Crate killer 

Killer — a fast, extensible code quality and security analysis engine.

This library crate exposes the analysis engine so it can be embedded and tested independently of the killer command-line binary.

Overview

Static analysis — the killer scan pipeline:

• scanner walks a directory, detects languages, and loads file contents.
• analyzer defines the analyzer::Rule trait and runs rules over files.
• rules contains the built-in security and quality rules.
• report turns findings into a scored terminal, JSON, Markdown, or HTML report.
• config loads .killer.toml settings.

The .klr language and test framework — killer test:

• klr is the language itself: parser, AST, interpreter, the parallel runner, and the static rule engine. The lexer behind klr::parse is an internal detail and is not exposed.
• attacks holds the executors, including a zero-dependency HTTP client behind the attacks::http::HttpClient trait.
• suites exposes the six built-in suites, embedded at compile time.
• results models a test run and persists it under .killer/results/.
• fuzz is the mutation-generator catalog shared by .klr mutate and the killer fuzz command.

Project analysis and workflow — everything else:

• graph builds a structural import/dependency graph (not a data-flow one).
• dependencies inventories declared dependencies from local manifests across six ecosystems — no CVE or advisory lookup.
• compliance maps detected findings onto OWASP Top 10 (2021) and CWE.
• intelligence records score snapshots and computes the trend.
• git parses git diff output for review, which analyzes only the lines a change touched.
• ci provides the gate helpers behind killer ci / killer github enable.
• watch is a dependency-free polling file watcher.
• explain is the knowledge base behind killer explain <ISSUE_ID>.

API stability

The enums that model an open set are #[non_exhaustive] (analyzer::Severity, analyzer::Category, scanner::Language, results::Verdict, dependencies::Ecosystem, compliance::CategoryStatus, git::DiffTarget, fuzz::HitOutcome, and the AST’s klr::ast::Value and klr::ast::Expectation). Match them with a wildcard arm and fold it into the conservative branch: a Verdict you do not recognize has not been shown secure.

analyzer::Finding and klr::ast::Attack are #[non_exhaustive] too, because both are going to gain fields; build them with analyzer::Finding::new and klr::ast::Attack::empty.

analyzer::Rule is deliberately unsealed so third-party rules keep working: only id and check are required, and any method added later will also carry a default body.

Example

use std::path::Path;
use killer::{analyzer::Analyzer, config::Config, report::Report, scanner};

let root = Path::new(".");
let config = Config::load(root).unwrap();
let scan = scanner::scan(root, &config);
let findings = Analyzer::with_default_rules(&config).analyze(&scan);
let report = Report::new("demo".into(), scan.stats, findings);
print!("{}", report.render_terminal());

Modules

analyzer

The analysis core: the Rule trait, the Finding type, and the Analyzer that runs a set of rules over scanned files.

attacks

Attack executors: the transport (HTTP) and domain-specific helpers (filesystem, database) used by the .klr interpreter to carry out and evaluate attacks.

ci

CI/CD Guardian helpers.

compliance

The compliance-mapping engine behind killer compliance.

config

Configuration loaded from a .killer.toml file at the scan root.

dependencies

The dependency-intelligence engine behind killer dependencies.

explain

The knowledge base behind killer explain <ISSUE_ID>.

fuzz

Fuzz generators — the shared mutation catalog behind the .klr mutate construct and the killer fuzz command.

git

A thin wrapper over git for the code-review engine.

graph

The project graph engine.

intelligence

The Project Intelligence Engine.

klr

The Killer Rule Language (.klr).

report

Report generation and terminal rendering.

results

Test-result types and on-disk storage.

review

The Code Review Engine.

rules

The rule registry.

scanner

Project scanner: recursively walks a directory, detects languages, and collects the file contents that the rule engine analyzes.

suites

Built-in security test suites, embedded in the binary at compile time.

watch

A dependency-free file watcher used by killer watch.