Build a deterministic bounded scanner for contextual repository risk
维护者通常 1 天内回复
还没有人认领这个 Issue。
评估
- 难度
- 5/5
- 预计耗时
- 一周以上
- 新手友好度
- 35/100
- Issue 类型
- 功能
- 描述清晰度
- 基本清楚
- 活跃度
- 活跃
- 技术栈
- javascript
调研方向
Read the repository guidance and inspect the implementation of dependency #13 (B01-01) to find where this roadmap item belongs. First resolve the decision gate for scope, bounds, and confidence reporting; the issue names no files or tests to start from. Done means a bounded, read-only scan covers the listed risk areas and reports path and confidence, with both verification cases passing.
由索引模型根据 Issue 内容生成。
描述
Goal
Build a deterministic, read-only, bounded scanner that flags contextual risk (prompt-injection heuristics, not a guarantee) across scripts, hooks, actions, invisible unicode, and encoded payloads.
Observations
- Baseline gitleaks already covers secret keys; B06 adds contextual risk analysis, not a duplicate scanner.
- Prompt-injection heuristics reduce risk but cannot guarantee detection.
- The scanner must be read-only and bounded in time and output.
Decision gate
Approve scope, bounds, and confidence reporting before implementing detection rules.
Acceptance criteria
- The scanner is read-only and bounded by explicit time and size limits.
- Checks cover scripts, hooks, actions, invisible unicode, and encoded payloads with context.
- Findings carry path and confidence, never a bare pass/fail.
Verification
- Scan of a benign tree -> exit 0 with no findings.
- Scan with a known encoded-payload fixture -> a finding with path and confidence.
Release checkpoint
Remaining risk: heuristics have false negatives; tests must not claim 100% malware detection or an unconditional LLM pass/fail.
Tracking
Roadmap item: B06-01. All acceptance criteria remain pending; publication does not grant approval or release authority.
Dependencies
- Depends on #13 (B01-01).
- 主要语言
- JavaScript
- 星标
- 22
- 派生
- 3
- 平均合并
- 27 分钟
- 30 天内合并 PR
- 27
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
egdev6/github-repository-bootstrap 的其他 Issue
-
status:approved type:chore
难度 5/5 一周以上 新手友好度 25/100
egdev6/github-repository-bootstrap#57 ·
维护者通常 1 天内回复
-
type:docs
难度 1/5 1 小时以内 新手友好度 20/100
egdev6/github-repository-bootstrap#50 ·
维护者通常 1 天内回复
-
enhancement
难度 5/5 一周以上 新手友好度 22/100
egdev6/github-repository-bootstrap#49 ·
维护者通常 1 天内回复
-
status:approved type:chore
难度 5/5 一周以上 新手友好度 25/100
egdev6/github-repository-bootstrap#30 ·
维护者通常 1 天内回复
-
status:approved type:chore
难度 5/5 一周以上 新手友好度 42/100
egdev6/github-repository-bootstrap#29 ·
维护者通常 1 天内回复
查看 egdev6/github-repository-bootstrap 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 62/100
woocommerce/woocommerce-google-analytics-integration#699 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 62/100
维护者通常 1 天内回复
-
bug
难度 2/5 1-3 小时 新手友好度 72/100
维护者通常 1 天内回复
-
t0ggles
难度 2/5 1-3 小时 新手友好度 70/100
nolimits4web/swiper#8240 · 1 条评论 ·
-
难度 2/5 1-3 小时 新手友好度 62/100
Inter-Actief/amelink#131 ·