@highflame/policy 2.1.1 → 2.1.3

package/_schemas/guardrails/context.json

@@ -160,6 +160,239 @@
           "required": false,
           "description": "Density score for invisible characters in the content (0-100). Higher scores indicate more invisible characters, suggesting evasion attempts",
           "range": "0-100"
+        },
+        {
+          "key": "command_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection patterns were detected in the content (reverse shells, privilege escalation, destructive commands)"
+        },
+        {
+          "key": "command_injection_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of command injection: 'reverse_shell', 'privilege_escalation', 'code_execution', 'destructive_command', or 'data_exfiltration'"
+        },
+        {
+          "key": "command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for command injection detection (0-100). Higher scores indicate stronger pattern matches",
+          "range": "0-100"
+        },
+        {
+          "key": "path_traversal_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether path traversal patterns were detected (e.g., ../../../etc/passwd, URL-encoded variants)"
+        },
+        {
+          "key": "path_traversal_severity",
+          "type": "string",
+          "required": false,
+          "description": "Severity of path traversal: 'critical' (sensitive system files), 'high' (deep traversal), 'medium' (moderate traversal), 'low', or 'none'"
+        },
+        {
+          "key": "path_traversal_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of path traversal detected (e.g., 'sensitive_file', 'deep_traversal', 'encoded_traversal')"
+        },
+        {
+          "key": "sql_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether SQL injection patterns were detected (tautologies, UNION-based, destructive queries)"
+        },
+        {
+          "key": "sql_injection_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of SQL injection: 'tautology', 'union_based', 'destructive', 'blind', or 'error_based'"
+        },
+        {
+          "key": "sql_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for SQL injection detection (0-100). Typical threshold: >=75 for blocks",
+          "range": "0-100"
+        },
+        {
+          "key": "cross_origin_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether cross-origin escalation patterns were detected (tool calls or references crossing trust boundaries)"
+        },
+        {
+          "key": "cross_origin_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of cross-origin escalation: 'cross_origin_tool', 'cross_origin_server', or 'none'"
+        },
+        {
+          "key": "cross_origin_score",
+          "type": "number",
+          "required": false,
+          "description": "Risk score for cross-origin escalation (0-100). Higher scores indicate more suspicious cross-boundary activity",
+          "range": "0-100"
+        },
+        {
+          "key": "encoded_content_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether encoded content was detected (base64, hex, unicode, URL encoding) that may hide malicious payloads"
+        },
+        {
+          "key": "encoded_types",
+          "type": "array",
+          "required": false,
+          "description": "Array of encoding types detected (e.g., ['base64', 'hex', 'unicode', 'url']). Use .contains() to check for specific encoding types"
+        },
+        {
+          "key": "encoded_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of encoded segments found in the content"
+        },
+        {
+          "key": "encoded_score",
+          "type": "number",
+          "required": false,
+          "description": "Risk score for encoded injection attempts (0-100). Considers encoding density and decoded content patterns",
+          "range": "0-100"
+        },
+        {
+          "key": "detected_language",
+          "type": "string",
+          "required": false,
+          "description": "ISO language code of the detected language (e.g., 'en', 'fr', 'zh'). Use this for language-specific policy enforcement"
+        },
+        {
+          "key": "is_english",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the content is in English. Useful for applying English-only policies or flagging non-English content"
+        },
+        {
+          "key": "language_confidence",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for language detection (0-100). Use with detected_language to tune sensitivity",
+          "range": "0-100"
+        },
+        {
+          "key": "detected_script",
+          "type": "string",
+          "required": false,
+          "description": "Writing script detected in content: 'latin', 'cyrillic', 'arabic', 'cjk', 'unknown', etc. Use to detect script-switching attacks"
+        },
+        {
+          "key": "is_latin_script",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether the content uses Latin script. Useful for detecting non-Latin script injection attempts"
+        },
+        {
+          "key": "script_confidence",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for script detection (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "hallucination_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based score for hallucinated or fabricated content (0-100). Higher scores indicate higher likelihood of non-factual claims",
+          "range": "0-100"
+        },
+        {
+          "key": "factuality_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based factuality assessment score (0-100). Higher scores indicate more factually grounded content",
+          "range": "0-100"
+        },
+        {
+          "key": "sentiment_score",
+          "type": "number",
+          "required": false,
+          "description": "Sentiment analysis score. Use to detect overly negative or manipulative tone in prompts or responses",
+          "range": "0-100"
+        },
+        {
+          "key": "contains_code",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether code snippets were detected in the content"
+        },
+        {
+          "key": "code_languages",
+          "type": "array",
+          "required": false,
+          "description": "Array of programming languages detected in code snippets (e.g., ['python', 'javascript'])"
+        },
+        {
+          "key": "code_ratio",
+          "type": "number",
+          "required": false,
+          "description": "Percentage of content that consists of code (0-100). High values may indicate code dumps or automated content",
+          "range": "0-100"
+        },
+        {
+          "key": "keyword_matched",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether any configured keywords or phrases were matched in the content"
+        },
+        {
+          "key": "keyword_categories",
+          "type": "array",
+          "required": false,
+          "description": "Array of keyword categories matched (e.g., ['competitor_names', 'restricted_topics']). Use .contains() for category-specific policies"
+        },
+        {
+          "key": "keyword_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of keyword matches found in the content"
+        },
+        {
+          "key": "contains_non_ascii",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether non-ASCII characters were detected. May indicate obfuscation or encoding-based evasion attempts"
+        },
+        {
+          "key": "phishing_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether phishing patterns were detected in the content (suspicious URLs, impersonation, credential requests)"
+        },
+        {
+          "key": "content_safety_score",
+          "type": "number",
+          "required": false,
+          "description": "Aggregate content safety score (0-100). Combines multiple safety signals into a single risk indicator",
+          "range": "0-100"
+        },
+        {
+          "key": "content_safety_blocked",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether content was flagged for blocking by the content safety system"
+        },
+        {
+          "key": "conversation_turn",
+          "type": "number",
+          "required": false,
+          "description": "Current conversation turn number. Use for policies that escalate strictness over long conversations"
+        },
+        {
+          "key": "multi_turn_detection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether multi-turn injection patterns were detected (attack spread across multiple conversation turns)"
         }
       ]
     },
@@ -314,6 +547,182 @@
           "type": "array",
           "required": false,
           "description": "Array of PII types found in tool arguments"
+        },
+        {
+          "key": "injection_score",
+          "type": "number",
+          "required": false,
+          "description": "ML-based confidence score for prompt injection in tool arguments (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "command_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether command injection patterns were detected in tool arguments"
+        },
+        {
+          "key": "command_injection_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of command injection detected in tool arguments"
+        },
+        {
+          "key": "command_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for command injection in tool arguments (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "path_traversal_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether path traversal patterns were detected in tool arguments"
+        },
+        {
+          "key": "path_traversal_severity",
+          "type": "string",
+          "required": false,
+          "description": "Severity of path traversal in tool arguments"
+        },
+        {
+          "key": "path_traversal_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of path traversal detected in tool arguments"
+        },
+        {
+          "key": "sql_injection_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether SQL injection patterns were detected in tool arguments"
+        },
+        {
+          "key": "sql_injection_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of SQL injection detected in tool arguments"
+        },
+        {
+          "key": "sql_injection_score",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for SQL injection in tool arguments (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "tool_poisoning_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether tool poisoning was detected (hidden instructions in tool descriptions or arguments designed to manipulate agent behavior)"
+        },
+        {
+          "key": "tool_poisoning_score",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for tool poisoning detection (0-100). Typical threshold: >=70 for blocks",
+          "range": "0-100"
+        },
+        {
+          "key": "tool_poisoning_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of tool poisoning: 'hidden_instructions', 'system_prompt_injection', or 'authority_hijack'"
+        },
+        {
+          "key": "rug_pull_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether a rug pull was detected (tool behavior changed significantly after establishing trust)"
+        },
+        {
+          "key": "rug_pull_score",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for rug pull detection based on behavioral drift analysis (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "mcp_config_risk",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether MCP configuration risk was detected (inline code execution, suspicious URLs, cross-origin issues)"
+        },
+        {
+          "key": "mcp_risk_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of MCP risk: 'inline_execution', 'suspicious_url', or 'cross_origin'"
+        },
+        {
+          "key": "mcp_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Risk score for MCP configuration issues (0-100). Typical threshold: >=70 for blocks",
+          "range": "0-100"
+        },
+        {
+          "key": "cross_origin_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether cross-origin escalation patterns were detected in tool calls crossing trust boundaries"
+        },
+        {
+          "key": "cross_origin_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of cross-origin escalation detected in tool call"
+        },
+        {
+          "key": "cross_origin_score",
+          "type": "number",
+          "required": false,
+          "description": "Risk score for cross-origin escalation in tool calls (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "encoded_content_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether encoded content was detected in tool arguments (base64, hex, unicode encoding hiding payloads)"
+        },
+        {
+          "key": "encoded_types",
+          "type": "array",
+          "required": false,
+          "description": "Array of encoding types detected in tool arguments (e.g., ['base64', 'hex'])"
+        },
+        {
+          "key": "encoded_count",
+          "type": "number",
+          "required": false,
+          "description": "Number of encoded segments found in tool arguments"
+        },
+        {
+          "key": "encoded_score",
+          "type": "number",
+          "required": false,
+          "description": "Risk score for encoded injection in tool arguments (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "rug_pull_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of rug pull detected: 'risk_spike' (sudden risk increase), 'pattern_change' (behavioral shift), 'combined', or 'none'"
+        },
+        {
+          "key": "conversation_turn",
+          "type": "number",
+          "required": false,
+          "description": "Current conversation turn number for the agentic session"
+        },
+        {
+          "key": "multi_turn_detection",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether multi-turn injection patterns were detected across tool calls in the session"
         }
       ]
     },
@@ -356,6 +765,24 @@
           "type": "array",
           "required": false,
           "description": "Array of PII types found in file content"
+        },
+        {
+          "key": "path_traversal_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether path traversal patterns were detected in the file path being read"
+        },
+        {
+          "key": "path_traversal_severity",
+          "type": "string",
+          "required": false,
+          "description": "Severity of path traversal in the file read path"
+        },
+        {
+          "key": "path_traversal_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of path traversal detected in the file read path"
         }
       ]
     },
@@ -398,6 +825,24 @@
           "type": "array",
           "required": false,
           "description": "Array of PII types found in write content"
+        },
+        {
+          "key": "path_traversal_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether path traversal patterns were detected in the file path being written"
+        },
+        {
+          "key": "path_traversal_severity",
+          "type": "string",
+          "required": false,
+          "description": "Severity of path traversal in the file write path"
+        },
+        {
+          "key": "path_traversal_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of path traversal detected in the file write path"
         }
       ]
     },
@@ -428,6 +873,63 @@
           "type": "boolean",
           "required": false,
           "description": "Whether the MCP server is from a verified/trusted registry. Use this to block connections to unverified servers"
+        },
+        {
+          "key": "tool_poisoning_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether tool poisoning was detected in the MCP server's tool descriptions (hidden instructions designed to manipulate agent behavior)"
+        },
+        {
+          "key": "tool_poisoning_score",
+          "type": "number",
+          "required": false,
+          "description": "Confidence score for tool poisoning in MCP server tools (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "tool_poisoning_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of tool poisoning detected in MCP server: 'hidden_instructions', 'system_prompt_injection', or 'authority_hijack'"
+        },
+        {
+          "key": "mcp_config_risk",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether MCP configuration risk was detected (inline code execution in server configs, suspicious URLs, cross-origin issues)"
+        },
+        {
+          "key": "mcp_risk_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of MCP configuration risk: 'inline_execution', 'suspicious_url', or 'cross_origin'"
+        },
+        {
+          "key": "mcp_risk_score",
+          "type": "number",
+          "required": false,
+          "description": "Risk score for MCP configuration issues (0-100)",
+          "range": "0-100"
+        },
+        {
+          "key": "cross_origin_detected",
+          "type": "boolean",
+          "required": false,
+          "description": "Whether cross-origin escalation patterns were detected in the MCP server connection"
+        },
+        {
+          "key": "cross_origin_type",
+          "type": "string",
+          "required": false,
+          "description": "Type of cross-origin escalation detected in server connection"
+        },
+        {
+          "key": "cross_origin_score",
+          "type": "number",
+          "required": false,
+          "description": "Risk score for cross-origin escalation in server connection (0-100)",
+          "range": "0-100"
         }
       ]
     }