Argus Lite — 免费代码扫描器

对单个 Python 文件执行 Top 10 关键安全与缺陷规则扫描。

免费版 vs 专业版

👉 升级专业版：openclaw skills install argus-pro —— 授权密钥获取地址：ko-fi.com/s/8b27346505

💰 套餐优惠：全部 5 项 Pro 技能仅需 $29 → ko-fi.com/s/7625accf3f（立省 $16）

第一步 — 安装依赖

pip3 install rich --break-system-packages --quiet

第二步 — 快速安全扫描（Lite 版）

import os, re
from pathlib import Path
from rich.console import Console
from rich.table import Table
from rich.panel import Panel
from rich import box

console = Console()

SRC_PATH = os.environ.get("SOURCE_PATH",".").strip()
src      = Path(SRC_PATH)

# 查找一个待扫描的 Python 文件
if src.is_dir():
    py_files = list(src.rglob("*.py"))
    if not py_files:
        console.print(f"[yellow]未在 {SRC_PATH} 中找到 .py 文件[/yellow]")
        raise SystemExit(0)
    target = py_files[0]
    if len(py_files) > 1:
        console.print(f"[yellow]ℹ️  Lite 版每次仅扫描 1 个文件。当前扫描：{target}\n   （升级至 Pro 版可一次性扫描全部 {len(py_files)} 个文件）[/yellow]\n")
elif src.is_file():
    target = src
else:
    console.print(f"[red]❌ 未找到路径：{SRC_PATH}[/red]")
    raise SystemExit(1)

# 仅启用 Top 10 关键/高危规则（Lite 版）
RULES = [
    ("PY001","critical","security", r"bevals*(",                           "eval() 执行任意代码 —— 关键风险。",         "请改用 ast.literal_eval() 进行安全解析。"),
    ("PY002","critical","security", r"bexecs*(",                           "exec() 将字符串作为 Python 代码执行。",       "请重构代码，避免动态执行。"),
    ("PY003","critical","security", r"bpickle.loads?s*(",                 "使用不可信数据调用 pickle.load() → 可导致远程代码执行。",     "请改用 json.loads() 替代。"),
    ("PY004","high","security",     r"(?i)(password|secret|api_key|token)s*=s*[\'\"].+[\'\"]", "检测到硬编码凭证。",          "请移至环境变量中管理。"),
    ("PY005","high","security",     r"shells*=s*True",                      "subprocess 中启用 shell=True → 存在命令注入风险。",      "请改用列表参数形式：subprocess.run(['cmd','arg'])"),
    ("PY006","high","security",     r".executes*(.*(%|.format(|f[\'\"])|)", "通过字符串格式化可能导致 SQL 注入。",          "请使用参数化查询：cursor.execute(sql,(val,))"),
    ("PY009","medium","bug",        r"excepts*:",                            "空 except 子句会捕获 SystemExit 和 KeyboardInterrupt 等系统异常。",   "请显式使用 except Exception: 或捕获具体异常类型。"),
    ("PY016","medium","security",   r"hashlib.(md5|sha1)s*(",              "MD5/SHA1 已被密码学攻破，不再安全。",                  "请改用 hashlib.sha256() 或 bcrypt（用于密码哈希）。"),
    ("PY007","medium","bug",        r"defs+w+s*([^)]*=s*[\\[\\]])",      "可变默认参数 [] —— 将在所有函数调用间共享。",  "请使用 None 作为默认值，并在函数内部初始化列表。"),
    ("PY017","high","security",     r"brandom.(random|randint|choice)s*(", "random 模块不具备密码学安全性。",          "请改用 secrets 模块生成安全敏感值。"),
]

console.print(Panel.fit(
    f"[bold red]🐛 Argus Lite — 快速扫描[/bold red]\n"
    f"文件：[yellow]{target}[/yellow]\n"
    f"[dim]Lite 版：1 个文件、10 条规则 —— 升级 Pro 版可扫描整个代码库[/dim]",
    border_style="red"
))

findings = []
try:
    source = target.read_text(encoding="utf-8", errors="replace")
    for lineno, line in enumerate(source.splitlines(), 1):
        for rule_id, sev, category, pattern, message, fix in RULES:
            if re.search(pattern, line):
                findings.append({"id":rule_id,"severity":sev,"category":category,
                                 "line":lineno,"code":line.strip()[:80],"message":message,"fix":fix})
except Exception as e:
    console.print(f"[red]读取文件时出错：{e}[/red]")
    raise SystemExit(1)

# 去重处理（基于 rule_id + 行号）
seen, unique = set(), []
for f in findings:
    key = (f["id"],f["line"])
    if key not in seen:
        seen.add(key)
        unique.append(f)

SEV_COLOUR = {"critical":"red","high":"orange3","medium":"yellow","low":"dim"}

if not unique:
    console.print(Panel(
        f"[green]✅ 在 {RULES.__len__()} 条规则扫描中未发现任何问题！[/green]\n"
        f"[dim]Pro 版支持 40+ 条规则扫描，涵盖性能模式等 —— 升级以获得全面覆盖。[/dim]",
        border_style="green"
    ))
else:
    tbl = Table(title=f"🔍 {len(unique)} 处问题（位于 {target.name}）", box=box.ROUNDED, border_style="red")
    tbl.add_column("ID",      width=7,  style="dim")
    tbl.add_column("Sev",     width=9)
    tbl.add_column("Line",    width=6,  justify="right", style="yellow")
    tbl.add_column("Issue",   width=50)
    for fi in unique:
        sc = SEV_COLOUR.get(fi["severity"],"white")
        tbl.add_row(fi["id"],f"[{sc}]{fi['severity'].upper()}[/{sc}]",str(fi["line"]),fi["message"][:48])
    console.print(tbl)

    for fi in [f for f in unique if f["severity"] in ("critical","high")]:
        sc = SEV_COLOUR.get(fi["severity"],"white")
        console.print(Panel(
            f"[dim]第 {fi['line']} 行：[/dim] [italic]{fi['code']}[/italic]\n\n"
            f"[white]{fi['message']}[/white]\n\n"
            f"[green]修复建议：[/green] {fi['fix']}",
            title=f"[{sc}]{fi['severity'].upper()}[/{sc}] — {fi['id']}",
            border_style=sc
        ))

console.print()
console.print(Panel(
    f"[bold yellow]🔒 想要更多功能？[/bold yellow]\n\n"
    f"Argus Pro 可扫描 [bold]您的整个代码库[/bold]，支持 [bold]40+ 条规则[/bold]，覆盖 Python 与 JavaScript —— "
    f"包括性能问题、内存泄漏、N+1 查询模式等。此外还提供 CI 就绪的 JSON 输出及 FAIL_ON_CRITICAL 退出码。\n\n"
    f"[bold cyan]openclaw skills install argus-pro[/bold cyan]\n"
    f"获取授权密钥 → [bold]ko-fi.com/s/8b27346505[/bold]",
    title="升级至 Argus Pro",
    border_style="cyan"
))