bastionskill 0.1.0__py3-none-any.whl

bastionskill/__init__.py

@@ -0,0 +1,19 @@
+"""bastionskill — static scanner for skill-poisoning (code-layer).
+
+Point it at an agent skill (a SKILL.md plus its bundled scripts). It inspects the
+bundled executable code for malicious behavior — network egress, obfuscated exec,
+secret reads, destructive commands, and persistence/hook install — and reports the
+*shadow*: what the code does that SKILL.md never declared.
+
+Prompt-layer risks (malicious SKILL.md instructions, hidden unicode) are delegated
+to bastionsupply; this tool owns the code-layer.
+"""
+
+from __future__ import annotations
+
+__version__ = "0.1.0"
+
+from .models import Finding, ScanReport, Skill, SourceFile
+from .scanner import scan
+
+__all__ = ["Finding", "ScanReport", "Skill", "SourceFile", "scan", "__version__"]

bastionskill/checks.py

@@ -0,0 +1,192 @@
+"""Code-layer detectors.
+
+Two tiers, both static (source is read, never executed — so payloads hidden
+behind dead-code or `if False:` / env-flag guards are flagged like any other):
+
+* a language-agnostic regex table applied line-by-line to every bundled file, and
+* a Python-only AST tier (`ast` is stdlib) that catches dynamic exec / import /
+  attribute-built calls that reflowed regex can miss.
+
+Each detector carries a `capability`; `scanner.shadow_findings` compares the set
+of capabilities the code exercises against what SKILL.md declared.
+"""
+
+from __future__ import annotations
+
+import ast
+import re
+from dataclasses import dataclass
+from typing import Callable
+
+from .models import Finding, SourceFile
+
+
+@dataclass(frozen=True)
+class Detector:
+    check: str
+    severity: str
+    capability: str
+    pattern: re.Pattern
+    message: str
+
+
+def _d(check, severity, capability, regex, message, flags=0) -> Detector:
+    return Detector(check, severity, capability, re.compile(regex, flags), message)
+
+
+# --- regex tier -------------------------------------------------------------
+# Ordered worst-first only for readability; scanner sorts output itself.
+_REGEX: tuple[Detector, ...] = (
+    # persistence / hook install — the lead finding
+    _d("hook-install", "critical", "persistence",
+       r"\b(Post|Pre|User(Prompt|)|Stop|Notification)ToolUse\b|\bPostToolUse\b|\bPreToolUse\b",
+       "installs an agent hook (runs after this skill, persistence)"),
+    _d("hook-install", "high", "persistence",
+       r"settings\.json|\.claude[\\/](settings|hooks)|[\\/]hooks[\\/]",
+       "writes to agent settings/hooks (persistence surface)"),
+    _d("lateral-tamper", "high", "persistence",
+       r"CLAUDE\.md|mcp\.json|claude_desktop_config|[\\/]skills[\\/]|\.mcp\.json",
+       "writes to agent config / other skills (lateral tampering)"),
+    _d("persistence", "high", "persistence",
+       r"\bcrontab\b|LaunchAgents|LaunchDaemons|\bHKCU\b|\bHKLM\b|systemctl\s+enable",
+       "installs OS-level persistence (cron/launchd/registry/systemd)"),
+    # network egress
+    _d("network-egress", "critical", "network",
+       r"\bsocket\.socket\b|\.connect\(\s*\(|\.sendall\(|\.sendto\(",
+       "raw socket network egress"),
+    _d("network-egress", "high", "network",
+       r"\brequests\.(get|post|put|patch|delete)\b|\burllib\.request\b|\bhttp\.client\b|\bfetch\(|\baxios\b",
+       "HTTP client call (possible exfiltration)"),
+    _d("network-egress", "high", "network",
+       r"\bcurl\b|\bwget\b|Invoke-WebRequest|Invoke-RestMethod",
+       "shells out to a network client (curl/wget/Invoke-WebRequest)"),
+    # secret read
+    _d("secret-read", "critical", "secrets",
+       r"\.aws[\\/]credentials|id_rsa|id_ed25519|\.ssh[\\/]|\.git-credentials|\.npmrc|KUBECONFIG|keychain",
+       "reads credential/secret material"),
+    _d("secret-read", "high", "secrets",
+       r"(^|[\s\"'/=@])\.env\b",
+       "reads a .env secrets file"),
+    # obfuscation
+    _d("obfuscation", "high", "exec",
+       r"base64\s+(-d|--decode)|b64decode|atob\(|FromBase64String",
+       "base64-decoded payload (obfuscation)"),
+    _d("obfuscation", "critical", "exec",
+       r"base64\s+(-d|--decode)[^\n|]*\|\s*(sh|bash|python|node)\b",
+       "decodes then pipes to an interpreter (staged exec)"),
+    # dynamic exec (regex catch; AST tier confirms for python)
+    _d("dynamic-exec", "critical", "exec",
+       r"\beval\(|\bexec\(|\bsystem\(|subprocess\.(Popen|call|run|check_output)|os\.popen",
+       "dynamic / shell execution"),
+    # destructive
+    _d("destructive", "high", "destructive",
+       r"\brm\s+-rf\b|Remove-Item\b[^\n]*-Recurse|\bmkfs\b|\bdd\s+if=|\bshred\b",
+       "destructive filesystem/disk command"),
+)
+
+
+_BLOCK_COMMENT = re.compile(r"/\*.*?\*/", re.DOTALL)
+
+
+def _strip_comments(text: str, lang: str) -> str:
+    """Blank out comment lines so regex doesn't match code described in prose.
+
+    Line count is preserved (line numbers stay valid). Conservative: only removes
+    FULL-LINE comments (and JS block comments) — trailing comments are left so a
+    `#` inside a string is never mistaken for a comment and a real finding hidden.
+    ponytail: trailing-comment false positives remain; upgrade to a real tokenizer
+    only if they prove noisy on real skills.
+    """
+    if lang == "javascript":
+        text = _BLOCK_COMMENT.sub(lambda m: "\n" * m.group(0).count("\n"), text)
+        prefix = "//"
+    elif lang in ("python", "bash", "other"):
+        prefix = "#"
+    else:
+        return text
+    out = []
+    for line in text.split("\n"):
+        out.append("" if line.lstrip().startswith(prefix) else line)
+    return "\n".join(out)
+
+
+def scan_regex(f: SourceFile) -> list[Finding]:
+    out: list[Finding] = []
+    original = f.text.splitlines()
+    scanned = _strip_comments(f.text, f.lang).splitlines()
+    for i, line in enumerate(scanned, start=1):
+        for det in _REGEX:
+            if det.pattern.search(line):
+                evidence = original[i - 1].strip() if i - 1 < len(original) else line.strip()
+                out.append(Finding(
+                    check=det.check, severity=det.severity, file=f.path,
+                    message=det.message, evidence=evidence[:200],
+                    line=i, capability=det.capability,
+                ))
+    return out
+
+
+def scan_opaque(opaque_paths: tuple[str, ...]) -> list[Finding]:
+    """One HIGH finding per bundled file we cannot read as source.
+
+    A compiled or binary artifact is an execution surface a static reader is blind
+    to — treat "can't inspect" as "don't trust", not as clean.
+    """
+    return [
+        Finding(
+            check="opaque-binary", severity="high", file=path, capability="exec",
+            message="opaque/compiled bundled file — cannot inspect, do not trust",
+        )
+        for path in opaque_paths
+    ]
+
+
+# --- python AST tier --------------------------------------------------------
+def _is_name(node: ast.AST, names: set[str]) -> bool:
+    return isinstance(node, ast.Name) and node.id in names
+
+
+class _Visitor(ast.NodeVisitor):
+    def __init__(self, path: str) -> None:
+        self.path = path
+        self.findings: list[Finding] = []
+
+    def _add(self, check, severity, capability, message, node) -> None:
+        self.findings.append(Finding(
+            check=check, severity=severity, file=self.path, message=message,
+            line=getattr(node, "lineno", 0), capability=capability,
+        ))
+
+    def visit_Call(self, node: ast.Call) -> None:
+        func = node.func
+        # exec(...) / eval(...)
+        if _is_name(func, {"exec", "eval"}):
+            self._add("dynamic-exec", "critical", "exec",
+                      f"AST: dynamic {func.id}() call", node)
+        # __import__(...) / importlib.import_module(...)
+        if _is_name(func, {"__import__"}) or (
+            isinstance(func, ast.Attribute) and func.attr == "import_module"
+        ):
+            self._add("dynamic-import", "medium", "exec",
+                      "AST: dynamic import", node)
+        # getattr(x, name)(...) — attribute-built call
+        if isinstance(func, ast.Call) and _is_name(func.func, {"getattr"}):
+            self._add("dynamic-call", "medium", "exec",
+                      "AST: getattr-built dynamic call", node)
+        self.generic_visit(node)
+
+
+def scan_python_ast(f: SourceFile) -> list[Finding]:
+    try:
+        tree = ast.parse(f.text)
+    except (SyntaxError, ValueError, RecursionError, MemoryError):
+        # unparseable or hostile-to-parse python: regex tier still covered it;
+        # never let a crafted file crash the scan.
+        return []
+    v = _Visitor(f.path)
+    v.visit(tree)
+    return v.findings
+
+
+def all_checks() -> tuple[Callable[[SourceFile], list[Finding]], ...]:
+    return (scan_regex,)

bastionskill/cli.py

@@ -0,0 +1,199 @@
+"""bastionskill command line.
+
+    bastionskill scan ./some-skill                # scan a local skill dir
+    bastionskill scan ~/.claude/skills            # batch-scan every skill under a dir
+    bastionskill scan owner/repo                  # pre-flight a remote skill (shallow clone)
+    bastionskill scan https://github.com/o/r      #   ... by full URL
+    bastionskill scan ./skill --json              # machine-readable
+    bastionskill scan ./skill --report out.json   # signable manifest (hashes, verdict)
+    bastionskill scan ./skill --record            # append result to the local ledger
+    bastionskill scan ./skill --fail-on critical  # CI gate threshold (default: high)
+    bastionskill harden ./skill -o skill-policy.yaml
+    bastionskill ledger                           # list previously scanned skills + dates
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+from . import __version__, harden, ledger as ledger_mod, prompt, remote, report
+from .ignore import load as load_ignore
+from .loader import discover_skills, load_skill
+from .models import SEVERITIES, ScanReport, Skill
+from .scanner import scan
+
+_RANK = {s: i for i, s in enumerate(SEVERITIES)}  # 0 = worst
+
+
+def _make_output_unicode_safe() -> None:
+    for stream in (sys.stdout, sys.stderr):
+        try:
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
+        except (AttributeError, ValueError):
+            pass
+
+
+def _resolve_ignore(skill_dir: Path, args):
+    if getattr(args, "no_ignore", False):
+        return None
+    path = args.ignore if getattr(args, "ignore", None) else skill_dir / ".bastionskillignore"
+    return load_ignore(path)
+
+
+def _fails(rep: ScanReport, threshold: str) -> bool:
+    if threshold == "none":
+        return False
+    worst = min((_RANK[f.severity] for f in rep.findings), default=len(SEVERITIES))
+    return worst <= _RANK[threshold]
+
+
+def _scan_one(skill_dir: Path, args) -> tuple[ScanReport, Skill]:
+    skill = load_skill(skill_dir, name=args.name)
+    rep = scan(skill, ignore=_resolve_ignore(skill_dir, args))
+    if getattr(args, "prompt", False):
+        rep = ScanReport(
+            skill=rep.skill, file_count=rep.file_count,
+            findings=rep.findings + tuple(prompt.scan_prompt_layer(skill)),
+        )
+    return rep, skill
+
+
+def main(argv=None) -> int:
+    _make_output_unicode_safe()
+    ap = argparse.ArgumentParser(
+        prog="bastionskill", description=__doc__,
+        formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("--version", action="version", version=f"bastionskill {__version__}")
+    sub = ap.add_subparsers(dest="cmd", required=True)
+
+    ps = sub.add_parser("scan", help="scan a skill (local dir, dir of skills, or remote)")
+    ps.add_argument("target", help="skill dir, a dir of skills, or a remote url/owner-repo")
+    ps.add_argument("--name", help="override skill name label")
+    ps.add_argument("--prompt", action="store_true",
+                    help="also run the prompt-layer check (hidden unicode)")
+    ps.add_argument("--json", action="store_true", help="emit JSON")
+    ps.add_argument("--report", help="write a signable scan manifest to this path")
+    ps.add_argument("--record", action="store_true", help="append result to the local ledger")
+    ps.add_argument("--fail-on", default="high", choices=[*SEVERITIES, "none"],
+                    help="exit non-zero at this severity or worse (default: high)")
+    ps.add_argument("--ignore", help="path to a .bastionskillignore (default: in the skill dir)")
+    ps.add_argument("--no-ignore", action="store_true", help="ignore any .bastionskillignore")
+
+    ph = sub.add_parser("harden", help="emit an agentbastion/bastiongate skill policy")
+    ph.add_argument("target", help="skill dir (or remote url/owner-repo)")
+    ph.add_argument("--name", help="override skill name label")
+    ph.add_argument("-o", "--out", help="write policy.yaml (default: stdout)")
+
+    pl = sub.add_parser("ledger", help="list previously scanned skills and dates")
+    pl.add_argument("--json", action="store_true", help="emit JSON")
+
+    args = ap.parse_args(argv)
+    if args.cmd == "scan":
+        return _cmd_scan(args)
+    if args.cmd == "harden":
+        return _cmd_harden(args)
+    if args.cmd == "ledger":
+        return _cmd_ledger(args)
+    return 2
+
+
+def _with_target(target: str):
+    """Yield a local base path for a target, remote or local, with cleanup.
+
+    Returns (base_path, checkout_or_None); caller must close the checkout.
+    """
+    # A local path always wins over remote heuristics, so "skills/mytool" (which
+    # also looks like owner/repo shorthand) scans the local dir when it exists.
+    p = Path(target)
+    if p.exists():
+        return p, None
+    if remote.is_remote(target):
+        checkout = remote.RemoteCheckout(target)
+        return checkout.__enter__(), checkout
+    _die(f"no such path (and not a recognized remote): {target}")
+
+
+def _cmd_scan(args) -> int:
+    base, checkout = _with_target(args.target)
+    manifests = []
+    worst_fail = False
+    try:
+        skill_dirs = discover_skills(base)
+        multi = len(skill_dirs) > 1
+        for i, d in enumerate(skill_dirs):
+            rep, skill = _scan_one(d, args)
+            # rug-pull drift is read-only; always surface it.
+            prior = ledger_mod.drift(skill)
+            if prior:
+                print(f"! DRIFT: {skill.source} changed since last scan "
+                      f"({prior.get('ts', '?')}, was {prior.get('verdict', '?')})",
+                      file=sys.stderr)
+            if args.json:
+                print(report.to_json(rep))
+            else:
+                if i:
+                    print()
+                print(report.to_text(rep))
+            if args.record:
+                ledger_mod.record(rep, skill)
+            if args.report:
+                manifests.append(report.to_manifest(rep, skill, __version__))
+            worst_fail = worst_fail or _fails(rep, args.fail_on)
+        if multi and not args.json:
+            print(f"\nscanned {len(skill_dirs)} skills; "
+                  f"{'FAIL' if worst_fail else 'pass'} at --fail-on {args.fail_on}")
+        if args.report:
+            Path(args.report).write_text(
+                json.dumps({"schema": "bastionskill.report/1", "scans": manifests},
+                           indent=2, ensure_ascii=False),
+                encoding="utf-8")
+            print(f"wrote report -> {args.report}", file=sys.stderr)
+    finally:
+        if checkout:
+            checkout.__exit__(None, None, None)
+    return 1 if worst_fail else 0
+
+
+def _cmd_harden(args) -> int:
+    base, checkout = _with_target(args.target)
+    try:
+        d = discover_skills(base)[0]
+        skill = load_skill(d, name=args.name)
+        yaml = harden.to_policy_yaml(scan(skill))
+    finally:
+        if checkout:
+            checkout.__exit__(None, None, None)
+    if args.out:
+        Path(args.out).write_text(yaml, encoding="utf-8")
+        print(f"wrote policy -> {args.out}")
+    else:
+        sys.stdout.write(yaml)
+    return 0
+
+
+def _cmd_ledger(args) -> int:
+    rows = ledger_mod.summary()
+    if args.json:
+        print(json.dumps(rows, indent=2, ensure_ascii=False))
+        return 0
+    if not rows:
+        print("ledger empty — scan with --record to populate it.")
+        return 0
+    print(f"{'last scan':<26} {'verdict':<7} {'risk':<8} source")
+    print("-" * 70)
+    for e in rows:
+        print(f"{e.get('ts', '?'):<26} {e.get('verdict', '?'):<7} "
+              f"{e.get('risk', '?'):<8} {e.get('source', '?')}")
+    return 0
+
+
+def _die(msg: str) -> None:
+    print(f"bastionskill: {msg}", file=sys.stderr)
+    raise SystemExit(2)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

bastionskill/harden.py

@@ -0,0 +1,41 @@
+"""Bridge to agentbastion / bastiongate: turn a skill scan into a policy.
+
+Closes the trilogy loop the same way the sibling tools' `harden` do. A scan of a
+skill produces a per-skill verdict (allow/deny) plus the capabilities that tripped
+the deny, ready to drop into the firewall's skill policy.
+"""
+
+from __future__ import annotations
+
+from .models import ScanReport
+
+_BLOCK = {"critical", "high"}
+
+
+def to_policy_yaml(report: ScanReport) -> str:
+    tripped = [f for f in report.findings if f.severity in _BLOCK]
+    verdict = "deny" if tripped else "allow"
+    reasons = sorted({f.check for f in tripped})
+    caps = sorted({f.capability for f in tripped if f.capability})
+
+    lines = [
+        "# agentbastion / bastiongate skill policy generated by bastionskill",
+        f"# skill: {report.skill}  risk={report.risk}",
+        "default: allow",
+        "skills:",
+        f"  {_q(report.skill)}:",
+        f"    verdict: {verdict}",
+    ]
+    if reasons:
+        lines.append("    reasons:")
+        lines += [f"      - {r}" for r in reasons]
+    if caps:
+        lines.append("    block_capabilities:")
+        lines += [f"      - {c}" for c in caps]
+    return "\n".join(lines) + "\n"
+
+
+def _q(name: str) -> str:
+    if name and all(c.isalnum() or c in "_-." for c in name):
+        return name
+    return '"' + name.replace("\\", "\\\\").replace('"', '\\"') + '"'

bastionskill/ignore.py

@@ -0,0 +1,61 @@
+"""`.bastionskillignore` — skip files and suppress findings.
+
+Format (gitignore-ish), one rule per line, blank lines and `#` comments skipped:
+
+    scripts/vendor/*        # a bare glob: skip these files entirely
+    suppress obfuscation    # drop every 'obfuscation' finding
+    suppress network-egress scripts/known_client.py   # drop only for a path glob
+
+Suppression is deliberately coarse — a vetted skill or a noisy check, not a
+per-line waiver. Keep the file in the skill root (or pass a path).
+"""
+
+from __future__ import annotations
+
+import fnmatch
+from dataclasses import dataclass, field
+from pathlib import Path
+
+from .models import Finding
+
+
+@dataclass(frozen=True)
+class _Suppress:
+    check: str
+    glob: str  # "" = all paths
+
+
+@dataclass
+class IgnoreRules:
+    skip_globs: list[str] = field(default_factory=list)
+    suppress: list[_Suppress] = field(default_factory=list)
+
+    def skip_file(self, rel_path: str) -> bool:
+        return any(fnmatch.fnmatch(rel_path, g) for g in self.skip_globs)
+
+    def suppressed(self, f: Finding) -> bool:
+        for s in self.suppress:
+            if s.check != f.check:
+                continue
+            if not s.glob or fnmatch.fnmatch(f.file, s.glob):
+                return True
+        return False
+
+
+def load(path: str | Path | None) -> IgnoreRules:
+    rules = IgnoreRules()
+    if path is None:
+        return rules
+    p = Path(path)
+    if not p.is_file():
+        return rules
+    for raw in p.read_text(encoding="utf-8", errors="replace").splitlines():
+        line = raw.strip()
+        if not line or line.startswith("#"):
+            continue
+        parts = line.split()
+        if parts[0] == "suppress" and len(parts) >= 2:
+            rules.suppress.append(_Suppress(check=parts[1], glob=parts[2] if len(parts) > 2 else ""))
+        else:
+            rules.skip_globs.append(line)
+    return rules

bastionskill/ledger.py

@@ -0,0 +1,82 @@
+"""Local scan ledger — an append-only record of what was scanned, when.
+
+One JSONL line per recorded scan at `~/.bastionskill/ledger.jsonl`. It answers
+"have I scanned this before, and did it change since?" — the rug-pull signal:
+same source, different content hash = the skill was modified after you vetted it.
+
+Local and dependency-free. The line schema is deliberately flat so a remote sink
+(e.g. Supabase) can later replay it without transformation.
+"""
+
+from __future__ import annotations
+
+import json
+from datetime import datetime, timezone
+from pathlib import Path
+
+from .models import ScanReport, Skill
+
+LEDGER_SCHEMA = "bastionskill.ledger/1"
+
+
+def ledger_path() -> Path:
+    return Path.home() / ".bastionskill" / "ledger.jsonl"
+
+
+def _entries(path: Path) -> list[dict]:
+    if not path.is_file():
+        return []
+    out = []
+    for line in path.read_text(encoding="utf-8", errors="replace").splitlines():
+        line = line.strip()
+        if not line:
+            continue
+        try:
+            out.append(json.loads(line))
+        except json.JSONDecodeError:
+            continue  # tolerate a partially written / corrupt line
+    return out
+
+
+def last_for_source(source: str, path: Path | None = None) -> dict | None:
+    """Most recent ledger entry for a source, or None."""
+    p = path or ledger_path()
+    match = [e for e in _entries(p) if e.get("source") == source]
+    return match[-1] if match else None
+
+
+def record(rep: ScanReport, skill: Skill, path: Path | None = None) -> dict:
+    """Append a scan to the ledger. Returns the entry written."""
+    p = path or ledger_path()
+    p.parent.mkdir(parents=True, exist_ok=True)
+    entry = {
+        "schema": LEDGER_SCHEMA,
+        "ts": datetime.now(timezone.utc).isoformat(),
+        "source": skill.source,
+        "skill": rep.skill,
+        "content_hash": skill.content_hash(),
+        "verdict": "allow" if rep.ok else "deny",
+        "risk": rep.risk,
+        "counts": rep.counts(),
+    }
+    with open(p, "a", encoding="utf-8") as fh:
+        fh.write(json.dumps(entry, ensure_ascii=False) + "\n")
+    return entry
+
+
+def drift(skill: Skill, path: Path | None = None) -> dict | None:
+    """If this source was scanned before with a DIFFERENT hash, return the prior
+    entry (a rug-pull signal). None if unseen or unchanged."""
+    prev = last_for_source(skill.source, path)
+    if prev and prev.get("content_hash") != skill.content_hash():
+        return prev
+    return None
+
+
+def summary(path: Path | None = None) -> list[dict]:
+    """Latest entry per source, most-recent first — the 'scanned skills' table."""
+    p = path or ledger_path()
+    latest: dict[str, dict] = {}
+    for e in _entries(p):
+        latest[e.get("source", "")] = e
+    return sorted(latest.values(), key=lambda e: e.get("ts", ""), reverse=True)

bastionskill/loader.py

@@ -0,0 +1,146 @@
+"""Load a skill directory into a `Skill` model.
+
+Reads SKILL.md (frontmatter `description`), collects bundled source files, and
+records bundled *opaque* files (compiled or binary artifacts we cannot statically
+read — a common poisoning bypass). No network, no code execution — pure read.
+"""
+
+from __future__ import annotations
+
+import re
+from pathlib import Path
+
+from .models import Skill, SourceFile
+
+# Extensions we treat as executable code worth scanning, mapped to a language tag.
+_LANG_BY_EXT = {
+    ".py": "python",
+    ".sh": "bash",
+    ".bash": "bash",
+    ".zsh": "bash",
+    ".js": "javascript",
+    ".mjs": "javascript",
+    ".cjs": "javascript",
+    ".ts": "javascript",  # close enough for regex heuristics
+    ".ps1": "other",
+    ".rb": "other",
+    ".pl": "other",
+}
+
+# Bundled artifacts that execute/load but cannot be read as source -> flagged.
+_OPAQUE_EXTS = {
+    ".exe", ".dll", ".so", ".dylib", ".pyc", ".pyd", ".wasm", ".bin",
+    ".o", ".a", ".jar", ".class", ".node", ".msi", ".apk", ".deb", ".dmg",
+}
+
+# Dirs skipped entirely (never the skill's own payload, and huge).
+_SKIP_ALWAYS = {".git", "node_modules", "__pycache__", ".venv", "venv"}
+# Dirs skipped for SOURCE noise but still swept for opaque binaries — a dropped
+# payload binary lives exactly here, so a security scan must not ignore them.
+_SKIP_SOURCE_ONLY = {"dist", "build"}
+_SKIP_DIRS = _SKIP_ALWAYS | _SKIP_SOURCE_ONLY  # for SKILL.md discovery only
+
+_FRONTMATTER = re.compile(r"^---\s*\n(.*?)\n---\s*\n", re.DOTALL)
+_DESC = re.compile(r"^description:\s*(.+?)\s*$", re.MULTILINE)
+
+
+def _read(path: Path) -> str:
+    return path.read_text(encoding="utf-8", errors="replace")
+
+
+def _parse_description(skill_md: str) -> str:
+    m = _FRONTMATTER.match(skill_md)
+    if not m:
+        return ""
+    d = _DESC.search(m.group(1))
+    return d.group(1).strip() if d else ""
+
+
+# Magic bytes of executable/loadable formats. Catches a binary even when it has
+# been renamed to look benign, while NOT flagging images/fonts/data (which carry
+# their own magic and legitimately appear in skills).
+_EXEC_MAGIC = (
+    b"\x7fELF",          # ELF (Linux)
+    b"MZ",               # PE / DOS (Windows .exe/.dll)
+    b"\xfe\xed\xfa\xce",  # Mach-O 32
+    b"\xfe\xed\xfa\xcf",  # Mach-O 64
+    b"\xcf\xfa\xed\xfe",  # Mach-O 64 LE
+    b"\xca\xfe\xba\xbe",  # Java class / Mach-O fat
+    b"\x00asm",          # WebAssembly
+    b"dex\n",            # Android dex
+)
+
+
+def _is_executable_blob(path: Path) -> bool:
+    """True if the file's magic bytes mark it as a compiled/loadable binary."""
+    try:
+        with open(path, "rb") as fh:
+            head = fh.read(8)
+    except OSError:
+        return False
+    return any(head.startswith(m) for m in _EXEC_MAGIC)
+
+
+def load_skill(root: str | Path, name: str | None = None) -> Skill:
+    """Load the skill rooted at `root`.
+
+    `root` may be the dir holding SKILL.md, or a parent — the first SKILL.md
+    found (breadth-first) wins.
+    """
+    root = Path(root)
+    if not root.exists():
+        raise FileNotFoundError(f"no such path: {root}")
+
+    skill_md = _find_skill_md(root)
+    description = _parse_description(_read(skill_md)) if skill_md else ""
+    base = skill_md.parent if skill_md else root
+
+    files: list[SourceFile] = []
+    opaque: list[str] = []
+    for p in sorted(base.rglob("*")):
+        if not p.is_file():
+            continue
+        if any(part in _SKIP_ALWAYS for part in p.parts):
+            continue
+        in_build = any(part in _SKIP_SOURCE_ONLY for part in p.parts)
+        rel = p.relative_to(base).as_posix()
+        lang = _LANG_BY_EXT.get(p.suffix.lower())
+        if lang is not None and not in_build:
+            files.append(SourceFile(path=rel, text=_read(p), lang=lang))
+        elif p.suffix.lower() in _OPAQUE_EXTS or _is_executable_blob(p):
+            # opaque binaries are flagged even inside dist/build
+            opaque.append(rel)
+
+    return Skill(
+        name=name or base.name,
+        description=description,
+        files=tuple(files),
+        source=str(root),
+        opaque=tuple(opaque),
+    )
+
+
+def discover_skills(root: str | Path) -> list[Path]:
+    """Return the directory of every skill under `root` (each holds a SKILL.md).
+
+    Falls back to `[root]` when no SKILL.md exists, so a bare script dir still
+    scans as one skill.
+    """
+    root = Path(root)
+    if (root / "SKILL.md").is_file():
+        return [root]
+    dirs = sorted({
+        p.parent for p in root.rglob("SKILL.md")
+        if p.is_file() and not any(part in _SKIP_DIRS for part in p.parts)
+    })
+    return dirs or [root]
+
+
+def _find_skill_md(root: Path) -> Path | None:
+    if (root / "SKILL.md").is_file():
+        return root / "SKILL.md"
+    matches = sorted(
+        p for p in root.rglob("SKILL.md")
+        if p.is_file() and not any(part in _SKIP_DIRS for part in p.parts)
+    )
+    return matches[0] if matches else None

bastionskill/models.py

@@ -0,0 +1,107 @@
+"""Immutable data model for skill-poisoning scanning.
+
+A `Skill` holds a SKILL.md declaration plus the bundled `SourceFile`s that run
+when the skill is invoked. Checks read a `Skill` and emit `Finding`s; a
+`ScanReport` collects them.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass, field
+
+SEVERITIES = ("critical", "high", "medium", "low")
+_RANK = {s: i for i, s in enumerate(SEVERITIES)}  # 0 = worst
+
+# Capabilities a bundled script can exercise. The shadow check compares these
+# against what SKILL.md declares.
+CAPABILITIES = ("network", "secrets", "persistence", "destructive", "exec")
+
+
+@dataclass(frozen=True)
+class SourceFile:
+    """One bundled file that ships with the skill."""
+
+    path: str  # relative to the skill root
+    text: str
+    lang: str  # "python" | "bash" | "javascript" | "other"
+
+
+@dataclass(frozen=True)
+class Skill:
+    """A named skill: its SKILL.md declaration and bundled source files."""
+
+    name: str
+    description: str = ""  # SKILL.md frontmatter description (the declared intent)
+    files: tuple[SourceFile, ...] = ()
+    source: str = ""  # dir or url it came from
+    opaque: tuple[str, ...] = ()  # bundled files we cannot statically read
+
+    def content_hash(self) -> str:
+        """Stable sha256 over every bundled file's path + bytes.
+
+        Drives ledger drift / rug-pull detection: same source, changed hash =
+        the skill was modified since the last scan.
+        """
+        import hashlib
+
+        h = hashlib.sha256()
+        for f in sorted(self.files, key=lambda x: x.path):
+            h.update(f.path.encode("utf-8"))
+            h.update(b"\0")
+            h.update(f.text.encode("utf-8", "replace"))
+            h.update(b"\0")
+        for name in sorted(self.opaque):
+            h.update(b"opaque:")
+            h.update(name.encode("utf-8"))
+            h.update(b"\0")
+        return h.hexdigest()
+
+
+@dataclass(frozen=True)
+class Finding:
+    """One risk detected by a check."""
+
+    check: str  # check id, e.g. "hook-install"
+    severity: str  # one of SEVERITIES
+    file: str  # relative path, or "" for skill-level
+    message: str
+    evidence: str = ""
+    line: int = 0
+    capability: str = ""  # one of CAPABILITIES, or "" (drives shadow detection)
+
+    def __post_init__(self) -> None:
+        if self.severity not in _RANK:
+            raise ValueError(f"bad severity {self.severity!r}")
+
+
+@dataclass(frozen=True)
+class ScanReport:
+    """Result of scanning one skill."""
+
+    skill: str
+    file_count: int
+    findings: tuple[Finding, ...] = ()
+
+    @property
+    def risk(self) -> str:
+        """Worst severity present, or 'clean'."""
+        if not self.findings:
+            return "clean"
+        return min((f.severity for f in self.findings), key=lambda s: _RANK[s])
+
+    @property
+    def ok(self) -> bool:
+        """True when nothing critical or high was found."""
+        return self.risk in ("clean", "medium", "low")
+
+    def counts(self) -> dict[str, int]:
+        out = {s: 0 for s in SEVERITIES}
+        for f in self.findings:
+            out[f.severity] += 1
+        return out
+
+    def sorted_findings(self) -> tuple[Finding, ...]:
+        """Findings worst-first, then by file/line for stable output."""
+        return tuple(
+            sorted(self.findings, key=lambda f: (_RANK[f.severity], f.file, f.line))
+        )

bastionskill/prompt.py

@@ -0,0 +1,45 @@
+"""Prompt-layer check (optional, off by default).
+
+v0.1 owns the code-layer. The prompt-layer (malicious SKILL.md instructions,
+injection templates) is bastionsupply's job — it already ships those detectors and
+the shared bastioncorpus. This module keeps only the one prompt-layer check that is
+trivial in the stdlib — hidden / zero-width / bidi unicode in the SKILL.md text —
+and defers everything richer to bastionsupply when it is installed.
+
+Enable with `bastionskill scan --prompt <path>`.
+"""
+
+from __future__ import annotations
+
+import unicodedata
+
+from .models import Finding, Skill
+
+# Zero-width and bidi-control code points used to hide or reorder text.
+_HIDDEN = {
+    "​", "‌", "‍", "",  # zero-width space/joiner/BOM
+    "‪", "‫", "‬", "‭", "‮",  # bidi overrides
+    "⁦", "⁧", "⁨", "⁩",  # isolates
+}
+
+
+def scan_prompt_layer(skill: Skill) -> list[Finding]:
+    text = skill.description
+    out: list[Finding] = []
+    hits = sorted({c for c in text if c in _HIDDEN})
+    if hits:
+        names = ", ".join(unicodedata.name(c, repr(c)) for c in hits)
+        out.append(Finding(
+            check="hidden-unicode", severity="high", file="SKILL.md",
+            message=f"hidden/bidi unicode in description: {names}",
+            evidence=text[:160],
+        ))
+    # Deeper injection detection lives in bastionsupply; use it if present.
+    try:
+        import bastionsupply  # noqa: F401
+    except ImportError:
+        out.append(Finding(
+            check="prompt-layer-note", severity="low", file="SKILL.md",
+            message="install bastionsupply for full prompt-layer injection scanning",
+        ))
+    return out

bastionskill/remote.py

@@ -0,0 +1,74 @@
+"""Fetch a remote skill to a temp dir for pre-flight scanning.
+
+The wedge: scan a skill *before* you clone it into your agent. We shallow-clone
+into a throwaway dir and hand back the path; the caller scans it (static — the
+skill's own code is never executed) and cleans up.
+
+`git clone` fetches files; it does not run repository code. We still never invoke
+anything inside the cloned tree.
+"""
+
+from __future__ import annotations
+
+import re
+import shutil
+import subprocess
+import tempfile
+from pathlib import Path
+
+# owner/repo  (letters, digits, dot, dash, underscore) — GitHub shorthand
+_SHORTHAND = re.compile(r"^[\w.-]+/[\w.-]+$")
+
+
+def is_remote(target: str) -> bool:
+    t = target.strip()
+    return (
+        t.startswith(("http://", "https://", "git@", "ssh://"))
+        or t.endswith(".git")
+        or t.startswith("github.com/")
+        or bool(_SHORTHAND.match(t))
+    )
+
+
+def _to_clone_url(target: str) -> str:
+    t = target.strip()
+    if t.startswith(("http://", "https://", "git@", "ssh://")) or t.endswith(".git"):
+        return t
+    if t.startswith("github.com/"):
+        return "https://" + t
+    if _SHORTHAND.match(t):
+        return f"https://github.com/{t}"
+    return t
+
+
+class RemoteCheckout:
+    """Context manager: shallow-clone a remote skill, clean up on exit."""
+
+    def __init__(self, target: str) -> None:
+        self.url = _to_clone_url(target)
+        self._dir: str | None = None
+
+    def __enter__(self) -> Path:
+        if shutil.which("git") is None:
+            raise RuntimeError("git not found on PATH — needed to scan a remote skill")
+        self._dir = tempfile.mkdtemp(prefix="bastionskill-")
+        try:
+            subprocess.run(
+                ["git", "clone", "--depth", "1", "--quiet", self.url, self._dir],
+                check=True, capture_output=True, text=True, timeout=120,
+            )
+        except subprocess.CalledProcessError as e:
+            self._cleanup()
+            raise RuntimeError(f"git clone failed: {e.stderr.strip() or e}") from e
+        except subprocess.TimeoutExpired:
+            self._cleanup()
+            raise RuntimeError("git clone timed out") from None
+        return Path(self._dir)
+
+    def __exit__(self, *exc) -> None:
+        self._cleanup()
+
+    def _cleanup(self) -> None:
+        if self._dir:
+            shutil.rmtree(self._dir, ignore_errors=True)
+            self._dir = None

bastionskill/report.py

@@ -0,0 +1,98 @@
+"""Render a `ScanReport` as text or JSON."""
+
+from __future__ import annotations
+
+import json
+from datetime import datetime, timezone
+
+from .models import ScanReport, Skill
+
+MANIFEST_SCHEMA = "bastionskill.manifest/1"
+
+_MARK = {"critical": "CRIT", "high": "HIGH", "medium": "MED ", "low": "LOW "}
+
+
+def to_text(rep: ScanReport) -> str:
+    lines: list[str] = []
+    c = rep.counts()
+    head = (f"skill: {rep.skill}  files: {rep.file_count}  risk: {rep.risk.upper()}"
+            f"  (crit {c['critical']} / high {c['high']} /"
+            f" med {c['medium']} / low {c['low']})")
+    lines.append(head)
+    lines.append("-" * len(head))
+
+    findings = rep.sorted_findings()
+    if not findings:
+        lines.append("clean: no code-layer risks found.")
+        return "\n".join(lines)
+
+    # Shadow first, called out — it is the headline.
+    shadows = [f for f in findings if f.check == "shadow"]
+    if shadows:
+        lines.append("SHADOW (declared intent != actual behavior):")
+        for f in shadows:
+            lines.append(f"  ! {f.message}")
+        lines.append("")
+
+    for f in findings:
+        if f.check == "shadow":
+            continue
+        loc = f.file + (f":{f.line}" if f.line else "")
+        lines.append(f"[{_MARK[f.severity]}] {f.check:<14} {loc}")
+        lines.append(f"        {f.message}")
+        if f.evidence:
+            lines.append(f"        > {f.evidence}")
+    return "\n".join(lines)
+
+
+def to_manifest(rep: ScanReport, skill: Skill, tool_version: str) -> dict:
+    """A stable, signable record of one scan.
+
+    Deterministic except `generated_at`; carries per-file sha256 and the skill
+    content hash so a signature (future) or a Supabase sink can pin exactly what
+    was scanned. This is the schema a certification/registry layer would build on.
+    """
+    import hashlib
+
+    files = [
+        {"path": f.path, "lang": f.lang,
+         "sha256": hashlib.sha256(f.text.encode("utf-8", "replace")).hexdigest()}
+        for f in sorted(skill.files, key=lambda x: x.path)
+    ]
+    return {
+        "schema": MANIFEST_SCHEMA,
+        "tool_version": tool_version,
+        "generated_at": datetime.now(timezone.utc).isoformat(),
+        "skill": rep.skill,
+        "source": skill.source,
+        "content_hash": skill.content_hash(),
+        "verdict": "allow" if rep.ok else "deny",
+        "risk": rep.risk,
+        "counts": rep.counts(),
+        "files": files,
+        "opaque": list(skill.opaque),
+        "findings": json.loads(to_json(rep))["findings"],
+    }
+
+
+def to_json(rep: ScanReport) -> str:
+    obj = {
+        "skill": rep.skill,
+        "file_count": rep.file_count,
+        "risk": rep.risk,
+        "ok": rep.ok,
+        "counts": rep.counts(),
+        "findings": [
+            {
+                "check": f.check,
+                "severity": f.severity,
+                "capability": f.capability,
+                "file": f.file,
+                "line": f.line,
+                "message": f.message,
+                "evidence": f.evidence,
+            }
+            for f in rep.sorted_findings()
+        ],
+    }
+    return json.dumps(obj, indent=2, ensure_ascii=False)

bastionskill/scanner.py

@@ -0,0 +1,92 @@
+"""Scan a `Skill`: run code-layer checks, then compute the shadow.
+
+The shadow is the product's whole point: capabilities the bundled code exercises
+(network, secrets, persistence, destructive) that SKILL.md never declared.
+"""
+
+from __future__ import annotations
+
+from .checks import scan_opaque, scan_python_ast, scan_regex
+from .ignore import IgnoreRules
+from .models import Finding, ScanReport, Skill
+
+# Words in a SKILL.md description that count as declaring a capability.
+_DECLARES: dict[str, tuple[str, ...]] = {
+    "network": ("network", "http", "https", "download", "upload", "fetch",
+                "online", "api", "url", "web", "request", "internet"),
+    "secrets": ("credential", "secret", "token", "api key", "api-key",
+                "password", "auth", "keychain", "ssh"),
+    "persistence": ("hook", "background", "daemon", "startup", "cron",
+                    "persist", "install a hook"),
+    "destructive": ("delete", "remove", "wipe", "erase", "clean up", "purge"),
+}
+
+# Phrases that explicitly DISCLAIM a capability. A disclaimer over code that does
+# the thing is the strongest shadow, so it always beats a bare keyword mention
+# (e.g. "no network" contains "network" but declares the opposite).
+_NEGATES: dict[str, tuple[str, ...]] = {
+    "network": ("no network", "offline", "no internet", "without network",
+                "no connection", "runs locally", "fully local"),
+    "secrets": ("no credential", "no secret", "reads no", "touches nothing"),
+    "persistence": ("no hook", "installs nothing", "no persistence"),
+    "destructive": ("read-only", "read only", "never deletes", "non-destructive"),
+}
+
+# Only these capabilities drive shadow detection ("exec" is generic and always
+# present in a script; it is not a declared-intent signal on its own).
+_SHADOW_CAPS = ("network", "secrets", "persistence", "destructive")
+
+
+def _dedupe(findings: list[Finding]) -> list[Finding]:
+    seen: set[tuple[str, str, int]] = set()
+    out: list[Finding] = []
+    for f in findings:
+        key = (f.check, f.file, f.line)
+        if key in seen:
+            continue
+        seen.add(key)
+        out.append(f)
+    return out
+
+
+def shadow_findings(skill: Skill, code_findings: list[Finding]) -> list[Finding]:
+    desc = skill.description.lower()
+    exercised = {f.capability for f in code_findings if f.capability in _SHADOW_CAPS}
+    out: list[Finding] = []
+    for cap in _SHADOW_CAPS:
+        if cap not in exercised:
+            continue
+        disclaimed = any(p in desc for p in _NEGATES.get(cap, ()))
+        if not disclaimed and any(word in desc for word in _DECLARES[cap]):
+            continue  # declared and not disclaimed: code and description agree
+        out.append(Finding(
+            check="shadow", severity="critical", file="SKILL.md",
+            capability=cap,
+            message=(f"undeclared {cap}: the code exercises {cap} but SKILL.md "
+                     f"never says so"),
+            evidence=(skill.description[:160] or "(no description)"),
+        ))
+    return out
+
+
+def scan(skill: Skill, ignore: IgnoreRules | None = None) -> ScanReport:
+    code: list[Finding] = []
+    scanned_files = 0
+    for f in skill.files:
+        if ignore and ignore.skip_file(f.path):
+            continue
+        scanned_files += 1
+        code.extend(scan_regex(f))
+        if f.lang == "python":
+            code.extend(scan_python_ast(f))
+    opaque = [o for o in skill.opaque if not (ignore and ignore.skip_file(o))]
+    code.extend(scan_opaque(tuple(opaque)))
+    code = _dedupe(code)
+    findings = code + shadow_findings(skill, code)
+    if ignore:
+        findings = [f for f in findings if not ignore.suppressed(f)]
+    return ScanReport(
+        skill=skill.name,
+        file_count=scanned_files + len(opaque),
+        findings=tuple(findings),
+    )

bastionskill-0.1.0.dist-info/METADATA

@@ -0,0 +1,111 @@
+Metadata-Version: 2.4
+Name: bastionskill
+Version: 0.1.0
+Summary: Skill-poisoning scanner: detect malicious bundled code (network egress, secret theft, hook-install persistence, destructive commands) in agent skills before you install them — the code-layer that a plain grepper and a prompt-scanner miss.
+Author-email: Stefano Rizzello <rizzellostefano@gmail.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/Rinkia/bastionskill
+Project-URL: Repository, https://github.com/Rinkia/bastionskill
+Project-URL: Issues, https://github.com/Rinkia/bastionskill/issues
+Keywords: skill,agent-skill,claude-code,security,supply-chain,prompt-injection,ai-agent,skill-poisoning,agent-security
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: prompt
+Requires-Dist: bastionsupply>=0.4.0; extra == "prompt"
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Dynamic: license-file
+
+# bastionskill
+
+Static scanner for **skill-poisoning**. Point it at an agent skill (a `SKILL.md`
+plus its bundled scripts) and it inspects the *bundled executable code* for
+malicious behavior — then reports the **shadow**: what the code does that the
+skill's description never declared.
+
+Agent skills bundle scripts that run when the skill is invoked, and can install
+hooks that run afterward. That is an arbitrary-code-execution surface. bastionskill
+is the code-layer leg of the bastion suite; the prompt-layer (malicious SKILL.md
+text) is [bastionsupply](https://github.com/Rinkia/bastionsupply)'s job.
+
+## Install
+
+```bash
+pip install bastionskill
+# optional: full prompt-layer scanning via bastionsupply
+pip install "bastionskill[prompt]"
+```
+
+Zero required dependencies. Python 3.10+.
+
+## Use
+
+```bash
+bastionskill scan ./some-skill              # scan a local skill dir
+bastionskill scan ~/.claude/skills          # batch-scan every skill under a dir
+bastionskill scan owner/repo                # pre-flight a REMOTE skill (shallow clone, no exec)
+bastionskill scan https://github.com/o/r    #   ... by full URL
+bastionskill scan ./skill --prompt          # + hidden-unicode / prompt-layer
+bastionskill scan ./skill --json            # machine-readable
+bastionskill scan ./skill --report out.json # signable manifest (per-file hashes, verdict)
+bastionskill scan ./skill --record          # append result to the local ledger
+bastionskill scan ./skill --fail-on critical  # CI gate threshold (default: high)
+bastionskill harden ./skill -o skill-policy.yaml   # agentbastion/bastiongate policy
+bastionskill ledger                         # list previously scanned skills + dates
+```
+
+`--fail-on` sets the exit-code threshold (`critical|high|medium|low|none`, default
+`high`) — drop it in CI as a pre-install gate. See [docs/github-action.md](docs/github-action.md).
+
+**Remote pre-flight** shallow-clones the repo to a temp dir, scans statically, and
+deletes it. The skill's own code is never executed.
+
+**Ledger & rug-pull.** `--record` writes each scan to `~/.bastionskill/ledger.jsonl`
+(source, content hash, date, verdict). Re-scan the same source after it changes and
+you get a `! DRIFT` warning — the poisoned-update vector.
+
+## What it catches (code-layer)
+
+| Detector | Example |
+|---|---|
+| **hook-install (lead)** | a script that writes a `PostToolUse` hook into `settings.json` = persistence |
+| network egress | `socket.connect`, `requests.post`, `curl`/`wget`, `fetch()` |
+| secret read | `~/.aws/credentials`, `id_rsa`, `.env` |
+| obfuscation | `base64 -d | sh`, `eval(atob(...))` |
+| dynamic exec | `exec()`, `eval()`, `getattr(m,n)()` (Python AST tier) |
+| destructive | `rm -rf`, `Remove-Item -Recurse` |
+| lateral-tamper | writes to `CLAUDE.md`, MCP config, or other skills |
+| **opaque-binary** | bundles a compiled/loadable file it can't inspect (incl. renamed binaries, magic-byte sniffed) |
+| **shadow** | code exercises a capability SKILL.md never declared |
+
+Python files get a real `ast` pass (stdlib) on top of regex, so dynamic exec /
+import / attribute-built calls survive reflow. Bash and JS use regex heuristics.
+
+Findings are reported **regardless of dead-code or `if False:` / env-flag guards** —
+the scanner reads source, it never runs it, and malware hides behind guards too.
+
+## How it fits the suite
+
+- Prompt-layer → [bastionsupply](https://github.com/Rinkia/bastionsupply) (dependency, optional extra)
+- Runtime gating → bastiongate
+- `harden` emits an agentbastion / bastiongate skill policy (allow/deny + blocked capabilities)
+
+## Test fixture
+
+The inert, defanged demo skill this scanner is built against lives at
+[Rinkia/poisoned-skill-demo](https://github.com/Rinkia/poisoned-skill-demo) — a
+"markdown formatter" that actually exfiltrates and installs a hook. See its
+`EXPECTED.md` for the findings oracle.
+
+```bash
+bastionskill scan Rinkia/poisoned-skill-demo   # scan the demo straight off GitHub
+```
+
+## License
+
+MIT © 2026 Stefano Rizzello

bastionskill-0.1.0.dist-info/RECORD

@@ -0,0 +1,18 @@
+bastionskill/__init__.py,sha256=mnI7-mXj3V4Cb77hmQo_rdhHPbEcNCBdppkaaFYtC40,745
+bastionskill/checks.py,sha256=edmqU5sWMm2sdbDCjI4EUhdNEi5FMAE0jRousBVlOtk,7783
+bastionskill/cli.py,sha256=tGI-Ncf3Wu8s42I8lVcxkun4c_grmUQByVbe_sIZeHA,7788
+bastionskill/harden.py,sha256=x2Nh8fCU4VGTfbVONu-rQq0scWa-sPVK9RYr8sK7RPw,1375
+bastionskill/ignore.py,sha256=dcNL2vlbzn0WoCc1sNA_F5jbC-rPdtzQ3j2HZ-Oetfs,1881
+bastionskill/ledger.py,sha256=dTs-zTeJeX3fH7V9XIvn1TeVd2uFSIV2Ejjcf1zVgVE,2820
+bastionskill/loader.py,sha256=1afyxvfoiweHcp1e1YkpC-zSqWFxWlpzPuD0Z48keL8,4908
+bastionskill/models.py,sha256=r-p5oTa7jmX7bxafyDkYZAzbCcemyKM4rp6XtWj9dSA,3358
+bastionskill/prompt.py,sha256=WP86UFnsXx1bgzNWudW1B70gcmXZ03LnUfa43Jy6cpQ,1671
+bastionskill/remote.py,sha256=ZM13-EaZ4QV7uGRoSSLDJNw7ogz27uD_fX9mzn5Rpvg,2394
+bastionskill/report.py,sha256=3D7UfbI0An28EwHn0L3wLQ8YoYN5fZNRw-4nIIACo4k,3142
+bastionskill/scanner.py,sha256=BFvvugE_Z7Pwh5jvuVMjnhiM4hT2weTtY0rbrbKyQQA,3812
+bastionskill-0.1.0.dist-info/licenses/LICENSE,sha256=BZvyzlc8AeEX5rrIdqgXPKWqOXp8O1B-0CDg4vy1o6k,1073
+bastionskill-0.1.0.dist-info/METADATA,sha256=tffsU5Zu6clgpbsay9oQ8mn36lAR7JKiHlqpRKn2E-g,5122
+bastionskill-0.1.0.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+bastionskill-0.1.0.dist-info/entry_points.txt,sha256=tQBj4XFZCVhvb71tRQ-oe62CZPHF4IH_yG0KmR9F0vY,55
+bastionskill-0.1.0.dist-info/top_level.txt,sha256=ZFjAp_d3FK5wmK2yFiiunCHfMZrtYZJEwzPj43dsKP8,13
+bastionskill-0.1.0.dist-info/RECORD,,

bastionskill-0.1.0.dist-info/WHEEL

@@ -0,0 +1,5 @@
+Wheel-Version: 1.0
+Generator: setuptools (84.0.0)
+Root-Is-Purelib: true
+Tag: py3-none-any
+

bastionskill-0.1.0.dist-info/entry_points.txt

@@ -0,0 +1,2 @@
+[console_scripts]
+bastionskill = bastionskill.cli:main

bastionskill-0.1.0.dist-info/licenses/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stefano Rizzello
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

bastionskill-0.1.0.dist-info/top_level.txt

@@ -0,0 +1 @@
+bastionskill