feat: add public doctor API for programmatic usage [4 of 8]

[whizzzkid]

Part 4 of 8

This is 4/8 of #265

Description of Changes (auto-gen)

Add library entry points for the doctor module:

• src/doctor/api.rs: run() and list() functions for programmatic doctor checks
• Export DoctorRunOptions and PathRunResult from doctor module and crate root
• Enable library users to run health checks without CLI dependencies

[dryrunsecurity]

This pull request introduces code in src/doctor/api.rs where the run function executes commands taken from repository configuration files (.scope/*.yaml) during both 'check' and 'fix' phases without prompting, using /usr/bin/env -S and an unsafe PATH that includes the repo's bin directories, allowing a malicious repository to achieve arbitrary code execution when a user runs scope doctor. This behavior is currently judged non-blocking but represents a critical security risk because commands run automatically and validation is insufficient.

Configuration-Driven Arbitrary Code Execution in src/doctor/api.rs

Vulnerability

Configuration-Driven Arbitrary Code Execution

Description

The run function in src/doctor/api.rs executes arbitrary commands defined in the configuration files (.scope/*.yaml) located within the repository being scanned. This execution occurs during both the 'check' phase and the 'fix' phase. Crucially, the 'check' phase and group-level skip checks execute these commands automatically without any user confirmation or prompting. The execution provider uses /usr/bin/env -S to run these command strings, and the validation performed is insufficient as it includes the repository's own bin directories in the search path. An attacker can thus achieve arbitrary code execution by providing a malicious repository that a user runs scope doctor on.

scope/src/doctor/api.rs

Lines 79 to 82 in 14d566f

	pub async fn run(config: &FoundConfig, options: DoctorRunOptions) -> Result<PathRunResult> {
	info!("Starting doctor run");
	// Get cache implementation

---

All finding details can be found in the DryRun Security Dashboard.