feat: harden security research workflows

Signed-off-by: zebbern <185730623+zebbern@users.noreply.github.com>

Author: zebbern

README.md

@@ -81,10 +81,10 @@ bun run dev:fe      # Frontend-only dev (no Docker needed)
 
 ### Integrated Tooling
 
-29 security components wrapping industry-standard open-source tools:
+34 security components wrapping industry-standard open-source tools:
 
 - **Discovery & Recon**: `Subfinder`, `Amass`, `DNSX`, `Naabu`, `HTTPx`, `Katana`, `theHarvester`, `ShuffleDNS`
-- **Vulnerability Scanning**: `Nuclei`, `Trivy`, `Semgrep`, `Checkov`, `TestSSL`
+- **Vulnerability Scanning**: `Nuclei`, `Trivy`, `Semgrep`, `OpenGrep`, `CodeQL`, `Jazzer.js`, `Checkov`, `TestSSL`
 - **Secret Detection**: `TruffleHog`
 - **Threat Intelligence**: `AbuseIPDB`, `VirusTotal`, `YARA`, `NPM Registry Intel`
 - **Web Security**: `Ffuf`, `Wafw00f`, `Prowler`, `Supabase Scanner`

backend/scripts/seed-templates.ts

@@ -303,9 +303,7 @@ export async function seedTemplates(): Promise<void> {
       REMOVED_OFFICIAL_SEED_TEMPLATES,
     );
     if (deactivated > 0) {
-      console.log(
-        `\n  Deactivated ${deactivated} retired official seed template(s)`,
-      );
+      console.log(`\n  Deactivated ${deactivated} retired official seed template(s)`);
     }
 
     console.log(`\nDone: ${inserted} inserted, ${updated} updated, ${deactivated} deactivated\n`);

backend/scripts/seed-templates/github-actions-supply-chain-triage.json

@@ -89,7 +89,6 @@
           "config": {
             "params": {
               "ref": "main",
-              "maxFiles": 80,
               "maxTotalBytes": 250000,
               "maxFileBytes": 50000
             },

backend/scripts/seed-templates/npm-cve-hunt-pipeline.json

@@ -77,7 +77,6 @@
           "config": {
             "params": {
               "ref": "main",
-              "maxFiles": 80,
               "maxTotalBytes": 250000,
               "maxFileBytes": 50000
             },

backend/scripts/seed-templates/oss-sast-cve-candidate-hunt.json

@@ -75,7 +75,6 @@
           "config": {
             "params": {
               "ref": "main",
-              "maxFiles": 80,
               "maxTotalBytes": 250000,
               "maxFileBytes": 50000
             },

backend/scripts/seed-templates/public-repo-code-iac-risk-triage.json

@@ -117,7 +117,6 @@
           "config": {
             "params": {
               "ref": "main",
-              "maxFiles": 80,
               "maxTotalBytes": 250000,
               "maxFileBytes": 50000
             },

backend/scripts/seed-templates/public-repo-full-code-security.json

@@ -71,7 +71,10 @@ description: Analyze KEV briefs
 
   it('mergeSkillFilesForResponse falls back to content', () => {
     expect(
-      mergeSkillFilesForResponse({ content: '# Legacy', files: null as unknown as Record<string, string> }),
+      mergeSkillFilesForResponse({
+        content: '# Legacy',
+        files: null as unknown as Record<string, string>,
+      }),
     ).toEqual({ 'SKILL.md': '# Legacy' });
   });
 

backend/src/agent-skills/__tests__/agent-skill-bundle.spec.ts

@@ -17,23 +17,23 @@ export const DEFAULT_AGENT_SKILL_DISCOVERY_DIRS = [
 
 export type AgentSkillFileMap = Record<string, string>;
 
-export type ParsedSkillBundle = {
+export interface ParsedSkillBundle {
   slug: string;
   name: string;
   description: string | null;
   files: AgentSkillFileMap;
   content: string;
   tags: string[];
-};
+}
 
-export type DiscoveredAgentSkillSummary = {
+export interface DiscoveredAgentSkillSummary {
   slug: string;
   name: string;
   description: string | null;
   sourceRoot: string;
   relativePath: string;
   fileCount: number;
-};
+}
 
 function isRecord(value: unknown): value is Record<string, unknown> {
   return typeof value === 'object' && value !== null && !Array.isArray(value);
@@ -62,7 +62,10 @@ export function resolveAgentSkillsWorkspaceRoot(): string {
 export function resolveAgentSkillDiscoveryDirs(workspaceRoot?: string): string[] {
   const configured = process.env.SENTRIS_AGENT_SKILLS_DISCOVERY_DIRS?.trim();
   const relativeDirs = configured
-    ? configured.split(',').map((dir) => dir.trim()).filter(Boolean)
+    ? configured
+        .split(',')
+        .map((dir) => dir.trim())
+        .filter(Boolean)
     : [...DEFAULT_AGENT_SKILL_DISCOVERY_DIRS];
 
   const root = workspaceRoot ?? resolveAgentSkillsWorkspaceRoot();
@@ -111,7 +114,10 @@ export function parseSkillMdFrontmatter(content: string): {
     const separator = line.indexOf(':');
     if (separator <= 0) continue;
     const key = line.slice(0, separator).trim();
-    const value = line.slice(separator + 1).trim().replace(/^['"]|['"]$/g, '');
+    const value = line
+      .slice(separator + 1)
+      .trim()
+      .replace(/^['"]|['"]$/g, '');
     if (key === 'name') metadata.name = value;
     if (key === 'description') metadata.description = value;
     if (key === 'tags') {
@@ -181,7 +187,10 @@ export function normalizeSkillBundle(input: {
   };
 }
 
-async function readTextFileIfAllowed(filePath: string, relativePath: string): Promise<string | null> {
+async function readTextFileIfAllowed(
+  filePath: string,
+  relativePath: string,
+): Promise<string | null> {
   validateSkillRelativePath(relativePath);
   const fileStat = await stat(filePath);
   if (!fileStat.isFile() || fileStat.size > AGENT_SKILL_FILE_MAX_BYTES) {
@@ -293,7 +302,7 @@ export async function readDiscoveredSkillBundle(
 }
 
 export function parseSkillBundlesFromZipEntries(
-  entries: Array<{ entryName: string; getData: () => Buffer }>,
+  entries: { entryName: string; getData: () => Buffer }[],
 ): ParsedSkillBundle[] {
   const filesBySkill = new Map<string, AgentSkillFileMap>();
 
@@ -361,9 +370,10 @@ function slugifyFromSkillMd(files: AgentSkillFileMap): string {
     .slice(0, 128);
 }
 
-export function mergeSkillFilesForResponse(
-  record: { content: string; files?: AgentSkillFileMap | null },
-): AgentSkillFileMap {
+export function mergeSkillFilesForResponse(record: {
+  content: string;
+  files?: AgentSkillFileMap | null;
+}): AgentSkillFileMap {
   if (isRecord(record.files) && Object.keys(record.files).length > 0) {
     return record.files;
   }

backend/src/agent-skills/agent-skill-bundle.ts

@@ -4,11 +4,7 @@ import { and, eq, inArray } from 'drizzle-orm';
 
 import { getPostgresErrorCode, PG_ERROR } from '../common/postgres-error';
 import { DRIZZLE_TOKEN } from '../database/database.module';
-import {
-  agentSkills,
-  type AgentSkillRecord,
-  type NewAgentSkillRecord,
-} from '../database/schema';
+import { agentSkills, type AgentSkillRecord, type NewAgentSkillRecord } from '../database/schema';
 
 import type { AgentSkillFileMap } from '../database/schema';