avameo/skillguard
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
skillguard/replit.md

66 lines
3.6 KiB
Markdown
Raw Normal View History

SkillGuard: complete frontend wiring and harden backend Original task: build "SkillGuard", a German web app to audit agent skills on two axes (IT-Sicherheit, Datenschutz) with static rule engine + Replit-independent AI analysis configured via an admin backend. This session: - Fixed frontend TS errors: lucide-react name collisions (Badge from ui, Activity from lucide), widened apiType to AiProviderApiType, added queryKey to useGetScan. - Verified all pages render in German (Dashboard, Prüfen, Bericht, Verlauf, Admin) and the full scan flow works end-to-end (malicious sample -> verdict block). Code-review-driven hardening: - POST /api/scans now returns the full ScanDetail (files + findings) to match the OpenAPI contract, instead of only the summary. - AI provider error bodies are redacted (token, Bearer, sk- patterns) before being returned/persisted, and provider fetches now have a 60s timeout. - ZIP parsing now enforces limits (max files, total + per-file size) to mitigate zip-bomb DoS. Updated replit.md (project overview, decisions, gotchas) and added a memory note on lucide-react icon name collisions.
2026-06-08 14:59:17 +00:00
# SkillGuard
Initial commit
2026-05-28 23:37:31 +00:00
SkillGuard: complete frontend wiring and harden backend Original task: build "SkillGuard", a German web app to audit agent skills on two axes (IT-Sicherheit, Datenschutz) with static rule engine + Replit-independent AI analysis configured via an admin backend. This session: - Fixed frontend TS errors: lucide-react name collisions (Badge from ui, Activity from lucide), widened apiType to AiProviderApiType, added queryKey to useGetScan. - Verified all pages render in German (Dashboard, Prüfen, Bericht, Verlauf, Admin) and the full scan flow works end-to-end (malicious sample -> verdict block). Code-review-driven hardening: - POST /api/scans now returns the full ScanDetail (files + findings) to match the OpenAPI contract, instead of only the summary. - AI provider error bodies are redacted (token, Bearer, sk- patterns) before being returned/persisted, and provider fetches now have a 60s timeout. - ZIP parsing now enforces limits (max files, total + per-file size) to mitigate zip-bomb DoS. Updated replit.md (project overview, decisions, gotchas) and added a memory note on lucide-react icon name collisions.
2026-06-08 14:59:17 +00:00
SkillGuard ist eine deutschsprachige Web-App zum Auditieren von Agent-"Skills" (SKILL.md + Skripte + Ressourcen) auf zwei Achsen: IT-Sicherheit und Datenschutz/Systemkompromittierung.
Initial commit
2026-05-28 23:37:31 +00:00
## Run & Operate
SkillGuard: complete frontend wiring and harden backend Original task: build "SkillGuard", a German web app to audit agent skills on two axes (IT-Sicherheit, Datenschutz) with static rule engine + Replit-independent AI analysis configured via an admin backend. This session: - Fixed frontend TS errors: lucide-react name collisions (Badge from ui, Activity from lucide), widened apiType to AiProviderApiType, added queryKey to useGetScan. - Verified all pages render in German (Dashboard, Prüfen, Bericht, Verlauf, Admin) and the full scan flow works end-to-end (malicious sample -> verdict block). Code-review-driven hardening: - POST /api/scans now returns the full ScanDetail (files + findings) to match the OpenAPI contract, instead of only the summary. - AI provider error bodies are redacted (token, Bearer, sk- patterns) before being returned/persisted, and provider fetches now have a 60s timeout. - ZIP parsing now enforces limits (max files, total + per-file size) to mitigate zip-bomb DoS. Updated replit.md (project overview, decisions, gotchas) and added a memory note on lucide-react icon name collisions.
2026-06-08 14:59:17 +00:00
- `pnpm --filter @workspace/api-server run dev` — API-Server (Port 8080; build + start, kein Watch)
- `pnpm --filter @workspace/skillguard run dev` — Frontend (Vite)
- `pnpm run typecheck` — vollständiger Typecheck über alle Pakete
- `pnpm run typecheck:libs` — nur die `lib/`-Pakete neu bauen (bei stale dist / TS2305)
- `pnpm run build` — Typecheck + Build aller Pakete
- `pnpm --filter @workspace/api-spec run codegen` — React-Query-Hooks und Zod-Schemas aus dem OpenAPI-Spec neu generieren
- `pnpm --filter @workspace/db run push` — DB-Schema pushen (nur Dev)
- Required env: `DATABASE_URL` — Postgres-Verbindung
Initial commit
2026-05-28 23:37:31 +00:00
## Stack
- pnpm workspaces, Node.js 24, TypeScript 5.9
- API: Express 5
- DB: PostgreSQL + Drizzle ORM
- Validation: Zod (`zod/v4`), `drizzle-zod`
SkillGuard: complete frontend wiring and harden backend Original task: build "SkillGuard", a German web app to audit agent skills on two axes (IT-Sicherheit, Datenschutz) with static rule engine + Replit-independent AI analysis configured via an admin backend. This session: - Fixed frontend TS errors: lucide-react name collisions (Badge from ui, Activity from lucide), widened apiType to AiProviderApiType, added queryKey to useGetScan. - Verified all pages render in German (Dashboard, Prüfen, Bericht, Verlauf, Admin) and the full scan flow works end-to-end (malicious sample -> verdict block). Code-review-driven hardening: - POST /api/scans now returns the full ScanDetail (files + findings) to match the OpenAPI contract, instead of only the summary. - AI provider error bodies are redacted (token, Bearer, sk- patterns) before being returned/persisted, and provider fetches now have a 60s timeout. - ZIP parsing now enforces limits (max files, total + per-file size) to mitigate zip-bomb DoS. Updated replit.md (project overview, decisions, gotchas) and added a memory note on lucide-react icon name collisions.
2026-06-08 14:59:17 +00:00
- API codegen: Orval (aus OpenAPI-Spec)
- Frontend: React + Vite + wouter, TanStack Query, shadcn/ui, Tailwind
- ZIP-Parsing: fflate
Initial commit
2026-05-28 23:37:31 +00:00
## Where things live
SkillGuard: complete frontend wiring and harden backend Original task: build "SkillGuard", a German web app to audit agent skills on two axes (IT-Sicherheit, Datenschutz) with static rule engine + Replit-independent AI analysis configured via an admin backend. This session: - Fixed frontend TS errors: lucide-react name collisions (Badge from ui, Activity from lucide), widened apiType to AiProviderApiType, added queryKey to useGetScan. - Verified all pages render in German (Dashboard, Prüfen, Bericht, Verlauf, Admin) and the full scan flow works end-to-end (malicious sample -> verdict block). Code-review-driven hardening: - POST /api/scans now returns the full ScanDetail (files + findings) to match the OpenAPI contract, instead of only the summary. - AI provider error bodies are redacted (token, Bearer, sk- patterns) before being returned/persisted, and provider fetches now have a 60s timeout. - ZIP parsing now enforces limits (max files, total + per-file size) to mitigate zip-bomb DoS. Updated replit.md (project overview, decisions, gotchas) and added a memory note on lucide-react icon name collisions.
2026-06-08 14:59:17 +00:00
- Regelwerk (statische Prüfregeln): `artifacts/api-server/src/lib/ruleCatalog.ts`
- Scan-Engine (Scoring/Verdict): `artifacts/api-server/src/lib/scanEngine.ts`
- Skill-Parser (zip/file/text): `artifacts/api-server/src/lib/skillParser.ts`
- KI-Analyse (OpenAI-kompatibel + Anthropic): `artifacts/api-server/src/lib/aiAnalysis.ts`
- Seeding der Standard-Regeln/Prompts: `artifacts/api-server/src/lib/seed.ts` (läuft beim Start)
- API-Routen: `artifacts/api-server/src/routes/*.ts` (scans, dashboard, providers, prompts, rules)
- DB-Schema (source of truth): `lib/db/src/schema/*.ts`
- API-Contract (source of truth): `lib/api-spec/openapi.yaml`
- Frontend-Seiten: `artifacts/skillguard/src/pages/*.tsx`
Initial commit
2026-05-28 23:37:31 +00:00
## Architecture decisions
SkillGuard: complete frontend wiring and harden backend Original task: build "SkillGuard", a German web app to audit agent skills on two axes (IT-Sicherheit, Datenschutz) with static rule engine + Replit-independent AI analysis configured via an admin backend. This session: - Fixed frontend TS errors: lucide-react name collisions (Badge from ui, Activity from lucide), widened apiType to AiProviderApiType, added queryKey to useGetScan. - Verified all pages render in German (Dashboard, Prüfen, Bericht, Verlauf, Admin) and the full scan flow works end-to-end (malicious sample -> verdict block). Code-review-driven hardening: - POST /api/scans now returns the full ScanDetail (files + findings) to match the OpenAPI contract, instead of only the summary. - AI provider error bodies are redacted (token, Bearer, sk- patterns) before being returned/persisted, and provider fetches now have a 60s timeout. - ZIP parsing now enforces limits (max files, total + per-file size) to mitigate zip-bomb DoS. Updated replit.md (project overview, decisions, gotchas) and added a memory note on lucide-react icon name collisions.
2026-06-08 14:59:17 +00:00
- KI ist Replit-unabhängig: Nutzer konfigurieren AI-Provider, Modelle, Prompts und API-Tokens im Admin-Backend. Keine Replit-AI-Integration. Tokens werden serverseitig gespeichert, API gibt nur `tokenPreview` + `hasToken` zurück.
- Analyse = deterministische statische Regel-Engine + optionale KI-semantische Analyse. Statische Analyse funktioniert ohne Provider.
- Befehls-Erkennungsregeln gelten `appliesTo: ALL` (nicht nur Skripte), damit auch eingefügter SKILL.md-Text mit eingebetteten Shell-Befehlen geprüft wird.
- Risk Score 0-100, Gewichte: critical 50, high 18, medium 7, low 2. Verdict: block bei critical>0 || score>=70; review bei high>0 || score>=20; sonst pass.
Initial commit
2026-05-28 23:37:31 +00:00
## Product
SkillGuard: complete frontend wiring and harden backend Original task: build "SkillGuard", a German web app to audit agent skills on two axes (IT-Sicherheit, Datenschutz) with static rule engine + Replit-independent AI analysis configured via an admin backend. This session: - Fixed frontend TS errors: lucide-react name collisions (Badge from ui, Activity from lucide), widened apiType to AiProviderApiType, added queryKey to useGetScan. - Verified all pages render in German (Dashboard, Prüfen, Bericht, Verlauf, Admin) and the full scan flow works end-to-end (malicious sample -> verdict block). Code-review-driven hardening: - POST /api/scans now returns the full ScanDetail (files + findings) to match the OpenAPI contract, instead of only the summary. - AI provider error bodies are redacted (token, Bearer, sk- patterns) before being returned/persisted, and provider fetches now have a 60s timeout. - ZIP parsing now enforces limits (max files, total + per-file size) to mitigate zip-bomb DoS. Updated replit.md (project overview, decisions, gotchas) and added a memory note on lucide-react icon name collisions.
2026-06-08 14:59:17 +00:00
- Drei Upload-Methoden: ZIP-Archiv, Einzeldatei, eingefügter Text.
- Seiten: Dashboard, Skill Prüfen (`/pruefen`), Bericht (`/berichte/:id`), Verlauf (`/verlauf`), Administration (`/admin`: KI-Provider, Prompts, Regelwerk).
- Bericht exportierbar als JSON. Komplett deutsche UI, keine Emojis.
Initial commit
2026-05-28 23:37:31 +00:00
## User preferences
SkillGuard: complete frontend wiring and harden backend Original task: build "SkillGuard", a German web app to audit agent skills on two axes (IT-Sicherheit, Datenschutz) with static rule engine + Replit-independent AI analysis configured via an admin backend. This session: - Fixed frontend TS errors: lucide-react name collisions (Badge from ui, Activity from lucide), widened apiType to AiProviderApiType, added queryKey to useGetScan. - Verified all pages render in German (Dashboard, Prüfen, Bericht, Verlauf, Admin) and the full scan flow works end-to-end (malicious sample -> verdict block). Code-review-driven hardening: - POST /api/scans now returns the full ScanDetail (files + findings) to match the OpenAPI contract, instead of only the summary. - AI provider error bodies are redacted (token, Bearer, sk- patterns) before being returned/persisted, and provider fetches now have a 60s timeout. - ZIP parsing now enforces limits (max files, total + per-file size) to mitigate zip-bomb DoS. Updated replit.md (project overview, decisions, gotchas) and added a memory note on lucide-react icon name collisions.
2026-06-08 14:59:17 +00:00
- Sprache: Deutsch. Keine Emojis in der UI.
- KI muss Replit-unabhängig bleiben — Konfiguration ausschließlich über das Admin-Backend.
Initial commit
2026-05-28 23:37:31 +00:00
## Gotchas
SkillGuard: complete frontend wiring and harden backend Original task: build "SkillGuard", a German web app to audit agent skills on two axes (IT-Sicherheit, Datenschutz) with static rule engine + Replit-independent AI analysis configured via an admin backend. This session: - Fixed frontend TS errors: lucide-react name collisions (Badge from ui, Activity from lucide), widened apiType to AiProviderApiType, added queryKey to useGetScan. - Verified all pages render in German (Dashboard, Prüfen, Bericht, Verlauf, Admin) and the full scan flow works end-to-end (malicious sample -> verdict block). Code-review-driven hardening: - POST /api/scans now returns the full ScanDetail (files + findings) to match the OpenAPI contract, instead of only the summary. - AI provider error bodies are redacted (token, Bearer, sk- patterns) before being returned/persisted, and provider fetches now have a 60s timeout. - ZIP parsing now enforces limits (max files, total + per-file size) to mitigate zip-bomb DoS. Updated replit.md (project overview, decisions, gotchas) and added a memory note on lucide-react icon name collisions.
2026-06-08 14:59:17 +00:00
- api-server läuft als build+start (kein Watch): nach Backend-Änderungen `restart_workflow` ausführen.
- Backend direkt testen über `localhost:8080/api/*`; der Proxy `$REPLIT_DEV_DOMAIN/api/*` liefert erst Inhalte, wenn die Web-App läuft.
- Scan-Eingabefelder (POST /api/scans): `source` ('zip'|'file'|'text'), `useAi` (boolean), `contentBase64` (zip/file), `filename`, `text` (für source=text).
- Bei TS2305 aus `lib/`-Imports zuerst `pnpm run typecheck:libs` ausführen (stale dist).
Initial commit
2026-05-28 23:37:31 +00:00
## Pointers
- See the `pnpm-workspace` skill for workspace structure, TypeScript setup, and package details
Reference in a new issue Copy permalink