/** * Security Scanner — password-protected archive evasion detector * @module @skillsmith/core/security/scanner/SecurityScanner.archive * * SMI-6033 Wave 2 (Gap 3): zero zip/archive/password logic existed anywhere * in the scanner before this file. Two sub-signals, single finding type * (`archive_evasion`), two-tier severity within that one type: * * - CLI invocation syntax (`unzip -P`, `unrar x -p`, `7z x -p`, * `zip -P ... -e`) — precise, low-FP. * - Prose co-occurrence (an archive noun + a password noun within a bounded * ±2-line window) — the FP-prone fuzzy case, kept as a SEPARATE code path * from the CLI-syntax case so its confidence/severity can stay capped * independently. * * Per the plan's §9 provenance-conditioned quarantine policy: a signal may * quarantine alone only when a provenance condition specific to THIS skill's * own content removes the legitimate interpretations. For archive passwords * that condition is "inline literal password AND correlated with a fetch * destination in the same content" — every legitimate counter-example * (licensed SDK, commercial font/media pack, encrypted export, vendor * support bundle) delivers the password out-of-band; shipping it inline next * to the fetched archive nullifies the encryption's only non-evasion * purpose. Every other shape (out-of-band `$VAR`/placeholder password, * uncorrelated CLI usage, or prose-only mention) stays medium (advisory, * co-signal-eligible) — never split into a second finding type, per the * plan's explicit instruction; severity alone carries the two-tier design, * mirroring how scanChmodFetchCompound's own compound signal uses ONE type * (privilege_escalation) with severity (not weight) doing the tiering. */ import type { SecurityFinding } from './types.js'; import type { LineContext } from './SecurityScanner.helpers.js'; export declare function scanArchiveEvasion(content: string, lineContexts?: LineContext[]): SecurityFinding[]; //# sourceMappingURL=SecurityScanner.archive.d.ts.map