mirror of
https://github.com/trailofbits/skills
synced 2026-06-21 14:12:00 +00:00
ed41cd7ceb
* Import four plugins from skills-internal and clean up README Import seatbelt-sandboxer, supply-chain-risk-auditor, zeroize-audit, and let-fate-decide from skills-internal. Remove dead humanizer and skill-extractor directories. Fold "About Trail of Bits" into the license line. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix CI: shellcheck SC2317 and let-fate-decide description mismatch Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Import agentic-actions-auditor from skills-internal Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Fix review issues across 5 imported plugins - Fix empty array expansion crash under set -u on macOS bash 3.2 (emit_rust_mir.sh, emit_asm.sh, emit_ir.sh) - Fix copy-paste error in seatbelt-sandboxer README ("variant analysis") - Remove references to non-existent leak-hunter skill - Update agentic-actions-auditor license to match repo CC-BY-SA-4.0 - Add PEP 723 metadata to check_rust_asm_{aarch64,x86}.py - Replace unsafe xargs trim with parameter expansion in track_dataflow.sh - Add json_escape function to analyze_asm.sh, analyze_heap.sh, track_dataflow.sh for safe JSON construction with backslashes - Add allowed-tools frontmatter to seatbelt-sandboxer and supply-chain-risk-auditor SKILL.md - Add minimum finding count assertions to run_smoke.sh - Fix double period typo in supply-chain-risk-auditor SKILL.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
40 lines
1020 B
YAML
40 lines
1020 B
YAML
fn demo_async() -> Result<(), ()> {
|
|
debug secret_key => _1;
|
|
debug token => _2;
|
|
_3 = <closure_capture as closure>::new(move _2);
|
|
_4 = Err(());
|
|
yield();
|
|
return;
|
|
}
|
|
|
|
fn drop_in_place_secret() {
|
|
debug secret_key => _5;
|
|
drop(_5);
|
|
return;
|
|
}
|
|
|
|
// Exercises detect_resume_with_live_secrets (MISSING_SOURCE_ZEROIZE/medium)
|
|
// and detect_drop_before_storagedead medium branch (no 'return' keyword).
|
|
fn unwind_only_secret() {
|
|
debug secret_key => _6;
|
|
drop(_6);
|
|
resume;
|
|
}
|
|
|
|
// Exercises detect_aggregate_move_non_zeroizing (SECRET_COPY/medium):
|
|
// sensitive local moved into a non-Zeroizing struct.
|
|
fn wrap_secret_in_buffer() {
|
|
debug secret_key => _7;
|
|
_8 = PlainBuffer { data: move _7 };
|
|
return;
|
|
}
|
|
|
|
// Exercises detect_ffi_call_with_secret (SECRET_COPY/high):
|
|
// sensitive local passed to a C FFI call (::c_ matches the FFI heuristic).
|
|
fn call_c_encrypt() {
|
|
debug secret_key => _9;
|
|
call c_crypto::c_encrypt(_9) -> [return: bb1, unwind: resume];
|
|
bb1:
|
|
return;
|
|
}
|