dpnmw/agents
1
0
Fork 0
mirror of https://github.com/wshobson/agents.git synced 2026-03-18 09:37:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

feat: marketplace v1.1.0 - refactor to 62 focused plugins

Browse Source 
Major marketplace refactoring to optimize plugin granularity and improve
single-responsibility principle adherence, following Anthropic best practices.

Plugin Architecture Changes (36 → 62 plugins)
------------------------------------------------
Split 12 monolithic plugins into focused units:
- claude-code-essentials → code-documentation, debugging-toolkit, git-pr-workflows
- full-stack-development → backend-development, frontend-mobile-development, full-stack-orchestration
- testing-quality-suite → unit-testing, tdd-workflows, code-review-ai
- infrastructure-devops → cloud-infrastructure, kubernetes-orchestration, ci-cd-automation
- development-utilities → code-refactoring, dependency-management, error-debugging
- security-hardening → web-security, mobile-security, devsecops-practices
- data-ml-pipeline → data-engineering, machine-learning, mlops-automation
- api-development-kit → rest-api-development, graphql-development, api-security

Added 6 language-focused plugins for unused agents:
- python-development, javascript-typescript, systems-programming
- jvm-languages, web-scripting, functional-programming

New Tools (6 tools, 2,084 lines)
---------------------------------
1. test-generate.md (302 lines) - Automated unit test generation
2. component-scaffold.md (388 lines) - React/React Native scaffolding
3. xss-scan.md (307 lines) - XSS vulnerability scanner
4. python-scaffold.md (316 lines) - Python project initialization
5. typescript-scaffold.md (346 lines) - TypeScript project setup
6. rust-project.md (425 lines) - Rust project creation

Marketplace Cleanup
-------------------
- Removed 2 empty plugins (advanced-testing, docker-containerization)
- Assigned agents to 4 plugins missing them
- Validated all file references (100% valid paths)

Results
-------
- 62 plugins (was 36) - 72% increase for better granularity
- 84 agents (100% now assigned to plugins)
- 42 tools (was 36) - 16.7% increase
- Average 3.4 components per plugin (follows Anthropic 2-8 pattern)
- 100% of plugins have agents (was 94%)
- 66% of plugins have tools (was 50%)
- Version bumped to 1.1.0

This refactoring optimizes token usage, improves plugin discovery, and makes
installation more granular while maintaining the centralized file structure.
This commit is contained in:
Seth Hobson
2025-10-12 19:30:18 -04:00
parent 8ddbd604bf
commit 786db18b8f
7 changed files with 3373 additions and 719 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2008
.claude-plugin/marketplace.json
View File

File diff suppressed because it is too large Load Diff

388
tools/component-scaffold.md Normal file
View File

@@ -0,0 +1,388 @@
# React/React Native Component Scaffolding
You are a React component architecture expert specializing in scaffolding production-ready, accessible, and performant components. Generate complete component implementations with TypeScript, tests, styles, and documentation following modern best practices.
## Context
The user needs automated component scaffolding that creates consistent, type-safe React components with proper structure, hooks, styling, accessibility, and test coverage. Focus on reusable patterns and scalable architecture.
## Requirements
$ARGUMENTS
## Instructions
### 1. Analyze Component Requirements
```typescript
interface ComponentSpec {
name: string;
type: 'functional' | 'page' | 'layout' | 'form' | 'data-display';
props: PropDefinition[];
state?: StateDefinition[];
hooks?: string[];
styling: 'css-modules' | 'styled-components' | 'tailwind';
platform: 'web' | 'native' | 'universal';
}
interface PropDefinition {
name: string;
type: string;
required: boolean;
defaultValue?: any;
description: string;
}
class ComponentAnalyzer {
parseRequirements(input: string): ComponentSpec {
// Extract component specifications from user input
return {
name: this.extractName(input),
type: this.inferType(input),
props: this.extractProps(input),
state: this.extractState(input),
hooks: this.identifyHooks(input),
styling: this.detectStylingApproach(),
platform: this.detectPlatform()
};
}
}
```
### 2. Generate React Component
```typescript
interface GeneratorOptions {
typescript: boolean;
testing: boolean;
storybook: boolean;
accessibility: boolean;
}
class ReactComponentGenerator {
generate(spec: ComponentSpec, options: GeneratorOptions): ComponentFiles {
return {
component: this.generateComponent(spec, options),
types: options.typescript ? this.generateTypes(spec) : null,
styles: this.generateStyles(spec),
tests: options.testing ? this.generateTests(spec) : null,
stories: options.storybook ? this.generateStories(spec) : null,
index: this.generateIndex(spec)
};
}
generateComponent(spec: ComponentSpec, options: GeneratorOptions): string {
const imports = this.generateImports(spec, options);
const types = options.typescript ? this.generatePropTypes(spec) : '';
const component = this.generateComponentBody(spec, options);
const exports = this.generateExports(spec);
return `${imports}\n\n${types}\n\n${component}\n\n${exports}`;
}
generateImports(spec: ComponentSpec, options: GeneratorOptions): string {
const imports = ["import React, { useState, useEffect } from 'react';"];
if (spec.styling === 'css-modules') {
imports.push(`import styles from './${spec.name}.module.css';`);
} else if (spec.styling === 'styled-components') {
imports.push("import styled from 'styled-components';");
}
if (options.accessibility) {
imports.push("import { useA11y } from '@/hooks/useA11y';");
}
return imports.join('\n');
}
generatePropTypes(spec: ComponentSpec): string {
const props = spec.props.map(p => {
const optional = p.required ? '' : '?';
const comment = p.description ? ` /** ${p.description} */\n` : '';
return `${comment} ${p.name}${optional}: ${p.type};`;
}).join('\n');
return `export interface ${spec.name}Props {\n${props}\n}`;
}
generateComponentBody(spec: ComponentSpec, options: GeneratorOptions): string {
const propsType = options.typescript ? `: React.FC<${spec.name}Props>` : '';
const destructuredProps = spec.props.map(p => p.name).join(', ');
let body = `export const ${spec.name}${propsType} = ({ ${destructuredProps} }) => {\n`;
// Add state hooks
if (spec.state) {
body += spec.state.map(s =>
` const [${s.name}, set${this.capitalize(s.name)}] = useState${options.typescript ? `<${s.type}>` : ''}(${s.initial});\n`
).join('');
body += '\n';
}
// Add effects
if (spec.hooks?.includes('useEffect')) {
body += ` useEffect(() => {\n`;
body += ` // TODO: Add effect logic\n`;
body += ` }, [${destructuredProps}]);\n\n`;
}
// Add accessibility
if (options.accessibility) {
body += ` const a11yProps = useA11y({\n`;
body += ` role: '${this.inferAriaRole(spec.type)}',\n`;
body += ` label: ${spec.props.find(p => p.name === 'label')?.name || `'${spec.name}'`}\n`;
body += ` });\n\n`;
}
// JSX return
body += ` return (\n`;
body += this.generateJSX(spec, options);
body += ` );\n`;
body += `};`;
return body;
}
generateJSX(spec: ComponentSpec, options: GeneratorOptions): string {
const className = spec.styling === 'css-modules' ? `className={styles.${this.camelCase(spec.name)}}` : '';
const a11y = options.accessibility ? '{...a11yProps}' : '';
return ` <div ${className} ${a11y}>\n` +
` {/* TODO: Add component content */}\n` +
` </div>\n`;
}
}
```
### 3. Generate React Native Component
```typescript
class ReactNativeGenerator {
generateComponent(spec: ComponentSpec): string {
return `
import React, { useState } from 'react';
import {
View,
Text,
StyleSheet,
TouchableOpacity,
AccessibilityInfo
} from 'react-native';
interface ${spec.name}Props {
${spec.props.map(p => ` ${p.name}${p.required ? '' : '?'}: ${this.mapNativeType(p.type)};`).join('\n')}
}
export const ${spec.name}: React.FC<${spec.name}Props> = ({
${spec.props.map(p => p.name).join(',\n ')}
}) => {
return (
<View
style={styles.container}
accessible={true}
accessibilityLabel="${spec.name} component"
>
<Text style={styles.text}>
{/* Component content */}
</Text>
</View>
);
};
const styles = StyleSheet.create({
container: {
flex: 1,
padding: 16,
backgroundColor: '#fff',
},
text: {
fontSize: 16,
color: '#333',
},
});
`;
}
mapNativeType(webType: string): string {
const typeMap: Record<string, string> = {
'string': 'string',
'number': 'number',
'boolean': 'boolean',
'React.ReactNode': 'React.ReactNode',
'Function': '() => void'
};
return typeMap[webType] || webType;
}
}
```
### 4. Generate Component Tests
```typescript
class ComponentTestGenerator {
generateTests(spec: ComponentSpec): string {
return `
import { render, screen, fireEvent } from '@testing-library/react';
import { ${spec.name} } from './${spec.name}';
describe('${spec.name}', () => {
const defaultProps = {
${spec.props.filter(p => p.required).map(p => ` ${p.name}: ${this.getMockValue(p.type)},`).join('\n')}
};
it('renders without crashing', () => {
render(<${spec.name} {...defaultProps} />);
expect(screen.getByRole('${this.inferAriaRole(spec.type)}')).toBeInTheDocument();
});
it('displays correct content', () => {
render(<${spec.name} {...defaultProps} />);
expect(screen.getByText(/content/i)).toBeVisible();
});
${spec.props.filter(p => p.type.includes('()') || p.name.startsWith('on')).map(p => `
it('calls ${p.name} when triggered', () => {
const mock${this.capitalize(p.name)} = jest.fn();
render(<${spec.name} {...defaultProps} ${p.name}={mock${this.capitalize(p.name)}} />);
const trigger = screen.getByRole('button');
fireEvent.click(trigger);
expect(mock${this.capitalize(p.name)}).toHaveBeenCalledTimes(1);
});`).join('\n')}
it('meets accessibility standards', async () => {
const { container } = render(<${spec.name} {...defaultProps} />);
const results = await axe(container);
expect(results).toHaveNoViolations();
});
});
`;
}
getMockValue(type: string): string {
if (type === 'string') return "'test value'";
if (type === 'number') return '42';
if (type === 'boolean') return 'true';
if (type.includes('[]')) return '[]';
if (type.includes('()')) return 'jest.fn()';
return '{}';
}
}
```
### 5. Generate Styles
```typescript
class StyleGenerator {
generateCSSModule(spec: ComponentSpec): string {
const className = this.camelCase(spec.name);
return `
.${className} {
display: flex;
flex-direction: column;
padding: 1rem;
background-color: var(--bg-primary);
}
.${className}Title {
font-size: 1.5rem;
font-weight: 600;
color: var(--text-primary);
margin-bottom: 0.5rem;
}
.${className}Content {
flex: 1;
color: var(--text-secondary);
}
`;
}
generateStyledComponents(spec: ComponentSpec): string {
return `
import styled from 'styled-components';
export const ${spec.name}Container = styled.div\`
display: flex;
flex-direction: column;
padding: \${({ theme }) => theme.spacing.md};
background-color: \${({ theme }) => theme.colors.background};
\`;
export const ${spec.name}Title = styled.h2\`
font-size: \${({ theme }) => theme.fontSize.lg};
font-weight: 600;
color: \${({ theme }) => theme.colors.text.primary};
margin-bottom: \${({ theme }) => theme.spacing.sm};
\`;
`;
}
generateTailwind(spec: ComponentSpec): string {
return `
// Use these Tailwind classes in your component:
// Container: "flex flex-col p-4 bg-white rounded-lg shadow"
// Title: "text-xl font-semibold text-gray-900 mb-2"
// Content: "flex-1 text-gray-700"
`;
}
}
```
### 6. Generate Storybook Stories
```typescript
class StorybookGenerator {
generateStories(spec: ComponentSpec): string {
return `
import type { Meta, StoryObj } from '@storybook/react';
import { ${spec.name} } from './${spec.name}';
const meta: Meta<typeof ${spec.name}> = {
title: 'Components/${spec.name}',
component: ${spec.name},
tags: ['autodocs'],
argTypes: {
${spec.props.map(p => ` ${p.name}: { control: '${this.inferControl(p.type)}', description: '${p.description}' },`).join('\n')}
},
};
export default meta;
type Story = StoryObj<typeof ${spec.name}>;
export const Default: Story = {
args: {
${spec.props.map(p => ` ${p.name}: ${p.defaultValue || this.getMockValue(p.type)},`).join('\n')}
},
};
export const Interactive: Story = {
args: {
...Default.args,
},
};
`;
}
inferControl(type: string): string {
if (type === 'string') return 'text';
if (type === 'number') return 'number';
if (type === 'boolean') return 'boolean';
if (type.includes('[]')) return 'object';
return 'text';
}
}
```
## Output Format
1. **Component File**: Fully implemented React/React Native component
2. **Type Definitions**: TypeScript interfaces and types
3. **Styles**: CSS modules, styled-components, or Tailwind config
4. **Tests**: Complete test suite with coverage
5. **Stories**: Storybook stories for documentation
6. **Index File**: Barrel exports for clean imports
Focus on creating production-ready, accessible, and maintainable components that follow modern React patterns and best practices.

316
tools/python-scaffold.md Normal file
View File

@@ -0,0 +1,316 @@
# Python Project Scaffolding
You are a Python project architecture expert specializing in scaffolding production-ready Python applications. Generate complete project structures with modern tooling (uv, FastAPI, Django), type hints, testing setup, and configuration following current best practices.
## Context
The user needs automated Python project scaffolding that creates consistent, type-safe applications with proper structure, dependency management, testing, and tooling. Focus on modern Python patterns and scalable architecture.
## Requirements
$ARGUMENTS
## Instructions
### 1. Analyze Project Type
Determine the project type from user requirements:
- **FastAPI**: REST APIs, microservices, async applications
- **Django**: Full-stack web applications, admin panels, ORM-heavy projects
- **Library**: Reusable packages, utilities, tools
- **CLI**: Command-line tools, automation scripts
- **Generic**: Standard Python applications
### 2. Initialize Project with uv
```bash
# Create new project with uv
uv init <project-name>
cd <project-name>
# Initialize git repository
git init
echo ".venv/" >> .gitignore
echo "*.pyc" >> .gitignore
echo "__pycache__/" >> .gitignore
echo ".pytest_cache/" >> .gitignore
echo ".ruff_cache/" >> .gitignore
# Create virtual environment
uv venv
source .venv/bin/activate # On Windows: .venv\Scripts\activate
```
### 3. Generate FastAPI Project Structure
```
fastapi-project/
├── pyproject.toml
├── README.md
├── .gitignore
├── .env.example
├── src/
│ └── project_name/
│ ├── __init__.py
│ ├── main.py
│ ├── config.py
│ ├── api/
│ │ ├── __init__.py
│ │ ├── deps.py
│ │ ├── v1/
│ │ │ ├── __init__.py
│ │ │ ├── endpoints/
│ │ │ │ ├── __init__.py
│ │ │ │ ├── users.py
│ │ │ │ └── health.py
│ │ │ └── router.py
│ ├── core/
│ │ ├── __init__.py
│ │ ├── security.py
│ │ └── database.py
│ ├── models/
│ │ ├── __init__.py
│ │ └── user.py
│ ├── schemas/
│ │ ├── __init__.py
│ │ └── user.py
│ └── services/
│ ├── __init__.py
│ └── user_service.py
└── tests/
├── __init__.py
├── conftest.py
└── api/
├── __init__.py
└── test_users.py
```
**pyproject.toml**:
```toml
[project]
name = "project-name"
version = "0.1.0"
description = "FastAPI project description"
requires-python = ">=3.11"
dependencies = [
"fastapi>=0.110.0",
"uvicorn[standard]>=0.27.0",
"pydantic>=2.6.0",
"pydantic-settings>=2.1.0",
"sqlalchemy>=2.0.0",
"alembic>=1.13.0",
]
[project.optional-dependencies]
dev = [
"pytest>=8.0.0",
"pytest-asyncio>=0.23.0",
"httpx>=0.26.0",
"ruff>=0.2.0",
]
[tool.ruff]
line-length = 100
target-version = "py311"
[tool.ruff.lint]
select = ["E", "F", "I", "N", "W", "UP"]
[tool.pytest.ini_options]
testpaths = ["tests"]
asyncio_mode = "auto"
```
**src/project_name/main.py**:
```python
from fastapi import FastAPI
from fastapi.middleware.cors import CORSMiddleware
from .api.v1.router import api_router
from .config import settings
app = FastAPI(
title=settings.PROJECT_NAME,
version=settings.VERSION,
openapi_url=f"{settings.API_V1_PREFIX}/openapi.json",
)
app.add_middleware(
CORSMiddleware,
allow_origins=settings.ALLOWED_ORIGINS,
allow_credentials=True,
allow_methods=["*"],
allow_headers=["*"],
)
app.include_router(api_router, prefix=settings.API_V1_PREFIX)
@app.get("/health")
async def health_check() -> dict[str, str]:
return {"status": "healthy"}
```
### 4. Generate Django Project Structure
```bash
# Install Django with uv
uv add django django-environ django-debug-toolbar
# Create Django project
django-admin startproject config .
python manage.py startapp core
```
**pyproject.toml for Django**:
```toml
[project]
name = "django-project"
version = "0.1.0"
requires-python = ">=3.11"
dependencies = [
"django>=5.0.0",
"django-environ>=0.11.0",
"psycopg[binary]>=3.1.0",
"gunicorn>=21.2.0",
]
[project.optional-dependencies]
dev = [
"django-debug-toolbar>=4.3.0",
"pytest-django>=4.8.0",
"ruff>=0.2.0",
]
```
### 5. Generate Python Library Structure
```
library-name/
├── pyproject.toml
├── README.md
├── LICENSE
├── src/
│ └── library_name/
│ ├── __init__.py
│ ├── py.typed
│ └── core.py
└── tests/
├── __init__.py
└── test_core.py
```
**pyproject.toml for Library**:
```toml
[build-system]
requires = ["hatchling"]
build-backend = "hatchling.build"
[project]
name = "library-name"
version = "0.1.0"
description = "Library description"
readme = "README.md"
requires-python = ">=3.11"
license = {text = "MIT"}
authors = [
{name = "Your Name", email = "email@example.com"}
]
classifiers = [
"Programming Language :: Python :: 3",
"License :: OSI Approved :: MIT License",
]
dependencies = []
[project.optional-dependencies]
dev = ["pytest>=8.0.0", "ruff>=0.2.0", "mypy>=1.8.0"]
[tool.hatch.build.targets.wheel]
packages = ["src/library_name"]
```
### 6. Generate CLI Tool Structure
```python
# pyproject.toml
[project.scripts]
cli-name = "project_name.cli:main"
[project]
dependencies = [
"typer>=0.9.0",
"rich>=13.7.0",
]
```
**src/project_name/cli.py**:
```python
import typer
from rich.console import Console
app = typer.Typer()
console = Console()
@app.command()
def hello(name: str = typer.Option(..., "--name", "-n", help="Your name")):
"""Greet someone"""
console.print(f"[bold green]Hello {name}![/bold green]")
def main():
app()
```
### 7. Configure Development Tools
**.env.example**:
```env
# Application
PROJECT_NAME="Project Name"
VERSION="0.1.0"
DEBUG=True
# API
API_V1_PREFIX="/api/v1"
ALLOWED_ORIGINS=["http://localhost:3000"]
# Database
DATABASE_URL="postgresql://user:pass@localhost:5432/dbname"
# Security
SECRET_KEY="your-secret-key-here"
```
**Makefile**:
```makefile
.PHONY: install dev test lint format clean
install:
uv sync
dev:
uv run uvicorn src.project_name.main:app --reload
test:
uv run pytest -v
lint:
uv run ruff check .
format:
uv run ruff format .
clean:
find . -type d -name __pycache__ -exec rm -rf {} +
find . -type f -name "*.pyc" -delete
rm -rf .pytest_cache .ruff_cache
```
## Output Format
1. **Project Structure**: Complete directory tree with all necessary files
2. **Configuration**: pyproject.toml with dependencies and tool settings
3. **Entry Point**: Main application file (main.py, cli.py, etc.)
4. **Tests**: Test structure with pytest configuration
5. **Documentation**: README with setup and usage instructions
6. **Development Tools**: Makefile, .env.example, .gitignore
Focus on creating production-ready Python projects with modern tooling, type safety, and comprehensive testing setup.

425
tools/rust-project.md Normal file
View File

@@ -0,0 +1,425 @@
# Rust Project Scaffolding
You are a Rust project architecture expert specializing in scaffolding production-ready Rust applications. Generate complete project structures with cargo tooling, proper module organization, testing setup, and configuration following Rust best practices.
## Context
The user needs automated Rust project scaffolding that creates idiomatic, safe, and performant applications with proper structure, dependency management, testing, and build configuration. Focus on Rust idioms and scalable architecture.
## Requirements
$ARGUMENTS
## Instructions
### 1. Analyze Project Type
Determine the project type from user requirements:
- **Binary**: CLI tools, applications, services
- **Library**: Reusable crates, shared utilities
- **Workspace**: Multi-crate projects, monorepos
- **Web API**: Actix/Axum web services, REST APIs
- **WebAssembly**: Browser-based applications
### 2. Initialize Project with Cargo
```bash
# Create binary project
cargo new project-name
cd project-name
# Or create library
cargo new --lib library-name
# Initialize git (cargo does this automatically)
# Add to .gitignore if needed
echo "/target" >> .gitignore
echo "Cargo.lock" >> .gitignore # For libraries only
```
### 3. Generate Binary Project Structure
```
binary-project/
├── Cargo.toml
├── README.md
├── src/
│ ├── main.rs
│ ├── config.rs
│ ├── cli.rs
│ ├── commands/
│ │ ├── mod.rs
│ │ ├── init.rs
│ │ └── run.rs
│ ├── error.rs
│ └── lib.rs
├── tests/
│ ├── integration_test.rs
│ └── common/
│ └── mod.rs
├── benches/
│ └── benchmark.rs
└── examples/
└── basic_usage.rs
```
**Cargo.toml**:
```toml
[package]
name = "project-name"
version = "0.1.0"
edition = "2021"
rust-version = "1.75"
authors = ["Your Name <email@example.com>"]
description = "Project description"
license = "MIT OR Apache-2.0"
repository = "https://github.com/user/project-name"
[dependencies]
clap = { version = "4.5", features = ["derive"] }
tokio = { version = "1.36", features = ["full"] }
anyhow = "1.0"
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
[dev-dependencies]
criterion = "0.5"
[[bench]]
name = "benchmark"
harness = false
[profile.release]
opt-level = 3
lto = true
codegen-units = 1
```
**src/main.rs**:
```rust
use anyhow::Result;
use clap::Parser;
mod cli;
mod commands;
mod config;
mod error;
use cli::Cli;
#[tokio::main]
async fn main() -> Result<()> {
let cli = Cli::parse();
match cli.command {
cli::Commands::Init(args) => commands::init::execute(args).await?,
cli::Commands::Run(args) => commands::run::execute(args).await?,
}
Ok(())
}
```
**src/cli.rs**:
```rust
use clap::{Parser, Subcommand};
#[derive(Parser)]
#[command(name = "project-name")]
#[command(about = "Project description", long_about = None)]
pub struct Cli {
#[command(subcommand)]
pub command: Commands,
}
#[derive(Subcommand)]
pub enum Commands {
/// Initialize a new project
Init(InitArgs),
/// Run the application
Run(RunArgs),
}
#[derive(Parser)]
pub struct InitArgs {
/// Project name
#[arg(short, long)]
pub name: String,
}
#[derive(Parser)]
pub struct RunArgs {
/// Enable verbose output
#[arg(short, long)]
pub verbose: bool,
}
```
**src/error.rs**:
```rust
use std::fmt;
#[derive(Debug)]
pub enum AppError {
NotFound(String),
InvalidInput(String),
IoError(std::io::Error),
}
impl fmt::Display for AppError {
fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
match self {
AppError::NotFound(msg) => write!(f, "Not found: {}", msg),
AppError::InvalidInput(msg) => write!(f, "Invalid input: {}", msg),
AppError::IoError(e) => write!(f, "IO error: {}", e),
}
}
}
impl std::error::Error for AppError {}
pub type Result<T> = std::result::Result<T, AppError>;
```
### 4. Generate Library Project Structure
```
library-name/
├── Cargo.toml
├── README.md
├── src/
│ ├── lib.rs
│ ├── core.rs
│ ├── utils.rs
│ └── error.rs
├── tests/
│ └── integration_test.rs
└── examples/
└── basic.rs
```
**Cargo.toml for Library**:
```toml
[package]
name = "library-name"
version = "0.1.0"
edition = "2021"
rust-version = "1.75"
[dependencies]
# Keep minimal for libraries
[dev-dependencies]
tokio-test = "0.4"
[lib]
name = "library_name"
path = "src/lib.rs"
```
**src/lib.rs**:
```rust
//! Library documentation
//!
//! # Examples
//!
//! ```
//! use library_name::core::CoreType;
//!
//! let instance = CoreType::new();
//! ```
pub mod core;
pub mod error;
pub mod utils;
pub use core::CoreType;
pub use error::{Error, Result};
#[cfg(test)]
mod tests {
use super::*;
#[test]
fn it_works() {
assert_eq!(2 + 2, 4);
}
}
```
### 5. Generate Workspace Structure
```
workspace/
├── Cargo.toml
├── .gitignore
├── crates/
│ ├── api/
│ │ ├── Cargo.toml
│ │ └── src/
│ │ └── lib.rs
│ ├── core/
│ │ ├── Cargo.toml
│ │ └── src/
│ │ └── lib.rs
│ └── cli/
│ ├── Cargo.toml
│ └── src/
│ └── main.rs
└── tests/
└── integration_test.rs
```
**Cargo.toml (workspace root)**:
```toml
[workspace]
members = [
"crates/api",
"crates/core",
"crates/cli",
]
resolver = "2"
[workspace.package]
version = "0.1.0"
edition = "2021"
rust-version = "1.75"
authors = ["Your Name <email@example.com>"]
license = "MIT OR Apache-2.0"
[workspace.dependencies]
tokio = { version = "1.36", features = ["full"] }
serde = { version = "1.0", features = ["derive"] }
[profile.release]
opt-level = 3
lto = true
```
### 6. Generate Web API Structure (Axum)
```
web-api/
├── Cargo.toml
├── src/
│ ├── main.rs
│ ├── routes/
│ │ ├── mod.rs
│ │ ├── users.rs
│ │ └── health.rs
│ ├── handlers/
│ │ ├── mod.rs
│ │ └── user_handler.rs
│ ├── models/
│ │ ├── mod.rs
│ │ └── user.rs
│ ├── services/
│ │ ├── mod.rs
│ │ └── user_service.rs
│ ├── middleware/
│ │ ├── mod.rs
│ │ └── auth.rs
│ └── error.rs
└── tests/
└── api_tests.rs
```
**Cargo.toml for Web API**:
```toml
[package]
name = "web-api"
version = "0.1.0"
edition = "2021"
[dependencies]
axum = "0.7"
tokio = { version = "1.36", features = ["full"] }
tower = "0.4"
tower-http = { version = "0.5", features = ["trace", "cors"] }
serde = { version = "1.0", features = ["derive"] }
serde_json = "1.0"
sqlx = { version = "0.7", features = ["runtime-tokio-native-tls", "postgres"] }
tracing = "0.1"
tracing-subscriber = "0.3"
```
**src/main.rs (Axum)**:
```rust
use axum::{Router, routing::get};
use tower_http::cors::CorsLayer;
use std::net::SocketAddr;
mod routes;
mod handlers;
mod models;
mod services;
mod error;
#[tokio::main]
async fn main() {
tracing_subscriber::fmt::init();
let app = Router::new()
.route("/health", get(routes::health::health_check))
.nest("/api/users", routes::users::router())
.layer(CorsLayer::permissive());
let addr = SocketAddr::from(([0, 0, 0, 0], 3000));
tracing::info!("Listening on {}", addr);
let listener = tokio::net::TcpListener::bind(addr).await.unwrap();
axum::serve(listener, app).await.unwrap();
}
```
### 7. Configure Development Tools
**Makefile**:
```makefile
.PHONY: build test lint fmt run clean bench
build:
cargo build
test:
cargo test
lint:
cargo clippy -- -D warnings
fmt:
cargo fmt --check
run:
cargo run
clean:
cargo clean
bench:
cargo bench
```
**rustfmt.toml**:
```toml
edition = "2021"
max_width = 100
tab_spaces = 4
use_small_heuristics = "Max"
```
**clippy.toml**:
```toml
cognitive-complexity-threshold = 30
```
## Output Format
1. **Project Structure**: Complete directory tree with idiomatic Rust organization
2. **Configuration**: Cargo.toml with dependencies and build settings
3. **Entry Point**: main.rs or lib.rs with proper documentation
4. **Tests**: Unit and integration test structure
5. **Documentation**: README and code documentation
6. **Development Tools**: Makefile, clippy/rustfmt configs
Focus on creating idiomatic Rust projects with strong type safety, proper error handling, and comprehensive testing setup.

302
tools/test-generate.md Normal file
View File

@@ -0,0 +1,302 @@
# Automated Unit Test Generation
You are a test automation expert specializing in generating comprehensive, maintainable unit tests across multiple languages and frameworks. Create tests that maximize coverage, catch edge cases, and follow best practices for assertion quality and test organization.
## Context
The user needs automated test generation that analyzes code structure, identifies test scenarios, and creates high-quality unit tests with proper mocking, assertions, and edge case coverage. Focus on framework-specific patterns and maintainable test suites.
## Requirements
$ARGUMENTS
## Instructions
### 1. Analyze Code for Test Generation
Scan codebase to identify untested code and generate comprehensive test suites:
```python
import ast
from pathlib import Path
from typing import Dict, List, Any
class TestGenerator:
def __init__(self, language: str):
self.language = language
self.framework_map = {
'python': 'pytest',
'javascript': 'jest',
'typescript': 'jest',
'java': 'junit',
'go': 'testing'
}
def analyze_file(self, file_path: str) -> Dict[str, Any]:
"""Extract testable units from source file"""
if self.language == 'python':
return self._analyze_python(file_path)
elif self.language in ['javascript', 'typescript']:
return self._analyze_javascript(file_path)
def _analyze_python(self, file_path: str) -> Dict:
with open(file_path) as f:
tree = ast.parse(f.read())
functions = []
classes = []
for node in ast.walk(tree):
if isinstance(node, ast.FunctionDef):
functions.append({
'name': node.name,
'args': [arg.arg for arg in node.args.args],
'returns': ast.unparse(node.returns) if node.returns else None,
'decorators': [ast.unparse(d) for d in node.decorator_list],
'docstring': ast.get_docstring(node),
'complexity': self._calculate_complexity(node)
})
elif isinstance(node, ast.ClassDef):
methods = [n.name for n in node.body if isinstance(n, ast.FunctionDef)]
classes.append({
'name': node.name,
'methods': methods,
'bases': [ast.unparse(base) for base in node.bases]
})
return {'functions': functions, 'classes': classes, 'file': file_path}
```
### 2. Generate Python Tests with pytest
```python
def generate_pytest_tests(self, analysis: Dict) -> str:
"""Generate pytest test file from code analysis"""
tests = ['import pytest', 'from unittest.mock import Mock, patch', '']
module_name = Path(analysis['file']).stem
tests.append(f"from {module_name} import *\n")
for func in analysis['functions']:
if func['name'].startswith('_'):
continue
test_class = self._generate_function_tests(func)
tests.append(test_class)
for cls in analysis['classes']:
test_class = self._generate_class_tests(cls)
tests.append(test_class)
return '\n'.join(tests)
def _generate_function_tests(self, func: Dict) -> str:
"""Generate test cases for a function"""
func_name = func['name']
tests = [f"\n\nclass Test{func_name.title()}:"]
# Happy path test
tests.append(f" def test_{func_name}_success(self):")
tests.append(f" result = {func_name}({self._generate_mock_args(func['args'])})")
tests.append(f" assert result is not None\n")
# Edge case tests
if len(func['args']) > 0:
tests.append(f" def test_{func_name}_with_empty_input(self):")
tests.append(f" with pytest.raises((ValueError, TypeError)):")
tests.append(f" {func_name}({self._generate_empty_args(func['args'])})\n")
# Exception handling test
tests.append(f" def test_{func_name}_handles_errors(self):")
tests.append(f" with pytest.raises(Exception):")
tests.append(f" {func_name}({self._generate_invalid_args(func['args'])})\n")
return '\n'.join(tests)
def _generate_class_tests(self, cls: Dict) -> str:
"""Generate test cases for a class"""
tests = [f"\n\nclass Test{cls['name']}:"]
tests.append(f" @pytest.fixture")
tests.append(f" def instance(self):")
tests.append(f" return {cls['name']}()\n")
for method in cls['methods']:
if method.startswith('_') and method != '__init__':
continue
tests.append(f" def test_{method}(self, instance):")
tests.append(f" result = instance.{method}()")
tests.append(f" assert result is not None\n")
return '\n'.join(tests)
```
### 3. Generate JavaScript/TypeScript Tests with Jest
```typescript
interface TestCase {
name: string;
setup?: string;
execution: string;
assertions: string[];
}
class JestTestGenerator {
generateTests(functionName: string, params: string[]): string {
const tests: TestCase[] = [
{
name: `${functionName} returns expected result with valid input`,
execution: `const result = ${functionName}(${this.generateMockParams(params)})`,
assertions: ['expect(result).toBeDefined()', 'expect(result).not.toBeNull()']
},
{
name: `${functionName} handles null input gracefully`,
execution: `const result = ${functionName}(null)`,
assertions: ['expect(result).toBeDefined()']
},
{
name: `${functionName} throws error for invalid input`,
execution: `() => ${functionName}(undefined)`,
assertions: ['expect(execution).toThrow()']
}
];
return this.formatJestSuite(functionName, tests);
}
formatJestSuite(name: string, cases: TestCase[]): string {
let output = `describe('${name}', () => {\n`;
for (const testCase of cases) {
output += ` it('${testCase.name}', () => {\n`;
if (testCase.setup) {
output += ` ${testCase.setup}\n`;
}
output += ` const execution = ${testCase.execution};\n`;
for (const assertion of testCase.assertions) {
output += ` ${assertion};\n`;
}
output += ` });\n\n`;
}
output += '});\n';
return output;
}
generateMockParams(params: string[]): string {
return params.map(p => `mock${p.charAt(0).toUpperCase() + p.slice(1)}`).join(', ');
}
}
```
### 4. Generate React Component Tests
```typescript
function generateReactComponentTest(componentName: string): string {
return `
import { render, screen, fireEvent } from '@testing-library/react';
import { ${componentName} } from './${componentName}';
describe('${componentName}', () => {
it('renders without crashing', () => {
render(<${componentName} />);
expect(screen.getByRole('main')).toBeInTheDocument();
});
it('displays correct initial state', () => {
render(<${componentName} />);
const element = screen.getByTestId('${componentName.toLowerCase()}');
expect(element).toBeVisible();
});
it('handles user interaction', () => {
render(<${componentName} />);
const button = screen.getByRole('button');
fireEvent.click(button);
expect(screen.getByText(/clicked/i)).toBeInTheDocument();
});
it('updates props correctly', () => {
const { rerender } = render(<${componentName} value="initial" />);
expect(screen.getByText('initial')).toBeInTheDocument();
rerender(<${componentName} value="updated" />);
expect(screen.getByText('updated')).toBeInTheDocument();
});
});
`;
}
```
### 5. Coverage Analysis and Gap Detection
```python
import subprocess
import json
class CoverageAnalyzer:
def analyze_coverage(self, test_command: str) -> Dict:
"""Run tests with coverage and identify gaps"""
result = subprocess.run(
[test_command, '--coverage', '--json'],
capture_output=True,
text=True
)
coverage_data = json.loads(result.stdout)
gaps = self.identify_coverage_gaps(coverage_data)
return {
'overall_coverage': coverage_data.get('totals', {}).get('percent_covered', 0),
'uncovered_lines': gaps,
'files_below_threshold': self.find_low_coverage_files(coverage_data, 80)
}
def identify_coverage_gaps(self, coverage: Dict) -> List[Dict]:
"""Find specific lines/functions without test coverage"""
gaps = []
for file_path, data in coverage.get('files', {}).items():
missing_lines = data.get('missing_lines', [])
if missing_lines:
gaps.append({
'file': file_path,
'lines': missing_lines,
'functions': data.get('excluded_lines', [])
})
return gaps
def generate_tests_for_gaps(self, gaps: List[Dict]) -> str:
"""Generate tests specifically for uncovered code"""
tests = []
for gap in gaps:
test_code = self.create_targeted_test(gap)
tests.append(test_code)
return '\n\n'.join(tests)
```
### 6. Mock Generation
```python
def generate_mock_objects(self, dependencies: List[str]) -> str:
"""Generate mock objects for external dependencies"""
mocks = ['from unittest.mock import Mock, MagicMock, patch\n']
for dep in dependencies:
mocks.append(f"@pytest.fixture")
mocks.append(f"def mock_{dep}():")
mocks.append(f" mock = Mock(spec={dep})")
mocks.append(f" mock.method.return_value = 'mocked_result'")
mocks.append(f" return mock\n")
return '\n'.join(mocks)
```
## Output Format
1. **Test Files**: Complete test suites ready to run
2. **Coverage Report**: Current coverage with gaps identified
3. **Mock Objects**: Fixtures for external dependencies
4. **Test Documentation**: Explanation of test scenarios
5. **CI Integration**: Commands to run tests in pipeline
Focus on generating maintainable, comprehensive tests that catch bugs early and provide confidence in code changes.

346
tools/typescript-scaffold.md Normal file
View File

@@ -0,0 +1,346 @@
# TypeScript Project Scaffolding
You are a TypeScript project architecture expert specializing in scaffolding production-ready Node.js and frontend applications. Generate complete project structures with modern tooling (pnpm, Vite, Next.js), type safety, testing setup, and configuration following current best practices.
## Context
The user needs automated TypeScript project scaffolding that creates consistent, type-safe applications with proper structure, dependency management, testing, and build tooling. Focus on modern TypeScript patterns and scalable architecture.
## Requirements
$ARGUMENTS
## Instructions
### 1. Analyze Project Type
Determine the project type from user requirements:
- **Next.js**: Full-stack React applications, SSR/SSG, API routes
- **React + Vite**: SPA applications, component libraries
- **Node.js API**: Express/Fastify backends, microservices
- **Library**: Reusable packages, utilities, tools
- **CLI**: Command-line tools, automation scripts
### 2. Initialize Project with pnpm
```bash
# Install pnpm if needed
npm install -g pnpm
# Initialize project
mkdir project-name && cd project-name
pnpm init
# Initialize git
git init
echo "node_modules/" >> .gitignore
echo "dist/" >> .gitignore
echo ".env" >> .gitignore
```
### 3. Generate Next.js Project Structure
```bash
# Create Next.js project with TypeScript
pnpm create next-app@latest . --typescript --tailwind --app --src-dir --import-alias "@/*"
```
```
nextjs-project/
├── package.json
├── tsconfig.json
├── next.config.js
├── .env.example
├── src/
│ ├── app/
│ │ ├── layout.tsx
│ │ ├── page.tsx
│ │ ├── api/
│ │ │ └── health/
│ │ │ └── route.ts
│ │ └── (routes)/
│ │ └── dashboard/
│ │ └── page.tsx
│ ├── components/
│ │ ├── ui/
│ │ │ ├── Button.tsx
│ │ │ └── Card.tsx
│ │ └── layout/
│ │ ├── Header.tsx
│ │ └── Footer.tsx
│ ├── lib/
│ │ ├── api.ts
│ │ ├── utils.ts
│ │ └── types.ts
│ └── hooks/
│ ├── useAuth.ts
│ └── useFetch.ts
└── tests/
├── setup.ts
└── components/
└── Button.test.tsx
```
**package.json**:
```json
{
"name": "nextjs-project",
"version": "0.1.0",
"scripts": {
"dev": "next dev",
"build": "next build",
"start": "next start",
"lint": "next lint",
"test": "vitest",
"type-check": "tsc --noEmit"
},
"dependencies": {
"next": "^14.1.0",
"react": "^18.2.0",
"react-dom": "^18.2.0"
},
"devDependencies": {
"@types/node": "^20.11.0",
"@types/react": "^18.2.0",
"typescript": "^5.3.0",
"vitest": "^1.2.0",
"@vitejs/plugin-react": "^4.2.0",
"eslint": "^8.56.0",
"eslint-config-next": "^14.1.0"
}
}
```
**tsconfig.json**:
```json
{
"compilerOptions": {
"target": "ES2022",
"lib": ["ES2022", "DOM", "DOM.Iterable"],
"jsx": "preserve",
"module": "ESNext",
"moduleResolution": "bundler",
"resolveJsonModule": true,
"allowJs": true,
"strict": true,
"noEmit": true,
"esModuleInterop": true,
"skipLibCheck": true,
"forceConsistentCasingInFileNames": true,
"incremental": true,
"paths": {
"@/*": ["./src/*"]
},
"plugins": [{"name": "next"}]
},
"include": ["next-env.d.ts", "**/*.ts", "**/*.tsx"],
"exclude": ["node_modules"]
}
```
### 4. Generate React + Vite Project Structure
```bash
# Create Vite project
pnpm create vite . --template react-ts
```
**vite.config.ts**:
```typescript
import { defineConfig } from 'vite'
import react from '@vitejs/plugin-react'
import path from 'path'
export default defineConfig({
plugins: [react()],
resolve: {
alias: {
'@': path.resolve(__dirname, './src'),
},
},
server: {
port: 3000,
},
test: {
globals: true,
environment: 'jsdom',
setupFiles: './tests/setup.ts',
},
})
```
### 5. Generate Node.js API Project Structure
```
nodejs-api/
├── package.json
├── tsconfig.json
├── src/
│ ├── index.ts
│ ├── app.ts
│ ├── config/
│ │ ├── database.ts
│ │ └── env.ts
│ ├── routes/
│ │ ├── index.ts
│ │ ├── users.ts
│ │ └── health.ts
│ ├── controllers/
│ │ └── userController.ts
│ ├── services/
│ │ └── userService.ts
│ ├── models/
│ │ └── User.ts
│ ├── middleware/
│ │ ├── auth.ts
│ │ └── errorHandler.ts
│ └── types/
│ └── express.d.ts
└── tests/
└── routes/
└── users.test.ts
```
**package.json for Node.js API**:
```json
{
"name": "nodejs-api",
"version": "0.1.0",
"type": "module",
"scripts": {
"dev": "tsx watch src/index.ts",
"build": "tsc",
"start": "node dist/index.js",
"test": "vitest",
"lint": "eslint src --ext .ts"
},
"dependencies": {
"express": "^4.18.2",
"dotenv": "^16.4.0",
"zod": "^3.22.0"
},
"devDependencies": {
"@types/express": "^4.17.21",
"@types/node": "^20.11.0",
"typescript": "^5.3.0",
"tsx": "^4.7.0",
"vitest": "^1.2.0",
"eslint": "^8.56.0",
"@typescript-eslint/parser": "^6.19.0",
"@typescript-eslint/eslint-plugin": "^6.19.0"
}
}
```
**src/app.ts**:
```typescript
import express, { Express } from 'express'
import { healthRouter } from './routes/health.js'
import { userRouter } from './routes/users.js'
import { errorHandler } from './middleware/errorHandler.js'
export function createApp(): Express {
const app = express()
app.use(express.json())
app.use('/health', healthRouter)
app.use('/api/users', userRouter)
app.use(errorHandler)
return app
}
```
### 6. Generate TypeScript Library Structure
```
library-name/
├── package.json
├── tsconfig.json
├── tsconfig.build.json
├── src/
│ ├── index.ts
│ └── core.ts
├── tests/
│ └── core.test.ts
└── dist/
```
**package.json for Library**:
```json
{
"name": "@scope/library-name",
"version": "0.1.0",
"type": "module",
"main": "./dist/index.js",
"types": "./dist/index.d.ts",
"exports": {
".": {
"import": "./dist/index.js",
"types": "./dist/index.d.ts"
}
},
"files": ["dist"],
"scripts": {
"build": "tsc -p tsconfig.build.json",
"test": "vitest",
"prepublishOnly": "pnpm build"
},
"devDependencies": {
"typescript": "^5.3.0",
"vitest": "^1.2.0"
}
}
```
### 7. Configure Development Tools
**.env.example**:
```env
NODE_ENV=development
PORT=3000
DATABASE_URL=postgresql://user:pass@localhost:5432/db
JWT_SECRET=your-secret-key
```
**vitest.config.ts**:
```typescript
import { defineConfig } from 'vitest/config'
export default defineConfig({
test: {
globals: true,
environment: 'node',
coverage: {
provider: 'v8',
reporter: ['text', 'json', 'html'],
},
},
})
```
**.eslintrc.json**:
```json
{
"parser": "@typescript-eslint/parser",
"extends": [
"eslint:recommended",
"plugin:@typescript-eslint/recommended"
],
"rules": {
"@typescript-eslint/no-explicit-any": "warn",
"@typescript-eslint/no-unused-vars": "error"
}
}
```
## Output Format
1. **Project Structure**: Complete directory tree with all necessary files
2. **Configuration**: package.json, tsconfig.json, build tooling
3. **Entry Point**: Main application file with type-safe setup
4. **Tests**: Test structure with Vitest configuration
5. **Documentation**: README with setup and usage instructions
6. **Development Tools**: .env.example, .gitignore, linting config
Focus on creating production-ready TypeScript projects with modern tooling, strict type safety, and comprehensive testing setup.

307
tools/xss-scan.md Normal file
View File

@@ -0,0 +1,307 @@
# XSS Vulnerability Scanner for Frontend Code
You are a frontend security specialist focusing on Cross-Site Scripting (XSS) vulnerability detection and prevention. Analyze React, Vue, Angular, and vanilla JavaScript code to identify injection points, unsafe DOM manipulation, and improper sanitization.
## Context
The user needs comprehensive XSS vulnerability scanning for client-side code, identifying dangerous patterns like unsafe HTML manipulation, URL handling issues, and improper user input rendering. Focus on context-aware detection and framework-specific security patterns.
## Requirements
$ARGUMENTS
## Instructions
### 1. XSS Vulnerability Detection
Scan codebase for XSS vulnerabilities using static analysis:
```typescript
interface XSSFinding {
file: string;
line: number;
severity: 'critical' | 'high' | 'medium' | 'low';
type: string;
vulnerable_code: string;
description: string;
fix: string;
cwe: string;
}
class XSSScanner {
private vulnerablePatterns = [
'innerHTML', 'outerHTML', 'document.write',
'insertAdjacentHTML', 'location.href', 'window.open'
];
async scanDirectory(path: string): Promise<XSSFinding[]> {
const files = await this.findJavaScriptFiles(path);
const findings: XSSFinding[] = [];
for (const file of files) {
const content = await fs.readFile(file, 'utf-8');
findings.push(...this.scanFile(file, content));
}
return findings;
}
scanFile(filePath: string, content: string): XSSFinding[] {
const findings: XSSFinding[] = [];
findings.push(...this.detectHTMLManipulation(filePath, content));
findings.push(...this.detectReactVulnerabilities(filePath, content));
findings.push(...this.detectURLVulnerabilities(filePath, content));
findings.push(...this.detectEventHandlerIssues(filePath, content));
return findings;
}
detectHTMLManipulation(file: string, content: string): XSSFinding[] {
const findings: XSSFinding[] = [];
const lines = content.split('\n');
lines.forEach((line, index) => {
if (line.includes('innerHTML') && this.hasUserInput(line)) {
findings.push({
file,
line: index + 1,
severity: 'critical',
type: 'Unsafe HTML manipulation',
vulnerable_code: line.trim(),
description: 'User-controlled data in HTML manipulation creates XSS risk',
fix: 'Use textContent for plain text or sanitize with DOMPurify library',
cwe: 'CWE-79'
});
}
});
return findings;
}
detectReactVulnerabilities(file: string, content: string): XSSFinding[] {
const findings: XSSFinding[] = [];
const lines = content.split('\n');
lines.forEach((line, index) => {
if (line.includes('dangerously') && !this.hasSanitization(content)) {
findings.push({
file,
line: index + 1,
severity: 'high',
type: 'React unsafe HTML rendering',
vulnerable_code: line.trim(),
description: 'Unsanitized HTML in React component creates XSS vulnerability',
fix: 'Apply DOMPurify.sanitize() before rendering or use safe alternatives',
cwe: 'CWE-79'
});
}
});
return findings;
}
detectURLVulnerabilities(file: string, content: string): XSSFinding[] {
const findings: XSSFinding[] = [];
const lines = content.split('\n');
lines.forEach((line, index) => {
if (line.includes('location.') && this.hasUserInput(line)) {
findings.push({
file,
line: index + 1,
severity: 'high',
type: 'URL injection',
vulnerable_code: line.trim(),
description: 'User input in URL assignment can execute malicious code',
fix: 'Validate URLs and enforce http/https protocols only',
cwe: 'CWE-79'
});
}
});
return findings;
}
hasUserInput(line: string): boolean {
const indicators = ['props', 'state', 'params', 'query', 'input', 'formData'];
return indicators.some(indicator => line.includes(indicator));
}
hasSanitization(content: string): boolean {
return content.includes('DOMPurify') || content.includes('sanitize');
}
}
```
### 2. Framework-Specific Detection
```typescript
class ReactXSSScanner {
scanReactComponent(code: string): XSSFinding[] {
const findings: XSSFinding[] = [];
// Check for unsafe React patterns
const unsafePatterns = [
'dangerouslySetInnerHTML',
'createMarkup',
'rawHtml'
];
unsafePatterns.forEach(pattern => {
if (code.includes(pattern) && !code.includes('DOMPurify')) {
findings.push({
severity: 'high',
type: 'React XSS risk',
description: `Pattern ${pattern} used without sanitization`,
fix: 'Apply proper HTML sanitization'
});
}
});
return findings;
}
}
class VueXSSScanner {
scanVueTemplate(template: string): XSSFinding[] {
const findings: XSSFinding[] = [];
if (template.includes('v-html')) {
findings.push({
severity: 'high',
type: 'Vue HTML injection',
description: 'v-html directive renders raw HTML',
fix: 'Use v-text for plain text or sanitize HTML'
});
}
return findings;
}
}
```
### 3. Secure Coding Examples
```typescript
class SecureCodingGuide {
getSecurePattern(vulnerability: string): string {
const patterns = {
html_manipulation: `
// SECURE: Use textContent for plain text
element.textContent = userInput;
// SECURE: Sanitize HTML when needed
import DOMPurify from 'dompurify';
const clean = DOMPurify.sanitize(userInput);
element.innerHTML = clean;`,
url_handling: `
// SECURE: Validate and sanitize URLs
function sanitizeURL(url: string): string {
try {
const parsed = new URL(url);
if (['http:', 'https:'].includes(parsed.protocol)) {
return parsed.href;
}
} catch {}
return '#';
}`,
react_rendering: `
// SECURE: Sanitize before rendering
import DOMPurify from 'dompurify';
const Component = ({ html }) => (
<div dangerouslySetInnerHTML={{
__html: DOMPurify.sanitize(html)
}} />
);`
};
return patterns[vulnerability] || 'No secure pattern available';
}
}
```
### 4. Automated Scanning Integration
```bash
# ESLint with security plugin
npm install --save-dev eslint-plugin-security
eslint . --plugin security
# Semgrep for XSS patterns
semgrep --config=p/xss --json
# Custom XSS scanner
node xss-scanner.js --path=src --format=json
```
### 5. Report Generation
```typescript
class XSSReportGenerator {
generateReport(findings: XSSFinding[]): string {
const grouped = this.groupBySeverity(findings);
let report = '# XSS Vulnerability Scan Report\n\n';
report += `Total Findings: ${findings.length}\n\n`;
for (const [severity, issues] of Object.entries(grouped)) {
report += `## ${severity.toUpperCase()} (${issues.length})\n\n`;
for (const issue of issues) {
report += `- **${issue.type}**\n`;
report += ` File: ${issue.file}:${issue.line}\n`;
report += ` Fix: ${issue.fix}\n\n`;
}
}
return report;
}
groupBySeverity(findings: XSSFinding[]): Record<string, XSSFinding[]> {
return findings.reduce((acc, finding) => {
if (!acc[finding.severity]) acc[finding.severity] = [];
acc[finding.severity].push(finding);
return acc;
}, {} as Record<string, XSSFinding[]>);
}
}
```
### 6. Prevention Checklist
**HTML Manipulation**
- Never use innerHTML with user input
- Prefer textContent for text content
- Sanitize with DOMPurify before rendering HTML
- Avoid document.write entirely
**URL Handling**
- Validate all URLs before assignment
- Block javascript: and data: protocols
- Use URL constructor for validation
- Sanitize href attributes
**Event Handlers**
- Use addEventListener instead of inline handlers
- Sanitize all event handler input
- Avoid string-to-code patterns
**Framework-Specific**
- React: Sanitize before using unsafe APIs
- Vue: Prefer v-text over v-html
- Angular: Use built-in sanitization
- Avoid bypassing framework security features
## Output Format
1. **Vulnerability Report**: Detailed findings with severity levels
2. **Risk Analysis**: Impact assessment for each vulnerability
3. **Fix Recommendations**: Secure code examples
4. **Sanitization Guide**: DOMPurify usage patterns
5. **Prevention Checklist**: Best practices for XSS prevention
Focus on identifying XSS attack vectors, providing actionable fixes, and establishing secure coding patterns.