moai-adk 0.34.0__py3-none-any.whl → 1.1.0__py3-none-any.whl

moai_adk/templates/.claude/skills/moai-tool-ast-grep/rules/quality/deprecated-apis.yml

@@ -0,0 +1,84 @@
+# Deprecated API Detection Rules
+
+id: deprecated-substr
+language: javascript
+severity: warning
+message: "substr() is deprecated. Use slice() or substring() instead."
+rule:
+  pattern: $STR.substr($$$ARGS)
+fix: $STR.slice($$$ARGS)
+
+---
+id: deprecated-escape
+language: javascript
+severity: warning
+message: "escape() is deprecated. Use encodeURIComponent() instead."
+rule:
+  pattern: escape($STR)
+fix: encodeURIComponent($STR)
+
+---
+id: deprecated-unescape
+language: javascript
+severity: warning
+message: "unescape() is deprecated. Use decodeURIComponent() instead."
+rule:
+  pattern: unescape($STR)
+fix: decodeURIComponent($STR)
+
+---
+id: deprecated-component-will-mount
+language: typescriptreact
+severity: error
+message: "componentWillMount is deprecated. Use componentDidMount or useEffect."
+rule:
+  pattern: componentWillMount() { $$$BODY }
+
+---
+id: deprecated-component-will-receive-props
+language: typescriptreact
+severity: error
+message: "componentWillReceiveProps is deprecated. Use getDerivedStateFromProps or useEffect."
+rule:
+  pattern: componentWillReceiveProps($PROPS) { $$$BODY }
+
+---
+id: deprecated-find-dom-node
+language: typescriptreact
+severity: warning
+message: "findDOMNode is deprecated. Use refs instead."
+rule:
+  pattern: ReactDOM.findDOMNode($COMPONENT)
+
+---
+id: deprecated-python-imp
+language: python
+severity: warning
+message: "imp module is deprecated. Use importlib instead."
+rule:
+  pattern: import imp
+
+---
+id: deprecated-python-optparse
+language: python
+severity: info
+message: "optparse is deprecated. Use argparse instead."
+rule:
+  pattern: import optparse
+
+---
+id: deprecated-python-thread
+language: python
+severity: warning
+message: "thread module is deprecated. Use threading instead."
+rule:
+  pattern: import thread
+
+---
+id: deprecated-python-cgi-escape
+language: python
+severity: warning
+message: "cgi.escape() is deprecated. Use html.escape() instead."
+rule:
+  pattern: cgi.escape($$$ARGS)
+fix: html.escape($$$ARGS)

moai_adk/templates/.claude/skills/moai-tool-ast-grep/rules/security/secrets-detection.yml

@@ -0,0 +1,89 @@
+# Secrets and Credentials Detection Rules
+
+id: hardcoded-password-python
+language: python
+severity: error
+message: "Hardcoded credential detected. Use environment variables."
+rule:
+  any:
+    - pattern: password = "$$$VALUE"
+    - pattern: PASSWORD = "$$$VALUE"
+    - pattern: passwd = "$$$VALUE"
+    - pattern: secret = "$$$VALUE"
+    - pattern: SECRET = "$$$VALUE"
+    - pattern: api_key = "$$$VALUE"
+    - pattern: API_KEY = "$$$VALUE"
+    - pattern: apikey = "$$$VALUE"
+
+---
+id: hardcoded-password-js
+language: javascript
+severity: error
+message: "Hardcoded credential detected. Use environment variables."
+rule:
+  any:
+    - pattern: "password: '$$$VALUE'"
+    - pattern: 'password: "$$$VALUE"'
+    - pattern: "apiKey: '$$$VALUE'"
+    - pattern: 'apiKey: "$$$VALUE"'
+    - pattern: "secret: '$$$VALUE'"
+    - pattern: 'secret: "$$$VALUE"'
+    - pattern: const password = "$$$VALUE"
+    - pattern: const apiKey = "$$$VALUE"
+
+---
+id: hardcoded-password-ts
+language: typescript
+severity: error
+message: "Hardcoded credential detected. Use environment variables."
+rule:
+  any:
+    - pattern: "password: '$$$VALUE'"
+    - pattern: 'password: "$$$VALUE"'
+    - pattern: "apiKey: '$$$VALUE'"
+    - pattern: 'apiKey: "$$$VALUE"'
+    - pattern: const password = "$$$VALUE"
+    - pattern: const apiKey = "$$$VALUE"
+
+---
+id: hardcoded-jwt-secret
+language: javascript
+severity: error
+message: "JWT secret should not be hardcoded"
+rule:
+  any:
+    - pattern: jwt.sign($PAYLOAD, "$SECRET")
+    - pattern: jwt.verify($TOKEN, "$SECRET")
+
+---
+id: hardcoded-jwt-secret-ts
+language: typescript
+severity: error
+message: "JWT secret should not be hardcoded"
+rule:
+  any:
+    - pattern: jwt.sign($PAYLOAD, "$SECRET")
+    - pattern: jwt.verify($TOKEN, "$SECRET")
+
+---
+id: aws-credentials-python
+language: python
+severity: error
+message: "AWS credentials should not be hardcoded"
+rule:
+  any:
+    - pattern: aws_access_key_id = "$$$VALUE"
+    - pattern: aws_secret_access_key = "$$$VALUE"
+    - pattern: AWS_ACCESS_KEY_ID = "$$$VALUE"
+    - pattern: AWS_SECRET_ACCESS_KEY = "$$$VALUE"
+
+---
+id: private-key-detection
+language: python
+severity: error
+message: "Private key should not be hardcoded in source code"
+rule:
+  any:
+    - pattern: private_key = "$$$VALUE"
+    - pattern: PRIVATE_KEY = "$$$VALUE"
+    - pattern: ssh_key = "$$$VALUE"

moai_adk/templates/.claude/skills/moai-tool-ast-grep/rules/security/sql-injection.yml

@@ -0,0 +1,45 @@
+# SQL Injection Detection Rules
+
+id: sql-injection-python-format
+language: python
+severity: error
+message: "Potential SQL injection: Use parameterized queries instead of string formatting"
+rule:
+  any:
+    - pattern: cursor.execute($QUERY % $ARGS)
+    - pattern: cursor.execute($QUERY.format($$$ARGS))
+    - pattern: cursor.execute(f"$$$SQL")
+    - pattern: execute($QUERY + $VAR)
+
+---
+id: sql-injection-python-fstring
+language: python
+severity: error
+message: "Potential SQL injection: f-strings in SQL queries are dangerous"
+rule:
+  pattern: |
+    cursor.execute(f"$$$SQL")
+
+---
+id: sql-injection-js-template
+language: javascript
+severity: error
+message: "Potential SQL injection: Use parameterized queries"
+rule:
+  any:
+    - pattern: $DB.query(`$$$SQL ${$VAR} $$$REST`)
+    - pattern: $DB.query($SQL + $VAR)
+    - pattern: $DB.raw($SQL + $VAR)
+    - pattern: knex.raw($SQL + $VAR)
+
+---
+id: sql-injection-ts-template
+language: typescript
+severity: error
+message: "Potential SQL injection: Use parameterized queries"
+rule:
+  any:
+    - pattern: $DB.query(`$$$SQL ${$VAR} $$$REST`)
+    - pattern: $DB.query($SQL + $VAR)
+    - pattern: prisma.$raw($SQL + $VAR)
+    - pattern: knex.raw($SQL + $VAR)

moai_adk/templates/.claude/skills/moai-tool-ast-grep/rules/security/xss-prevention.yml

@@ -0,0 +1,50 @@
+# XSS Prevention Rules
+
+id: xss-dangerouslySetInnerHTML
+language: typescriptreact
+severity: warning
+message: "XSS risk: Sanitize content before using dangerouslySetInnerHTML"
+rule:
+  pattern: dangerouslySetInnerHTML={{ __html: $CONTENT }}
+
+---
+id: xss-dangerouslySetInnerHTML-jsx
+language: javascript
+severity: warning
+message: "XSS risk: Sanitize content before using dangerouslySetInnerHTML"
+rule:
+  pattern: dangerouslySetInnerHTML={{ __html: $CONTENT }}
+
+---
+id: xss-innerHTML
+language: javascript
+severity: warning
+message: "Potential XSS: innerHTML assignment with user input"
+rule:
+  any:
+    - pattern: $EL.innerHTML = $CONTENT
+    - pattern: document.write($CONTENT)
+    - pattern: $EL.outerHTML = $CONTENT
+
+---
+id: xss-document-write
+language: javascript
+severity: error
+message: "document.write is a security risk and bad practice"
+rule:
+  pattern: document.write($CONTENT)
+
+---
+id: xss-eval-usage
+language: javascript
+severity: error
+message: "eval() is dangerous and can lead to code injection"
+rule:
+  any:
+    - pattern: eval($CODE)
+    - pattern: new Function($CODE)
+    - pattern: setTimeout($CODE, $DELAY)
+    - pattern: setInterval($CODE, $DELAY)
+  constraints:
+    CODE:
+      kind: string

moai_adk/templates/.claude/skills/moai-tool-ast-grep/rules/sgconfig.yml

@@ -0,0 +1,54 @@
+# AST-Grep Configuration for MoAI-ADK
+# https://ast-grep.github.io/reference/sgconfig.html
+
+ruleDirs:
+  - security
+  - quality
+  - languages
+
+testConfigs:
+  - ./**/__tests__/*.yml
+
+languageGlobs:
+  python:
+    - "**/*.py"
+    - "**/*.pyi"
+  javascript:
+    - "**/*.js"
+    - "**/*.jsx"
+    - "**/*.mjs"
+    - "**/*.cjs"
+  typescript:
+    - "**/*.ts"
+    - "**/*.tsx"
+    - "**/*.mts"
+    - "**/*.cts"
+  go:
+    - "**/*.go"
+  rust:
+    - "**/*.rs"
+  java:
+    - "**/*.java"
+  kotlin:
+    - "**/*.kt"
+    - "**/*.kts"
+  cpp:
+    - "**/*.c"
+    - "**/*.cpp"
+    - "**/*.cc"
+    - "**/*.h"
+    - "**/*.hpp"
+  ruby:
+    - "**/*.rb"
+  php:
+    - "**/*.php"
+
+# Custom rules utilities
+utils:
+  is-security-sensitive:
+    any:
+      - pattern: password
+      - pattern: secret
+      - pattern: api_key
+      - pattern: token
+      - pattern: credential