hefestoai-auditor

TotalClaw 作者 totalclaw v2.2.0

静态代码分析工具。检测 17 种语言的安全漏洞、代码异味和复杂性问题。所有分析都在本地运行——没有代码离开您的机器。

安装 / 下载方式

TotalClaw CLI推荐

totalclaw skills install shop:totalclaw:totalclaw~artvepa80-hefestoai-auditor

cURL直接下载，无需登录

curl -fsSL https://skills.taituai.com/api/skills/totalclaw%3Atotalclaw~artvepa80-hefestoai-auditor/file -o artvepa80-hefestoai-auditor.md

# HefestoAI Auditor

Static code analysis for security, quality, and complexity. Supports 17 languages.

**Privacy:** All analysis runs locally. No code is transmitted to external services. No network calls are made during analysis.

**Permissions:** This tool reads source files in the specified directory (read-only). It does not modify your code.

---

## Install

```bash
pip install hefesto-ai
```

## Quick Start

```bash
hefesto analyze /path/to/project --severity HIGH
```

### Severity Levels

```bash
hefesto analyze /path/to/project --severity CRITICAL   # Critical only
hefesto analyze /path/to/project --severity HIGH        # High + Critical
hefesto analyze /path/to/project --severity MEDIUM      # Medium + High + Critical
hefesto analyze /path/to/project --severity LOW         # Everything
```

### Output Formats

```bash
hefesto analyze /path/to/project --output text                          # Terminal (default)
hefesto analyze /path/to/project --output json                          # Structured JSON
hefesto analyze /path/to/project --output html --save-html report.html  # HTML report
hefesto analyze /path/to/project --quiet                                # Summary only
```

### Status and Version

```bash
hefesto status
hefesto --version
```

---

## What It Detects

### Security Vulnerabilities
- SQL injection and command injection
- Hardcoded secrets (API keys, passwords, tokens)
- Insecure configurations (Dockerfiles, Terraform, YAML)
- Path traversal and XSS risks

### Semantic Drift (AI Code Integrity)
- Logic alterations that preserve syntax but change intent
- Architectural degradation from AI-generated code
- Hidden duplicates and inconsistencies in monorepos

### Code Quality
- Cyclomatic complexity >10 (HIGH) or >20 (CRITICAL)
- Deep nesting (>4 levels)
- Long functions (>50 lines)
- Code smells and anti-patterns

### DevOps Issues
- Dockerfile: missing USER, no HEALTHCHECK, running as root
- Shell: missing `set -euo pipefail`, unquoted variables
- Terraform: missing tags, hardcoded values

### What It Does NOT Detect
- Runtime network attacks (DDoS, port scanning)
- Active intrusions (rootkits, privilege escalation)
- Network traffic monitoring
- For these, use SIEM/IDS/IPS or GCP Security Command Center

---

## Supported Languages (17)

**Code:** Python, TypeScript, JavaScript, Java, Go, Rust, C#

**DevOps/Config:** Dockerfile, Jenkins/Groovy, JSON, Makefile, PowerShell, Shell, SQL, Terraform, TOML, YAML

---

## Interpreting Results

```
file.py:42:10
  Issue: Hardcoded database password detected
  Function: connect_db
  Type: HARDCODED_SECRET
  Severity: CRITICAL
  Suggestion: Move credentials to environment variables or a secrets manager
```

### Issue Types

| Type | Severity | Action |
|------|----------|--------|
| `VERY_HIGH_COMPLEXITY` | CRITICAL | Fix immediately |
| `HIGH_COMPLEXITY` | HIGH | Fix in current sprint |
| `DEEP_NESTING` | HIGH | Refactor nesting levels |
| `SQL_INJECTION_RISK` | HIGH | Parameterize queries |
| `HARDCODED_SECRET` | CRITICAL | Remove and rotate |
| `LONG_FUNCTION` | MEDIUM | Split function |

---

## CI/CD Integration

```bash
# Fail build on HIGH or CRITICAL issues
hefesto analyze /path/to/project --fail-on HIGH

# Pre-push git hook
hefesto install-hook

# Limit output
hefesto analyze /path/to/project --max-issues 10

# Exclude specific issue types
hefesto analyze /path/to/project --exclude-types VERY_HIGH_COMPLEXITY,LONG_FUNCTION
```

---

## Licensing

| Tier | Price | Key Features |
|------|-------|-------------|
| **FREE** | $0/mo | Static analysis, 17 languages, pre-push hooks |
| **PRO** | $8/mo | ML semantic analysis, REST API, BigQuery integration, custom rules |
| **OMEGA** | $19/mo | IRIS monitoring, auto-correlation, real-time alerts, team dashboard |

All paid tiers include a **14-day free trial**.

See pricing and subscribe at [hefestoai.narapallc.com](https://hefestoai.narapallc.com).

To activate a license, see the setup guide at [hefestoai.narapallc.com/setup](https://hefestoai.narapallc.com/setup).

---

## About

Created by **Narapa LLC** (Miami, FL) — Arturo Velasquez (@artvepa)

- GitHub: [github.com/artvepa80/Agents-Hefesto](https://github.com/artvepa80/Agents-Hefesto)
- Support: support@narapallc.com

---

## 中文说明

# HefestoAI Auditor

面向安全性、质量和复杂性的静态代码分析。支持 17 种语言。

**隐私：** 所有分析都在本地运行。不会向外部服务传输任何代码。分析期间不进行任何网络调用。

**权限：** 此工具读取指定目录中的源文件（只读）。它不会修改你的代码。

---

## 安装

```bash
pip install hefesto-ai
```

## 快速开始

```bash
hefesto analyze /path/to/project --severity HIGH
```

### 严重级别

```bash
hefesto analyze /path/to/project --severity CRITICAL   # Critical only
hefesto analyze /path/to/project --severity HIGH        # High + Critical
hefesto analyze /path/to/project --severity MEDIUM      # Medium + High + Critical
hefesto analyze /path/to/project --severity LOW         # Everything
```

### 输出格式

```bash
hefesto analyze /path/to/project --output text                          # Terminal (default)
hefesto analyze /path/to/project --output json                          # Structured JSON
hefesto analyze /path/to/project --output html --save-html report.html  # HTML report
hefesto analyze /path/to/project --quiet                                # Summary only
```

### 状态与版本

```bash
hefesto status
hefesto --version
```

---

## 它能检测什么

### 安全漏洞
- SQL 注入和命令注入
- 硬编码密钥（API 密钥、密码、令牌）
- 不安全的配置（Dockerfile、Terraform、YAML）
- 路径遍历和 XSS 风险

### 语义漂移（AI 代码完整性）
- 保留语法但改变意图的逻辑变更
- AI 生成代码导致的架构退化
- monorepo 中隐藏的重复和不一致

### 代码质量
- 圈复杂度 >10（HIGH）或 >20（CRITICAL）
- 深层嵌套（>4 层）
- 过长函数（>50 行）
- 代码异味和反模式

### DevOps 问题
- Dockerfile：缺少 USER、无 HEALTHCHECK、以 root 运行
- Shell：缺少 `set -euo pipefail`、未加引号的变量
- Terraform：缺少标签、硬编码值

### 它不会检测什么
- 运行时网络攻击（DDoS、端口扫描）
- 活跃入侵（rootkit、权限提升）
- 网络流量监控
- 对于这些，请使用 SIEM/IDS/IPS 或 GCP Security Command Center

---

## 支持的语言（17 种）

**代码：** Python、TypeScript、JavaScript、Java、Go、Rust、C#

**DevOps/配置：** Dockerfile、Jenkins/Groovy、JSON、Makefile、PowerShell、Shell、SQL、Terraform、TOML、YAML

---

## 解读结果

```
file.py:42:10
  Issue: Hardcoded database password detected
  Function: connect_db
  Type: HARDCODED_SECRET
  Severity: CRITICAL
  Suggestion: Move credentials to environment variables or a secrets manager
```

### 问题类型

| 类型 | 严重级别 | 操作 |
|------|----------|--------|
| `VERY_HIGH_COMPLEXITY` | CRITICAL | 立即修复 |
| `HIGH_COMPLEXITY` | HIGH | 在当前迭代中修复 |
| `DEEP_NESTING` | HIGH | 重构嵌套层级 |
| `SQL_INJECTION_RISK` | HIGH | 参数化查询 |
| `HARDCODED_SECRET` | CRITICAL | 移除并轮换 |
| `LONG_FUNCTION` | MEDIUM | 拆分函数 |

---

## CI/CD 集成

```bash
# Fail build on HIGH or CRITICAL issues
hefesto analyze /path/to/project --fail-on HIGH

# Pre-push git hook
hefesto install-hook

# Limit output
hefesto analyze /path/to/project --max-issues 10

# Exclude specific issue types
hefesto analyze /path/to/project --exclude-types VERY_HIGH_COMPLEXITY,LONG_FUNCTION
```

---

## 许可

| 层级 | 价格 | 关键功能 |
|------|-------|-------------|
| **FREE** | $0/mo | 静态分析、17 种语言、pre-push 钩子 |
| **PRO** | $8/mo | ML 语义分析、REST API、BigQuery 集成、自定义规则 |
| **OMEGA** | $19/mo | IRIS 监控、自动关联、实时告警、团队仪表盘 |

所有付费层级均包含 **14 天免费试用**。

在 [hefestoai.narapallc.com](https://hefestoai.narapallc.com) 查看定价并订阅。

要激活许可证，请查看 [hefestoai.narapallc.com/setup](https://hefestoai.narapallc.com/setup) 上的设置指南。

---

## 关于

由 **Narapa LLC**（Miami, FL）创建 — Arturo Velasquez (@artvepa)

- GitHub: [github.com/artvepa80/Agents-Hefesto](https://github.com/artvepa80/Agents-Hefesto)
- 支持: support@narapallc.com