fix(security): block path traversal in static analyzer and redact secrets in findings (#59)

The static analyzer's _scan_references_recursive followed file references
from SKILL.md without validating that resolved paths stayed within the
skill directory.  A crafted markdown link like [x](../../etc/passwd)
could read arbitrary host files.

Additionally, hardcoded secret findings were emitted with full unredacted
values in the description, snippet, and metadata fields, leaking raw
secrets into scan reports, CI logs, and API responses.

Changes:
- Add _is_path_traversal() and _is_within_directory() guards to
  _scan_references_recursive with CRITICAL findings for traversal attempts
- Filter traversal paths in _extract_references_from_content (static.py)
- Filter traversal paths in _extract_referenced_files and
  extract_references_from_file (loader.py)
- Add _redact_secret() that preserves type-identifying prefixes
  (AKIA****, sk_live_****, ghp_****, etc.) while masking the secret value
- Apply redaction in _create_finding_from_match for HARDCODED_SECRETS
- Add 43 new tests covering path traversal prevention and secret redaction

Author: vineethsai7

.gitleaksignore

@@ -16,3 +16,15 @@ tests/test_policy_knobs.py:stripe-access-token:355
 tests/test_policy_knobs.py:stripe-access-token:362
 tests/test_policy_knobs.py:stripe-access-token:377
 tests/test_policy_knobs.py:stripe-access-token:388
+
+# Fake/synthetic test credentials used in path-traversal and redaction tests.
+# These are not real secrets — they exist to verify the redaction logic works.
+tests/test_path_traversal_and_redaction.py:stripe-access-token:117
+tests/test_path_traversal_and_redaction.py:stripe-access-token:121
+tests/test_path_traversal_and_redaction.py:stripe-access-token:316
+tests/test_path_traversal_and_redaction.py:stripe-access-token:460
+tests/test_path_traversal_and_redaction.py:aws-access-token:111
+tests/test_path_traversal_and_redaction.py:aws-access-token:251
+tests/test_path_traversal_and_redaction.py:aws-access-token:291
+tests/test_path_traversal_and_redaction.py:aws-access-token:440
+tests/test_path_traversal_and_redaction.py:aws-access-token:501

skill_scanner/core/analyzers/static.py

@@ -116,6 +116,58 @@
 }
 
 
+def _is_path_traversal(ref_path: str) -> bool:
+    """Check if a reference path contains traversal sequences or is absolute."""
+    return ".." in ref_path or ref_path.startswith("/")
+
+
+def _is_within_directory(path: Path, directory: Path) -> bool:
+    """Check if a resolved path stays within the given directory."""
+    try:
+        resolved_path = path.resolve()
+        resolved_directory = directory.resolve()
+        return resolved_path.is_relative_to(resolved_directory)
+    except (ValueError, OSError):
+        return False
+
+
+def _redact_secret(text: str) -> str:
+    """Redact a matched secret, preserving a short prefix for identification.
+
+    Returns a version like ``AKIA****`` or ``sk_live_****`` so the type of
+    secret is still recognisable in the report without exposing the full value.
+    """
+    if not text:
+        return text
+    _KNOWN_PREFIXES = {
+        "AKIA": 4,
+        "AGPA": 4,
+        "AIDA": 4,
+        "AROA": 4,
+        "AIPA": 4,
+        "ANPA": 4,
+        "ANVA": 4,
+        "ASIA": 4,
+        "AIza": 4,
+    }
+    for prefix, length in _KNOWN_PREFIXES.items():
+        if text.startswith(prefix):
+            return text[:length] + "****"
+    _TOKEN_PREFIXES = ("sk_live_", "pk_live_", "sk_test_", "pk_test_", "ghp_", "gho_", "ghu_", "ghs_", "ghr_")
+    for prefix in _TOKEN_PREFIXES:
+        if text.startswith(prefix):
+            return prefix + "****"
+    if text.startswith("eyJ"):
+        return "eyJ****"
+    _PK_MARKER_BEGIN = "-----BEGIN"
+    _PK_MARKER_TYPE = "PRIVATE KEY"
+    if _PK_MARKER_BEGIN in text and _PK_MARKER_TYPE in text:
+        return f"{_PK_MARKER_BEGIN} {_PK_MARKER_TYPE}----- [REDACTED]"
+    if len(text) <= 8:
+        return text[:2] + "****"
+    return text[:4] + "****"
+
+
 class StaticAnalyzer(BaseAnalyzer):
     """Static pattern-based security analyzer."""
 
@@ -585,6 +637,26 @@ def _scan_references_recursive(
             return findings
 
         for ref_file_path in references:
+            if _is_path_traversal(ref_file_path):
+                findings.append(
+                    Finding(
+                        id=self._generate_finding_id("PATH_TRAVERSAL", ref_file_path),
+                        rule_id="PATH_TRAVERSAL_ATTEMPT",
+                        category=ThreatCategory.DATA_EXFILTRATION,
+                        severity=Severity.CRITICAL,
+                        title="Path traversal attempt in file reference",
+                        description=(
+                            f"Reference '{ref_file_path}' attempts to escape the skill directory. "
+                            f"This is a path traversal attack that could read sensitive files "
+                            f"from the host system."
+                        ),
+                        file_path="SKILL.md",
+                        remediation="Remove path traversal sequences from file references",
+                        analyzer="static",
+                    )
+                )
+                continue
+
             full_path = skill.directory / ref_file_path
             if not full_path.exists():
                 alt_paths = [
@@ -601,6 +673,25 @@ def _scan_references_recursive(
             if not full_path.exists():
                 continue
 
+            if not _is_within_directory(full_path, skill.directory):
+                findings.append(
+                    Finding(
+                        id=self._generate_finding_id("PATH_TRAVERSAL_RESOLVED", ref_file_path),
+                        rule_id="PATH_TRAVERSAL_ATTEMPT",
+                        category=ThreatCategory.DATA_EXFILTRATION,
+                        severity=Severity.CRITICAL,
+                        title="File reference resolves outside skill directory",
+                        description=(
+                            f"Reference '{ref_file_path}' resolves to a path outside the skill "
+                            f"directory. This could be a path traversal attack."
+                        ),
+                        file_path="SKILL.md",
+                        remediation="Ensure all file references point to files within the skill directory",
+                        analyzer="static",
+                    )
+                )
+                continue
+
             dedupe_reference_aliases = self.policy.rule_scoping.dedupe_reference_aliases
             # De-duplicate aliases to the same physical file (e.g.
             # "cover_art_generator.py" and "scripts/cover_art_generator.py").
@@ -690,17 +781,20 @@ def _extract_references_from_content(self, file_path: Path, content: str) -> lis
             markdown_links = _MARKDOWN_LINK_PATTERN.findall(content)
             for _, link in markdown_links:
                 if not link.startswith(("http://", "https://", "ftp://", "#")):
-                    references.append(link)
+                    if not _is_path_traversal(link):
+                        references.append(link)
 
         elif suffix == ".py":
             import_patterns = _PYTHON_IMPORT_PATTERN.findall(content)
             for imp in import_patterns:
-                if imp:
+                if imp and not _is_path_traversal(imp):
                     references.append(f"{imp}.py")
 
         elif suffix in (".sh", ".bash"):
             source_patterns = _BASH_SOURCE_PATTERN.findall(content)
-            references.extend(source_patterns)
+            for src in source_patterns:
+                if not _is_path_traversal(src):
+                    references.append(src)
 
         return references
 
@@ -1340,21 +1434,30 @@ def _create_finding_from_match(self, rule: SecurityRule, match: dict[str, Any])
         except (ValueError, AttributeError):
             pass
 
+        matched_text = match.get("matched_text", "N/A")
+        snippet = match.get("line_content")
+
+        if rule.category == ThreatCategory.HARDCODED_SECRETS:
+            redacted = _redact_secret(matched_text)
+            if snippet and matched_text in snippet:
+                snippet = snippet.replace(matched_text, redacted)
+            matched_text = redacted
+
         return Finding(
             id=self._generate_finding_id(rule.id, f"{match.get('file_path', 'unknown')}:{match.get('line_number', 0)}"),
             rule_id=rule.id,
             category=rule.category,
             severity=rule.severity,
             title=rule.description,
-            description=f"Pattern detected: {match.get('matched_text', 'N/A')}",
+            description=f"Pattern detected: {matched_text}",
             file_path=match.get("file_path"),
             line_number=match.get("line_number"),
-            snippet=match.get("line_content"),
+            snippet=snippet,
             remediation=rule.remediation,
             analyzer="static",
             metadata={
                 "matched_pattern": match.get("matched_pattern"),
-                "matched_text": match.get("matched_text"),
+                "matched_text": matched_text,
                 "aitech": threat_mapping.get("aitech") if threat_mapping else None,
                 "aitech_name": threat_mapping.get("aitech_name") if threat_mapping else None,
                 "scanner_category": threat_mapping.get("scanner_category") if threat_mapping else None,

skill_scanner/core/loader.py

@@ -282,7 +282,8 @@ def _extract_referenced_files(self, instruction_body: str) -> list[str]:
         for _, link in markdown_links:
             # Filter out URLs, keep relative file paths
             if not link.startswith(("http://", "https://", "ftp://", "#")):
-                references.append(link)
+                if ".." not in link and not link.startswith("/"):
+                    references.append(link)
 
         # Match "see FILE.md" or "refer to FILE.md" patterns
         # Use backticks or quotes to identify actual file references, avoiding false matches like "the.py"
@@ -347,8 +348,8 @@ def _extract_referenced_files(self, instruction_body: str) -> list[str]:
             references.append(f"assets/{pattern}")
             references.append(f"templates/{pattern}")
 
-        # Return unique references
-        return list(set(references))
+        # Filter out any references with path traversal sequences
+        return list({r for r in references if ".." not in r and not r.startswith("/")})
 
     def extract_references_from_file(self, file_path: Path, content: str) -> list[str]:
         """
@@ -410,7 +411,8 @@ def extract_references_from_file(self, file_path: Path, content: str) -> list[st
             source_patterns = re.findall(r"(?:source|\.)\s+([A-Za-z0-9_\-./]+\.(?:sh|bash))", content)
             references.extend(source_patterns)
 
-        return list(set(references))
+        # Filter out any references with path traversal sequences
+        return list({r for r in references if ".." not in r and not r.startswith("/")})
 
 
 def load_skill(