skill_veil_core/
lib.rs

1//! skill-veil-core: Behavioral & Supply-Chain Security Analysis for Agent Skills
2//!
3//! This crate provides the core analysis engine for detecting security risks
4//! in agent skills based on Markdown and associated code.
5//!
6//! # Overview
7//!
8//! skill-veil-core analyzes agent skill files (typically Markdown) for security
9//! risks such as:
10//!
11//! - Remote code execution patterns (`curl | bash`, PowerShell IEX, etc.)
12//! - Supply chain risks (untrusted sources, suspicious packages)
13//! - Credential exposure
14//! - Privilege escalation attempts
15//! - Data exfiltration indicators
16//!
17//! # Quick Start
18//!
19//! ```
20//! use skill_veil_core::scanner::Scanner;
21//! use skill_veil_core::findings::Severity;
22//!
23//! // Create a scanner with default rules
24//! let scanner = Scanner::new().unwrap();
25//!
26//! // Scan content directly (for demo purposes)
27//! # use std::io::Write;
28//! # let mut file = tempfile::NamedTempFile::new().unwrap();
29//! # writeln!(file, "# Test Skill\n## Setup\n```bash\necho hello\n```").unwrap();
30//! let result = scanner.scan_file(file.path()).unwrap();
31//!
32//! // Check results
33//! println!("Found {} findings", result.findings.len());
34//! if result.has_severity(Severity::Critical) {
35//!     println!("Critical issues detected!");
36//! }
37//! ```
38//!
39//! # Architecture
40//!
41//! The crate follows a hexagonal (ports and adapters) architecture:
42//!
43//! - **Core Domain**: [`scanner`], [`rules`], [`findings`], [`analyzer`]
44//! - **Port Traits**: [`ports`] - Interfaces for dependency injection
45//! - **Adapters**: [`adapters`] - Default implementations of port traits
46//! - **Services**: [`services`] - Business logic services
47//!
48//! # Modules
49//!
50//! - [`scanner`] - High-level scanning orchestration
51//! - [`rules`] - Rule engine and rule definitions
52//! - [`findings`] - Finding and severity types
53//! - [`analyzer`] - Document parsing and analysis
54//! - [`policy`] - Policy generation (SHIELD.md, SARIF, JSON)
55//! - [`ports`] - Trait definitions for dependency injection
56//! - [`adapters`] - Default implementations
57//! - [`services`] - File discovery and filtering services
58
59pub mod adapters;
60pub mod analyzer;
61pub mod artifact_graph;
62mod artifact_taint;
63pub mod benchmark;
64mod deceptive_docs;
65mod detectors;
66pub mod findings;
67mod inline_suppressions;
68pub mod ioc_extraction;
69pub mod nova;
70pub(crate) mod path_safety;
71pub(crate) mod patterns;
72pub mod policy;
73pub mod ports;
74pub mod rules;
75pub mod scanner;
76mod scanner_execution;
77mod scanner_graph;
78mod scanner_support;
79pub(crate) mod scanner_types;
80pub mod services;
81mod verdict;
82mod verdict_calibration;
83
84#[cfg(feature = "yara")]
85pub mod yara_engine;
86
87// Domain types
88pub use analyzer::{
89    AgentExtensionKind, ArtifactAssessment, ArtifactClassification, ArtifactIdentitySource,
90    CodeBlock, Section, SkillDocument, StructuralSignals, StructuralValidity,
91};
92pub use benchmark::{
93    evaluate_gold_corpus, AttackFamilyMetrics, BenchmarkError, BenchmarkHistory,
94    BenchmarkHistoryEntry, CalibrationBucket, CalibrationSummary, CorpusCoverage, CorpusEvaluation,
95    CorpusManifest, CoverageBucket, DeduplicationMetrics, GoldCorpusManifest, GoldSample,
96    LabeledSample, RegressionMetrics, SampleEvaluation, SampleLabel, ThresholdRecommendation,
97};
98pub use findings::{
99    artifact_scope_for_kind, signal_class_for, ActionTrigger, ArtifactKind, ArtifactScope,
100    BlastRadiusLevel, BlastRadiusSummary, ConsensusClass, ConsensusDiscrepancy, DeclaredPermission,
101    DeduplicationSummary, EvidenceKind, Finding, FindingSummary, HygieneSummary, MatchTarget,
102    OperationalContext, PackageHealth, PackageVerdictReport, ProviderVote, RecommendedAction,
103    RiskFactor, RootCauseGroup, Severity, SeverityCounts, SignalClass, ThreatCategory, Verdict,
104    VerdictReason, RISK_THRESHOLD_BLOCK,
105};
106pub use ioc_extraction::{ExtractedIocs, FileHash};
107pub use path_safety::path_stays_within_base;
108pub use policy::{
109    adjust_confidence, apply_baseline, apply_policy_overrides, apply_policy_overrides_with_audit,
110    apply_waivers, baseline_from_reports, count_baseline_matches, diff_reports,
111    diff_reports_with_policy_state, empty_sarif_report, finding_fingerprint, learned_allowlist,
112    learned_confidence_adjustments, load_baseline, load_disposition_overlay, load_policy,
113    load_waivers, validate_policy, validate_waivers, AppliedPolicyOverride, BaselineEntry,
114    BaselineFile, ConfiguredProfile, ContextActionOverride, ContextPolicy, DiffEntry, DiffReport,
115    Disposition, DispositionOverlay, DispositionRecord, JsonReport, PolicyAudit, PolicyFile,
116    PolicyGenerator, PolicyOverride, PolicyProfile, PolicyProfiles, ShieldPolicy,
117    SuppressionSummary, WaiverEntry, WaiverFile, POLICY_AUDIT_PRECEDENCE, POLICY_SCHEMA_VERSION,
118};
119pub use rules::{
120    default_external_rule_dirs, is_supported_rule_pack_schema, parse_rules_file, IocFeedFile, Rule,
121    RuleCondition, RuleEngine, RulePackFile, RulePackKind, RulePackMetadata,
122    RULE_PACK_SCHEMA_VERSION,
123};
124pub use scanner::{
125    ArtifactMetadata, DefaultScanner, PackageScanResult, ScanError, ScanErrorEntry, ScanOptions,
126    ScanResult, ScanTargetMode, Scanner,
127};
128pub use scanner_graph::{artifact_kind_for_path, derive_package_id};
129pub use verdict::is_conclusive_single_rule_id;
130
131// Port traits (interfaces for dependency injection)
132pub use ports::{
133    DecodedText, FileContent, FileMeta, FileSystemProvider, MarkdownParser, PatternMatcher,
134};
135
136// Default adapters (implementations of port traits)
137pub use adapters::{PulldownMarkdownParser, RegexPatternMatcher, StdFileSystemProvider};
138pub use artifact_graph::{
139    ArtifactCapability, ArtifactCapabilityFact, ArtifactCapabilitySource, ArtifactEdge,
140    ArtifactGraph, ArtifactNode, ArtifactRelation, EndpointKind,
141};
skill_veil_core/lib.rs

skill_veil_core/
lib.rs
