\r \r

HTTPLint -- HTTP Client & Server Misconfiguration Detector\r

\r HTTPLint scans codebases for HTTP client/server misconfigurations, insecure connections, missing timeouts, cookie security issues, caching misconfigurations, header problems, and request handling vulnerabilities. It uses regex-based pattern matching against 90 HTTP-specific patterns across 6 categories, lefthook for git hook integration, and produces markdown reports with actionable remediation guidance. 100% local. Zero telemetry.\r \r

Commands\r

\r

Free Tier (No license required)\r

\r

httplint scan [file|directory]\r

One-shot HTTP configuration scan of files or directories.\r \r How to execute:\r

bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" --path [target]\r
```\r
\r
**What it does:**\r
1. Accepts a file path or directory (defaults to current directory)\r
2. Discovers all source files (skips .git, node_modules, binaries, images, .min.js)\r
3. Runs 30 HTTP configuration patterns against each file (free tier limit)\r
4. Calculates an HTTP configuration quality score (0-100) per file and overall\r
5. Grades: A (90-100), B (80-89), C (70-79), D (60-69), F (\x3C60)\r
6. Outputs findings with: file, line number, check ID, severity, description, recommendation\r
7. Exit code 0 if score >= 70, exit code 1 if HTTP configuration quality is poor\r
8. Free tier limited to first 30 patterns (HC + HS categories)\r
\r
**Example usage scenarios:**\r
- "Scan my code for HTTP issues" -> runs `httplint scan .`\r
- "Check this file for HTTP misconfigurations" -> runs `httplint scan src/server.ts`\r
- "Find insecure HTTP connections" -> runs `httplint scan src/`\r
- "Audit HTTP configuration quality in my project" -> runs `httplint scan .`\r
- "Check for cookie security issues" -> runs `httplint scan .`\r
\r
### Pro Tier ($19/user/month -- requires HTTPLINT_LICENSE_KEY)\r
\r
#### `httplint scan --tier pro [file|directory]`\r
Extended scan with 60 patterns covering HTTP client, server, cookie security, and caching headers.\r
\r
**How to execute:**\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" --path [target] --tier pro\r
```\r
\r
**What it does:**\r
1. Validates Pro+ license\r
2. Runs 60 HTTP patterns (HC, HS, CK, CH categories)\r
3. Detects cookie security issues (missing Secure flag, SameSite, session fixation)\r
4. Identifies caching and header misconfigurations\r
5. Full category breakdown reporting\r
\r
#### `httplint scan --format json [directory]`\r
Generate JSON output for CI/CD integration.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" --path [directory] --format json\r
```\r
\r
#### `httplint scan --format html [directory]`\r
Generate HTML report for browser viewing.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" --path [directory] --format html\r
```\r
\r
#### `httplint scan --category CK [directory]`\r
Filter scan to a specific check category (HC, HS, CK, CH, RH, ER).\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" --path [directory] --category CK\r
```\r
\r
### Team Tier ($39/user/month -- requires HTTPLINT_LICENSE_KEY with team tier)\r
\r
#### `httplint scan --tier team [directory]`\r
Full scan with all 90 patterns across all 6 categories including request handling and error response.\r
\r
**How to execute:**\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" --path [directory] --tier team\r
```\r
\r
**What it does:**\r
1. Validates Team+ license\r
2. Runs all 90 patterns across 6 categories\r
3. Includes request handling checks (input validation, content-length, redirects, smuggling)\r
4. Includes error and response checks (stack traces, status codes, error handling, response format)\r
5. Full category breakdown with per-file results\r
\r
#### `httplint scan --verbose [directory]`\r
Verbose output showing every matched line and pattern details.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" --path [directory] --verbose\r
```\r
\r
#### `httplint status`\r
Show license and configuration information.\r
\r
```bash\r
bash "\x3CSKILL_DIR>/scripts/dispatcher.sh" status\r
```\r
\r
## Check Categories\r
\r
HTTPLint detects 90 HTTP misconfiguration patterns across 6 categories:\r
\r
| Category | Code | Patterns | Description | Severity Range |\r
|----------|------|----------|-------------|----------------|\r
| **HTTP Client** | HC | 15 | Missing timeouts, no retries, insecure connections, hardcoded URLs, missing User-Agent | medium -- critical |\r
| **HTTP Server** | HS | 15 | Missing CORS configuration, no rate limiting, improper status codes, missing middleware | medium -- critical |\r
| **Cookie & Session** | CK | 15 | Missing Secure flag, no SameSite attribute, session fixation, insecure token storage | high -- critical |\r
| **Caching & Headers** | CH | 15 | Missing cache control, no ETags, missing security headers, improper content type | medium -- high |\r
| **Request Handling** | RH | 15 | Missing input validation, content-length issues, open redirects, request smuggling | high -- critical |\r
| **Error & Response** | ER | 15 | Stack trace exposure, improper status codes, missing error handling, response format issues | medium -- high |\r
\r
## Tier-Based Pattern Access\r
\r
| Tier | Patterns | Categories |\r
|------|----------|------------|\r
| **Free** | 30 | HC, HS |\r
| **Pro** | 60 | HC, HS, CK, CH |\r
| **Team** | 90 | HC, HS, CK, CH, RH, ER |\r
| **Enterprise** | 90 | HC, HS, CK, CH, RH, ER + priority support |\r
\r
## Scoring\r
\r
HTTPLint uses a deductive scoring system starting at 100 (perfect):\r
\r
| Severity | Point Deduction | Description |\r
|----------|-----------------|-------------|\r
| **Critical** | -25 per finding | Severe security issue (insecure connections, missing authentication) |\r
| **High** | -15 per finding | Significant quality problem (missing timeouts, no CORS) |\r
| **Medium** | -8 per finding | Moderate concern (missing headers, caching issues) |\r
| **Low** | -3 per finding | Informational / best practice suggestion |\r
\r
### Grading Scale\r
\r
| Grade | Score Range | Meaning |\r
|-------|-------------|---------|\r
| **A** | 90-100 | Excellent HTTP configuration quality |\r
| **B** | 80-89 | Good configuration with minor issues |\r
| **C** | 70-79 | Acceptable but needs improvement |\r
| **D** | 60-69 | Poor HTTP configuration quality |\r
| **F** | Below 60 | Critical HTTP configuration problems |\r
\r
- **Pass threshold:** 70 (Grade C or better)\r
- Exit code 0 = pass (score >= 70)\r
- Exit code 1 = fail (score \x3C 70)\r
\r
## Configuration\r
\r
Users can configure HTTPLint in `~/.openclaw/openclaw.json`:\r
\r
```json\r
{\r
  "skills": {\r
    "entries": {\r
      "httplint": {\r
        "enabled": true,\r
        "apiKey": "YOUR_LICENSE_KEY_HERE",\r
        "config": {\r
          "severityThreshold": "medium",\r
          "ignorePatterns": ["**/test/**", "**/fixtures/**", "**/*.test.*"],\r
          "ignoreChecks": [],\r
          "reportFormat": "text"\r
        }\r
      }\r
    }\r
  }\r
}\r
```\r
\r
## Important Notes\r
\r
- **Free tier** works immediately with no configuration\r
- **All scanning happens locally** -- no code is sent to external servers\r
- **License validation is offline** -- no phone-home or network calls\r
- Pattern matching only -- no AST parsing, no external dependencies beyond bash\r
- Supports scanning all file types in a single pass\r
- Git hooks use **lefthook** which must be installed (see install metadata above)\r
- Exit codes: 0 = pass (score >= 70), 1 = fail (for CI/CD integration)\r
- Output formats: text (default), json, html\r
\r
## Error Handling\r
\r
- If lefthook is not installed and user tries hooks, prompt to install it\r
- If license key is invalid or expired, show clear message with link to https://httplint.pages.dev/renew\r
- If a file is binary, skip it automatically with no warning\r
- If no scannable files found in target, report clean scan with info message\r
- If an invalid category is specified with --category, show available categories\r
\r
## When to Use HTTPLint\r
\r
The user might say things like:\r
- "Scan my code for HTTP issues"\r
- "Check my HTTP configuration"\r
- "Find insecure HTTP connections"\r
- "Detect missing timeouts in my HTTP clients"\r
- "Are there any hardcoded URLs in my code?"\r
- "Check for missing CORS configuration"\r
- "Audit my cookie security"\r
- "Find missing security headers"\r
- "Check for request smuggling vulnerabilities"\r
- "Scan for HTTP anti-patterns"\r
- "Run an HTTP configuration audit"\r
- "Generate an HTTP quality report"\r
- "Check if cookies have the Secure flag"\r
- "Find missing rate limiting in my API"\r
- "Check my code for HTTP security issues"\r