diff --git a/skills/artvepa80/hefestoai-auditor/SKILL.md b/skills/artvepa80/hefestoai-auditor/SKILL.md index 1df38c5c1de..f3da02b48bb 100644 --- a/skills/artvepa80/hefestoai-auditor/SKILL.md +++ b/skills/artvepa80/hefestoai-auditor/SKILL.md @@ -1,7 +1,7 @@ --- name: hefestoai-auditor version: "2.1.0" -description: "AI-powered architectural guardian with Socratic Adaptive Constitution. Runs security audits, detects semantic drift, analyzes complexity, and prevents AI-generated code degradation across 17 languages. Governed by formal ethical principles and multi-model awareness." +description: "Static code analysis tool. Detects security vulnerabilities, code smells, and complexity issues across 17 languages. All analysis runs locally — no code leaves your machine." metadata: { "openclaw": @@ -22,48 +22,47 @@ metadata: } --- -# HefestoAI Auditor Skill v2.0 +# HefestoAI Auditor -AI-powered architectural guardian. Not just a code analyzer — a **security and quality governance system** governed by a Socratic Adaptive Constitution. +Static code analysis for security, quality, and complexity. Supports 17 languages. -## What's New in v2.0 +**Privacy:** All analysis runs locally. No code is transmitted to external services. No network calls are made during analysis. -- **Constitución Socrática Adaptativa:** Formal ethical framework governing all bot behavior -- **Semantic Drift Detection:** Identifies when AI-generated code subtly alters logical intent -- **Multi-Model Architecture (Active):** Grok, DeepSeek, Claude, and OpenAI integrated as operational sub-agents -- **Enhanced Security Posture:** Explicit security scope definition and continuous audit principle -- **Optimized Token Management:** Structured outputs and delta-based communication +**Permissions:** This tool reads source files in the specified directory (read-only). It does not modify your code. --- -## Quick Start +## Install -### Run a full audit +```bash +pip install hefesto-ai +``` + +## Quick Start ```bash -source /home/user/.hefesto_env 2>/dev/null -hefesto analyze /absolute/path/to/project --severity HIGH --exclude venv,node_modules,.git +hefesto analyze /path/to/project --severity HIGH ``` -### Severity levels +### Severity Levels ```bash -hefesto analyze /path --severity CRITICAL # Critical only -hefesto analyze /path --severity HIGH # High + Critical -hefesto analyze /path --severity MEDIUM # Medium + High + Critical -hefesto analyze /path --severity LOW # Everything +hefesto analyze /path/to/project --severity CRITICAL # Critical only +hefesto analyze /path/to/project --severity HIGH # High + Critical +hefesto analyze /path/to/project --severity MEDIUM # Medium + High + Critical +hefesto analyze /path/to/project --severity LOW # Everything ``` -### Output formats +### Output Formats ```bash -hefesto analyze /path --output text # Terminal (default) -hefesto analyze /path --output json # Structured JSON -hefesto analyze /path --output html --save-html report.html # HTML report -hefesto analyze /path --quiet # Summary only +hefesto analyze /path/to/project --output text # Terminal (default) +hefesto analyze /path/to/project --output json # Structured JSON +hefesto analyze /path/to/project --output html --save-html report.html # HTML report +hefesto analyze /path/to/project --quiet # Summary only ``` -### Status and version +### Status and Version ```bash hefesto status @@ -72,21 +71,6 @@ hefesto --version --- -## Socratic Adaptive Constitution (Summary) - -This skill operates under a formal constitution with 6 chapters: - -1. **Fundamental Principles:** Truthfulness, human leadership, continuous audit, beneficence, accountability, privacy -2. **Socratic Adaptive Method (MSA):** 4-phase workflow — Diagnose, Decide (max 2 questions), Execute (minimal impact), Verify -3. **Multi-Model Architecture:** Current Gemini + future DeepSeek/Claude Code/Grok roles -4. **Security:** Shift-left code/config vulnerabilities (not runtime/network) -5. **Operational Rules:** Anti-spam, anti-hallucination, structured responses -6. **Capabilities:** Audit protocol, social publishing, dev tools - -Full constitution: see workspace `CLAUDE.md` - ---- - ## What It Detects ### Security Vulnerabilities @@ -122,6 +106,7 @@ Full constitution: see workspace `CLAUDE.md` ## Supported Languages (17) **Code:** Python, TypeScript, JavaScript, Java, Go, Rust, C# + **DevOps/Config:** Dockerfile, Jenkins/Groovy, JSON, Makefile, PowerShell, Shell, SQL, Terraform, TOML, YAML --- @@ -129,15 +114,16 @@ Full constitution: see workspace `CLAUDE.md` ## Interpreting Results ``` -📄 :: -├─ Issue: -├─ Function: -├─ Type: -├─ Severity: CRITICAL | HIGH | MEDIUM | LOW -└─ Suggestion: +file.py:42:10 + Issue: Hardcoded database password detected + Function: connect_db + Type: HARDCODED_SECRET + Severity: CRITICAL + Suggestion: Move credentials to environment variables or a secrets manager ``` ### Issue Types + | Type | Severity | Action | |------|----------|--------| | `VERY_HIGH_COMPLEXITY` | CRITICAL | Fix immediately | @@ -149,96 +135,43 @@ Full constitution: see workspace `CLAUDE.md` --- -## Pro Tips +## CI/CD Integration ```bash -# CI/CD gate - fail build on issues -hefesto analyze /path --fail-on HIGH --exclude venv +# Fail build on HIGH or CRITICAL issues +hefesto analyze /path/to/project --fail-on HIGH -# Pre-push hook +# Pre-push git hook hefesto install-hook # Limit output -hefesto analyze /path --max-issues 10 +hefesto analyze /path/to/project --max-issues 10 -# Exclude specific types -hefesto analyze /path --exclude-types VERY_HIGH_COMPLEXITY,LONG_FUNCTION -``` - -### Wrapper Script (Recommended) - -```bash -#!/bin/bash -source /home/user/.hefesto_env 2>/dev/null -exec hefesto "$@" +# Exclude specific issue types +hefesto analyze /path/to/project --exclude-types VERY_HIGH_COMPLEXITY,LONG_FUNCTION ``` --- -## Multi-Model Architecture (Active) - -HefestoAI Auditor is designed to work within a 4-model system: - -| Model | Role | Status | -|-------|------|--------| -| **Gemini 2.5 Flash** | Central brain + ethical filter | Active | -| **DeepSeek** | Logical architect (formalization) | Active | -| **Claude Code** | Senior coder (generation + refactoring) | Active | -| **Grok** | Strategist + social sensor (X/Twitter) | Active | -| **OpenAI GPT** | Complementary analyst | Active | - -HefestoAI acts as the **external audit layer** — reviewing output from all models for security and quality compliance. - -### Multi-Model Commands - -```bash -# Query individual models -source ~/.hefesto_env 2>/dev/null -python3 ~/hefesto_tools/multi_model/query_model.py --model grok "Analyze trends" -python3 ~/hefesto_tools/multi_model/query_model.py --model deepseek "Formalize this algorithm" -python3 ~/hefesto_tools/multi_model/query_model.py --model claude "Review this code" - -# Run constitutional pipelines -python3 ~/hefesto_tools/multi_model/orchestrate.py --task code-review --input "def foo(): ..." -python3 ~/hefesto_tools/multi_model/orchestrate.py --task full-cycle --input "Design a webhook validator" -python3 ~/hefesto_tools/multi_model/orchestrate.py --task strategy --input "Position vs Devin" -``` - ---- - -## Licensing Tiers +## Licensing | Tier | Price | Key Features | |------|-------|-------------| | **FREE** | $0/mo | Static analysis, 17 languages, pre-push hooks | -| **PRO** | $8/mo | ML semantic analysis, REST API, BigQuery, custom rules | +| **PRO** | $8/mo | ML semantic analysis, REST API, BigQuery integration, custom rules | | **OMEGA** | $19/mo | IRIS monitoring, auto-correlation, real-time alerts, team dashboard | All paid tiers include a **14-day free trial**. -- **PRO**: https://buy.stripe.com/4gM00i6jE6gV3zE4HseAg0b -- **OMEGA**: https://buy.stripe.com/14A9AS23o20Fgmqb5QeAg0c - -```bash -export HEFESTO_LICENSE_KEY= -hefesto status # verify tier -``` - ---- - -## Important Rules +See pricing and subscribe at [hefestoai.narapallc.com](https://hefestoai.narapallc.com). -- **ALWAYS** use absolute paths, never `.` or relative paths -- **ALWAYS** load environment first: `source /home/user/.hefesto_env` -- **ALWAYS** exclude: `--exclude venv,node_modules,.git` -- **REPORT ONLY** what hefesto returns — never invent or add issues +To activate a license, see the setup guide at [hefestoai.narapallc.com/setup](https://hefestoai.narapallc.com/setup). --- ## About Created by **Narapa LLC** (Miami, FL) — Arturo Velasquez (@artvepa) -GitHub: https://github.com/artvepa80/Agents-Hefesto -Support: support@narapallc.com -> "El código limpio es código seguro" 🛡️ +- GitHub: [github.com/artvepa80/Agents-Hefesto](https://github.com/artvepa80/Agents-Hefesto) +- Support: support@narapallc.com