@kenhkl/agent-moss 0.11.5 → 0.12.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +321 -385
- package/dist/cli.js.map +1 -1
- package/dist/engine/coordinator.d.ts +9 -0
- package/dist/engine/coordinator.js +280 -349
- package/dist/engine/coordinator.js.map +1 -1
- package/dist/rules/l1_rules.json +821 -0
- package/dist/rules/l2_rules.json +82 -0
- package/dist/rules/l3_rules.json +245 -0
- package/dist/server.js +307 -371
- package/dist/server.js.map +1 -1
- package/dist/templates/security_judge_template.txt +7 -1
- package/package.json +1 -1
|
@@ -0,0 +1,82 @@
|
|
|
1
|
+
{
|
|
2
|
+
"intent_consistency": [
|
|
3
|
+
{
|
|
4
|
+
"intent_keywords": [
|
|
5
|
+
"读取",
|
|
6
|
+
"查看",
|
|
7
|
+
"分析",
|
|
8
|
+
"read",
|
|
9
|
+
"analyze",
|
|
10
|
+
"view",
|
|
11
|
+
"list",
|
|
12
|
+
"列出"
|
|
13
|
+
],
|
|
14
|
+
"dangerous_actions": [
|
|
15
|
+
"删除",
|
|
16
|
+
"remove",
|
|
17
|
+
"delete",
|
|
18
|
+
"rm",
|
|
19
|
+
"格式化",
|
|
20
|
+
"format"
|
|
21
|
+
],
|
|
22
|
+
"reason": "原始意图为读取/分析，但执行了删除操作"
|
|
23
|
+
},
|
|
24
|
+
{
|
|
25
|
+
"intent_keywords": [
|
|
26
|
+
"查询",
|
|
27
|
+
"搜索",
|
|
28
|
+
"search",
|
|
29
|
+
"query",
|
|
30
|
+
"find"
|
|
31
|
+
],
|
|
32
|
+
"dangerous_actions": [
|
|
33
|
+
"修改",
|
|
34
|
+
"update",
|
|
35
|
+
"write",
|
|
36
|
+
"写入",
|
|
37
|
+
"alter"
|
|
38
|
+
],
|
|
39
|
+
"reason": "原始意图为查询/搜索，但执行了修改操作"
|
|
40
|
+
}
|
|
41
|
+
],
|
|
42
|
+
"password_modify_consent": [
|
|
43
|
+
{
|
|
44
|
+
"pattern": "\\|\\s*passwd\\b"
|
|
45
|
+
},
|
|
46
|
+
{
|
|
47
|
+
"pattern": "\\bpasswd\\s+--stdin\\b"
|
|
48
|
+
},
|
|
49
|
+
{
|
|
50
|
+
"pattern": "\\bchpasswd\\b"
|
|
51
|
+
},
|
|
52
|
+
{
|
|
53
|
+
"pattern": "\\bchgpasswd\\b"
|
|
54
|
+
},
|
|
55
|
+
{
|
|
56
|
+
"pattern": "\\b(newusers|lnewusers)\\b"
|
|
57
|
+
},
|
|
58
|
+
{
|
|
59
|
+
"pattern": "\\bpasswd\\s+-[a-zA-Z]*d\\b"
|
|
60
|
+
},
|
|
61
|
+
{
|
|
62
|
+
"pattern": "\\bpasswd\\s+-[a-zA-Z]*l\\b"
|
|
63
|
+
}
|
|
64
|
+
],
|
|
65
|
+
"user_deletion_consent": [
|
|
66
|
+
{
|
|
67
|
+
"pattern": "\\buserdel\\s"
|
|
68
|
+
},
|
|
69
|
+
{
|
|
70
|
+
"pattern": "\\bdeluser\\s"
|
|
71
|
+
},
|
|
72
|
+
{
|
|
73
|
+
"pattern": "\\bluserdel\\s"
|
|
74
|
+
},
|
|
75
|
+
{
|
|
76
|
+
"pattern": "\\bgroupdel\\s"
|
|
77
|
+
},
|
|
78
|
+
{
|
|
79
|
+
"pattern": "\\blgroupdel\\s"
|
|
80
|
+
}
|
|
81
|
+
]
|
|
82
|
+
}
|
|
@@ -0,0 +1,245 @@
|
|
|
1
|
+
{
|
|
2
|
+
"file_operations": {
|
|
3
|
+
"file_access_guard": [
|
|
4
|
+
"file",
|
|
5
|
+
"文件",
|
|
6
|
+
"path",
|
|
7
|
+
"路径",
|
|
8
|
+
"read",
|
|
9
|
+
"write",
|
|
10
|
+
"cat",
|
|
11
|
+
"open",
|
|
12
|
+
"access",
|
|
13
|
+
"访问",
|
|
14
|
+
"读写",
|
|
15
|
+
"copy",
|
|
16
|
+
"cp",
|
|
17
|
+
"mv",
|
|
18
|
+
"move"
|
|
19
|
+
],
|
|
20
|
+
"script_execution_guard": [
|
|
21
|
+
"command",
|
|
22
|
+
"shell",
|
|
23
|
+
"bash",
|
|
24
|
+
"exec",
|
|
25
|
+
"execute",
|
|
26
|
+
"执行",
|
|
27
|
+
"命令",
|
|
28
|
+
"script",
|
|
29
|
+
"脚本",
|
|
30
|
+
"run",
|
|
31
|
+
"运行",
|
|
32
|
+
"subprocess",
|
|
33
|
+
"system",
|
|
34
|
+
"eval",
|
|
35
|
+
"compile",
|
|
36
|
+
"安装",
|
|
37
|
+
"install",
|
|
38
|
+
"pip",
|
|
39
|
+
"npm"
|
|
40
|
+
],
|
|
41
|
+
"indirect_access_guard": [
|
|
42
|
+
"listdir",
|
|
43
|
+
"os.walk",
|
|
44
|
+
"os.scandir",
|
|
45
|
+
"glob.glob",
|
|
46
|
+
"glob.iglob",
|
|
47
|
+
"pathlib",
|
|
48
|
+
"iterdir",
|
|
49
|
+
"rglob",
|
|
50
|
+
"scandir",
|
|
51
|
+
"os.listdir",
|
|
52
|
+
"目录遍历",
|
|
53
|
+
"traversal"
|
|
54
|
+
]
|
|
55
|
+
},
|
|
56
|
+
"network_security": {
|
|
57
|
+
"data_exfiltration_guard": [
|
|
58
|
+
"upload",
|
|
59
|
+
"上传",
|
|
60
|
+
"send",
|
|
61
|
+
"发送",
|
|
62
|
+
"transfer",
|
|
63
|
+
"传输",
|
|
64
|
+
"export",
|
|
65
|
+
"导出",
|
|
66
|
+
"download",
|
|
67
|
+
"下载",
|
|
68
|
+
"post",
|
|
69
|
+
"http",
|
|
70
|
+
"request",
|
|
71
|
+
"fetch",
|
|
72
|
+
"curl",
|
|
73
|
+
"wget",
|
|
74
|
+
"外传",
|
|
75
|
+
"泄露",
|
|
76
|
+
"exfil",
|
|
77
|
+
"network",
|
|
78
|
+
"网络"
|
|
79
|
+
],
|
|
80
|
+
"browser_web_access_guard": [
|
|
81
|
+
"browser",
|
|
82
|
+
"浏览器",
|
|
83
|
+
"web",
|
|
84
|
+
"网页",
|
|
85
|
+
"url",
|
|
86
|
+
"navigate",
|
|
87
|
+
"浏览",
|
|
88
|
+
"scrape",
|
|
89
|
+
"crawl",
|
|
90
|
+
"爬取",
|
|
91
|
+
"click",
|
|
92
|
+
"screenshot"
|
|
93
|
+
],
|
|
94
|
+
"lateral_movement_guard": [
|
|
95
|
+
"ssh",
|
|
96
|
+
"scp",
|
|
97
|
+
"ftp",
|
|
98
|
+
"sftp",
|
|
99
|
+
"rdp",
|
|
100
|
+
"vnc",
|
|
101
|
+
"telnet",
|
|
102
|
+
"内网",
|
|
103
|
+
"横向",
|
|
104
|
+
"tunnel",
|
|
105
|
+
"代理",
|
|
106
|
+
"proxy",
|
|
107
|
+
"port",
|
|
108
|
+
"端口",
|
|
109
|
+
"scan",
|
|
110
|
+
"扫描",
|
|
111
|
+
"ping",
|
|
112
|
+
"traceroute",
|
|
113
|
+
"nslookup"
|
|
114
|
+
],
|
|
115
|
+
"email_operation_guard": [
|
|
116
|
+
"email",
|
|
117
|
+
"邮件",
|
|
118
|
+
"mail",
|
|
119
|
+
"smtp",
|
|
120
|
+
"send_email",
|
|
121
|
+
"发送邮件",
|
|
122
|
+
"inbox",
|
|
123
|
+
"收件箱",
|
|
124
|
+
"附件",
|
|
125
|
+
"attachment"
|
|
126
|
+
]
|
|
127
|
+
},
|
|
128
|
+
"persistence_supply_chain": {
|
|
129
|
+
"persistence_backdoor_guard": [
|
|
130
|
+
"cron",
|
|
131
|
+
"crontab",
|
|
132
|
+
"定时",
|
|
133
|
+
"scheduled",
|
|
134
|
+
"startup",
|
|
135
|
+
"启动项",
|
|
136
|
+
"service",
|
|
137
|
+
"服务",
|
|
138
|
+
"daemon",
|
|
139
|
+
"守护",
|
|
140
|
+
"registry",
|
|
141
|
+
"注册表",
|
|
142
|
+
"backdoor",
|
|
143
|
+
"后门",
|
|
144
|
+
"persist",
|
|
145
|
+
"持久化",
|
|
146
|
+
"authorized_keys",
|
|
147
|
+
"bashrc",
|
|
148
|
+
"zshrc",
|
|
149
|
+
"profile",
|
|
150
|
+
".rc",
|
|
151
|
+
"shell config",
|
|
152
|
+
"shell 配置"
|
|
153
|
+
],
|
|
154
|
+
"supply_chain_guard": [
|
|
155
|
+
"dependency",
|
|
156
|
+
"依赖",
|
|
157
|
+
"package",
|
|
158
|
+
"包",
|
|
159
|
+
"npm install",
|
|
160
|
+
"pip install",
|
|
161
|
+
"requirements",
|
|
162
|
+
"import",
|
|
163
|
+
"library",
|
|
164
|
+
"库",
|
|
165
|
+
"registry",
|
|
166
|
+
"仓库",
|
|
167
|
+
"supply",
|
|
168
|
+
"供应链",
|
|
169
|
+
"typosquatting"
|
|
170
|
+
],
|
|
171
|
+
"skill_installation_guard": [
|
|
172
|
+
"skill",
|
|
173
|
+
"plugin",
|
|
174
|
+
"插件",
|
|
175
|
+
"extension",
|
|
176
|
+
"扩展",
|
|
177
|
+
"install skill",
|
|
178
|
+
"安装插件",
|
|
179
|
+
"安装技能",
|
|
180
|
+
"marketplace",
|
|
181
|
+
"商店"
|
|
182
|
+
]
|
|
183
|
+
},
|
|
184
|
+
"intent_and_general": {
|
|
185
|
+
"intent_deviation_guard": [
|
|
186
|
+
"rm",
|
|
187
|
+
"del",
|
|
188
|
+
"delete",
|
|
189
|
+
"remove",
|
|
190
|
+
"删除",
|
|
191
|
+
"format",
|
|
192
|
+
"格式化",
|
|
193
|
+
"drop",
|
|
194
|
+
"truncate",
|
|
195
|
+
"清空",
|
|
196
|
+
"wipe",
|
|
197
|
+
"擦除",
|
|
198
|
+
"重置",
|
|
199
|
+
"reset",
|
|
200
|
+
"sudo",
|
|
201
|
+
"root",
|
|
202
|
+
"admin",
|
|
203
|
+
"管理员",
|
|
204
|
+
"privilege",
|
|
205
|
+
"提权"
|
|
206
|
+
],
|
|
207
|
+
"general_tool_risk_guard": [
|
|
208
|
+
"tool",
|
|
209
|
+
"工具",
|
|
210
|
+
"api",
|
|
211
|
+
"invoke",
|
|
212
|
+
"调用",
|
|
213
|
+
"function",
|
|
214
|
+
"函数"
|
|
215
|
+
]
|
|
216
|
+
},
|
|
217
|
+
"resource": {
|
|
218
|
+
"resource_exhaustion_guard": [
|
|
219
|
+
"fork",
|
|
220
|
+
"bomb",
|
|
221
|
+
"炸弹",
|
|
222
|
+
"memory bomb",
|
|
223
|
+
"oom",
|
|
224
|
+
"out of memory",
|
|
225
|
+
"内存溢出",
|
|
226
|
+
"内存耗尽",
|
|
227
|
+
"内存泄漏",
|
|
228
|
+
"disk",
|
|
229
|
+
"磁盘",
|
|
230
|
+
"cpu",
|
|
231
|
+
"process",
|
|
232
|
+
"进程",
|
|
233
|
+
"dd if=",
|
|
234
|
+
"/dev/zero",
|
|
235
|
+
"/dev/null",
|
|
236
|
+
"yes >",
|
|
237
|
+
"while true",
|
|
238
|
+
"无限循环",
|
|
239
|
+
"耗尽",
|
|
240
|
+
"exhaust",
|
|
241
|
+
"资源"
|
|
242
|
+
]
|
|
243
|
+
},
|
|
244
|
+
"user_custom": {}
|
|
245
|
+
}
|