0 Fork 0

Files

T

evandrodevbr c17192c9fe feat: vendorizar as 10 skills do pilar de seguranca em skills/

Copia local (nao fork, nao submodule) de safedeps, sca-audit,
secrets-scan, code-review-security, api-security-review,
web-security-review, cve-triage, patch-prioritization,
dependency-scanning e hermaguard -- commit exato de origem e licenca
de cada uma em skills/NOTICE.md. Elimina o passo de clone externo
pro pilar de seguranca do wf-security-review: git clone deste repo
ja traz tudo funcional.

Corrige tambem o comando de instalacao pro Claude Code nos dois
READMEs e no docs/SKILLS.md: Claude Code exige um diretorio por
skill (skills/<nome>/SKILL.md), nao aceita os .md soltos que o
comando antigo copiava -- confirmado testando a instalacao real.

2026-08-24 00:32:20 -03:00

4.3 KiB

Raw Permalink Blame History

Hermaguard — Schemas and Config Reference

Full schemas and project config for the hermaguard skill. The skill body keeps the behavioural instructions; the verbose data shapes live here so the loaded skill stays lean.

Pre-scan output schema

hermaguard-prescan writes this JSON (consumed as Agent 1/2 context):

{
  "findings": [
    {
      "tool": "bandit",
      "rule_id": "B301",
      "severity": "HIGH",
      "file": "src/auth.py",
      "line": 42,
      "message": "Use of unsafe yaml.load() — allows arbitrary code execution",
      "category": "security"
    }
  ],
  "stats": {
    "tools_run": ["bandit", "ruff"],
    "tools_skipped": ["gosec"],
    "total_findings": 12,
    "by_severity": {"CRITICAL": 0, "HIGH": 2, "MEDIUM": 5, "LOW": 5}
  }
}

JSON report schema (`--json`)

The consolidator writes this alongside the markdown report:

{
  "meta": {
    "timestamp": "ISO8601",
    "scope": {"files_changed": 4, "files_in_blast_radius": 12},
    "diff_ref": "git diff main..HEAD",
    "version": "2.0.0",
    "prescan": {"tools_run": ["bandit"], "tools_skipped": ["eslint"], "total_findings": 3}
  },
  "summary": {"total": 7, "critical": 0, "high": 2, "medium": 3, "low": 2},
  "findings": [
    {
      "id": "HG-001",
      "severity": "HIGH",
      "source_agent": "adversarial-reviewer",
      "cross_agent_agreement": ["edge-case-hunter"],
      "file": "src/handler.ts",
      "line_range": "42-58",
      "trigger_condition": "Concurrent calls to processPayment without mutex",
      "consequence": "Double-charge on payment",
      "recommendation": "Add distributed lock on orderId before processing",
      "exploit_poc": "Send two identical requests within 100ms window",
      "classes": ["CWE-362", "HG-PARTIAL-WRITE"],
      "source_prescan": false
    },
    {
      "id": "HG-004",
      "severity": "HIGH",
      "source_agent": "edge-case-hunter",
      "cross_agent_agreement": [],
      "file": "src/auth.py",
      "line_range": "42-42",
      "trigger_condition": "Unsafe yaml.load() allows arbitrary code execution",
      "consequence": "Remote code execution via crafted YAML input",
      "recommendation": "Replace yaml.load() with yaml.safe_load()",
      "exploit_poc": "",
      "source_prescan": true,
      "prescan_tool": "bandit",
      "prescan_rule": "B301"
    }
  ],
  "blast_radius": {
    "callers": [
      {"file": "src/handler.ts", "line": 42, "symbol": "processPayment()", "risk": "HIGH", "notes": "Assumes sync return"}
    ],
    "downstream": [
      {"callee": "payments/gateway.ts", "change_impact": "Now called without retry wrapper", "risk": "MEDIUM"}
    ],
    "config_affected": ["PAYMENT_TIMEOUT_MS"],
    "revert_safety": {"safe": true, "procedure": "Roll back commit, no migration needed"}
  },
  "coverage": [
    {"class_id": "CWE-362", "status": "finding", "backed_by": ["HG-001"]},
    {"class_id": "CWE-89", "status": "clean"},
    {"class_id": "CWE-787", "status": "not_applicable", "reason": "memory-unsafe class N/A for this language"}
  ],
  "verdict": {
    "overall_risk": "HIGH",
    "recommended_actions": {
      "before_merge": ["Fix HG-001"],
      "before_deploy": ["Fix HG-002", "Fix HG-003"],
      "next_sprint": ["Address HG-004"],
      "backlog": ["HG-005", "HG-006", "HG-007"]
    }
  }
}

Project config (optional `.kensei/hermaguard.yaml`)

hermaguard:
  enabled: true
  auto_trigger: false           # opt-in — no auto-trigger on commit
  scope: modified               # modified | staged | all
  skip_patterns: ["*.test.*", "*.spec.*", "*.md", "*.json", "*.yaml"]
  max_files: 50                 # skip if more than this many files changed
  blast_radius:
    max_depth: 2                # max caller/callee hop depth
    skip_patterns: ["node_modules/", "vendor/", "dist/"]
  severity_threshold: LOW       # minimum severity to report
  agents:
    parallel: 3                 # always 3 — non-configurable
    batch: true                 # parallel dispatch via harness subagents
  prescan:
    enabled: true               # run deterministic pre-scan before agents
    tools: auto                 # auto-detect from file extensions | explicit list
  json_output: false            # write JSON report alongside markdown
  feedback:
    mcp_url: ""                 # hermaguard-feedback MCP server URL (if available)

4.3 KiB Raw Permalink Blame History

Hermaguard — Schemas and Config Reference

Pre-scan output schema

JSON report schema (--json)

Project config (optional .kensei/hermaguard.yaml)

4.3 KiB

Raw Permalink Blame History

JSON report schema (`--json`)

Project config (optional `.kensei/hermaguard.yaml`)