---
name: famclaw/honeybadger-dev
source: https://app.decimal.ai/s/famclaw-honeybadger-dev@1/SKILL.md
source_sha256: 4a4f6772b26d
---

# HoneyBadger — extending scanners

## Adding a scanner
- New scanner = its own package under `internal/scanner/<name>/`.
- Register it in `internal/engine/engine.go` (scanner list + verdict weighting).
- Ship a matching fixture in `internal/testfixture/` — fixtures build secrets **at runtime** (never hardcoded) so GitHub push protection doesn't reject the push.

## Common extensions
- New lockfile parser (Cargo.lock, pnpm-lock.yaml, poetry.lock): add in `internal/scanner/cve/deps.go`.
- New supply-chain rule / secret pattern: add YAML under `rules/` (embedded via `rules/embed.go`).
- Typosquat dictionary entries: `internal/scanner/supplychain`.
- New test fixture: add to `internal/testfixture/` with secrets built at runtime.

## Before submitting
`make build` · `make test` · `make self-check` (scans itself) · `go test -tags integration ./...`. Open the PR against `main`.