@gendigital/sage-openclaw 0.9.0 → 0.11.0

package/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "sage-openclaw",
   "name": "Sage",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "description": "Safety for Agents — ADR layer that guards commands, files, and web requests",
   "skills": [
     "resources/skills/security-awareness"

package/package.json

@@ -1,9 +1,18 @@
 {
   "name": "@gendigital/sage-openclaw",
   "license": "Apache-2.0",
-  "version": "0.9.0",
+  "version": "0.11.0",
   "type": "module",
   "description": "Safety for Agents — ADR layer for OpenClaw",
+  "homepage": "https://github.com/gendigitalinc/sage",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/gendigitalinc/sage.git",
+    "directory": "packages/openclaw"
+  },
+  "bugs": {
+    "url": "https://github.com/gendigitalinc/sage/issues"
+  },
   "main": "./dist/index.cjs",
   "files": [
     "dist/**",
@@ -21,7 +30,8 @@
     "esbuild": "^0.25.0",
     "typescript": "^5.9.0",
     "vitest": "^4.0.0",
-    "@gendigital/sage-core": "0.9.0"
+    "@gendigital/sage-core": "0.11.0",
+    "@gendigital/sage-mcp": "0.11.0"
   },
   "openclaw": {
     "extensions": [
@@ -52,7 +62,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "pnpm -C ../core build && pnpm run clean && pnpm run sync:assets && node esbuild.config.js",
+    "build": "pnpm run clean && pnpm run sync:assets && node esbuild.config.js",
     "clean": "node ../../scripts/clean.mjs dist resources",
     "sync:assets": "node scripts/sync-assets.mjs",
     "test": "vitest run"

package/resources/skills/security-awareness/SKILL.md

@@ -62,7 +62,11 @@ On OpenCode, Sage relays flagged details through the conversation, making it sus
 
 ## False Positive Reporting
 
-If the user believes a Sage detection is incorrect (a wrong block, mistaken flag, or false alarm), you can report it using the MCP tools provided by Sage:
+If the user believes a Sage detection is incorrect (a wrong block, mistaken flag, or false alarm), you can report it using the MCP tools provided by Sage.
+
+**Platform availability:** The MCP tools are registered automatically on Claude Code, Cursor, and OpenCode. On VS Code, the user must start the MCP server first (`MCP: List Server` → `sage` → `Start server`). On OpenClaw, the user must add the Sage MCP server to their `mcp.servers` config manually (see the OpenClaw platform guide).
+
+With the server running:
 
 1. **`sage_list_audit_entries`** — Lists recent Sage audit log entries for the current conversation. Use this to find the `entry_id`s of the detections the user considers incorrect.
 2. **`sage_report_false_positive`** — Submits a false positive report to the Sage backend. Requires a `description` (what was wrongly detected) and `reasoning` (why it is a false positive). Optionally accepts `entry_ids` to scope the report to specific entries.

package/resources/threats/agent-layer.yaml

@@ -0,0 +1,186 @@
+# Agent-layer threat patterns for Sage
+#
+# Author: ATR (Agent Threat Rules) community contributors
+# Upstream: https://github.com/Agent-Threat-Rule/agent-threat-rules
+# Contributed per issue #30 + vaclavbelak's comment
+#   (https://github.com/gendigitalinc/sage/issues/30#issuecomment-4266904912)
+#
+# License: MIT
+#   Rules in this file are adapted from the ATR project
+#   (https://github.com/Agent-Threat-Rule/agent-threat-rules),
+#   Copyright (c) 2026 ATR Contributors, and are included in Sage
+#   under the ATR MIT license per explicit agreement in issue #30.
+#   Sage-specific modifications to each rule are noted in its comment block.
+#
+# What this file covers (gaps vs Sage's existing rules):
+#   MCP tool / response attacks CLT-MCP-004      (1 rule -- path traversal)
+#   Skill package compromise    CLT-SKL-001..008  (6 rules -- IDs 001,002,004,005,006,008; 003/007 dropped for FP risk)
+#   Context exfiltration        CLT-CTX-003       (1 rule -- PEM key leak)
+#   Supply chain                CLT-SUPPLY-002    (1 rule)
+#
+#   All prompt_injection rules have been moved to prompt-injection.yaml:
+#     CLT-PI-052 (IMPORTANT-tag shadowing, ex CLT-MCP-002)
+#     CLT-PI-091..093 (HTML-comment delivery, jailbreak persona, CJK pivot)
+#   Dropped: CLT-CTX-002 (instruction tampering) -- covered by CLT-PI-001..005
+#
+# Design notes:
+#   - All rules use `match_on: content` so they fire on Write/Edit content,
+#     plugin/skill file scans, and any agent integration that passes a
+#     `content` artifact. They complement (do not duplicate) Sage's existing
+#     command/URL/credential-file rules.
+#   - Confidence values are calibrated to Sage's policy zones (docs/decision-pipeline.md):
+#     0.95 = attack-only signal, deny under all sensitivities
+#     0.85 = high-precision attack pattern, deny paranoid/balanced, ask relaxed
+#   - `case_insensitive: true` replaces ATR's `(?i)` inline flag.
+
+# ===========================================================================
+# MCP TOOL & RESPONSE POISONING
+# ===========================================================================
+
+- id: "CLT-MCP-004"
+  category: mcp_poisoning
+  severity: warning
+  confidence: 0.85
+  pattern: "\\.\\.[\\/\\\\](?:\\.\\.[\\/\\\\])+(?:etc|proc|root|sys|boot|passwd|shadow|shadow\\.bak|master\\.key)(?:[\\/\\\\]|\\s|$)"
+  match_on: content
+  case_insensitive: false
+  title: "Path traversal targeting system directory (/etc, /proc, /root, /sys, ...)"
+  expires_at: null
+  revoked: false
+  # Adapted from ATR-2026-00012: narrowed to require 2+ traversal hops terminating
+  # in a sensitive system directory (dropped dev, hosts from ATR's list); reduces
+  # FP on benign code examples that use relative paths like ../../src/.
+  # Fires in pre-hook (Write/Edit content blocking) and session-start plugin scans
+  # only; post-hook scanning is limited to category=prompt_injection rules.
+
+# ===========================================================================
+# SKILL PACKAGE COMPROMISE  --  malicious content inside SKILL.md, plugin
+# manifests, or skill package files.
+# ===========================================================================
+
+- id: "CLT-SKL-001"
+  category: skill_compromise
+  severity: critical
+  confidence: 0.85
+  pattern: "you\\s+(must|should|will|shall)\\s+(ignore|disregard|override|forget|bypass|circumvent|supersede|set\\s+aside|discard|abandon)\\s+(all\\s+)?(previous|prior|system|safety|security)\\s+(instructions?|prompts?|rules?|guidelines?|policies|restrictions?)"
+  match_on: content
+  case_insensitive: true
+  title: "SKILL.md prompt injection via mandatory override"
+  expires_at: null
+  revoked: false
+  # Adapted from ATR-2026-00120: simplified to single regex targeting the
+  # mandatory-subject ("you must/shall") framing only; omits ATR's broader
+  # context-window injection and multi-condition layers.
+  # Intentional layering with CLT-PI-001..004: those rules catch the bare
+  # imperative verb; this rule adds a distinct signal for the explicit mandatory
+  # subject, increasing confidence when both fire on the same payload.
+
+# CLT-SKL-003 intentionally omitted — dropped for FP risk during ATR curation.
+
+- id: "CLT-SKL-002"
+  category: skill_compromise
+  severity: critical
+  confidence: 0.85
+  pattern: "(eval\\s*\\$\\(\\s*echo\\s+[\"'][A-Za-z0-9+/=]{20,}[\"']\\s*\\|\\s*base64\\s+-d|echo\\s+[\"'][A-Za-z0-9+/=]{20,}[\"']\\s*\\|\\s*base64\\s+(-d|--decode)\\s*\\|\\s*(bash|sh|python|node|ruby|perl))"
+  match_on: content
+  case_insensitive: true
+  title: "Base64-encoded payload piped to interpreter inside skill content"
+  expires_at: null
+  revoked: false
+  # Source: ATR-2026-00121 (pattern unchanged from upstream).
+
+- id: "CLT-SKL-004"
+  category: skill_compromise
+  severity: critical
+  confidence: 0.85
+  pattern: "<!--[\\s\\S]{0,200}?(agent\\s+should|send\\s+all|output\\s+all|exfiltrate|curl\\s|wget\\s|post\\s+.{0,30}(key|credential|token|password|secret)|api[_-]?key.{0,30}https?://)"
+  match_on: content
+  case_insensitive: true
+  title: "Hidden payload in HTML comment within skill content"
+  expires_at: null
+  revoked: false
+  # Adapted from ATR-2026-00128: changed ATR's [^>] lookahead to [\s\S] to avoid
+  # false negatives when a hyphen precedes an exfil keyword; maintains same
+  # exfil-keyword focus (distinct from CLT-PI-002's instruction-override focus).
+
+- id: "CLT-SKL-005"
+  category: skill_compromise
+  severity: critical
+  confidence: 0.95
+  pattern: "(?:\\uDB40[\\uDC00-\\uDC7F]){3,}"
+  match_on: content
+  case_insensitive: false
+  title: "Unicode Tag character smuggling (U+E0000..U+E007F) in skill content"
+  expires_at: null
+  revoked: false
+  # Source: ATR-2026-00129 (pattern unchanged from upstream). Tag characters
+  # are invisible to humans but visible to LLMs; 3+ in sequence is an
+  # injection signature with no legitimate use.
+
+- id: "CLT-SKL-006"
+  category: skill_compromise
+  severity: critical
+  confidence: 0.85
+  pattern: "(tar|zip|7z)\\s+[^\\n]*~/?\\.ssh|(find|ls|cat|strings)\\s+[^\\n]*(wallet\\.dat|seed\\.txt|mnemonic|keystore)[^\\n]*(\\||>|>>|curl|wget|fetch|POST)|sqlite3\\s+[^\\n]*(Cookies|Login\\s*Data|cookies\\.sqlite|places\\.sqlite)"
+  match_on: content
+  case_insensitive: true
+  title: "Compound skill-content exfiltration (wallet/browser/SSH archival)"
+  expires_at: null
+  revoked: false
+  # Adapted from ATR-2026-00149: condensed ATR's 13 detection conditions into
+  # one regex covering SSH archival, crypto wallet exfil, and browser DB dump;
+  # omits ATR's DNS-exfil, IMDS metadata, and env-file piping layers.
+  # Intentional layering with CLT-CRED-008 (command artifact): that rule catches
+  # the same SSH archival at shell execution time; this rule catches it in
+  # written skill/plugin content before it executes.
+
+# CLT-SKL-007 intentionally omitted — dropped for FP risk during ATR curation.
+
+- id: "CLT-SKL-008"
+  category: skill_compromise
+  severity: warning
+  confidence: 0.85
+  pattern: "(?:(?:always|must|shall|will|should)\\s+){1,3}(?:approve|accept|allow|grant|permit)\\b[^.\\n]{0,80}(?:without|regardless|even\\s+if|despite)\\s+(?:confirmation|permission|approval|consent|asking|checking|verification|user)"
+  match_on: content
+  case_insensitive: true
+  title: "Hidden override instruction in skill -- auto-approve all"
+  expires_at: null
+  revoked: false
+  # Adapted from ATR-2026-00163: added "will"/"should" modals and "despite" as
+  # an additional consent-bypass synonym; bounded modal repetition to {1,3}.
+
+# ===========================================================================
+# CONTEXT EXFILTRATION
+# ===========================================================================
+
+- id: "CLT-CTX-003"
+  category: context_exfiltration
+  severity: critical
+  confidence: 0.95
+  pattern: "-----BEGIN\\s+[A-Z ]+PRIVATE\\s+KEY-----[\\s\\S]{40,}-----END\\s+[A-Z ]+PRIVATE\\s+KEY-----"
+  match_on: content
+  title: "PEM private key block appearing in agent content"
+  expires_at: null
+  revoked: false
+  # Source: ATR-2026-00021 (pattern unchanged from upstream). Fires on Write/Edit
+  # content and session-start plugin scans (category context_exfiltration is
+  # pre-hook only; post-hook scanning is limited to prompt_injection rules).
+  # Covers RSA, EC, DSA, OPENSSH, ENCRYPTED variants.
+
+# ===========================================================================
+# SUPPLY CHAIN
+# ===========================================================================
+
+- id: "CLT-SUPPLY-002"
+  category: supply_chain
+  severity: warning
+  confidence: 0.95
+  pattern: "(?:filesytem|filsystem|file_sytem|flie_system|filessystem|filesystm|filsystm|filesysem)[-_](?:read|write|list|delete|search)"
+  match_on: content
+  case_insensitive: true
+  title: "Typosquatted filesystem tool name (targets MCP filesystem server)"
+  expires_at: null
+  revoked: false
+  # Adapted from ATR-2026-00060: extracted filesystem-server typo variants only;
+  # narrows ATR's broader MCP squatting rule to the
+  # @modelcontextprotocol/server-filesystem impersonation family.

package/resources/threats/commands.yaml

@@ -1,14 +1,13 @@
 # Command threat patterns for Sage
 # Author: Gen Digital Inc.
 # License: DRL-1.1 (see threats/LICENSE)
-# Schema: id, category, severity, confidence, action, pattern, match_on, title, expires_at, revoked
+# Schema: id, category, severity, confidence, pattern, match_on, title, expires_at, revoked, flags
 
 # --- Pipe to shell (Remote Code Execution) ---
 - id: "CLT-CMD-001"
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "curl\\s[^|]*\\|\\s*(bash|sh|zsh|ksh|dash)"
   match_on: command
   title: "Remote code execution via curl pipe to shell"
@@ -19,7 +18,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "wget\\s[^|]*\\|\\s*(bash|sh|zsh|ksh|dash)"
   match_on: command
   title: "Remote code execution via wget pipe to shell"
@@ -31,8 +29,7 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
-  pattern: "/dev/tcp/"
+  pattern: "\\b(bash|sh|zsh|ksh|dash)\\s+-i\\b[\\s\\S]{0,160}/dev/tcp/"
   match_on: command
   title: "Reverse shell via /dev/tcp"
   expires_at: null
@@ -42,7 +39,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bnc\\b.*\\s-e\\s"
   match_on: command
   title: "Reverse shell via netcat -e"
@@ -53,7 +49,6 @@
   category: tool
   severity: critical
   confidence: 0.85
-  action: block
   pattern: "bash\\s+-i\\s+>\\s*&\\s*/dev/"
   match_on: command
   title: "Interactive reverse shell via bash"
@@ -65,7 +60,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\brm\\s+(-[a-zA-Z]*f[a-zA-Z]*\\s+)?(-[a-zA-Z]*r[a-zA-Z]*\\s+)?/(\\s|$|[;&|*])|\\brm\\s+(-[a-zA-Z]*r[a-zA-Z]*\\s+)?(-[a-zA-Z]*f[a-zA-Z]*\\s+)?/(\\s|$|[;&|*])|\\brm\\s+-[a-zA-Z]*rf[a-zA-Z]*\\s+/(\\s|$|[;&|*])"
   match_on: command
   title: "Recursive forced deletion from root"
@@ -76,7 +70,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bmkfs\\b"
   match_on: command
   title: "Filesystem format command"
@@ -85,9 +78,8 @@
 
 - id: "CLT-CMD-008"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   pattern: "\\bdd\\s+if=.*of=/dev/"
   match_on: command
   title: "Direct disk write via dd"
@@ -98,7 +90,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bshred\\b"
   match_on: command
   title: "Secure file destruction via shred"
@@ -110,7 +101,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "(curl|wget)\\s[\\s\\S]*?(&&|;)\\s*chmod\\s+\\+x"
   match_on: command
   title: "Download and execute chain"
@@ -120,9 +110,8 @@
 # --- Privilege escalation ---
 - id: "CLT-CMD-011"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bchmod\\s+777\\b"
   match_on: command
   title: "Overly permissive file permissions"
@@ -131,9 +120,8 @@
 
 - id: "CLT-CMD-012"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "NOPASSWD"
   match_on: command
   title: "Passwordless sudo configuration"
@@ -143,9 +131,8 @@
 # --- Data exfiltration ---
 - id: "CLT-CMD-013"
   category: network_egress
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "curl\\s[^|;]*(-d|--data|--data-binary)\\s\\S*(/etc/passwd|/etc/shadow|\\.ssh/|id_rsa|credentials|secrets)"
   match_on: command
   title: "Possible data exfiltration of sensitive files"
@@ -157,7 +144,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\bsudo\\s+(curl|wget)\\s[^|]*\\|\\s*(bash|sh|zsh|ksh|dash)"
   match_on: command
   title: "Privileged pipe-to-shell (sudo curl/wget piped to shell)"
@@ -171,9 +157,8 @@
 # bounded non-greedy quantifier to avoid catastrophic backtracking.
 - id: "CLT-CMD-015"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "python[3]?\\s+-c\\s+[\"'][\\s\\S]{0,2048}?(?:os\\.(?:system|popen|exec[lv]?[ep]?e?)|subprocess\\.(?:run|call|Popen|check_output|check_call|getoutput|getstatusoutput)|__import__)\\s*\\("
   match_on: command
   title: "Python one-liner invoking shell/exec/subprocess call"
@@ -185,7 +170,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bbash\\s+<\\(\\s*(curl|wget)\\b"
   match_on: command
   title: "Process substitution executing remote content"
@@ -194,9 +178,8 @@
 
 - id: "CLT-CMD-017"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   pattern: "\\beval\\b[^;|]*\\b(curl|wget)\\b"
   match_on: command
   title: "Eval executing remote download command"
@@ -205,13 +188,12 @@
 
 - id: "CLT-CMD-018"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   # The lookarounds prevent matching short-option flags like `du -sh` or
   # identifiers like `shell`/`bashrc`; only standalone command invocations
   # (preceded by whitespace, `/`, etc.) are flagged.
-  pattern: "\\bxargs\\b[^|;]*(?<![-\\w])(curl|wget|bash|sh)(?![-\\w])"
+  pattern: "\\bxargs\\b[^|;\\r\\n]{0,400}(?:(?<![-\\w])(bash|sh)(?![-\\w])(?:\\s+-[\\w]*c\\b\\s+(?:\"(?!\\s*(?:head|cat|wc)\\b)[^\"\\r\\n]{0,240}(?:\\{\\}|\\$[@*]|\\$\\d)[^\"\\r\\n]{0,240}\"|'(?!\\s*(?:head|cat|wc)\\b)[^'\\r\\n]{0,240}(?:\\{\\}|\\$[@*]|\\$\\d)[^'\\r\\n]{0,240}')|(?!\\s+-[\\w]*c\\b))|(?<![-\\w])(curl|wget)(?![-\\w])[^|;\\r\\n]{0,400}(?:-d|--data|--data-binary|--upload-file|-T|--post-file|--post-data|--body-file)\\b)"
   match_on: command
   title: "xargs dispatching download or shell execution"
   expires_at: null
@@ -219,9 +201,8 @@
 
 - id: "CLT-CMD-019"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   pattern: "\\bfind\\b[^|;]*-exec\\s+(bash|sh|curl|wget)\\b"
   match_on: command
   title: "find -exec executing shell or download commands"
@@ -231,9 +212,8 @@
 # --- DNS exfiltration ---
 - id: "CLT-CMD-020"
   category: network_egress
-  severity: high
+  severity: warning
   confidence: 0.80
-  action: block
   pattern: "\\b(nslookup|dig|host)\\b[^|;]*\\$\\([^)]+\\)\\.[a-zA-Z]"
   match_on: command
   title: "DNS exfiltration via command substitution as subdomain label"
@@ -242,9 +222,8 @@
 
 - id: "CLT-CMD-021"
   category: network_egress
-  severity: high
+  severity: warning
   confidence: 0.80
-  action: block
   pattern: "\\b(nslookup|dig|host)\\b[^|;]*`[^`]+`\\.[a-zA-Z]"
   match_on: command
   title: "DNS exfiltration via backtick substitution as subdomain label"
@@ -254,9 +233,8 @@
 # --- Loop-based indirect execution ---
 - id: "CLT-CMD-022"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.80
-  action: block
   pattern: "\\b(while|for)\\b[^;]*;\\s*do[^;]*(\\b(bash|sh)\\s+-c\\b|\\b(curl|wget)\\b[^;]*\\|\\s*(?:sudo\\s+)?(?:env\\s+)?(?:[^\\s\"']*[\\\\/])?(bash|sh|zsh|ksh|dash)\\b|\\b(curl|wget)\\b[^;]*(?:(-d|--data|--data-binary)\\s+['\\\"]?@\\S+|(--upload-file|-T)\\s+['\\\"]?\\S+))"
   match_on: command
   title: "Loop executing shell or download commands"
@@ -270,7 +248,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "python[23]?\\s+-c.*socket.*connect.*(\\/bin\\/zsh|\\/bin\\/sh|\\/bin\\/bash)"
   match_on: command
   title: "Python reverse shell via socket"
@@ -282,7 +259,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "ruby\\s+-e.*TCPSocket.*exec.*(\\/bin\\/zsh|\\/bin\\/sh)"
   match_on: command
   title: "Ruby reverse shell via TCPSocket"
@@ -294,7 +270,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\bzsh\\s+-c\\b.*\\b(exec|socket|/dev/tcp)\\b"
   match_on: command
   title: "Zsh reverse shell pattern"
@@ -306,7 +281,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "\\brm\\s+(-[a-zA-Z]+\\s+)*-[a-zA-Z]*[rR][a-zA-Z]*(\\s+-[a-zA-Z]+)*\\s+/(home|Users|etc|usr|var|boot|bin|sbin|lib|lib64|opt|root|System|Applications|Library|Volumes|private|mnt)\\b/?(\\s|$|[;&|])"
   match_on: command
   title: "Recursive deletion of critical system directory"
@@ -316,9 +290,8 @@
 # --- Deletion of .env files ---
 - id: "CLT-CMD-027"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\brm\\s+(-{1,2}[\\w-]+(=\\S+)?\\s+)*(\\S+[\\\\/])?\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.(local|production|prod|staging|stage|development|dev|test))?\\b"
   match_on: command
   title: "Deletion of .env file"
@@ -328,9 +301,8 @@
 # --- Deletion of database files ---
 - id: "CLT-CMD-028"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\brm\\s+(-{1,2}[\\w-]+(=\\S+)?\\s+)*\\S+\\.(db|sqlite|sqlite3)\\b"
   match_on: command
   title: "Deletion of database file"
@@ -340,9 +312,8 @@
 # --- Deletion of .git directory ---
 - id: "CLT-CMD-029"
   category: tool
-  severity: high
-  confidence: 0.90
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\b(rm|del|rmdir|rd|Remove-Item|unlink)\\b.*(\\s|[\\\\/])\\.git(\\s|[\\\\/]|$)"
   case_insensitive: true
   match_on: command

package/resources/threats/credentials.yaml

@@ -7,7 +7,6 @@
   category: secrets
   severity: critical
   confidence: 0.80
-  action: block
   pattern: "(sk-[a-zA-Z0-9_-]{20,}|sk-proj-[a-zA-Z0-9_-]{20,}|AKIA[0-9A-Z]{16}|AIza[0-9A-Za-z_-]{35}|ghp_[0-9a-zA-Z]{36}|gho_[0-9a-zA-Z]{36}|glpat-[0-9a-zA-Z_-]{20,}|xox[baprs]-[0-9a-zA-Z-]+)"
   match_on: [command, content]
   title: "Known API key prefix detected"
@@ -17,9 +16,8 @@
 # --- Export of credential env vars ---
 - id: "CLT-CRED-002"
   category: secrets
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bexport\\s+[A-Z_]*(API_KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL|AUTH)[A-Z_]*="
   match_on: command
   title: "Export of environment variable with credential keyword"
@@ -29,9 +27,8 @@
 # --- .env file writes ---
 - id: "CLT-CRED-003"
   category: secrets
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(>>|>)\\s*\\.env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.local|\\.production|\\.prod|\\.staging|\\.stage|\\.development|\\.dev|\\.test)?\\b"
   match_on: command
   title: "Write/append to .env file (potential credential exposure)"
@@ -41,9 +38,8 @@
 # --- Reading credential files ---
 - id: "CLT-CRED-004"
   category: secrets
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\b(cat|less|more|head|tail)\\s+.*(\\.(env(?!\\S*\\.(example|sample|template|dist)\\b)(\\.(local|production|prod|staging|stage|development|dev|test))?)|credentials|\\.aws/credentials|\\.ssh/id_rsa|\\.ssh/id_ed25519|\\.netrc|\\.pgpass)"
   match_on: command
   title: "Reading credential or secret file"
@@ -53,9 +49,8 @@
 # --- Plaintext credential assignment ---
 - id: "CLT-CRED-005"
   category: secrets
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\b(PASSWORD|API_SECRET|SECRET_KEY|PRIVATE_KEY|DB_PASSWORD|MYSQL_PASSWORD|POSTGRES_PASSWORD)=[\"']?[^\\s\"']{8,}"
   match_on: [command, content]
   title: "Plaintext credential assignment detected"
@@ -67,7 +62,6 @@
   category: secrets
   severity: critical
   confidence: 0.92
-  action: block
   pattern: "(github_pat_[0-9a-zA-Z_]{22,}|SG\\.[0-9a-zA-Z_-]{22,}\\.[0-9a-zA-Z_-]{22,}|pk_live_[0-9a-zA-Z]{24,}|sk_live_[0-9a-zA-Z]{24,}|rk_live_[0-9a-zA-Z]{24,})"
   match_on: [command, content]
   title: "Long-form API key pattern detected (GitHub PAT, SendGrid, Stripe)"
@@ -77,9 +71,8 @@
 # --- Copy/move/link secret files ---
 - id: "CLT-CRED-007"
   category: secrets
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   # Protected files: .env*, .aws/credentials, .ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa),
   # .netrc, .pgpass, .npmrc, .pypirc, key.properties, .docker/config.json,
   # kubeconfig, .kube/config, master.key, credentials.yml
@@ -92,9 +85,8 @@
 # --- Archive secret files ---
 - id: "CLT-CRED-008"
   category: secrets
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   # Protected files: .env*, .aws/credentials, .ssh/(id_rsa|id_ed25519|id_ecdsa|id_dsa),
   # .netrc, .pgpass, .npmrc, .pypirc, key.properties, .docker/config.json,
   # kubeconfig, .kube/config, master.key, credentials.yml