HaE Skill

Author: EvilChen

README Version: [English | 简体中文]

Project Introduction

HaE Skill turns the HaE rule set into an Agent Skill. An AI coding agent loads SKILL.md, scans the files you point it at with ripgrep, and reports fingerprints, secrets and sensitive data grouped by rule — with file:line references you can act on.

Matching is rule-driven and nothing else: the rules in rules/Rules.json decide what is interesting, ripgrep does the work, and a single deduplicated JSON report is the output.

Requirements

• Python 3.8+, standard library only
• ripgrep, PCRE2 build recommended (brew install ripgrep)

Installation

npx skills add https://github.com/overspace-labs/HaESkill -g -y

-g installs it globally so every project can use it, and -y skips the prompts. Drop -g to install into the current project only.

Manual installation works too, by cloning the repository and linking it into whichever directory your agent loads skills from:

git clone https://github.com/overspace-labs/HaESkill.git
ln -s "$(pwd)/HaESkill" <agent-skills-dir>/hae

Usage

Ask the agent in natural language, for example "scan ./dist for leaked keys with HaE". The agent runs the scanner and reports what matters.

The scanner also works on its own:

python3 scripts/hae_scan.py /path/to/target
python3 scripts/hae_scan.py /path/to/target --group "Sensitive Information"
python3 scripts/hae_scan.py --list-rules

A target is always required. The report is written to .hae/hae-scan-<timestamp>.json under the current directory, with a per-rule summary printed to stdout.

HTTP Response Scanning

When a request involves curl, wget, downloading a URL, or checking downloaded JavaScript/configuration, use scripts/hae_forward.py. The first two arguments are curl|wget URL; all remaining arguments are passed unchanged to the real client. The real client runs exactly once. The script reads the external rules/Rules.json, captures that command's stdout in memory, scans it by invoking rg --json --pcre2 once per rule, and emits one aggregated JSON report.

python3 scripts/hae_forward.py curl https://example.com/app.js -sS -L
python3 scripts/hae_forward.py wget https://example.com/config.json --header='User-Agent: HaE'

The report uses the same top-level shape as hae_scan.py: meta, summary, and findings. Each finding includes its HaE group and rule. Only stdout is scanned. If the original command writes the body to a file, returns headers only, or produces no body on stdout, there are no HTTP body findings. stderr remains the real client's diagnostics. Use scripts/hae_scan.py separately for local files or already-saved responses.

Rules

rules/Rules.json carries the HaE rule set reduced to what file scanning needs:

{
  "rules": [
    {
      "group": "Fingerprint",
      "rule": [
        { "name": "Shiro", "regex": "(=deleteMe|rememberMe=)", "sensitive": true }
      ]
    }
  ]
}

regex reports its capture group 1 as the matched value, and sensitive: true means case-sensitive. JSON is used instead of HaE's YAML so that loading rules needs nothing beyond the Python standard library; --rules still accepts a .yml file when PyYAML happens to be installed.

HaE's HTTP-oriented fields (scope, engine, color, validator) and the two-stage s_regex / format extraction are dropped — there is no HTTP message to scope and no UI to color. Copy rules from any HaE rule set by renaming f_regex to regex.

Documentation

• SKILL.md — the Skill itself: workflow, options, report shape
• reference.md — rule semantics, ripgrep invocation, troubleshooting

Related Projects

• HaE Network — BurpSuite extension for HTTP traffic
• HaE File — VS Code extension for local files

License

Apache License 2.0