scan-composer

Bitrix Module Security — orchestrated entry

This is the headless entry point of the automatic scan (suitable for any agent-CLI). You run the security-flow for checking a single Bitrix module, headless (the container is isolated, there is no external network — only the model relay; no web UI).

This skill itself contains no audit heuristics. The audit is in the skill scan, the severity policy is in journal-review. The same steps in human-readable form are described in using-marketplace-sec (upstream reference).

You are given in the prompt:

• MODULE_DIR — path to the unpacked PHP source of the module (invocation argument).
• RESULT_PATH — path where the final JSON report should be saved.
• REVIEW_SCRIPT — absolute path to review_journal.py (deterministic severity-review script). Already on disk — use the path as is, do NOT look for it via find.

If the path to REVIEW_SCRIPT is not given in the prompt — report this and stop the flow.

Mandatory sequence

Execute ALL steps in order. You must not write the raw audit directly to RESULT_PATH — RESULT_PATH must contain the reviewed (reviewed) report after step 2.

1. SCAN. Invoke the skill scan with the MODULE_DIR argument — conduct a thorough security audit according to its methodology (including scan/references/*). Save the raw JSON to /tmp/raw-scan.json. Format strictly: {success, requestId, data:{vulnerabilities[], summary, scannedFiles, riskLevel, auditedFiles}}; EACH finding has file, line, type, severity, description, recommendation, fix.

2. REVIEW (BUS-aware severity). Execute (substitute the real RESULT_PATH and REVIEW_SCRIPT from the prompt):

   python3 "$REVIEW_SCRIPT" /tmp/raw-scan.json --output "RESULT_PATH"

   The script preserves the original fields, replaces only severity with the reviewed severity, adds a reviewed node to each finding and data.reviewSummary. Now RESULT_PATH is the final report.

   On a NON-zero exit code review_journal.py the script does NOT invent anything — it prints to stderr the full list of actual gaps. Act with a deterministic loop (maximum 3 iterations):

   1. Read stderr. The machine-readable list is in the line REVIEW_VALIDATION_ERRORS: [...] (JSON array of all problematic findings at once). Each element: index, file, line, type, missingKeys, invalidSeverity.
   2. For each listed finding, do a targeted check: open (Read) its file (if necessary by line) and write into /tmp/raw-scan.json real the missing value derived from the code — the actual description/recommendation/fix, or the correct severity from the set {high, medium, low}. Fix all findings from the list in one pass. No stubs/placeholders.
   3. Rerun the same command review_journal.py. Repeat the cycle until the exit code becomes 0.

   If you fail to converge within 3 iterations — do NOT slip in fabricated data: stop the flow with an error (the outer layer will restart the scan from scratch). An honest retry is better than a fake report.

3. VALIDATE final. First the syntax: python3 -m json.tool "RESULT_PATH". Then — self-check the real final form before declaring it done. Read RESULT_PATH and verify each point:

   • data.summary — it is a string (not an object, not an array).
   • data.scannedFiles — it is a number.
   • data.riskLevel ∈ {high, medium, low, none}.
   • data.auditedFiles — it is an array of strings.
   • у each data.vulnerabilities[i] contains all 7 keys (file, line, type, severity, description, recommendation, fix), and description, recommendation, fix — non-empty.
   • data.riskLevel equals the maximum severity among the findings (none, if there are no findings).

   If the self-check found a gap — do NOT insert a placeholder. Fix the real content: reread the module file and write in the actual fix/recommendation/description, then rerun the REVIEW step (item 2, with the same bounded loop — at most 3 iterations), so that the reviewed report is reassembled from the corrected data. If you fail to converge — stop the flow with an error, do not submit a fake report.

4. One-line summary: reviewed severity counters (high/medium/low) from data.reviewSummary.

Do not start any UI/web servers. The cumulative log (journal-update) in this headless pipeline is NOT maintained — cross-run state is tracked by the API.