lite-kits 0.1.1__py3-none-any.whl → 0.3.2__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- lite_kits/__init__.py +56 -4
- lite_kits/cli.py +782 -189
- lite_kits/core/__init__.py +6 -0
- lite_kits/core/banner.py +1 -1
- lite_kits/core/conflict_checker.py +115 -0
- lite_kits/core/detector.py +177 -0
- lite_kits/core/installer.py +242 -351
- lite_kits/core/manifest.py +146 -146
- lite_kits/core/validator.py +183 -0
- lite_kits/kits/README.md +6 -6
- lite_kits/kits/dev/README.md +241 -241
- lite_kits/kits/dev/{claude/commands → commands/.claude}/audit.md +143 -143
- lite_kits/kits/dev/{claude/commands → commands/.claude}/cleanup.md +2 -2
- lite_kits/kits/{git/claude/commands → dev/commands/.claude}/commit.md +2 -2
- lite_kits/kits/{project/claude/commands → dev/commands/.claude}/orient.md +3 -4
- lite_kits/kits/{git/claude/commands → dev/commands/.claude}/pr.md +1 -1
- lite_kits/kits/{git/claude/commands → dev/commands/.claude}/review.md +202 -202
- lite_kits/kits/{project/claude/commands → dev/commands/.claude}/stats.md +162 -162
- lite_kits/kits/{project/github/prompts → dev/commands/.github}/audit.prompt.md +143 -143
- lite_kits/kits/{git/github/prompts → dev/commands/.github}/cleanup.prompt.md +2 -2
- lite_kits/kits/{git/github/prompts → dev/commands/.github}/commit.prompt.md +2 -2
- lite_kits/kits/dev/{github/prompts → commands/.github}/orient.prompt.md +3 -4
- lite_kits/kits/{git/github/prompts → dev/commands/.github}/pr.prompt.md +1 -1
- lite_kits/kits/{git/github/prompts → dev/commands/.github}/review.prompt.md +202 -202
- lite_kits/kits/dev/{github/prompts → commands/.github}/stats.prompt.md +163 -163
- lite_kits/kits/kits.yaml +497 -180
- lite_kits/kits/multiagent/README.md +6 -6
- lite_kits/kits/multiagent/{claude/commands → commands/.claude}/sync.md +331 -331
- lite_kits/kits/multiagent/{github/prompts → commands/.github}/sync.prompt.md +73 -69
- lite_kits/kits/multiagent/memory/git-worktrees-protocol.md +370 -370
- lite_kits/kits/multiagent/memory/parallel-work-protocol.md +536 -536
- lite_kits/kits/multiagent/memory/pr-workflow-guide.md +275 -275
- lite_kits/kits/multiagent/templates/collaboration-structure/README.md +166 -166
- lite_kits/kits/multiagent/templates/decision.md +79 -79
- lite_kits/kits/multiagent/templates/handoff.md +95 -95
- lite_kits/kits/multiagent/templates/session-log.md +68 -68
- lite_kits-0.3.2.dist-info/METADATA +259 -0
- lite_kits-0.3.2.dist-info/RECORD +41 -0
- {lite_kits-0.1.1.dist-info → lite_kits-0.3.2.dist-info}/licenses/LICENSE +21 -21
- lite_kits/kits/dev/claude/commands/commit.md +0 -612
- lite_kits/kits/dev/claude/commands/orient.md +0 -146
- lite_kits/kits/dev/claude/commands/pr.md +0 -593
- lite_kits/kits/dev/claude/commands/review.md +0 -202
- lite_kits/kits/dev/claude/commands/stats.md +0 -162
- lite_kits/kits/dev/github/prompts/audit.prompt.md +0 -143
- lite_kits/kits/dev/github/prompts/cleanup.prompt.md +0 -382
- lite_kits/kits/dev/github/prompts/commit.prompt.md +0 -591
- lite_kits/kits/dev/github/prompts/pr.prompt.md +0 -603
- lite_kits/kits/dev/github/prompts/review.prompt.md +0 -202
- lite_kits/kits/git/README.md +0 -365
- lite_kits/kits/git/claude/commands/cleanup.md +0 -361
- lite_kits/kits/git/scripts/bash/get-git-context.sh +0 -208
- lite_kits/kits/git/scripts/powershell/Get-GitContext.ps1 +0 -242
- lite_kits/kits/project/README.md +0 -228
- lite_kits/kits/project/claude/commands/audit.md +0 -143
- lite_kits/kits/project/claude/commands/review.md +0 -112
- lite_kits/kits/project/github/prompts/orient.prompt.md +0 -150
- lite_kits/kits/project/github/prompts/review.prompt.md +0 -112
- lite_kits/kits/project/github/prompts/stats.prompt.md +0 -163
- lite_kits-0.1.1.dist-info/METADATA +0 -447
- lite_kits-0.1.1.dist-info/RECORD +0 -58
- {lite_kits-0.1.1.dist-info → lite_kits-0.3.2.dist-info}/WHEEL +0 -0
- {lite_kits-0.1.1.dist-info → lite_kits-0.3.2.dist-info}/entry_points.txt +0 -0
@@ -1,162 +1,162 @@
|
|
1
|
-
---
|
2
|
-
description: Generate concise project metrics for AI agent orientation
|
3
|
-
---
|
4
|
-
|
5
|
-
# Project Statistics
|
6
|
-
|
7
|
-
**Purpose**: Provide quick project overview metrics for AI agents joining a project or assessing scope.
|
8
|
-
|
9
|
-
## Execution Steps
|
10
|
-
|
11
|
-
Execute the following steps to gather project statistics:
|
12
|
-
|
13
|
-
### 1. Count Lines of Code
|
14
|
-
|
15
|
-
**Preferred method** (if tokei installed):
|
16
|
-
```bash
|
17
|
-
# Check if tokei is available
|
18
|
-
command -v tokei >/dev/null 2>&1
|
19
|
-
|
20
|
-
# If available, use tokei for fast, accurate counts
|
21
|
-
tokei --output json
|
22
|
-
```
|
23
|
-
|
24
|
-
**Fallback method** (if tokei not available):
|
25
|
-
```bash
|
26
|
-
# Python
|
27
|
-
find . -name "*.py" -type f | xargs wc -l 2>/dev/null | tail -1
|
28
|
-
|
29
|
-
# JavaScript/TypeScript
|
30
|
-
find . -name "*.js" -o -name "*.ts" | xargs wc -l 2>/dev/null | tail -1
|
31
|
-
|
32
|
-
# Markdown
|
33
|
-
find . -name "*.md" -type f | xargs wc -l 2>/dev/null | tail -1
|
34
|
-
|
35
|
-
# All files combined
|
36
|
-
find . -type f -not -path "*/\.*" | xargs wc -l 2>/dev/null | tail -1
|
37
|
-
```
|
38
|
-
|
39
|
-
### 2. Count Files and Directories
|
40
|
-
|
41
|
-
```bash
|
42
|
-
# Count files (excluding hidden)
|
43
|
-
find . -type f -not -path "*/\.*" | wc -l
|
44
|
-
|
45
|
-
# Count directories (excluding hidden)
|
46
|
-
find . -type d -not -path "*/\.*" | wc -l
|
47
|
-
```
|
48
|
-
|
49
|
-
### 3. Get Git History Summary
|
50
|
-
|
51
|
-
```bash
|
52
|
-
# Total commits
|
53
|
-
git log --oneline | wc -l
|
54
|
-
|
55
|
-
# Contributor count
|
56
|
-
git log --format='%aN' | sort -u | wc -l
|
57
|
-
|
58
|
-
# Recent activity
|
59
|
-
git log --oneline -5
|
60
|
-
```
|
61
|
-
|
62
|
-
If not a git repository, skip this section.
|
63
|
-
|
64
|
-
### 4. Check for Test Coverage
|
65
|
-
|
66
|
-
Look for common coverage report files:
|
67
|
-
```bash
|
68
|
-
# Python coverage files
|
69
|
-
ls .coverage coverage.xml htmlcov/ 2>/dev/null
|
70
|
-
|
71
|
-
# JavaScript coverage
|
72
|
-
ls coverage/ .nyc_output/ 2>/dev/null
|
73
|
-
|
74
|
-
# If coverage files exist, try to extract percentage
|
75
|
-
# Python: coverage report | grep TOTAL
|
76
|
-
# JavaScript: cat coverage/coverage-summary.json
|
77
|
-
```
|
78
|
-
|
79
|
-
### 5. Generate Concise Table Output
|
80
|
-
|
81
|
-
Provide stats in this format (~20 lines max):
|
82
|
-
|
83
|
-
```markdown
|
84
|
-
## Project Statistics
|
85
|
-
|
86
|
-
**Code**:
|
87
|
-
- Language1: X,XXX LOC (NN%)
|
88
|
-
- Language2: XXX LOC (NN%)
|
89
|
-
- Language3: XX LOC (NN%)
|
90
|
-
|
91
|
-
**Structure**:
|
92
|
-
- NN files, NN directories
|
93
|
-
- NNN commits, N contributors
|
94
|
-
|
95
|
-
**Testing**:
|
96
|
-
- Coverage: NN% (or N/A)
|
97
|
-
- Tests: NN files (or N/A)
|
98
|
-
|
99
|
-
**Next Action**: [Explore src/ / Review tests / Check docs]
|
100
|
-
```
|
101
|
-
|
102
|
-
## Important Notes
|
103
|
-
|
104
|
-
- **Be concise**: Keep output under 20 lines
|
105
|
-
- **Use tables**: Well-formatted markdown tables or lists
|
106
|
-
- **Handle missing tools**:
|
107
|
-
- No tokei → Use find/wc fallback, note "Basic LOC count"
|
108
|
-
- Not a git repo → Skip git section, note "No git history"
|
109
|
-
- No coverage → Show "N/A" gracefully
|
110
|
-
|
111
|
-
- **Percentages**: Calculate language percentages from total LOC
|
112
|
-
- **Large repos**: If >100k LOC, note "Large project" and consider sampling
|
113
|
-
- **Speed**: Target <5 second execution time
|
114
|
-
|
115
|
-
## Edge Cases
|
116
|
-
|
117
|
-
- **No git repository**: Skip git section, show file/LOC stats only
|
118
|
-
- **No test coverage reports**: Show "Coverage: N/A"
|
119
|
-
- **Tokei not installed**: Use find/wc fallback, note in output
|
120
|
-
- **Very large repo (1M+ LOC)**: Sample or provide high-level summary only
|
121
|
-
- **No code files**: "Appears to be a documentation-only or data project"
|
122
|
-
|
123
|
-
## Example Output
|
124
|
-
|
125
|
-
```markdown
|
126
|
-
## Project Statistics
|
127
|
-
|
128
|
-
**Code**:
|
129
|
-
- Python: 2,453 LOC (87%)
|
130
|
-
- Markdown: 342 LOC (12%)
|
131
|
-
- YAML: 28 LOC (1%)
|
132
|
-
- Total: 2,823 LOC
|
133
|
-
|
134
|
-
**Structure**:
|
135
|
-
- 45 files, 12 directories
|
136
|
-
- 127 commits, 3 contributors
|
137
|
-
|
138
|
-
**Testing**:
|
139
|
-
- Coverage: 78% (via pytest-cov)
|
140
|
-
- Tests: 23 test files
|
141
|
-
|
142
|
-
**Next Action**: Explore src/ directory to understand core modules
|
143
|
-
```
|
144
|
-
|
145
|
-
```markdown
|
146
|
-
## Project Statistics
|
147
|
-
|
148
|
-
**Code** (tokei not available, using basic count):
|
149
|
-
- Python: ~1,200 lines
|
150
|
-
- Markdown: ~400 lines
|
151
|
-
- Total: ~1,600 lines (approximate)
|
152
|
-
|
153
|
-
**Structure**:
|
154
|
-
- 32 files, 8 directories
|
155
|
-
- Not a git repository
|
156
|
-
|
157
|
-
**Testing**:
|
158
|
-
- Coverage: N/A
|
159
|
-
- Tests: N/A
|
160
|
-
|
161
|
-
**Next Action**: Check if this is a standalone library or tool
|
162
|
-
```
|
1
|
+
---
|
2
|
+
description: Generate concise project metrics for AI agent orientation
|
3
|
+
---
|
4
|
+
|
5
|
+
# Project Statistics
|
6
|
+
|
7
|
+
**Purpose**: Provide quick project overview metrics for AI agents joining a project or assessing scope.
|
8
|
+
|
9
|
+
## Execution Steps
|
10
|
+
|
11
|
+
Execute the following steps to gather project statistics:
|
12
|
+
|
13
|
+
### 1. Count Lines of Code
|
14
|
+
|
15
|
+
**Preferred method** (if tokei installed):
|
16
|
+
```bash
|
17
|
+
# Check if tokei is available
|
18
|
+
command -v tokei >/dev/null 2>&1
|
19
|
+
|
20
|
+
# If available, use tokei for fast, accurate counts
|
21
|
+
tokei --output json
|
22
|
+
```
|
23
|
+
|
24
|
+
**Fallback method** (if tokei not available):
|
25
|
+
```bash
|
26
|
+
# Python
|
27
|
+
find . -name "*.py" -type f | xargs wc -l 2>/dev/null | tail -1
|
28
|
+
|
29
|
+
# JavaScript/TypeScript
|
30
|
+
find . -name "*.js" -o -name "*.ts" | xargs wc -l 2>/dev/null | tail -1
|
31
|
+
|
32
|
+
# Markdown
|
33
|
+
find . -name "*.md" -type f | xargs wc -l 2>/dev/null | tail -1
|
34
|
+
|
35
|
+
# All files combined
|
36
|
+
find . -type f -not -path "*/\.*" | xargs wc -l 2>/dev/null | tail -1
|
37
|
+
```
|
38
|
+
|
39
|
+
### 2. Count Files and Directories
|
40
|
+
|
41
|
+
```bash
|
42
|
+
# Count files (excluding hidden)
|
43
|
+
find . -type f -not -path "*/\.*" | wc -l
|
44
|
+
|
45
|
+
# Count directories (excluding hidden)
|
46
|
+
find . -type d -not -path "*/\.*" | wc -l
|
47
|
+
```
|
48
|
+
|
49
|
+
### 3. Get Git History Summary
|
50
|
+
|
51
|
+
```bash
|
52
|
+
# Total commits
|
53
|
+
git log --oneline | wc -l
|
54
|
+
|
55
|
+
# Contributor count
|
56
|
+
git log --format='%aN' | sort -u | wc -l
|
57
|
+
|
58
|
+
# Recent activity
|
59
|
+
git log --oneline -5
|
60
|
+
```
|
61
|
+
|
62
|
+
If not a git repository, skip this section.
|
63
|
+
|
64
|
+
### 4. Check for Test Coverage
|
65
|
+
|
66
|
+
Look for common coverage report files:
|
67
|
+
```bash
|
68
|
+
# Python coverage files
|
69
|
+
ls .coverage coverage.xml htmlcov/ 2>/dev/null
|
70
|
+
|
71
|
+
# JavaScript coverage
|
72
|
+
ls coverage/ .nyc_output/ 2>/dev/null
|
73
|
+
|
74
|
+
# If coverage files exist, try to extract percentage
|
75
|
+
# Python: coverage report | grep TOTAL
|
76
|
+
# JavaScript: cat coverage/coverage-summary.json
|
77
|
+
```
|
78
|
+
|
79
|
+
### 5. Generate Concise Table Output
|
80
|
+
|
81
|
+
Provide stats in this format (~20 lines max):
|
82
|
+
|
83
|
+
```markdown
|
84
|
+
## Project Statistics
|
85
|
+
|
86
|
+
**Code**:
|
87
|
+
- Language1: X,XXX LOC (NN%)
|
88
|
+
- Language2: XXX LOC (NN%)
|
89
|
+
- Language3: XX LOC (NN%)
|
90
|
+
|
91
|
+
**Structure**:
|
92
|
+
- NN files, NN directories
|
93
|
+
- NNN commits, N contributors
|
94
|
+
|
95
|
+
**Testing**:
|
96
|
+
- Coverage: NN% (or N/A)
|
97
|
+
- Tests: NN files (or N/A)
|
98
|
+
|
99
|
+
**Next Action**: [Explore src/ / Review tests / Check docs]
|
100
|
+
```
|
101
|
+
|
102
|
+
## Important Notes
|
103
|
+
|
104
|
+
- **Be concise**: Keep output under 20 lines
|
105
|
+
- **Use tables**: Well-formatted markdown tables or lists
|
106
|
+
- **Handle missing tools**:
|
107
|
+
- No tokei → Use find/wc fallback, note "Basic LOC count"
|
108
|
+
- Not a git repo → Skip git section, note "No git history"
|
109
|
+
- No coverage → Show "N/A" gracefully
|
110
|
+
|
111
|
+
- **Percentages**: Calculate language percentages from total LOC
|
112
|
+
- **Large repos**: If >100k LOC, note "Large project" and consider sampling
|
113
|
+
- **Speed**: Target <5 second execution time
|
114
|
+
|
115
|
+
## Edge Cases
|
116
|
+
|
117
|
+
- **No git repository**: Skip git section, show file/LOC stats only
|
118
|
+
- **No test coverage reports**: Show "Coverage: N/A"
|
119
|
+
- **Tokei not installed**: Use find/wc fallback, note in output
|
120
|
+
- **Very large repo (1M+ LOC)**: Sample or provide high-level summary only
|
121
|
+
- **No code files**: "Appears to be a documentation-only or data project"
|
122
|
+
|
123
|
+
## Example Output
|
124
|
+
|
125
|
+
```markdown
|
126
|
+
## Project Statistics
|
127
|
+
|
128
|
+
**Code**:
|
129
|
+
- Python: 2,453 LOC (87%)
|
130
|
+
- Markdown: 342 LOC (12%)
|
131
|
+
- YAML: 28 LOC (1%)
|
132
|
+
- Total: 2,823 LOC
|
133
|
+
|
134
|
+
**Structure**:
|
135
|
+
- 45 files, 12 directories
|
136
|
+
- 127 commits, 3 contributors
|
137
|
+
|
138
|
+
**Testing**:
|
139
|
+
- Coverage: 78% (via pytest-cov)
|
140
|
+
- Tests: 23 test files
|
141
|
+
|
142
|
+
**Next Action**: Explore src/ directory to understand core modules
|
143
|
+
```
|
144
|
+
|
145
|
+
```markdown
|
146
|
+
## Project Statistics
|
147
|
+
|
148
|
+
**Code** (tokei not available, using basic count):
|
149
|
+
- Python: ~1,200 lines
|
150
|
+
- Markdown: ~400 lines
|
151
|
+
- Total: ~1,600 lines (approximate)
|
152
|
+
|
153
|
+
**Structure**:
|
154
|
+
- 32 files, 8 directories
|
155
|
+
- Not a git repository
|
156
|
+
|
157
|
+
**Testing**:
|
158
|
+
- Coverage: N/A
|
159
|
+
- Tests: N/A
|
160
|
+
|
161
|
+
**Next Action**: Check if this is a standalone library or tool
|
162
|
+
```
|
@@ -1,143 +1,143 @@
|
|
1
|
-
---
|
2
|
-
description: Perform security analysis on dependencies and code patterns
|
3
|
-
---
|
4
|
-
|
5
|
-
# Security Audit Helper
|
6
|
-
|
7
|
-
**Purpose**: Quick security analysis for AI agents working on features involving authentication, data handling, or external dependencies.
|
8
|
-
|
9
|
-
## Execution Steps
|
10
|
-
|
11
|
-
Execute the following steps to perform a security audit:
|
12
|
-
|
13
|
-
### 1. Detect Project Type and Dependencies
|
14
|
-
|
15
|
-
```powershell
|
16
|
-
# Check for Python dependencies
|
17
|
-
Get-ChildItem -Path . -Include requirements.txt,pyproject.toml,setup.py -Recurse -ErrorAction SilentlyContinue
|
18
|
-
|
19
|
-
# Check for Node.js dependencies
|
20
|
-
Get-ChildItem -Path . -Include package.json,package-lock.json -Recurse -ErrorAction SilentlyContinue
|
21
|
-
|
22
|
-
# Check for Rust dependencies
|
23
|
-
Get-ChildItem -Path . -Include Cargo.toml,Cargo.lock -Recurse -ErrorAction SilentlyContinue
|
24
|
-
|
25
|
-
# Check for Go dependencies
|
26
|
-
Get-ChildItem -Path . -Include go.mod,go.sum -Recurse -ErrorAction SilentlyContinue
|
27
|
-
```
|
28
|
-
|
29
|
-
### 2. Run Dependency Vulnerability Scan
|
30
|
-
|
31
|
-
**Python projects**:
|
32
|
-
```powershell
|
33
|
-
# Check if pip-audit is available
|
34
|
-
Get-Command pip-audit -ErrorAction SilentlyContinue
|
35
|
-
|
36
|
-
# If available, run scan
|
37
|
-
pip-audit
|
38
|
-
|
39
|
-
# If not available, suggest installation
|
40
|
-
Write-Host "Install pip-audit: pip install pip-audit"
|
41
|
-
```
|
42
|
-
|
43
|
-
**Node.js projects**:
|
44
|
-
```powershell
|
45
|
-
# npm audit is built-in
|
46
|
-
npm audit
|
47
|
-
|
48
|
-
# Or use yarn
|
49
|
-
yarn audit
|
50
|
-
```
|
51
|
-
|
52
|
-
**Other languages**: Suggest appropriate tools (cargo audit, go list, etc.)
|
53
|
-
|
54
|
-
### 3. Scan for Common Security Anti-Patterns
|
55
|
-
|
56
|
-
Check source code for security issues:
|
57
|
-
|
58
|
-
```powershell
|
59
|
-
# Look for potential hardcoded secrets
|
60
|
-
Select-String -Path src\* -Pattern "API_KEY\s*=\s*['""]" -Recurse | Select-Object -First 5
|
61
|
-
Select-String -Path src\* -Pattern "PASSWORD\s*=\s*['""]" -Recurse | Select-Object -First 5
|
62
|
-
Select-String -Path src\* -Pattern "SECRET\s*=\s*['""]" -Recurse | Select-Object -First 5
|
63
|
-
|
64
|
-
# Look for weak crypto patterns (Python)
|
65
|
-
Select-String -Path src\* -Pattern "md5|sha1" -Recurse | Select-Object -First 5
|
66
|
-
|
67
|
-
# Look for SQL injection risks
|
68
|
-
Select-String -Path src\* -Pattern "execute.*%|execute.*\+" -Recurse | Select-Object -First 5
|
69
|
-
```
|
70
|
-
|
71
|
-
**Common patterns to flag**:
|
72
|
-
- Hardcoded API keys, passwords, tokens
|
73
|
-
- Weak cryptographic algorithms (MD5, SHA1)
|
74
|
-
- SQL string concatenation
|
75
|
-
- Eval/exec with user input
|
76
|
-
- Insecure file permissions
|
77
|
-
|
78
|
-
### 4. Generate Concise Report
|
79
|
-
|
80
|
-
Provide analysis in this format (~150 words max):
|
81
|
-
|
82
|
-
```markdown
|
83
|
-
## Security Audit
|
84
|
-
|
85
|
-
**Dependencies**: N scanned, M vulnerabilities found
|
86
|
-
|
87
|
-
**Vulnerabilities** (if any):
|
88
|
-
- package-name==version: [SEVERITY] - Brief description
|
89
|
-
- Link to advisory for details
|
90
|
-
|
91
|
-
**Code Patterns** (if any):
|
92
|
-
- file.py:line: [PATTERN] - Recommendation
|
93
|
-
|
94
|
-
**Next Action**: [Fix CVE-XXXX / Update package / Review auth code]
|
95
|
-
```
|
96
|
-
|
97
|
-
## Important Notes
|
98
|
-
|
99
|
-
- **Graceful fallbacks**: If audit tools not installed, do basic pattern checks only
|
100
|
-
- **Be concise**: Target <150 words total output
|
101
|
-
- **Prioritize**: Show highest severity issues first
|
102
|
-
- **Avoid false positives**: Note that manual review may be needed
|
103
|
-
- **No dependencies**: Report "No dependencies to audit" gracefully
|
104
|
-
- **Cross-platform**: Use commands available on Windows, macOS, Linux
|
105
|
-
|
106
|
-
## Edge Cases
|
107
|
-
|
108
|
-
- **No dependency files**: "No dependencies found. This appears to be a dependency-free project."
|
109
|
-
- **Tool not installed**: Provide installation command, run basic grep checks
|
110
|
-
- **No vulnerabilities**: "✅ No known vulnerabilities found! Consider reviewing auth/data handling patterns."
|
111
|
-
- **Too many issues**: Sample top 5, note total count
|
112
|
-
|
113
|
-
## Example Output
|
114
|
-
|
115
|
-
```markdown
|
116
|
-
## Security Audit
|
117
|
-
|
118
|
-
**Dependencies**: 12 scanned, 2 vulnerabilities found
|
119
|
-
|
120
|
-
**Vulnerabilities**:
|
121
|
-
- requests==2.25.0: MEDIUM - CVE-2023-32681 (Proxy-Auth header leak)
|
122
|
-
Update to: requests>=2.31.0
|
123
|
-
|
124
|
-
**Code Patterns**:
|
125
|
-
- src/auth.py:42: Hardcoded API key detected
|
126
|
-
- src/db.py:103: SQL string concatenation (injection risk)
|
127
|
-
|
128
|
-
**Next Action**: Update requests package, move API key to environment variables, use parameterized queries
|
129
|
-
```
|
130
|
-
|
131
|
-
```markdown
|
132
|
-
## Security Audit
|
133
|
-
|
134
|
-
**Dependencies**: pip-audit not installed
|
135
|
-
|
136
|
-
**Tool Not Available**:
|
137
|
-
Install pip-audit for vulnerability scanning:
|
138
|
-
`pip install pip-audit`
|
139
|
-
|
140
|
-
**Code Patterns**: Basic grep checks performed, no obvious issues found
|
141
|
-
|
142
|
-
**Next Action**: Install pip-audit and re-run for comprehensive dependency scan
|
143
|
-
```
|
1
|
+
---
|
2
|
+
description: Perform security analysis on dependencies and code patterns
|
3
|
+
---
|
4
|
+
|
5
|
+
# Security Audit Helper
|
6
|
+
|
7
|
+
**Purpose**: Quick security analysis for AI agents working on features involving authentication, data handling, or external dependencies.
|
8
|
+
|
9
|
+
## Execution Steps
|
10
|
+
|
11
|
+
Execute the following steps to perform a security audit:
|
12
|
+
|
13
|
+
### 1. Detect Project Type and Dependencies
|
14
|
+
|
15
|
+
```powershell
|
16
|
+
# Check for Python dependencies
|
17
|
+
Get-ChildItem -Path . -Include requirements.txt,pyproject.toml,setup.py -Recurse -ErrorAction SilentlyContinue
|
18
|
+
|
19
|
+
# Check for Node.js dependencies
|
20
|
+
Get-ChildItem -Path . -Include package.json,package-lock.json -Recurse -ErrorAction SilentlyContinue
|
21
|
+
|
22
|
+
# Check for Rust dependencies
|
23
|
+
Get-ChildItem -Path . -Include Cargo.toml,Cargo.lock -Recurse -ErrorAction SilentlyContinue
|
24
|
+
|
25
|
+
# Check for Go dependencies
|
26
|
+
Get-ChildItem -Path . -Include go.mod,go.sum -Recurse -ErrorAction SilentlyContinue
|
27
|
+
```
|
28
|
+
|
29
|
+
### 2. Run Dependency Vulnerability Scan
|
30
|
+
|
31
|
+
**Python projects**:
|
32
|
+
```powershell
|
33
|
+
# Check if pip-audit is available
|
34
|
+
Get-Command pip-audit -ErrorAction SilentlyContinue
|
35
|
+
|
36
|
+
# If available, run scan
|
37
|
+
pip-audit
|
38
|
+
|
39
|
+
# If not available, suggest installation
|
40
|
+
Write-Host "Install pip-audit: pip install pip-audit"
|
41
|
+
```
|
42
|
+
|
43
|
+
**Node.js projects**:
|
44
|
+
```powershell
|
45
|
+
# npm audit is built-in
|
46
|
+
npm audit
|
47
|
+
|
48
|
+
# Or use yarn
|
49
|
+
yarn audit
|
50
|
+
```
|
51
|
+
|
52
|
+
**Other languages**: Suggest appropriate tools (cargo audit, go list, etc.)
|
53
|
+
|
54
|
+
### 3. Scan for Common Security Anti-Patterns
|
55
|
+
|
56
|
+
Check source code for security issues:
|
57
|
+
|
58
|
+
```powershell
|
59
|
+
# Look for potential hardcoded secrets
|
60
|
+
Select-String -Path src\* -Pattern "API_KEY\s*=\s*['""]" -Recurse | Select-Object -First 5
|
61
|
+
Select-String -Path src\* -Pattern "PASSWORD\s*=\s*['""]" -Recurse | Select-Object -First 5
|
62
|
+
Select-String -Path src\* -Pattern "SECRET\s*=\s*['""]" -Recurse | Select-Object -First 5
|
63
|
+
|
64
|
+
# Look for weak crypto patterns (Python)
|
65
|
+
Select-String -Path src\* -Pattern "md5|sha1" -Recurse | Select-Object -First 5
|
66
|
+
|
67
|
+
# Look for SQL injection risks
|
68
|
+
Select-String -Path src\* -Pattern "execute.*%|execute.*\+" -Recurse | Select-Object -First 5
|
69
|
+
```
|
70
|
+
|
71
|
+
**Common patterns to flag**:
|
72
|
+
- Hardcoded API keys, passwords, tokens
|
73
|
+
- Weak cryptographic algorithms (MD5, SHA1)
|
74
|
+
- SQL string concatenation
|
75
|
+
- Eval/exec with user input
|
76
|
+
- Insecure file permissions
|
77
|
+
|
78
|
+
### 4. Generate Concise Report
|
79
|
+
|
80
|
+
Provide analysis in this format (~150 words max):
|
81
|
+
|
82
|
+
```markdown
|
83
|
+
## Security Audit
|
84
|
+
|
85
|
+
**Dependencies**: N scanned, M vulnerabilities found
|
86
|
+
|
87
|
+
**Vulnerabilities** (if any):
|
88
|
+
- package-name==version: [SEVERITY] - Brief description
|
89
|
+
- Link to advisory for details
|
90
|
+
|
91
|
+
**Code Patterns** (if any):
|
92
|
+
- file.py:line: [PATTERN] - Recommendation
|
93
|
+
|
94
|
+
**Next Action**: [Fix CVE-XXXX / Update package / Review auth code]
|
95
|
+
```
|
96
|
+
|
97
|
+
## Important Notes
|
98
|
+
|
99
|
+
- **Graceful fallbacks**: If audit tools not installed, do basic pattern checks only
|
100
|
+
- **Be concise**: Target <150 words total output
|
101
|
+
- **Prioritize**: Show highest severity issues first
|
102
|
+
- **Avoid false positives**: Note that manual review may be needed
|
103
|
+
- **No dependencies**: Report "No dependencies to audit" gracefully
|
104
|
+
- **Cross-platform**: Use commands available on Windows, macOS, Linux
|
105
|
+
|
106
|
+
## Edge Cases
|
107
|
+
|
108
|
+
- **No dependency files**: "No dependencies found. This appears to be a dependency-free project."
|
109
|
+
- **Tool not installed**: Provide installation command, run basic grep checks
|
110
|
+
- **No vulnerabilities**: "✅ No known vulnerabilities found! Consider reviewing auth/data handling patterns."
|
111
|
+
- **Too many issues**: Sample top 5, note total count
|
112
|
+
|
113
|
+
## Example Output
|
114
|
+
|
115
|
+
```markdown
|
116
|
+
## Security Audit
|
117
|
+
|
118
|
+
**Dependencies**: 12 scanned, 2 vulnerabilities found
|
119
|
+
|
120
|
+
**Vulnerabilities**:
|
121
|
+
- requests==2.25.0: MEDIUM - CVE-2023-32681 (Proxy-Auth header leak)
|
122
|
+
Update to: requests>=2.31.0
|
123
|
+
|
124
|
+
**Code Patterns**:
|
125
|
+
- src/auth.py:42: Hardcoded API key detected
|
126
|
+
- src/db.py:103: SQL string concatenation (injection risk)
|
127
|
+
|
128
|
+
**Next Action**: Update requests package, move API key to environment variables, use parameterized queries
|
129
|
+
```
|
130
|
+
|
131
|
+
```markdown
|
132
|
+
## Security Audit
|
133
|
+
|
134
|
+
**Dependencies**: pip-audit not installed
|
135
|
+
|
136
|
+
**Tool Not Available**:
|
137
|
+
Install pip-audit for vulnerability scanning:
|
138
|
+
`pip install pip-audit`
|
139
|
+
|
140
|
+
**Code Patterns**: Basic grep checks performed, no obvious issues found
|
141
|
+
|
142
|
+
**Next Action**: Install pip-audit and re-run for comprehensive dependency scan
|
143
|
+
```
|
@@ -318,13 +318,13 @@ dev/004-cleanup-command
|
|
318
318
|
> git branch --merged develop
|
319
319
|
dev/001-starter-kits
|
320
320
|
dev/002-installer-polish
|
321
|
-
dev/003-
|
321
|
+
dev/003-dev-kit-enhancements
|
322
322
|
|
323
323
|
# Agent presents options
|
324
324
|
Merged branches available for cleanup:
|
325
325
|
1. dev/001-starter-kits (2 days ago)
|
326
326
|
2. dev/002-installer-polish (1 day ago)
|
327
|
-
3. dev/003-
|
327
|
+
3. dev/003-dev-kit-enhancements (2 hours ago)
|
328
328
|
|
329
329
|
Delete which branches? (y/n/e): e
|
330
330
|
|
@@ -240,7 +240,7 @@ Message:
|
|
240
240
|
9. ?? docs/new-guide.md
|
241
241
|
|
242
242
|
Message:
|
243
|
-
docs(004): update documentation for
|
243
|
+
docs(004): update documentation for dev-kit
|
244
244
|
|
245
245
|
Added git workflow documentation and updated README
|
246
246
|
with new command examples.
|
@@ -254,7 +254,7 @@ Message:
|
|
254
254
|
Message:
|
255
255
|
chore(004): update implementation status tracking
|
256
256
|
|
257
|
-
Marked
|
257
|
+
Marked dev-kit as complete in status docs.
|
258
258
|
|
259
259
|
---
|
260
260
|
|
@@ -17,8 +17,7 @@ Check for kit marker files to determine what's installed:
|
|
17
17
|
```powershell
|
18
18
|
# Check all kits in one efficient operation
|
19
19
|
$KITS_INSTALLED = @()
|
20
|
-
if (Test-Path .github/prompts/orient.prompt.md) { $KITS_INSTALLED += "
|
21
|
-
if (Test-Path .github/prompts/commit.prompt.md) { $KITS_INSTALLED += "git" }
|
20
|
+
if (Test-Path .github/prompts/orient.prompt.md) { $KITS_INSTALLED += "dev" }
|
22
21
|
if (Test-Path .specify/memory/pr-workflow-guide.md) { $KITS_INSTALLED += "multiagent" }
|
23
22
|
$KITS_LIST = if ($KITS_INSTALLED.Count -gt 0) { $KITS_INSTALLED -join ", " } else { "vanilla only" }
|
24
23
|
```
|
@@ -120,7 +119,7 @@ Based on the state you discovered, suggest the next logical action:
|
|
120
119
|
- **Plan exists, no tasks** → "Run `/tasks` to break down into tasks"
|
121
120
|
- **Tasks exist** → "Run `/implement` to start coding"
|
122
121
|
- **Handoff detected** (multiagent) → "Review handoff in `specs/[feature]/collaboration/active/decisions/`"
|
123
|
-
- **Uncommitted changes** → "Review changes and consider running `/commit`" (if
|
122
|
+
- **Uncommitted changes** → "Review changes and consider running `/commit`" (if dev-kit installed)
|
124
123
|
|
125
124
|
## Important Notes
|
126
125
|
|
@@ -135,7 +134,7 @@ Based on the state you discovered, suggest the next logical action:
|
|
135
134
|
```
|
136
135
|
## Orientation Complete
|
137
136
|
|
138
|
-
**Installed Kits**:
|
137
|
+
**Installed Kits**: dev
|
139
138
|
|
140
139
|
**I am**: Grok Code Fast 1 @ GitHub Copilot (Specialist)
|
141
140
|
**Project**: Blog Platform API (TypeScript/Node.js)
|