{"_id":"@claude-tools-i-use/ai-code-audit","name":"@claude-tools-i-use/ai-code-audit","dist-tags":{"latest":"0.1.0"},"versions":{"0.1.0":{"name":"@claude-tools-i-use/ai-code-audit","version":"0.1.0","description":"Security and quality linter for AI-generated code","type":"module","main":"dist/index.js","bin":{"ai-code-audit":"dist/cli.js","aca":"dist/cli.js"},"scripts":{"build":"tsc","dev":"tsc --watch","start":"node dist/cli.js","test":"node --test","clean":"rm -rf dist","prepublishOnly":"npm run build"},"keywords":["ai","security","lint","audit","code-review","owasp"],"author":{"name":"Josh Duffy"},"license":"MIT","repository":{"type":"git","url":"git+https://github.com/joshduffy/claude-tools.git","directory":"packages/ai-code-audit"},"homepage":"https://joshduffy.dev/tools","devDependencies":{"@types/node":"^22.10.0","typescript":"^5.7.0"},"engines":{"node":">=18.0.0"},"_id":"@claude-tools-i-use/ai-code-audit@0.1.0","gitHead":"7d0f67a77203abd5c513c5b924fda8606f7eafaf","types":"./dist/index.d.ts","bugs":{"url":"https://github.com/joshduffy/claude-tools/issues"},"_nodeVersion":"22.21.0","_npmVersion":"10.9.4","dist":{"integrity":"sha512-1EICAPPo471zdWUNmi/aJix/hMqSuFW4ZcaDfB08NY2vtRCm50GEl7Yk/oIHTJ5+P4c7UAfwYnpSHh/+MdjN2w==","shasum":"e8bfdeed16fdd0beb74a18d5e4615c528804a7a8","tarball":"https://registry.npmjs.org/@claude-tools-i-use/ai-code-audit/-/ai-code-audit-0.1.0.tgz","fileCount":34,"unpackedSize":65867,"signatures":[{"keyid":"SHA256:DhQ8wR5APBvFHLF/+Tc+AYvPOdTpcIDqOhxsBHRwC7U","sig":"MEUCIBWtpB98goFFB2kvv3sZAbb+cikOl1fnnhr5wdCowBFoAiEAxtr1n36RwZ/bEeaJs5OEOrmOiJ4Zh4f47mot3ZFqNzM="}]},"_npmUser":{"name":"nahsuhn","email":"josh@joshduffy.dev"},"directories":{},"maintainers":[{"name":"nahsuhn","email":"josh@joshduffy.dev"}],"_npmOperationalInternal":{"host":"s3://npm-registry-packages-npm-production","tmp":"tmp/ai-code-audit_0.1.0_1768782191111_0.8771110458677609"},"_hasShrinkwrap":false}},"time":{"created":"2026-01-19T00:23:11.034Z","0.1.0":"2026-01-19T00:23:11.284Z","modified":"2026-01-19T00:23:11.490Z"},"maintainers":[{"name":"nahsuhn","email":"josh@joshduffy.dev"}],"description":"Security and quality linter for AI-generated code","homepage":"https://joshduffy.dev/tools","keywords":["ai","security","lint","audit","code-review","owasp"],"repository":{"type":"git","url":"git+https://github.com/joshduffy/claude-tools.git","directory":"packages/ai-code-audit"},"author":{"name":"Josh Duffy"},"bugs":{"url":"https://github.com/joshduffy/claude-tools/issues"},"license":"MIT","readme":"# ai-code-audit\n\nSecurity and quality linter specifically designed for AI-generated code.\n\n## The Problem\n\nAI coding assistants can introduce security vulnerabilities and quality issues:\n\n- SQL injection through string concatenation\n- Command injection via unsanitized inputs\n- Hardcoded secrets and credentials\n- Missing error handling\n- Unsafe deserialization\n- Over-complex \"clever\" solutions\n\nTraditional linters catch some of these, but AI code has unique patterns that need specific attention.\n\n## Installation\n\n```bash\nnpm install -g ai-code-audit\n```\n\n## Usage\n\n### Audit Files\n\n```bash\n# Audit a single file\naca src/api.ts\n\n# Audit multiple files\naca src/**/*.ts\n\n# Audit a git diff\ngit diff HEAD~1 | aca --stdin\n\n# Audit staged changes\ngit diff --cached | aca --stdin\n```\n\n### Options\n\n```\nOptions:\n  -s, --stdin           Read diff from stdin\n  -f, --format <type>   Output format: text, json, sarif (default: text)\n  -c, --config <file>   Config file path\n  --severity <level>    Minimum severity: info, warning, error (default: warning)\n  -q, --quiet           Only output errors\n  -h, --help            Show help\n```\n\n### Git Hook Integration\n\nAdd to `.git/hooks/pre-commit`:\n\n```bash\n#!/bin/bash\ngit diff --cached | aca --stdin --severity error\nif [ $? -ne 0 ]; then\n  echo \"AI code audit found issues. Please review before committing.\"\n  exit 1\nfi\n```\n\n### CI Integration\n\n```yaml\n# GitHub Actions\n- name: AI Code Audit\n  run: |\n    npm install -g ai-code-audit\n    git diff ${{ github.event.before }} ${{ github.sha }} | aca --stdin --format sarif > results.sarif\n\n- name: Upload SARIF\n  uses: github/codeql-action/upload-sarif@v2\n  with:\n    sarif_file: results.sarif\n```\n\n## Rules\n\n### Security Rules\n\n| Rule                | Severity | Description                                   |\n| ------------------- | -------- | --------------------------------------------- |\n| `sql-injection`     | error    | Detects SQL queries with string interpolation |\n| `command-injection` | error    | Detects shell commands with unsanitized input |\n| `hardcoded-secret`  | error    | Detects hardcoded API keys, passwords, tokens |\n| `unsafe-eval`       | error    | Detects use of eval() or Function()           |\n| `unsafe-regex`      | warning  | Detects potentially catastrophic regex        |\n| `path-traversal`    | error    | Detects unsanitized file path operations      |\n| `xss-risk`          | warning  | Detects potential XSS in HTML generation      |\n\n### Quality Rules\n\n| Rule                     | Severity | Description                                    |\n| ------------------------ | -------- | ---------------------------------------------- |\n| `missing-error-handling` | warning  | Detects async operations without try/catch     |\n| `empty-catch`            | warning  | Detects empty catch blocks that swallow errors |\n| `console-log`            | info     | Detects console.log left in code               |\n| `todo-fixme`             | info     | Detects TODO/FIXME comments                    |\n| `magic-number`           | info     | Detects unexplained numeric literals           |\n| `deep-nesting`           | warning  | Detects deeply nested code (>4 levels)         |\n\n### AI-Specific Rules\n\n| Rule                 | Severity | Description                                           |\n| -------------------- | -------- | ----------------------------------------------------- |\n| `ai-placeholder`     | error    | Detects placeholder text like \"// Add implementation\" |\n| `incomplete-impl`    | warning  | Detects `throw new Error('Not implemented')`          |\n| `excessive-comments` | info     | Detects over-commented obvious code                   |\n| `type-any-abuse`     | warning  | Detects excessive use of `any` type                   |\n\n## Configuration\n\nCreate `.ai-code-audit.json`:\n\n```json\n{\n  \"rules\": {\n    \"sql-injection\": \"error\",\n    \"console-log\": \"off\",\n    \"magic-number\": \"warning\"\n  },\n  \"ignore\": [\"**/*.test.ts\", \"**/fixtures/**\"],\n  \"languages\": [\"typescript\", \"javascript\", \"python\"]\n}\n```\n\n## Output Example\n\n```\nsrc/api/users.ts\n  12:5  error    SQL injection risk: query uses string interpolation     sql-injection\n  24:3  warning  Missing error handling for async operation              missing-error-handling\n  45:1  error    Hardcoded secret detected: API_KEY = \"sk-...\"           hardcoded-secret\n\nsrc/utils/shell.ts\n  8:12  error    Command injection: exec() with unsanitized input        command-injection\n\n4 problems (3 errors, 1 warning)\n```\n\n## License\n\nMIT\n","readmeFilename":"README.md","_rev":"1-7215b00485eb3548a00c1efd2af42192"}