@gendigital/sage-opencode 0.10.0 → 0.12.0

package/resources/threats/obfuscation.yaml

@@ -7,7 +7,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: "base64\\s+(-d|--decode)\\s*\\|\\s*(bash|sh|zsh|ksh|dash)"
   match_on: command
   title: "Base64 decode piped to shell execution"
@@ -17,9 +16,8 @@
 # --- Hex escape sequences in printf ---
 - id: "CLT-OBFUS-002"
   category: tool
-  severity: medium
-  confidence: 0.70
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "printf\\s+[\"']\\\\x[0-9a-fA-F]{2}(\\\\x[0-9a-fA-F]{2}){3,}"
   match_on: command
   title: "Hex escape sequences in printf (potential obfuscation)"
@@ -31,7 +29,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\|\\s*rev\\s*\\|\\s*(bash|sh|zsh|ksh|dash)"
   match_on: command
   title: "Reversed string piped to shell execution"
@@ -43,7 +40,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "\\beval\\s+.*\\$\\(\\s*base64|python[3]?\\s+-c\\s+[\"'].*exec\\(.*decode"
   match_on: [command, content]
   title: "Eval with decode (obfuscated code execution)"
@@ -53,9 +49,8 @@
 # --- Shell metacharacter escaping ---
 - id: "CLT-OBFUS-005"
   category: tool
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   pattern: "\\|\\s*[\\\\'\"]+(bash|sh|zsh|ksh|dash)[\\\\'\"]*(\\s|$)"
   match_on: command
   title: "Shell metacharacter escaping to hide pipe target"
@@ -65,9 +60,8 @@
 # --- Alias/function redefinition ---
 - id: "CLT-OBFUS-006"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\balias\\s+(bash|sh|zsh|curl|wget|nc|netcat|python|ruby|perl|node)="
   match_on: command
   title: "Alias redefinition of security-relevant command"
@@ -76,9 +70,8 @@
 
 - id: "CLT-OBFUS-007"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\b(function\\s+)?(bash|sh|curl|wget|nc|python|ruby|perl|node)\\s*\\(\\s*\\)"
   match_on: command
   title: "Function redefinition of security-relevant command"
@@ -90,7 +83,6 @@
   category: tool
   severity: critical
   confidence: 0.85
-  action: block
   pattern: "python[23]?\\s+-c\\s+[\"'].*\\b(exec|eval|compile|__import__)\\b.*\\b(base64|decode|decompress)\\b"
   match_on: command
   title: "Python encoded payload execution via -c"

package/resources/threats/persistence.yaml

@@ -5,9 +5,8 @@
 # --- Shell RC file modification ---
 - id: "CLT-PERSIST-001"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(>>|>)\\s*~?/?(\\$HOME/)?\\.?(bashrc|zshrc|profile|bash_profile|zprofile|zshenv)"
   match_on: command
   title: "Write/append to shell RC file (persistence mechanism)"
@@ -17,9 +16,8 @@
 # --- Crontab manipulation ---
 - id: "CLT-PERSIST-002"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bcrontab\\s+(-[er]|[^-])"
   match_on: command
   title: "Crontab manipulation (list, edit, or remove scheduled tasks)"
@@ -29,9 +27,8 @@
 # --- Cron directory writes ---
 - id: "CLT-PERSIST-003"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "/etc/cron\\.(d|daily|hourly|weekly|monthly)/"
   match_on: command
   title: "Write to system cron directory"
@@ -41,9 +38,8 @@
 # --- systemd service manipulation ---
 - id: "CLT-PERSIST-005"
   category: tool
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bsystemctl\\s+(enable|start)\\b|/etc/systemd/system/"
   match_on: command
   title: "systemd service enable/start or unit file write"
@@ -55,7 +51,6 @@
   category: tool
   severity: critical
   confidence: 0.95
-  action: block
   pattern: ">>\\s*(~|\\/(root|home\\/[a-zA-Z0-9._-]{1,32}))?/?\\.ssh/authorized_keys"
   match_on: command
   title: "Append to SSH authorized_keys (unauthorized access persistence)"
@@ -67,7 +62,6 @@
   category: tool
   severity: critical
   confidence: 0.90
-  action: block
   pattern: "(echo|printf)\\s+.*>>\\s*~?/?(\\$HOME/)?\\.?(bashrc|zshrc|profile|bash_profile)"
   match_on: command
   title: "Echo/printf append to shell RC file (code injection persistence)"
@@ -77,9 +71,8 @@
 # --- at job scheduling ---
 - id: "CLT-PERSIST-008"
   category: tool
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\\bat\\b\\s+(-f\\s+|now|midnight|noon|teatime)"
   match_on: command
   title: "At-job scheduling (persistence)"

package/resources/threats/prompt-injection.yaml

@@ -12,7 +12,6 @@
   category: prompt_injection
   severity: critical
   confidence: 0.90
-  action: block
   case_insensitive: true
   pattern: "ignore\\s+(all\\s+)?(previous|prior|above|earlier)\\s+(instructions?|directives?|rules?|guidelines?|prompts?|directions?)"
   match_on: content
@@ -24,7 +23,6 @@
   category: prompt_injection
   severity: critical
   confidence: 0.90
-  action: block
   case_insensitive: true
   pattern: "disregard\\s+(all\\s+)?(previous|prior|above|your)\\s+(instructions?|directives?|rules?|guidelines?|safety)"
   match_on: content
@@ -36,7 +34,6 @@
   category: prompt_injection
   severity: critical
   confidence: 0.90
-  action: block
   case_insensitive: true
   pattern: "forget\\s+(all\\s+)?(your\\s+)?(previous\\s+)?(instructions?|rules?|guidelines?|restrictions?|constraints?|context)"
   match_on: content
@@ -48,7 +45,6 @@
   category: prompt_injection
   severity: critical
   confidence: 0.90
-  action: block
   case_insensitive: true
   pattern: "override\\s+(the\\s+)?(system\\s+)?(prompt|instructions?|rules?|guidelines?)"
   match_on: content
@@ -58,9 +54,8 @@
 
 - id: "CLT-PI-005"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   case_insensitive: true
   pattern: "(new|updated?|revised?|changed?)\\s+instructions?:\\s*"
   match_on: content
@@ -75,7 +70,6 @@
   category: prompt_injection
   severity: critical
   confidence: 0.90
-  action: block
   case_insensitive: true
   pattern: "you\\s+are\\s+now\\s+(a\\s+)?(different|new|the|my|an?\\s+unrestricted|an?\\s+unfiltered)"
   match_on: content
@@ -85,21 +79,22 @@
 
 - id: "CLT-PI-011"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   case_insensitive: true
   pattern: "\\bDAN\\b.*?(do\\s+anything|jailbreak|no\\s+restrictions)"
   match_on: content
   title: "Role override: DAN jailbreak"
   expires_at: null
   revoked: false
+  # Intentional layering with CLT-PI-092 (ATR): this rule requires an explicit
+  # qualifier (jailbreak/no restrictions) after DAN; CLT-PI-092 instead requires
+  # an activation prefix (pretend/act as/you are) before the persona name.
 
 - id: "CLT-PI-012"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   case_insensitive: true
   pattern: "developer\\s+mode\\s+(is\\s+)?(now\\s+)?(enabled?|activated?|on).{0,50}(comply|content\\s+polic|no\\s+restrict|without\\s+restrict|any\\s+request)"
   match_on: content
@@ -109,9 +104,8 @@
 
 - id: "CLT-PI-013"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   case_insensitive: true
   pattern: "act\\s+(as|like)\\s+(a\\s+)?(system|admin|root|superuser)"
   match_on: content
@@ -126,7 +120,6 @@
   category: prompt_injection
   severity: critical
   confidence: 0.85
-  action: block
   case_insensitive: true
   pattern: "(bypass|disable)\\s+(the\\s+)?(security|safety|guardrails?|filters?|restrictions?)"
   match_on: content
@@ -136,9 +129,8 @@
 
 - id: "CLT-PI-021"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   case_insensitive: true
   pattern: "ignore\\s+(the\\s+)?(safety|security|ethical)\\s+(guidelines?|rules?|restrictions?)"
   match_on: content
@@ -148,9 +140,8 @@
 
 - id: "CLT-PI-022"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.80
-  action: block
   case_insensitive: true
   pattern: "skip\\s+(all\\s+)?security\\s+checks"
   match_on: content
@@ -162,7 +153,6 @@
   category: prompt_injection
   severity: critical
   confidence: 0.90
-  action: block
   case_insensitive: true
   pattern: "system\\s+override.{0,50}(execut|disabl|bypass|security|safet|comply|filter)"
   match_on: content
@@ -177,7 +167,6 @@
   category: prompt_injection
   severity: critical
   confidence: 0.90
-  action: block
   case_insensitive: true
   pattern: "do\\s+not\\s+(tell|inform|mention|reveal|show|disclose)\\s+(the\\s+)?(user|human|operator|developer)"
   match_on: content
@@ -190,9 +179,8 @@
 
 - id: "CLT-PI-040"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   case_insensitive: true
   pattern: "reveal\\s+(your\\s+)?(system\\s+)?prompt"
   match_on: content
@@ -202,9 +190,8 @@
 
 - id: "CLT-PI-041"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   case_insensitive: true
   pattern: "show\\s+(me\\s+)?(your\\s+)?(initial|original|system|hidden)\\s+instructions?"
   match_on: content
@@ -214,9 +201,8 @@
 
 - id: "CLT-PI-042"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   case_insensitive: true
   pattern: "repeat\\s+(back\\s+)?(everything|all|your\\s+instructions?)"
   match_on: content
@@ -226,9 +212,8 @@
 
 - id: "CLT-PI-043"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   case_insensitive: true
   pattern: "output\\s+(your\\s+)?(initialization|system\\s+prompt|initial\\s+instructions?)"
   match_on: content
@@ -241,21 +226,22 @@
 
 - id: "CLT-PI-050"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   case_insensitive: true
   pattern: "<!--\\s*(?:system|ignore|instruction|prompt|important|override|execute).*?-->"
   match_on: content
   title: "Structural injection: HTML comment with injection keywords"
   expires_at: null
   revoked: false
+  # Intentional layering with CLT-PI-091 (ATR): this rule matches injection
+  # keywords anywhere in the comment body; CLT-PI-091 adds a distinct signal
+  # for keywords appearing within 20 chars of the opening tag.
 
 - id: "CLT-PI-051"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   case_insensitive: true
   # Require a reasonably long hidden link target/title plus a high-signal PI phrase.
   pattern: "\\[[^\\]]*\\]\\((?=[^)]{40,}\\))[^)]*(?:ignore\\s+previous\\s+instructions|forget\\s+instructions|system\\s+prompt|override\\s+instructions)[^)]*\\)"
@@ -264,14 +250,28 @@
   expires_at: null
   revoked: false
 
+- id: "CLT-PI-052"
+  category: prompt_injection
+  severity: warning
+  confidence: 0.85
+  case_insensitive: true
+  pattern: "<important>[\\s\\S]{0,600}?\\b(send|exec|fetch|invoke|extract|pass|forward|upload)\\b[\\s\\S]{0,300}?</important>"
+  match_on: content
+  title: "Structural injection: MCP IMPORTANT-tag cross-tool shadowing"
+  expires_at: null
+  revoked: false
+  # Adapted from ATR-2026-00161: uses ATR Layer 1 only (upstream has 5 detection
+  # layers); dropped verbs read/include/must to reduce FP on benign documentation.
+  # Fires in pre-hook (Write/Edit content blocking) and post-hook advisory
+  # output scanning (Read/Bash/WebFetch); also caught by session-start plugin scan.
+
 # ── Role Marker Injection ──────────────────────────────────────────
 # Fake conversation turn markers to confuse the model.
 
 - id: "CLT-PI-060"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   case_insensitive: true
   pattern: "\\n\\s*\\n\\s*(Human|User|Assistant|System)\\s*:"
   match_on: content
@@ -281,9 +281,8 @@
 
 - id: "CLT-PI-061"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   case_insensitive: true
   pattern: "\\[INST\\]|\\[/INST\\]"
   match_on: content
@@ -296,9 +295,8 @@
 
 - id: "CLT-PI-070"
   category: prompt_injection
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   case_insensitive: true
   pattern: "1gn0r3|f0rg3t|byp4ss|syst3m|4dm1n"
   match_on: content
@@ -312,9 +310,8 @@
 
 - id: "CLT-PI-080"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.80
-  action: block
   case_insensitive: true
   pattern: "cat\\s+~/\\.(env|ssh|aws|gnupg).*\\|.*curl"
   match_on: content
@@ -324,12 +321,64 @@
 
 - id: "CLT-PI-081"
   category: prompt_injection
-  severity: high
+  severity: warning
   confidence: 0.80
-  action: block
   case_insensitive: true
   pattern: "output\\s+(all\\s+)?(the\\s+)?environment\\s+variables.{0,50}(send|post|upload|exfiltrat|curl|fetch)"
   match_on: content
   title: "Credential exfiltration: dump env vars and send"
   expires_at: null
   revoked: false
+
+# ── ATR Delivery Variants ──────────────────────────────────────────────────
+# Rules below are adapted from the ATR project
+# (https://github.com/Agent-Threat-Rule/agent-threat-rules),
+# Copyright (c) 2026 ATR Contributors, MIT License.
+# Included in Sage under the ATR MIT license per issue #30.
+# See threats/agent-layer.yaml for companion non-PI rules from the same contribution.
+# Sage-specific modifications to each rule are noted in its comment block.
+
+- id: "CLT-PI-091"
+  category: prompt_injection
+  severity: warning
+  confidence: 0.85
+  pattern: "<!--[\\s\\S]{0,20}?(ignore|disregard|override|new\\s+instructions?|you\\s+must|you\\s+are\\s+now|forget\\s+previous|send\\s+to|exfiltrate)\\b"
+  match_on: content
+  case_insensitive: true
+  title: "Indirect prompt injection hidden in HTML comment"
+  expires_at: null
+  revoked: false
+  # Adapted from ATR-2026-00002: extracted HTML-comment delivery condition only;
+  # narrowed keyword list (dropped reveal, disclose, output, execute, perform)
+  # to reduce FP; changed [^>] to [\s\S] so comparisons (a>b) before the keyword
+  # don't cause false negatives. Intentional layering with CLT-PI-050 (which
+  # matches keywords anywhere in the comment body): this rule adds a near-tag
+  # precision signal.
+
+- id: "CLT-PI-092"
+  category: prompt_injection
+  severity: warning
+  confidence: 0.85
+  pattern: "(?:(?:pretend|Pretend|act(?:ing)?\\s+as|Act(?:ing)?\\s+as|you\\s+are(?:\\s+now)?|You\\s+are(?:\\s+now)?|be(?:come)|Be(?:come))\\s+(?:(?:a|the|in|into|on)\\s+)?\\b(DAN|D\\.A\\.N|STAN|DUDE|AIM|UCAR|BH|BetterDAN|Evil\\s*Confidant|God\\s*Mode|Jailbreak\\s*Mode|Unrestricted\\s*Mode|Sudo\\s*Mode|Root\\s*Mode|Admin\\s*Mode)\\b)"
+  match_on: content
+  case_insensitive: false
+  title: "Jailbreak persona activation attempt (DAN/STAN/God-Mode family)"
+  expires_at: null
+  revoked: false
+  # Adapted from ATR-2026-00003: curated 16 highest-signal personas from ATR's
+  # 20+ (dropped KEVIN, Maximum, Omega, EvilGPT etc.); added space-separated
+  # mode names (God Mode, Jailbreak Mode). Case-sensitive (ATR is case-insensitive)
+  # to avoid FP on the common first name "Dan"; activation verbs include
+  # capitalized variants (Act/You/Pretend/Be) to cover sentence-start phrasing.
+
+- id: "CLT-PI-093"
+  category: prompt_injection
+  severity: warning
+  confidence: 0.85
+  pattern: "(?:忽略|无视|無視|忘记|忘記|跳过|跳過|绕过|繞過|覆盖|覆蓋|不要遵守|不要遵循)(?:之前|先前|以前|上述|上面)?(?:的)?(?:所有|一切|全部)?(?:指令|命令|指示|要求|规则|規則|系统|系統|提示|提醒|对话|對話)|(?:無視して|忘れて|無効にし)(?:以前|先の|上記)の(?:指示|命令|ルール|システム)|(?:이전|전의|앞의)(?:\\s*)(?:명령|지시|규칙|시스템|프롬프트)(?:을|를|은|는)?(?:\\s*)(?:무시|잊|건너뛰|우회)"
+  match_on: content
+  case_insensitive: false
+  title: "CJK prompt-injection override (Chinese/Japanese/Korean)"
+  expires_at: null
+  revoked: false
+  # Source: ATR-2026-00097 (pattern unchanged from upstream). Covers zh-CN, zh-TW, ja, ko.

package/resources/threats/self-defense.yaml

@@ -8,8 +8,7 @@
 - id: "CLT-SELF-001"
   category: self_defense
   severity: critical
-  confidence: 0.90
-  action: require_approval
+  confidence: 0.60
   pattern: "(rm|del|rmdir|rd|Remove-Item|unlink)\\s.*\\.sage(\\s|[\\\\/]|$)"
   case_insensitive: true
   match_on: command
@@ -20,10 +19,9 @@
 # Access Sage config files
 - id: "CLT-SELF-002"
   category: self_defense
-  severity: high
-  confidence: 0.85
-  action: require_approval
-  pattern: "\\.sage[\\\\/](allowlist|config|exceptions|pending-exceptions)\\.json"
+  severity: warning
+  confidence: 0.60
+  pattern: "\\.sage[\\\\/](config|exceptions|pending-exceptions)\\.json"
   match_on: file_path
   title: "Access Sage configuration files"
   expires_at: null
@@ -32,9 +30,8 @@
 # Delete Claude Code hook or plugin config
 - id: "CLT-SELF-003"
   category: self_defense
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "(rm|del|Remove-Item|unlink)\\s.*\\.claude[\\\\/].*(hooks\\.json|installed_plugins)"
   case_insensitive: true
   match_on: command
@@ -45,9 +42,8 @@
 # Disable Sage security features via config
 - id: "CLT-SELF-004"
   category: self_defense
-  severity: high
-  confidence: 0.85
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "\"heuristics_enabled\"\\s*:\\s*false|\"url_check\"\\s*:\\s*\\{[^}]*\"enabled\"\\s*:\\s*false"
   match_on: content
   title: "Attempt to disable Sage security features via config"

package/resources/threats/supply_chain.yaml

@@ -5,9 +5,8 @@
 # --- Install scripts piped to shell ---
 - id: "CLT-SUPPLY-001"
   category: supply_chain
-  severity: high
+  severity: warning
   confidence: 0.85
-  action: block
   pattern: "(curl|wget)\\s+.*install.*\\|\\s*(bash|sh|zsh|sudo\\s+bash|sudo\\s+sh)"
   match_on: command
   title: "Install script piped to shell (supply chain risk)"

package/resources/threats/urls.yaml

@@ -1,14 +1,13 @@
 # URL/domain threat patterns for Sage
 # Author: Gen Digital Inc.
 # License: DRL-1.1 (see threats/LICENSE)
-# Schema: id, category, severity, confidence, action, pattern, match_on, title, expires_at, revoked
+# Schema: id, category, severity, confidence, pattern, match_on, title, expires_at, revoked, flags
 
 # --- Known malware hosting patterns ---
 - id: "CLT-URL-001"
   category: network_egress
   severity: critical
   confidence: 0.85
-  action: block
   pattern: "raw\\.githubusercontent\\.com/.*/malware"
   match_on: url
   title: "Known malware hosting pattern on GitHub raw"
@@ -18,9 +17,8 @@
 # --- Paste sites used for C2 ---
 - id: "CLT-URL-002"
   category: network_egress
-  severity: high
-  confidence: 0.75
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "pastebin\\.com/raw/"
   match_on: url
   title: "Pastebin raw content (commonly used for C2 payloads)"
@@ -29,9 +27,8 @@
 
 - id: "CLT-URL-003"
   category: network_egress
-  severity: high
-  confidence: 0.75
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "paste\\.ee/r/"
   match_on: url
   title: "paste.ee raw content (commonly used for C2 payloads)"
@@ -44,9 +41,8 @@
 # which are common in local development and rarely indicate C2 traffic.
 - id: "CLT-URL-004"
   category: network_egress
-  severity: medium
-  confidence: 0.65
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "https?://(?!(?:127|10|0)\\.|192\\.168\\.|169\\.254\\.|172\\.(?:1[6-9]|2\\d|3[01])\\.)\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}\\.\\d{1,3}[:/]"
   match_on: url
   title: "Direct public IP address URL (potential C2 or staging server)"
@@ -56,9 +52,8 @@
 # --- Executable downloads ---
 - id: "CLT-URL-005"
   category: network_egress
-  severity: high
-  confidence: 0.80
-  action: require_approval
+  severity: warning
+  confidence: 0.60
   pattern: "/[^/\\s]{1,255}\\.(exe|msi|bat|cmd|ps1|vbs|scr|pif|hta|inf)([?#]|$)"
   match_on: url
   title: "URL pointing to executable file download"