mirror of
https://github.com/BaaRai/ARTEX.git
synced 2026-11-15 04:30:55 +08:00
BaaRai
b81c6238a7
ARTEX hunts live targets well but has no methodology for auditing source code handed to it (a plugin, an application, a repository). White-box audits so far ran on ad-hoc task goals with no shared procedure. Adds skills/codeaudit/SKILL.md, distilled from VulnHunter's methodology (Apache-2.0) and adapted to ARTEX mechanics (work dir artifacts, facts, report_finding, the standing quality and adversarial gates): - production-code-only scope rules, with the checked-in infra-config exception (reverse proxy / trust / CORS directives are in scope) - phase 1: every user-controllable input inventoried with dispositions, codebase partitioning, shared defense catalog - phase 2: attacker-first forward tracing per vuln class, with the investigation discipline (never stop at abstraction boundaries, audit all parameters at outbound call sites, exhaust all paths, follow through stores and responses, transitive caller search on sinks) - three gates (reachable, attacker-controlled, new capability), comment skepticism, sanitizer scope mismatch, anti-merge - PoC preference order (executed against a local instance beats static trace; static PoCs carry entry value, file:line chain, sink literal, impact), measured impact per the standing gates - sweep with per-instance dispositions and a count cross-check that forbids silent drops Also fixes the shipped scopesentry skill, which the new guard test caught immediately: its frontmatter block was never closed and its name did not match its directory, so the whole file failed frontmatter parsing and silently degraded to an empty description (the skill has been undiscoverable). The new server test parses every shipped skill with the real parser and fails on any skill LoadDir cannot read or that ends with an empty description.
50 lines
1.2 KiB
Go
50 lines
1.2 KiB
Go
package server
|
|
|
|
import (
|
|
"os"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/Autumn-27/norma/skill"
|
|
)
|
|
|
|
// Every skill shipped in the repository's skills/ directory must parse cleanly
|
|
// with the real frontmatter parser and carry a description: a broken YAML
|
|
// scalar silently empties the metadata and the skill stops being discoverable
|
|
// by the agents (see the skills-YAML fix for the same failure mode).
|
|
func TestShippedSkillsParseCleanly(t *testing.T) {
|
|
dir := filepath.Join("..", "skills")
|
|
entries, err := os.ReadDir(dir)
|
|
if err != nil {
|
|
t.Skipf("no shipped skills dir: %v", err)
|
|
}
|
|
reg, err := skill.LoadDir(dir)
|
|
if err != nil {
|
|
t.Fatalf("LoadDir on shipped skills: %v", err)
|
|
}
|
|
byDir := map[string]skill.Skill{}
|
|
if reg != nil {
|
|
for _, sk := range reg.List() {
|
|
if sk.Dir != "" {
|
|
byDir[filepath.Base(sk.Dir)] = sk
|
|
}
|
|
}
|
|
}
|
|
for _, e := range entries {
|
|
if !e.IsDir() {
|
|
continue
|
|
}
|
|
sk, ok := byDir[e.Name()]
|
|
if !ok {
|
|
t.Errorf("skill %s: not parsed by LoadDir (frontmatter broken?)", e.Name())
|
|
continue
|
|
}
|
|
if sk.Description == "" {
|
|
t.Errorf("skill %s: empty description after parse", e.Name())
|
|
}
|
|
}
|
|
if _, ok := byDir["codeaudit"]; !ok {
|
|
t.Error("codeaudit skill missing from shipped skills")
|
|
}
|
|
}
|