@clear-capabilities/agentic-security-scanner 0.118.2 → 0.119.2

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (155) hide show
  1. package/CHANGELOG.md +274 -0
  2. package/bin/agentic-security.js +78 -1
  3. package/dist/178.index.js +1 -1
  4. package/dist/384.index.js +1 -1
  5. package/dist/415.index.js +90 -0
  6. package/dist/444.index.js +89 -0
  7. package/dist/503.index.js +288 -0
  8. package/dist/637.index.js +15 -1
  9. package/dist/838.index.js +1 -1
  10. package/dist/985.index.js +5 -1
  11. package/dist/agentic-security.mjs +18 -18
  12. package/dist/agentic-security.mjs.sha256 +1 -1
  13. package/package.json +13 -8
  14. package/src/dataflow/CLAUDE.md +1 -1
  15. package/src/dataflow/catalog.js +50 -11
  16. package/src/dataflow/engine.js +76 -1
  17. package/src/dataflow/implicit-flow.js +4 -2
  18. package/src/dataflow/index.js +9 -4
  19. package/src/dataflow/proof-gate.js +5 -0
  20. package/src/dataflow/summaries.js +19 -1
  21. package/src/engine.js +95 -7
  22. package/src/ir/parser-go.js +8 -0
  23. package/src/mcp/tools.js +6 -2
  24. package/src/posture/fix-history.js +24 -0
  25. package/src/posture/provenance.js +39 -0
  26. package/src/posture/sca-verdict.js +130 -0
  27. package/src/posture/secret-history.js +72 -0
  28. package/src/pr-delta.js +13 -0
  29. package/src/report/index.js +50 -0
  30. package/src/sast/agent-untrusted-flow.js +107 -0
  31. package/src/sast/api-authz.js +71 -0
  32. package/src/sast/cross-service.js +98 -0
  33. package/src/sast/event-entrypoint.js +90 -0
  34. package/src/sast/iac-terraform.js +107 -0
  35. package/src/sast/rbac-consistency.js +113 -0
  36. package/src/sast/wrong-context-sanitizer.js +55 -0
  37. package/src/sca/image-packages.js +74 -0
  38. package/src/sca/import-reachability.js +271 -0
  39. package/src/sca/install-script-analysis.js +82 -0
  40. package/bin/.agentic-security/findings.json +0 -1907
  41. package/bin/.agentic-security/last-scan.json +0 -1907
  42. package/bin/.agentic-security/last-scan.json.sig +0 -1
  43. package/bin/.agentic-security/scan-history.json +0 -166
  44. package/bin/.agentic-security/streak.json +0 -20
  45. package/src/.agentic-security/dpia.md +0 -26
  46. package/src/.agentic-security/findings.json +0 -117732
  47. package/src/.agentic-security/last-scan.json +0 -117732
  48. package/src/.agentic-security/last-scan.json.sig +0 -1
  49. package/src/.agentic-security/pqc-migration-plan.json +0 -80
  50. package/src/.agentic-security/pqc-migration-plan.md +0 -32
  51. package/src/.agentic-security/sbom-history/0775d96ba4cf814520d02760cfb3010760c7684f.json +0 -6
  52. package/src/.agentic-security/sbom-history/29300441d3460832137a8e51a92b74068cad2f15.json +0 -6
  53. package/src/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json +0 -6
  54. package/src/.agentic-security/sbom-history/3d96e2daec97e3226c9679bac6e64a89ca10bfe9.json +0 -6
  55. package/src/.agentic-security/sbom-history/5f0b136622fce09b469a1a6137c04d5b18652ea4.json +0 -6
  56. package/src/.agentic-security/sbom-history/64e30595d447b62344d0d9200760269df2095332.json +0 -6
  57. package/src/.agentic-security/sbom-history/71f3241902c9e7437764e3caa046ba8a3bcdd32a.json +0 -6
  58. package/src/.agentic-security/sbom-history/99c372cdc33ecc9dde92960b4ffadf7775860e61.json +0 -6
  59. package/src/.agentic-security/sbom-history/9c93b15e8cf3ff2ddb8cdae92371b82e178b463c.json +0 -6
  60. package/src/.agentic-security/sbom-history/a3544abf1863d71776b61302ca74d9ead2b26a9f.json +0 -6
  61. package/src/.agentic-security/sbom-history/dca15abdec43c508aa342db86dc5db8d7f01fbbe.json +0 -6
  62. package/src/.agentic-security/scan-history.json +0 -12946
  63. package/src/.agentic-security/streak.json +0 -21
  64. package/src/.agentic-security/threat-model.json +0 -3702
  65. package/src/.agentic-security/threat-model.md +0 -118
  66. package/src/dataflow/.agentic-security/dpia.md +0 -26
  67. package/src/dataflow/.agentic-security/findings.json +0 -6086
  68. package/src/dataflow/.agentic-security/last-scan.json +0 -6086
  69. package/src/dataflow/.agentic-security/last-scan.json.sig +0 -1
  70. package/src/dataflow/.agentic-security/sbom-history/15d7c4d20f9d968ebec29445c9e9b3fc6f74e6a1.json +0 -6
  71. package/src/dataflow/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json +0 -6
  72. package/src/dataflow/.agentic-security/sbom-history/73166872888d9ddcbe98645af818ecc7d8917b07.json +0 -6
  73. package/src/dataflow/.agentic-security/sbom-history/8869fe64035bec0152d92ece961e9369d8637076.json +0 -6
  74. package/src/dataflow/.agentic-security/sbom-history/9c93b15e8cf3ff2ddb8cdae92371b82e178b463c.json +0 -6
  75. package/src/dataflow/.agentic-security/sbom-history/b7ac2dada4a9216ccfe8969fc57f988c83f46975.json +0 -6
  76. package/src/dataflow/.agentic-security/scan-history.json +0 -250
  77. package/src/dataflow/.agentic-security/streak.json +0 -21
  78. package/src/dataflow/.agentic-security/threat-model.json +0 -161
  79. package/src/dataflow/.agentic-security/threat-model.md +0 -43
  80. package/src/ir/.agentic-security/dpia.md +0 -26
  81. package/src/ir/.agentic-security/exploit-bundles.json +0 -77
  82. package/src/ir/.agentic-security/findings.json +0 -4011
  83. package/src/ir/.agentic-security/last-scan.json +0 -4011
  84. package/src/ir/.agentic-security/last-scan.json.sig +0 -1
  85. package/src/ir/.agentic-security/sbom-history/73166872888d9ddcbe98645af818ecc7d8917b07.json +0 -6
  86. package/src/ir/.agentic-security/sbom-history/b5f468a158f6a145aedd8680841c106b9809f16b.json +0 -6
  87. package/src/ir/.agentic-security/scan-history.json +0 -193
  88. package/src/ir/.agentic-security/streak.json +0 -20
  89. package/src/ir/.agentic-security/threat-model.json +0 -143
  90. package/src/ir/.agentic-security/threat-model.md +0 -39
  91. package/src/mcp/.agentic-security/findings.json +0 -8632
  92. package/src/mcp/.agentic-security/last-scan.json +0 -8632
  93. package/src/mcp/.agentic-security/last-scan.json.sig +0 -1
  94. package/src/mcp/.agentic-security/scan-history.json +0 -331
  95. package/src/mcp/.agentic-security/streak.json +0 -20
  96. package/src/posture/.agentic-security/dpia.md +0 -26
  97. package/src/posture/.agentic-security/findings.json +0 -77181
  98. package/src/posture/.agentic-security/last-scan.json +0 -77181
  99. package/src/posture/.agentic-security/last-scan.json.sig +0 -1
  100. package/src/posture/.agentic-security/pqc-migration-plan.json +0 -65
  101. package/src/posture/.agentic-security/pqc-migration-plan.md +0 -30
  102. package/src/posture/.agentic-security/sbom-history/0724c133d2943c87555695b5b2adcfcfc3373a2d.json +0 -6
  103. package/src/posture/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json +0 -6
  104. package/src/posture/.agentic-security/sbom-history/99c372cdc33ecc9dde92960b4ffadf7775860e61.json +0 -6
  105. package/src/posture/.agentic-security/sbom-history/b7ac2dada4a9216ccfe8969fc57f988c83f46975.json +0 -6
  106. package/src/posture/.agentic-security/scan-history.json +0 -8904
  107. package/src/posture/.agentic-security/streak.json +0 -21
  108. package/src/posture/.agentic-security/threat-model.json +0 -2038
  109. package/src/posture/.agentic-security/threat-model.md +0 -73
  110. package/src/posture/compliance-frameworks/.agentic-security/findings.json +0 -80
  111. package/src/posture/compliance-frameworks/.agentic-security/last-scan.json +0 -80
  112. package/src/posture/compliance-frameworks/.agentic-security/last-scan.json.sig +0 -1
  113. package/src/posture/compliance-frameworks/.agentic-security/scan-history.json +0 -90
  114. package/src/posture/compliance-frameworks/.agentic-security/streak.json +0 -22
  115. package/src/report/.agentic-security/dpia.md +0 -26
  116. package/src/report/.agentic-security/sbom-history/7d45b5e03804aac084b4a2b4dc8c6f10107d2005.json +0 -6
  117. package/src/report/.agentic-security/sbom-history/f94be839aa6a1011f53da016416a561698b8f338.json +0 -6
  118. package/src/report/.agentic-security/threat-model.json +0 -7
  119. package/src/report/.agentic-security/threat-model.md +0 -22
  120. package/src/sast/.agentic-security/dpia.md +0 -26
  121. package/src/sast/.agentic-security/findings.json +0 -6154
  122. package/src/sast/.agentic-security/last-scan.json +0 -6154
  123. package/src/sast/.agentic-security/last-scan.json.sig +0 -1
  124. package/src/sast/.agentic-security/pqc-migration-plan.json +0 -65
  125. package/src/sast/.agentic-security/pqc-migration-plan.md +0 -30
  126. package/src/sast/.agentic-security/sbom-history/043a7b401c68f5a298c83d4c42e94f118ff2a89a.json +0 -6
  127. package/src/sast/.agentic-security/sbom-history/0775d96ba4cf814520d02760cfb3010760c7684f.json +0 -6
  128. package/src/sast/.agentic-security/sbom-history/20d77ad7363a82777d506dedbbb1ecfed52f094a.json +0 -6
  129. package/src/sast/.agentic-security/sbom-history/29300441d3460832137a8e51a92b74068cad2f15.json +0 -6
  130. package/src/sast/.agentic-security/sbom-history/3852ad2aa0e50951bed0c930c29d1861aa13d048.json +0 -6
  131. package/src/sast/.agentic-security/sbom-history/3c6b3205f04e26f7654943d465281d00e0fa395e.json +0 -6
  132. package/src/sast/.agentic-security/sbom-history/3d96e2daec97e3226c9679bac6e64a89ca10bfe9.json +0 -6
  133. package/src/sast/.agentic-security/sbom-history/5282502e090013219eb006f7e02d8c983bc29c8e.json +0 -6
  134. package/src/sast/.agentic-security/sbom-history/5f0b136622fce09b469a1a6137c04d5b18652ea4.json +0 -6
  135. package/src/sast/.agentic-security/sbom-history/64e30595d447b62344d0d9200760269df2095332.json +0 -6
  136. package/src/sast/.agentic-security/sbom-history/71f3241902c9e7437764e3caa046ba8a3bcdd32a.json +0 -6
  137. package/src/sast/.agentic-security/sbom-history/73514b485d4770f3c5ee57d87338bccd1c61d8b7.json +0 -6
  138. package/src/sast/.agentic-security/sbom-history/96fa584fc3134512237d58aac63d6f3778b0cbcb.json +0 -6
  139. package/src/sast/.agentic-security/sbom-history/99c372cdc33ecc9dde92960b4ffadf7775860e61.json +0 -6
  140. package/src/sast/.agentic-security/sbom-history/a3544abf1863d71776b61302ca74d9ead2b26a9f.json +0 -6
  141. package/src/sast/.agentic-security/sbom-history/a4a34ab8b3d758de2adc8c3dc3e42d4cb0db00a3.json +0 -6
  142. package/src/sast/.agentic-security/sbom-history/ac236ec3602cfc8fb133f389ec3687e409084673.json +0 -6
  143. package/src/sast/.agentic-security/sbom-history/b57b3e1292f1f9f0de6c5a34a436e330c78008a3.json +0 -6
  144. package/src/sast/.agentic-security/sbom-history/dca15abdec43c508aa342db86dc5db8d7f01fbbe.json +0 -6
  145. package/src/sast/.agentic-security/sbom-history/dcbfd4935922dd165093c08a1003c338eed937c5.json +0 -6
  146. package/src/sast/.agentic-security/sbom-history/fa017f725615b0293814344c8ef7dfeb06775ca0.json +0 -6
  147. package/src/sast/.agentic-security/scan-history.json +0 -941
  148. package/src/sast/.agentic-security/streak.json +0 -22
  149. package/src/sast/.agentic-security/threat-model.json +0 -816
  150. package/src/sast/.agentic-security/threat-model.md +0 -91
  151. package/src/sca/.agentic-security/findings.json +0 -7460
  152. package/src/sca/.agentic-security/last-scan.json +0 -7460
  153. package/src/sca/.agentic-security/last-scan.json.sig +0 -1
  154. package/src/sca/.agentic-security/scan-history.json +0 -113
  155. package/src/sca/.agentic-security/streak.json +0 -21
@@ -1 +0,0 @@
1
- 5bb921912d508574fede241a7e16cd7ac261f415b200e9eff04093fa70426dd1
@@ -1,166 +0,0 @@
1
- [
2
- {
3
- "timestamp": "2026-05-26T04:00:10.464Z",
4
- "label": "scan",
5
- "total": 4,
6
- "critical": 0,
7
- "high": 0,
8
- "medium": 4,
9
- "low": 0,
10
- "kev": 0,
11
- "ids": [
12
- "toctou-fs:agentic-security-audit.js:55",
13
- "toctou-fs:agentic-security-consistency.js:44",
14
- "toctou-fs:agentic-security-consistency.js:66",
15
- "toctou-fs:agentic-security.js:1108"
16
- ]
17
- },
18
- {
19
- "timestamp": "2026-05-26T04:00:56.905Z",
20
- "label": "scan",
21
- "total": 4,
22
- "critical": 0,
23
- "high": 0,
24
- "medium": 4,
25
- "low": 0,
26
- "kev": 0,
27
- "ids": [
28
- "toctou-fs:agentic-security-audit.js:55",
29
- "toctou-fs:agentic-security-consistency.js:44",
30
- "toctou-fs:agentic-security-consistency.js:66",
31
- "toctou-fs:agentic-security.js:1108"
32
- ]
33
- },
34
- {
35
- "timestamp": "2026-05-26T04:02:41.681Z",
36
- "label": "scan",
37
- "total": 4,
38
- "critical": 0,
39
- "high": 0,
40
- "medium": 4,
41
- "low": 0,
42
- "kev": 0,
43
- "ids": [
44
- "toctou-fs:agentic-security-audit.js:55",
45
- "toctou-fs:agentic-security-consistency.js:44",
46
- "toctou-fs:agentic-security-consistency.js:66",
47
- "toctou-fs:agentic-security.js:1108"
48
- ]
49
- },
50
- {
51
- "timestamp": "2026-05-27T01:03:34.318Z",
52
- "label": "scan",
53
- "total": 4,
54
- "critical": 0,
55
- "high": 0,
56
- "medium": 4,
57
- "low": 0,
58
- "kev": 0,
59
- "ids": [
60
- "toctou-fs:agentic-security-audit.js:55",
61
- "toctou-fs:agentic-security-consistency.js:44",
62
- "toctou-fs:agentic-security-consistency.js:66",
63
- "toctou-fs:agentic-security.js:1109"
64
- ]
65
- },
66
- {
67
- "timestamp": "2026-05-27T01:05:45.968Z",
68
- "label": "scan",
69
- "total": 4,
70
- "critical": 0,
71
- "high": 0,
72
- "medium": 4,
73
- "low": 0,
74
- "kev": 0,
75
- "ids": [
76
- "toctou-fs:agentic-security-audit.js:55",
77
- "toctou-fs:agentic-security-consistency.js:44",
78
- "toctou-fs:agentic-security-consistency.js:66",
79
- "toctou-fs:agentic-security.js:1114"
80
- ]
81
- },
82
- {
83
- "timestamp": "2026-05-27T11:21:25.101Z",
84
- "label": "scan",
85
- "total": 4,
86
- "critical": 0,
87
- "high": 0,
88
- "medium": 4,
89
- "low": 0,
90
- "kev": 0,
91
- "ids": [
92
- "toctou-fs:agentic-security-audit.js:55",
93
- "toctou-fs:agentic-security-consistency.js:44",
94
- "toctou-fs:agentic-security-consistency.js:66",
95
- "toctou-fs:agentic-security.js:1116"
96
- ]
97
- },
98
- {
99
- "timestamp": "2026-05-27T11:23:11.242Z",
100
- "label": "scan",
101
- "total": 5,
102
- "critical": 0,
103
- "high": 0,
104
- "medium": 5,
105
- "low": 0,
106
- "kev": 0,
107
- "ids": [
108
- "toctou-fs:agentic-security-audit.js:55",
109
- "toctou-fs:agentic-security-consistency.js:44",
110
- "toctou-fs:agentic-security-consistency.js:66",
111
- "toctou-fs:agentic-security.js:1136",
112
- "toctou-fs:agentic-security.js:362"
113
- ]
114
- },
115
- {
116
- "timestamp": "2026-05-28T14:13:54.951Z",
117
- "label": "scan",
118
- "total": 5,
119
- "critical": 0,
120
- "high": 0,
121
- "medium": 5,
122
- "low": 0,
123
- "kev": 0,
124
- "ids": [
125
- "toctou-fs:agentic-security-audit.js:55",
126
- "toctou-fs:agentic-security-consistency.js:44",
127
- "toctou-fs:agentic-security-consistency.js:66",
128
- "toctou-fs:agentic-security.js:1141",
129
- "toctou-fs:agentic-security.js:362"
130
- ]
131
- },
132
- {
133
- "timestamp": "2026-05-28T14:16:39.437Z",
134
- "label": "scan",
135
- "total": 5,
136
- "critical": 0,
137
- "high": 0,
138
- "medium": 5,
139
- "low": 0,
140
- "kev": 0,
141
- "ids": [
142
- "toctou-fs:agentic-security-audit.js:55",
143
- "toctou-fs:agentic-security-consistency.js:44",
144
- "toctou-fs:agentic-security-consistency.js:66",
145
- "toctou-fs:agentic-security.js:1146",
146
- "toctou-fs:agentic-security.js:367"
147
- ]
148
- },
149
- {
150
- "timestamp": "2026-05-28T14:16:53.162Z",
151
- "label": "scan",
152
- "total": 5,
153
- "critical": 0,
154
- "high": 0,
155
- "medium": 5,
156
- "low": 0,
157
- "kev": 0,
158
- "ids": [
159
- "toctou-fs:agentic-security-audit.js:55",
160
- "toctou-fs:agentic-security-consistency.js:44",
161
- "toctou-fs:agentic-security-consistency.js:66",
162
- "toctou-fs:agentic-security.js:1151",
163
- "toctou-fs:agentic-security.js:367"
164
- ]
165
- }
166
- ]
@@ -1,20 +0,0 @@
1
- {
2
- "firstScanDate": "2026-05-26T04:00:10.482Z",
3
- "lastScanDate": "2026-05-28T14:16:53.192Z",
4
- "totalScans": 10,
5
- "daysCleanCritical": 3,
6
- "lastCleanDate": "2026-05-28",
7
- "lastCriticalDate": null,
8
- "hasEverHadCritical": false,
9
- "bestDaysCleanCritical": 3,
10
- "totalFindingsAtFirstScan": 11,
11
- "totalFindingsAtLastScan": 13,
12
- "totalFixesInferred": 0,
13
- "lastGrade": "A-",
14
- "bestGrade": "A-",
15
- "launchCheckPassedAt": null,
16
- "achievements": [
17
- "first-scan"
18
- ],
19
- "previousGrade": "A-"
20
- }
@@ -1,26 +0,0 @@
1
- # Data Protection Impact Assessment (DPIA)
2
-
3
- Generated by agentic-security scanner on 2026-06-01.
4
-
5
- This is an automated DPIA scaffold derived from static analysis.
6
- It must be reviewed and completed by a privacy officer before use.
7
-
8
- ## Data classes identified
9
-
10
- ## Privacy-related findings
11
-
12
- | Severity | File:Line | Class → Sink | Description |
13
- |---|---|---|---|
14
-
15
- ## Regulatory framework mapping
16
-
17
- - **GDPR Art. 35** — DPIA required when processing is likely to result in high risk to data subjects.
18
- - **CCPA §1798.130** — Notice + access rights for collected personal information.
19
-
20
- ## Reviewer checklist
21
-
22
- - [ ] Confirm each PII field's collection has a documented lawful basis
23
- - [ ] Confirm retention period for each class is documented
24
- - [ ] Confirm DSAR (data subject access request) workflow exists
25
- - [ ] Confirm encryption at rest + in transit for each class
26
- - [ ] Confirm logging of PII access for audit (where applicable)