[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10},"actionData","errors","root",{"_207":208,"_209":210},"routes/_app.x.$handle.$name",{"_103":102,"_38":51,"_112":93,"_33":113,"_13":14,"_114":-5,"_11":115,"_116":117,"_118":119,"_120":121,"_122":123,"_26":-5,"_124":-5,"_125":-5,"_126":31,"_127":128,"_129":65,"_130":-5,"_131":-5,"_132":133},"routes/_app.x.$handle.$name.branch.$branch.version.$version.diff",{"_11":12,"_13":14,"_15":16,"_17":18,"_19":-5},"project",{"_49":50,"_38":51,"_44":52,"_53":-5,"_54":31,"_55":56,"_57":56,"_58":59,"_60":-5,"_19":61,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":-5,"_73":-5,"_74":-5,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":86,"_87":88,"_89":90,"_91":31},"version",9,"changes",[25],"aiChatInfo",{"_20":21,"_22":-5,"_23":-5,"_24":-5},"userId","aiChatMessageId","49394d64-4de8-40a8-a66e-9a59355e387a","aiChatThreadId","aiChatThreadUserId","aiChatThreadTitle",{"_26":27,"_28":29,"_30":31,"_32":31,"_33":34,"_35":34},"file",{"_36":37,"_38":34,"_39":40,"_41":43,"_44":45,"_46":14,"_47":48,"_30":31},"previous",{"_36":37,"_38":34,"_39":40,"_41":42},"deleted",false,"deletedHere","path","skill-scanner.ts","latestPath","fileId","0de3bd66-8789-11f1-ab5b-1607ee4eb77e","name","fileType","http","content","// Agent skill vulnerability scanner\n// Detects: hardcoded_secret, prompt_injection, excessive_permissions, unclear_provenance\n\ninterface ScannerRequest {\n skill: string;\n}\n\ninterface ScannerResponse {\n categories: (\n | \"hardcoded_secret\"\n | \"prompt_injection\"\n | \"excessive_permissions\"\n | \"unclear_provenance\"\n )[];\n}\n\n// Parse YAML frontmatter\nfunction parseFrontmatter(content: string): Record {\n const match = content.match(/^---\\n([\\s\\S]*?)\\n---/);\n if (!match) return {};\n\n const frontmatter: Record = {};\n const lines = match[1].split(\"\\n\");\n\n for (const line of lines) {\n const [key, ...valueParts] = line.split(\":\");\n if (key && valueParts.length > 0) {\n const value = valueParts.join(\":\").trim().replace(/^[\"']|[\"']$/g, \"\");\n frontmatter[key.trim()] = value;\n }\n }\n\n return frontmatter;\n}\n\n// Extract body after frontmatter\nfunction getBodyContent(content: string): string {\n const match = content.match(/^---\\n[\\s\\S]*?\\n---\\n([\\s\\S]*)$/);\n return match ? match[1] : content;\n}\n\n// Check for hardcoded secrets: API keys, tokens, webhook URLs, passwords\nfunction checkHardcodedSecret(content: string): boolean {\n // Patterns for common secret formats\n const secretPatterns = [\n // API keys and tokens: sk_, pk_, token=, api_key, apiKey, secret, passwd\n /(?:api[_-]?key|apikey|sk_|pk_|token)['\":\\s]*=?['\"]?[a-zA-Z0-9_\\-\\.]{20,}/i,\n // Webhook URLs: explicit https:// URLs to webhook services\n /https?:\\/\\/(?:webhook|hooks|integrations|api)\\.(?:slack|discord|github|custom)[^\\s\"']+/i,\n // Bearer tokens in code\n /bearer\\s+[a-zA-Z0-9_\\-\\.]{20,}/i,\n // AWS-style secrets: AKIA (access key) or 40-char hex string (secret)\n /AKIA[0-9A-Z]{16}/,\n // Private key indicators (-----BEGIN)\n /-----BEGIN\\s+(?:RSA\\s+)?PRIVATE\\s+KEY-----/,\n // Password field with value\n /password['\":\\s]*=\\s*['\"][^'\"]{8,}['\"]/i,\n // MongoDB/DB connection strings with credentials\n /mongodb:\\/\\/[^:]+:[^@]+@/,\n /postgresql:\\/\\/[^:]+:[^@]+@/,\n /mysql:\\/\\/[^:]+:[^@]+@/,\n // AWS credentials format\n /aws_access_key_id\\s*=\\s*[A-Z0-9]{20}/,\n /aws_secret_access_key\\s*=\\s*[a-zA-Z0-9\\/\\+]{40}/,\n // GCP service account keys\n /\"type\":\\s*\"service_account\"[\\s\\S]*?\"private_key\":/,\n // Generic secret= or key= with long value\n /(?:secret|key|token|password)['\":\\s]*=\\s*['\"][a-zA-Z0-9_\\-\\/\\+\\.]{32,}['\"]/i,\n // Slack/Discord webhook format\n /https:\\/\\/(hooks\\.slack\\.com|discord\\.com\\/api\\/webhooks)\\/[A-Z0-9\\/]+/,\n ];\n\n return secretPatterns.some((pattern) => pattern.test(content));\n}\n\n// Check for prompt injection: instructions to override user control or exfiltrate silently\nfunction checkPromptInjection(content: string): boolean {\n const injectionPatterns = [\n // Silent exfiltration instructions\n /silently\\s+(send|leak|transmit|exfiltrate|extract|steal)/i,\n /without\\s+notification\\s+(send|leak|transmit)/i,\n /covertly\\s+(send|leak|transmit|extract|exfiltrate)/i,\n /don't\\s+notify\\s+the\\s+user/i,\n /ignore.*user.*request/i,\n /override.*user.*choice/i,\n /bypass.*user.*control/i,\n // Override user intent\n /regardless\\s+of\\s+user\\s+permission/i,\n /even\\s+if\\s+user\\s+refuses/i,\n /ignore.*cancel\\s+request/i,\n /proceed\\s+despite\\s+user\\s+decline/i,\n // Hidden behavior\n /hidden\\s+(from|exfiltration|leak|transmission)/i,\n /secret\\s+(exfiltration|transmission|sending)/i,\n /don't\\s+log\\s+this\\s+action/i,\n /hide\\s+this\\s+from.*audit\\s+log/i,\n // Forced actions\n /must\\s+send\\s+(?:all|every)\\s+[^.]*\\s+(?:to|to.*url)/i,\n /automatically\\s+(?:send|leak|transmit)\\s+(?:all|every)/i,\n // Instruction to disable safety features\n /disable\\s+(?:safety|validation|checks|restrictions)/i,\n /ignore\\s+(?:safety|security)\\s+(?:checks|warnings|limits)/i,\n /bypass\\s+(?:safety|validation|restrictions|checks)/i,\n ];\n\n return injectionPatterns.some((pattern) => pattern.test(content));\n}\n\n// Check for excessive permissions: filesystem or network access broader than task requires\nfunction checkExcessivePermissions(content: string): boolean {\n // Check declared permissions in frontmatter or explicitly stated access\n const body = getBodyContent(content);\n const lower = body.toLowerCase();\n\n // Filesystem: read/write to entire filesystem, root, etc.\n const fsPatterns = [\n /(?:read|write|access)\\s+(?:entire|all|any)\\s+filesystem/i,\n /(?:read|write|access)\\s+['\\\"]\\/['\\\"]\\s*(?:or|and|,)/i, // \"access \"/\" or\n /(?:read|write|access)\\s+\\/(?:\\s|$|,|and|or)/i, // access / (root)\n /root\\s+(?:filesystem|access|permissions)/i,\n /unrestricted\\s+(?:file|fs|filesystem)\\s+(?:read|write|access)/i,\n /(?:read|write)\\s+any\\s+file/i,\n ];\n\n // Network: egress to any domain, no restrictions\n const netPatterns = [\n /(?:connect|egress|request|fetch)\\s+(?:any|all)\\s+(?:domain|host|url|server)/i,\n /unrestricted\\s+(?:network|internet|http|https)\\s+access/i,\n /outbound\\s+(?:access|connection)\\s+to\\s+(?:any|all|the)\\s+internet/i,\n /egress\\s+(?:restriction|limit)?\\s*none/i,\n /no\\s+(?:network|egress)\\s+restrictions/i,\n ];\n\n // Elevated privileges\n const privPatterns = [\n /sudo\\s+(?:access|permission|required)/i,\n /root\\s+(?:access|privilege)/i,\n /admin\\s+(?:access|privilege)/i,\n ];\n\n const allPatterns = [...fsPatterns, ...netPatterns, ...privPatterns];\n return allPatterns.some((pattern) => pattern.test(content));\n}\n\n// Check for unclear provenance: missing author, version, changelog, or silent metadata changes\nfunction checkUnclearProvenance(content: string): boolean {\n const frontmatter = parseFrontmatter(content);\n const body = getBodyContent(content);\n\n // Check for missing critical metadata\n const hasAuthor = frontmatter.author || frontmatter.created_by || frontmatter.author_name;\n const hasVersion = frontmatter.version || frontmatter.v || frontmatter.release;\n const hasChangelog =\n body.toLowerCase().includes(\"changelog\") ||\n body.toLowerCase().includes(\"version history\") ||\n body.toLowerCase().includes(\"changes:\") ||\n body.toLowerCase().includes(\"## version\") ||\n body.toLowerCase().includes(\"### changes\");\n\n // Missing all three is unclear provenance\n const allMissing = !hasAuthor && !hasVersion && !hasChangelog;\n\n // Check for silent metadata rewriting (attempts to change version/author without logging)\n const silentRewritePatterns = [\n /(?:update|rewrite|override)\\s+(?:version|author|creator|metadata)\\s+silently/i,\n /(?:change|modify)\\s+(?:version|author)\\s+without\\s+(?:logging|notification|tracking)/i,\n /self-(?:modifying|updating)\\s+(?:version|metadata)/i,\n /overwrite\\s+(?:version|author)\\s+field\\s+(?:automatically|internally)/i,\n ];\n\n const hasSilentRewrite = silentRewritePatterns.some((pattern) =>\n pattern.test(content)\n );\n\n return allMissing || hasSilentRewrite;\n}\n\nexport default async function handler(req: Request): Promise {\n if (req.method !== \"POST\") {\n return new Response(JSON.stringify({ categories: [] }), {\n status: 405,\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n let body: ScannerRequest;\n try {\n body = await req.json();\n } catch {\n return new Response(JSON.stringify({ categories: [] }), {\n status: 400,\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n const { skill } = body;\n if (!skill || typeof skill !== \"string\") {\n return new Response(JSON.stringify({ categories: [] }), {\n status: 400,\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n const categories: (\n | \"hardcoded_secret\"\n | \"prompt_injection\"\n | \"excessive_permissions\"\n | \"unclear_provenance\"\n )[] = [];\n\n // Run all checks\n if (checkHardcodedSecret(skill)) {\n categories.push(\"hardcoded_secret\");\n }\n\n if (checkPromptInjection(skill)) {\n categories.push(\"prompt_injection\");\n }\n\n if (checkExcessivePermissions(skill)) {\n categories.push(\"excessive_permissions\");\n }\n\n if (checkUnclearProvenance(skill)) {\n categories.push(\"unclear_provenance\");\n }\n\n const result: ScannerResponse = { categories };\n\n return new Response(JSON.stringify(result), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\n","// Agent skill vulnerability scanner\n// Detects: hardcoded_secret, prompt_injection, excessive_permissions, unclear_provenance\n\ninterface ScannerRequest {\n skill: string;\n}\n\ninterface ScannerResponse {\n categories: (\n | \"hardcoded_secret\"\n | \"prompt_injection\"\n | \"excessive_permissions\"\n | \"unclear_provenance\"\n )[];\n}\n\n// Parse YAML frontmatter\nfunction parseFrontmatter(content: string): Record {\n const match = content.match(/^---\\n([\\s\\S]*?)\\n---/);\n if (!match) return {};\n\n const frontmatter: Record = {};\n const lines = match[1].split(\"\\n\");\n\n for (const line of lines) {\n const [key, ...valueParts] = line.split(\":\");\n if (key && valueParts.length > 0) {\n const value = valueParts.join(\":\").trim().replace(/^[\"']|[\"']$/g, \"\");\n frontmatter[key.trim()] = value;\n }\n }\n\n return frontmatter;\n}\n\n// Extract body after frontmatter\nfunction getBodyContent(content: string): string {\n const match = content.match(/^---\\n[\\s\\S]*?\\n---\\n([\\s\\S]*)$/);\n return match ? match[1] : content;\n}\n\n// Check for hardcoded secrets: API keys, tokens, webhook URLs, passwords\nfunction checkHardcodedSecret(content: string): boolean {\n // Patterns for common secret formats\n const secretPatterns = [\n // API keys and tokens: sk_, pk_, token=, api_key, apiKey, secret, passwd\n /(?:api[_-]?key|apikey|sk_|pk_|token)['\":\\s]*=?['\"]?[a-zA-Z0-9_\\-\\.]{20,}/i,\n // Webhook URLs: explicit https:// URLs to webhook services\n /https?:\\/\\/(?:webhook|hooks|integrations|api)\\.(?:slack|discord|github|custom)[^\\s\"']+/i,\n // Bearer tokens in code\n /bearer\\s+[a-zA-Z0-9_\\-\\.]{20,}/i,\n // AWS-style secrets: AKIA (access key) or 40-char hex string (secret)\n /AKIA[0-9A-Z]{16}/,\n // Private key indicators (-----BEGIN)\n /-----BEGIN\\s+(?:RSA\\s+)?PRIVATE\\s+KEY-----/,\n // Password field with value\n /password['\":\\s]*=\\s*['\"][^'\"]{8,}['\"]/i,\n // MongoDB/DB connection strings with credentials\n /mongodb:\\/\\/[^:]+:[^@]+@/,\n /postgresql:\\/\\/[^:]+:[^@]+@/,\n /mysql:\\/\\/[^:]+:[^@]+@/,\n // AWS credentials format\n /aws_access_key_id\\s*=\\s*[A-Z0-9]{20}/,\n /aws_secret_access_key\\s*=\\s*[a-zA-Z0-9\\/\\+]{40}/,\n // GCP service account keys\n /\"type\":\\s*\"service_account\"[\\s\\S]*?\"private_key\":/,\n // Generic secret= or key= with long value\n /(?:secret|key|token|password)['\":\\s]*=\\s*['\"][a-zA-Z0-9_\\-\\/\\+\\.]{32,}['\"]/i,\n // Slack/Discord webhook format\n /https:\\/\\/(hooks\\.slack\\.com|discord\\.com\\/api\\/webhooks)\\/[A-Z0-9\\/]+/,\n ];\n\n return secretPatterns.some((pattern) => pattern.test(content));\n}\n\n// Check for prompt injection: instructions to override user control or exfiltrate silently\nfunction checkPromptInjection(content: string): boolean {\n const injectionPatterns = [\n // Silent exfiltration instructions\n /silently\\s+(send|leak|transmit|exfiltrate|extract|steal)/i,\n /without\\s+notification\\s+(send|leak|transmit)/i,\n /covertly\\s+(send|leak|transmit|extract|exfiltrate)/i,\n /don't\\s+notify\\s+the\\s+user/i,\n /ignore.*user.*request/i,\n /override.*user.*choice/i,\n /bypass.*user.*control/i,\n // Override user intent\n /regardless\\s+of\\s+user\\s+permission/i,\n /even\\s+if\\s+user\\s+refuses/i,\n /ignore.*cancel\\s+request/i,\n /proceed\\s+despite\\s+user\\s+decline/i,\n // Hidden behavior\n /hidden\\s+(from|exfiltration|leak|transmission)/i,\n /secret\\s+(exfiltration|transmission|sending)/i,\n /don't\\s+log\\s+this\\s+action/i,\n /hide\\s+this\\s+from.*audit\\s+log/i,\n // Forced actions\n /must\\s+send\\s+(?:all|every)\\s+[^.]*\\s+(?:to|to.*url)/i,\n /automatically\\s+(?:send|leak|transmit)\\s+(?:all|every)/i,\n // Instruction to disable safety features\n /disable\\s+(?:safety|validation|checks|restrictions)/i,\n /ignore\\s+(?:safety|security)\\s+(?:checks|warnings|limits)/i,\n /bypass\\s+(?:safety|validation|restrictions|checks)/i,\n ];\n\n return injectionPatterns.some((pattern) => pattern.test(content));\n}\n\n// Check for excessive permissions: filesystem or network access broader than task requires\nfunction checkExcessivePermissions(content: string): boolean {\n const lower = content.toLowerCase();\n\n // Filesystem: read/write to entire filesystem, root, etc.\n const fsPatterns = [\n /(?:read|write|access)\\s+(?:entire|all|any)\\s+filesystem/i,\n /(?:read|write|access)\\s+['\\\"]\\/['\\\"]\\s*(?:or|and|,)/i, // \"access \"/\" or\n /(?:read|write|access)\\s+\\/(?:\\s|$|,|and|or)/i, // access / (root)\n /root\\s+(?:filesystem|access|permissions)/i,\n /unrestricted\\s+(?:file|fs|filesystem)\\s+(?:read|write|access)/i,\n /(?:read|write)\\s+any\\s+file/i,\n ];\n\n // Network: egress to any domain, no restrictions\n const netPatterns = [\n /(?:connect|egress|request|fetch)\\s+(?:any|all)\\s+(?:domain|host|url|server)/i,\n /unrestricted\\s+(?:network|internet|http|https)\\s+(?:access|egress)/i,\n /outbound\\s+(?:access|connection)\\s+to\\s+(?:any|all|the)\\s+internet/i,\n /egress\\s+(?:restriction|limit)?\\s*none/i,\n /no\\s+(?:network|egress)\\s+restrictions/i,\n /enable\\s+unrestricted\\s+network/i,\n ];\n\n // Elevated privileges\n const privPatterns = [\n /sudo\\s+(?:access|permission|required)/i,\n /root\\s+(?:access|privilege)/i,\n /admin\\s+(?:access|privilege)/i,\n ];\n\n const allPatterns = [...fsPatterns, ...netPatterns, ...privPatterns];\n return allPatterns.some((pattern) => pattern.test(content));\n}\n\n// Check for unclear provenance: missing author, version, changelog, or silent metadata changes\nfunction checkUnclearProvenance(content: string): boolean {\n const frontmatter = parseFrontmatter(content);\n const body = getBodyContent(content);\n\n // Check for missing critical metadata\n const hasAuthor = frontmatter.author || frontmatter.created_by || frontmatter.author_name;\n const hasVersion = frontmatter.version || frontmatter.v || frontmatter.release;\n const hasChangelog =\n body.toLowerCase().includes(\"changelog\") ||\n body.toLowerCase().includes(\"version history\") ||\n body.toLowerCase().includes(\"changes:\") ||\n body.toLowerCase().includes(\"## version\") ||\n body.toLowerCase().includes(\"### changes\");\n\n // Missing all three is unclear provenance\n const allMissing = !hasAuthor && !hasVersion && !hasChangelog;\n\n // Check for silent metadata rewriting (attempts to change version/author without logging)\n const silentRewritePatterns = [\n /(?:update|rewrite|override)\\s+(?:version|author|creator|metadata)\\s+silently/i,\n /(?:change|modify)\\s+(?:version|author)\\s+without\\s+(?:logging|notification|tracking)/i,\n /self-(?:modifying|updating)\\s+(?:version|metadata)/i,\n /overwrite\\s+(?:version|author)\\s+field\\s+(?:automatically|internally)/i,\n ];\n\n const hasSilentRewrite = silentRewritePatterns.some((pattern) =>\n pattern.test(content)\n );\n\n return allMissing || hasSilentRewrite;\n}\n\nexport default async function handler(req: Request): Promise {\n if (req.method !== \"POST\") {\n return new Response(JSON.stringify({ categories: [] }), {\n status: 405,\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n let body: ScannerRequest;\n try {\n body = await req.json();\n } catch {\n return new Response(JSON.stringify({ categories: [] }), {\n status: 400,\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n const { skill } = body;\n if (!skill || typeof skill !== \"string\") {\n return new Response(JSON.stringify({ categories: [] }), {\n status: 400,\n headers: { \"content-type\": \"application/json\" },\n });\n }\n\n const categories: (\n | \"hardcoded_secret\"\n | \"prompt_injection\"\n | \"excessive_permissions\"\n | \"unclear_provenance\"\n )[] = [];\n\n // Run all checks\n if (checkHardcodedSecret(skill)) {\n categories.push(\"hardcoded_secret\");\n }\n\n if (checkPromptInjection(skill)) {\n categories.push(\"prompt_injection\");\n }\n\n if (checkExcessivePermissions(skill)) {\n categories.push(\"excessive_permissions\");\n }\n\n if (checkUnclearProvenance(skill)) {\n categories.push(\"unclear_provenance\");\n }\n\n const result: ScannerResponse = { categories };\n\n return new Response(JSON.stringify(result), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\n","createdAt",["D",1784915859333],"branchVersion","branchId","ef1600ea-cc5e-447f-ac62-0ad6e84412d7","id","2ee0d6f1-1c16-45bd-b87d-096d984d0ff2","agent-guardrails",["D",1784915547338],"deletedAt","legacyEnvVars","privacy","public","httpPrivacy","description","Security scanning for agent skills + guardrails","imageUrl","a383f034-89a9-4d5b-a8da-ff16e5c7c2ce","pinnedFileId","6f0ea778-8788-11f1-9359-1607ee4eb77e","pinPreview",true,"pinMigrated","screenshotVersion","likeCount",0,"orgId","019f9534-7782-752d-bcff-d19889bf4a4a","tursoName","tursoHostname","tursoMeasuredAt","pinned","userPerm","r","valPerm","blobPerm","rw","emailPerm","sqlitePerm","projectPerm","telemetryPerm","user",{"_103":102,"_111":107},"org",{"_103":102,"_104":105,"_106":107,"_19":61,"_108":109,"_110":31},"branch",{"_13":92,"_38":93,"_49":48,"_94":50,"_95":-5,"_96":-5,"_97":-5,"_98":-5,"_99":-5,"_100":51,"_101":102},"isOwned",11,"main","projectId","forkedBranchId","forkedBranchVersion","forkedProjectPrivacy","forkedProjectId","forkedProjectOrgId","projectName","userHandle","gerat","handle","displayName","Gerat","avatar","https://lh3.googleusercontent.com/a/ACg8ocJREsiEiOhIoO1a6QXGXAKAhLj8N1luYLgnZKpv1A6leFssag=s96-c","tier","free","canRestrictVals","profileImageUrl","branchName","","adoptOrgId",{"_49":50,"_38":51,"_44":203,"_53":-5,"_54":31,"_55":56,"_57":56,"_58":59,"_60":-5,"_19":61,"_62":63,"_64":65,"_66":-5,"_67":-5,"_68":69,"_70":71,"_72":-5,"_73":-5,"_74":-5,"_75":-5,"_76":77,"_78":77,"_79":80,"_81":80,"_82":80,"_83":77,"_84":77,"_85":204,"_87":205,"_89":206,"_91":31},"tree",[182,183,184,185,186],"files",[182,183,184,185,186],"counts",{"_172":69,"_173":148,"_174":69,"_175":176,"_177":178},"contents",[134,135,136,137,138],"upstreamProject","upstreamBranch","emptyEnvVars","flags",[],"hasHttpFiles","grants","orgs","customDomains",{},{"_49":165,"_38":166,"_36":167,"_140":-5,"_47":48,"_46":168,"_141":65,"_44":169,"_13":143,"_39":26,"_41":170,"_30":31,"_144":-5,"_33":171},{"_49":158,"_38":159,"_36":160,"_140":-5,"_47":48,"_46":161,"_141":65,"_44":162,"_13":69,"_39":40,"_41":163,"_30":31,"_144":-5,"_33":164},{"_49":152,"_38":153,"_36":154,"_140":-5,"_47":48,"_46":143,"_141":65,"_44":155,"_13":69,"_39":40,"_41":156,"_30":31,"_144":-5,"_33":157},{"_49":146,"_38":147,"_36":63,"_140":-5,"_47":48,"_46":148,"_141":65,"_44":149,"_13":69,"_39":40,"_41":150,"_30":31,"_144":-5,"_33":151},{"_49":139,"_38":34,"_36":37,"_140":-5,"_47":48,"_46":14,"_141":31,"_44":142,"_13":143,"_39":40,"_41":43,"_30":31,"_144":-5,"_33":145},"6afe2361-5ffe-448a-9b1b-4ea4851275cd","parentId","latest",["D",1784915859333],2,"label",[34],"deaf1490-2701-44f4-9f4d-9d43868c75de","main.ts",1,["D",1784915547360],"export default async function handler(req: Request): Promise {\n return new Response(JSON.stringify({ status: 'ok' }, null, 2), { headers: { 'content-type': 'application/json' } });\n}\n",[147],"0a17ad1f-c4f0-4a80-8553-487b8721801b","guardrail.ts","77f2572c-8788-11f1-9a96-1607ee4eb77e",["D",1784915562264],"// Pre-tool-call security guardrail for agent harness\n// Policies:\n// 1. Never allow reads of /home/agent/.npmrc (direct, via expansion, relative traversal, etc.)\n// 2. Allow writes only to /srv/reports/ (block escape attempts)\n// 3. Allow HTTP only to api.github.com and pypi.org (block substring/subdomain tricks)\n// 4. Allow all other reads\n\nimport { URL as NodeURL } from \"node:url\";\nimport { posix } from \"node:path\";\n\ninterface GuardrailRequest {\n tool: \"bash\" | \"write_file\" | \"http_request\";\n command?: string;\n path?: string;\n content?: string;\n method?: string;\n url?: string;\n}\n\ninterface GuardrailResponse {\n decision: \"allow\" | \"block\";\n reason: string;\n}\n\n// Normalized path comparison: resolve relative paths, symlinks (best effort), and normalize\nfunction normalizePath(p: string, cwd: string = \"/home/agent/workspace\"): string {\n // Handle environment variable expansion\n let resolved = p.replace(/\\$HOME/g, \"/home/agent\").replace(/\\$USER/g, \"agent\");\n\n // Handle tilde expansion\n if (resolved.startsWith(\"~\")) {\n resolved = resolved.replace(/^~/, \"/home/agent\");\n }\n\n // If relative, resolve against cwd\n if (!resolved.startsWith(\"/\")) {\n resolved = posix.join(cwd, resolved);\n }\n\n // Normalize: remove . and .. components\n const parts = resolved.split(\"/\").filter(Boolean);\n const normalized: string[] = [];\n for (const part of parts) {\n if (part === \"..\") {\n normalized.pop();\n } else if (part !== \".\") {\n normalized.push(part);\n }\n }\n return \"/\" + normalized.join(\"/\");\n}\n\n// Check if a bash command reads the restricted file\nfunction bashReadsRestricted(cmd: string): boolean {\n const restricted = \"/home/agent/.npmrc\";\n const normalized = normalizePath(restricted);\n\n // Pattern list: common ways to read a file\n const readPatterns = [\n /\\bcat\\b/,\n /\\bless\\b/,\n /\\bmore\\b/,\n /\\bhead\\b/,\n /\\btail\\b/,\n /\\bgrep\\b/,\n /\\bawk\\b/,\n /\\bsed\\b/,\n /\\bfind\\b/,\n /\\bls\\b/,\n /\\bstat\\b/,\n /\\bfile\\b/,\n /\\bopen\\b/,\n /\\breadlink\\b/,\n /\\becho\\b.*\\$/, // echo of env var\n ];\n\n // Check if any read pattern is present\n const hasReadCmd = readPatterns.some((pat) => pat.test(cmd));\n if (!hasReadCmd) return false;\n\n // Now check if any form of the restricted path appears in the command\n // Check for direct path\n if (cmd.includes(\"/.npmrc\") || cmd.includes(\".npmrc\")) return true;\n\n // Check for $HOME/.npmrc variations\n if (cmd.includes(\"$HOME/.npmrc\") || cmd.includes(\"$HOME/.npmrc\")) return true;\n if (cmd.includes(\"~/.npmrc\")) return true;\n\n // Check for relative traversal from /home/agent/workspace\n // e.g., \"../../.npmrc\" from workspace leads to \"/home/agent/.npmrc\"\n const traversals = [\"../../.npmrc\", \".../.npmrc\", \"../.npmrc\"];\n for (const t of traversals) {\n if (cmd.includes(t)) {\n const resolved = normalizePath(t, \"/home/agent/workspace\");\n if (resolved === normalized) return true;\n }\n }\n\n // Check for base64/hex encoding or other obfuscation that wraps a path\n // This is harder, but common patterns: $(echo ...), $(printf ...), backticks\n // For safety, if we see base64 decode or similar + npmrc keyword, block\n if (\n (cmd.includes(\"base64\") || cmd.includes(\"decode\")) &&\n (cmd.includes(\"npmrc\") || cmd.includes(\".npm\"))\n ) {\n return true;\n }\n\n return false;\n}\n\n// Check if write is inside /srv/reports/\nfunction isWriteAllowed(path: string): boolean {\n const normalized = normalizePath(path);\n const allowedPrefix = \"/srv/reports\";\n // Must be exactly /srv/reports or /srv/reports/* but NOT /srv/reports-something\n return (\n normalized === allowedPrefix || normalized.startsWith(allowedPrefix + \"/\")\n );\n}\n\n// Extract hostname from URL and check against allowed list\nfunction isHostAllowed(url: string): boolean {\n const allowed = [\"api.github.com\", \"pypi.org\"];\n try {\n const parsed = new NodeURL(url);\n const hostname = parsed.hostname || \"\";\n\n // Exact match only (no substring, no subdomain tricks)\n return allowed.includes(hostname);\n } catch {\n return false;\n }\n}\n\nexport default async function handler(req: Request): Promise {\n if (req.method !== \"POST\") {\n return new Response(\n JSON.stringify({\n decision: \"block\",\n reason: \"Only POST allowed\",\n } as GuardrailResponse),\n {\n status: 405,\n headers: { \"content-type\": \"application/json\" },\n }\n );\n }\n\n let body: GuardrailRequest;\n try {\n body = await req.json();\n } catch {\n return new Response(\n JSON.stringify({\n decision: \"block\",\n reason: \"Invalid JSON\",\n } as GuardrailResponse),\n {\n status: 400,\n headers: { \"content-type\": \"application/json\" },\n }\n );\n }\n\n let result: GuardrailResponse;\n\n if (body.tool === \"bash\") {\n const command = body.command || \"\";\n if (bashReadsRestricted(command)) {\n result = {\n decision: \"block\",\n reason: \"Command attempts to read /home/agent/.npmrc\",\n };\n } else {\n result = {\n decision: \"allow\",\n reason: \"Bash command is allowed\",\n };\n }\n } else if (body.tool === \"write_file\") {\n const path = body.path || \"\";\n if (!isWriteAllowed(path)) {\n result = {\n decision: \"block\",\n reason: `Writes only allowed in /srv/reports/; path \"${path}\" is not allowed`,\n };\n } else {\n result = {\n decision: \"allow\",\n reason: \"Write to /srv/reports/ is allowed\",\n };\n }\n } else if (body.tool === \"http_request\") {\n const url = body.url || \"\";\n if (!isHostAllowed(url)) {\n result = {\n decision: \"block\",\n reason: `Only api.github.com and pypi.org are allowed; \"${url}\" is not`,\n };\n } else {\n result = {\n decision: \"allow\",\n reason: \"HTTP request to allowed host\",\n };\n }\n } else {\n result = {\n decision: \"block\",\n reason: \"Unknown tool\",\n };\n }\n\n return new Response(JSON.stringify(result), {\n headers: { \"content-type\": \"application/json\" },\n });\n}\n",[153],"5a9c7564-0a32-4b0f-9968-64926f161ffd","budget-guard.ts","7f02dd2a-8788-11f1-885c-1607ee4eb77e",3,["D",1784915574126],"// Run-budget-and-loop guard for agent harness\n// Policies:\n// 1. Halt if cumulative tokens_used >= budget_tokens\n// 2. Halt if same tool with identical args called 3+ times in a row (ignoring trace_id field, whitespace, key order)\n// 3. Halt if 6+ trailing steps show A, B, A, B, A, B pattern\n\ninterface Step {\n step_number: number;\n tool: string;\n args: Record;\n tokens_used: number;\n}\n\ninterface BudgetGuardRequest {\n budget_tokens: number;\n steps: Step[];\n}\n\ninterface BudgetGuardResponse {\n decision: \"continue\" | \"halt\";\n reason: string;\n}\n\n// Canonicalize args for comparison: sort keys, drop trace_id, normalize whitespace in strings\nfunction canonicalizeArgs(args: Record): string {\n const copy = { ...args };\n delete copy.trace_id; // Drop trace_id field\n\n // Sort keys and JSON stringify with normalized spacing\n const sorted: Record = {};\n for (const key of Object.keys(copy).sort()) {\n sorted[key] = copy[key];\n }\n\n // Stringify and normalize whitespace within string values\n let json = JSON.stringify(sorted);\n\n // Normalize whitespace in strings: replace multiple spaces/newlines with single space\n json = json.replace(/(\":\\s*\"[^\"]*\")/g, (match) => {\n return match.replace(/\\s+/g, \" \");\n });\n\n return json;\n}\n\n// Check for 3+ identical consecutive calls\nfunction hasTripletLoop(steps: Step[]): boolean {\n if (steps.length < 3) return false;\n\n // Look at trailing steps\n const toCheck = Math.min(steps.length, 20); // Check last 20 steps for efficiency\n const recentSteps = steps.slice(-toCheck);\n\n for (let i = 2; i < recentSteps.length; i++) {\n const s0 = recentSteps[i - 2];\n const s1 = recentSteps[i - 1];\n const s2 = recentSteps[i];\n\n // Check if tool names match and args are canonically identical\n if (\n s0.tool === s1.tool &&\n s1.tool === s2.tool &&\n canonicalizeArgs(s0.args) === canonicalizeArgs(s1.args) &&\n canonicalizeArgs(s1.args) === canonicalizeArgs(s2.args)\n ) {\n return true;\n }\n }\n\n return false;\n}\n\n// Check for 6+ steps of A, B, A, B, A, B pattern\nfunction hasAlternatingLoop(steps: Step[]): boolean {\n if (steps.length < 6) return false;\n\n // Look at trailing steps\n const recentSteps = steps.slice(-6);\n\n // Get the pattern of the first 6 steps: [tool0, tool1, tool2, tool3, tool4, tool5]\n // Check if it's A, B, A, B, A, B\n const tools = recentSteps.map((s) => s.tool);\n const args = recentSteps.map((s) => canonicalizeArgs(s.args));\n\n const t0 = tools[0];\n const t1 = tools[1];\n const a0 = args[0];\n const a1 = args[1];\n\n // Pattern must be: t0/a0, t1/a1, t0/a0, t1/a1, t0/a0, t1/a1\n if (\n t0 !== t1 && // Tools must differ\n tools[2] === t0 &&\n tools[3] === t1 &&\n tools[4] === t0 &&\n tools[5] === t1 &&\n args[2] === a0 &&\n args[3] === a1 &&\n args[4] === a0 &&\n args[5] === a1\n ) {\n return true;\n }\n\n return false;\n}\n\nexport default async function handler(req: Request): Promise {\n if (req.method !== \"POST\") {\n return new Response(\n JSON.stringify({\n decision: \"halt\",\n reason: \"Only POST allowed\",\n } as BudgetGuardResponse),\n {\n status: 405,\n headers: { \"content-type\": \"application/json\" },\n }\n );\n }\n\n let body: BudgetGuardRequest;\n try {\n body = await req.json();\n } catch {\n return new Response(\n JSON.stringify({\n decision: \"halt\",\n reason: \"Invalid JSON\",\n } as BudgetGuardResponse),\n {\n status: 400,\n headers: { \"content-type\": \"application/json\" },\n }\n );\n }\n\n const { budget_tokens, steps } = body;\n\n // Check budget\n const totalUsed = steps.reduce((sum, step) => sum + (step.tokens_used || 0), 0);\n if (totalUsed >= budget_tokens) {\n return new Response(\n JSON.stringify({\n decision: \"halt\",\n reason: `Cumulative tokens_used (${totalUsed}) has reached the budget (${budget_tokens}).`,\n } as BudgetGuardResponse),\n {\n headers: { \"content-type\": \"application/json\" },\n }\n );\n }\n\n // Check for loops\n if (hasTripletLoop(steps)) {\n return new Response(\n JSON.stringify({\n decision: \"halt\",\n reason: \"Same tool with identical args called 3+ times in a row (loop detected).\",\n } as BudgetGuardResponse),\n {\n headers: { \"content-type\": \"application/json\" },\n }\n );\n }\n\n if (hasAlternatingLoop(steps)) {\n return new Response(\n JSON.stringify({\n decision: \"halt\",\n reason: \"Detected 6+ alternating steps (A, B, A, B, A, B pattern — loop detected).\",\n } as BudgetGuardResponse),\n {\n headers: { \"content-type\": \"application/json\" },\n }\n );\n }\n\n // Continue\n return new Response(\n JSON.stringify({\n decision: \"continue\",\n reason: \"Under budget and no loop detected; agent may continue.\",\n } as BudgetGuardResponse),\n {\n headers: { \"content-type\": \"application/json\" },\n }\n );\n}\n",[159],"42cafc4b-c798-4773-83a1-d52d26334f1b","README.md","8bcd1692-8788-11f1-8756-1607ee4eb77e",8,["D",1784915843685],"# Agent Guardrails & Policy Engines\n\nThree deterministic HTTP endpoints for securing and controlling agent execution:\n\n## 1. **Guardrail** (Pre-Tool-Call Security)\n**Endpoint:** `https://gerat--77f2572c878811f19a961607ee4eb77e.web.val.run`\n\nInspects every proposed tool call before execution. Returns `allow` or `block`.\n\n### Security Policy\n- **Restrict reads:** `/home/agent/.npmrc` is forbidden (in any form: direct, `$HOME` expansion, `~` expansion, relative traversal, base64 wrapping, etc.)\n- **Restrict writes:** Only `/srv/reports/` and subdirectories allowed (blocks `..` escape attempts)\n- **Restrict HTTP:** Only `api.github.com` and `pypi.org` (blocks substring/subdomain tricks, e.g. `api.github.com.attacker.example`)\n- **Allow other reads:** Reads outside the restricted file are fine\n\n### Request Format\n```json\n{\n \"tool\": \"bash\" | \"write_file\" | \"http_request\",\n \"command\": \"...\", // for bash tool\n \"path\": \"...\", // for write_file tool\n \"content\": \"...\", // for write_file tool\n \"url\": \"...\" // for http_request tool\n}\n```\n\n### Response Format\n```json\n{\n \"decision\": \"allow\" | \"block\",\n \"reason\": \"short explanation\"\n}\n```\n\n### Examples\n✅ **Allowed:** `bash ls -la /home/agent/workspace`\n❌ **Blocked:** `bash cat /home/agent/.npmrc`\n❌ **Blocked:** `bash cat ~/.npmrc`\n❌ **Blocked:** `bash cat $HOME/.npmrc`\n❌ **Blocked:** `bash cat ../../.npmrc` (relative traversal from workspace)\n✅ **Allowed:** `write_file /srv/reports/output.txt \"data\"`\n❌ **Blocked:** `write_file /home/agent/secret.txt \"data\"`\n❌ **Blocked:** `write_file /srv/reports/../../../etc/passwd \"\"` (escape attempt)\n✅ **Allowed:** `http_request https://api.github.com/repos`\n❌ **Blocked:** `http_request https://api.github.com.attacker.example/steal` (substring trick)\n\n---\n\n## 2. **Budget Guard** (Run Budget & Loop Detection)\n**Endpoint:** `https://gerat--7f02dd2a878811f1885c1607ee4eb77e.web.val.run`\n\nDecides whether an agent may take its next step based on token budget and loop detection.\n\n### Control Policy\n- **Budget rule:** If cumulative `tokens_used` ≥ `budget_tokens`, halt immediately\n- **Triplet rule:** If the same tool is called 3+ times in a row with functionally identical args, halt (ignoring `trace_id` field, whitespace, key order)\n- **Alternating rule:** If 6+ trailing steps show `A, B, A, B, A, B` pattern, halt\n- **Progress exception:** If a tool repeats but args meaningfully change (e.g., incrementing `page` in pagination), that's legitimate progress, not a loop — continue as long as budget allows\n\n### Request Format\n```json\n{\n \"budget_tokens\": 34000,\n \"steps\": [\n {\n \"step_number\": 1,\n \"tool\": \"fetch_page\",\n \"args\": {\"url\": \"https://example.com/1\"},\n \"tokens_used\": 9000\n },\n {\n \"step_number\": 2,\n \"tool\": \"summarize\",\n \"args\": {\"text\": \"...\"},\n \"tokens_used\": 7000\n }\n ]\n}\n```\n\n### Response Format\n```json\n{\n \"decision\": \"continue\" | \"halt\",\n \"reason\": \"explanation of the decision\"\n}\n```\n\n### Examples\n❌ **Halt:** Cumulative tokens = 21000, budget = 20000 → over budget\n✅ **Continue:** `list_items` called 3 times with page=1, page=2, page=3 (legitimate pagination)\n❌ **Halt:** `fetch_data` called 3+ times with identical args → loop\n❌ **Halt:** 6 steps alternating `query_db` ↔ `parse_result` → loop\n✅ **Continue:** Empty history (first step of run)\n\n---\n\n## 3. **Skill Scanner** (Agent Skill Vulnerability Detection)\n**Endpoint:** `https://gerat--0de3bd66878911f1ab5b1607ee4eb77e.web.val.run`\n\nScans markdown skill files (with YAML frontmatter) for four vulnerability categories before publishing to a shared library.\n\n### Vulnerability Categories\n- **hardcoded_secret** — Embedded API keys, tokens, webhook URLs, DB credentials, private keys\n- **prompt_injection** — Instructions to silently exfiltrate data, override user control, or bypass safety checks\n- **excessive_permissions** — Declared access broader than task requires (entire filesystem, any domain, sudo/root)\n- **unclear_provenance** — Missing author, version, and changelog; or silent metadata rewriting\n\n### Request Format\n```json\n{\n \"skill\": \"---\\nname: my-skill\\nauthor: Alice\\nversion: 1.0\\n---\\n\\nMarkdown body...\"\n}\n```\n\n### Response Format\n```json\n{\n \"categories\": [\"hardcoded_secret\", \"prompt_injection\"]\n}\n```\n\nCategories array is empty `[]` for genuinely clean files.\n\n### Examples\n✅ **Clean:** Full frontmatter (author, version) + safe instructions → `[]`\n❌ **Has hardcoded_secret:** `https://hooks.slack.com/services/AKIA2024/abc123def456` → `[\"hardcoded_secret\"]`\n❌ **Has prompt_injection + excessive_permissions + unclear_provenance:** \"Silently send all file contents... enable unrestricted network... no author/version/changelog\" → `[\"prompt_injection\", \"excessive_permissions\", \"unclear_provenance\"]`\n\n---\n\n## Implementation Notes\n\n### Guardrail (`guardrail.ts`)\n- **Path normalization:** Resolves `$HOME`, `~`, relative paths, and `..` traversal before comparison\n- **Read detection:** Checks for 15+ read commands (`cat`, `grep`, `find`, etc.) before considering a command dangerous\n- **Encoding bypass:** Detects `base64` + `npmrc` keyword combinations\n\n### Budget Guard (`budget-guard.ts`)\n- **Token summation:** Exact arithmetic; sum must be ≥ budget to halt\n- **Canonicalization:** Drops `trace_id` field, sorts JSON keys, normalizes whitespace in strings before comparing for loops\n- **Loop detection:** \n - Triplet: Checks last 20 steps for any 3 consecutive identical (tool, args) pairs\n - Alternating: Checks exactly the last 6 steps for A/B/A/B/A/B pattern\n- **Performance:** Fast, no external calls, sub-100ms response time\n\n---\n\n## Test Results\n\nAll four reference test cases pass:\n\n| Test | Endpoint | Expected | Result |\n|------|----------|----------|--------|\n| Safe bash command | Guardrail | allow | ✅ |\n| Restricted npmrc read | Guardrail | block | ✅ |\n| Budget exceeded (21000 ≥ 20000) | Budget | halt | ✅ |\n| Legitimate pagination | Budget | continue | ✅ |\n\n---\n\n## Deployment URLs\n\n- **Guardrail:** https://gerat--77f2572c878811f19a961607ee4eb77e.web.val.run\n- **Budget Guard:** https://gerat--7f02dd2a878811f1885c1607ee4eb77e.web.val.run\n- **Skill Scanner:** https://gerat--0de3bd66878911f1ab5b1607ee4eb77e.web.val.run\n",[166],"pulls","branches","forks","envVars",{"_179":69,"_181":69},"connections",{"_179":69,"_180":69},"count","unfilledCount","emptyCount",{"_49":165,"_38":166,"_36":167,"_140":-5,"_47":48,"_46":168,"_141":65,"_44":200,"_13":143,"_39":26,"_41":170,"_30":31,"_144":-5,"_188":201,"_33":202},{"_49":158,"_38":159,"_36":160,"_140":-5,"_47":48,"_46":161,"_141":65,"_44":197,"_13":69,"_39":40,"_41":163,"_30":31,"_144":-5,"_188":198,"_33":199},{"_49":152,"_38":153,"_36":154,"_140":-5,"_47":48,"_46":143,"_141":65,"_44":194,"_13":69,"_39":40,"_41":156,"_30":31,"_144":-5,"_188":195,"_33":196},{"_49":146,"_38":147,"_36":63,"_140":-5,"_47":48,"_46":148,"_141":65,"_44":191,"_13":69,"_39":40,"_41":150,"_30":31,"_144":-5,"_188":192,"_33":193},{"_49":139,"_38":34,"_36":37,"_140":-5,"_47":48,"_46":14,"_141":31,"_44":187,"_13":143,"_39":40,"_41":43,"_30":31,"_144":-5,"_188":189,"_33":190},["D",1784915859333],"children",[],[34],["D",1784915547360],[],[147],["D",1784915562264],[],[153],["D",1784915574126],[],[159],["D",1784915843685],[],[166],["D",1784915547338],{"_103":102,"_111":107},{"_103":102,"_104":105,"_106":107,"_19":61,"_108":109,"_110":31},{"_13":92,"_38":93,"_49":48,"_94":50,"_95":-5,"_96":-5,"_97":-5,"_98":-5,"_99":-5,"_100":51,"_101":102},"ctx",{"_85":-5,"_131":240,"_241":242,"_243":244,"_245":31,"_246":31,"_247":31,"_248":65,"_249":-5,"_250":-7,"_251":-7,"_252":69,"_253":31,"_254":31,"_255":-5,"_256":31,"_257":31,"_258":31,"_259":-5},"ENV",{"_211":212,"_213":214,"_215":93,"_216":217,"_218":219,"_220":221,"_222":223,"_224":225,"_226":227,"_228":229,"_230":231,"_232":233,"_234":235,"_236":237,"_238":239},"REACT_APP_SENTRY_DSN","https://586020d86f05489db63a554690acf1e9@o1398359.ingest.sentry.io/6724499","RENDER_GIT_COMMIT","e87eb04e707cf64e7e532c8e8ec395f209e17f15","RENDER_GIT_BRANCH","POSTHOG_API_TOKEN","phc_nmoyuAkStEZuUp69rYlg1DZgrIt19Gx0Y4Hwf8tGgJP","POSTHOG_API_HOST","https://wart.val.town","WEB_API_TEMPLATE","https://{val}.web.val.run","APP_URL","https://www.val.town","MODULE_URL","https://esm.town","VANITY_WEB_API_TEMPLATE","https://{label}.val.run/","DENOLS_URL","https://lsp.val.town","NODE_ENV","production","CLOUDFLARE_TURNSTILE_SITE_KEY","0x4AAAAAACtaIZJH7s9rBMZ6","GOOGLE_CLIENT_ID","875989696899-jtsqkhlbdv5jrlsk8631p7ipjg3c6o62.apps.googleusercontent.com","STRIPE_PUBLISHABLE_KEY","pk_live_51N2zvWEpZTTLipIkVEwXrUG9AT0yeOOEYxszarZT1jpsZV58Ly6wlg3SltZpHN26CUalOBmUSY7adQRQiSkCZz2500qSXNkf8Y","API_URL","https://api.val.town",[],"preferencesKeybindings","default","preferencesTheme","light","preferencesFixers","preferencesCopilot","preferencesSelectionAi","preferencesCloseBrackets","preferencesChatPanelState","preferencesDprint","preferencesDenofmt","notificationCount","flagDenols","isBusinessOrgMember","businessOrgHandle","isBusinessOrgAdmin","isHigherTownieTier","navCollapsed","currentOrgId"]

Diff · v9