From cecb264bc956fe2de8fb7a5c970e64d0167cf209 Mon Sep 17 00:00:00 2001 From: artale Date: Wed, 1 Jul 2026 23:02:47 +0200 Subject: [PATCH] feat: review scankii external scanner safely --- src/fable5/external-project-review.test.ts | 8 ++++++++ src/fable5/external-project-review.ts | 12 +++++++++++- 2 files changed, 19 insertions(+), 1 deletion(-) diff --git a/src/fable5/external-project-review.test.ts b/src/fable5/external-project-review.test.ts index 6667be1..e5bf923 100644 --- a/src/fable5/external-project-review.test.ts +++ b/src/fable5/external-project-review.test.ts @@ -39,6 +39,14 @@ describe("external project review receipts", () => { expect(receipt.risks).toContain("optimization claims need local receipts"); }); + it("records scankii as learn-only external security scanner research", () => { + const receipt = createSkillsRepoReviewReceipt("ashp15205/scankii", new Date("2026-07-01T00:00:00.000Z")); + + expect(receipt).toMatchObject({ repo: "ashp15205/scankii", license: "NOASSERTION", safeToVendor: false, decision: "learn-only", deployAttempted: false }); + expect(receipt.patternsLearned).toContain("SAST scanner patterns for AI workflows"); + expect(receipt.risks).toContain("security findings need local repro receipts"); + }); + it("records deploy-gated permission posture without opening 8098", () => { const receipt = createPermissionPostureReceipt("deploy-gated", new Date("2026-07-01T00:00:00.000Z")); diff --git a/src/fable5/external-project-review.ts b/src/fable5/external-project-review.ts index efde38d..95465fd 100644 --- a/src/fable5/external-project-review.ts +++ b/src/fable5/external-project-review.ts @@ -60,7 +60,7 @@ export function createOpenCovenReviewReceipt(now = new Date()): ExternalProjectR } -export function createSkillsRepoReviewReceipt(repo: "mattpocock/skills" | "AI-Builder-Club/skills" | "affaan-m/ECC", now = new Date()): ExternalProjectReviewReceipt { +export function createSkillsRepoReviewReceipt(repo: "mattpocock/skills" | "AI-Builder-Club/skills" | "affaan-m/ECC" | "ashp15205/scankii", now = new Date()): ExternalProjectReviewReceipt { const rows: Record> = { "mattpocock/skills": { url: "https://github.com/mattpocock/skills", @@ -92,6 +92,16 @@ export function createSkillsRepoReviewReceipt(repo: "mattpocock/skills" | "AI-Bu decision: "learn-only", policy: "learn-patterns-no-vendored-code", }, + "ashp15205/scankii": { + url: "https://github.com/ashp15205/scankii", + license: "NOASSERTION", + safeToVendor: false, + patternsLearned: ["SAST scanner patterns for AI workflows", "prompt-injection detection ideas", "malicious tool payload review concepts"], + adaptations: ["treat scanner rules as advisory research", "rewrite useful checks locally with tests", "keep existing Fable security scan as authority until receipts prove parity"], + risks: ["no detected license means no vendoring", "do not execute external scanner without sandbox review", "security findings need local repro receipts"], + decision: "learn-only", + policy: "learn-patterns-no-vendored-code", + }, }; return { schema: "fable.external_project.review.v1", createdAt: now.toISOString(), repo, ...rows[repo], deployAttempted: false }; }