15 Commits

Author SHA1 Message Date
Leif 8d24921981 Merge branch 'main' into pnpm-cooldown 2026-04-25 03:09:14 +01:00
Leif 76e3de2316 Rebuild code-security AGENTS.md and test cases
Rebuilds the generated outputs for skills/code-security after the rule
content updates in #13 (commit ddc19af). The source rule files were
updated but `make` was not run, so the compiled AGENTS.md and extracted
test cases drifted from the rules.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-24 18:51:32 -07:00
Leif 2347c443c1 pnpm security stuff
pnpm security stuff
2026-04-24 18:40:45 -07:00
Drew Dennison 1932e6d984 Bump GitHub Actions and dependencies
- Upgrade actions/setup-node v4 → v6
- Upgrade actions/checkout v4 → v6
- Upgrade actions/upload-artifact v4 → v7
- Bump unist-util-visit 5.0.0 → 5.1.0
- Bump @types/node 20.19.29 → 25.0.10

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-07 22:31:50 -08:00
Drew Dennison 823e429b92 Add llm-security skill and make build tooling generic
- Add llm-security skill covering OWASP Top 10 for LLM Applications 2025
  - 10 rules: Prompt Injection, Sensitive Disclosure, Supply Chain,
    Data Poisoning, Output Handling, Excessive Agency, System Prompt
    Leakage, Vector/Embedding Weaknesses, Misinformation, Unbounded
    Consumption
  - Python code examples with vulnerable/secure patterns

- Rename packages/code-security-build to packages/skill-build
  - Accept skill name as CLI argument: `pnpm validate llm-security`
  - Auto-discover skills with rules/ directories
  - Support Vulnerable/Secure labels (in addition to Incorrect/Correct)

- Update Makefile to build all skills automatically
  - `make validate` - validates all skills
  - `make build` - builds AGENTS.md for all skills
  - `make validate-skill SKILL=name` - single skill operations

- Update READMEs with llm-security documentation

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-15 14:59:55 -08:00
Drew Dennison e6d279659f Expand sql-injection.md with multi-language examples
Based on semgrep-rules test cases, now covers:
- Python (psycopg2): concatenation, .format(), f-strings
- JavaScript (pg): template literals, concatenation
- Java (JDBC): Statement vs PreparedStatement
- Go (database/sql): concatenation, fmt.Sprintf
- Ruby (pg): concatenation, interpolation
- C# (SqlCommand): String.Format, SqlParameter

Test cases: 347 → 364 (+17 examples)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-15 14:23:17 -08:00
Drew Dennison cd382c1c40 Extract section parsing into shared module
- Create sections.ts to parse _sections.md dynamically
- Eliminate hardcoded section map from parser.ts (was 28 entries)
- Replace duplicate parsing code in build.ts with shared module
- _sections.md is now the single source of truth for section metadata

Adding a new rule now only requires updating _sections.md

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-15 14:17:35 -08:00
Drew Dennison bfa8941893 Fix section mapping for security rules
- Replace React performance section map with security categories (1-28)
- Fix _sections.md parsing to use ### headings instead of ##
- Each rule now maps to its proper section by filename

Now generates 28 sections organized by impact level:
- Critical (1-9): SQL injection, XSS, secrets, etc.
- High (10-22): Crypto, SSRF, Terraform, K8s, etc.
- Medium (23-25): Regex DoS, race conditions
- Low (26-28): Best practices, performance

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-15 14:14:33 -08:00
Drew Dennison 2e12e64d4d Improve rule consistency and rewrite parser with remark/unified
Rule consistency:
- Add missing impactDescription and tags to 15 rule files
- Standardize reference format to **References:** across all rules
- Update _template.md with correct reference format

Parser improvements:
- Replace regex-based parser with AST-based parsing using remark/unified
- Add unified, remark-parse, remark-frontmatter, unist-util-visit, js-yaml
- More robust extraction of frontmatter, examples, and code blocks

Validation improvements:
- Add warnings for missing optional fields (impactDescription, tags)
- Report all errors/warnings instead of stopping on first error

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-15 14:11:57 -08:00
Drew Dennison ffaf3d2612 Update READMEs and add build package documentation
- skills/code-security/README.md: Simplified, added categories summary
- packages/code-security-build/README.md: New - documents build tooling

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-15 13:13:57 -08:00
Drew Dennison cfec7199b8 make it very clear this is an example non-valid secret 2026-01-15 12:56:49 -08:00
Drew Dennison 1804f863e2 reduce size of files 2026-01-15 12:54:30 -08:00
Drew Dennison c81e69ac77 first pass 2026-01-15 12:33:17 -08:00
Drew Dennison eaff835852 remove old code example 2026-01-15 08:26:33 -08:00
Drew Dennison 4e9b382510 inital commit 2026-01-15 08:23:52 -08:00