-            continue;
-        }
-        if (inBlock) {
-            if (/^```\s*$/.test(line)) {
-                blocks.push({
-                    lang: currentLang,
-                    content: currentLines.join('\n'),
-                    startLine: blockStartLine,
-                });
-                inBlock = false;
-                currentLang = '';
-                currentLines = [];
-            }
-            else {
-                currentLines.push(line);
-            }
-        }
-    }
-    return blocks;
-}
-/**
- * Returns only bash/shell code blocks (lang is "bash", "sh", "shell", or empty).
- */
-export function extractBashBlocks(markdown) {
-    return extractCodeBlocks(markdown).filter(b => ['bash', 'sh', 'shell', ''].includes(b.lang.toLowerCase()));
-}
-//# sourceMappingURL=parser.js.map

package/dist/src/core/skill-security/parser.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"parser.js","sourceRoot":"","sources":["../../../../src/core/skill-security/parser.ts"],"names":[],"mappings":"AAAA;;GAEG;AAWH;;;;;;;;;GASG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACnC,MAAM,MAAM,GAAgB,EAAE,CAAC;IAE/B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,WAAW,GAAG,EAAE,CAAC;IACrB,IAAI,YAAY,GAAa,EAAE,CAAC;IAChC,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAE/C,IAAI,CAAC,OAAO,IAAI,UAAU,EAAE,CAAC;YAC3B,OAAO,GAAG,IAAI,CAAC;YACf,WAAW,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAClC,YAAY,GAAG,EAAE,CAAC;YAClB,cAAc,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,UAAU;YAClC,SAAS;QACX,CAAC;QAED,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC1B,MAAM,CAAC,IAAI,CAAC;oBACV,IAAI,EAAE,WAAW;oBACjB,OAAO,EAAE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC;oBAChC,SAAS,EAAE,cAAc;iBAC1B,CAAC,CAAC;gBACH,OAAO,GAAG,KAAK,CAAC;gBAChB,WAAW,GAAG,EAAE,CAAC;gBACjB,YAAY,GAAG,EAAE,CAAC;YACpB,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC1B,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,OAAO,iBAAiB,CAAC,QAAQ,CAAC,CAAC,MAAM,CACvC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,CAChE,CAAC;AACJ,CAAC"}

package/dist/src/core/skill-security/reporter.d.ts

@@ -1,21 +0,0 @@
-/**
- * Report formatter for SKILL.md security scan results.
- */
-import type { SkillScanResult } from './scanner.js';
-export interface BatchScanEntry {
-    file: string;
-    result: SkillScanResult;
-}
-/**
- * Print a human-readable scan report for a single file.
- */
-export declare function printScanReport(file: string, result: SkillScanResult): void;
-/**
- * Print a batch scan summary table.
- */
-export declare function printBatchReport(entries: BatchScanEntry[]): void;
-/**
- * Serialize batch results to JSON for CI integration.
- */
-export declare function toBatchJson(entries: BatchScanEntry[]): string;
-//# sourceMappingURL=reporter.d.ts.map

package/dist/src/core/skill-security/reporter.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"reporter.d.ts","sourceRoot":"","sources":["../../../../src/core/skill-security/reporter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAGH,OAAO,KAAK,EAAgB,eAAe,EAAE,MAAM,cAAc,CAAC;AAUlE,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,eAAe,CAAC;CACzB;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,eAAe,GAAG,IAAI,CAqC3E;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,IAAI,CA2ChE;AAED;;GAEG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,CAY7D"}

package/dist/src/core/skill-security/reporter.js

@@ -1,121 +0,0 @@
-/**
- * Report formatter for SKILL.md security scan results.
- */
-import chalk from 'chalk';
-const SEVERITY_COLORS = {
-    critical: chalk.bgRed.white.bold,
-    high: chalk.red.bold,
-    medium: chalk.yellow,
-    low: chalk.blue,
-    info: chalk.dim,
-};
-/**
- * Print a human-readable scan report for a single file.
- */
-export function printScanReport(file, result) {
-    console.log('');
-    console.log(chalk.bold(`  Scanning: ${file}`));
-    console.log(chalk.dim('  ' + '─'.repeat(50)));
-    if (result.findings.length === 0) {
-        console.log(chalk.green.bold('\n  PASSED — No findings\n'));
-        return;
-    }
-    // Group by severity
-    const bySeverity = groupBySeverity(result.findings);
-    const order = ['critical', 'high', 'medium', 'low', 'info'];
-    for (const sev of order) {
-        const findings = bySeverity[sev];
-        if (!findings?.length)
-            continue;
-        const colorFn = SEVERITY_COLORS[sev] || chalk.white;
-        console.log(`\n  ${colorFn(` ${sev.toUpperCase()} `)} (${findings.length})`);
-        for (const f of findings) {
-            console.log(`    ${chalk.dim('•')} [${chalk.cyan(f.ruleId)}] ${f.message}`);
-            console.log(`      ${chalk.dim(`line ${f.line}:`)} ${chalk.italic(f.matchedText.slice(0, 80))}`);
-            console.log(`      ${chalk.dim('fix:')} ${f.suggestedFix}`);
-        }
-    }
-    console.log('');
-    console.log(chalk.dim('  ' + '─'.repeat(50)));
-    const counts = getSeverityCounts(result.findings);
-    if (result.passed) {
-        const total = result.findings.length;
-        console.log(chalk.yellow.bold('  CONCERNS') + chalk.dim(` — ${total} finding(s) (no critical/high)`));
-    }
-    else {
-        console.log(chalk.red.bold('  FAILED') + ` — ${counts.critical} critical, ${counts.high} high finding(s)`);
-    }
-    console.log('');
-}
-/**
- * Print a batch scan summary table.
- */
-export function printBatchReport(entries) {
-    console.log('');
-    console.log(chalk.bold('  Plugin Security Scan — Batch Report'));
-    console.log(chalk.dim('  ' + '═'.repeat(70)));
-    let totalFindings = 0;
-    let failCount = 0;
-    let warnCount = 0;
-    let passCount = 0;
-    for (const { file, result } of entries) {
-        const counts = getSeverityCounts(result.findings);
-        totalFindings += result.findings.length;
-        const shortName = file.replace(/^.*plugins\//, '').replace(/\/SKILL\.md$/, '');
-        const status = result.exitCode === 0
-            ? chalk.green('PASS')
-            : result.exitCode === 1
-                ? chalk.yellow('WARN')
-                : chalk.red('FAIL');
-        const breakdown = result.findings.length === 0
-            ? chalk.dim('no findings')
-            : [
-                counts.critical > 0 ? chalk.red(`${counts.critical}C`) : '',
-                counts.high > 0 ? chalk.red(`${counts.high}H`) : '',
-                counts.medium > 0 ? chalk.yellow(`${counts.medium}M`) : '',
-                counts.low > 0 ? chalk.blue(`${counts.low}L`) : '',
-            ].filter(Boolean).join(' ');
-        console.log(`  ${status}  ${chalk.bold(shortName.padEnd(45))} ${breakdown}`);
-        if (result.exitCode === 2)
-            failCount++;
-        else if (result.exitCode === 1)
-            warnCount++;
-        else
-            passCount++;
-    }
-    console.log(chalk.dim('  ' + '─'.repeat(70)));
-    console.log(`  ${chalk.green(`${passCount} pass`)}  ${chalk.yellow(`${warnCount} warn`)}  ${chalk.red(`${failCount} fail`)}` +
-        chalk.dim(`  (${totalFindings} total findings across ${entries.length} skills)`));
-    console.log('');
-}
-/**
- * Serialize batch results to JSON for CI integration.
- */
-export function toBatchJson(entries) {
-    return JSON.stringify(entries.map(({ file, result }) => ({
-        file,
-        exitCode: result.exitCode,
-        passed: result.passed,
-        findings: result.findings,
-        counts: getSeverityCounts(result.findings),
-    })), null, 2);
-}
-function groupBySeverity(findings) {
-    const map = {};
-    for (const f of findings) {
-        if (!map[f.severity])
-            map[f.severity] = [];
-        map[f.severity].push(f);
-    }
-    return map;
-}
-function getSeverityCounts(findings) {
-    return {
-        critical: findings.filter(f => f.severity === 'critical').length,
-        high: findings.filter(f => f.severity === 'high').length,
-        medium: findings.filter(f => f.severity === 'medium').length,
-        low: findings.filter(f => f.severity === 'low').length,
-        info: findings.filter(f => f.severity === 'info').length,
-    };
-}
-//# sourceMappingURL=reporter.js.map

package/dist/src/core/skill-security/reporter.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"reporter.js","sourceRoot":"","sources":["../../../../src/core/skill-security/reporter.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,KAAK,MAAM,OAAO,CAAC;AAG1B,MAAM,eAAe,GAA0C;IAC7D,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI;IAChC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,IAAI;IACpB,MAAM,EAAE,KAAK,CAAC,MAAM;IACpB,GAAG,EAAE,KAAK,CAAC,IAAI;IACf,IAAI,EAAE,KAAK,CAAC,GAAG;CAChB,CAAC;AAOF;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,IAAY,EAAE,MAAuB;IACnE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE9C,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC,CAAC;QAC5D,OAAO;IACT,CAAC;IAED,oBAAoB;IACpB,MAAM,UAAU,GAAG,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,MAAM,KAAK,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;IAE5D,KAAK,MAAM,GAAG,IAAI,KAAK,EAAE,CAAC;QACxB,MAAM,QAAQ,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,CAAC,QAAQ,EAAE,MAAM;YAAE,SAAS;QAChC,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,OAAO,OAAO,CAAC,IAAI,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;QAC7E,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;YACzB,OAAO,CAAC,GAAG,CAAC,OAAO,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YAC5E,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC;YACjG,OAAO,CAAC,GAAG,CAAC,SAAS,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE9C,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAClD,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,gCAAgC,CAAC,CAAC,CAAC;IACxG,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,MAAM,MAAM,CAAC,QAAQ,cAAc,MAAM,CAAC,IAAI,kBAAkB,CAAC,CAAC;IAC7G,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAyB;IACxD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uCAAuC,CAAC,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAE9C,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,SAAS,GAAG,CAAC,CAAC;IAElB,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACvC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAClD,aAAa,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;QAExC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC/E,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,KAAK,CAAC;YAClC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;YACrB,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,CAAC;gBACrB,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC;gBACtB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAExB,MAAM,SAAS,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,KAAK,CAAC;YAC5C,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC;YAC1B,CAAC,CAAC;gBACA,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC3D,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBACnD,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC1D,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;aACnD,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE9B,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,KAAK,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,SAAS,EAAE,CAAC,CAAC;QAE7E,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,SAAS,EAAE,CAAC;aAClC,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,SAAS,EAAE,CAAC;;YACvC,SAAS,EAAE,CAAC;IACnB,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CACT,KAAK,KAAK,CAAC,KAAK,CAAC,GAAG,SAAS,OAAO,CAAC,KAAK,KAAK,CAAC,MAAM,CAAC,GAAG,SAAS,OAAO,CAAC,KAAK,KAAK,CAAC,GAAG,CAAC,GAAG,SAAS,OAAO,CAAC,EAAE;QAChH,KAAK,CAAC,GAAG,CAAC,MAAM,aAAa,0BAA0B,OAAO,CAAC,MAAM,UAAU,CAAC,CACjF,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,OAAyB;IACnD,OAAO,IAAI,CAAC,SAAS,CACnB,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACjC,IAAI;QACJ,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,MAAM,EAAE,iBAAiB,CAAC,MAAM,CAAC,QAAQ,CAAC;KAC3C,CAAC,CAAC,EACH,IAAI,EACJ,CAAC,CACF,CAAC;AACJ,CAAC;AAED,SAAS,eAAe,CAAC,QAAwB;IAC/C,MAAM,GAAG,GAAmC,EAAE,CAAC;IAC/C,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC;YAAE,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC;QAC3C,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,QAAwB;IACjD,OAAO;QACL,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,UAAU,CAAC,CAAC,MAAM;QAChE,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;QACxD,MAAM,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,MAAM;QAC5D,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,CAAC,MAAM;QACtD,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,KAAK,MAAM,CAAC,CAAC,MAAM;KACzD,CAAC;AACJ,CAAC"}

package/dist/src/core/skill-security/rules.d.ts

@@ -1,25 +0,0 @@
-/**
- * Structured detection rules for SKILL.md self-scan.
- * Maps to Gen Agent Trust Hub audit categories.
- */
-export interface SkillSecurityRule {
-    /** Unique rule identifier (Gen Agent Trust Hub category) */
-    id: string;
-    /** Finding category label */
-    category: string;
-    /** Severity level */
-    severity: 'critical' | 'high' | 'medium' | 'low' | 'info';
-    /** Regex pattern to match against content */
-    pattern: RegExp;
-    /** Human-readable description of the finding */
-    message: string;
-    /** Actionable fix suggestion */
-    suggestedFix: string;
-    /** If true, only scan inside bash/shell code blocks */
-    codeBlockOnly?: boolean;
-}
-/**
- * All detection rules, ordered by severity (medium → low)
- */
-export declare const SKILL_SECURITY_RULES: SkillSecurityRule[];
-//# sourceMappingURL=rules.d.ts.map

package/dist/src/core/skill-security/rules.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"rules.d.ts","sourceRoot":"","sources":["../../../../src/core/skill-security/rules.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,iBAAiB;IAChC,4DAA4D;IAC5D,EAAE,EAAE,MAAM,CAAC;IACX,6BAA6B;IAC7B,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,6CAA6C;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,gDAAgD;IAChD,OAAO,EAAE,MAAM,CAAC;IAChB,gCAAgC;IAChC,YAAY,EAAE,MAAM,CAAC;IACrB,uDAAuD;IACvD,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAiID;;GAEG;AACH,eAAO,MAAM,oBAAoB,EAAE,iBAAiB,EAKnD,CAAC"}

package/dist/src/core/skill-security/rules.js

@@ -1,137 +0,0 @@
-/**
- * Structured detection rules for SKILL.md self-scan.
- * Maps to Gen Agent Trust Hub audit categories.
- */
-/**
- * CREDENTIALS_UNSAFE (MEDIUM)
- * Skills that instruct agents to collect or write secrets.
- */
-const CREDENTIALS_UNSAFE_RULES = [
-    {
-        id: 'CREDENTIALS_UNSAFE',
-        category: 'credentials-unsafe',
-        severity: 'medium',
-        pattern: /cat\s+>>?\s*\.env|echo\s+\w+=.*>>?\s*\.env|>>?\s*\.env\b/,
-        message: 'CREDENTIALS_UNSAFE: Bash snippet writes to .env file',
-        suggestedFix: 'Skills should only CHECK for credential presence (e.g., grep -q KEY .env), never write or append secrets.',
-        codeBlockOnly: true,
-    },
-    {
-        id: 'CREDENTIALS_UNSAFE',
-        category: 'credentials-unsafe',
-        severity: 'medium',
-        pattern: /echo\s+[A-Z_][A-Z0-9_]*=/,
-        message: 'CREDENTIALS_UNSAFE: Bash snippet echoes a secret variable assignment',
-        suggestedFix: 'Avoid echoing credential assignments. Use grep -q to check if a key already exists.',
-        codeBlockOnly: true,
-    },
-    {
-        id: 'CREDENTIALS_UNSAFE',
-        category: 'credentials-unsafe',
-        severity: 'medium',
-        pattern: /(?:please\s+)?(?:provide|enter|share|give|ask\s+for|supply|add)\s+(?:your\s+)?(?:api\s+)?(?:token|secret|key|password|credential|auth)/i,
-        message: 'CREDENTIALS_UNSAFE: Skill instructs agent to prompt user for secrets',
-        suggestedFix: 'Check for credential presence via environment variables or config files; never ask the user to type secrets.',
-        codeBlockOnly: false,
-    },
-];
-/**
- * DATA_EXFILTRATION (MEDIUM)
- * Skills that read secrets and transmit to user-controlled destinations.
- */
-const DATA_EXFILTRATION_RULES = [
-    {
-        id: 'DATA_EXFILTRATION',
-        category: 'data-exfiltration',
-        severity: 'medium',
-        pattern: /\bcurl\b[^\n]*\$\{?[A-Za-z_]\w*\}?/,
-        message: 'DATA_EXFILTRATION: curl uses a variable URL without domain validation',
-        suggestedFix: 'Validate domain strictly (allowlist of known-safe hostnames), enforce HTTPS-only, and prevent SSRF (block localhost/private IPs).',
-        codeBlockOnly: true,
-    },
-    {
-        id: 'DATA_EXFILTRATION',
-        category: 'data-exfiltration',
-        severity: 'medium',
-        pattern: /\bfetch\s*\(\s*\$\{?[A-Za-z_]\w*\}?/,
-        message: 'DATA_EXFILTRATION: fetch() uses a variable URL without domain validation',
-        suggestedFix: 'Validate the URL against an allowlist of known-safe domains before making the request.',
-        codeBlockOnly: true,
-    },
-    {
-        id: 'DATA_EXFILTRATION',
-        category: 'data-exfiltration',
-        severity: 'medium',
-        pattern: /https?:\/\/\*\.|domain\s*validation\s*allows\s*wildcards/i,
-        message: 'DATA_EXFILTRATION: Domain validation allows wildcards (potential SSRF)',
-        suggestedFix: 'Use strict hostname allowlists. Wildcards in domain validation enable SSRF attacks.',
-        codeBlockOnly: false,
-    },
-];
-/**
- * COMMAND_EXECUTION (LOW)
- * Bash snippets with unquoted variable interpolation or dynamic shell execution.
- */
-const COMMAND_EXECUTION_RULES = [
-    {
-        id: 'COMMAND_EXECUTION',
-        category: 'command-execution',
-        severity: 'low',
-        pattern: /\b(?:eval|source)\s+\$[A-Za-z_]/,
-        message: 'COMMAND_EXECUTION: eval/source with variable argument enables arbitrary code execution',
-        suggestedFix: 'Avoid eval/source with variable arguments. Use explicit paths or validated input.',
-        codeBlockOnly: true,
-    },
-    {
-        id: 'COMMAND_EXECUTION',
-        category: 'command-execution',
-        severity: 'low',
-        pattern: /\bsh\s+-c\s+["']?\$[A-Za-z_]/,
-        message: 'COMMAND_EXECUTION: sh -c with unquoted variable input enables shell injection',
-        suggestedFix: 'Pass sh -c arguments as array elements, not interpolated strings. Validate all dynamic input before execution.',
-        codeBlockOnly: true,
-    },
-    {
-        id: 'COMMAND_EXECUTION',
-        category: 'command-execution',
-        severity: 'low',
-        pattern: /\b\w[\w-]+\s+\$[A-Z_][A-Z0-9_]*\b(?!\s*=)/,
-        message: 'COMMAND_EXECUTION: Command uses unquoted variable argument (risk of word splitting/globbing)',
-        suggestedFix: 'Double-quote all variable references: use "$VARIABLE" instead of $VARIABLE in command arguments.',
-        codeBlockOnly: true,
-    },
-];
-/**
- * PROMPT_INJECTION (LOW)
- * User input interpolated without boundary markers or sanitization.
- */
-const PROMPT_INJECTION_RULES = [
-    {
-        id: 'PROMPT_INJECTION',
-        category: 'prompt-injection',
-        severity: 'low',
-        pattern: /\$\{?(?:USER_INPUT|USER_QUERY|INPUT|QUERY|REQUEST|USER_DATA|UNTRUSTED|RAW_INPUT)\}?/i,
-        message: 'PROMPT_INJECTION: User-supplied input variable interpolated without sanitization',
-        suggestedFix: 'Validate input against an allowlist regex before use. Add boundary markers (e.g., "--- USER INPUT ---") to separate trusted from untrusted content.',
-        codeBlockOnly: false,
-    },
-    {
-        id: 'PROMPT_INJECTION',
-        category: 'prompt-injection',
-        severity: 'low',
-        pattern: /\{\{[^}]+\}\}.*without\s+(?:sanitiz|validat|escap)/i,
-        message: 'PROMPT_INJECTION: Template interpolation without sanitization noted',
-        suggestedFix: 'Add explicit sanitization or validation before interpolating dynamic content.',
-        codeBlockOnly: false,
-    },
-];
-/**
- * All detection rules, ordered by severity (medium → low)
- */
-export const SKILL_SECURITY_RULES = [
-    ...CREDENTIALS_UNSAFE_RULES,
-    ...DATA_EXFILTRATION_RULES,
-    ...COMMAND_EXECUTION_RULES,
-    ...PROMPT_INJECTION_RULES,
-];
-//# sourceMappingURL=rules.js.map

package/dist/src/core/skill-security/rules.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"rules.js","sourceRoot":"","sources":["../../../../src/core/skill-security/rules.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAmBH;;;GAGG;AACH,MAAM,wBAAwB,GAAwB;IACpD;QACE,EAAE,EAAE,oBAAoB;QACxB,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,0DAA0D;QACnE,OAAO,EAAE,sDAAsD;QAC/D,YAAY,EAAE,2GAA2G;QACzH,aAAa,EAAE,IAAI;KACpB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,0BAA0B;QACnC,OAAO,EAAE,sEAAsE;QAC/E,YAAY,EAAE,qFAAqF;QACnG,aAAa,EAAE,IAAI;KACpB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,QAAQ,EAAE,oBAAoB;QAC9B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,yIAAyI;QAClJ,OAAO,EAAE,sEAAsE;QAC/E,YAAY,EAAE,8GAA8G;QAC5H,aAAa,EAAE,KAAK;KACrB;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,uBAAuB,GAAwB;IACnD;QACE,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,oCAAoC;QAC7C,OAAO,EAAE,uEAAuE;QAChF,YAAY,EAAE,mIAAmI;QACjJ,aAAa,EAAE,IAAI;KACpB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,qCAAqC;QAC9C,OAAO,EAAE,0EAA0E;QACnF,YAAY,EAAE,wFAAwF;QACtG,aAAa,EAAE,IAAI;KACpB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,QAAQ;QAClB,OAAO,EAAE,2DAA2D;QACpE,OAAO,EAAE,wEAAwE;QACjF,YAAY,EAAE,qFAAqF;QACnG,aAAa,EAAE,KAAK;KACrB;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,uBAAuB,GAAwB;IACnD;QACE,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,iCAAiC;QAC1C,OAAO,EAAE,wFAAwF;QACjG,YAAY,EAAE,mFAAmF;QACjG,aAAa,EAAE,IAAI;KACpB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,8BAA8B;QACvC,OAAO,EAAE,+EAA+E;QACxF,YAAY,EAAE,gHAAgH;QAC9H,aAAa,EAAE,IAAI;KACpB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,QAAQ,EAAE,mBAAmB;QAC7B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,2CAA2C;QACpD,OAAO,EAAE,8FAA8F;QACvG,YAAY,EAAE,kGAAkG;QAChH,aAAa,EAAE,IAAI;KACpB;CACF,CAAC;AAEF;;;GAGG;AACH,MAAM,sBAAsB,GAAwB;IAClD;QACE,EAAE,EAAE,kBAAkB;QACtB,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,sFAAsF;QAC/F,OAAO,EAAE,kFAAkF;QAC3F,YAAY,EAAE,qJAAqJ;QACnK,aAAa,EAAE,KAAK;KACrB;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,QAAQ,EAAE,kBAAkB;QAC5B,QAAQ,EAAE,KAAK;QACf,OAAO,EAAE,qDAAqD;QAC9D,OAAO,EAAE,qEAAqE;QAC9E,YAAY,EAAE,+EAA+E;QAC7F,aAAa,EAAE,KAAK;KACrB;CACF,CAAC;AAEF;;GAEG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,GAAG,wBAAwB;IAC3B,GAAG,uBAAuB;IAC1B,GAAG,uBAAuB;IAC1B,GAAG,sBAAsB;CAC1B,CAAC"}

package/dist/src/core/skill-security/scanner.d.ts

@@ -1,41 +0,0 @@
-/**
- * SKILL.md self-scan scanner.
- * Applies detection rules against SKILL.md content and bash code blocks.
- */
-import { SkillSecurityRule } from './rules.js';
-export interface SkillFinding {
-    /** Rule identifier (e.g., "CREDENTIALS_UNSAFE") */
-    ruleId: string;
-    /** Finding category */
-    category: string;
-    /** Severity level */
-    severity: 'critical' | 'high' | 'medium' | 'low' | 'info';
-    /** Human-readable finding description */
-    message: string;
-    /** Suggested fix */
-    suggestedFix: string;
-    /** 1-based line number in the original file */
-    line: number;
-    /** The matched text snippet */
-    matchedText: string;
-}
-export interface SkillScanResult {
-    /**
-     * Exit code:
-     *   0 = pass (no findings)
-     *   1 = concerns (medium or low only)
-     *   2 = fail (critical or high)
-     */
-    exitCode: 0 | 1 | 2;
-    /** Whether the scan passed (no critical/high findings) */
-    passed: boolean;
-    /** All findings */
-    findings: SkillFinding[];
-}
-/**
- * Scan SKILL.md content using structured detection rules.
- * Rules marked `codeBlockOnly: true` only apply inside bash code blocks.
- * Other rules apply to the full markdown content.
- */
-export declare function scanSkillMd(content: string, rules?: SkillSecurityRule[]): SkillScanResult;
-//# sourceMappingURL=scanner.d.ts.map

package/dist/src/core/skill-security/scanner.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"scanner.d.ts","sourceRoot":"","sources":["../../../../src/core/skill-security/scanner.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,OAAO,EAAwB,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAGrE,MAAM,WAAW,YAAY;IAC3B,mDAAmD;IACnD,MAAM,EAAE,MAAM,CAAC;IACf,uBAAuB;IACvB,QAAQ,EAAE,MAAM,CAAC;IACjB,qBAAqB;IACrB,QAAQ,EAAE,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,GAAG,MAAM,CAAC;IAC1D,yCAAyC;IACzC,OAAO,EAAE,MAAM,CAAC;IAChB,oBAAoB;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,+CAA+C;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,eAAe;IAC9B;;;;;OAKG;IACH,QAAQ,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IACpB,0DAA0D;IAC1D,MAAM,EAAE,OAAO,CAAC;IAChB,mBAAmB;IACnB,QAAQ,EAAE,YAAY,EAAE,CAAC;CAC1B;AAED;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,GAAE,iBAAiB,EAAyB,GAAG,eAAe,CAwE/G"}