goose-extension-audit

KO | EN

gitlite — search

#kubernetes #video #csharp #nextjs #claude #cloud-native #devops #mysql #bash #github

goose-extension-audit

(★ 9)

Audits the security of the extensions a goose recipe declares

File Explorer

ZIP Download

- __init__.py
- __main__.py
- audit.py
- cli.py
- discover.py
- grade.py
- load.py
- miniyaml.py
- report.py
- clean-recipe.yaml
- risky-recipe.yaml
- test_audit.py
- test_cli.py
- test_discover_grade.py
- test_miniyaml.py
.gitignore
AGENTS.md
LICENSE
pyproject.toml
README.md

# Use via CDN

jsDelivr

jsDelivr serves any public GitHub repository as a CDN with zero setup. Pick a version and a file to get a ready-to-paste link and snippet.

Version

File

Link

Example

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

Security audit for the extensions declared in [goose](https://github.com/block/goose) recipes.

A goose recipe can bring its own extensions: stdio commands, `inline_python`
blocks, builtins, and remote MCP servers. Those extensions are where a recipe
gets its real power, and its real risk. `goose-extension-audit` reads a recipe
(or a whole directory of them), inspects every extension, and grades the
recipe A-F so a recipe that shells out to `bash -c`, pipes `curl` into a shell,
or runs `eval()` in `inline_python` can be caught in review or blocked in CI.

It is stdlib-only. [PyYAML](https://pyyaml.org/) is used when present;
otherwise a vendored subset parser handles the common recipe shapes, so there
are no required dependencies.

## What it checks

**stdio extensions**

| Kind | Severity |
| --- | --- |
| `stdio-shell-interpreter` (command is `bash`/`sh`/... , `-c` makes it critical) | critical / high |
| `stdio-curl-pipe-shell` (downloads a script and pipes it into a shell) | critical |
| `stdio-remote-exec-unpinned` (`npx`/`uvx`/`pip`/... with no version pin) | high |
| `stdio-shell-metacharacters` (an argument carries `;`, `|`, `$(...)`, ...) | high |
| `secret-in-env` (a hardcoded secret in `envs`) | high |
| `stdio-missing-timeout` | medium |
| `stdio-unpinned-command` (resolved from `PATH`, not an absolute path) | low |

**inline_python extensions**

| Kind | Severity |
| --- | --- |
| `inline-os-system`, `inline-subprocess`, `inline-popen`, `inline-pty-spawn` | critical |
| `inline-eval`, `inline-exec` | critical |
| `inline-dynamic-import` (`__import__`) | high |
| `inline-network`, `inline-socket`, `inline-urlopen` | high |
| `inline-rmtree`, `inline-fs-delete` | high |
| `inline-compile` | medium |
| `inline-missing-timeout` | medium |

**builtin and remote extensions**

| Kind | Severity |
| --- | --- |
| `builtin-broad-permission` (`developer`, `computercontroller`, `shell`) | medium |
| `remote-insecure-transport` (plaintext `http://`) | high |
| `secret-in-header` (hardcoded secret in a remote header) | high |
| `remote-missing-timeout` | medium |
| `unknown-extension-type` | low |

Environment and secret-manager references (`${VAR}`, `env:`, `vault:`, ...)
are treated as safe and never flagged as hardcoded secrets.

## Grading

Each recipe starts at 100 and each finding deducts a weight by severity
(critical 40, high 25, medium 15, low 8). Any critical finding caps that
recipe at grade D. Across several recipes the overall grade is the worst
single recipe, so one recipe with an arbitrary-code-execution extension fails
the whole run.

| Grade | Score |
| --- | --- |
| A | 90-100 |
| B | 80-89 |
| C | 70-79 |
| D | 60-69 |
| F | below 60 |

## Usage

```
python -m goose_extension_audit PATH [PATH ...] [options]
```

`PATH` can be a recipe file or a directory (walked for `.yaml`/`.yml`/`.json`
recipes). Options:

- `--format {console,json,markdown,badge}` output format (default: console)
- `--output FILE` write the report to a file instead of stdout
- `--min-grade {A,B,C,D,F}` exit non-zero if the worst recipe grades below this
- `--fail-on {critical,high,medium,low}` exit non-zero if any finding is at or
  above this severity

Exit codes: `0` passed, `1` a gate failed, `2` no recipes found.

## Example

```
$ python -m goose_extension_audit samples/risky-recipe.yaml
goose-extension-audit  1 recipe(s)
overall grade F  score 0/100  findings 15
  critical 5  high 4  medium 6  low 0

Data Wrangler  [grade F | 0/100]
  samples/risky-recipe.yaml
  [CRITICAL] stdio-shell-interpreter :: shell
        runs an arbitrary shell command via bash -c
  [CRITICAL] stdio-curl-pipe-shell :: shell
        downloads and pipes a script straight into a shell
  ...
```

## In CI

```yaml
- name: audit goose recipes
  run: python -m goose_extension_audit recipes/ --fail-on high
```

## Development

```
python -m unittest discover -s tests -v
```

The suite runs on the zero-dependency parser and, separately, with PyYAML
installed, across Python 3.9 to 3.12.

## License

MIT

goose-extension-audit

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

goose-extension-audit

Owner Repos

File Explorer

# Use via CDN

Was this content helpful?

Recent Feedback

Download README