feat(llm-security): v7.7.0 — HTML-rapport for alle 18 skill-kommandoer
Hver /security <cmd> som produserer rapport printer nå en klikkbar file://-lenke til en self-contained HTML-versjon. Levert over fem sesjoner; sesjon 5 wirer de 14 resterende skill-filene + slipper v7.7.0 (versjonsbump + docs). Sesjon-historikk: - Sesjon 1 (0dc7ff4) — playground katalog list-view + builder-pane med copy-knapp på alle 18 rapporter - Sesjon 2 (86d6ecd) — playground prosjekt-surface opprydding (stub-screen + topbar-splitt) - Sesjon 3 (fa5fb48) — extract 18 inline parsers + 18 inline renderers fra playground til canonical ESM-modul scripts/lib/report-renderers.mjs (playground beholder bit-identisk inline-kopi siden ESM import ikke fungerer fra file://) - Sesjon 4 (db80854) — ny zero-dep CLI scripts/render-report.mjs (stdin/file/stdout-modus, kebab→camel commandId-routing, ~140 KB self-contained HTML med 6 inlined DS-stylesheets + lokal .report-table, absolutte file://-paths for Ghostty cmd-click). 4 skills wired: scan, audit, posture, deep-scan. - Sesjon 5 (denne) — 14 resterende skills wired: plugin-audit, mcp-audit, mcp-inspect, ide-scan, supply-check, dashboard, pre-deploy, diff, watch, registry, clean, harden, threat-model, red-team. Hver skill-fil har nå en HTML Report-step som instruerer Claude å skrive markdown verbatim, kjøre CLI, og appende klikkbar file://-lenke til respons. Release-arbeid: - Versjonsbump v7.6.1 → v7.7.0 i 6 plugin-filer + 2 rot-filer (package.json, .claude-plugin/plugin.json, README badge, CLAUDE.md header + state-seksjon, docs/version-history.md, plugin Recent versions- tabell, rot README plugin-entry, rot CLAUDE.md plugin-katalog) - CHANGELOG [7.7.0] med full historikk fra sesjon 1-5 - docs/version-history.md v7.7.0-seksjon Verifisert: - 18/18 commandIds i CLI gir > 138 KB self-contained HTML - 1819/1820 tester grønne (pre-compact-scan-perf-flake fyrte under last, passerer i isolasjon på 1582 ms — pre-eksisterende, defer til v7.7.x) - 18/18 skill-filer har HTML Report-step - Ingen kildefil-treff på 7.6.1 utenfor historiske changelog/version- history/README releases-tabell Ingen scanner- eller hook-atferdsendringer — purely additive surface. Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
This commit is contained in:
parent
db80854830
commit
3b034d9266
22 changed files with 373 additions and 8 deletions
|
|
@ -59,3 +59,23 @@ Validate modified files (JSON parse, frontmatter, `node --check`). Restore from
|
|||
|
||||
Output: Pre/post comparison, all fix summaries, remaining manual findings, rollback instructions.
|
||||
- Dry-run: show "DRY-RUN" mode, list proposed changes without applying.
|
||||
|
||||
## Step 8: HTML Report
|
||||
|
||||
After producing the markdown clean report above:
|
||||
|
||||
1. Compute a temp markdown path:
|
||||
```bash
|
||||
node -p "require('path').join(require('os').tmpdir(), 'sec-clean-' + Date.now() + '.md')"
|
||||
```
|
||||
2. Use the Write tool to save the **entire markdown report you just produced** (pre/post comparison + applied/skipped/failed fix summaries + remaining manual findings + backup/rollback path) to that temp path. Verbatim.
|
||||
3. Run the renderer:
|
||||
```bash
|
||||
node <plugin-root>/scripts/render-report.mjs clean --in "<temp-md-path>"
|
||||
```
|
||||
The CLI writes `reports/clean-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
|
||||
4. Append to your response (markdown link, no bare URL):
|
||||
|
||||
> **HTML-rapport:** [Åpne i nettleser](file:///abs/path.html)
|
||||
|
||||
If the CLI exits non-zero, mention the error but do not block — the markdown report above is the primary deliverable.
|
||||
|
|
|
|||
|
|
@ -59,3 +59,23 @@ Sort the project table by grade (F first, A last), then by risk score descending
|
|||
- If machine grade is C: "Some projects need attention. Run `/security posture` in the worst-graded project."
|
||||
- If machine grade is D/F: "Significant exposure. Run `/security audit` in projects graded D/F."
|
||||
- If from_cache: "Results cached. Run `/security dashboard --fresh` for a live scan."
|
||||
|
||||
## Step 4: HTML Report
|
||||
|
||||
After producing the markdown dashboard above:
|
||||
|
||||
1. Compute a temp markdown path:
|
||||
```bash
|
||||
node -p "require('path').join(require('os').tmpdir(), 'sec-dashboard-' + Date.now() + '.md')"
|
||||
```
|
||||
2. Use the Write tool to save the **entire markdown dashboard you just produced** (header table with Machine Grade + Project Overview table + Errors + Recommendations) to that temp path. Verbatim.
|
||||
3. Run the renderer:
|
||||
```bash
|
||||
node <plugin-root>/scripts/render-report.mjs dashboard --in "<temp-md-path>"
|
||||
```
|
||||
The CLI writes `reports/dashboard-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
|
||||
4. Append to your response (markdown link, no bare URL):
|
||||
|
||||
> **HTML-rapport:** [Åpne i nettleser](file:///abs/path.html)
|
||||
|
||||
If the CLI exits non-zero, mention the error but do not block — the markdown dashboard above is the primary deliverable.
|
||||
|
|
|
|||
|
|
@ -96,3 +96,23 @@ Omit Unchanged findings from the output — they add noise. Mention count in sum
|
|||
- If resolved > new: "**Improving:** more findings resolved than introduced."
|
||||
- If new > 0 and resolved == 0: "**Regression:** X new findings, none resolved."
|
||||
- If new == 0 and resolved == 0: "**Stable:** no changes since baseline."
|
||||
|
||||
## Step 5: HTML Report
|
||||
|
||||
After producing the markdown diff report above:
|
||||
|
||||
1. Compute a temp markdown path:
|
||||
```bash
|
||||
node -p "require('path').join(require('os').tmpdir(), 'sec-diff-' + Date.now() + '.md')"
|
||||
```
|
||||
2. Use the Write tool to save the **entire markdown report you just produced** (banner with baseline+current timestamps + Summary table + New + Resolved + Moved sections + Advisory) to that temp path. Verbatim.
|
||||
3. Run the renderer:
|
||||
```bash
|
||||
node <plugin-root>/scripts/render-report.mjs diff --in "<temp-md-path>"
|
||||
```
|
||||
The CLI writes `reports/diff-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
|
||||
4. Append to your response (markdown link, no bare URL):
|
||||
|
||||
> **HTML-rapport:** [Åpne i nettleser](file:///abs/path.html)
|
||||
|
||||
If the CLI exits non-zero, mention the error but do not block — the markdown report above is the primary deliverable.
|
||||
|
|
|
|||
|
|
@ -70,3 +70,23 @@ If Grade A not achieved, explain remaining gaps (likely hook-related, which requ
|
|||
|
||||
- Grade A: "Configuration hardened. All posture checks pass."
|
||||
- Below A: "Configuration improved. Remaining gaps require [hooks/manual setup]. Run `/security posture` for details."
|
||||
|
||||
## Step 6: HTML Report
|
||||
|
||||
After producing the markdown harden report above:
|
||||
|
||||
1. Compute a temp markdown path:
|
||||
```bash
|
||||
node -p "require('path').join(require('os').tmpdir(), 'sec-harden-' + Date.now() + '.md')"
|
||||
```
|
||||
2. Use the Write tool to save the **entire markdown report you just produced** (Security Harden header + project metadata + Recommendations + Apply summary + post-apply grade + closing) to that temp path. Verbatim.
|
||||
3. Run the renderer:
|
||||
```bash
|
||||
node <plugin-root>/scripts/render-report.mjs harden --in "<temp-md-path>"
|
||||
```
|
||||
The CLI writes `reports/harden-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
|
||||
4. Append to your response (markdown link, no bare URL):
|
||||
|
||||
> **HTML-rapport:** [Åpne i nettleser](file:///abs/path.html)
|
||||
|
||||
If the CLI exits non-zero, mention the error but do not block — the markdown report above is the primary deliverable.
|
||||
|
|
|
|||
|
|
@ -104,3 +104,23 @@ If the user has many sideloaded (`source=vsix`) extensions: suggest re-installin
|
|||
- First run with no `--online` is fully offline.
|
||||
- Pass a single extracted extension directory to scan just one extension.
|
||||
- JetBrains plugins are additionally checked for `Premain-Class` javaagents, `application-components` lifecycle hooks, native binaries (`.so`/`.dylib`/`.dll`/`.jnilib`), long `<depends>` chains, typosquats vs top JetBrains plugins, and shaded-jar advisories (see `knowledge/ide-extension-threat-patterns.md`).
|
||||
|
||||
## Step 4: HTML Report
|
||||
|
||||
After producing the markdown IDE-scan report above:
|
||||
|
||||
1. Compute a temp markdown path:
|
||||
```bash
|
||||
node -p "require('path').join(require('os').tmpdir(), 'sec-ide-scan-' + Date.now() + '.md')"
|
||||
```
|
||||
2. Use the Write tool to save the **entire markdown report you just produced** (scanner header table + counts + Per-Extension Results table + Top Findings + Warnings + Recommendations + Notes) to that temp path. Verbatim.
|
||||
3. Run the renderer:
|
||||
```bash
|
||||
node <plugin-root>/scripts/render-report.mjs ide-scan --in "<temp-md-path>"
|
||||
```
|
||||
The CLI writes `reports/ide-scan-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
|
||||
4. Append to your response (markdown link, no bare URL):
|
||||
|
||||
> **HTML-rapport:** [Åpne i nettleser](file:///abs/path.html)
|
||||
|
||||
If the CLI exits non-zero, mention the error but do not block — the markdown report above is the primary deliverable.
|
||||
|
|
|
|||
|
|
@ -45,3 +45,23 @@ Parse JSON output. Append a **Live Inspection Results** section:
|
|||
- Tool shadowing across servers
|
||||
|
||||
**Cross-reference escalation:** If a server was rated "Untrusted" or "Dangerous" in Step 2 AND has live injection findings → escalate to CRITICAL priority in the final report and highlight as "Confirmed active threat (static + live)".
|
||||
|
||||
## Step 5: HTML Report
|
||||
|
||||
After producing the markdown MCP audit report (Step 3 + optional Step 4 Live Inspection):
|
||||
|
||||
1. Compute a temp markdown path:
|
||||
```bash
|
||||
node -p "require('path').join(require('os').tmpdir(), 'sec-mcp-audit-' + Date.now() + '.md')"
|
||||
```
|
||||
2. Use the Write tool to save the **entire markdown report you just produced** (MCP Landscape Summary + per-server analysis + Live Inspection Results section if `--live` + Keep/Review/Remove groupings + overall risk) to that temp path. Verbatim.
|
||||
3. Run the renderer:
|
||||
```bash
|
||||
node <plugin-root>/scripts/render-report.mjs mcp-audit --in "<temp-md-path>"
|
||||
```
|
||||
The CLI writes `reports/mcp-audit-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
|
||||
4. Append to your response (markdown link, no bare URL):
|
||||
|
||||
> **HTML-rapport:** [Åpne i nettleser](file:///abs/path.html)
|
||||
|
||||
If the CLI exits non-zero, mention the error but do not block — the markdown report above is the primary deliverable.
|
||||
|
|
|
|||
|
|
@ -52,3 +52,23 @@ If zero findings: "No injection, shadowing, or drift detected across N servers."
|
|||
## Step 4: Combined Use
|
||||
|
||||
Mention: "For combined static + live analysis, use `/security mcp-audit --live`."
|
||||
|
||||
## Step 5: HTML Report
|
||||
|
||||
After producing the markdown live-inspection report above:
|
||||
|
||||
1. Compute a temp markdown path:
|
||||
```bash
|
||||
node -p "require('path').join(require('os').tmpdir(), 'sec-mcp-inspect-' + Date.now() + '.md')"
|
||||
```
|
||||
2. Use the Write tool to save the **entire markdown report you just produced** (Live Inspection banner + Server Details table + Findings table + Advisory) to that temp path. Verbatim.
|
||||
3. Run the renderer:
|
||||
```bash
|
||||
node <plugin-root>/scripts/render-report.mjs mcp-inspect --in "<temp-md-path>"
|
||||
```
|
||||
The CLI writes `reports/mcp-inspect-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
|
||||
4. Append to your response (markdown link, no bare URL):
|
||||
|
||||
> **HTML-rapport:** [Åpne i nettleser](file:///abs/path.html)
|
||||
|
||||
If the CLI exits non-zero, mention the error but do not block — the markdown report above is the primary deliverable.
|
||||
|
|
|
|||
|
|
@ -72,3 +72,23 @@ If `clone_path != null`:
|
|||
|
||||
If `evidence_file != null`:
|
||||
Run: `node <plugin-root>/scanners/lib/fs-utils.mjs cleanup "<evidence_file>"`
|
||||
|
||||
## Step 7: HTML Report
|
||||
|
||||
After producing the markdown plugin-audit report (Step 5) and any cleanup (Step 6):
|
||||
|
||||
1. Compute a temp markdown path:
|
||||
```bash
|
||||
node -p "require('path').join(require('os').tmpdir(), 'sec-plugin-audit-' + Date.now() + '.md')"
|
||||
```
|
||||
2. Use the Write tool to save the **entire markdown report you just produced** (plugin metadata + component inventory + permission matrix + hook analysis + security findings + trust verdict) to that temp path. Verbatim.
|
||||
3. Run the renderer:
|
||||
```bash
|
||||
node <plugin-root>/scripts/render-report.mjs plugin-audit --in "<temp-md-path>"
|
||||
```
|
||||
The CLI writes `reports/plugin-audit-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
|
||||
4. Append to your response (markdown link, no bare URL):
|
||||
|
||||
> **HTML-rapport:** [Åpne i nettleser](file:///abs/path.html)
|
||||
|
||||
If the CLI exits non-zero, mention the error but do not block — the markdown report above is the primary deliverable.
|
||||
|
|
|
|||
|
|
@ -99,3 +99,23 @@ Map the pass count to a risk band and verdict:
|
|||
| 0-3/10 | Extreme | Critical risk — deployment blocked until fundamental controls are in place. |
|
||||
|
||||
State the verdict and risk band clearly at the end of the report.
|
||||
|
||||
## HTML Report
|
||||
|
||||
After producing the markdown pre-deploy checklist + verdict above:
|
||||
|
||||
1. Compute a temp markdown path:
|
||||
```bash
|
||||
node -p "require('path').join(require('os').tmpdir(), 'sec-pre-deploy-' + Date.now() + '.md')"
|
||||
```
|
||||
2. Use the Write tool to save the **entire markdown report you just produced** (10-row checklist table + Manual Verification + Recommendations + Verdict + risk band) to that temp path. Verbatim.
|
||||
3. Run the renderer:
|
||||
```bash
|
||||
node <plugin-root>/scripts/render-report.mjs pre-deploy --in "<temp-md-path>"
|
||||
```
|
||||
The CLI writes `reports/pre-deploy-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
|
||||
4. Append to your response (markdown link, no bare URL):
|
||||
|
||||
> **HTML-rapport:** [Åpne i nettleser](file:///abs/path.html)
|
||||
|
||||
If the CLI exits non-zero, mention the error but do not block — the markdown checklist above is the primary deliverable.
|
||||
|
|
|
|||
|
|
@ -93,3 +93,23 @@ In adaptive mode, also explain:
|
|||
- No network calls, no file modifications, no LLM invocations
|
||||
- Safe to run repeatedly — all state is cleaned up after each run
|
||||
- Adaptive mode bypasses are **expected** — they document evasion resistance limits
|
||||
|
||||
## HTML Report
|
||||
|
||||
After producing the markdown red-team narrative report above:
|
||||
|
||||
1. Compute a temp markdown path:
|
||||
```bash
|
||||
node -p "require('path').join(require('os').tmpdir(), 'sec-red-team-' + Date.now() + '.md')"
|
||||
```
|
||||
2. Use the Write tool to save the **entire markdown report you just produced** (per-category narrative + scenario pass/fail + defense score + adaptive-mode bypasses if `--adaptive`) to that temp path. Verbatim.
|
||||
3. Run the renderer:
|
||||
```bash
|
||||
node <plugin-root>/scripts/render-report.mjs red-team --in "<temp-md-path>"
|
||||
```
|
||||
The CLI writes `reports/red-team-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
|
||||
4. Append to your response (markdown link, no bare URL):
|
||||
|
||||
> **HTML-rapport:** [Åpne i nettleser](file:///abs/path.html)
|
||||
|
||||
If the CLI exits non-zero, mention the error but do not block — the markdown report above is the primary deliverable.
|
||||
|
|
|
|||
|
|
@ -119,3 +119,23 @@ Display results table:
|
|||
```
|
||||
|
||||
If no matches: "No entries matching '<pattern>'."
|
||||
|
||||
## Step 3: HTML Report
|
||||
|
||||
After producing the markdown registry output above (stats / scan-result / search-result, whichever sub-command ran):
|
||||
|
||||
1. Compute a temp markdown path:
|
||||
```bash
|
||||
node -p "require('path').join(require('os').tmpdir(), 'sec-registry-' + Date.now() + '.md')"
|
||||
```
|
||||
2. Use the Write tool to save the **entire markdown output you just produced** (Skill Signature Registry header + metric table + Recent Entries, OR Registry Hit banner, OR Registry Search results) to that temp path. Verbatim.
|
||||
3. Run the renderer:
|
||||
```bash
|
||||
node <plugin-root>/scripts/render-report.mjs registry --in "<temp-md-path>"
|
||||
```
|
||||
The CLI writes `reports/registry-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
|
||||
4. Append to your response (markdown link, no bare URL):
|
||||
|
||||
> **HTML-rapport:** [Åpne i nettleser](file:///abs/path.html)
|
||||
|
||||
If the CLI exits non-zero, mention the error but do not block — the markdown output above is the primary deliverable.
|
||||
|
|
|
|||
|
|
@ -45,3 +45,23 @@ For each finding, show:
|
|||
- Recommendation
|
||||
|
||||
Group by severity (CRITICAL first). If zero findings: "No supply chain issues detected in N lockfile(s)."
|
||||
|
||||
## Step 5: HTML Report
|
||||
|
||||
After producing the markdown supply-check report above:
|
||||
|
||||
1. Compute a temp markdown path:
|
||||
```bash
|
||||
node -p "require('path').join(require('os').tmpdir(), 'sec-supply-check-' + Date.now() + '.md')"
|
||||
```
|
||||
2. Use the Write tool to save the **entire markdown report you just produced** (banner + lockfile coverage + all findings grouped by severity) to that temp path. Verbatim.
|
||||
3. Run the renderer:
|
||||
```bash
|
||||
node <plugin-root>/scripts/render-report.mjs supply-check --in "<temp-md-path>"
|
||||
```
|
||||
The CLI writes `reports/supply-check-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
|
||||
4. Append to your response (markdown link, no bare URL):
|
||||
|
||||
> **HTML-rapport:** [Åpne i nettleser](file:///abs/path.html)
|
||||
|
||||
If the CLI exits non-zero, mention the error but do not block — the markdown report above is the primary deliverable.
|
||||
|
|
|
|||
|
|
@ -25,3 +25,23 @@ Spawn `subagent_type: "llm-security:threat-modeler-agent"`, `model: "opus"`:
|
|||
- To save: ask user if they want it written to `threat-model.md`
|
||||
- To verify mitigations: `/security posture`
|
||||
- For production readiness: `/security pre-deploy`
|
||||
|
||||
## HTML Report
|
||||
|
||||
After the threat-modeler agent has produced the complete threat-model markdown document:
|
||||
|
||||
1. Compute a temp markdown path:
|
||||
```bash
|
||||
node -p "require('path').join(require('os').tmpdir(), 'sec-threat-model-' + Date.now() + '.md')"
|
||||
```
|
||||
2. Use the Write tool to save the **entire threat-model markdown you just produced** (Architecture Discovery + Component Mapping + STRIDE × MAESTRO threat matrix + Risk Assessment + Mitigation Mapping) to that temp path. Verbatim.
|
||||
3. Run the renderer:
|
||||
```bash
|
||||
node <plugin-root>/scripts/render-report.mjs threat-model --in "<temp-md-path>"
|
||||
```
|
||||
The CLI writes `reports/threat-model-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
|
||||
4. Append to your response (markdown link, no bare URL):
|
||||
|
||||
> **HTML-rapport:** [Åpne i nettleser](file:///abs/path.html)
|
||||
|
||||
If the CLI exits non-zero, mention the error but do not block — the markdown threat-model document above is the primary deliverable.
|
||||
|
|
|
|||
|
|
@ -56,3 +56,23 @@ To run as a system cron job instead:
|
|||
|
||||
To stop watching: Escape or Ctrl+C
|
||||
```
|
||||
|
||||
## Step 5: HTML Report
|
||||
|
||||
After producing the markdown watch banner above (before starting the loop):
|
||||
|
||||
1. Compute a temp markdown path:
|
||||
```bash
|
||||
node -p "require('path').join(require('os').tmpdir(), 'sec-watch-' + Date.now() + '.md')"
|
||||
```
|
||||
2. Use the Write tool to save the **entire markdown banner you just produced** (Security Watch header + baseline timestamp + findings counts + interval + advisory) to that temp path. Verbatim.
|
||||
3. Run the renderer:
|
||||
```bash
|
||||
node <plugin-root>/scripts/render-report.mjs watch --in "<temp-md-path>"
|
||||
```
|
||||
The CLI writes `reports/watch-<YYYYMMDD-HHmmss>.html` relative to CWD and prints `file:///abs/path.html` on stdout.
|
||||
4. Append to your response (markdown link, no bare URL):
|
||||
|
||||
> **HTML-rapport:** [Åpne i nettleser](file:///abs/path.html)
|
||||
|
||||
If the CLI exits non-zero, mention the error but do not block — the markdown banner above is the primary deliverable.
|
||||
|
|
|
|||
Loading…
Add table
Add a link
Reference in a new issue