bastionskill 0.1.0__tar.gz

bastionskill-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Stefano Rizzello
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

bastionskill-0.1.0/PKG-INFO

@@ -0,0 +1,111 @@
+Metadata-Version: 2.4
+Name: bastionskill
+Version: 0.1.0
+Summary: Skill-poisoning scanner: detect malicious bundled code (network egress, secret theft, hook-install persistence, destructive commands) in agent skills before you install them — the code-layer that a plain grepper and a prompt-scanner miss.
+Author-email: Stefano Rizzello <rizzellostefano@gmail.com>
+License-Expression: MIT
+Project-URL: Homepage, https://github.com/Rinkia/bastionskill
+Project-URL: Repository, https://github.com/Rinkia/bastionskill
+Project-URL: Issues, https://github.com/Rinkia/bastionskill/issues
+Keywords: skill,agent-skill,claude-code,security,supply-chain,prompt-injection,ai-agent,skill-poisoning,agent-security
+Classifier: Development Status :: 3 - Alpha
+Classifier: Intended Audience :: Developers
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: Security
+Requires-Python: >=3.10
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Provides-Extra: prompt
+Requires-Dist: bastionsupply>=0.4.0; extra == "prompt"
+Provides-Extra: dev
+Requires-Dist: pytest>=7.0; extra == "dev"
+Dynamic: license-file
+
+# bastionskill
+
+Static scanner for **skill-poisoning**. Point it at an agent skill (a `SKILL.md`
+plus its bundled scripts) and it inspects the *bundled executable code* for
+malicious behavior — then reports the **shadow**: what the code does that the
+skill's description never declared.
+
+Agent skills bundle scripts that run when the skill is invoked, and can install
+hooks that run afterward. That is an arbitrary-code-execution surface. bastionskill
+is the code-layer leg of the bastion suite; the prompt-layer (malicious SKILL.md
+text) is [bastionsupply](https://github.com/Rinkia/bastionsupply)'s job.
+
+## Install
+
+```bash
+pip install bastionskill
+# optional: full prompt-layer scanning via bastionsupply
+pip install "bastionskill[prompt]"
+```
+
+Zero required dependencies. Python 3.10+.
+
+## Use
+
+```bash
+bastionskill scan ./some-skill              # scan a local skill dir
+bastionskill scan ~/.claude/skills          # batch-scan every skill under a dir
+bastionskill scan owner/repo                # pre-flight a REMOTE skill (shallow clone, no exec)
+bastionskill scan https://github.com/o/r    #   ... by full URL
+bastionskill scan ./skill --prompt          # + hidden-unicode / prompt-layer
+bastionskill scan ./skill --json            # machine-readable
+bastionskill scan ./skill --report out.json # signable manifest (per-file hashes, verdict)
+bastionskill scan ./skill --record          # append result to the local ledger
+bastionskill scan ./skill --fail-on critical  # CI gate threshold (default: high)
+bastionskill harden ./skill -o skill-policy.yaml   # agentbastion/bastiongate policy
+bastionskill ledger                         # list previously scanned skills + dates
+```
+
+`--fail-on` sets the exit-code threshold (`critical|high|medium|low|none`, default
+`high`) — drop it in CI as a pre-install gate. See [docs/github-action.md](docs/github-action.md).
+
+**Remote pre-flight** shallow-clones the repo to a temp dir, scans statically, and
+deletes it. The skill's own code is never executed.
+
+**Ledger & rug-pull.** `--record` writes each scan to `~/.bastionskill/ledger.jsonl`
+(source, content hash, date, verdict). Re-scan the same source after it changes and
+you get a `! DRIFT` warning — the poisoned-update vector.
+
+## What it catches (code-layer)
+
+| Detector | Example |
+|---|---|
+| **hook-install (lead)** | a script that writes a `PostToolUse` hook into `settings.json` = persistence |
+| network egress | `socket.connect`, `requests.post`, `curl`/`wget`, `fetch()` |
+| secret read | `~/.aws/credentials`, `id_rsa`, `.env` |
+| obfuscation | `base64 -d | sh`, `eval(atob(...))` |
+| dynamic exec | `exec()`, `eval()`, `getattr(m,n)()` (Python AST tier) |
+| destructive | `rm -rf`, `Remove-Item -Recurse` |
+| lateral-tamper | writes to `CLAUDE.md`, MCP config, or other skills |
+| **opaque-binary** | bundles a compiled/loadable file it can't inspect (incl. renamed binaries, magic-byte sniffed) |
+| **shadow** | code exercises a capability SKILL.md never declared |
+
+Python files get a real `ast` pass (stdlib) on top of regex, so dynamic exec /
+import / attribute-built calls survive reflow. Bash and JS use regex heuristics.
+
+Findings are reported **regardless of dead-code or `if False:` / env-flag guards** —
+the scanner reads source, it never runs it, and malware hides behind guards too.
+
+## How it fits the suite
+
+- Prompt-layer → [bastionsupply](https://github.com/Rinkia/bastionsupply) (dependency, optional extra)
+- Runtime gating → bastiongate
+- `harden` emits an agentbastion / bastiongate skill policy (allow/deny + blocked capabilities)
+
+## Test fixture
+
+The inert, defanged demo skill this scanner is built against lives at
+[Rinkia/poisoned-skill-demo](https://github.com/Rinkia/poisoned-skill-demo) — a
+"markdown formatter" that actually exfiltrates and installs a hook. See its
+`EXPECTED.md` for the findings oracle.
+
+```bash
+bastionskill scan Rinkia/poisoned-skill-demo   # scan the demo straight off GitHub
+```
+
+## License
+
+MIT © 2026 Stefano Rizzello

bastionskill-0.1.0/README.md

@@ -0,0 +1,88 @@
+# bastionskill
+
+Static scanner for **skill-poisoning**. Point it at an agent skill (a `SKILL.md`
+plus its bundled scripts) and it inspects the *bundled executable code* for
+malicious behavior — then reports the **shadow**: what the code does that the
+skill's description never declared.
+
+Agent skills bundle scripts that run when the skill is invoked, and can install
+hooks that run afterward. That is an arbitrary-code-execution surface. bastionskill
+is the code-layer leg of the bastion suite; the prompt-layer (malicious SKILL.md
+text) is [bastionsupply](https://github.com/Rinkia/bastionsupply)'s job.
+
+## Install
+
+```bash
+pip install bastionskill
+# optional: full prompt-layer scanning via bastionsupply
+pip install "bastionskill[prompt]"
+```
+
+Zero required dependencies. Python 3.10+.
+
+## Use
+
+```bash
+bastionskill scan ./some-skill              # scan a local skill dir
+bastionskill scan ~/.claude/skills          # batch-scan every skill under a dir
+bastionskill scan owner/repo                # pre-flight a REMOTE skill (shallow clone, no exec)
+bastionskill scan https://github.com/o/r    #   ... by full URL
+bastionskill scan ./skill --prompt          # + hidden-unicode / prompt-layer
+bastionskill scan ./skill --json            # machine-readable
+bastionskill scan ./skill --report out.json # signable manifest (per-file hashes, verdict)
+bastionskill scan ./skill --record          # append result to the local ledger
+bastionskill scan ./skill --fail-on critical  # CI gate threshold (default: high)
+bastionskill harden ./skill -o skill-policy.yaml   # agentbastion/bastiongate policy
+bastionskill ledger                         # list previously scanned skills + dates
+```
+
+`--fail-on` sets the exit-code threshold (`critical|high|medium|low|none`, default
+`high`) — drop it in CI as a pre-install gate. See [docs/github-action.md](docs/github-action.md).
+
+**Remote pre-flight** shallow-clones the repo to a temp dir, scans statically, and
+deletes it. The skill's own code is never executed.
+
+**Ledger & rug-pull.** `--record` writes each scan to `~/.bastionskill/ledger.jsonl`
+(source, content hash, date, verdict). Re-scan the same source after it changes and
+you get a `! DRIFT` warning — the poisoned-update vector.
+
+## What it catches (code-layer)
+
+| Detector | Example |
+|---|---|
+| **hook-install (lead)** | a script that writes a `PostToolUse` hook into `settings.json` = persistence |
+| network egress | `socket.connect`, `requests.post`, `curl`/`wget`, `fetch()` |
+| secret read | `~/.aws/credentials`, `id_rsa`, `.env` |
+| obfuscation | `base64 -d | sh`, `eval(atob(...))` |
+| dynamic exec | `exec()`, `eval()`, `getattr(m,n)()` (Python AST tier) |
+| destructive | `rm -rf`, `Remove-Item -Recurse` |
+| lateral-tamper | writes to `CLAUDE.md`, MCP config, or other skills |
+| **opaque-binary** | bundles a compiled/loadable file it can't inspect (incl. renamed binaries, magic-byte sniffed) |
+| **shadow** | code exercises a capability SKILL.md never declared |
+
+Python files get a real `ast` pass (stdlib) on top of regex, so dynamic exec /
+import / attribute-built calls survive reflow. Bash and JS use regex heuristics.
+
+Findings are reported **regardless of dead-code or `if False:` / env-flag guards** —
+the scanner reads source, it never runs it, and malware hides behind guards too.
+
+## How it fits the suite
+
+- Prompt-layer → [bastionsupply](https://github.com/Rinkia/bastionsupply) (dependency, optional extra)
+- Runtime gating → bastiongate
+- `harden` emits an agentbastion / bastiongate skill policy (allow/deny + blocked capabilities)
+
+## Test fixture
+
+The inert, defanged demo skill this scanner is built against lives at
+[Rinkia/poisoned-skill-demo](https://github.com/Rinkia/poisoned-skill-demo) — a
+"markdown formatter" that actually exfiltrates and installs a hook. See its
+`EXPECTED.md` for the findings oracle.
+
+```bash
+bastionskill scan Rinkia/poisoned-skill-demo   # scan the demo straight off GitHub
+```
+
+## License
+
+MIT © 2026 Stefano Rizzello

bastionskill-0.1.0/bastionskill/__init__.py

@@ -0,0 +1,19 @@
+"""bastionskill — static scanner for skill-poisoning (code-layer).
+
+Point it at an agent skill (a SKILL.md plus its bundled scripts). It inspects the
+bundled executable code for malicious behavior — network egress, obfuscated exec,
+secret reads, destructive commands, and persistence/hook install — and reports the
+*shadow*: what the code does that SKILL.md never declared.
+
+Prompt-layer risks (malicious SKILL.md instructions, hidden unicode) are delegated
+to bastionsupply; this tool owns the code-layer.
+"""
+
+from __future__ import annotations
+
+__version__ = "0.1.0"
+
+from .models import Finding, ScanReport, Skill, SourceFile
+from .scanner import scan
+
+__all__ = ["Finding", "ScanReport", "Skill", "SourceFile", "scan", "__version__"]

bastionskill-0.1.0/bastionskill/checks.py

@@ -0,0 +1,192 @@
+"""Code-layer detectors.
+
+Two tiers, both static (source is read, never executed — so payloads hidden
+behind dead-code or `if False:` / env-flag guards are flagged like any other):
+
+* a language-agnostic regex table applied line-by-line to every bundled file, and
+* a Python-only AST tier (`ast` is stdlib) that catches dynamic exec / import /
+  attribute-built calls that reflowed regex can miss.
+
+Each detector carries a `capability`; `scanner.shadow_findings` compares the set
+of capabilities the code exercises against what SKILL.md declared.
+"""
+
+from __future__ import annotations
+
+import ast
+import re
+from dataclasses import dataclass
+from typing import Callable
+
+from .models import Finding, SourceFile
+
+
+@dataclass(frozen=True)
+class Detector:
+    check: str
+    severity: str
+    capability: str
+    pattern: re.Pattern
+    message: str
+
+
+def _d(check, severity, capability, regex, message, flags=0) -> Detector:
+    return Detector(check, severity, capability, re.compile(regex, flags), message)
+
+
+# --- regex tier -------------------------------------------------------------
+# Ordered worst-first only for readability; scanner sorts output itself.
+_REGEX: tuple[Detector, ...] = (
+    # persistence / hook install — the lead finding
+    _d("hook-install", "critical", "persistence",
+       r"\b(Post|Pre|User(Prompt|)|Stop|Notification)ToolUse\b|\bPostToolUse\b|\bPreToolUse\b",
+       "installs an agent hook (runs after this skill, persistence)"),
+    _d("hook-install", "high", "persistence",
+       r"settings\.json|\.claude[\\/](settings|hooks)|[\\/]hooks[\\/]",
+       "writes to agent settings/hooks (persistence surface)"),
+    _d("lateral-tamper", "high", "persistence",
+       r"CLAUDE\.md|mcp\.json|claude_desktop_config|[\\/]skills[\\/]|\.mcp\.json",
+       "writes to agent config / other skills (lateral tampering)"),
+    _d("persistence", "high", "persistence",
+       r"\bcrontab\b|LaunchAgents|LaunchDaemons|\bHKCU\b|\bHKLM\b|systemctl\s+enable",
+       "installs OS-level persistence (cron/launchd/registry/systemd)"),
+    # network egress
+    _d("network-egress", "critical", "network",
+       r"\bsocket\.socket\b|\.connect\(\s*\(|\.sendall\(|\.sendto\(",
+       "raw socket network egress"),
+    _d("network-egress", "high", "network",
+       r"\brequests\.(get|post|put|patch|delete)\b|\burllib\.request\b|\bhttp\.client\b|\bfetch\(|\baxios\b",
+       "HTTP client call (possible exfiltration)"),
+    _d("network-egress", "high", "network",
+       r"\bcurl\b|\bwget\b|Invoke-WebRequest|Invoke-RestMethod",
+       "shells out to a network client (curl/wget/Invoke-WebRequest)"),
+    # secret read
+    _d("secret-read", "critical", "secrets",
+       r"\.aws[\\/]credentials|id_rsa|id_ed25519|\.ssh[\\/]|\.git-credentials|\.npmrc|KUBECONFIG|keychain",
+       "reads credential/secret material"),
+    _d("secret-read", "high", "secrets",
+       r"(^|[\s\"'/=@])\.env\b",
+       "reads a .env secrets file"),
+    # obfuscation
+    _d("obfuscation", "high", "exec",
+       r"base64\s+(-d|--decode)|b64decode|atob\(|FromBase64String",
+       "base64-decoded payload (obfuscation)"),
+    _d("obfuscation", "critical", "exec",
+       r"base64\s+(-d|--decode)[^\n|]*\|\s*(sh|bash|python|node)\b",
+       "decodes then pipes to an interpreter (staged exec)"),
+    # dynamic exec (regex catch; AST tier confirms for python)
+    _d("dynamic-exec", "critical", "exec",
+       r"\beval\(|\bexec\(|\bsystem\(|subprocess\.(Popen|call|run|check_output)|os\.popen",
+       "dynamic / shell execution"),
+    # destructive
+    _d("destructive", "high", "destructive",
+       r"\brm\s+-rf\b|Remove-Item\b[^\n]*-Recurse|\bmkfs\b|\bdd\s+if=|\bshred\b",
+       "destructive filesystem/disk command"),
+)
+
+
+_BLOCK_COMMENT = re.compile(r"/\*.*?\*/", re.DOTALL)
+
+
+def _strip_comments(text: str, lang: str) -> str:
+    """Blank out comment lines so regex doesn't match code described in prose.
+
+    Line count is preserved (line numbers stay valid). Conservative: only removes
+    FULL-LINE comments (and JS block comments) — trailing comments are left so a
+    `#` inside a string is never mistaken for a comment and a real finding hidden.
+    ponytail: trailing-comment false positives remain; upgrade to a real tokenizer
+    only if they prove noisy on real skills.
+    """
+    if lang == "javascript":
+        text = _BLOCK_COMMENT.sub(lambda m: "\n" * m.group(0).count("\n"), text)
+        prefix = "//"
+    elif lang in ("python", "bash", "other"):
+        prefix = "#"
+    else:
+        return text
+    out = []
+    for line in text.split("\n"):
+        out.append("" if line.lstrip().startswith(prefix) else line)
+    return "\n".join(out)
+
+
+def scan_regex(f: SourceFile) -> list[Finding]:
+    out: list[Finding] = []
+    original = f.text.splitlines()
+    scanned = _strip_comments(f.text, f.lang).splitlines()
+    for i, line in enumerate(scanned, start=1):
+        for det in _REGEX:
+            if det.pattern.search(line):
+                evidence = original[i - 1].strip() if i - 1 < len(original) else line.strip()
+                out.append(Finding(
+                    check=det.check, severity=det.severity, file=f.path,
+                    message=det.message, evidence=evidence[:200],
+                    line=i, capability=det.capability,
+                ))
+    return out
+
+
+def scan_opaque(opaque_paths: tuple[str, ...]) -> list[Finding]:
+    """One HIGH finding per bundled file we cannot read as source.
+
+    A compiled or binary artifact is an execution surface a static reader is blind
+    to — treat "can't inspect" as "don't trust", not as clean.
+    """
+    return [
+        Finding(
+            check="opaque-binary", severity="high", file=path, capability="exec",
+            message="opaque/compiled bundled file — cannot inspect, do not trust",
+        )
+        for path in opaque_paths
+    ]
+
+
+# --- python AST tier --------------------------------------------------------
+def _is_name(node: ast.AST, names: set[str]) -> bool:
+    return isinstance(node, ast.Name) and node.id in names
+
+
+class _Visitor(ast.NodeVisitor):
+    def __init__(self, path: str) -> None:
+        self.path = path
+        self.findings: list[Finding] = []
+
+    def _add(self, check, severity, capability, message, node) -> None:
+        self.findings.append(Finding(
+            check=check, severity=severity, file=self.path, message=message,
+            line=getattr(node, "lineno", 0), capability=capability,
+        ))
+
+    def visit_Call(self, node: ast.Call) -> None:
+        func = node.func
+        # exec(...) / eval(...)
+        if _is_name(func, {"exec", "eval"}):
+            self._add("dynamic-exec", "critical", "exec",
+                      f"AST: dynamic {func.id}() call", node)
+        # __import__(...) / importlib.import_module(...)
+        if _is_name(func, {"__import__"}) or (
+            isinstance(func, ast.Attribute) and func.attr == "import_module"
+        ):
+            self._add("dynamic-import", "medium", "exec",
+                      "AST: dynamic import", node)
+        # getattr(x, name)(...) — attribute-built call
+        if isinstance(func, ast.Call) and _is_name(func.func, {"getattr"}):
+            self._add("dynamic-call", "medium", "exec",
+                      "AST: getattr-built dynamic call", node)
+        self.generic_visit(node)
+
+
+def scan_python_ast(f: SourceFile) -> list[Finding]:
+    try:
+        tree = ast.parse(f.text)
+    except (SyntaxError, ValueError, RecursionError, MemoryError):
+        # unparseable or hostile-to-parse python: regex tier still covered it;
+        # never let a crafted file crash the scan.
+        return []
+    v = _Visitor(f.path)
+    v.visit(tree)
+    return v.findings
+
+
+def all_checks() -> tuple[Callable[[SourceFile], list[Finding]], ...]:
+    return (scan_regex,)

bastionskill-0.1.0/bastionskill/cli.py

@@ -0,0 +1,199 @@
+"""bastionskill command line.
+
+    bastionskill scan ./some-skill                # scan a local skill dir
+    bastionskill scan ~/.claude/skills            # batch-scan every skill under a dir
+    bastionskill scan owner/repo                  # pre-flight a remote skill (shallow clone)
+    bastionskill scan https://github.com/o/r      #   ... by full URL
+    bastionskill scan ./skill --json              # machine-readable
+    bastionskill scan ./skill --report out.json   # signable manifest (hashes, verdict)
+    bastionskill scan ./skill --record            # append result to the local ledger
+    bastionskill scan ./skill --fail-on critical  # CI gate threshold (default: high)
+    bastionskill harden ./skill -o skill-policy.yaml
+    bastionskill ledger                           # list previously scanned skills + dates
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+from . import __version__, harden, ledger as ledger_mod, prompt, remote, report
+from .ignore import load as load_ignore
+from .loader import discover_skills, load_skill
+from .models import SEVERITIES, ScanReport, Skill
+from .scanner import scan
+
+_RANK = {s: i for i, s in enumerate(SEVERITIES)}  # 0 = worst
+
+
+def _make_output_unicode_safe() -> None:
+    for stream in (sys.stdout, sys.stderr):
+        try:
+            stream.reconfigure(encoding="utf-8", errors="backslashreplace")
+        except (AttributeError, ValueError):
+            pass
+
+
+def _resolve_ignore(skill_dir: Path, args):
+    if getattr(args, "no_ignore", False):
+        return None
+    path = args.ignore if getattr(args, "ignore", None) else skill_dir / ".bastionskillignore"
+    return load_ignore(path)
+
+
+def _fails(rep: ScanReport, threshold: str) -> bool:
+    if threshold == "none":
+        return False
+    worst = min((_RANK[f.severity] for f in rep.findings), default=len(SEVERITIES))
+    return worst <= _RANK[threshold]
+
+
+def _scan_one(skill_dir: Path, args) -> tuple[ScanReport, Skill]:
+    skill = load_skill(skill_dir, name=args.name)
+    rep = scan(skill, ignore=_resolve_ignore(skill_dir, args))
+    if getattr(args, "prompt", False):
+        rep = ScanReport(
+            skill=rep.skill, file_count=rep.file_count,
+            findings=rep.findings + tuple(prompt.scan_prompt_layer(skill)),
+        )
+    return rep, skill
+
+
+def main(argv=None) -> int:
+    _make_output_unicode_safe()
+    ap = argparse.ArgumentParser(
+        prog="bastionskill", description=__doc__,
+        formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("--version", action="version", version=f"bastionskill {__version__}")
+    sub = ap.add_subparsers(dest="cmd", required=True)
+
+    ps = sub.add_parser("scan", help="scan a skill (local dir, dir of skills, or remote)")
+    ps.add_argument("target", help="skill dir, a dir of skills, or a remote url/owner-repo")
+    ps.add_argument("--name", help="override skill name label")
+    ps.add_argument("--prompt", action="store_true",
+                    help="also run the prompt-layer check (hidden unicode)")
+    ps.add_argument("--json", action="store_true", help="emit JSON")
+    ps.add_argument("--report", help="write a signable scan manifest to this path")
+    ps.add_argument("--record", action="store_true", help="append result to the local ledger")
+    ps.add_argument("--fail-on", default="high", choices=[*SEVERITIES, "none"],
+                    help="exit non-zero at this severity or worse (default: high)")
+    ps.add_argument("--ignore", help="path to a .bastionskillignore (default: in the skill dir)")
+    ps.add_argument("--no-ignore", action="store_true", help="ignore any .bastionskillignore")
+
+    ph = sub.add_parser("harden", help="emit an agentbastion/bastiongate skill policy")
+    ph.add_argument("target", help="skill dir (or remote url/owner-repo)")
+    ph.add_argument("--name", help="override skill name label")
+    ph.add_argument("-o", "--out", help="write policy.yaml (default: stdout)")
+
+    pl = sub.add_parser("ledger", help="list previously scanned skills and dates")
+    pl.add_argument("--json", action="store_true", help="emit JSON")
+
+    args = ap.parse_args(argv)
+    if args.cmd == "scan":
+        return _cmd_scan(args)
+    if args.cmd == "harden":
+        return _cmd_harden(args)
+    if args.cmd == "ledger":
+        return _cmd_ledger(args)
+    return 2
+
+
+def _with_target(target: str):
+    """Yield a local base path for a target, remote or local, with cleanup.
+
+    Returns (base_path, checkout_or_None); caller must close the checkout.
+    """
+    # A local path always wins over remote heuristics, so "skills/mytool" (which
+    # also looks like owner/repo shorthand) scans the local dir when it exists.
+    p = Path(target)
+    if p.exists():
+        return p, None
+    if remote.is_remote(target):
+        checkout = remote.RemoteCheckout(target)
+        return checkout.__enter__(), checkout
+    _die(f"no such path (and not a recognized remote): {target}")
+
+
+def _cmd_scan(args) -> int:
+    base, checkout = _with_target(args.target)
+    manifests = []
+    worst_fail = False
+    try:
+        skill_dirs = discover_skills(base)
+        multi = len(skill_dirs) > 1
+        for i, d in enumerate(skill_dirs):
+            rep, skill = _scan_one(d, args)
+            # rug-pull drift is read-only; always surface it.
+            prior = ledger_mod.drift(skill)
+            if prior:
+                print(f"! DRIFT: {skill.source} changed since last scan "
+                      f"({prior.get('ts', '?')}, was {prior.get('verdict', '?')})",
+                      file=sys.stderr)
+            if args.json:
+                print(report.to_json(rep))
+            else:
+                if i:
+                    print()
+                print(report.to_text(rep))
+            if args.record:
+                ledger_mod.record(rep, skill)
+            if args.report:
+                manifests.append(report.to_manifest(rep, skill, __version__))
+            worst_fail = worst_fail or _fails(rep, args.fail_on)
+        if multi and not args.json:
+            print(f"\nscanned {len(skill_dirs)} skills; "
+                  f"{'FAIL' if worst_fail else 'pass'} at --fail-on {args.fail_on}")
+        if args.report:
+            Path(args.report).write_text(
+                json.dumps({"schema": "bastionskill.report/1", "scans": manifests},
+                           indent=2, ensure_ascii=False),
+                encoding="utf-8")
+            print(f"wrote report -> {args.report}", file=sys.stderr)
+    finally:
+        if checkout:
+            checkout.__exit__(None, None, None)
+    return 1 if worst_fail else 0
+
+
+def _cmd_harden(args) -> int:
+    base, checkout = _with_target(args.target)
+    try:
+        d = discover_skills(base)[0]
+        skill = load_skill(d, name=args.name)
+        yaml = harden.to_policy_yaml(scan(skill))
+    finally:
+        if checkout:
+            checkout.__exit__(None, None, None)
+    if args.out:
+        Path(args.out).write_text(yaml, encoding="utf-8")
+        print(f"wrote policy -> {args.out}")
+    else:
+        sys.stdout.write(yaml)
+    return 0
+
+
+def _cmd_ledger(args) -> int:
+    rows = ledger_mod.summary()
+    if args.json:
+        print(json.dumps(rows, indent=2, ensure_ascii=False))
+        return 0
+    if not rows:
+        print("ledger empty — scan with --record to populate it.")
+        return 0
+    print(f"{'last scan':<26} {'verdict':<7} {'risk':<8} source")
+    print("-" * 70)
+    for e in rows:
+        print(f"{e.get('ts', '?'):<26} {e.get('verdict', '?'):<7} "
+              f"{e.get('risk', '?'):<8} {e.get('source', '?')}")
+    return 0
+
+
+def _die(msg: str) -> None:
+    print(f"bastionskill: {msg}", file=sys.stderr)
+    raise SystemExit(2)
+
+
+if __name__ == "__main__":
+    raise SystemExit(main())

bastionskill-0.1.0/bastionskill/harden.py

@@ -0,0 +1,41 @@
+"""Bridge to agentbastion / bastiongate: turn a skill scan into a policy.
+
+Closes the trilogy loop the same way the sibling tools' `harden` do. A scan of a
+skill produces a per-skill verdict (allow/deny) plus the capabilities that tripped
+the deny, ready to drop into the firewall's skill policy.
+"""
+
+from __future__ import annotations
+
+from .models import ScanReport
+
+_BLOCK = {"critical", "high"}
+
+
+def to_policy_yaml(report: ScanReport) -> str:
+    tripped = [f for f in report.findings if f.severity in _BLOCK]
+    verdict = "deny" if tripped else "allow"
+    reasons = sorted({f.check for f in tripped})
+    caps = sorted({f.capability for f in tripped if f.capability})
+
+    lines = [
+        "# agentbastion / bastiongate skill policy generated by bastionskill",
+        f"# skill: {report.skill}  risk={report.risk}",
+        "default: allow",
+        "skills:",
+        f"  {_q(report.skill)}:",
+        f"    verdict: {verdict}",
+    ]
+    if reasons:
+        lines.append("    reasons:")
+        lines += [f"      - {r}" for r in reasons]
+    if caps:
+        lines.append("    block_capabilities:")
+        lines += [f"      - {c}" for c in caps]
+    return "\n".join(lines) + "\n"
+
+
+def _q(name: str) -> str:
+    if name and all(c.isalnum() or c in "_-." for c in name):
+        return name
+    return '"' + name.replace("\\", "\\\\").replace('"', '\\"') + '"'