@clear-capabilities/agentic-security-scanner 0.118.2 → 0.119.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +256 -0
- package/bin/agentic-security.js +78 -1
- package/dist/178.index.js +1 -1
- package/dist/384.index.js +1 -1
- package/dist/415.index.js +90 -0
- package/dist/444.index.js +89 -0
- package/dist/503.index.js +288 -0
- package/dist/637.index.js +15 -1
- package/dist/838.index.js +1 -1
- package/dist/985.index.js +5 -1
- package/dist/agentic-security.mjs +18 -18
- package/dist/agentic-security.mjs.sha256 +1 -1
- package/package.json +13 -8
- package/src/dataflow/CLAUDE.md +1 -1
- package/src/dataflow/catalog.js +50 -11
- package/src/dataflow/engine.js +76 -1
- package/src/dataflow/implicit-flow.js +4 -2
- package/src/dataflow/index.js +9 -4
- package/src/dataflow/proof-gate.js +5 -0
- package/src/dataflow/summaries.js +19 -1
- package/src/engine.js +95 -7
- package/src/ir/parser-go.js +8 -0
- package/src/mcp/tools.js +6 -2
- package/src/posture/fix-history.js +24 -0
- package/src/posture/provenance.js +39 -0
- package/src/posture/sca-verdict.js +130 -0
- package/src/posture/secret-history.js +72 -0
- package/src/pr-delta.js +13 -0
- package/src/report/index.js +50 -0
- package/src/sast/agent-untrusted-flow.js +107 -0
- package/src/sast/api-authz.js +71 -0
- package/src/sast/cross-service.js +98 -0
- package/src/sast/event-entrypoint.js +90 -0
- package/src/sast/iac-terraform.js +107 -0
- package/src/sast/rbac-consistency.js +113 -0
- package/src/sast/wrong-context-sanitizer.js +55 -0
- package/src/sca/image-packages.js +74 -0
- package/src/sca/import-reachability.js +271 -0
- package/src/sca/install-script-analysis.js +82 -0
- package/bin/.agentic-security/findings.json +0 -1907
- package/bin/.agentic-security/last-scan.json +0 -1907
- package/bin/.agentic-security/last-scan.json.sig +0 -1
- package/bin/.agentic-security/scan-history.json +0 -166
- package/bin/.agentic-security/streak.json +0 -20
- package/src/.agentic-security/dpia.md +0 -26
- package/src/.agentic-security/findings.json +0 -117732
- package/src/.agentic-security/last-scan.json +0 -117732
- package/src/.agentic-security/last-scan.json.sig +0 -1
- package/src/.agentic-security/pqc-migration-plan.json +0 -80
- package/src/.agentic-security/pqc-migration-plan.md +0 -32
- package/src/.agentic-security/sbom-history/0775d96ba4cf814520d02760cfb3010760c7684f.json +0 -6
- package/src/.agentic-security/sbom-history/29300441d3460832137a8e51a92b74068cad2f15.json +0 -6
- package/src/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json +0 -6
- package/src/.agentic-security/sbom-history/3d96e2daec97e3226c9679bac6e64a89ca10bfe9.json +0 -6
- package/src/.agentic-security/sbom-history/5f0b136622fce09b469a1a6137c04d5b18652ea4.json +0 -6
- package/src/.agentic-security/sbom-history/64e30595d447b62344d0d9200760269df2095332.json +0 -6
- package/src/.agentic-security/sbom-history/71f3241902c9e7437764e3caa046ba8a3bcdd32a.json +0 -6
- package/src/.agentic-security/sbom-history/99c372cdc33ecc9dde92960b4ffadf7775860e61.json +0 -6
- package/src/.agentic-security/sbom-history/9c93b15e8cf3ff2ddb8cdae92371b82e178b463c.json +0 -6
- package/src/.agentic-security/sbom-history/a3544abf1863d71776b61302ca74d9ead2b26a9f.json +0 -6
- package/src/.agentic-security/sbom-history/dca15abdec43c508aa342db86dc5db8d7f01fbbe.json +0 -6
- package/src/.agentic-security/scan-history.json +0 -12946
- package/src/.agentic-security/streak.json +0 -21
- package/src/.agentic-security/threat-model.json +0 -3702
- package/src/.agentic-security/threat-model.md +0 -118
- package/src/dataflow/.agentic-security/dpia.md +0 -26
- package/src/dataflow/.agentic-security/findings.json +0 -6086
- package/src/dataflow/.agentic-security/last-scan.json +0 -6086
- package/src/dataflow/.agentic-security/last-scan.json.sig +0 -1
- package/src/dataflow/.agentic-security/sbom-history/15d7c4d20f9d968ebec29445c9e9b3fc6f74e6a1.json +0 -6
- package/src/dataflow/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json +0 -6
- package/src/dataflow/.agentic-security/sbom-history/73166872888d9ddcbe98645af818ecc7d8917b07.json +0 -6
- package/src/dataflow/.agentic-security/sbom-history/8869fe64035bec0152d92ece961e9369d8637076.json +0 -6
- package/src/dataflow/.agentic-security/sbom-history/9c93b15e8cf3ff2ddb8cdae92371b82e178b463c.json +0 -6
- package/src/dataflow/.agentic-security/sbom-history/b7ac2dada4a9216ccfe8969fc57f988c83f46975.json +0 -6
- package/src/dataflow/.agentic-security/scan-history.json +0 -250
- package/src/dataflow/.agentic-security/streak.json +0 -21
- package/src/dataflow/.agentic-security/threat-model.json +0 -161
- package/src/dataflow/.agentic-security/threat-model.md +0 -43
- package/src/ir/.agentic-security/dpia.md +0 -26
- package/src/ir/.agentic-security/exploit-bundles.json +0 -77
- package/src/ir/.agentic-security/findings.json +0 -4011
- package/src/ir/.agentic-security/last-scan.json +0 -4011
- package/src/ir/.agentic-security/last-scan.json.sig +0 -1
- package/src/ir/.agentic-security/sbom-history/73166872888d9ddcbe98645af818ecc7d8917b07.json +0 -6
- package/src/ir/.agentic-security/sbom-history/b5f468a158f6a145aedd8680841c106b9809f16b.json +0 -6
- package/src/ir/.agentic-security/scan-history.json +0 -193
- package/src/ir/.agentic-security/streak.json +0 -20
- package/src/ir/.agentic-security/threat-model.json +0 -143
- package/src/ir/.agentic-security/threat-model.md +0 -39
- package/src/mcp/.agentic-security/findings.json +0 -8632
- package/src/mcp/.agentic-security/last-scan.json +0 -8632
- package/src/mcp/.agentic-security/last-scan.json.sig +0 -1
- package/src/mcp/.agentic-security/scan-history.json +0 -331
- package/src/mcp/.agentic-security/streak.json +0 -20
- package/src/posture/.agentic-security/dpia.md +0 -26
- package/src/posture/.agentic-security/findings.json +0 -77181
- package/src/posture/.agentic-security/last-scan.json +0 -77181
- package/src/posture/.agentic-security/last-scan.json.sig +0 -1
- package/src/posture/.agentic-security/pqc-migration-plan.json +0 -65
- package/src/posture/.agentic-security/pqc-migration-plan.md +0 -30
- package/src/posture/.agentic-security/sbom-history/0724c133d2943c87555695b5b2adcfcfc3373a2d.json +0 -6
- package/src/posture/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json +0 -6
- package/src/posture/.agentic-security/sbom-history/99c372cdc33ecc9dde92960b4ffadf7775860e61.json +0 -6
- package/src/posture/.agentic-security/sbom-history/b7ac2dada4a9216ccfe8969fc57f988c83f46975.json +0 -6
- package/src/posture/.agentic-security/scan-history.json +0 -8904
- package/src/posture/.agentic-security/streak.json +0 -21
- package/src/posture/.agentic-security/threat-model.json +0 -2038
- package/src/posture/.agentic-security/threat-model.md +0 -73
- package/src/posture/compliance-frameworks/.agentic-security/findings.json +0 -80
- package/src/posture/compliance-frameworks/.agentic-security/last-scan.json +0 -80
- package/src/posture/compliance-frameworks/.agentic-security/last-scan.json.sig +0 -1
- package/src/posture/compliance-frameworks/.agentic-security/scan-history.json +0 -90
- package/src/posture/compliance-frameworks/.agentic-security/streak.json +0 -22
- package/src/report/.agentic-security/dpia.md +0 -26
- package/src/report/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json +0 -6
- package/src/report/.agentic-security/sbom-history/f94be839aa6a1011f53da016416a561698b8f338.json +0 -6
- package/src/report/.agentic-security/threat-model.json +0 -7
- package/src/report/.agentic-security/threat-model.md +0 -22
- package/src/sast/.agentic-security/dpia.md +0 -26
- package/src/sast/.agentic-security/findings.json +0 -6154
- package/src/sast/.agentic-security/last-scan.json +0 -6154
- package/src/sast/.agentic-security/last-scan.json.sig +0 -1
- package/src/sast/.agentic-security/pqc-migration-plan.json +0 -65
- package/src/sast/.agentic-security/pqc-migration-plan.md +0 -30
- package/src/sast/.agentic-security/sbom-history/043a7b401c68f5a298c83d4c42e94f118ff2a89a.json +0 -6
- package/src/sast/.agentic-security/sbom-history/0775d96ba4cf814520d02760cfb3010760c7684f.json +0 -6
- package/src/sast/.agentic-security/sbom-history/20d77ad7363a82777d506dedbbb1ecfed52f094a.json +0 -6
- package/src/sast/.agentic-security/sbom-history/29300441d3460832137a8e51a92b74068cad2f15.json +0 -6
- package/src/sast/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json +0 -6
- package/src/sast/.agentic-security/sbom-history/3c6b3205f04e26f7654943d465281d00e0fa395e.json +0 -6
- package/src/sast/.agentic-security/sbom-history/3d96e2daec97e3226c9679bac6e64a89ca10bfe9.json +0 -6
- package/src/sast/.agentic-security/sbom-history/5282502e090013219eb006f7e02d8c983bc29c8e.json +0 -6
- package/src/sast/.agentic-security/sbom-history/5f0b136622fce09b469a1a6137c04d5b18652ea4.json +0 -6
- package/src/sast/.agentic-security/sbom-history/64e30595d447b62344d0d9200760269df2095332.json +0 -6
- package/src/sast/.agentic-security/sbom-history/71f3241902c9e7437764e3caa046ba8a3bcdd32a.json +0 -6
- package/src/sast/.agentic-security/sbom-history/73514b485d4770f3c5ee57d87338bccd1c61d8b7.json +0 -6
- package/src/sast/.agentic-security/sbom-history/96fa584fc3134512237d58aac63d6f3778b0cbcb.json +0 -6
- package/src/sast/.agentic-security/sbom-history/99c372cdc33ecc9dde92960b4ffadf7775860e61.json +0 -6
- package/src/sast/.agentic-security/sbom-history/a3544abf1863d71776b61302ca74d9ead2b26a9f.json +0 -6
- package/src/sast/.agentic-security/sbom-history/a4a34ab8b3d758de2adc8c3dc3e42d4cb0db00a3.json +0 -6
- package/src/sast/.agentic-security/sbom-history/ac236ec3602cfc8fb133f389ec3687e409084673.json +0 -6
- package/src/sast/.agentic-security/sbom-history/b57b3e1292f1f9f0de6c5a34a436e330c78008a3.json +0 -6
- package/src/sast/.agentic-security/sbom-history/dca15abdec43c508aa342db86dc5db8d7f01fbbe.json +0 -6
- package/src/sast/.agentic-security/sbom-history/dcbfd4935922dd165093c08a1003c338eed937c5.json +0 -6
- package/src/sast/.agentic-security/sbom-history/fa017f725615b0293814344c8ef7dfeb06775ca0.json +0 -6
- package/src/sast/.agentic-security/scan-history.json +0 -941
- package/src/sast/.agentic-security/streak.json +0 -22
- package/src/sast/.agentic-security/threat-model.json +0 -816
- package/src/sast/.agentic-security/threat-model.md +0 -91
- package/src/sca/.agentic-security/findings.json +0 -7460
- package/src/sca/.agentic-security/last-scan.json +0 -7460
- package/src/sca/.agentic-security/last-scan.json.sig +0 -1
- package/src/sca/.agentic-security/scan-history.json +0 -113
- package/src/sca/.agentic-security/streak.json +0 -21
|
@@ -1 +0,0 @@
|
|
|
1
|
-
5bb921912d508574fede241a7e16cd7ac261f415b200e9eff04093fa70426dd1
|
|
@@ -1,166 +0,0 @@
|
|
|
1
|
-
[
|
|
2
|
-
{
|
|
3
|
-
"timestamp": "2026-05-26T04:00:10.464Z",
|
|
4
|
-
"label": "scan",
|
|
5
|
-
"total": 4,
|
|
6
|
-
"critical": 0,
|
|
7
|
-
"high": 0,
|
|
8
|
-
"medium": 4,
|
|
9
|
-
"low": 0,
|
|
10
|
-
"kev": 0,
|
|
11
|
-
"ids": [
|
|
12
|
-
"toctou-fs:agentic-security-audit.js:55",
|
|
13
|
-
"toctou-fs:agentic-security-consistency.js:44",
|
|
14
|
-
"toctou-fs:agentic-security-consistency.js:66",
|
|
15
|
-
"toctou-fs:agentic-security.js:1108"
|
|
16
|
-
]
|
|
17
|
-
},
|
|
18
|
-
{
|
|
19
|
-
"timestamp": "2026-05-26T04:00:56.905Z",
|
|
20
|
-
"label": "scan",
|
|
21
|
-
"total": 4,
|
|
22
|
-
"critical": 0,
|
|
23
|
-
"high": 0,
|
|
24
|
-
"medium": 4,
|
|
25
|
-
"low": 0,
|
|
26
|
-
"kev": 0,
|
|
27
|
-
"ids": [
|
|
28
|
-
"toctou-fs:agentic-security-audit.js:55",
|
|
29
|
-
"toctou-fs:agentic-security-consistency.js:44",
|
|
30
|
-
"toctou-fs:agentic-security-consistency.js:66",
|
|
31
|
-
"toctou-fs:agentic-security.js:1108"
|
|
32
|
-
]
|
|
33
|
-
},
|
|
34
|
-
{
|
|
35
|
-
"timestamp": "2026-05-26T04:02:41.681Z",
|
|
36
|
-
"label": "scan",
|
|
37
|
-
"total": 4,
|
|
38
|
-
"critical": 0,
|
|
39
|
-
"high": 0,
|
|
40
|
-
"medium": 4,
|
|
41
|
-
"low": 0,
|
|
42
|
-
"kev": 0,
|
|
43
|
-
"ids": [
|
|
44
|
-
"toctou-fs:agentic-security-audit.js:55",
|
|
45
|
-
"toctou-fs:agentic-security-consistency.js:44",
|
|
46
|
-
"toctou-fs:agentic-security-consistency.js:66",
|
|
47
|
-
"toctou-fs:agentic-security.js:1108"
|
|
48
|
-
]
|
|
49
|
-
},
|
|
50
|
-
{
|
|
51
|
-
"timestamp": "2026-05-27T01:03:34.318Z",
|
|
52
|
-
"label": "scan",
|
|
53
|
-
"total": 4,
|
|
54
|
-
"critical": 0,
|
|
55
|
-
"high": 0,
|
|
56
|
-
"medium": 4,
|
|
57
|
-
"low": 0,
|
|
58
|
-
"kev": 0,
|
|
59
|
-
"ids": [
|
|
60
|
-
"toctou-fs:agentic-security-audit.js:55",
|
|
61
|
-
"toctou-fs:agentic-security-consistency.js:44",
|
|
62
|
-
"toctou-fs:agentic-security-consistency.js:66",
|
|
63
|
-
"toctou-fs:agentic-security.js:1109"
|
|
64
|
-
]
|
|
65
|
-
},
|
|
66
|
-
{
|
|
67
|
-
"timestamp": "2026-05-27T01:05:45.968Z",
|
|
68
|
-
"label": "scan",
|
|
69
|
-
"total": 4,
|
|
70
|
-
"critical": 0,
|
|
71
|
-
"high": 0,
|
|
72
|
-
"medium": 4,
|
|
73
|
-
"low": 0,
|
|
74
|
-
"kev": 0,
|
|
75
|
-
"ids": [
|
|
76
|
-
"toctou-fs:agentic-security-audit.js:55",
|
|
77
|
-
"toctou-fs:agentic-security-consistency.js:44",
|
|
78
|
-
"toctou-fs:agentic-security-consistency.js:66",
|
|
79
|
-
"toctou-fs:agentic-security.js:1114"
|
|
80
|
-
]
|
|
81
|
-
},
|
|
82
|
-
{
|
|
83
|
-
"timestamp": "2026-05-27T11:21:25.101Z",
|
|
84
|
-
"label": "scan",
|
|
85
|
-
"total": 4,
|
|
86
|
-
"critical": 0,
|
|
87
|
-
"high": 0,
|
|
88
|
-
"medium": 4,
|
|
89
|
-
"low": 0,
|
|
90
|
-
"kev": 0,
|
|
91
|
-
"ids": [
|
|
92
|
-
"toctou-fs:agentic-security-audit.js:55",
|
|
93
|
-
"toctou-fs:agentic-security-consistency.js:44",
|
|
94
|
-
"toctou-fs:agentic-security-consistency.js:66",
|
|
95
|
-
"toctou-fs:agentic-security.js:1116"
|
|
96
|
-
]
|
|
97
|
-
},
|
|
98
|
-
{
|
|
99
|
-
"timestamp": "2026-05-27T11:23:11.242Z",
|
|
100
|
-
"label": "scan",
|
|
101
|
-
"total": 5,
|
|
102
|
-
"critical": 0,
|
|
103
|
-
"high": 0,
|
|
104
|
-
"medium": 5,
|
|
105
|
-
"low": 0,
|
|
106
|
-
"kev": 0,
|
|
107
|
-
"ids": [
|
|
108
|
-
"toctou-fs:agentic-security-audit.js:55",
|
|
109
|
-
"toctou-fs:agentic-security-consistency.js:44",
|
|
110
|
-
"toctou-fs:agentic-security-consistency.js:66",
|
|
111
|
-
"toctou-fs:agentic-security.js:1136",
|
|
112
|
-
"toctou-fs:agentic-security.js:362"
|
|
113
|
-
]
|
|
114
|
-
},
|
|
115
|
-
{
|
|
116
|
-
"timestamp": "2026-05-28T14:13:54.951Z",
|
|
117
|
-
"label": "scan",
|
|
118
|
-
"total": 5,
|
|
119
|
-
"critical": 0,
|
|
120
|
-
"high": 0,
|
|
121
|
-
"medium": 5,
|
|
122
|
-
"low": 0,
|
|
123
|
-
"kev": 0,
|
|
124
|
-
"ids": [
|
|
125
|
-
"toctou-fs:agentic-security-audit.js:55",
|
|
126
|
-
"toctou-fs:agentic-security-consistency.js:44",
|
|
127
|
-
"toctou-fs:agentic-security-consistency.js:66",
|
|
128
|
-
"toctou-fs:agentic-security.js:1141",
|
|
129
|
-
"toctou-fs:agentic-security.js:362"
|
|
130
|
-
]
|
|
131
|
-
},
|
|
132
|
-
{
|
|
133
|
-
"timestamp": "2026-05-28T14:16:39.437Z",
|
|
134
|
-
"label": "scan",
|
|
135
|
-
"total": 5,
|
|
136
|
-
"critical": 0,
|
|
137
|
-
"high": 0,
|
|
138
|
-
"medium": 5,
|
|
139
|
-
"low": 0,
|
|
140
|
-
"kev": 0,
|
|
141
|
-
"ids": [
|
|
142
|
-
"toctou-fs:agentic-security-audit.js:55",
|
|
143
|
-
"toctou-fs:agentic-security-consistency.js:44",
|
|
144
|
-
"toctou-fs:agentic-security-consistency.js:66",
|
|
145
|
-
"toctou-fs:agentic-security.js:1146",
|
|
146
|
-
"toctou-fs:agentic-security.js:367"
|
|
147
|
-
]
|
|
148
|
-
},
|
|
149
|
-
{
|
|
150
|
-
"timestamp": "2026-05-28T14:16:53.162Z",
|
|
151
|
-
"label": "scan",
|
|
152
|
-
"total": 5,
|
|
153
|
-
"critical": 0,
|
|
154
|
-
"high": 0,
|
|
155
|
-
"medium": 5,
|
|
156
|
-
"low": 0,
|
|
157
|
-
"kev": 0,
|
|
158
|
-
"ids": [
|
|
159
|
-
"toctou-fs:agentic-security-audit.js:55",
|
|
160
|
-
"toctou-fs:agentic-security-consistency.js:44",
|
|
161
|
-
"toctou-fs:agentic-security-consistency.js:66",
|
|
162
|
-
"toctou-fs:agentic-security.js:1151",
|
|
163
|
-
"toctou-fs:agentic-security.js:367"
|
|
164
|
-
]
|
|
165
|
-
}
|
|
166
|
-
]
|
|
@@ -1,20 +0,0 @@
|
|
|
1
|
-
{
|
|
2
|
-
"firstScanDate": "2026-05-26T04:00:10.482Z",
|
|
3
|
-
"lastScanDate": "2026-05-28T14:16:53.192Z",
|
|
4
|
-
"totalScans": 10,
|
|
5
|
-
"daysCleanCritical": 3,
|
|
6
|
-
"lastCleanDate": "2026-05-28",
|
|
7
|
-
"lastCriticalDate": null,
|
|
8
|
-
"hasEverHadCritical": false,
|
|
9
|
-
"bestDaysCleanCritical": 3,
|
|
10
|
-
"totalFindingsAtFirstScan": 11,
|
|
11
|
-
"totalFindingsAtLastScan": 13,
|
|
12
|
-
"totalFixesInferred": 0,
|
|
13
|
-
"lastGrade": "A-",
|
|
14
|
-
"bestGrade": "A-",
|
|
15
|
-
"launchCheckPassedAt": null,
|
|
16
|
-
"achievements": [
|
|
17
|
-
"first-scan"
|
|
18
|
-
],
|
|
19
|
-
"previousGrade": "A-"
|
|
20
|
-
}
|
|
@@ -1,26 +0,0 @@
|
|
|
1
|
-
# Data Protection Impact Assessment (DPIA)
|
|
2
|
-
|
|
3
|
-
Generated by agentic-security scanner on 2026-06-01.
|
|
4
|
-
|
|
5
|
-
This is an automated DPIA scaffold derived from static analysis.
|
|
6
|
-
It must be reviewed and completed by a privacy officer before use.
|
|
7
|
-
|
|
8
|
-
## Data classes identified
|
|
9
|
-
|
|
10
|
-
## Privacy-related findings
|
|
11
|
-
|
|
12
|
-
| Severity | File:Line | Class → Sink | Description |
|
|
13
|
-
|---|---|---|---|
|
|
14
|
-
|
|
15
|
-
## Regulatory framework mapping
|
|
16
|
-
|
|
17
|
-
- **GDPR Art. 35** — DPIA required when processing is likely to result in high risk to data subjects.
|
|
18
|
-
- **CCPA §1798.130** — Notice + access rights for collected personal information.
|
|
19
|
-
|
|
20
|
-
## Reviewer checklist
|
|
21
|
-
|
|
22
|
-
- [ ] Confirm each PII field's collection has a documented lawful basis
|
|
23
|
-
- [ ] Confirm retention period for each class is documented
|
|
24
|
-
- [ ] Confirm DSAR (data subject access request) workflow exists
|
|
25
|
-
- [ ] Confirm encryption at rest + in transit for each class
|
|
26
|
-
- [ ] Confirm logging of PII access for audit (where applicable)
|