|
1 | 1 | # EXC Analyzer |
2 | | -<<<<<<< HEAD |
3 | | -[](https://github.com/exc-analyzer/exc/releases) |
5 | | -[](https://pepy.tech/projects/exc-analyzer) |
6 | | -[](https://github.com/exc-analyzer/exc/releases) |
7 | | -[](https://pypi.org/project/exc-analyzer/) |
8 | | -[](https://github.com/exc-analyzer/exc) |
9 | | -[](https://badge.socket.dev/pypi/package/exc-analyzer/1.2.1?artifact_id=tar-gz) |
10 | | -======= |
11 | 2 |
|
12 | 3 | [](https://github.com/exc-analyzer/exc/releases) |
13 | 4 | [](https://pepy.tech/projects/exc-analyzer) |
14 | 5 | [](https://github.com/exc-analyzer/exc/releases) |
15 | 6 | [](https://pypi.org/project/exc-analyzer/) |
16 | 7 | [](https://github.com/exc-analyzer/exc) |
17 | 8 | [](https://badge.socket.dev/pypi/package/exc-analyzer/1.3.0?artifact_id=tar-gz) |
18 | | ->>>>>>> ba1aa21 (chore: prepare release v1.3.0 with automated workflow) |
19 | 9 |
|
20 | 10 | **EXC Analyzer** is a professional command-line tool for advanced GitHub repository intelligence, security auditing, and content analysis. Designed for security researchers, penetration testers, and open-source maintainers, it bridges the gap between simple metadata and deep, actionable insights. |
21 | 11 |
|
@@ -126,174 +116,6 @@ Switch languages dynamically using `--lang` or the environment variable: |
126 | 116 |
|
127 | 117 | *(Selection is remembered for future commands.)* |
128 | 118 |
|
129 | | -## Debian/Kali Packaging |
130 | | -1. Prerequisites (on Debian/Ubuntu/Kali): |
131 | | - ```sh |
132 | | - sudo apt update |
133 | | - sudo apt install build-essential debhelper dh-python python3-all python3-build python3-setuptools python3-wheel pybuild-plugin-pyproject |
134 | | - ``` |
135 | | -2. Build the source package (tested on Ubuntu 22.04 / WSL): |
136 | | - ```sh |
137 | | - dpkg-buildpackage -us -uc |
138 | | - ``` |
139 | | - This consumes the metadata under `debian/` and emits `exc-analyzer_*.deb` artifacts. |
140 | | - For traceability we publish sanitized logs, e.g. `exc-analyzer_1.2.1-1_build.log`. |
141 | | -3. Test the resulting `.deb` locally: |
142 | | - ```sh |
143 | | - sudo apt install ./exc-analyzer_1.2.1-1_all.deb |
144 | | - ``` |
145 | | -4. The package is assembled via `dh --with python3 --buildsystem=pybuild`, so `pyproject.toml`, localization catalogs, and console scripts are bundled automatically. `Rules-Requires-Root: no` keeps the build user-friendly. |
146 | | -
|
147 | | -> Note: `dpkg-buildpackage` is only available on Debian-like systems. Use WSL, a container, or a native Kali/Ubuntu machine rather than Windows PowerShell when producing the actual `.deb` for submission. |
148 | | -
|
149 | | -## Testing |
150 | | -1. Install development dependencies: |
151 | | - ```sh |
152 | | - pip install -e .[dev] |
153 | | - ``` |
154 | | -2. Execute the automated suite: |
155 | | - ```sh |
156 | | - pytest |
157 | | - ``` |
158 | | -GitHub Actions also runs these tests on every push/PR across Linux, macOS, and Windows environments to keep the CLI stable for Kali packaging requirements. |
159 | | -
|
160 | | -
|
161 | | -## Command Overview |
162 | | -| Command | Purpose | |
163 | | -|------------------------------- |----------------------------------------------| |
164 | | -| `key` | Manage GitHub API token | |
165 | | -| `analysis <owner/repo>` | Analyze repository statistics and health | |
166 | | -| `user-a <username>` | Analyze a GitHub user's profile | |
167 | | -| `scan-secrets <owner/repo>` | Scan recent commits for secrets | |
168 | | -| `file-history <owner/repo> <file>` | Show commit history for a file | |
169 | | -| `dork-scan <query>` | Search public code for sensitive patterns | |
170 | | -| `advanced-secrets <owner/repo>`| Deep scan for secrets in files and commits | |
171 | | -| `security-score <owner/repo>` | Evaluate repository security posture | |
172 | | -| `commit-anomaly <owner/repo>` | Detect suspicious commit/PR activity | |
173 | | -| `user-anomaly <username>` | Detect unusual user activity | |
174 | | -| `content-audit <owner/repo>` | Audit repo docs, policies, and content | |
175 | | -| `actions-audit <owner/repo>` | Audit GitHub Actions/CI workflows | |
176 | | - |
177 | | - |
178 | | -## Detailed Command Reference |
179 | | - |
180 | | -### 1. API Key Management |
181 | | - |
182 | | -- **Set or update your GitHub API key:** |
183 | | - ```sh |
184 | | - exc key |
185 | | - ``` |
186 | | - |
187 | | -- **Reset (delete) your API key:** |
188 | | - ```sh |
189 | | - exc key --reset |
190 | | - ``` |
191 | | - |
192 | | -- **Migrate key to the OS credential store:** |
193 | | - ```sh |
194 | | - exc key --migrate |
195 | | - ``` |
196 | | -### Storage |
197 | | - |
198 | | -By default, the API key is stored in the **OS credential store**. |
199 | | - |
200 | | -Alternatively, if the OS credential store is not available or migration is not performed, the key can be stored in: |
201 | | - |
202 | | -- **Linux:** `~/.exc/build.sec` (permissions: 0600) |
203 | | -- **Windows:** `%USERPROFILE%\.exc\build.sec` |
204 | | - |
205 | | -### 2. Repository Analysis |
206 | | -- Analyze repository health, stats, and contributors: |
207 | | - ```sh |
208 | | - exc analysis owner/repo |
209 | | - ``` |
210 | | - - Shows description, stars, forks, languages, top committers, contributors, issues, and PRs. |
211 | | - |
212 | | -### 3. User Analysis |
213 | | -- Profile a GitHub user: |
214 | | - ```sh |
215 | | - exc user-a username |
216 | | - ``` |
217 | | - - Displays user info, activity, and top repositories. |
218 | | - |
219 | | -### 4. Secret Scanning |
220 | | -- Scan recent commits for secrets: |
221 | | - ```sh |
222 | | - exc scan-secrets owner/repo -l 20 |
223 | | - ``` |
224 | | - - Detects AWS keys, GitHub tokens, SSH keys, and generic API keys in the last N commits. |
225 | | -- Deep scan for secrets in files and commits: |
226 | | - ```sh |
227 | | - exc advanced-secrets owner/repo -l 30 |
228 | | - ``` |
229 | | - - Scans all files and recent commits for a wide range of secret patterns. |
230 | | - |
231 | | -### 5. File History |
232 | | -- Show commit history for a specific file: |
233 | | - ```sh |
234 | | - exc file-history owner/repo path/to/file.py |
235 | | - ``` |
236 | | - - Lists commit messages, authors, dates, and links for the file. |
237 | | - |
238 | | -### 6. Dork Scan |
239 | | -- Search public GitHub code for sensitive patterns: |
240 | | - ```sh |
241 | | - exc dork-scan "dork query" |
242 | | - ``` |
243 | | - - Supports advanced queries, file extension and filename filters. |
244 | | - |
245 | | -### 7. Contributor Impact |
246 | | -- Estimate contributor impact: |
247 | | - ```sh |
248 | | - exc contrib-impact owner/repo |
249 | | - ``` |
250 | | - - Ranks contributors by code additions/deletions. |
251 | | - |
252 | | -### 8. Security Scoring |
253 | | -- Evaluate repository security posture: |
254 | | - ```sh |
255 | | - exc security-score owner/repo |
256 | | - ``` |
257 | | - - Checks for branch protection, code scanning, dependabot, security.md, and more. |
258 | | - |
259 | | -### 9. Commit/PR Anomaly Detection |
260 | | -- Detect suspicious commit/PR activity: |
261 | | - ```sh |
262 | | - exc commit-anomaly owner/repo |
263 | | - ``` |
264 | | - - Flags risky commit messages and patterns. |
265 | | - |
266 | | -### 10. User Anomaly Detection |
267 | | -- Detect unusual user activity: |
268 | | - ```sh |
269 | | - exc user-anomaly username |
270 | | - ``` |
271 | | - - Highlights abnormal event timing or frequency. |
272 | | - |
273 | | -### 11. Content & Workflow Auditing |
274 | | -- Audit repository documentation and policies: |
275 | | - ```sh |
276 | | - exc content-audit owner/repo |
277 | | - ``` |
278 | | - - Checks for LICENSE, SECURITY.md, CODE_OF_CONDUCT.md, CONTRIBUTING.md, and README quality. |
279 | | -- Audit GitHub Actions/CI workflows: |
280 | | - ```sh |
281 | | - exc actions-audit owner/repo |
282 | | - ``` |
283 | | - - Reviews workflow files for security risks and best practices. |
284 | | - |
285 | | - |
286 | | -## API Key Management |
287 | | -- Your GitHub token is required for all API operations. |
288 | | -- The token is stored securely and never transmitted except to GitHub. |
289 | | -- If you lose or wish to rotate your token, use `exc key --reset`. |
290 | | - |
291 | | -Note on storage and security: |
292 | | - |
293 | | -- EXC attempts to use the operating system's secure credential storage when available (for example, Windows Credential Manager, macOS Keychain, or Linux Secret Service) via the optional `keyring` library. This provides the strongest local protection for tokens. |
294 | | -- If OS credential storage is not available, EXC falls back to storing the token in a local file: `~/.exc/build.sec` (Linux/macOS) or `%USERPROFILE%\\.exc\\build.sec` (Windows). The app will attempt to set strict file permissions (0600) on Unix-like systems. |
295 | | -- Important: base64 is used for a simple file-obfuscation fallback and is not a replacement for proper encryption. File permission protections (0600) reduce exposure, but the most robust option is OS credential storage; EXC will prefer that when possible. |
296 | | -
|
297 | 119 | ## Troubleshooting |
298 | 120 |
|
299 | 121 | * **Rate Limits:** If you hit API limits, the tool will automatically pause and retry. Using an authenticated token (`exc login`) increases your quota significantly. |
|
0 commit comments