/**
 * Skill Scanner — Core Module
 *
 * Scans agent instruction files (skill definitions, tool configs, rules files)
 * for threats using the full ShieldCortex defence pipeline combined with
 * skill-specific pattern detection.
 *
 * Public API:
 *  - scanSkill(filePath, options?)     — read from disc and scan
 *  - scanSkillContent(content, options?) — scan raw content directly
 *
 * Never throws — returns safe defaults on errors.
 */
import type { FirewallAnalysis, SensitivityClassification } from '../types.js';
import type { SkillFormat } from './parser.js';
export interface SkillScanOptions {
    /** Defence mode override (defaults to config default — 'balanced'). */
    mode?: 'strict' | 'balanced' | 'permissive';
    /** When true, include the matched text snippet in each finding. */
    includeContent?: boolean;
}
export interface SkillThreatFinding {
    /** Pattern group name, e.g. 'tool_injection', 'data_exfiltration'. */
    pattern: string;
    /** Derived severity for this finding. */
    severity: 'low' | 'medium' | 'high' | 'critical';
    /** Human-readable explanation of the threat. */
    description: string;
    /** The text that triggered the finding (truncated to 80 chars). */
    matchedText?: string;
    /** Line number in the source file, if determinable. */
    line?: number;
}
export interface SkillScanResult {
    /** True when no high or critical findings exist. */
    safe: boolean;
    /** Name extracted from the skill file. */
    skillName: string;
    /** Detected format of the skill file. */
    format: SkillFormat;
    /** Individual threat findings. */
    findings: SkillThreatFinding[];
    /** Overall risk level — the highest severity found, or 'safe'. */
    riskLevel: 'safe' | 'low' | 'medium' | 'high' | 'critical';
    /** One-line human-readable summary. */
    summary: string;
    /** Time taken to scan in milliseconds. */
    scanDurationMs: number;
    /** Full firewall analysis result. */
    firewall: FirewallAnalysis;
    /** Sensitivity classification result. */
    sensitivity: SensitivityClassification;
}
/**
 * Scan a skill file from disc for threats.
 *
 * Reads the file, auto-detects its format, and runs the full defence pipeline
 * plus skill-specific pattern detection.
 *
 * Never throws — returns safe defaults if the file cannot be read.
 */
export declare function scanSkill(filePath: string, options?: SkillScanOptions): SkillScanResult;
/**
 * Scan raw skill content for threats without reading from disc.
 *
 * Useful when the content is already in memory (e.g. received via API,
 * read from a database, or extracted from a larger document).
 *
 * @param content  Raw file content to scan
 * @param options  Scan options (mode, includeContent)
 * @param format   Optional format hint — auto-detected as 'unknown' if omitted
 * @param name     Optional skill name — defaults to 'inline'
 */
export declare function scanSkillContent(content: string, options?: SkillScanOptions, format?: SkillFormat, name?: string): SkillScanResult;
