artale
/
fable-agent
Template
1
1
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

feat: review scankii external scanner safely

This commit is contained in:
artale 2026-07-01 23:02:47 +02:00
parent bac3c27380
commit cecb264bc9
2 changed files with 19 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
src/fable5/external-project-review.test.ts
View File

@ -39,6 +39,14 @@ describe("external project review receipts", () => {
expect(receipt.risks).toContain("optimization claims need local receipts"); expect(receipt.risks).toContain("optimization claims need local receipts");
}); });
it("records scankii as learn-only external security scanner research", () => {
const receipt = createSkillsRepoReviewReceipt("ashp15205/scankii", new Date("2026-07-01T00:00:00.000Z"));
expect(receipt).toMatchObject({ repo: "ashp15205/scankii", license: "NOASSERTION", safeToVendor: false, decision: "learn-only", deployAttempted: false });
expect(receipt.patternsLearned).toContain("SAST scanner patterns for AI workflows");
expect(receipt.risks).toContain("security findings need local repro receipts");
});
it("records deploy-gated permission posture without opening 8098", () => { it("records deploy-gated permission posture without opening 8098", () => {
const receipt = createPermissionPostureReceipt("deploy-gated", new Date("2026-07-01T00:00:00.000Z")); const receipt = createPermissionPostureReceipt("deploy-gated", new Date("2026-07-01T00:00:00.000Z"));

12
src/fable5/external-project-review.ts
View File

@ -60,7 +60,7 @@ export function createOpenCovenReviewReceipt(now = new Date()): ExternalProjectR
} }
export function createSkillsRepoReviewReceipt(repo: "mattpocock/skills" | "AI-Builder-Club/skills" | "affaan-m/ECC", now = new Date()): ExternalProjectReviewReceipt { export function createSkillsRepoReviewReceipt(repo: "mattpocock/skills" | "AI-Builder-Club/skills" | "affaan-m/ECC" | "ashp15205/scankii", now = new Date()): ExternalProjectReviewReceipt {
const rows: Record<typeof repo, Omit<ExternalProjectReviewReceipt, "schema" | "createdAt" | "repo" | "deployAttempted">> = { const rows: Record<typeof repo, Omit<ExternalProjectReviewReceipt, "schema" | "createdAt" | "repo" | "deployAttempted">> = {
"mattpocock/skills": { "mattpocock/skills": {
url: "https://github.com/mattpocock/skills", url: "https://github.com/mattpocock/skills",
@ -92,6 +92,16 @@ export function createSkillsRepoReviewReceipt(repo: "mattpocock/skills" | "AI-Bu
decision: "learn-only", decision: "learn-only",
policy: "learn-patterns-no-vendored-code", policy: "learn-patterns-no-vendored-code",
}, },
"ashp15205/scankii": {
url: "https://github.com/ashp15205/scankii",
license: "NOASSERTION",
safeToVendor: false,
patternsLearned: ["SAST scanner patterns for AI workflows", "prompt-injection detection ideas", "malicious tool payload review concepts"],
adaptations: ["treat scanner rules as advisory research", "rewrite useful checks locally with tests", "keep existing Fable security scan as authority until receipts prove parity"],
risks: ["no detected license means no vendoring", "do not execute external scanner without sandbox review", "security findings need local repro receipts"],
decision: "learn-only",
policy: "learn-patterns-no-vendored-code",
},
}; };
return { schema: "fable.external_project.review.v1", createdAt: now.toISOString(), repo, ...rows[repo], deployAttempted: false }; return { schema: "fable.external_project.review.v1", createdAt: now.toISOString(), repo, ...rows[repo], deployAttempted: false };
} }