valory-xyz/open-autonomy/triage-security

# 0. Platform check. The skill targets Linux + macOS bash; runs untested on
#    Git Bash / MSYS / Cygwin. Native PowerShell / cmd.exe is not supported
#    (the skill uses heredocs, process substitution, array expansion).
case "$(uname -s 2>/dev/null)" in
  Linux*|Darwin*) ;;  # supported
  MINGW*|MSYS*|CYGWIN*)
    echo "WARN: running under $(uname -s) — Git Bash / MSYS path is untested. Most operations should work; report any failures." >&2
    ;;
  *)
    echo "WARN: unrecognized platform $(uname -s). Skill is bash-only and may fail on this OS." >&2
    ;;
esac
 
# Required CLIs — fail fast if anything is missing so the operator gets a clear
# message instead of a cryptic mid-loop error 40 minutes in.
for cmd in gh jq python3 grep find sed tr printf mktemp; do
  command -v "$cmd" >/dev/null 2>&1 \
    || { echo "ERROR: required CLI not found on PATH: $cmd"; exit 1; }
done
 
# 1. Confirm we're in a git repo with a GitHub remote
gh repo view --json owner,name --jq '"\(.owner.login)/\(.name)"' > /tmp/td_repo.txt 2>/dev/null \
  || { echo "ERROR: not in a GitHub repo (gh repo view failed)"; exit 1; }
REPO=$(cat /tmp/td_repo.txt)
echo "operating on $REPO"
 
# 2. Confirm alert APIs are reachable. Each is OPTIONAL — the skill can run
#    against either source, or both. Source selection happens in Phase 1.
#    Track availability so Phase 1 can fetch only what's actually enabled.
DEPENDABOT_AVAILABLE="no"
CODESCAN_AVAILABLE="no"
# Differentiate "feature disabled" (404) from "token missing scope" (401/403).
# `> /dev/null 2>&1` collapses both into "unavailable" and silently skips
# every alert when the real cause is a permissions failure. Capture stderr
# and fail loudly on auth errors so the operator gets an actionable message
# instead of a clean Phase 4 "0 alerts processed" that masks a broken run.
_check_alerts_api() {
  local label="$1" url="$2" err
  if err=$(gh api "$url" --jq 'length' 2>&1 >/dev/null); then
    return 0
  fi
  # Auth/scope failures look like `HTTP 401`, `HTTP 403`, `Bad credentials`,
  # or mention `scope` / `requires authentication`. Anything else (most
  # commonly `HTTP 404` for a disabled feature) is treated as not-enabled.
  if printf '%s' "$err" | grep -qiE 'HTTP 40[13]|Bad credentials|requires authentication|missing.*scope|needs the .*scope'; then
    echo "ERROR: gh token lacks required scope for $label alerts on $REPO." >&2
    echo "       Run: gh auth refresh -h github.com -s security_events" >&2
    echo "       Underlying error: $err" >&2
    exit 1
  fi
  echo "WARN: $label alerts API unreachable on $REPO (feature likely not enabled) — $label path will be skipped" >&2
  return 1
}
_check_alerts_api "Dependabot"     "repos/$REPO/dependabot/alerts?per_page=1"    && DEPENDABOT_AVAILABLE="yes"
_check_alerts_api "code-scanning"  "repos/$REPO/code-scanning/alerts?per_page=1" && CODESCAN_AVAILABLE="yes"
[[ "$DEPENDABOT_AVAILABLE" == "no" && "$CODESCAN_AVAILABLE" == "no" ]] \
  && { echo "ERROR: neither Dependabot nor code-scanning is enabled on $REPO. Nothing to triage."; exit 1; }
 
# 3. Confirm a Python project layout exists (this skill currently keys off Python ecosystems)
test -f pyproject.toml \
  || { echo "ERROR: no pyproject.toml — skill only supports Python repos right now"; exit 1; }
 
# 4. Pin the skill version into audit issue bodies. This is a hardcoded date
#    string, NOT a runtime git-rev-parse: Claude Code executes the skill via
#    per-call `bash -c` invocations, so `BASH_SOURCE[0]` is empty, `$0` is
#    `bash`, and any `realpath`+`git -C` chain resolves against the AUDITED
#    repo's cwd — yielding the audited repo's HEAD, not the skill's. That's
#    worse than `unknown` (looks authoritative, points at the wrong tree).
#    Bump this string when the skill itself is updated.
SKILL_VERSION="2026-05-14"
export SKILL_VERSION

# Glob patterns matched case-insensitively against alert.rule.id.
# Add patterns here based on observed false-positive cost vs the
# blast radius of a real miss. Tested against actual SnykCode + CodeQL
# rule IDs seen on the Valory fleet.
RULE_HUMAN_REVIEW_PATTERNS=(
  # Cert / TLS verification bypass — bypass of HTTPS trust path
  "*disabled-certificate-check*"
  "*SSLVerificationBypass*"
  "*TooPermissiveTrustManager*"
  "*MissingCertVerification*"
  "*InsecureProtocol*"
 
  # Injection — SQL, XSS, command, XML — when fired on prod code
  "*SQLInjection*"
  "*XSS*"
  "*CommandInjection*"
  "*ShellInjection*"
  "*InsecureXmlParser*"
  "*XmlInjection*"
  "*LdapInjection*"
  "*TaintedFormatString*"
 
  # Hardcoded secrets in NON-test code. The /test variants of these
  # rules are auto-dismissable as `used in tests`; the bare names are not.
  "*HardcodedPassword"
  "*HardcodedCredential*"
  "*HardcodedNonCryptoSecret"
  "*HardcodedKey"
  "*EmbeddedCredentials*"
 
  # Auth / authz — can't statically prove "middleware X handles this"
  "*MissingAuth*"
  "*WeakAuthorization*"
  "*BrokenAccessControl*"
  "*authentication*"
  "*authorization*"
 
  # Deserialization / RCE — highest blast radius
  "*UnsafeDeserialization*"
  "*UnsafePickle*"
  "*PickleLoad*"
  "*UnsafeYaml*"
  "*CodeInjection*"
  "*EvalUsage*"
  "*UnsafeReflection*"
 
  # Path traversal — too easy to misjudge input-sourcing
  "*PathTraversal*"
  "*TaintedPath*"
  "*ZipSlip*"
)
 
# Helper: does the alert's rule.id match any pattern? (Phase 2-cs uses this.)
matches_human_review_pattern() {
  local rule_id="$1"
  local rid_lower pat_lower
  # Lower-case both sides for case-insensitive match. `${var,,}` would be
  # shorter but is bash 4+ only; macOS ships `/bin/bash` 3.2 (this file
  # is explicitly bash-3.2-compat — see §2.1 `while read` note and the
  # reference loop's `mapfile` callout). Using `tr` keeps the safety
  # guard active on the default macOS shell instead of silently
  # disabling it (otherwise the function errors → forced-review never
  # fires for high-stakes rule classes like SQLi / RCE / path-traversal).
  rid_lower=$(printf '%s' "$rule_id" | tr '[:upper:]' '[:lower:]')
  for pat in "${RULE_HUMAN_REVIEW_PATTERNS[@]}"; do
    pat_lower=$(printf '%s' "$pat" | tr '[:upper:]' '[:lower:]')
    # Bash glob match; `*foo*` matches "foo" anywhere in rule_id
    # shellcheck disable=SC2053
    [[ "$rid_lower" == $pat_lower ]] && return 0
  done
  return 1
}