npm - @bryan-thompson/inspector-assessment-client - Versions diffs - 1.18.1 → 1.19.1 - Mend

@bryan-thompson/inspector-assessment-client 1.18.1 → 1.19.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (31) hide show

package/lib/services/assessment/LanguageAwarePayloadGenerator.js ADDED Viewed

@@ -0,0 +1,258 @@
+/**
+ * Language-Aware Payload Generator
+ *
+ * Detects expected input language from parameter/tool names and generates
+ * appropriate payloads for code execution vulnerability detection.
+ *
+ * Problem: Inspector sends shell commands like `whoami` to all tools, but
+ * code execution tools expecting language-specific input (Python, JavaScript, SQL)
+ * are not detected because they reject shell syntax as invalid.
+ *
+ * Solution: Detect target language from context and generate appropriate payloads.
+ */
+export class LanguageAwarePayloadGenerator {
+    /**
+     * Detect target language from parameter name and tool context.
+     * Uses heuristics based on common naming patterns.
+     */
+    detectLanguage(paramName, toolName, toolDescription) {
+        const combined = `${paramName} ${toolName} ${toolDescription || ""}`.toLowerCase();
+        const paramLower = paramName.toLowerCase();
+        // Note: Use (^|_|\s) and ($_|\s|$) instead of \b to handle underscore-separated names
+        // since \b treats _ as a word character
+        // Python indicators (highest priority for code execution)
+        if (/(^|_|\s|^)(python|py|pycode)(\_|\s|$)/i.test(combined) ||
+            /exec_?python/i.test(combined) ||
+            (/(^|_|\s)(code)(_|\s|$)/i.test(paramLower) &&
+                /(^|_|\s)(python|py)(_|\s|$)/i.test(combined))) {
+            return "python";
+        }
+        // JavaScript indicators
+        if (/(^|_|\s)(javascript|js|node|nodejs)(_|\s|$)/i.test(combined) ||
+            (/(^|_|\s)(code)(_|\s|$)/i.test(paramLower) &&
+                /(^|_|\s)(js|javascript|node)(_|\s|$)/i.test(combined))) {
+            return "javascript";
+        }
+        // SQL indicators (exclude NoSQL patterns)
+        if (/(^|_|\s)(sql|query|statement)(_|\s|$)/i.test(combined) &&
+            !/(nosql|mongodb|dynamodb|couchdb)/i.test(combined)) {
+            return "sql";
+        }
+        // Shell/command indicators (existing behavior)
+        if (/(^|_|\s)(command|cmd|shell|bash|exec|run)(_|\s|$)/i.test(combined)) {
+            return "shell";
+        }
+        // Generic code parameter - defaults to Python as most common
+        if (/(^|_|\s)(code|script|source|program|expression)(_|\s|$)/i.test(paramLower)) {
+            return "python";
+        }
+        return "generic";
+    }
+    /**
+     * Get payloads appropriate for the detected language.
+     */
+    getPayloadsForLanguage(language) {
+        switch (language) {
+            case "python":
+                return this.getPythonPayloads();
+            case "javascript":
+                return this.getJavaScriptPayloads();
+            case "sql":
+                return this.getSqlPayloads();
+            case "shell":
+                return this.getShellPayloads();
+            default:
+                return this.getGenericPayloads();
+        }
+    }
+    /**
+     * Check if a parameter name suggests code execution context.
+     */
+    isCodeExecutionParameter(paramName) {
+        // Use (^|_|\s) and (_|\s|$) to handle underscore-separated names
+        return /(^|_|\s)(code|script|source|program|expression|eval|exec)(_|\s|$)/i.test(paramName);
+    }
+    getPythonPayloads() {
+        return [
+            {
+                language: "python",
+                payload: "import subprocess; print(subprocess.check_output(['whoami']).decode())",
+                evidence: /\b(root|user|admin|ubuntu|www-data|node|bryan)\b/i,
+                description: "Python subprocess command execution",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "python",
+                payload: "__import__('os').system('whoami')",
+                evidence: /\b(root|user|admin|ubuntu|www-data|node|bryan)\b|^0$/,
+                description: "Python os.system via __import__",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "python",
+                payload: "import os; print(os.popen('whoami').read())",
+                evidence: /\b(root|user|admin|ubuntu|www-data|node|bryan)\b/i,
+                description: "Python os.popen command execution",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "python",
+                payload: "exec('import os; os.system(\"whoami\")')",
+                evidence: /\b(root|user|admin|ubuntu|www-data|node|bryan)\b|^0$/,
+                description: "Python exec() with embedded os.system",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "python",
+                payload: "print(open('/etc/passwd').read())",
+                evidence: /root:x:0:0|\/bin\/bash|\/bin\/sh/i,
+                description: "Python file read /etc/passwd",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "python",
+                payload: "import os; print(os.environ)",
+                evidence: /(PATH|HOME|USER|SECRET|API_KEY|DATABASE|TOKEN)/i,
+                description: "Python environment variable dump",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "python",
+                payload: "import os; print(os.getcwd())",
+                evidence: /\/(home|tmp|var|app|usr|root)/i,
+                description: "Python current directory disclosure",
+                riskLevel: "MEDIUM",
+            },
+        ];
+    }
+    getJavaScriptPayloads() {
+        return [
+            {
+                language: "javascript",
+                payload: "require('child_process').execSync('whoami').toString()",
+                evidence: /\b(root|user|admin|ubuntu|www-data|node|bryan)\b/i,
+                description: "Node.js execSync command execution",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "javascript",
+                payload: "const { execSync } = require('child_process'); execSync('whoami').toString()",
+                evidence: /\b(root|user|admin|ubuntu|www-data|node|bryan)\b/i,
+                description: "Node.js destructured execSync",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "javascript",
+                payload: "require('fs').readFileSync('/etc/passwd', 'utf8')",
+                evidence: /root:x:0:0|\/bin\/bash|\/bin\/sh/i,
+                description: "Node.js file read /etc/passwd",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "javascript",
+                payload: "JSON.stringify(process.env)",
+                evidence: /(PATH|HOME|USER|SECRET|API_KEY|DATABASE|TOKEN)/i,
+                description: "Node.js environment dump as JSON",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "javascript",
+                payload: "process.cwd()",
+                evidence: /\/(home|tmp|var|app|usr|root)/i,
+                description: "Node.js current directory disclosure",
+                riskLevel: "MEDIUM",
+            },
+        ];
+    }
+    getSqlPayloads() {
+        return [
+            {
+                language: "sql",
+                payload: "'; DROP TABLE users;--",
+                evidence: /(dropped|deleted|table.*users|sql.*error|affected)/i,
+                description: "SQL DROP TABLE injection",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "sql",
+                payload: "' OR '1'='1",
+                evidence: /(true|1|success|rows|result)/i,
+                description: "SQL boolean-based injection",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "sql",
+                payload: "' UNION SELECT * FROM information_schema.tables--",
+                evidence: /(information_schema|table_name|table_schema)/i,
+                description: "SQL UNION information disclosure",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "sql",
+                payload: "'; SELECT pg_sleep(5);--",
+                evidence: /(pg_sleep|sleep|delayed|timeout)/i,
+                description: "SQL time-based injection (PostgreSQL)",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "sql",
+                payload: "'; WAITFOR DELAY '0:0:5';--",
+                evidence: /(waitfor|delay|timeout)/i,
+                description: "SQL time-based injection (SQL Server)",
+                riskLevel: "HIGH",
+            },
+        ];
+    }
+    getShellPayloads() {
+        return [
+            {
+                language: "shell",
+                payload: "whoami",
+                evidence: /\b(root|user|admin|ubuntu|www-data|node|bryan)\b/i,
+                description: "Shell identity command",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "shell",
+                payload: "cat /etc/passwd",
+                evidence: /root:x:0:0|\/bin\/bash|\/bin\/sh/i,
+                description: "Shell file read via cat",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "shell",
+                payload: "id",
+                evidence: /uid=\d+|gid=\d+|groups=/i,
+                description: "Shell user ID command",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "shell",
+                payload: "env",
+                evidence: /(PATH|HOME|USER|SECRET|API_KEY|DATABASE|TOKEN)/i,
+                description: "Shell environment dump",
+                riskLevel: "HIGH",
+            },
+            {
+                language: "shell",
+                payload: "pwd",
+                evidence: /\/(home|tmp|var|app|usr|root)/i,
+                description: "Shell current directory",
+                riskLevel: "MEDIUM",
+            },
+        ];
+    }
+    getGenericPayloads() {
+        // Combine shell and Python payloads for generic detection
+        return [
+            ...this.getShellPayloads(),
+            {
+                language: "generic",
+                payload: "__import__('os').system('whoami')",
+                evidence: /\b(root|user|admin|ubuntu|www-data|node|bryan)\b|^0$/,
+                description: "Python os.system (generic fallback)",
+                riskLevel: "HIGH",
+            },
+        ];
+    }
+}

package/lib/services/assessment/ToolClassifier.d.ts CHANGED Viewed

@@ -7,6 +7,7 @@
 export declare enum ToolCategory {
     CALCULATOR = "calculator",
     SYSTEM_EXEC = "system_exec",
+    CODE_EXECUTOR = "code_executor",
     DATA_ACCESS = "data_access",
     TOOL_OVERRIDE = "tool_override",
     CONFIG_MODIFIER = "config_modifier",

package/lib/services/assessment/ToolClassifier.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ToolClassifier.d.ts","sourceRoot":"","sources":["../../../src/services/assessment/ToolClassifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,oBAAY,YAAY;IACtB,UAAU,eAAe;IACzB,WAAW,gBAAgB;IAC3B,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,eAAe,oBAAoB;IACnC,WAAW,YAAY;IACvB,iBAAiB,YAAY;IAC7B,WAAW,WAAW;IACtB,iBAAiB,cAAc;IAC/B,QAAQ,aAAa;IACrB,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;IAC3B,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IACjC,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,qBAAa,cAAc;IACzB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,kBAAkB;~~IA2UpE~~;;OAEG;IACH,OAAO,CAAC,cAAc;IAItB;;OAEG;IACH,MAAM,CAAC,gBAAgB,IAAI,YAAY,EAAE;IAIzC;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK;~~IAgCtE~~;;OAEG;IACH,aAAa,CACX,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GACnD,kBAAkB,EAAE;CAGxB"}
1	+ {"version":3,"file":"ToolClassifier.d.ts","sourceRoot":"","sources":["../../../src/services/assessment/ToolClassifier.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,oBAAY,YAAY;IACtB,UAAU,eAAe;IACzB,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,WAAW,gBAAgB;IAC3B,aAAa,kBAAkB;IAC/B,eAAe,oBAAoB;IACnC,WAAW,YAAY;IACvB,iBAAiB,YAAY;IAC7B,WAAW,WAAW;IACtB,iBAAiB,cAAc;IAC/B,QAAQ,aAAa;IACrB,YAAY,iBAAiB;IAC7B,WAAW,gBAAgB;IAC3B,gBAAgB,qBAAqB;IACrC,aAAa,kBAAkB;IAC/B,cAAc,mBAAmB;IACjC,OAAO,YAAY;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,YAAY,EAAE,CAAC;IAC3B,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED;;;GAGG;AACH,qBAAa,cAAc;IACzB;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,GAAG,kBAAkB;IAwWpE;;OAEG;IACH,OAAO,CAAC,cAAc;IAItB;;OAEG;IACH,MAAM,CAAC,gBAAgB,IAAI,YAAY,EAAE;IAIzC;;OAEG;IACH,MAAM,CAAC,YAAY,CAAC,QAAQ,EAAE,YAAY,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK;IAiCtE;;OAEG;IACH,aAAa,CACX,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,GACnD,kBAAkB,EAAE;CAGxB"}

package/lib/services/assessment/ToolClassifier.js CHANGED Viewed

@@ -8,6 +8,7 @@ export var ToolCategory;
 (function (ToolCategory) {
     ToolCategory["CALCULATOR"] = "calculator";
     ToolCategory["SYSTEM_EXEC"] = "system_exec";
+    ToolCategory["CODE_EXECUTOR"] = "code_executor";
     ToolCategory["DATA_ACCESS"] = "data_access";
     ToolCategory["TOOL_OVERRIDE"] = "tool_override";
     ToolCategory["CONFIG_MODIFIER"] = "config_modifier";
@@ -67,6 +68,30 @@ export class ToolClassifier {
             confidenceScores.push(95);
             reasons.push("System execution pattern detected (command injection risk)");
         }
+        // Code execution tools (HIGH RISK)
+        // Tools that execute arbitrary code in specific languages (Python, JavaScript, etc.)
+        // These require language-specific payloads, not shell commands
+        if (this.matchesPattern(toolText, [
+            /execute.*code/i,
+            /run.*code/i,
+            /code.*execut/i,
+            /run.*script/i,
+            /exec.*script/i,
+            /\bpython.*code\b/i,
+            /\bjavascript.*code\b/i,
+            /\bjs.*code\b/i,
+            /\beval.*code\b/i,
+            /code.*runner/i,
+            /script.*runner/i,
+            /\bexec\b.*\b(python|js|javascript)\b/i,
+            /\b(python|js|javascript)\b.*\bexec\b/i,
+            /interpret/i,
+            /\brepl\b/i,
+        ])) {
+            categories.push(ToolCategory.CODE_EXECUTOR);
+            confidenceScores.push(95);
+            reasons.push("Code executor pattern detected (arbitrary code execution risk)");
+        }
         // Data access/leak tools (HIGH RISK)
         // Validated: vulnerable_data_leak_tool
         if (this.matchesPattern(toolText, [
@@ -313,6 +338,7 @@ export class ToolClassifier {
         const highRiskCategories = [
             ToolCategory.CALCULATOR,
             ToolCategory.SYSTEM_EXEC,
+            ToolCategory.CODE_EXECUTOR,
             ToolCategory.DATA_ACCESS,
             ToolCategory.TOOL_OVERRIDE,
             ToolCategory.CONFIG_MODIFIER,

package/lib/services/assessment/modules/ResourceAssessor.d.ts CHANGED Viewed

@@ -20,6 +20,11 @@ export declare class ResourceAssessor extends BaseAssessor {
     private isValidUriTemplate;
     private isSensitiveUri;
     private containsSensitiveContent;
+    /**
+     * Detect prompt injection patterns in resource content.
+     * Returns array of matched pattern descriptions.
+     */
+    private detectPromptInjection;
     private injectPayloadIntoTemplate;
     private determineResourceStatus;
     private generateExplanation;

package/lib/services/assessment/modules/ResourceAssessor.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"ResourceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ResourceAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,kBAAkB,EAGnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;~~AA4C9D~~,qBAAa,gBAAiB,SAAQ,YAAY;IAC1C,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;~~IA0ErE~~,OAAO,CAAC,yBAAyB;~~YAgBnB~~,YAAY;~~YAuDZ~~,oBAAoB;~~IA8ElC~~,OAAO,CAAC,UAAU;IAmBlB,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,wBAAwB;IAIhC,OAAO,CAAC,yBAAyB;IAYjC,OAAO,CAAC,uBAAuB;~~IAmB~~/B,OAAO,CAAC,mBAAmB;~~IA6B3B~~,OAAO,CAAC,uBAAuB;~~CAyChC~~"}
1	+ {"version":3,"file":"ResourceAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/ResourceAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EACL,kBAAkB,EAGnB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AA6J9D,qBAAa,gBAAiB,SAAQ,YAAY;IAC1C,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAgFrE,OAAO,CAAC,yBAAyB;YAiBnB,YAAY;YAqEZ,oBAAoB;IAkFlC,OAAO,CAAC,UAAU;IAmBlB,OAAO,CAAC,kBAAkB;IAM1B,OAAO,CAAC,cAAc;IAItB,OAAO,CAAC,wBAAwB;IAIhC;;;OAGG;IACH,OAAO,CAAC,qBAAqB;IAc7B,OAAO,CAAC,yBAAyB;IAYjC,OAAO,CAAC,uBAAuB;IAqB/B,OAAO,CAAC,mBAAmB;IAoC3B,OAAO,CAAC,uBAAuB;CA+DhC"}

package/lib/services/assessment/modules/ResourceAssessor.js CHANGED Viewed

@@ -48,6 +48,110 @@ const SENSITIVE_CONTENT_PATTERNS = [
     /password\s*[:=]\s*['"][^'"]+['"]/i,
     /secret\s*[:=]\s*['"][^'"]+['"]/i,
 ];
+// Prompt injection patterns to detect in resource content
+// These patterns indicate attempts to manipulate LLM behavior through resource content
+const PROMPT_INJECTION_PATTERNS = [
+    // Hidden instruction tags
+    {
+        pattern: /<IMPORTANT>[\s\S]*?<\/IMPORTANT>/gi,
+        description: "Hidden <IMPORTANT> instruction tag",
+    },
+    {
+        pattern: /<HIDDEN>[\s\S]*?<\/HIDDEN>/gi,
+        description: "Hidden <HIDDEN> instruction tag",
+    },
+    {
+        pattern: /<SYSTEM>[\s\S]*?<\/SYSTEM>/gi,
+        description: "Hidden <SYSTEM> instruction tag",
+    },
+    {
+        pattern: /<INSTRUCTION>[\s\S]*?<\/INSTRUCTION>/gi,
+        description: "Hidden <INSTRUCTION> tag",
+    },
+    {
+        pattern: /<SECRET>[\s\S]*?<\/SECRET>/gi,
+        description: "Hidden <SECRET> instruction tag",
+    },
+    // Instruction override attempts
+    {
+        pattern: /ignore\s+(all\s+)?(previous|prior|above)\s+instructions/i,
+        description: "Instruction override attempt",
+    },
+    {
+        pattern: /disregard\s+(all\s+)?(previous|prior|above)\s+instructions/i,
+        description: "Instruction disregard attempt",
+    },
+    {
+        pattern: /forget\s+(all\s+)?(previous|prior|above)\s+instructions/i,
+        description: "Instruction forget attempt",
+    },
+    {
+        pattern: /override\s+(all\s+)?(previous|prior|system)\s+instructions/i,
+        description: "Instruction override attempt",
+    },
+    // Role/identity hijacking
+    {
+        pattern: /you\s+are\s+now\s+(a|an|the)\s+/i,
+        description: "Role hijacking attempt",
+    },
+    {
+        pattern: /your\s+new\s+(role|identity|purpose)\s+is/i,
+        description: "Identity reassignment attempt",
+    },
+    {
+        pattern: /act\s+as\s+(a|an|if\s+you\s+were)\s+/i,
+        description: "Role impersonation instruction",
+    },
+    {
+        pattern: /pretend\s+(to\s+be|you\s+are)\s+/i,
+        description: "Pretend instruction",
+    },
+    // System override attempts
+    {
+        pattern: /system:\s*override/i,
+        description: "System override command",
+    },
+    { pattern: /admin:\s*execute/i, description: "Admin execute command" },
+    { pattern: /root:\s*command/i, description: "Root command injection" },
+    {
+        pattern: /\[system\][\s\S]*?\[\/system\]/gi,
+        description: "System block injection",
+    },
+    // Data exfiltration instructions
+    {
+        pattern: /return\s+all\s+(api\s+)?keys/i,
+        description: "API key exfiltration instruction",
+    },
+    {
+        pattern: /output\s+(all\s+)?(secrets|credentials|passwords)/i,
+        description: "Credential exfiltration instruction",
+    },
+    {
+        pattern: /reveal\s+(all\s+)?(secrets|credentials|api\s+keys)/i,
+        description: "Secret reveal instruction",
+    },
+    {
+        pattern: /print\s+(all\s+)?(environment|env)\s+variables/i,
+        description: "Environment variable exfiltration",
+    },
+    // Delimiter/format injection
+    {
+        pattern: /```system[\s\S]*?```/gi,
+        description: "System code block injection",
+    },
+    {
+        pattern: /\[INST\][\s\S]*?\[\/INST\]/gi,
+        description: "INST tag injection (Llama format)",
+    },
+    {
+        pattern: /<<SYS>>[\s\S]*?<<\/SYS>>/gi,
+        description: "SYS tag injection (Llama format)",
+    },
+    {
+        pattern: /<\|im_start\|>system[\s\S]*?<\|im_end\|>/gi,
+        description: "ChatML system injection",
+    },
+];
 export class ResourceAssessor extends BaseAssessor {
     async assess(context) {
         const results = [];
@@ -75,10 +179,11 @@ export class ResourceAssessor extends BaseAssessor {
         const securityIssuesFound = results.filter((r) => r.securityIssues.length > 0).length;
         const pathTraversalVulnerabilities = results.filter((r) => r.pathTraversalVulnerable).length;
         const sensitiveDataExposures = results.filter((r) => r.sensitiveDataExposed).length;
+        const promptInjectionVulnerabilities = results.filter((r) => r.promptInjectionDetected).length;
         // Determine status
-        const status = this.determineResourceStatus(pathTraversalVulnerabilities, sensitiveDataExposures, securityIssuesFound, results.length);
+        const status = this.determineResourceStatus(pathTraversalVulnerabilities, sensitiveDataExposures, promptInjectionVulnerabilities, securityIssuesFound, results.length);
         // Generate explanation and recommendations
-        const explanation = this.generateExplanation(results, pathTraversalVulnerabilities, sensitiveDataExposures);
+        const explanation = this.generateExplanation(results, pathTraversalVulnerabilities, sensitiveDataExposures, promptInjectionVulnerabilities);
         const recommendations = this.generateRecommendations(results);
         return {
             resourcesTested: resources.length,
@@ -87,6 +192,7 @@ export class ResourceAssessor extends BaseAssessor {
             securityIssuesFound,
             pathTraversalVulnerabilities,
             sensitiveDataExposures,
+            promptInjectionVulnerabilities,
             results,
             status,
             explanation,
@@ -101,6 +207,7 @@ export class ResourceAssessor extends BaseAssessor {
             securityIssuesFound: 0,
             pathTraversalVulnerabilities: 0,
             sensitiveDataExposures: 0,
+            promptInjectionVulnerabilities: 0,
             results: [],
             status: "PASS",
             explanation: "No resources declared by server. Resource assessment skipped.",
@@ -117,6 +224,8 @@ export class ResourceAssessor extends BaseAssessor {
             securityIssues: [],
             pathTraversalVulnerable: false,
             sensitiveDataExposed: false,
+            promptInjectionDetected: false,
+            promptInjectionPatterns: [],
             validUri: this.isValidUri(resource.uri),
         };
         // Check URI for sensitive patterns
@@ -137,6 +246,15 @@ export class ResourceAssessor extends BaseAssessor {
                     result.securityIssues.push("Resource content contains sensitive data patterns (credentials, keys, etc.)");
                     result.sensitiveDataExposed = true;
                 }
+                // Check content for prompt injection patterns
+                if (content) {
+                    const injectionMatches = this.detectPromptInjection(content);
+                    if (injectionMatches.length > 0) {
+                        result.promptInjectionDetected = true;
+                        result.promptInjectionPatterns = injectionMatches;
+                        result.securityIssues.push(`Prompt injection patterns detected: ${injectionMatches.join(", ")}`);
+                    }
+                }
             }
             catch (error) {
                 result.error = this.extractErrorMessage(error);
@@ -161,6 +279,8 @@ export class ResourceAssessor extends BaseAssessor {
             securityIssues: [],
             pathTraversalVulnerable: false,
             sensitiveDataExposed: false,
+            promptInjectionDetected: false,
+            promptInjectionPatterns: [],
             validUri: this.isValidUriTemplate(template.uriTemplate),
         };
         // Check template for sensitive patterns
@@ -182,6 +302,8 @@ export class ResourceAssessor extends BaseAssessor {
                     securityIssues: [],
                     pathTraversalVulnerable: false,
                     sensitiveDataExposed: false,
+                    promptInjectionDetected: false,
+                    promptInjectionPatterns: [],
                     validUri: false,
                 };
                 try {
@@ -231,6 +353,21 @@ export class ResourceAssessor extends BaseAssessor {
     containsSensitiveContent(content) {
         return SENSITIVE_CONTENT_PATTERNS.some((pattern) => pattern.test(content));
     }
+    /**
+     * Detect prompt injection patterns in resource content.
+     * Returns array of matched pattern descriptions.
+     */
+    detectPromptInjection(content) {
+        const matches = [];
+        for (const { pattern, description } of PROMPT_INJECTION_PATTERNS) {
+            // Reset lastIndex for global patterns
+            pattern.lastIndex = 0;
+            if (pattern.test(content)) {
+                matches.push(description);
+            }
+        }
+        return matches;
+    }
     injectPayloadIntoTemplate(template, payload) {
         // Replace template variables with payload
         const result = template.replace(/\{[^}]+\}/g, payload);
@@ -240,12 +377,14 @@ export class ResourceAssessor extends BaseAssessor {
         }
         return result;
     }
-    determineResourceStatus(pathTraversalVulnerabilities, sensitiveDataExposures, securityIssuesFound, totalResources) {
+    determineResourceStatus(pathTraversalVulnerabilities, sensitiveDataExposures, promptInjectionVulnerabilities, securityIssuesFound, totalResources) {
         // Critical failures
         if (pathTraversalVulnerabilities > 0)
             return "FAIL";
         if (sensitiveDataExposures > 0)
             return "FAIL";
+        if (promptInjectionVulnerabilities > 0)
+            return "FAIL";
         // Moderate issues
         if (securityIssuesFound > 0)
             return "NEED_MORE_INFO";
@@ -254,7 +393,7 @@ export class ResourceAssessor extends BaseAssessor {
             return "PASS";
         return "PASS";
     }
-    generateExplanation(results, pathTraversalVulnerabilities, sensitiveDataExposures) {
+    generateExplanation(results, pathTraversalVulnerabilities, sensitiveDataExposures, promptInjectionVulnerabilities) {
         const parts = [];
         parts.push(`Tested ${results.length} resource(s).`);
         if (pathTraversalVulnerabilities > 0) {
@@ -263,6 +402,9 @@ export class ResourceAssessor extends BaseAssessor {
         if (sensitiveDataExposures > 0) {
             parts.push(`WARNING: ${sensitiveDataExposures} resource(s) may expose sensitive data.`);
         }
+        if (promptInjectionVulnerabilities > 0) {
+            parts.push(`CRITICAL: ${promptInjectionVulnerabilities} resource(s) contain prompt injection patterns.`);
+        }
         const accessibleCount = results.filter((r) => r.accessible).length;
         if (accessibleCount > 0) {
             parts.push(`${accessibleCount} resource(s) are accessible.`);
@@ -281,6 +423,21 @@ export class ResourceAssessor extends BaseAssessor {
         if (sensitiveResults.length > 0) {
             recommendations.push("Review resources for sensitive data exposure. Remove or restrict access to resources containing credentials, keys, or sensitive configuration.");
         }
+        // Prompt injection recommendations
+        const promptInjectionResults = results.filter((r) => r.promptInjectionDetected);
+        if (promptInjectionResults.length > 0) {
+            recommendations.push("CRITICAL: Resource content contains prompt injection patterns that could manipulate LLM behavior. Sanitize resource content or restrict access to untrusted resources.");
+            // List specific patterns found
+            const allPatterns = new Set();
+            for (const r of promptInjectionResults) {
+                for (const pattern of r.promptInjectionPatterns) {
+                    allPatterns.add(pattern);
+                }
+            }
+            if (allPatterns.size > 0) {
+                recommendations.push(`Detected patterns: ${Array.from(allPatterns).join(", ")}`);
+            }
+        }
         // Invalid URI recommendations
         const invalidUriResults = results.filter((r) => !r.validUri);
         if (invalidUriResults.length > 0) {

package/lib/services/assessment/modules/SecurityAssessor.d.ts CHANGED Viewed

@@ -13,6 +13,7 @@ import { SecurityAssessment } from "../../../lib/assessmentTypes.js";
 import { BaseAssessor } from "./BaseAssessor.js";
 import { AssessmentContext } from "../AssessmentOrchestrator.js";
 export declare class SecurityAssessor extends BaseAssessor {
+    private languageGenerator;
     assess(context: AssessmentContext): Promise<SecurityAssessment>;
     /**
      * Select tools for testing based on configuration

package/lib/services/assessment/modules/SecurityAssessor.d.ts.map CHANGED Viewed

	@@ -1 +1 @@
1	- {"version":3,"file":"SecurityAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/SecurityAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,kBAAkB,EAInB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;~~AAa9D~~,qBAAa,gBAAiB,SAAQ,YAAY;~~IAC1C~~,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAuFrE;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAkC7B;;;;OAIG;YACW,yBAAyB;IAuKvC;;;;OAIG;YACW,qBAAqB;IA2JnC;;OAEG;YACW,WAAW;IA2HzB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;~~IAkDzB~~;;;OAGG;IACH,OAAO,CAAC,8BAA8B;~~IAmDtC~~;;OAEG;IACH,OAAO,CAAC,aAAa;IA+BrB;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAgClC;;;OAGG;IACH,OAAO,CAAC,eAAe;IA6HvB;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAiE7B;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAqC5B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAsB3B;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;OAEG;YACW,+BAA+B;IAiC7C;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAYjC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA0B/B;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAkEnC;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAuI3B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAsB5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;~~IAmM5B~~;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IA8BhC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IA8BhC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAW9B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,oBAAoB;~~IAoE5B~~;;OAEG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,CAAC,eAAe;IASvB;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAiB9B;;;OAGG;IACH,OAAO,CAAC,kBAAkB;CAmB3B"}
1	+ {"version":3,"file":"SecurityAssessor.d.ts","sourceRoot":"","sources":["../../../../src/services/assessment/modules/SecurityAssessor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,kBAAkB,EAInB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAc9D,qBAAa,gBAAiB,SAAQ,YAAY;IAChD,OAAO,CAAC,iBAAiB,CAAuC;IAC1D,MAAM,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;IAuFrE;;OAEG;IACH,OAAO,CAAC,qBAAqB;IAkC7B;;;;OAIG;YACW,yBAAyB;IAuKvC;;;;OAIG;YACW,qBAAqB;IA2JnC;;OAEG;YACW,WAAW;IA2HzB;;;;;OAKG;IACH,OAAO,CAAC,iBAAiB;IAgDzB;;;OAGG;IACH,OAAO,CAAC,8BAA8B;IAiDtC;;OAEG;IACH,OAAO,CAAC,aAAa;IA+BrB;;OAEG;IACH,OAAO,CAAC,0BAA0B;IAgClC;;;OAGG;IACH,OAAO,CAAC,eAAe;IA6HvB;;;;;;;OAOG;IACH,OAAO,CAAC,qBAAqB;IAiE7B;;;;;;;;;OASG;IACH,OAAO,CAAC,oBAAoB;IAqC5B;;;;;OAKG;IACH,OAAO,CAAC,mBAAmB;IAsB3B;;;;;;;OAOG;IACH,OAAO,CAAC,oBAAoB;IAkC5B;;OAEG;YACW,+BAA+B;IAiC7C;;OAEG;IACH,OAAO,CAAC,yBAAyB;IAYjC;;OAEG;IACH,OAAO,CAAC,uBAAuB;IA0B/B;;OAEG;IACH,OAAO,CAAC,2BAA2B;IAkEnC;;;OAGG;IACH,OAAO,CAAC,mBAAmB;IAuI3B;;;OAGG;IACH,OAAO,CAAC,oBAAoB;IAsB5B;;;;;;;;;;;;OAYG;IACH,OAAO,CAAC,oBAAoB;IAuM5B;;;;;;OAMG;IACH,OAAO,CAAC,wBAAwB;IA8BhC;;;OAGG;IACH,OAAO,CAAC,wBAAwB;IA8BhC;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAW9B;;OAEG;IACH,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,oBAAoB;IAoH5B;;OAEG;IACH,OAAO,CAAC,YAAY;IASpB;;;OAGG;IACH,OAAO,CAAC,eAAe;IASvB;;;OAGG;IACH,OAAO,CAAC,sBAAsB;IAiB9B;;;OAGG;IACH,OAAO,CAAC,kBAAkB;CAmB3B"}