crabukit 0.1.0__tar.gz

crabukit-0.1.0/.github/workflows/ci.yml

@@ -0,0 +1,92 @@
+name: CI
+
+on:
+  push:
+    branches: [main, develop]
+  pull_request:
+    branches: [main]
+
+jobs:
+  test:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest]
+        python-version: ['3.9', '3.10', '3.11', '3.12', '3.13']
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python ${{ matrix.python-version }}
+        uses: actions/setup-python@v5
+        with:
+          python-version: ${{ matrix.python-version }}
+
+      - name: Install dependencies
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e ".[dev]"
+
+      - name: Lint with ruff
+        run: ruff check .
+
+      - name: Format check with black
+        run: black --check .
+
+      - name: Test with pytest
+        run: pytest --cov=crabukit --cov-report=xml
+
+      - name: Upload coverage
+        uses: codecov/codecov-action@v3
+        with:
+          file: ./coverage.xml
+          fail_ci_if_error: false
+
+  integration-test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install crabukit
+        run: |
+          pip install -e .
+
+      - name: Test CLI
+        run: |
+          crabukit --version
+          crabukit list-rules
+
+      - name: Scan test fixtures
+        run: |
+          crabukit scan tests/fixtures/malicious-skill/ --fail-on=low || true
+
+  build:
+    runs-on: ubuntu-latest
+    needs: [test]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install build dependencies
+        run: pip install build twine
+
+      - name: Build package
+        run: python -m build
+
+      - name: Check package
+        run: twine check dist/*
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/

crabukit-0.1.0/.github/workflows/release.yml

@@ -0,0 +1,35 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - 'v*'
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.11'
+
+      - name: Install dependencies
+        run: pip install build twine
+
+      - name: Build package
+        run: python -m build
+
+      - name: Publish to PyPI
+        env:
+          TWINE_USERNAME: __token__
+          TWINE_PASSWORD: ${{ secrets.PYPI_API_TOKEN }}
+        run: twine upload dist/*
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v1
+        with:
+          generate_release_notes: true
+          files: dist/*

crabukit-0.1.0/.gitignore

@@ -0,0 +1,150 @@
+# Byte-compiled / optimized / DLL files
+__pycache__/
+*.py[cod]
+*$py.class
+
+# C extensions
+*.so
+
+# Distribution / packaging
+.Python
+build/
+develop-eggs/
+dist/
+downloads/
+eggs/
+.eggs/
+lib/
+lib64/
+parts/
+sdist/
+var/
+wheels/
+share/python-wheels/
+*.egg-info/
+.installed.cfg
+*.egg
+MANIFEST
+
+# PyInstaller
+*.manifest
+*.spec
+
+# Installer logs
+pip-log.txt
+pip-delete-this-directory.txt
+
+# Unit test / coverage reports
+htmlcov/
+.tox/
+.nox/
+.coverage
+.coverage.*
+.cache
+nosetests.xml
+coverage.xml
+*.cover
+*.py,cover
+.hypothesis/
+.pytest_cache/
+cover/
+
+# Translations
+*.mo
+*.pot
+
+# Django stuff:
+*.log
+local_settings.py
+db.sqlite3
+db.sqlite3-journal
+
+# Flask stuff:
+instance/
+.webassets-cache
+
+# Scrapy stuff:
+.scrapy
+
+# Sphinx documentation
+docs/_build/
+
+# PyBuilder
+.pybuilder/
+target/
+
+# Jupyter Notebook
+.ipynb_checkpoints
+
+# IPython
+profile_default/
+ipython_config.py
+
+# pyenv
+.python-version
+
+# pipenv
+Pipfile.lock
+
+# poetry
+poetry.lock
+
+# pdm
+.pdm.toml
+
+# PEP 582
+__pypackages__/
+
+# Celery stuff
+celerybeat-schedule
+celerybeat.pid
+
+# SageMath parsed files
+*.sage.py
+
+# Environments
+.env
+.venv
+env/
+venv/
+ENV/
+env.bak/
+venv.bak/
+
+# Spyder project settings
+.spyderproject
+.spyproject
+
+# Rope project settings
+.ropeproject
+
+# mkdocs documentation
+/site
+
+# mypy
+.mypy_cache/
+.dmypy.json
+dmypy.json
+
+# Pyre type checker
+.pyre/
+
+# pytype static type analyzer
+.pytype/
+
+# Cython debug symbols
+cython_debug/
+
+# PyCharm
+.idea/
+
+# VS Code
+.vscode/
+
+# macOS
+.DS_Store
+
+# Crabukit specific
+crabukit.egg-info/
+*.skill
+.scan-results/

crabukit-0.1.0/CHANGELOG.md

@@ -0,0 +1,30 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.2.0] - 2026-02-20
+
+### Added
+- Initial release of Crabukit - comprehensive OpenClaw skill security scanner
+- **Prompt Injection Detection**: Direct, indirect, encoded, and typoglycemia attacks
+- **Code Vulnerability Detection**: eval(), exec(), shell injection, path traversal
+- **Secret Detection**: AWS keys, GitHub tokens, OpenAI keys, JWTs, private keys
+- **AI Malware Detection**: PROMPTFLUX/PROMPTSTEAL-style patterns
+- **Supply Chain Detection**: Typosquatting, homoglyphs, hidden files
+- **Tool Combination Analysis**: Detects dangerous tool pairings (Confused Deputy)
+- **Backdoor Detection**: Cron jobs, SSH keys, persistent execution
+- Rich CLI output with severity colors and recommendations
+- JSON output format for automation
+- CI/CD integration with exit codes
+- Comprehensive test suite with malicious skill fixtures
+
+### Security
+- Based on OWASP LLM Top 10
+- Incorporates Lakera AI Q4 2025 research
+- Implements Google Threat Intelligence malware patterns
+- Protects against WithSecure's ReAct Confused Deputy attacks
+
+[0.2.0]: https://github.com/troy/crabukit/releases/tag/v0.2.0

crabukit-0.1.0/CONTRIBUTING.md

@@ -0,0 +1,136 @@
+# Contributing to Crabukit
+
+Thank you for your interest in contributing to Crabukit! This document provides guidelines and instructions for contributing.
+
+## 🐛 Reporting Issues
+
+### Bug Reports
+
+Please include:
+- Crabukit version (`crabukit --version`)
+- Python version (`python --version`)
+- Operating system
+- Steps to reproduce
+- Expected vs actual behavior
+- Sample skill that triggers the issue (if applicable)
+
+### Security Vulnerabilities
+
+**Do not open public issues for security vulnerabilities.**
+
+Instead, email security@crabukit.dev with:
+- Description of the vulnerability
+- Steps to reproduce
+- Potential impact
+- Suggested fix (if any)
+
+## 💡 Feature Requests
+
+We welcome feature requests! Please open an issue with:
+- Clear description of the feature
+- Use case / why it's needed
+- Proposed implementation (if you have ideas)
+
+## 🔧 Development Setup
+
+```bash
+# Clone the repo
+git clone https://github.com/troy/crabukit.git
+cd crabukit
+
+# Create virtual environment
+python -m venv .venv
+source .venv/bin/activate  # On Windows: .venv\Scripts\activate
+
+# Install in development mode
+pip install -e ".[dev]"
+
+# Run tests
+pytest
+
+# Run linting
+ruff check .
+black --check .
+```
+
+## 📝 Code Style
+
+- **Formatter**: [Black](https://github.com/psf/black) (line length 100)
+- **Linter**: [Ruff](https://github.com/astral-sh/ruff)
+- **Type hints**: Required for new code
+- **Docstrings**: Google style
+
+## 🧪 Testing
+
+```bash
+# Run all tests
+pytest
+
+# Run with coverage
+pytest --cov=crabukit --cov-report=html
+
+# Run specific test file
+pytest tests/test_python_analyzer.py
+```
+
+## 🏗️ Adding New Detection Rules
+
+To add a new security check:
+
+1. **Add the pattern** to `crabukit/rules/patterns.py`:
+```python
+"my_new_pattern": {
+    "pattern": r"regex_here",
+    "severity": Severity.HIGH,
+    "title": "Descriptive title",
+    "description": "What this detects and why it's dangerous",
+    "remediation": "How to fix it",
+    "cwe": "CWE-XXX",  # Optional
+}
+```
+
+2. **Implement the check** in the appropriate analyzer
+3. **Add a test case** in `tests/fixtures/`
+4. **Update documentation** in `docs/rules.md`
+
+## 📋 Pull Request Process
+
+1. Fork the repository
+2. Create a feature branch (`git checkout -b feature/amazing-feature`)
+3. Make your changes
+4. Run tests and linting
+5. Commit with clear messages
+6. Push to your fork
+7. Open a Pull Request
+
+### PR Checklist
+
+- [ ] Tests pass
+- [ ] Code follows style guidelines
+- [ ] New rules have test cases
+- [ ] Documentation updated
+- [ ] CHANGELOG.md updated
+
+## 🎯 Priority Areas
+
+We especially welcome contributions in:
+
+- **New detection rules** for emerging AI threats
+- **Performance improvements** for large skills
+- **Better false positive reduction**
+- **Additional output formats** (SARIF, JUnit XML)
+- **Documentation improvements**
+- **CI/CD integrations**
+
+## 💬 Community
+
+- GitHub Discussions: [github.com/troy/crabukit/discussions](https://github.com/troy/crabukit/discussions)
+- Issues: [github.com/troy/crabukit/issues](https://github.com/troy/crabukit/issues)
+
+## 📜 Code of Conduct
+
+Be respectful, constructive, and inclusive. We're all here to make AI safer.
+
+---
+
+Thank you for contributing to safer AI! 🦀🔒

crabukit-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Troy (Moltatron)
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.