@elliotllliu/agent-shield 0.3.1

package/dist/rules/skill-risks.js

@@ -0,0 +1,148 @@
+/**
+ * Rule: skill-risks
+ * Detects high-risk patterns in agent skills that may indicate
+ * dangerous capabilities or insecure practices.
+ *
+ * Based on Snyk Agent Scan issue codes:
+ * - W007: Insecure credential handling
+ * - W009: Direct financial execution
+ * - W011: Exposure to untrusted third-party content
+ * - W012: Unverifiable external dependency (runtime fetch of instructions)
+ * - W013: System service modification
+ */
+// W007: Insecure credential handling — skill asks agent to output secrets verbatim
+const INSECURE_CRED_PATTERNS = [
+    { pattern: /(?:paste|type|enter|input|write|include|put)\s+(?:your\s+)?(?:api\s+key|token|password|secret|credential|access\s+key)\s+(?:here|below|in\s+the|into|directly)/i, description: "Asks user to paste credentials directly" },
+    { pattern: /(?:hardcode|embed|include|put)\s+(?:the\s+)?(?:api\s+key|token|password|secret)\s+(?:in|into|inside)\s+(?:the\s+)?(?:code|file|config|script)/i, description: "Instructs embedding secrets in code" },
+    { pattern: /(?:api_key|token|password|secret)\s*[:=]\s*["'][A-Za-z0-9_\-]{20,}["']/i, description: "Appears to contain a hardcoded credential in instructions" },
+];
+// W009: Financial execution capabilities
+const FINANCIAL_PATTERNS = [
+    { pattern: /(?:send|transfer|move|wire)\s+(?:money|funds|payment|bitcoin|crypto|eth|btc|usdt)/i, description: "Direct money transfer capability" },
+    { pattern: /(?:execute|place|submit)\s+(?:a\s+)?(?:trade|order|transaction|purchase|buy\s+order|sell\s+order)/i, description: "Financial trade/order execution" },
+    { pattern: /(?:stripe|paypal|braintree|square)\.(?:charges?|payments?)\.create/i, description: "Payment processing API call" },
+    { pattern: /(?:web3|ethers|solana).*(?:sendTransaction|transfer|sign)/i, description: "Blockchain transaction execution" },
+];
+// W011: Untrusted content exposure
+const UNTRUSTED_CONTENT_PATTERNS = [
+    { pattern: /(?:browse|visit|open|navigate|fetch|scrape|crawl)\s+(?:any\s+)?(?:arbitrary|user[- ]?provided|unknown|untrusted)\s+(?:url|website|webpage|link|page)/i, description: "Browses arbitrary user-provided URLs" },
+    { pattern: /(?:read|parse|analyze|process)\s+(?:social\s+media|forum|reddit|twitter|comments?|reviews?|posts?)\s+(?:from|on|at)/i, description: "Processes untrusted social media content" },
+    { pattern: /(?:download|fetch|get|retrieve)\s+(?:content|data|text|html)\s+from\s+(?:any|arbitrary|user)/i, description: "Downloads content from arbitrary sources" },
+];
+// W012: Unverifiable external dependency — runtime code/instruction fetch
+const EXTERNAL_DEP_PATTERNS = [
+    { pattern: /(?:fetch|download|pull|get)\s+(?:the\s+)?(?:latest|updated?|current)\s+(?:instructions?|prompts?|config|rules?|script)\s+from\s+/i, description: "Fetches instructions from external URL at runtime" },
+    { pattern: /(?:auto[- ]?update|self[- ]?update|live[- ]?reload)\s+(?:from|via|using)\s+/i, description: "Auto-update mechanism from external source" },
+    { pattern: /(?:eval|exec|execute|run)\s*\(\s*(?:await\s+)?(?:fetch|axios|got|request)\s*\(/i, description: "Fetches and executes remote code" },
+    { pattern: /(?:import|require|load)\s*\(\s*(?:['"`]https?:\/\/|url|endpoint)/i, description: "Dynamic import from remote URL" },
+];
+// W013: System service modification
+const SYSTEM_MOD_PATTERNS = [
+    { pattern: /(?:sudo|doas|runas)\s+/i, description: "Elevated privilege execution" },
+    { pattern: /(?:systemctl|service|launchctl|sc\.exe)\s+(?:start|stop|enable|disable|restart|create)/i, description: "System service management" },
+    { pattern: /(?:crontab|schtasks|at\s+\d|launchd)\s+/i, description: "Scheduled task creation" },
+    { pattern: /(?:chmod\s+[0-7]*[1-7][0-7]*|chown\s+root|setuid|setgid)/i, description: "Permission/ownership modification" },
+    { pattern: /(?:\/etc\/(?:passwd|shadow|sudoers|crontab|hosts|resolv|fstab|profile|rc\.local))/i, description: "Modifies critical system configuration files" },
+    { pattern: /(?:iptables|ufw|firewalld|netsh\s+firewall)\s+/i, description: "Firewall rule modification" },
+    { pattern: /(?:~\/\.bashrc|~\/\.zshrc|~\/\.profile|~\/\.bash_profile|\/etc\/environment)\b/i, description: "Shell profile/environment modification" },
+];
+export const skillRisks = {
+    id: "skill-risks",
+    name: "Skill Risk Assessment",
+    description: "Detects high-risk capabilities in skills: financial ops, untrusted content, external deps, system modification",
+    run(files) {
+        const findings = [];
+        for (const file of files) {
+            const isSkillMd = file.relativePath.toLowerCase().includes("skill.md");
+            const isMarkdown = file.ext === ".md";
+            const isCode = [".ts", ".js", ".py", ".sh", ".bash"].includes(file.ext);
+            const isConfig = [".json", ".yaml", ".yml"].includes(file.ext);
+            if (!isMarkdown && !isCode && !isConfig)
+                continue;
+            for (let i = 0; i < file.lines.length; i++) {
+                const line = file.lines[i];
+                const trimmed = line.trimStart();
+                if (trimmed.startsWith("//") || trimmed.startsWith("#") && !trimmed.startsWith("#!"))
+                    continue;
+                // W007: Insecure credential handling (in markdown/docs)
+                if (isMarkdown) {
+                    for (const { pattern, description } of INSECURE_CRED_PATTERNS) {
+                        if (pattern.test(line)) {
+                            findings.push({
+                                rule: "skill-risks",
+                                severity: "warning",
+                                file: file.relativePath,
+                                line: i + 1,
+                                message: `Insecure credential handling: ${description}`,
+                                evidence: line.trim().substring(0, 120),
+                            });
+                            break;
+                        }
+                    }
+                }
+                // W009: Financial execution
+                for (const { pattern, description } of FINANCIAL_PATTERNS) {
+                    if (pattern.test(line)) {
+                        findings.push({
+                            rule: "skill-risks",
+                            severity: "warning",
+                            file: file.relativePath,
+                            line: i + 1,
+                            message: `Financial execution: ${description}`,
+                            evidence: line.trim().substring(0, 120),
+                        });
+                        break;
+                    }
+                }
+                // W011: Untrusted content (primarily in SKILL.md)
+                if (isSkillMd || isMarkdown) {
+                    for (const { pattern, description } of UNTRUSTED_CONTENT_PATTERNS) {
+                        if (pattern.test(line)) {
+                            findings.push({
+                                rule: "skill-risks",
+                                severity: "warning",
+                                file: file.relativePath,
+                                line: i + 1,
+                                message: `Untrusted content exposure: ${description}`,
+                                evidence: line.trim().substring(0, 120),
+                            });
+                            break;
+                        }
+                    }
+                }
+                // W012: External dependency
+                if (isCode || isMarkdown) {
+                    for (const { pattern, description } of EXTERNAL_DEP_PATTERNS) {
+                        if (pattern.test(line)) {
+                            findings.push({
+                                rule: "skill-risks",
+                                severity: isCode ? "critical" : "warning",
+                                file: file.relativePath,
+                                line: i + 1,
+                                message: `Unverifiable external dependency: ${description}`,
+                                evidence: line.trim().substring(0, 120),
+                            });
+                            break;
+                        }
+                    }
+                }
+                // W013: System modification
+                for (const { pattern, description } of SYSTEM_MOD_PATTERNS) {
+                    if (pattern.test(line)) {
+                        findings.push({
+                            rule: "skill-risks",
+                            severity: isSkillMd ? "warning" : "info",
+                            file: file.relativePath,
+                            line: i + 1,
+                            message: `System modification: ${description}`,
+                            evidence: line.trim().substring(0, 120),
+                        });
+                        break;
+                    }
+                }
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=skill-risks.js.map

package/dist/rules/skill-risks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-risks.js","sourceRoot":"","sources":["../../src/rules/skill-risks.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;GAWG;AAEH,mFAAmF;AACnF,MAAM,sBAAsB,GAAoD;IAC9E,EAAE,OAAO,EAAE,iKAAiK,EAAE,WAAW,EAAE,yCAAyC,EAAE;IACtO,EAAE,OAAO,EAAE,gJAAgJ,EAAE,WAAW,EAAE,qCAAqC,EAAE;IACjN,EAAE,OAAO,EAAE,yEAAyE,EAAE,WAAW,EAAE,2DAA2D,EAAE;CACjK,CAAC;AAEF,yCAAyC;AACzC,MAAM,kBAAkB,GAAoD;IAC1E,EAAE,OAAO,EAAE,oFAAoF,EAAE,WAAW,EAAE,kCAAkC,EAAE;IAClJ,EAAE,OAAO,EAAE,oGAAoG,EAAE,WAAW,EAAE,iCAAiC,EAAE;IACjK,EAAE,OAAO,EAAE,qEAAqE,EAAE,WAAW,EAAE,6BAA6B,EAAE;IAC9H,EAAE,OAAO,EAAE,4DAA4D,EAAE,WAAW,EAAE,kCAAkC,EAAE;CAC3H,CAAC;AAEF,mCAAmC;AACnC,MAAM,0BAA0B,GAAoD;IAClF,EAAE,OAAO,EAAE,uJAAuJ,EAAE,WAAW,EAAE,sCAAsC,EAAE;IACzN,EAAE,OAAO,EAAE,sHAAsH,EAAE,WAAW,EAAE,0CAA0C,EAAE;IAC5L,EAAE,OAAO,EAAE,+FAA+F,EAAE,WAAW,EAAE,0CAA0C,EAAE;CACtK,CAAC;AAEF,0EAA0E;AAC1E,MAAM,qBAAqB,GAAoD;IAC7E,EAAE,OAAO,EAAE,mIAAmI,EAAE,WAAW,EAAE,mDAAmD,EAAE;IAClN,EAAE,OAAO,EAAE,8EAA8E,EAAE,WAAW,EAAE,4CAA4C,EAAE;IACtJ,EAAE,OAAO,EAAE,iFAAiF,EAAE,WAAW,EAAE,kCAAkC,EAAE;IAC/I,EAAE,OAAO,EAAE,mEAAmE,EAAE,WAAW,EAAE,gCAAgC,EAAE;CAChI,CAAC;AAEF,oCAAoC;AACpC,MAAM,mBAAmB,GAAoD;IAC3E,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,8BAA8B,EAAE;IACnF,EAAE,OAAO,EAAE,yFAAyF,EAAE,WAAW,EAAE,2BAA2B,EAAE;IAChJ,EAAE,OAAO,EAAE,0CAA0C,EAAE,WAAW,EAAE,yBAAyB,EAAE;IAC/F,EAAE,OAAO,EAAE,2DAA2D,EAAE,WAAW,EAAE,mCAAmC,EAAE;IAC1H,EAAE,OAAO,EAAE,oFAAoF,EAAE,WAAW,EAAE,8CAA8C,EAAE;IAC9J,EAAE,OAAO,EAAE,iDAAiD,EAAE,WAAW,EAAE,4BAA4B,EAAE;IACzG,EAAE,OAAO,EAAE,iFAAiF,EAAE,WAAW,EAAE,wCAAwC,EAAE;CACtJ,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAS;IAC9B,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,uBAAuB;IAC7B,WAAW,EAAE,gHAAgH;IAE7H,GAAG,CAAC,KAAoB;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;YACvE,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,KAAK,KAAK,CAAC;YACtC,MAAM,MAAM,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACxE,MAAM,QAAQ,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAE/D,IAAI,CAAC,UAAU,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;gBAAE,SAAS;YAElD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;gBAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjC,IAAI,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAE/F,wDAAwD;gBACxD,IAAI,UAAU,EAAE,CAAC;oBACf,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,sBAAsB,EAAE,CAAC;wBAC9D,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BACvB,QAAQ,CAAC,IAAI,CAAC;gCACZ,IAAI,EAAE,aAAa;gCACnB,QAAQ,EAAE,SAAS;gCACnB,IAAI,EAAE,IAAI,CAAC,YAAY;gCACvB,IAAI,EAAE,CAAC,GAAG,CAAC;gCACX,OAAO,EAAE,iCAAiC,WAAW,EAAE;gCACvD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;6BACxC,CAAC,CAAC;4BACH,MAAM;wBACR,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,4BAA4B;gBAC5B,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,kBAAkB,EAAE,CAAC;oBAC1D,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvB,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,aAAa;4BACnB,QAAQ,EAAE,SAAS;4BACnB,IAAI,EAAE,IAAI,CAAC,YAAY;4BACvB,IAAI,EAAE,CAAC,GAAG,CAAC;4BACX,OAAO,EAAE,wBAAwB,WAAW,EAAE;4BAC9C,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;yBACxC,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;gBACH,CAAC;gBAED,kDAAkD;gBAClD,IAAI,SAAS,IAAI,UAAU,EAAE,CAAC;oBAC5B,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,0BAA0B,EAAE,CAAC;wBAClE,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BACvB,QAAQ,CAAC,IAAI,CAAC;gCACZ,IAAI,EAAE,aAAa;gCACnB,QAAQ,EAAE,SAAS;gCACnB,IAAI,EAAE,IAAI,CAAC,YAAY;gCACvB,IAAI,EAAE,CAAC,GAAG,CAAC;gCACX,OAAO,EAAE,+BAA+B,WAAW,EAAE;gCACrD,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;6BACxC,CAAC,CAAC;4BACH,MAAM;wBACR,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,4BAA4B;gBAC5B,IAAI,MAAM,IAAI,UAAU,EAAE,CAAC;oBACzB,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,qBAAqB,EAAE,CAAC;wBAC7D,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BACvB,QAAQ,CAAC,IAAI,CAAC;gCACZ,IAAI,EAAE,aAAa;gCACnB,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS;gCACzC,IAAI,EAAE,IAAI,CAAC,YAAY;gCACvB,IAAI,EAAE,CAAC,GAAG,CAAC;gCACX,OAAO,EAAE,qCAAqC,WAAW,EAAE;gCAC3D,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;6BACxC,CAAC,CAAC;4BACH,MAAM;wBACR,CAAC;oBACH,CAAC;gBACH,CAAC;gBAED,4BAA4B;gBAC5B,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,mBAAmB,EAAE,CAAC;oBAC3D,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;wBACvB,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,aAAa;4BACnB,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;4BACxC,IAAI,EAAE,IAAI,CAAC,YAAY;4BACvB,IAAI,EAAE,CAAC,GAAG,CAAC;4BACX,OAAO,EAAE,wBAAwB,WAAW,EAAE;4BAC9C,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;yBACxC,CAAC,CAAC;wBACH,MAAM;oBACR,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/rules/supply-chain.d.ts

@@ -0,0 +1,6 @@
+import type { Rule } from "../types.js";
+/**
+ * Rule: supply-chain
+ * Runs npm audit to detect known CVEs in dependencies.
+ */
+export declare const supplyChainRule: Rule;

package/dist/rules/supply-chain.js

@@ -0,0 +1,105 @@
+import { execSync } from "child_process";
+import { existsSync } from "fs";
+import { join } from "path";
+/**
+ * Rule: supply-chain
+ * Runs npm audit to detect known CVEs in dependencies.
+ */
+export const supplyChainRule = {
+    id: "supply-chain",
+    name: "Supply Chain Audit",
+    description: "Checks for known CVEs in npm/pip dependencies",
+    run(files) {
+        const findings = [];
+        // Determine the target directory from the first file
+        if (files.length === 0)
+            return findings;
+        const targetDir = files[0].path.replace(files[0].relativePath, "").replace(/\/$/, "");
+        // Check for package.json
+        const pkgJsonPath = join(targetDir, "package.json");
+        const hasNodeModules = existsSync(join(targetDir, "node_modules"));
+        const hasPkgJson = existsSync(pkgJsonPath);
+        const hasLockFile = existsSync(join(targetDir, "package-lock.json")) ||
+            existsSync(join(targetDir, "yarn.lock")) ||
+            existsSync(join(targetDir, "pnpm-lock.yaml"));
+        if (hasPkgJson && (hasNodeModules || hasLockFile)) {
+            try {
+                // npm audit returns exit code > 0 when vulnerabilities are found
+                const result = execSync("npm audit --json 2>/dev/null", {
+                    cwd: targetDir,
+                    encoding: "utf-8",
+                    timeout: 30000,
+                    stdio: ["pipe", "pipe", "pipe"],
+                });
+                parseNpmAudit(result, findings);
+            }
+            catch (err) {
+                // npm audit exits non-zero when vulns are found
+                if (err && typeof err === "object" && "stdout" in err) {
+                    parseNpmAudit(err.stdout, findings);
+                }
+            }
+        }
+        else if (hasPkgJson) {
+            // Has package.json but no lock file — check deps manually
+            try {
+                const pkgContent = files.find((f) => f.relativePath === "package.json");
+                if (pkgContent) {
+                    const pkg = JSON.parse(pkgContent.content);
+                    const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+                    const depCount = Object.keys(deps).length;
+                    if (depCount > 0) {
+                        findings.push({
+                            rule: "supply-chain",
+                            severity: "info",
+                            file: "package.json",
+                            message: `${depCount} dependencies declared — run 'npm install && npm audit' for full CVE check`,
+                        });
+                    }
+                }
+            }
+            catch {
+                // ignore parse errors
+            }
+        }
+        // Check for requirements.txt (Python)
+        const reqTxt = files.find((f) => f.relativePath === "requirements.txt" || f.relativePath.endsWith("/requirements.txt"));
+        if (reqTxt) {
+            findings.push({
+                rule: "supply-chain",
+                severity: "info",
+                file: reqTxt.relativePath,
+                message: "Python requirements.txt found — run 'pip-audit' for CVE check",
+            });
+        }
+        return findings;
+    },
+};
+function parseNpmAudit(output, findings) {
+    try {
+        const audit = JSON.parse(output);
+        if (audit.vulnerabilities) {
+            for (const [name, vuln] of Object.entries(audit.vulnerabilities)) {
+                const severity = vuln.severity || "moderate";
+                const via = Array.isArray(vuln.via) ? vuln.via : [];
+                const cves = via
+                    .filter((v) => typeof v === "object" && v !== null && "url" in v)
+                    .map((v) => String(v.url))
+                    .join(", ");
+                const mappedSeverity = severity === "critical" || severity === "high" ? "critical" :
+                    severity === "moderate" ? "warning" : "info";
+                findings.push({
+                    rule: "supply-chain",
+                    severity: mappedSeverity,
+                    file: "package.json",
+                    message: `${name} — ${severity} severity${cves ? ` (${cves})` : ""}`,
+                    evidence: typeof vuln.range === "string" ? `affected: ${vuln.range}` : undefined,
+                });
+            }
+        }
+    }
+    catch {
+        // unparseable output
+    }
+}
+//# sourceMappingURL=supply-chain.js.map

package/dist/rules/supply-chain.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"supply-chain.js","sourceRoot":"","sources":["../../src/rules/supply-chain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B;;;GAGG;AAEH,MAAM,CAAC,MAAM,eAAe,GAAS;IACnC,EAAE,EAAE,cAAc;IAClB,IAAI,EAAE,oBAAoB;IAC1B,WAAW,EAAE,+CAA+C;IAE5D,GAAG,CAAC,KAAoB;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,qDAAqD;QACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAExC,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,YAAY,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QAExF,yBAAyB;QACzB,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QACpD,MAAM,cAAc,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC,CAAC;QACnE,MAAM,UAAU,GAAG,UAAU,CAAC,WAAW,CAAC,CAAC;QAC3C,MAAM,WAAW,GACf,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,mBAAmB,CAAC,CAAC;YAChD,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACxC,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAEhD,IAAI,UAAU,IAAI,CAAC,cAAc,IAAI,WAAW,CAAC,EAAE,CAAC;YAClD,IAAI,CAAC;gBACH,iEAAiE;gBACjE,MAAM,MAAM,GAAG,QAAQ,CAAC,8BAA8B,EAAE;oBACtD,GAAG,EAAE,SAAS;oBACd,QAAQ,EAAE,OAAO;oBACjB,OAAO,EAAE,KAAK;oBACd,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC;iBAChC,CAAC,CAAC;gBACH,aAAa,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;YAClC,CAAC;YAAC,OAAO,GAAY,EAAE,CAAC;gBACtB,gDAAgD;gBAChD,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,QAAQ,IAAI,GAAG,EAAE,CAAC;oBACtD,aAAa,CAAE,GAA0B,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC9D,CAAC;YACH,CAAC;QACH,CAAC;aAAM,IAAI,UAAU,EAAE,CAAC;YACtB,0DAA0D;YAC1D,IAAI,CAAC;gBACH,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,cAAc,CAAC,CAAC;gBACxE,IAAI,UAAU,EAAE,CAAC;oBACf,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;oBAC3C,MAAM,IAAI,GAAG,EAAE,GAAG,GAAG,CAAC,YAAY,EAAE,GAAG,GAAG,CAAC,eAAe,EAAE,CAAC;oBAC7D,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC;oBAC1C,IAAI,QAAQ,GAAG,CAAC,EAAE,CAAC;wBACjB,QAAQ,CAAC,IAAI,CAAC;4BACZ,IAAI,EAAE,cAAc;4BACpB,QAAQ,EAAE,MAAM;4BAChB,IAAI,EAAE,cAAc;4BACpB,OAAO,EAAE,GAAG,QAAQ,4EAA4E;yBACjG,CAAC,CAAC;oBACL,CAAC;gBACH,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,sBAAsB;YACxB,CAAC;QACH,CAAC;QAED,sCAAsC;QACtC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,KAAK,kBAAkB,IAAI,CAAC,CAAC,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAC7F,CAAC;QACF,IAAI,MAAM,EAAE,CAAC;YACX,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,cAAc;gBACpB,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,MAAM,CAAC,YAAY;gBACzB,OAAO,EAAE,+DAA+D;aACzE,CAAC,CAAC;QACL,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,SAAS,aAAa,CAAC,MAAc,EAAE,QAAmB;IACxD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAEjC,IAAI,KAAK,CAAC,eAAe,EAAE,CAAC;YAC1B,KAAK,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,MAAM,CAAC,OAAO,CAA0B,KAAK,CAAC,eAAe,CAAC,EAAE,CAAC;gBAC1F,MAAM,QAAQ,GAAI,IAAI,CAAC,QAAmB,IAAI,UAAU,CAAC;gBACzD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACpD,MAAM,IAAI,GAAG,GAAG;qBACb,MAAM,CAAC,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,KAAK,IAAI,CAAC,CAAC;qBACvG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;qBACzB,IAAI,CAAC,IAAI,CAAC,CAAC;gBAEd,MAAM,cAAc,GAClB,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;oBAC7D,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;gBAE/C,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,cAAc;oBACpB,QAAQ,EAAE,cAAc;oBACxB,IAAI,EAAE,cAAc;oBACpB,OAAO,EAAE,GAAG,IAAI,MAAM,QAAQ,YAAY,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;oBACpE,QAAQ,EAAE,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,SAAS;iBACjF,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;AACH,CAAC"}

package/dist/rules/tool-shadowing.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from "../types.js";
+export declare const toolShadowing: Rule;

package/dist/rules/tool-shadowing.js

@@ -0,0 +1,129 @@
+/**
+ * Rule: tool-shadowing
+ * Detects when a tool description references tools from other MCP servers,
+ * potentially hijacking or overriding their behavior.
+ * Also detects cross-server tool name conflicts from MCP config files.
+ */
+// Common MCP tool names that could be shadowed
+const WELL_KNOWN_TOOLS = [
+    "read_file", "write_file", "list_files", "search_files",
+    "execute_command", "run_terminal_command",
+    "browser_action", "web_search",
+    "create_file", "edit_file", "delete_file",
+    "git_commit", "git_push", "git_pull",
+    "send_message", "read_email",
+];
+// Patterns indicating cross-tool reference in descriptions
+const CROSS_TOOL_PATTERNS = [
+    { pattern: /(?:instead\s+of|replace|override|intercept|wrap)\s+(?:the\s+)?(?:original|default|built-in|other)\s+(?:tool|function|command)/i, description: "Claims to replace another tool" },
+    { pattern: /(?:call|use|invoke)\s+(?:this\s+tool\s+)?(?:instead\s+of|before|after)\s+["']?\w+["']?/i, description: "Redirects from another tool to this one" },
+    { pattern: /(?:this|my)\s+(?:version|implementation)\s+of\s+["']?\w+["']?\s+(?:is|should\s+be)/i, description: "Claims to be a version of another tool" },
+    { pattern: /(?:enhanced|improved|better|secure)\s+(?:version|replacement)\s+(?:of|for)\s+/i, description: "Claims to be an enhanced version" },
+    { pattern: /(?:whenever|every\s+time)\s+(?:you|the\s+agent)\s+(?:would\s+)?(?:use|call|invoke)\s+["']?\w+["']?,?\s+(?:use|call)\s+(?:this|me)/i, description: "Hijacks calls to another tool" },
+];
+export const toolShadowing = {
+    id: "tool-shadowing",
+    name: "Tool Shadowing Detection",
+    description: "Detects tools that attempt to shadow, override, or hijack other tools",
+    run(files) {
+        const findings = [];
+        // Collect tool names from MCP config files
+        const toolsByServer = new Map();
+        for (const file of files) {
+            // Check JSON config files for MCP tool definitions
+            if (file.ext === ".json") {
+                try {
+                    const config = JSON.parse(file.content);
+                    extractMcpTools(config, file.relativePath, toolsByServer);
+                }
+                catch {
+                    // Not valid JSON, skip
+                }
+            }
+            // Check tool descriptions for cross-tool reference patterns
+            if ([".json", ".md", ".yaml", ".yml", ".ts", ".js"].includes(file.ext)) {
+                for (let i = 0; i < file.lines.length; i++) {
+                    const line = file.lines[i];
+                    for (const { pattern, description } of CROSS_TOOL_PATTERNS) {
+                        pattern.lastIndex = 0;
+                        if (pattern.test(line)) {
+                            findings.push({
+                                rule: "tool-shadowing",
+                                severity: "critical",
+                                file: file.relativePath,
+                                line: i + 1,
+                                message: `Tool shadowing: ${description}`,
+                                evidence: line.trim().substring(0, 120),
+                            });
+                            break;
+                        }
+                    }
+                    // Check if description references well-known tool names
+                    const lineLower = line.toLowerCase();
+                    for (const toolName of WELL_KNOWN_TOOLS) {
+                        if (lineLower.includes(toolName) &&
+                            /(?:instead|replace|override|intercept|before|after|wrap)/i.test(line)) {
+                            findings.push({
+                                rule: "tool-shadowing",
+                                severity: "critical",
+                                file: file.relativePath,
+                                line: i + 1,
+                                message: `References well-known tool "${toolName}" with override intent`,
+                                evidence: line.trim().substring(0, 120),
+                            });
+                            break;
+                        }
+                    }
+                }
+            }
+        }
+        // Check for duplicate tool names across servers
+        const allToolNames = new Map(); // toolName -> [server1, server2]
+        for (const [serverName, { tools }] of toolsByServer) {
+            for (const tool of tools) {
+                if (!allToolNames.has(tool))
+                    allToolNames.set(tool, []);
+                allToolNames.get(tool).push(serverName);
+            }
+        }
+        for (const [toolName, servers] of allToolNames) {
+            if (servers.length > 1) {
+                findings.push({
+                    rule: "tool-shadowing",
+                    severity: "critical",
+                    file: servers[0],
+                    message: `Tool name conflict: "${toolName}" defined in ${servers.length} servers (${servers.join(", ")}) — potential tool shadowing attack`,
+                });
+            }
+        }
+        return findings;
+    },
+};
+function extractMcpTools(obj, filePath, result, serverName) {
+    if (!obj || typeof obj !== "object")
+        return;
+    const record = obj;
+    // Look for MCP server definitions with tools
+    if (record.tools && Array.isArray(record.tools)) {
+        const tools = record.tools
+            .map((t) => String(t.name || t.id || ""))
+            .filter(Boolean);
+        if (tools.length > 0) {
+            const name = serverName || filePath;
+            result.set(name, { tools, file: filePath });
+        }
+    }
+    // Recurse into mcpServers config
+    if (record.mcpServers && typeof record.mcpServers === "object") {
+        for (const [name, config] of Object.entries(record.mcpServers)) {
+            extractMcpTools(config, filePath, result, name);
+        }
+    }
+    // Recurse into servers
+    if (record.servers && typeof record.servers === "object") {
+        for (const [name, config] of Object.entries(record.servers)) {
+            extractMcpTools(config, filePath, result, name);
+        }
+    }
+}
+//# sourceMappingURL=tool-shadowing.js.map

package/dist/rules/tool-shadowing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-shadowing.js","sourceRoot":"","sources":["../../src/rules/tool-shadowing.ts"],"names":[],"mappings":"AAEA;;;;;GAKG;AAEH,+CAA+C;AAC/C,MAAM,gBAAgB,GAAG;IACvB,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,cAAc;IACvD,iBAAiB,EAAE,sBAAsB;IACzC,gBAAgB,EAAE,YAAY;IAC9B,aAAa,EAAE,WAAW,EAAE,aAAa;IACzC,YAAY,EAAE,UAAU,EAAE,UAAU;IACpC,cAAc,EAAE,YAAY;CAC7B,CAAC;AAEF,2DAA2D;AAC3D,MAAM,mBAAmB,GAAoD;IAC3E,EAAE,OAAO,EAAE,gIAAgI,EAAE,WAAW,EAAE,gCAAgC,EAAE;IAC5L,EAAE,OAAO,EAAE,yFAAyF,EAAE,WAAW,EAAE,yCAAyC,EAAE;IAC9J,EAAE,OAAO,EAAE,qFAAqF,EAAE,WAAW,EAAE,wCAAwC,EAAE;IACzJ,EAAE,OAAO,EAAE,gFAAgF,EAAE,WAAW,EAAE,kCAAkC,EAAE;IAC9I,EAAE,OAAO,EAAE,oIAAoI,EAAE,WAAW,EAAE,+BAA+B,EAAE;CAChM,CAAC;AAEF,MAAM,CAAC,MAAM,aAAa,GAAS;IACjC,EAAE,EAAE,gBAAgB;IACpB,IAAI,EAAE,0BAA0B;IAChC,WAAW,EAAE,uEAAuE;IAEpF,GAAG,CAAC,KAAoB;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAE/B,2CAA2C;QAC3C,MAAM,aAAa,GAAmD,IAAI,GAAG,EAAE,CAAC;QAEhF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,mDAAmD;YACnD,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO,EAAE,CAAC;gBACzB,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;oBACxC,eAAe,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,aAAa,CAAC,CAAC;gBAC5D,CAAC;gBAAC,MAAM,CAAC;oBACP,uBAAuB;gBACzB,CAAC;YACH,CAAC;YAED,4DAA4D;YAC5D,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACvE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC;oBAE5B,KAAK,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,IAAI,mBAAmB,EAAE,CAAC;wBAC3D,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;wBACtB,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;4BACvB,QAAQ,CAAC,IAAI,CAAC;gCACZ,IAAI,EAAE,gBAAgB;gCACtB,QAAQ,EAAE,UAAU;gCACpB,IAAI,EAAE,IAAI,CAAC,YAAY;gCACvB,IAAI,EAAE,CAAC,GAAG,CAAC;gCACX,OAAO,EAAE,mBAAmB,WAAW,EAAE;gCACzC,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;6BACxC,CAAC,CAAC;4BACH,MAAM;wBACR,CAAC;oBACH,CAAC;oBAED,wDAAwD;oBACxD,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;oBACrC,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;wBACxC,IACE,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC;4BAC5B,2DAA2D,CAAC,IAAI,CAAC,IAAI,CAAC,EACtE,CAAC;4BACD,QAAQ,CAAC,IAAI,CAAC;gCACZ,IAAI,EAAE,gBAAgB;gCACtB,QAAQ,EAAE,UAAU;gCACpB,IAAI,EAAE,IAAI,CAAC,YAAY;gCACvB,IAAI,EAAE,CAAC,GAAG,CAAC;gCACX,OAAO,EAAE,+BAA+B,QAAQ,wBAAwB;gCACxE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,GAAG,CAAC;6BACxC,CAAC,CAAC;4BACH,MAAM;wBACR,CAAC;oBACH,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;QAED,gDAAgD;QAChD,MAAM,YAAY,GAA0B,IAAI,GAAG,EAAE,CAAC,CAAC,iCAAiC;QACxF,KAAK,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,CAAC,IAAI,aAAa,EAAE,CAAC;YACpD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;gBACzB,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;oBAAE,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBACxD,YAAY,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAC3C,CAAC;QACH,CAAC;QAED,KAAK,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,YAAY,EAAE,CAAC;YAC/C,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvB,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,gBAAgB;oBACtB,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,OAAO,CAAC,CAAC,CAAE;oBACjB,OAAO,EAAE,wBAAwB,QAAQ,gBAAgB,OAAO,CAAC,MAAM,aAAa,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,qCAAqC;iBAC5I,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC;AAEF,SAAS,eAAe,CACtB,GAAY,EACZ,QAAgB,EAChB,MAAsD,EACtD,UAAmB;IAEnB,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO;IAE5C,MAAM,MAAM,GAAG,GAA8B,CAAC;IAE9C,6CAA6C;IAC7C,IAAI,MAAM,CAAC,KAAK,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QAChD,MAAM,KAAK,GAAI,MAAM,CAAC,KAAwC;aAC3D,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;aACxC,MAAM,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACrB,MAAM,IAAI,GAAG,UAAU,IAAI,QAAQ,CAAC;YACpC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC9C,CAAC;IACH,CAAC;IAED,iCAAiC;IACjC,IAAI,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC/D,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,UAAqC,CAAC,EAAE,CAAC;YAC1F,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;IAED,uBAAuB;IACvB,IAAI,MAAM,CAAC,OAAO,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzD,KAAK,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,OAAkC,CAAC,EAAE,CAAC;YACvF,eAAe,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC;QAClD,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/rules/toxic-flow.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from "../types.js";
+export declare const toxicFlow: Rule;

package/dist/rules/toxic-flow.js

@@ -0,0 +1,160 @@
+// Patterns for classifying tool capabilities
+const UNTRUSTED_INDICATORS = [
+    /(?:fetch|browse|scrape|crawl|read)[_\s]*(?:url|web|page|site|link)/i,
+    /(?:user[- ]?(?:provided|input|supplied)|external|third[- ]?party)/i,
+    /(?:search|query)\s+(?:the\s+)?(?:web|internet|google|bing)/i,
+    /(?:download|get)\s+(?:from|content)/i,
+    /(?:parse|read)\s+(?:email|message|comment|post|tweet|rss)/i,
+    /browse\s+(?:any|arbitrary)\s+(?:web|url|page|site)/i,
+];
+const PRIVATE_DATA_INDICATORS = [
+    /(?:read|access|get|list)\s*(?:file|directory|folder|document)/i,
+    /(?:database|db|sql|query|select)\s/i,
+    /(?:user\s+data|personal|private|confidential|sensitive)/i,
+    /(?:credential|password|secret|token|key)\s/i,
+    /(?:history|log|conversation|chat|message)/i,
+    /(?:config|setting|preference|profile)/i,
+];
+const PUBLIC_SINK_INDICATORS = [
+    /(?:send|post|publish|share|upload|transmit|forward)\s/i,
+    /(?:email|message|notification|webhook|api\s+call)/i,
+    /(?:slack|discord|telegram|whatsapp|twitter|github)/i,
+    /(?:http|https|request|fetch)\s*\(/i,
+    /(?:write|save|export)\s+(?:to\s+)?(?:external|remote|cloud)/i,
+];
+const DESTRUCTIVE_INDICATORS = [
+    /(?:delete|remove|drop|truncate|destroy|purge|wipe|erase)/i,
+    /(?:overwrite|replace|modify|update|alter)\s+(?:file|data|record|config)/i,
+    /(?:execute|run|exec|spawn|shell)\s+(?:command|script|process)/i,
+    /(?:format|reset|factory\s+reset|reinstall)/i,
+    /(?:revoke|disable|block|ban|suspend)/i,
+];
+function classifyTool(name, description, serverName) {
+    const cap = {
+        name,
+        server: serverName,
+        untrustedContent: false,
+        privateData: false,
+        publicSink: false,
+        destructive: false,
+        reasons: [],
+    };
+    const text = `${name} ${description}`.toLowerCase();
+    for (const re of UNTRUSTED_INDICATORS) {
+        if (re.test(text)) {
+            cap.untrustedContent = true;
+            cap.reasons.push("untrusted-content");
+            break;
+        }
+    }
+    for (const re of PRIVATE_DATA_INDICATORS) {
+        if (re.test(text)) {
+            cap.privateData = true;
+            cap.reasons.push("private-data");
+            break;
+        }
+    }
+    for (const re of PUBLIC_SINK_INDICATORS) {
+        if (re.test(text)) {
+            cap.publicSink = true;
+            cap.reasons.push("public-sink");
+            break;
+        }
+    }
+    for (const re of DESTRUCTIVE_INDICATORS) {
+        if (re.test(text)) {
+            cap.destructive = true;
+            cap.reasons.push("destructive");
+            break;
+        }
+    }
+    return cap;
+}
+/** Extract tools from MCP config JSON */
+function extractTools(config, filePath) {
+    const tools = [];
+    const servers = (config.mcpServers || config.servers || {});
+    for (const [serverName, serverConfig] of Object.entries(servers)) {
+        if (!serverConfig || typeof serverConfig !== "object")
+            continue;
+        const sc = serverConfig;
+        // Tools array
+        if (Array.isArray(sc.tools)) {
+            for (const tool of sc.tools) {
+                const name = String(tool.name || tool.id || "unknown");
+                const desc = String(tool.description || "");
+                tools.push(classifyTool(name, desc, serverName));
+            }
+        }
+        // If no tools array, classify the server itself by name/description
+        if (!sc.tools) {
+            const desc = String(sc.description || sc.command || "");
+            tools.push(classifyTool(serverName, desc, serverName));
+        }
+    }
+    return tools;
+}
+export const toxicFlow = {
+    id: "toxic-flow",
+    name: "Toxic Flow Detection",
+    description: "Detects dangerous tool combinations that enable cross-tool data exfiltration or destructive attacks",
+    run(files) {
+        const findings = [];
+        const allTools = [];
+        // Collect tools from all JSON config files
+        for (const file of files) {
+            if (file.ext !== ".json")
+                continue;
+            try {
+                const config = JSON.parse(file.content);
+                const tools = extractTools(config, file.relativePath);
+                allTools.push(...tools);
+            }
+            catch {
+                // Not valid JSON
+            }
+        }
+        if (allTools.length === 0)
+            return findings;
+        // TF001: Data Leak — untrusted content + private data + public sink
+        const hasUntrusted = allTools.filter(t => t.untrustedContent);
+        const hasPrivate = allTools.filter(t => t.privateData);
+        const hasSink = allTools.filter(t => t.publicSink);
+        if (hasUntrusted.length > 0 && hasPrivate.length > 0 && hasSink.length > 0) {
+            findings.push({
+                rule: "toxic-flow",
+                severity: "critical",
+                file: "MCP configuration",
+                message: `TF001 Data Leak: Tool combination enables data exfiltration — ` +
+                    `untrusted input (${hasUntrusted.map(t => t.name).join(", ")}) → ` +
+                    `private data (${hasPrivate.map(t => t.name).join(", ")}) → ` +
+                    `public sink (${hasSink.map(t => t.name).join(", ")})`,
+            });
+        }
+        // TF002: Destructive — untrusted content + destructive action
+        const hasDestructive = allTools.filter(t => t.destructive);
+        if (hasUntrusted.length > 0 && hasDestructive.length > 0) {
+            findings.push({
+                rule: "toxic-flow",
+                severity: "critical",
+                file: "MCP configuration",
+                message: `TF002 Destructive Flow: Untrusted content could trigger destructive actions — ` +
+                    `untrusted (${hasUntrusted.map(t => t.name).join(", ")}) → ` +
+                    `destructive (${hasDestructive.map(t => t.name).join(", ")})`,
+            });
+        }
+        // Single tool that combines multiple risky capabilities
+        for (const tool of allTools) {
+            if (tool.untrustedContent && tool.privateData && tool.publicSink) {
+                findings.push({
+                    rule: "toxic-flow",
+                    severity: "critical",
+                    file: "MCP configuration",
+                    message: `Single tool "${tool.name}" (${tool.server}) combines untrusted content, private data access, and public sink — high exfiltration risk`,
+                });
+            }
+        }
+        return findings;
+    },
+};
+//# sourceMappingURL=toxic-flow.js.map

package/dist/rules/toxic-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"toxic-flow.js","sourceRoot":"","sources":["../../src/rules/toxic-flow.ts"],"names":[],"mappings":"AAyBA,6CAA6C;AAC7C,MAAM,oBAAoB,GAAG;IAC3B,qEAAqE;IACrE,oEAAoE;IACpE,6DAA6D;IAC7D,sCAAsC;IACtC,4DAA4D;IAC5D,qDAAqD;CACtD,CAAC;AAEF,MAAM,uBAAuB,GAAG;IAC9B,gEAAgE;IAChE,qCAAqC;IACrC,0DAA0D;IAC1D,6CAA6C;IAC7C,4CAA4C;IAC5C,wCAAwC;CACzC,CAAC;AAEF,MAAM,sBAAsB,GAAG;IAC7B,wDAAwD;IACxD,oDAAoD;IACpD,qDAAqD;IACrD,oCAAoC;IACpC,8DAA8D;CAC/D,CAAC;AAEF,MAAM,sBAAsB,GAAG;IAC7B,2DAA2D;IAC3D,0EAA0E;IAC1E,gEAAgE;IAChE,6CAA6C;IAC7C,uCAAuC;CACxC,CAAC;AAEF,SAAS,YAAY,CAAC,IAAY,EAAE,WAAmB,EAAE,UAAkB;IACzE,MAAM,GAAG,GAAmB;QAC1B,IAAI;QACJ,MAAM,EAAE,UAAU;QAClB,gBAAgB,EAAE,KAAK;QACvB,WAAW,EAAE,KAAK;QAClB,UAAU,EAAE,KAAK;QACjB,WAAW,EAAE,KAAK;QAClB,OAAO,EAAE,EAAE;KACZ,CAAC;IAEF,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,WAAW,EAAE,CAAC,WAAW,EAAE,CAAC;IAEpD,KAAK,MAAM,EAAE,IAAI,oBAAoB,EAAE,CAAC;QACtC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,gBAAgB,GAAG,IAAI,CAAC;YAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;IACnG,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,uBAAuB,EAAE,CAAC;QACzC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC;YAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;IACzF,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;QACxC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,UAAU,GAAG,IAAI,CAAC;YAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;IACvF,CAAC;IACD,KAAK,MAAM,EAAE,IAAI,sBAAsB,EAAE,CAAC;QACxC,IAAI,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YAAC,GAAG,CAAC,WAAW,GAAG,IAAI,CAAC;YAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;YAAC,MAAM;QAAC,CAAC;IACxF,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yCAAyC;AACzC,SAAS,YAAY,CAAC,MAA+B,EAAE,QAAgB;IACrE,MAAM,KAAK,GAAqB,EAAE,CAAC;IAEnC,MAAM,OAAO,GAAG,CAAC,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,OAAO,IAAI,EAAE,CAA4B,CAAC;IACvF,KAAK,MAAM,CAAC,UAAU,EAAE,YAAY,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACjE,IAAI,CAAC,YAAY,IAAI,OAAO,YAAY,KAAK,QAAQ;YAAE,SAAS;QAChE,MAAM,EAAE,GAAG,YAAuC,CAAC;QAEnD,cAAc;QACd,IAAI,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5B,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,KAAuC,EAAE,CAAC;gBAC9D,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC,CAAC;gBACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;gBAC5C,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;YACnD,CAAC;QACH,CAAC;QAED,oEAAoE;QACpE,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,CAAC;YACd,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,WAAW,IAAI,EAAE,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC;YACxD,KAAK,CAAC,IAAI,CAAC,YAAY,CAAC,UAAU,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAS;IAC7B,EAAE,EAAE,YAAY;IAChB,IAAI,EAAE,sBAAsB;IAC5B,WAAW,EAAE,qGAAqG;IAElH,GAAG,CAAC,KAAoB;QACtB,MAAM,QAAQ,GAAc,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAqB,EAAE,CAAC;QAEtC,2CAA2C;QAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,IAAI,IAAI,CAAC,GAAG,KAAK,OAAO;gBAAE,SAAS;YACnC,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAA4B,CAAC;gBACnE,MAAM,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,CAAC,CAAC;gBACtD,QAAQ,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;YAC1B,CAAC;YAAC,MAAM,CAAC;gBACP,iBAAiB;YACnB,CAAC;QACH,CAAC;QAED,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QAE3C,oEAAoE;QACpE,MAAM,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC;QAC9D,MAAM,UAAU,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;QAEnD,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC3E,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,gEAAgE;oBACvE,oBAAoB,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAClE,iBAAiB,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAC7D,gBAAgB,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aACzD,CAAC,CAAC;QACL,CAAC;QAED,8DAA8D;QAC9D,MAAM,cAAc,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;QAE3D,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,QAAQ,CAAC,IAAI,CAAC;gBACZ,IAAI,EAAE,YAAY;gBAClB,QAAQ,EAAE,UAAU;gBACpB,IAAI,EAAE,mBAAmB;gBACzB,OAAO,EAAE,gFAAgF;oBACvF,cAAc,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM;oBAC5D,gBAAgB,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;aAChE,CAAC,CAAC;QACL,CAAC;QAED,wDAAwD;QACxD,KAAK,MAAM,IAAI,IAAI,QAAQ,EAAE,CAAC;YAC5B,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,EAAE,CAAC;gBACjE,QAAQ,CAAC,IAAI,CAAC;oBACZ,IAAI,EAAE,YAAY;oBAClB,QAAQ,EAAE,UAAU;oBACpB,IAAI,EAAE,mBAAmB;oBACzB,OAAO,EAAE,gBAAgB,IAAI,CAAC,IAAI,MAAM,IAAI,CAAC,MAAM,6FAA6F;iBACjJ,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC;CACF,CAAC"}

package/dist/rules/typosquatting.d.ts

@@ -0,0 +1,2 @@
+import type { Rule } from "../types.js";
+export declare const typosquattingRule: Rule;