johnQ
04e20babc1
skill-gate / gate (pull_request) Waiting to run
- hooks/git/{pre-commit,pre-push} + scripts/install-git-hooks.sh（Gitea Actions 无 runner，本地兜底）
- install-skills.sh: --scope project --project-dir（装到项目 .agents/skills）
- scripts/scan-installed.sh: 扫第三方已装技能（33 个，0 高危）
- generate-catalog: has_evals/has_docs + coverage；validate --coverage + 路由一致性检查
- SCOPE 覆盖率路线图（3-4 周补齐 40 个技能的 evals 与四段式文档）
- MAINTENANCE/README/CHANGELOG 同步
59 lines
2.0 KiB
Bash
Executable File
59 lines
2.0 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
# scan-installed.sh — 扫描「已安装但不是本仓库管理」的第三方技能，找出高风险内容。
|
|
# 用法: ./scripts/scan-installed.sh [--strict] [dir ...]
|
|
# 默认扫描 ~/.agents/skills 与 $DSH_HOME/skills
|
|
# --strict: 有高危项则退出码 1
|
|
set -uo pipefail
|
|
ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
|
|
STRICT=0
|
|
dirs=()
|
|
for a in "$@"; do
|
|
case "$a" in
|
|
--strict) STRICT=1 ;;
|
|
*) dirs+=("$a") ;;
|
|
esac
|
|
done
|
|
if [[ ${#dirs[@]} -eq 0 ]]; then
|
|
dirs+=("${HOME}/.agents/skills")
|
|
[[ -n "${DSH_HOME:-}" ]] && dirs+=("${DSH_HOME}/skills")
|
|
fi
|
|
|
|
HIGH_PATTERNS=(
|
|
'rm[[:space:]]+-[a-zA-Z]*r[a-zA-Z]*[[:space:]]+/($|[[:space:]])'
|
|
'curl[^|]*\|[[:space:]]*(ba|z)?sh'
|
|
'wget[^|]*\|[[:space:]]*(ba|z)?sh'
|
|
'chmod[[:space:]]+777'
|
|
'BEGIN (RSA|OPENSSH|EC|DSA) PRIVATE KEY'
|
|
'sk-[A-Za-z0-9]{16,}'
|
|
'AKIA[0-9A-Z]{16}'
|
|
'ghp_[A-Za-z0-9]{20,}'
|
|
)
|
|
|
|
managed=""
|
|
for st in "${HOME}/.agents/.ai-proj-helper-installed-skills.json" \
|
|
"${DSH_HOME:-/nonexistent}/.ai-proj-helper-installed-skills.json"; do
|
|
[[ -f "$st" ]] && managed="$managed $(python3 -c "import json;print(' '.join(json.load(open('$st')).keys()))" 2>/dev/null)"
|
|
done
|
|
|
|
total=0 high=0 third=0
|
|
for dir in "${dirs[@]}"; do
|
|
[[ -d "$dir" ]] || continue
|
|
for entry in "$dir"/*; do
|
|
[[ -e "$entry" || -L "$entry" ]] || continue
|
|
name="$(basename "$entry")"
|
|
[[ " $managed " == *" $name "* ]] && continue
|
|
third=$((third + 1))
|
|
for pattern in "${HIGH_PATTERNS[@]}"; do
|
|
while IFS= read -r hit; do
|
|
echo "[HIGH] $name: ${hit#*:}"
|
|
high=$((high + 1)); total=$((total + 1))
|
|
done < <(grep -rnE --include='*.md' --include='*.sh' --include='*.py' --include='*.js' --include='*.ts' --include='*.json' -- "$pattern" "$entry" 2>/dev/null | cut -c1-180)
|
|
done
|
|
done
|
|
done
|
|
|
|
echo ""
|
|
echo "扫描完成：第三方技能 $third 个，高危 $high 处"
|
|
[[ "$STRICT" == 1 && "$high" -gt 0 ]] && { echo "存在高危第三方技能，需人工确认来源。"; exit 1; }
|
|
exit 0
|