boost-skill-cli 1.0.119__tar.gz → 1.0.121__tar.gz

{boost_skill_cli-1.0.119 → boost_skill_cli-1.0.121}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.119
+Version: 1.0.121
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.119 → boost_skill_cli-1.0.121}/boost_cli/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '1.0.119'
-__version_tuple__ = version_tuple = (1, 0, 119)
+__version__ = version = '1.0.121'
+__version_tuple__ = version_tuple = (1, 0, 121)
 
 __commit_id__ = commit_id = None

{boost_skill_cli-1.0.119 → boost_skill_cli-1.0.121}/boost_cli/commands/pkg.py

@@ -16,8 +16,8 @@ from typing import Dict, List, Optional
 
 from .. import cliparse
 from ..core import (agents, catalog, gitutil, injectscan, journal, lockfile,
-                    paths, registry, staleness, store, typosquat, updatediff,
-                    util)
+                    paths, registry, secretscan, staleness, store, typosquat,
+                    updatediff, util)
 from ..core import output as out
 from ..errors import BoostError
 
@@ -83,6 +83,23 @@ def _warn_injection(res: store.InstallResult) -> None:
         out.warn("  L%d [%s] %s" % (f.line, f.severity, f.description))
 
 
+def _warn_secrets(res: store.InstallResult) -> None:
+    """Flag embedded credentials / secrets in the skill just copied.
+
+    Scans the installed ``SKILL.md`` (core.secretscan) for known secret shapes
+    and surfaces any hits worst-first, with the secret value redacted. Advisory
+    only — it warns, it never blocks the install.
+    """
+    findings = secretscan.scan_file(res.dest / "SKILL.md")
+    if not findings:
+        return
+    out.warn("%s: %d possible secret%s in SKILL.md (%s) — do not commit"
+             % (res.name, len(findings), "" if len(findings) == 1 else "s",
+                secretscan.worst_severity(findings)))
+    for f in findings[:3]:
+        out.warn("  L%d [%s] %s" % (f.line, f.severity, f.description))
+
+
 def _report_result(res: store.InstallResult) -> None:
     """The canonical three-line install report."""
     out.ok("copied to %s" % _tilde(res.dest))
@@ -94,6 +111,7 @@ def _report_result(res: store.InstallResult) -> None:
         out.warn("not linked: %s exists and is not managed by boost" % _tilde(path))
     out.ok("lock updated (.skill-lock.json)")
     _warn_injection(res)
+    _warn_secrets(res)
 
 
 def _boostfile_text(skills: Dict[str, dict], via: str = "boost bundle dump") -> str:

{boost_skill_cli-1.0.119 → boost_skill_cli-1.0.121}/boost_cli/commands/quality.py

@@ -286,12 +286,19 @@ def cmd_doctor(argv):
     enabled = agents.enabled_agents()
     skill_issues = 0
     for name, entry in sorted(skills.items()):
-        if not store.skill_store_dir(name).is_dir():
+        sdir = store.skill_store_dir(name)
+        if not sdir.is_dir():
             bad("skill %s missing from store — run `boost heal`" % name)
             skill_issues += 1
             continue
         if entry.get("quarantined"):
             continue
+        # tamper detection: the lock file records a sha256 at install time, but
+        # only `boost verify` ever re-checked it — surface content drift here too.
+        locked = entry.get("sha256")
+        if locked and util.sha256_dir(sdir) != locked:
+            bad("skill %s modified since install — run `boost verify`" % name)
+            skill_issues += 1
         for agent in entry.get("agents", []):
             adir = enabled.get(agent)
             if adir is None:

boost_skill_cli-1.0.121/boost_cli/core/secretscan.py

@@ -0,0 +1,128 @@
+"""Scan installed skill content for embedded secrets & credentials (stdlib).
+
+A third-party skill can ship a hard-coded credential — an AWS key, a GitHub
+token, a private-key block — that then lands in the user's tree, or leak one the
+agent was handed. This module carries a small, high-precision set of secret
+*shape* patterns (known token prefixes and key blocks, not entropy guessing) so
+boost can flag them at install time without any external scanner.
+
+Findings never echo the raw secret: the matched value is redacted to a short
+prefix so a warning can point at the offending line without re-leaking it.
+"""
+from __future__ import annotations
+
+import re
+from pathlib import Path
+from typing import List, NamedTuple
+
+_SEVERITY_RANK = {"high": 3, "medium": 2, "low": 1}
+
+
+class Rule(NamedTuple):
+    id: str
+    severity: str
+    pattern: "re.Pattern[str]"
+    group: int          # capture group holding the secret value to redact
+    description: str
+
+
+class Finding(NamedTuple):
+    rule_id: str
+    severity: str
+    line: int           # 1-based line number
+    snippet: str        # offending line, secret redacted, trimmed
+    description: str
+
+
+def _rx(pattern: str, flags: int = 0) -> "re.Pattern[str]":
+    return re.compile(pattern, flags)
+
+
+# High-precision rules keyed on well-known token shapes — chosen so a benign
+# skill almost never trips them. ``group`` marks the span to redact (0 = whole
+# match).
+RULES: tuple = (
+    Rule("private-key-block", "high",
+         _rx(r"-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY-----"),
+         0, "embedded private key block"),
+    Rule("aws-access-key-id", "high",
+         _rx(r"\b(AKIA[0-9A-Z]{16})\b"), 1, "AWS access key id"),
+    Rule("github-token", "high",
+         _rx(r"\b((?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}"
+             r"|github_pat_[A-Za-z0-9_]{22,})\b"), 1, "GitHub token"),
+    Rule("slack-token", "high",
+         _rx(r"\b(xox[baprs]-[A-Za-z0-9-]{10,})\b"), 1, "Slack token"),
+    Rule("google-api-key", "high",
+         _rx(r"\b(AIza[0-9A-Za-z_\-]{35})\b"), 1, "Google API key"),
+    Rule("stripe-secret-key", "high",
+         _rx(r"\b((?:r|s)k_live_[A-Za-z0-9]{16,})\b"), 1, "Stripe live key"),
+    Rule("openai-key", "high",
+         _rx(r"\b(sk-(?:proj-)?[A-Za-z0-9]{20,})\b"), 1, "OpenAI-style key"),
+    Rule("jwt", "medium",
+         _rx(r"\b(eyJ[A-Za-z0-9_\-]{8,}\.[A-Za-z0-9_\-]{8,}"
+             r"\.[A-Za-z0-9_\-]{8,})\b"), 1, "JSON Web Token"),
+    Rule("generic-secret-assignment", "medium",
+         _rx(r"(?i)\b(?:api[_\-]?key|secret|token|passwd|password|"
+             r"access[_\-]?key)\b\s*[=:]\s*[\"']([^\"'\n]{8,})[\"']"),
+         1, "hard-coded secret assignment"),
+    Rule("us-ssn", "medium",
+         _rx(r"\b([0-9]{3}-[0-9]{2}-[0-9]{4})\b"), 1, "US Social Security number"),
+)
+
+
+def redact(value: str) -> str:
+    """Mask a secret to a short, non-recoverable hint (keeps ≤4 leading chars)."""
+    if len(value) <= 4:
+        return "****"
+    return value[:4] + "****"
+
+
+def _redacted_line(line: str, rule: Rule, match) -> str:
+    """The offending line with this match's secret span replaced by a hint."""
+    start, end = match.span(rule.group)
+    if start < 0:                       # optional group didn't participate
+        return line.strip()[:200]
+    masked = line[:start] + redact(match.group(rule.group)) + line[end:]
+    return masked.strip()[:200]
+
+
+def scan_text(text: str) -> List[Finding]:
+    """Findings for every secret-shape rule that matches a line of ``text``.
+
+    One finding per (rule, line), using that line's first match. The raw secret
+    is never included — the snippet carries a redacted line. Ordered worst-first
+    (severity desc, then line, then rule id).
+    """
+    findings: List[Finding] = []
+    for lineno, raw in enumerate(text.splitlines(), start=1):
+        for rule in RULES:
+            m = rule.pattern.search(raw)
+            if m:
+                findings.append(Finding(rule.id, rule.severity, lineno,
+                                        _redacted_line(raw, rule, m),
+                                        rule.description))
+    findings.sort(key=lambda f: (-_SEVERITY_RANK[f.severity], f.line,
+                                 f.rule_id))
+    return findings
+
+
+def scan_file(path) -> List[Finding]:
+    """Scan the file at ``path``; a missing/unreadable file yields ``[]``."""
+    p = Path(path)
+    try:
+        text = p.read_text(encoding="utf-8", errors="replace")
+    except (OSError, ValueError):
+        return []
+    return scan_text(text)
+
+
+def worst_severity(findings) -> str:
+    """Highest severity among ``findings`` ("high" > "medium" > "low"), or ""."""
+    best = ""
+    best_rank = 0
+    for f in findings:
+        rank = _SEVERITY_RANK.get(f.severity, 0)
+        if rank > best_rank:
+            best_rank = rank
+            best = f.severity
+    return best

{boost_skill_cli-1.0.119 → boost_skill_cli-1.0.121}/boost_skill_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: boost-skill-cli
-Version: 1.0.119
+Version: 1.0.121
 Summary: boost — Homebrew for AI coding skills
 Author: Jonathan Reyes
 License: GNU GENERAL PUBLIC LICENSE

{boost_skill_cli-1.0.119 → boost_skill_cli-1.0.121}/boost_skill_cli.egg-info/SOURCES.txt

@@ -50,6 +50,7 @@ boost_cli/core/paths.py
 boost_cli/core/policy.py
 boost_cli/core/rag.py
 boost_cli/core/registry.py
+boost_cli/core/secretscan.py
 boost_cli/core/serve.py
 boost_cli/core/staleness.py
 boost_cli/core/store.py
@@ -241,11 +242,13 @@ tests/unit/test_output.py
 tests/unit/test_paths.py
 tests/unit/test_pkg_confusions.py
 tests/unit/test_pkg_injection.py
+tests/unit/test_pkg_secrets.py
 tests/unit/test_policy.py
 tests/unit/test_rag.py
 tests/unit/test_registries_fresh.py
 tests/unit/test_registry.py
 tests/unit/test_roadmap_fresh.py
+tests/unit/test_secretscan.py
 tests/unit/test_serve.py
 tests/unit/test_spin.py
 tests/unit/test_staleness.py

{boost_skill_cli-1.0.119 → boost_skill_cli-1.0.121}/docs/roadmap/items/integrity-verification-boost-verify.md

@@ -2,15 +2,15 @@
 id: integrity-verification-boost-verify
 board: code
 section: trust
-status: planned
+status: shipped
 category: Security · Integrity
 complexity: S
 impact: High
 wow: 4
 note: reuses sha256_dir
 order: 2
-owner:
-pr:
+owner: loop/doctor-integrity
+pr: 139
 title: Integrity verification — <code>boost verify</code>
 ---
 The lockfile already records a <code>sha256</code> per install via

{boost_skill_cli-1.0.119 → boost_skill_cli-1.0.121}/docs/roadmap/items/secret-and-pii-scanning-of-installed-skills.md

@@ -2,15 +2,15 @@
 id: secret-and-pii-scanning-of-installed-skills
 board: code
 section: trust
-status: planned
+status: shipped
 category: Security · Secrets
 complexity: S
 impact: Med
 wow: 3
 note: installed content
 order: 6
-owner:
-pr:
+owner: loop/secret-scan
+pr: 138
 title: Secret & PII scanning of installed skills
 ---
 Point the round-2 secret scanners (<code>gitleaks</code>/<code>trufflehog</code>)

{boost_skill_cli-1.0.119 → boost_skill_cli-1.0.121}/docs/roadmap.html

@@ -1663,7 +1663,7 @@ and the work stays visible.</p>
       </article>
 
       <article class="cap rcard">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Security · Integrity</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Security · Integrity</span></div>
         <h3>Integrity verification — <code>boost verify</code></h3>
         <p>The lockfile already records a <code>sha256</code> per install via
            <code>util.sha256_dir</code>, but nothing ever re-checks it. A
@@ -1734,7 +1734,7 @@ paths.</p>
       </article>
 
       <article class="cap rcard">
-        <div class="head"><span class="pill planned">Planned</span><span class="cat">Security · Secrets</span></div>
+        <div class="head"><span class="pill shipped">Shipped</span><span class="cat">Security · Secrets</span></div>
         <h3>Secret &amp; PII scanning of installed skills</h3>
         <p>Point the round-2 secret scanners (<code>gitleaks</code>/<code>trufflehog</code>)
            at <em>third-party</em> skill content, not just boost's own repo — catching

{boost_skill_cli-1.0.119 → boost_skill_cli-1.0.121}/tests/functional/test_cli_quality.py

@@ -82,6 +82,14 @@ class TestDoctor:
         assert "no taps configured — add one with `boost tap owner/repo`" in r.out
         assert "0 skills installed · 0 taps synced · 0 broken links" in r.out
 
+    def test_tampered_content_rc1(self, boost, installed):
+        # doctor must re-hash installed skills, not just check they exist:
+        # editing SKILL.md content after install is drift from the lock digest.
+        _tamper("brainstorming")
+        r = boost("doctor", expect=1)
+        assert "skill brainstorming modified since install — run `boost verify`" in r.out
+        assert "need attention" in r.out
+
 
 # ── lint ─────────────────────────────────────────────────────────────────
 

boost_skill_cli-1.0.121/tests/unit/test_pkg_secrets.py

@@ -0,0 +1,54 @@
+"""Unit tests: pkg._warn_secrets — the install-time secret-scan wiring."""
+from __future__ import annotations
+
+from boost_cli.commands import pkg
+from boost_cli.core import output as out
+from boost_cli.core.store import InstallResult
+
+
+def _capture(monkeypatch):
+    warnings = []
+    monkeypatch.setattr(out, "warn", lambda m: warnings.append(m))
+    return warnings
+
+
+def _result(tmp_path, body):
+    dest = tmp_path / "leaky-skill"
+    dest.mkdir()
+    (dest / "SKILL.md").write_text(body, encoding="utf-8")
+    return InstallResult(name="leaky-skill", dest=dest)
+
+
+def test_warns_on_embedded_secret(monkeypatch, tmp_path):
+    warnings = _capture(monkeypatch)
+    pkg._warn_secrets(_result(tmp_path, "aws = AKIAIOSFODNN7EXAMPLE"))
+    assert any("possible secret" in w for w in warnings)
+    assert any("high" in w for w in warnings)
+
+
+def test_never_prints_raw_secret(monkeypatch, tmp_path):
+    leaked = "AKIAIOSFODNN7EXAMPLE"
+    warnings = _capture(monkeypatch)
+    pkg._warn_secrets(_result(tmp_path, "aws = " + leaked))
+    assert all(leaked not in w for w in warnings)
+
+
+def test_quiet_on_clean_skill(monkeypatch, tmp_path):
+    warnings = _capture(monkeypatch)
+    pkg._warn_secrets(_result(tmp_path, "# Clean\nRuns pytest.\n"))
+    assert warnings == []
+
+
+def test_missing_skill_md_quiet(monkeypatch, tmp_path):
+    dest = tmp_path / "no-md"
+    dest.mkdir()
+    warnings = _capture(monkeypatch)
+    pkg._warn_secrets(InstallResult(name="no-md", dest=dest))
+    assert warnings == []
+
+
+def test_singular_wording(monkeypatch, tmp_path):
+    warnings = _capture(monkeypatch)
+    pkg._warn_secrets(_result(tmp_path, "aws = AKIAIOSFODNN7EXAMPLE"))
+    summary = next(w for w in warnings if "possible secret" in w)
+    assert "1 possible secret in" in summary

boost_skill_cli-1.0.121/tests/unit/test_secretscan.py

@@ -0,0 +1,154 @@
+"""Unit tests: boost_cli/core/secretscan.py — embedded-secret detection."""
+from __future__ import annotations
+
+from boost_cli.core import secretscan
+
+
+def _ids(findings):
+    return [f.rule_id for f in findings]
+
+
+class TestRuleMatches:
+    def test_private_key_block(self):
+        got = secretscan.scan_text("-----BEGIN RSA PRIVATE KEY-----")
+        assert _ids(got) == ["private-key-block"]
+        assert got[0].severity == "high"
+
+    def test_openssh_private_key_block(self):
+        assert _ids(secretscan.scan_text(
+            "-----BEGIN OPENSSH PRIVATE KEY-----")) == ["private-key-block"]
+
+    def test_aws_access_key_id(self):
+        got = secretscan.scan_text("key = AKIAIOSFODNN7EXAMPLE")
+        assert "aws-access-key-id" in _ids(got)
+
+    def test_github_token(self):
+        tok = "ghp_" + "a" * 36
+        assert "github-token" in _ids(secretscan.scan_text("token: " + tok))
+
+    def test_github_fine_grained_pat(self):
+        tok = "github_pat_" + "A" * 30
+        assert "github-token" in _ids(secretscan.scan_text(tok))
+
+    def test_slack_token(self):
+        assert "slack-token" in _ids(
+            secretscan.scan_text("xoxb-123456789012-abcdefghijkl"))
+
+    def test_google_api_key(self):
+        key = "AIza" + "b" * 35
+        assert "google-api-key" in _ids(secretscan.scan_text(key))
+
+    def test_stripe_live_key(self):
+        assert "stripe-secret-key" in _ids(
+            secretscan.scan_text("sk_live_" + "c" * 20))
+
+    def test_openai_key(self):
+        assert "openai-key" in _ids(secretscan.scan_text("sk-" + "d" * 32))
+
+    def test_jwt(self):
+        jwt = "eyJhbGciOiJIUzI1.eyJzdWIiOiIxMjM0NTY.SflKxwRJSMeKKF2QT4"
+        assert "jwt" in _ids(secretscan.scan_text(jwt))
+
+    def test_generic_assignment(self):
+        got = secretscan.scan_text('api_key = "s3cr3t-value-here"')
+        assert "generic-secret-assignment" in _ids(got)
+        assert got[0].severity == "medium"
+
+    def test_us_ssn(self):
+        assert "us-ssn" in _ids(secretscan.scan_text("SSN: 123-45-6789"))
+
+
+class TestNonMatches:
+    def test_benign_prose_clean(self):
+        text = ("# A skill\n\nRuns `pytest` and reports coverage. See the "
+                "README for setup.\n")
+        assert secretscan.scan_text(text) == []
+
+    def test_short_akia_lookalike_not_matched(self):
+        # too short to be a real AWS key id
+        assert secretscan.scan_text("AKIA123") == []
+
+    def test_unquoted_assignment_not_matched(self):
+        # rule requires a quoted literal to avoid matching prose
+        assert secretscan.scan_text("api_key = see the vault") == []
+
+    def test_empty_text(self):
+        assert secretscan.scan_text("") == []
+
+
+class TestRedaction:
+    def test_secret_value_never_appears_in_snippet(self):
+        leaked = "AKIAIOSFODNN7EXAMPLE"
+        got = secretscan.scan_text("aws = " + leaked)
+        assert leaked not in got[0].snippet
+
+    def test_snippet_keeps_short_prefix_hint(self):
+        got = secretscan.scan_text("aws = AKIAIOSFODNN7EXAMPLE")
+        assert "AKIA****" in got[0].snippet
+
+    def test_generic_assignment_value_redacted(self):
+        got = secretscan.scan_text('password = "hunter2-very-secret"')
+        assert "hunter2-very-secret" not in got[0].snippet
+        assert "hunt****" in got[0].snippet
+
+    def test_redact_masks_short_values(self):
+        assert secretscan.redact("abcd") == "****"
+
+    def test_redact_keeps_four_char_prefix(self):
+        assert secretscan.redact("abcdefghij") == "abcd****"
+
+    def test_private_key_block_group0_redacts_whole_match(self):
+        got = secretscan.scan_text("-----BEGIN PRIVATE KEY-----")
+        # group 0 = whole match; redaction keeps a 4-char prefix hint
+        assert got[0].snippet.startswith("----")
+        assert "PRIVATE KEY" not in got[0].snippet
+
+
+class TestScanMechanics:
+    def test_line_numbers_one_based(self):
+        text = "clean\nclean\nAKIAIOSFODNN7EXAMPLE"
+        got = secretscan.scan_text(text)
+        assert got[0].line == 3
+
+    def test_sorted_high_before_medium(self):
+        text = 'password = "abcdefgh"\n-----BEGIN PRIVATE KEY-----'
+        got = secretscan.scan_text(text)
+        assert [f.severity for f in got] == ["high", "medium"]
+        assert got[0].rule_id == "private-key-block"
+
+    def test_ties_broken_by_line(self):
+        tok = "ghp_" + "a" * 36
+        text = "AKIAIOSFODNN7EXAMPLE\n" + tok
+        got = secretscan.scan_text(text)
+        assert [f.line for f in got] == [1, 2]
+
+    def test_description_populated(self):
+        got = secretscan.scan_text("AKIAIOSFODNN7EXAMPLE")
+        assert got[0].description
+
+
+class TestScanFile:
+    def test_reads_existing_file(self, tmp_path):
+        p = tmp_path / "SKILL.md"
+        p.write_text("token: ghp_" + "a" * 36, encoding="utf-8")
+        assert "github-token" in _ids(secretscan.scan_file(p))
+
+    def test_missing_file_empty(self, tmp_path):
+        assert secretscan.scan_file(tmp_path / "nope.md") == []
+
+    def test_directory_path_empty(self, tmp_path):
+        assert secretscan.scan_file(tmp_path) == []
+
+
+class TestWorstSeverity:
+    def test_high_wins(self):
+        findings = secretscan.scan_text(
+            'password = "abcdefgh"\nAKIAIOSFODNN7EXAMPLE')
+        assert secretscan.worst_severity(findings) == "high"
+
+    def test_empty_blank(self):
+        assert secretscan.worst_severity([]) == ""
+
+    def test_only_medium(self):
+        findings = secretscan.scan_text('token = "abcdefgh12"')
+        assert secretscan.worst_severity(findings) == "medium"