߲jj dZddlZddlZddlZddlZddlmZddlmZm Z m Z ddl m Z m Z ddl mZddlmZmZdZhd Zd d d d dZddddZe GddZe GddZdZdZdZdZdedefdZdedefdZdedefdZdZ d Z!d!Z"d"Z#d#Z$d$e$zd%zZ%d&e%zd'zZ&gd(d)d*d+d,d-d.d/d0d1d2d3d4d5e%zd6d7d8d9fd:e&zd;zdd7d8d?fd@dAdBdCdDdEdFdGdHdIdJdKdLdMdNdOdPdQdRdSdTdUdVdWdXdYdZd[d\d]d^d_d`dadbdcdddedfdgdhdidjdkdle#dmdnd7dodpfdqdrdsdtdudvdwdxdye#dzd{d7d|d}fd~dddddddddddddddddddddde#dd7ddfde#dd7ddfdddddddddddddeedd7ddfeedd7ddfeeddddfdeeddddfeedd7ddfdeeddddfeedd7ddfddddddddd‘dÑdđdődƑdǑdȑde e!de e"e!d˝ddd8dfdΑZ'e'Dcgc]%^}}ejP|ejRg|'c}}Z*e+hdϣZ,iddѓddѓddѓddѓddѓddѓddѓddѓddѓddѓddѓddݓddݓddddddZ-ejPdejRZ.ejPdejRZ/ejPdZ0de1de1fdZ2dededededededeeeffdZ3d\Z4Z5Z6hdZ7hdZ8hdZ9idddddddddddddddddddddd d d d d ddddddddZ:e;e:Z<ddhZ=dedefdZ>de1de;fdZ?dedefdZ@ejPdZAejPdZBdeedeefdZCd=d ed!edeefd"ZDd>d#ed$edefd%ZEd#edefd&ZFd#edefd'ZGd>ddd(d#ed$ed)ed*edzdeeeHff d+ZId?d,ed-eJdeeJeffd.ZKd,edefd/ZLd@d0edeefd1ZMd2ZNd0efd3ZOd4ZPd$edefd5ZQd6eedefd7ZRd8ed$ed9ed:ed6eedef d;ZSd#edefd<ZTycc}}w(AugSkills Guard — regex static scan of externally-sourced skills plus a trust-aware install policy. Trust: builtin (never scanned), trusted (openai/anthropics/... repos: caution allowed), community (any findings block unless --force). ``scan_skill`` -> ``should_allow_install`` -> ``format_scan_report``. Known gap: language write APIs (open(..., 'w'), Path.write_text, shutil.copy*, fs.writeFileSync) aimed at agent-config files surface only the low *_ref finding — static regexes cannot tie the call to a dynamic destination; future coverage belongs as a fourth "mechanical" tier next to agent_config_mod_shell.N)suppress)asdict dataclassfield)datetimetimezone)Path)ListTuplezskills-guard-v6> NVIDIA/skills openai/skillsanthropics/skillshuggingface/skills)allowrr)rrblock)rrr)rrask)builtintrusted community agent-created)safecaution dangerouscTeZdZUeed<eed<eed<eed<eed<eed<eed<y) Finding pattern_idseveritycategoryfilelinematch descriptionN)__name__ __module__ __qualname__str__annotations__int7/home/ubuntu/.hermes/hermes-agent/tools/skills_guard.pyrr&s&OMM I I Jr,rceZdZUeed<eed<eed<eed<eeZee ed<dZ eed<dZ eed <ee Z e ed <y ) ScanResult skill_namesource trust_levelverdict)default_factoryfindings scanned_atsummaryscan_provenanceN)r%r&r'r(r)rlistr5r rr7r8dictr9r+r,r-r/r/1sMO K L#D9Hd7m9JGS!$7OT7r,r/a0(?:\bwrit(?:e|es|ing)\b|\bwritten\b|\bedit(?:s|ed|ing)?\b|\bmodif(?:y|ies|ied|ying|ication)s?\b|\bupdat(?:e|es|ed|ing)\b|\bappend(?:s|ed|ing)?\b|\bprepend(?:s|ed|ing)?\b|\binject(?:s|ed|ing)?\b|\boverwrit(?:e|es|ing)\b|\boverwritten\b|\breplac(?:e|es|ed|ing)\b|\balter(?:s|ed|ing)?\b|\badd(?:s|ed|ing)\b)z4(?:AGENTS\.md|CLAUDE\.md|\.cursorrules|\.clinerules)z"\.hermes/(?:config\.yaml|SOUL\.md)z(\.(?:claude/settings|codex/config)[\w.]*file_altreturnc  d|d|d|d|d S)aMechanical shell write into *file_alt*: ``>``/``>>``, ``sed -i``, ``tee`` (target as immediate argument, so ``| tee output | AGENTS.md |`` cells miss), ``cp``/``mv`` with the file as destination (source arg required, so ``cp AGENTS.md backup/`` misses; ``AGENTS.md.bak`` is not the file). A single ``>`` needs a preceding word/quote/ paren char so blockquotes (``> text``) and arrows (``-> file``) miss.z"(?:>>|[\w"\'`)\]]\s*>)\s*[~\w./-]*zD(?!\.?\w)|\bsed\b[^\n]*\s(?:-[A-Za-z]*i[A-Za-z]*|--in-place)\b[^\n]*z((?!\.?\w)|\btee\s+(?:-a\s+)?[~\w./"\'-]*z3(?!\.?\w)|\b(?:cp|mv)\s+[^\s|;&]+\s+[^\n|;&]{0,40}?z (?!\.?\w)r+r<s r-_shell_write_rer@Ms9 .hZ8GGOjQ++3*588@z LMr,c 0dtd|dtd|d S)uTProse instructing modification of *file_alt*: an imperative-position verb (line start / bullet), or a mid-line verb with a directive marker ("you must", "please", "make sure to"). Descriptive prose ("skills that edit AGENTS.md") misses; the verb→file gap forbids commas so enumerations ("Write skills, AGENTS.md, CLAUDE.md") miss.z^\s*(?:[-*+]\s+|\d+[.)]\s+)?z [^\n,]{0,80}?zl\b|(?:\byou\s+(?:must|should|need\s+to)\s+|\bplease\s+|\bmake\s+sure\s+(?:to\s+|you\s+)|\bbe\s+sure\s+to\s+)z\b)MODIFY_VERB_REr?s r-_prose_modify_rerCYs3 ('7xjQB  ?8*B 89r,c |dS)u" should contain/include ..." prose. Authoring guides and attacks share this shape and are not separable statically, so the tier is scored high (caution → confirmation), never critical.zQ\b[^\n]{0,40}?\b(?:should|must|needs?\s+to)\s+(?:contain|say|include|have|list)\br+r?s r-_content_contract_rerEdsjk llr,zt(?!(?:\w+\s+){0,4}?(?:never|not|doesn\'?t|didn\'?t|won\'?t|isn\'?t|aren\'?t|can\'?t|cannot|mustn\'?t|shouldn\'?t)\b)z(?:\w+\s+){0,3}?z(?!(?:(?:the|your|each|every|all|to|a)\s+)?(?:sub-?agents?|sub-?tasks?)\b|(?:(?:the|your|each|every|all|to|a)\s+)(?:workers?|delegates?|children|child)\b)z(?:bash|sh|zsh|ksh|dash)zs(?:\.ssh[/\\]id_(?:rsa|ed25519|ecdsa|dsa)(?!\.pub)|\.env\b|credentials\b|\.netrc\b|\.pgpass\b|\.npmrc\b|\.pypirc\b)z["\'][^"\'\n]*z[^"\'\n]*["\']z!(?:os\.path\.expanduser\s*\(\s*)?z\s*\)?)zvcurl\s+(?![^\n]*https?://(?:localhost|127\.0\.0\.1|\[::1\]))[^\n]*\$\{?\w*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)S?\benv_exfil_curlcritical exfiltrationz6curl command interpolating secret environment variable)zvwget\s+(?![^\n]*https?://(?:localhost|127\.0\.0\.1|\[::1\]))[^\n]*\$\{?\w*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)S?\benv_exfil_wgetrGrHz6wget command interpolating secret environment variable)znfetch\s*\((?![^\n]*https?://(?:localhost|127\.0\.0\.1|\[::1\]))[^\n]*\$\{?\w*(?:KEY|TOKEN|SECRET|PASSWORD)S?\benv_exfil_fetchrGrHz6fetch() call interpolating secret environment variable)zwhttpx?\.(get|post|put|patch)\s*\((?![^\n]*https?://(?:localhost|127\.0\.0\.1|\[::1\]))[^\n]*(KEY|TOKEN|SECRET|PASSWORD)env_exfil_httpxrGrHz&HTTP library call with secret variable)zyrequests\.(get|post|put|patch)\s*\((?![^\n]*https?://(?:localhost|127\.0\.0\.1|\[::1\]))[^\n]*(KEY|TOKEN|SECRET|PASSWORD)env_exfil_requestsrGrHz*requests library call with secret variable)zbase64[^\n]*env encoded_exfilhighrHz0base64 encoding combined with environment access)z\$HOME/\.ssh|\~/\.sshssh_dir_accessrNrHzreferences user SSH directory)z\$HOME/\.aws|\~/\.awsaws_dir_accessrNrHz)references user AWS credentials directory)z\$HOME/\.gnupg|\~/\.gnupggpg_dir_accessrNrHzreferences user GPG keyring)z\$HOME/\.kube|\~/\.kubekube_dir_accessrNrHz&references Kubernetes config directory)z\$HOME/\.docker|\~/\.dockerdocker_dir_accessrNrHz5references Docker config (may contain registry creds))z'\$HOME/\.hermes/\.env|\~/\.hermes/\.envhermes_env_accessrGrHz'directly references Hermes secrets file)zFcat\s+(?!>)[^\n]*(\.env|credentials|\.netrc|\.pgpass|\.npmrc|\.pypirc)read_secrets_filerGrHzreads known secrets filez,\b(?:readFile(?:Sync)?|readTextFile)\s*\(\s*js_read_secrets_filerGrHz(JavaScript reads a known credential filez\bopen\s*\(\s*zV(?!\s*\)?\s*,\s*["\'][^"\']*[wax][^"\']*["\'])(?![^\n]*\bmode\s*=\s*["\'][^"\']*[wax])z|\bPath\s*\(\s*z7\s*\)\.(?:read_text|read_bytes|readlines|readline)\s*\(py_read_secrets_filez$Python reads a known credential file)zprintenv|env\s*\| dump_all_envrNrHzdumps all environment variables)z&^[^#\n]*os\.environ\b(?!\s*\.get\s*\()python_os_environrNrHzDaccesses os.environ outside comments/docstrings (potential env dump))zOos\.environ\s*\.get\s*\(\s*["\'][^"\']*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)python_environ_get_secretmediumrHzHreads secret via os.environ.get() (normal API-key access; informational))z@os\.getenv\s*\(\s*[^\)]*(?:KEY|TOKEN|SECRET|PASSWORD|CREDENTIAL)python_getenv_secretr[rHzCreads secret via os.getenv() (normal API-key access; informational))zprocess\.env\[node_process_envrNrHz*accesses process.env (Node.js environment))z*(?-i:ENV)\[.*(?:KEY|TOKEN|SECRET|PASSWORD)ruby_env_secretrGrHzreads secret via Ruby ENV[])z\(?\s*/tmp/[^\s]*\s*&&\s*(curl|wget|nc|python) tmp_stagingrGrHzwrites to /tmp then exfiltrates)z!\[.*\]\(https?://[^\)]*\$\{?md_image_exfilrNrHzBmarkdown image URL with variable interpolation (image-based exfil))z\[.*\]\(https?://[^\)]*\$\{? md_link_exfilrNrHz)markdown link with variable interpolation)z=ignore\s+(?:\w+\s+)*(previous|all|above|prior)\s+instructionsprompt_injection_ignorerG injectionz.prompt injection: ignore previous instructions)zyou\s+are\s+(?:\w+\s+)*now\s+ role_hijackrNrdz%attempts to override the agent's role)zqdo\s+not\s+(?:\w+\s+)*tell\s+(?:\w+\s+)*the\s+user(?!.*\b(?:unless|except|until|confirm|diagnose|verify|check)\b)deception_hiderNrdz-instructs agent to hide information from user)z0system\s+(?:\w+\s+)*prompt\s+(?:\w+\s+)*overridesys_prompt_overriderGrdz&attempts to override the system prompt)z+pretend\s+(?:\w+\s+)*(you\s+are|to\s+be)\s+ role_pretendrNrdz6attempts to make the agent assume a different identity)zRdisregard\s+(?:\w+\s+)*(your|all|any)\s+(?:\w+\s+)*(instructions|rules|guidelines)disregard_rulesrGrdz&instructs agent to disregard its rules)z-output\s+(?:\w+\s+)*(system|initial)\s+promptleak_system_promptrNrdz%attempts to extract the system prompt)z.(when|if)\s+no\s*one\s+is\s+(watching|looking)conditional_deceptionrNrdz=conditional instruction to behave differently when unobserved)zwact\s+as\s+(if|though)\s+(?:\w+\s+)*you\s+(?:\w+\s+)*(have\s+no|don\'t\s+have)\s+(?:\w+\s+)*(restrictions|limits|rules)bypass_restrictionsrGrdz+instructs agent to act without restrictions)z5translate\s+.*\s+into\s+.*\s+and\s+(execute|run|eval)translate_executerGrdz(translate-then-execute evasion technique)z9html_comment_injectionrNrdz$hidden instructions in HTML comments)z5<\s*div\s+style\s*=\s*["\'][\s\S]*?display\s*:\s*none hidden_divrNrdz(hidden HTML div (invisible instructions))zrm\s+-rf\s+/(?:(?!tmp(?:\b|/)|var/tmp(?:\b|/)|dev/shm(?:\b|/)|run(?:\b|/))|(?:tmp|var/tmp|dev/shm|run)/(?:[^/\s]*/)*\.\.(?=/|[\s;&|]|$))destructive_root_rmrG destructivezrecursive delete from root)z+rm\s+(-[^\s]*)?r.*\$HOME|\brmdir\s+.*\$HOMEdestructive_home_rmrGrqz)recursive delete targeting home directory)z chmod\s+777insecure_permsr[rqzsets world-writable permissions)z >\s*/etc/system_overwriterGrqz$overwrites system configuration file)z\bmkfs\bformat_filesystemrGrqzformats a filesystem)z\bdd\s+.*if=.*of=/dev/disk_overwriterGrqzraw disk write operation)zshutil\.rmtree\s*\(\s*[\"\'/] python_rmtreerNrqz/Python rmtree on absolute or root-relative path)ztruncate\s+-s\s*0\s+/truncate_systemrGrqz#truncates system file to zero bytes)z \bcrontab\bpersistence_cronr[ persistencezmodifies cron jobs)z:\.(bashrc|zshrc|bash_profile|bash_login|zprofile|zlogin)\b shell_rc_modr[rzreferences shell startup file)z(?/dev/tcp/bash_reverse_shellrz+bash interactive reverse shell via /dev/tcp)z'python[23]?\s+-c\s+["\']import\s+socketpython_socket_onelinerrGrz9Python one-liner socket connection (likely reverse shell))zsocket\.connect\s*\(\s*\(python_socket_connectrNrz'Python socket connect to arbitrary host)z9webhook\.site|requestbin\.com|pipedream\.net|hookbin\.com exfil_servicerNrz:references known data exfiltration/webhook testing service)z&pastebin\.com|hastebin\.com|ghostbin\. paste_servicer[rz0references paste service (possible data staging))zbase64\s+(-d|--decode)\s*\|base64_decode_piperN obfuscationz%base64 decodes and pipes to execution)z7\\x[0-9a-fA-F]{2}.*\\x[0-9a-fA-F]{2}.*\\x[0-9a-fA-F]{2}hex_encoded_stringr[rz)hex-encoded string (possible obfuscation))z\beval\s*\(\s*["\'] eval_stringrNrzeval() with string argument)z\bexec\s*\(\s*["\'] exec_stringrNrzexec() with string argumentzecho\s+[^\n]*\|\s*(?:z|python|perl|ruby|node)echo_pipe_execrz'echo piped to interpreter for execution)z?compile\s*\(\s*[^\)]+,\s*["\'].*["\']\s*,\s*["\']exec["\']\s*\)python_compile_execrNrzPython compile() with exec mode)zgetattr\s*\(\s*__builtins__python_getattr_builtinsrNrz5dynamic access to Python builtins (evasion technique))z#__import__\s*\(\s*["\']os["\']\s*\)python_import_osrNrzdynamic import of os module)zcodecs\.decode\s*\(\s*["\']python_codecs_decoder[rz6codecs.decode (possible ROT13 or encoding obfuscation))zString\.fromCharCode|charCodeAt js_char_coder[rz=JavaScript character code construction (possible obfuscation))zatob\s*\(|btoa\s*\( js_base64r[rzJavaScript base64 encode/decode)z\[::-1\]string_reversallowrz-string reversal (possible obfuscated payload))z)chr\s*\(\s*\d+\s*\)\s*\+\s*chr\s*\(\s*\d+ chr_buildingrNrz.building string from chr() calls (obfuscation))z7\\u[0-9a-fA-F]{4}.*\\u[0-9a-fA-F]{4}.*\\u[0-9a-fA-F]{4}unicode_escape_chainr[rz/chain of unicode escapes (possible obfuscation))z.subprocess\.(run|call|Popen|check_output)\s*\(python_subprocessr[ executionzPython subprocess execution)zos\.system\s*\(python_os_systemrNru)os.system() — unguarded shell execution)zos\.popen\s*\(python_os_popenrNru#os.popen() — shell pipe execution)z%child_process\.(exec|spawn|fork)\s*\(node_child_processrNrzNode.js child_process execution)zRuntime\.getRuntime\(\)\.exec\(java_runtime_execrNru'Java Runtime.exec() — shell execution)z`[^`]*\$\([^)]+\)[^`]*`backtick_subshellr[rz)backtick string with command substitution)z\.\./\.\./\.\.path_traversal_deeprN traversalz+deep relative path traversal (3+ levels up))z \.\./\.\.path_traversalr[rz&relative path traversal (2+ levels up))z/etc/passwd|/etc/shadowsystem_passwd_accessrGrz references system password files)z/proc/self|/proc/\d+/ proc_accessrNrz3references /proc filesystem (process introspection))z /dev/shm/dev_shmr[rz.references shared memory (common staging area))z.xmrig|stratum\+tcp|monero|coinhive|cryptonight crypto_miningrGminingzcryptocurrency mining reference)zhashrate|nonce.*difficultymining_indicatorsr[rz)possible cryptocurrency mining indicatorszcurl\s+[^\n]*\|\s*curl_pipe_shell supply_chainz*curl piped to shell (download-and-execute)zwget\s+[^\n]*-O\s*-\s*\|\s*wget_pipe_shellz*wget piped to shell (download-and-execute))zcurl\s+[^\n]*\|\s*pythoncurl_pipe_pythonrGrz curl piped to Python interpreter)z#\s*///\s*script.*dependenciespep723_inline_depsr[rzAPEP 723 inline script metadata with dependencies (verify pinning))z pip\s+install\s+(?!-r\s)(?!.*==)unpinned_pip_installr[rz#pip install without version pinning)znpm\s+install\s+(?!.*@\d)unpinned_npm_installr[rz#npm install without version pinning)z uv\s+run\s+uv_runr[rz/uv run (may auto-install unpinned dependencies))zD(curl|wget|httpx?\.get|requests\.get|fetch)\s*[\(]?\s*["\']https?:// remote_fetchr[rz"fetches remote resource at runtime)zgit\s+clone\s+ git_cloner[rz"clones a git repository at runtime)zdocker\s+pull\s+ docker_pullr[rzpulls a Docker image at runtime)z^allowed-tools\s*:allowed_tools_fieldrprivilege_escalationzBskill declares allowed-tools (standard frontmatter; informational))z#\bsudo\b(?!\.(?:request|respond)\b) sudo_usagerNrz uses sudo (privilege escalation))zsetuid|setgid|cap_setuid setuid_setgidrGrz.setuid/setgid (privilege escalation mechanism))NOPASSWD nopasswd_sudorGrz:NOPASSWD sudoers entry (passwordless privilege escalation))zchmod\s+[u+]?ssuid_bitrGrzsets SUID/SGID bit on a fileagent_config_modrzzYinstructs modification of agent config files (could persist instructions across sessions)agent_config_mod_shellz\shell write (redirect/sed -i/tee/cp/mv) targeting agent config files (persistence mechanism)agent_config_contractrNu[dictates agent config file contents (verify intent — authoring guides use this shape too))z0AGENTS\.md|CLAUDE\.md|\.cursorrules|\.clinerulesagent_config_refrrzzQreferences agent config files (informational; only modification intent is scored)hermes_config_modzImodification language aimed at Hermes configuration files (verify intent)hermes_config_mod_shellzLshell write (redirect/sed -i/tee/cp/mv) targeting Hermes configuration files)z'\.hermes/config\.yaml|\.hermes/SOUL\.mdhermes_config_refrrzzYreferences Hermes configuration files (informational; only modification intent is scored)other_agent_config_modz*modifies other agents' configuration filesother_agent_config_mod_shellzSshell write (redirect/sed -i/tee/cp/mv) targeting other agents' configuration files)z \.claude/settings|\.codex/configother_agent_config_refrrzz^references other agent configuration files (informational; only modification intent is scored))zu(?:api[_-]?key|token|secret|password)\s*[=:]\s*["\'](?!(?-i:[A-Z][A-Z0-9]*(?:_[A-Z0-9]+)+)["\'])[A-Za-z0-9+/=_-]{20,}hardcoded_secretrGcredential_exposurez,possible hardcoded API key, token, or secret)z(-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----embedded_private_keyrGrzembedded private key)z0ghp_[A-Za-z0-9]{36}|github_pat_[A-Za-z0-9_]{80,}github_token_leakedrGrz-GitHub personal access token in skill content)zsk-[A-Za-z0-9]{20,}openai_key_leakedrGrz(possible OpenAI API key in skill content)zsk-ant-[A-Za-z0-9_-]{90,}anthropic_key_leakedrGrz+possible Anthropic API key in skill content)zAKIA[0-9A-Z]{16}aws_access_key_leakedrGrz"AWS access key ID in skill content)zglpat-[A-Za-z0-9_\-]{20,}gitlab_token_leakedrGrz-GitLab personal access token in skill content)z"\bDAN\s+mode\b|Do\s+Anything\s+Now jailbreak_danrGrdz'DAN (Do Anything Now) jailbreak attempt)z"\bdeveloper\s+mode\b.*\benabled?\bjailbreak_dev_moderGrdz developer mode jailbreak attempt)z3hypothetical\s+scenario.*(?:ignore|bypass|override)hypothetical_bypassrNrdz1hypothetical scenario used to bypass restrictions)z$for\s+educational\s+purposes?\s+onlyeducational_pretextr[rdz9educational pretext often used to justify harmful content)zW(respond|answer|reply)\s+without\s+(?:\w+\s+)*(restrictions|limitations|filters|safety)remove_filtersrGrdz1instructs agent to respond without safety filters)z>you\s+have\s+been\s+(?:\w+\s+)*(updated|upgraded|patched)\s+to fake_updaterNrdz3fake update/patch announcement (social engineering))zYnew\s+(?:\w+\s+)*policy|updated\s+(?:\w+\s+)*guidelines|revised\s+(?:\w+\s+)*instructions fake_policyr[rdz8claims new policy/guidelines (may be social engineering)z(\b(?:include|output|print|send|share)\s+zO(?:conversation|chat\s+history|previous\s+messages)\b|\b(?:print|send|share)\s+z context\b context_exfilz4instructs agent to output/share conversation history)z6(send|post|upload|transmit)\s+.*\s+(to|at)\s+https?:// send_to_urlrNrHz%instructs agent to send data to a URL>r~rPrQrOrRrSr.py#.sh.bash.rb.pl.r.jl.yaml.yml.toml.conf.cfg)r;.ini.js//.ts.php)rrz^\s*(?:(?:const|let|var|export)\s+)?[\w.\-]*(?:deny|black|block|skip|exclu|ignor|forbid|refus|reject|never|unsafe|sensitive|secret_?file|redact)[\w.\-]*\s*(?::[^=]*?)?(?:=|:\s*(?:$|[\[({]))a\b(?:cat|less|more|head|tail|cp|mv|rm|scp|rsync|curl|wget|tee|chmod|chown|ssh|sudo|install|source|eval|exec|system|popen|run|check_output|copyfile|copy2|sendfile)\b|\.(?:read|write|open|unlink|copy|append)\w*\s*\(|\bopen\s*\(|readFileSync|writeFileSync|appendFileSync|>>z'[^'\n]*'|"[^"\n]*\"linesc Ngdddf\}}}}t|D]\}}|dkr|s|}|j|tjd|t d|t fddDzt fddDz }|j jd}|S) aJ0-indexed line that opened each line's statement (an unclosed bracket or trailing backslash continues it), so a match on a continuation line of a multi-line regex can be traced to the assignment target above it. Quoted spans are blanked before counting brackets; a miscount costs a missed demotion, never a missed finding.rFr6c3@K|]}j|ywNcount.0cbares r- z$_statement_owners..s"@Q4::a="@z([{c3@K|]}j|ywrrrs r-rz$_statement_owners..sFdYZtzzRS}Fdrz)]}\) enumerateappend_QUOTED_SPAN_REsubmaxsumrstripendswith)rownersdepthowner continuedir"rs @r-_statement_ownersr s')!Qo#FE5)U#14 A:iE e""2t,Aus"@%"@@@3Fd^cFdCddeKKM**40 1 Mr,pidrr$r" owner_linesuffixc|tvr||fS|jjtj |drd|dfSt j |rtj|sd|dfS||fS)zc``(severity, description)`` for a path-token match, lowered when the line cannot act where it sits.r+rz (in a comment; informational)rNz3 (in a denylist literal; confirm before installing)) _PATH_REFERENCE_PATTERN_IDSlstrip startswith_COMMENT_PREFIXget_DENYLIST_OWNER_REr#_ACTION_ON_LINE_REsearch)r rr$r"r r s r-_demote_inert_path_referencers --$$ {{} 3 3FB ?@ %CDDD +4F4M4Md4S+&YZZZ [  r,)2i>.css.tex.txt.xml.htmlrrr.mdrrrrrrrrrrr.jsonrr> .so.app.bin.com.dat.deb.dll.dmg.exe.msi.rpm.dylib>rrrrru​zzero-width spaceu‌zzero-width non-joineru‍zzero-width joineru⁠z word joineru⁢zinvisible timesu⁣zinvisible separatoru⁤zinvisible plusuzBOM/zero-width no-break spaceu‪z LTR embeddingu‫z RTL embeddingu‬zpop directionalu‭z LTR overrideu‮z RTL overrideu⁦z LTR isolateu⁧z RTL isolateu⁨zfirst strong isolateu⁩zpop directional isolaterrcharcHtj|dt|dS)NU+04X)_INVISIBLE_CHAR_NAMESrord)r-s r-_unicode_char_namer3s" $ $TRD #+? @@r,ct}d}t|dD]Z\}}|dDcgc]}|j|}}}|t|dzdk(z}|s|s t |sJ|j |\|Scc}w)a1-indexed lines inside or on the boundary of triple-quoted strings (opening, interior, closing, and one-line docstrings), so ``os.environ`` in prose is not scored. Heuristic: a triple quote inside a string literal is miscounted, but the common false-positive shapes are covered.Frstart)z"""z'''r)setrrranyadd)r doc_linesinsider r"markerwas_incountss r-_compute_docstring_linesr?sUI FU!,4>!R$**V"4!R!R#f+/Q&& Vs6{ MM!    "SsA9czt|}d}|jd|x}dk7rd}d}|dz}|t|krW||}|rd}n9|dk(rd}n1|d k(r|dz }n&|d k(r!|dz}|dk(rd ||z dz z||dz||dz}n|dz }|t|krWn|jd|x}dk7rd j|S) a9Blank balanced inline-link destinations while preserving line offsets. A relative Markdown destination describes documentation structure; it does not cause filesystem access. Nested parentheses and escaped characters are handled so a later, non-link traversal on the same line remains scannable. rz](rFrrT() r6)r:findlenjoin)r"masked search_fromr6rescapedcursorr-s r- _mask_markdown_link_destinationsrLs$ZFKIIdK0 05R 7s4y `{3,}|~{3,})(?P.*)$z-^(?: {0,3}(?:>|(?:[-*+]|\d{1,9}[.)]) {1,4}))+cg}d}|D]}tjtjd|}|<|r7|dd|dk(r)t |d|dk\r|dj sd}d}nA|r(|dddk(rd|dvs|ddt |df}|duxs|j d }|j|r|n t||S) aMask link destinations only in Markdown prose. Inside a fenced or indented code block a ``[x](../..)`` is an argument to whatever command surrounds it, not a hyperlink, so those lines scan verbatim. Fence state is ``(marker_char, opener_length)`` rather than a bool so a mismatched fence line cannot drop the scanner back into prose mode; an unclosed fence stays code to EOF (fail-safe).Nr6r<rrinfoT`) z ) _FENCE_LINEr#_CONTAINER_PREFIXrrFstriprrrL)routfencer"r#codes r-_mask_prose_link_destinationsrW<s C E M!!"3"7"7D"AB  %/!,a8Sx=QUZ[\U]=]!&M//1DeHoa0C7C5=.ksBT !Bs invisible_unicoderNrdr/r0 (rCzinvisible unicode character z! (possible text hiding/injection))namer lowerSCANNABLE_EXTENSIONS read_textsplitUnicodeDecodeErrorOSErrorr?rWr _COMPILED_THREAT_PATTERNSr_PATH_TRAVERSAL_PATTERN_IDSrrSrrrrFnextINVISIBLE_CHARSr3r2)rXrYrr5docstring_linestraversal_linesr rpatternr rr r$r  scan_linetext line_severityline_descriptionr-rer"s @r- scan_filerwSs4)9>>H';; R\@\ ##W#5;;DAH.u5O>G>N>N>T>T>VZ_>_3E:ejO%%++-/@/GFF9Rm5h+ a0 mGAt259T2TA.Z^I'GNN9,Ezz|2N;eF1q5M6JF3T/ /]HhPQ03D S0@d4CjSXFXZj!lm  mmU!,m4B_BDI ID V%d+D OOG$7hXY&(T3r$q$A&B4&Hi$jl mm O+  ( s!G%%G98G9 skill_pathr1c|jt|}}g}|jrt|}|j t |||j dD]Q}|js|t|j|x}r7|j t||Sn5|jr%|j t||jt|}t|||||tjtj j#t%|||||S)aHStructural checks + pattern scan of every text file in a skill dir (or a single file). A gitignore-style `.skillignore` / `.clawhubignore` excludes dev/docs artifacts from BOTH passes; the ignore file itself is always excluded and `SKILL.md` can never be un-ignored. *source* (e.g. "openai/skills") sets the trust level.)ignore*)re_resolve_trust_levelis_dir_load_skill_ignoreextend_check_structurerglobis_filer( relative_torw_determine_verdictr/rnowrutc isoformat_build_summary) rxr1retrustr5rzfrelr3s r- scan_skillrss//#7#?%D H#J/(FCD!!#& 3Ayy{6Q]]:5N1O*O##P !S 12 3     *joo>? *G dFE7Hhll8<<>X>b>b>d$T65'8L NNr,cjs1tjjj Stj}t fdj dDD]G\}}|j|jddz|j|jI|j S)uvCanonical SHA-256 over (POSIX relative path, file bytes) ORDERED by the rel-path STRING — Path sorting is case-insensitive on Windows and diverged from ``skills_hub.bundle_content_hash`` (every installed skill then reported ``update_available`` forever). String order keeps both sides byte-symmetric. Ordering by ``sorted(rglob(...))`` diverged from the bundle side on Windows: Path comparison is case-insensitive there (normcase), while ``bundle_content_hash`` sorts plain strings — the same skill hashed to different digests and every installed skill reported ``update_available`` forever (#62310). c3K|]6}|js|jj|f8ywr)rras_posix)rprxs r-rz"_content_digest..s4qqefenenep!-- 3<<>Bqs?&?r{r\) r}hashlibsha256 read_bytes hexdigestsortedrupdateencode)rxhrrs` r-_content_digestrs    ~~j3356@@BBAqJL\L\]`Laqq!Q G$w./  ! ;;=r,c$dt|ddS)uShort integrity hash (paths mixed in, so swapping two files' contents changes it). MUST stay symmetric with ``tools.skills_hub_install.bundle_content_hash`` — change both at once.sha256:Nrrxs r- content_hashrs_Z0"56 77r,) source_url cache_dirrrc t|}|xs|jdz }tj|d|j dj dd}||d|dz }d|t ||d }d tttj5tj|jd  dddt trt fd |j!Drdt#|j$| d  d  j'dgD cgc] } t)di| c} d j'dd} i ddi} nt+||} | j,D cgc] } t/| } } i|| j0| j2| t5| D chc]} | d c} | j6| j8dd} tt5|j;dd|j=tj>| ddzd ddd| | _ | | fS#1swYxYwcc} wcc} wcc} w#1swY0xYw)zScan plus attestation dict; the cache (keyed by content digest + source identity) only serves exact current content under the current scanner version.z .scan-cacher\Nr-r r) bundle_hashscanner_versionr1rr]c3LK|]\}}j||k(ywr)r)rkvcacheds r-rz$scan_skill_cached..s"'Xtq! 1 (:'Xs!$r2r3r5r7r8r6freshF)r1rT)r3r2r5rulesr7r8r)parentsexist_okr)indentr_r+)!rparentrrrrSCANNER_VERSIONrrkjsonJSONDecodeErrorloadsrh isinstancer;allitemsr/rerrrr5rr3r2rr7r8mkdir write_textdumpsr9)rxr1rrdigest cache_rootsource_identity cache_fileexpecteditemresult provenancer5rs @r-scan_skill_cachedrsRZ (F?j//-?Jnnxr*%>%E%Eg%NOYY[\_]_`O/):%@@J!(1oag(*H F '4// 0DJ00'0BCD&$C'Xx~~GW'X$XJOOVVM5JFS\L]9?JPR9STW_t_TV\]iVj"JJy"570// Jv6-3__=TF4L==@@V^^FL^L^lt%h&OdtL'9&OP`f`q`q!'$@ g  ]   TD  9  ! !$**Z"BT"IT[ ! \ ](F : #DDU >&O ] ]s*&H7 I2I ) I%?I7IIrforcectj|jtdtj|jd}t |j }|jdk(xr|jdv}|dk(rdd|jd|jd fS|r|sdd |jd |d fS|d k(r"dd|jd|jd|d fSd|jd|jd|d}d||rdzfSdzfS)z``(allowed, reason)`` from verdict + trust; *force* overrides every block except a dangerous verdict on community/trusted sources. ``allowed`` is None when policy says "ask".rrr)rrrTz Allowed (z source, z verdict)zForce-installed despite z verdict (z findings)rNzRequires confirmation (z source + z verdict, z Blocked (z findings). Fz.--force does not override a dangerous verdict.zUse --force to override.)INSTALL_POLICYrr2 VERDICT_INDEXr3rFr5)rrdecisionn hard_blockblockeds r-should_allow_installrs>!!&"4"4n[6QRS`SdSdekesesuvSwxH FOOA;.a63E3EIa3aJ7y!3!3 4Ifnn=MYWWW Z//?z!JWWW5.v/A/A.B*V^^L\\fghfiisttt&,,-Z7GzRSQTT`aG 'Q[M| ||a{| ||r,c d|jd|jd|jd|jj g}|j rddddd t |j fd  D]}|jd |jj jd d|jjdd|jd|jjdd|jddd |jdt|\}}|durdn|dnd}dj|d|d|gzS)uQCompact multi-line report for CLI/chat display; findings sorted critical → low.zScan: rd/z ) Verdict: rrr)rGrNr[rc<j|jdS)N)rr)rorders r-z$format_scan_report..suyyQ7Or,)keyz rD:z "N<"r6TALLOWEDzNEEDS CONFIRMATIONBLOCKEDr_z Decision:  — )r0r1r2r3upperr5rrrljustr r!r"r#rrG)rrrallowedreasonstatusrs @r-format_scan_reportrsOf''(6==/6;M;M:Nl[a[i[i[o[o[qZr s tE QqA-OP QA LL2ajj..066q9:!AJJ bool* excludes paths from every count and finding.c Fjt||||d||y)Nr)rr)r sevcatrr#descr5s r-r9z_check_structure..adds S#sAudCDr,rr{rsymlink_escaperGrz symlink -> z*symlink points outside the skill directorybroken_symlinkr[zbroken symlinkzbroken or circular symlinkioversized_file structuralKBzfile is z KB (limit: zKB) binary_filezbinary: zbinary/executable file (z) should not be in a skillIunexpected_executablezexecutable bit setzBfile has executable permission but is not a recognized script typetoo_many_filesz (directory)z filesz skill has z files (limit: rCoversized_skillrzKB totalz skill is zKB total (limit: )rr(rr is_symlinkresolveis_relative_torkstatst_sizeMAX_SINGLE_FILE_KBr rfSUSPICIOUS_BINARY_EXTENSIONS_SCRIPT_EXTENSIONSst_modeMAX_FILE_COUNTMAX_TOTAL_SIZE_KB) rrzr9 file_count total_sizerrresolvedstsizeextr5s @r-rrsaHEJ __S !V!-- *+ q||~63E&QT+ a <<> r99;..y/@/@/BC(*k3+V^U_H`DF  B rzz)t* $t+ +  (L#$$,r?R44<. 4F3GsK M88>># #C(D D  z<>N*3%/IJ L ( (RZZ%-? '<FZT V5V8N" h m |SYEZ ON3C1 E G%,, ulMjTXFXEYYaCb d*++<=NGGG G*)G*)z .skillignorez.clawhubignorec hgfdtDD]}}ttt5|j rNj dt tj|jdjDddddtdtffd }|S#1swYxYw) aeBuild ``ignore(rel_posix_path) -> bool`` from `.skillignore` / `.clawhubignore`. gitignore basics: blank lines and ``#`` comments skipped; trailing ``/`` = directory (it and everything under it); ``*``/``?`` globs via fnmatch on the full path and each segment; leading ``/`` anchors to the root. Ignore files always excluded; ``SKILL.md`` never.c3(K|] }|z  ywrr+)rrers r-rz%_load_skill_ignore..sDDy4Dsc3FK|]}|r|jds|yw)rNr)rss r-rz%_load_skill_ignore..s' @a#$Q\\#->!" @s!r\r]Nrr=ct|j}|jd}|d}|dk(ry|tvryD]}|j d}|j ds(|j dz}|j dr|k(s|s|rWdzdzd|zdzvshytj|s5|rtj|s|sdvstfd|Dsyy)NrrAr[FTc3JK|]}tj|ywr)fnmatch)rsegrs r-rz5_load_skill_ignore..ignore..+s(QSa)@(Qs #) r rri_SKILL_IGNORE_FILENAMESrrSrr r8) r rel_posixsegsbasepatanchoredbelowrpatternss @r-rzz"_load_skill_ignore..ignoresI&&( s#Bx :  * * C~~c*H #A((S1E||C >U8q3TWZcTcfiTi@jA.xW__UY[\E]afqLS(QD(Q%Q r,) rrrjrkrrmapr(rSrh splitlinesbool)rigrzrs` @r-r~r~ s HD,CD@ (' 2 @zz| @3syy",,PW,:X:c:c:e+f @@ @ @@ CD. M9 @ @s AB((B1 )z skills-sh/z skills.sh/z skils-sh/z skils.sh/cttfdtDdddk(rydk(rytfdtDrdSd S) uSource id -> trust level. "official" is provenance, not a user-controlled GitHub id like "official/"; trusted repos match exactly or as a skill path inside the repo — never a sibling sharing the prefix.c3FK|]}j|s|ywrr )rrr1s r-rz'_resolve_trust_level..8sU@Q@QRS@T1Us!!r6Nrofficialrc3TK|]}|k(xsj|d!yw)rNr )rtsrcs r-rz'_resolve_trust_level..=s,WAC1H?!Aw(??Ws%(rr)rFrn_SOURCE_PREFIX_ALIASESr8 TRUSTED_REPOS)r1r s`@r-r|r|5sU TU&<UWYZ[\ ]C o jWWW9h]hhr,r5cZ|Dchc]}|j}}d|vrdSd|vrdSdScc}w)uTcritical → dangerous, high → caution; medium/low alone are informational (safe).rGrrNrr)r)r5rrs r-rr@s<' (!1:: (C ($+;WfmWQWW )s(rerr3c|s|dS|d|dt|ddjt|Dchc]}|jc}Scc}w)Nz!: clean scan, no threats detectedz: rz finding(s) in z, )rFrGrr )rer1rr3r5rs r-rrFsZ 899V2gYeCM?/$))FhpSqcdTUT^T^SqLrBsAt uuSqsAcdt|S)z8Full canonical digest used to bind scanner attestations.rrrs r-full_content_hashr&Qs _Z01 22r,)r6)r)Fr)U__doc__rer rr contextlibr dataclassesrrrrrpathlibr typingr r rr"rrrr/rB_AGENT_CONFIG_FILES_HERMES_CONFIG_FILES_OTHER_AGENT_CONFIG_FILESr(r@rCrE _NO_TRANSFER _SHORT_FILLER _NOT_DELEGATE_SHELL_NAMES_RE _CRED_FILE_CRED_FILE_LITERAL_PY_CRED_FILE_ARGTHREAT_PATTERNScompile IGNORECASErl frozensetrrrrrr:r rrrrrgrrr1r7rormr3r?rLrQrRrWrwrrrr;rrrrrrr~r!r|rrr&)rrrests00r-r<sf  00'$^ 4331 qq9    88 8NN<G Mc Mc M9s9s9m3m3mH $ Y. D '36GG8;MMPYYh m hmhnh^heh"v#h$j%h&v'h(l)h*v+h,k-h0a1h6R7h:57IIZ9ce;hN**`a-.0jkZ9_aOhXfYhbzchfHghj~khnrohrBsh~thBSChHuIhL|MhPkQhTtUhX]Yh\_]h`dahd[ehhYihltmhpdqht_uhx\yh|T}hHUIhPdQhTcUhVjWhXZYhZi[h\B]h^t_hbXchnOohrOshvdwhxQyhzZ{h~ch@XAhDrEhFwGhNQOhRXShV@WhXpYhZ o 23:y2_a[h^s_hbzchdgehh_ihn{ohpaqhtbuhvbwhx o..EFz=2[]yh|V}h@pAhDwEhFpGhJoKhNfOhPlQhR^ShViWh\P]h`oahbgchd}ehf~ghhzihlsmhnfohpvqhrzshtguhxByhzz{h~ ?+,.?^^JKh@ $O#45 N4`bAhDvEhHzIhL^MhP|QhRlShVUWhZe[h\f]hbAchlWmhplqhtxuhxhyhN)*]5PQOhR()z=;YZShV-.fm6STWhZD[h^*+&-1|~_hb)* MN8O> } }D }U4QT9EU } Cz Cc C**d7m*\=#$#LPiiiXgX3X vvcv#vvtT[}vadv3$333A ps*R/