@kenhkl/agent-moss 0.16.13 → 0.16.14
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +958 -1257
- package/dist/engine/coordinator.js +405 -872
- package/dist/rules/formal_rules.json +61 -0
- package/dist/rules/heuristic_rules.json +40 -0
- package/dist/rules/inline_rules.json +151 -0
- package/dist/rules/l1_rules.json +115 -49
- package/dist/rules/logic_rules.json +73 -0
- package/dist/rules/manifest.json +6 -0
- package/dist/rules/platform_traits.json +389 -0
- package/dist/rules/script_rules.json +311 -0
- package/dist/server.js +692 -1013
- package/package.json +1 -1
|
@@ -0,0 +1,61 @@
|
|
|
1
|
+
{
|
|
2
|
+
"_comment": "L2.2 形式化引擎（行为图 + 性质验证）的识别名单（Python engine/formal_engine/* ↔ TS engine/formal-engine/* 单一事实源）。全部为集合成员判断，顺序无意义。",
|
|
3
|
+
"privesc": {
|
|
4
|
+
"_comment": "提权判定的「命令位置」旁证：sudo 后面跟包管理器 → 运维不是提权；跟裸 shell → 提权。",
|
|
5
|
+
"package_managers": [
|
|
6
|
+
"apt",
|
|
7
|
+
"apt-get",
|
|
8
|
+
"aptitude",
|
|
9
|
+
"yum",
|
|
10
|
+
"dnf",
|
|
11
|
+
"pacman",
|
|
12
|
+
"zypper",
|
|
13
|
+
"apk",
|
|
14
|
+
"brew"
|
|
15
|
+
],
|
|
16
|
+
"bare_shells": [
|
|
17
|
+
"bash",
|
|
18
|
+
"sh",
|
|
19
|
+
"zsh",
|
|
20
|
+
"dash",
|
|
21
|
+
"fish",
|
|
22
|
+
"ksh",
|
|
23
|
+
"csh",
|
|
24
|
+
"tcsh",
|
|
25
|
+
"nologin"
|
|
26
|
+
]
|
|
27
|
+
},
|
|
28
|
+
"compute_action_types": [
|
|
29
|
+
"python",
|
|
30
|
+
"node",
|
|
31
|
+
"exec",
|
|
32
|
+
"terminal",
|
|
33
|
+
"cmd"
|
|
34
|
+
],
|
|
35
|
+
"_compute_action_types_comment": "命中的 action_type 一律视为命令执行形态（不论 detail）。",
|
|
36
|
+
"pattern_miner": {
|
|
37
|
+
"_comment": "组合链挖掘的危险阶段与敏感相邻对：命中即认为该链值得报出。",
|
|
38
|
+
"danger_stages": [
|
|
39
|
+
"PRIVESC",
|
|
40
|
+
"EXFIL",
|
|
41
|
+
"LISTEN"
|
|
42
|
+
],
|
|
43
|
+
"sensitive_pairs": [
|
|
44
|
+
[
|
|
45
|
+
"CRED",
|
|
46
|
+
"LISTEN"
|
|
47
|
+
],
|
|
48
|
+
[
|
|
49
|
+
"LISTEN",
|
|
50
|
+
"CRED"
|
|
51
|
+
]
|
|
52
|
+
]
|
|
53
|
+
},
|
|
54
|
+
"_not_moved": "decode 的 _STAGE_PRIORITY（EXFIL/PRIVESC/PERSIST/SCAN/LISTEN 的仲裁顺序）留在代码里 —— 它表达的是「多阶段同时命中时报哪个」的优先级逻辑，不是可以独立增删的规则。",
|
|
55
|
+
"output_commands": [
|
|
56
|
+
"echo",
|
|
57
|
+
"printf",
|
|
58
|
+
"print"
|
|
59
|
+
],
|
|
60
|
+
"_output_commands_comment": "纯输出命令：解码候选里要剥掉其引号内容（grep/cat 等查询类的引号内是搜索词，有安全语义，不能剥）。"
|
|
61
|
+
}
|
|
@@ -0,0 +1,40 @@
|
|
|
1
|
+
{
|
|
2
|
+
"_comment": "L1 特征检测里的小型名单（Python engine/heuristic.py ↔ TS engine/heuristic.ts 单一事实源）。统一为子串/前缀匹配，大小写不敏感（匹配前先转小写）。",
|
|
3
|
+
"sensitive_excluded_prefixes": [
|
|
4
|
+
"memory-",
|
|
5
|
+
"skill-",
|
|
6
|
+
"skill-manager-",
|
|
7
|
+
"mailbox-",
|
|
8
|
+
"app-"
|
|
9
|
+
],
|
|
10
|
+
"_sensitive_excluded_prefixes_comment": "敏感路径检测排除的非文件工具前缀（避免 memory-searchMemory 等误报）。前缀匹配。",
|
|
11
|
+
"search_action_prefixes": [
|
|
12
|
+
"search-",
|
|
13
|
+
"web-",
|
|
14
|
+
"browser-",
|
|
15
|
+
"query-",
|
|
16
|
+
"websearch",
|
|
17
|
+
"web_search"
|
|
18
|
+
],
|
|
19
|
+
"search_action_exact": [
|
|
20
|
+
"websearch",
|
|
21
|
+
"web_search",
|
|
22
|
+
"search",
|
|
23
|
+
"query"
|
|
24
|
+
],
|
|
25
|
+
"_search_action_comment": "搜索/查询类工具：其 action_detail 是「查询数据」（如 query=...）不是指令，注入关键词检测跳过它，否则搜「jailbreak」资料会被误判为注入。命中口径 = 前缀匹配(search_action_prefixes) 或 精确名(search_action_exact)。",
|
|
26
|
+
"loopback_hosts": [
|
|
27
|
+
"localhost",
|
|
28
|
+
"::1",
|
|
29
|
+
"0.0.0.0",
|
|
30
|
+
"[::1]"
|
|
31
|
+
],
|
|
32
|
+
"_loopback_hosts_comment": "回环地址豁免名单（另加 127.* 前缀）。命令里所有 http(s) URL 都在回环 → 不判外传。",
|
|
33
|
+
"temp_dirs": [
|
|
34
|
+
"/tmp",
|
|
35
|
+
"/var/tmp",
|
|
36
|
+
"/run",
|
|
37
|
+
"/dev/shm"
|
|
38
|
+
],
|
|
39
|
+
"_temp_dirs_comment": "临时目录（批量删除豁免）。L1 的 _check_dangerous_patterns 与 L2 的 read_before_write 共用这一份；调用方按需拼尾随斜杠做 startswith。"
|
|
40
|
+
}
|
|
@@ -0,0 +1,151 @@
|
|
|
1
|
+
{
|
|
2
|
+
"_comment": "内联脚本静态语义判定的识别词表（Python inline_analyzer ↔ TS inline-analyzer 单一事实源）。read_write_keywords 与 dir_traversal_keywords 为子串匹配（被匹配文本先转小写）；write_exec_chain_patterns 的 flags 是语义标志（i=忽略大小写、s=点匹配换行），TS 侧另加 g 用于循环匹配（不参与语义）。",
|
|
3
|
+
"read_write_keywords": [
|
|
4
|
+
"open(",
|
|
5
|
+
"read(",
|
|
6
|
+
"write(",
|
|
7
|
+
"fopen(",
|
|
8
|
+
"system(",
|
|
9
|
+
"exec(",
|
|
10
|
+
"eval(",
|
|
11
|
+
"popen(",
|
|
12
|
+
"load(",
|
|
13
|
+
"dump(",
|
|
14
|
+
"readline",
|
|
15
|
+
"readlines",
|
|
16
|
+
"writelines",
|
|
17
|
+
"getpass",
|
|
18
|
+
"pickle.load",
|
|
19
|
+
"yaml.load",
|
|
20
|
+
"json.load",
|
|
21
|
+
"json.read",
|
|
22
|
+
"configparser",
|
|
23
|
+
"fread",
|
|
24
|
+
"fwrite",
|
|
25
|
+
"fgets",
|
|
26
|
+
"os.system",
|
|
27
|
+
"os.popen",
|
|
28
|
+
"subprocess",
|
|
29
|
+
"os.exec",
|
|
30
|
+
"os.spawn",
|
|
31
|
+
"import os",
|
|
32
|
+
"import subprocess",
|
|
33
|
+
"shell=true",
|
|
34
|
+
"check_output",
|
|
35
|
+
"check_call",
|
|
36
|
+
"run(",
|
|
37
|
+
"getattr(",
|
|
38
|
+
"__builtins__",
|
|
39
|
+
"globals(",
|
|
40
|
+
"locals(",
|
|
41
|
+
"file_get_contents",
|
|
42
|
+
"file_put_contents",
|
|
43
|
+
"passthru",
|
|
44
|
+
"shell_exec",
|
|
45
|
+
"proc_open",
|
|
46
|
+
"<stdin>",
|
|
47
|
+
"open my",
|
|
48
|
+
"readfilesync(",
|
|
49
|
+
"writefilesync(",
|
|
50
|
+
"appendfilesync(",
|
|
51
|
+
"unlinksync(",
|
|
52
|
+
"rmsync(",
|
|
53
|
+
"mkdirsync(",
|
|
54
|
+
"execsync(",
|
|
55
|
+
"spawnsync(",
|
|
56
|
+
"execfile",
|
|
57
|
+
"createreadstream",
|
|
58
|
+
"createwritestream",
|
|
59
|
+
"fs.read",
|
|
60
|
+
"fs.write",
|
|
61
|
+
"fs.promises",
|
|
62
|
+
"require('fs')",
|
|
63
|
+
"require(\"fs\")",
|
|
64
|
+
"require('node:fs')",
|
|
65
|
+
"require(\"node:fs\")",
|
|
66
|
+
"require('child_process')",
|
|
67
|
+
"require(\"child_process\")",
|
|
68
|
+
"require('https')",
|
|
69
|
+
"require(\"https\")"
|
|
70
|
+
],
|
|
71
|
+
"dir_traversal_keywords": [
|
|
72
|
+
"os.listdir",
|
|
73
|
+
"os.walk",
|
|
74
|
+
"os.scandir",
|
|
75
|
+
"glob.glob",
|
|
76
|
+
"glob.iglob",
|
|
77
|
+
"pathlib.",
|
|
78
|
+
"iterdir",
|
|
79
|
+
"rglob",
|
|
80
|
+
"scandir(",
|
|
81
|
+
"listdir("
|
|
82
|
+
],
|
|
83
|
+
"write_exec_chain_patterns": [
|
|
84
|
+
{
|
|
85
|
+
"pattern": "(?:echo|cat|printf)\\b.*?>\\s*\\S+.*(?:&&|;|\\|)\\s*(?:bash|sh|zsh|python\\d?|perl|ruby|node|php)\\s",
|
|
86
|
+
"flags": "is"
|
|
87
|
+
},
|
|
88
|
+
{
|
|
89
|
+
"pattern": "\\|\\s*(?:bash|sh|zsh|python\\d?|perl|ruby|node|php)\\b",
|
|
90
|
+
"flags": "i"
|
|
91
|
+
},
|
|
92
|
+
{
|
|
93
|
+
"pattern": "eval\\s+\\\"\\$\\(",
|
|
94
|
+
"flags": "i"
|
|
95
|
+
},
|
|
96
|
+
{
|
|
97
|
+
"pattern": "\\|\\s*xargs\\s+(?:bash|sh|zsh)",
|
|
98
|
+
"flags": "i"
|
|
99
|
+
}
|
|
100
|
+
],
|
|
101
|
+
"redirect_sensitive_paths": {
|
|
102
|
+
"_comment": "「重定向写到敏感路径」的路径清单。**两端口径本就不同，此处只做搬家、未统一**：Python 优先用 profile.sensitive_paths 动态编译（含 ~/.bashrc 等），python_fallback 仅在没有 profile 时兜底（生产不触发）；TS 无 profile 注入，用 ts_static + shell_rc_fragments 静态拼。统一两端口径是独立事项，改动会直接改变判定，不要顺手做。",
|
|
103
|
+
"python_fallback": [
|
|
104
|
+
"/etc/shadow",
|
|
105
|
+
"/etc/gshadow",
|
|
106
|
+
"/etc/passwd",
|
|
107
|
+
"/etc/sudoers",
|
|
108
|
+
"/etc/hosts",
|
|
109
|
+
"/etc/crontab",
|
|
110
|
+
"/etc/systemd/",
|
|
111
|
+
"/etc/ssh/sshd_config",
|
|
112
|
+
"/etc/pam.d/",
|
|
113
|
+
"/etc/nginx/nginx.conf",
|
|
114
|
+
"/etc/nginx/conf.d/",
|
|
115
|
+
"/etc/nginx/sites-enabled/",
|
|
116
|
+
"/boot/",
|
|
117
|
+
"/proc/sys/",
|
|
118
|
+
"/sys/",
|
|
119
|
+
"/dev/mem",
|
|
120
|
+
"/dev/kmsg",
|
|
121
|
+
".ssh/id_rsa",
|
|
122
|
+
".ssh/id_ed25519",
|
|
123
|
+
".ssh/authorized_keys"
|
|
124
|
+
],
|
|
125
|
+
"ts_static": [
|
|
126
|
+
"/etc/shadow",
|
|
127
|
+
"/etc/gshadow",
|
|
128
|
+
"/etc/passwd",
|
|
129
|
+
"/etc/sudoers",
|
|
130
|
+
"/etc/hosts",
|
|
131
|
+
"/etc/crontab",
|
|
132
|
+
"/etc/systemd/",
|
|
133
|
+
"/etc/ssh/sshd_config",
|
|
134
|
+
"/boot/",
|
|
135
|
+
"/proc/sys/",
|
|
136
|
+
"/sys/",
|
|
137
|
+
"/dev/mem",
|
|
138
|
+
"/dev/kmsg",
|
|
139
|
+
".ssh/id_rsa",
|
|
140
|
+
".ssh/id_ed25519",
|
|
141
|
+
".ssh/authorized_keys"
|
|
142
|
+
],
|
|
143
|
+
"shell_rc_fragments": [
|
|
144
|
+
".bashrc",
|
|
145
|
+
".zshrc",
|
|
146
|
+
".profile",
|
|
147
|
+
".bash_profile",
|
|
148
|
+
".zprofile"
|
|
149
|
+
]
|
|
150
|
+
}
|
|
151
|
+
}
|
package/dist/rules/l1_rules.json
CHANGED
|
@@ -1417,242 +1417,308 @@
|
|
|
1417
1417
|
{
|
|
1418
1418
|
"keyword": "ignore previous instructions",
|
|
1419
1419
|
"risk_level": "critical",
|
|
1420
|
-
"lang": "en"
|
|
1420
|
+
"lang": "en",
|
|
1421
|
+
"os": "all"
|
|
1421
1422
|
},
|
|
1422
1423
|
{
|
|
1423
1424
|
"keyword": "ignore all previous",
|
|
1424
1425
|
"risk_level": "critical",
|
|
1425
|
-
"lang": "en"
|
|
1426
|
+
"lang": "en",
|
|
1427
|
+
"os": "all"
|
|
1426
1428
|
},
|
|
1427
1429
|
{
|
|
1428
1430
|
"keyword": "disregard all prior",
|
|
1429
1431
|
"risk_level": "critical",
|
|
1430
|
-
"lang": "en"
|
|
1432
|
+
"lang": "en",
|
|
1433
|
+
"os": "all"
|
|
1431
1434
|
},
|
|
1432
1435
|
{
|
|
1433
1436
|
"keyword": "forget everything",
|
|
1434
1437
|
"risk_level": "high",
|
|
1435
|
-
"lang": "en"
|
|
1438
|
+
"lang": "en",
|
|
1439
|
+
"os": "all"
|
|
1436
1440
|
},
|
|
1437
1441
|
{
|
|
1438
1442
|
"keyword": "忽略之前的指令",
|
|
1439
1443
|
"risk_level": "critical",
|
|
1440
|
-
"lang": "zh"
|
|
1444
|
+
"lang": "zh",
|
|
1445
|
+
"os": "all"
|
|
1441
1446
|
},
|
|
1442
1447
|
{
|
|
1443
1448
|
"keyword": "忽略所有先前的",
|
|
1444
1449
|
"risk_level": "critical",
|
|
1445
|
-
"lang": "zh"
|
|
1450
|
+
"lang": "zh",
|
|
1451
|
+
"os": "all"
|
|
1446
1452
|
},
|
|
1447
1453
|
{
|
|
1448
1454
|
"keyword": "忽略上面所有",
|
|
1449
1455
|
"risk_level": "high",
|
|
1450
|
-
"lang": "zh"
|
|
1456
|
+
"lang": "zh",
|
|
1457
|
+
"os": "all"
|
|
1451
1458
|
},
|
|
1452
1459
|
{
|
|
1453
1460
|
"keyword": "请忘记之前",
|
|
1454
1461
|
"risk_level": "high",
|
|
1455
|
-
"lang": "zh"
|
|
1462
|
+
"lang": "zh",
|
|
1463
|
+
"os": "all"
|
|
1456
1464
|
},
|
|
1457
1465
|
{
|
|
1458
1466
|
"keyword": "you are now",
|
|
1459
1467
|
"risk_level": "high",
|
|
1460
|
-
"lang": "en"
|
|
1468
|
+
"lang": "en",
|
|
1469
|
+
"os": "all"
|
|
1461
1470
|
},
|
|
1462
1471
|
{
|
|
1463
1472
|
"keyword": "you are no longer",
|
|
1464
1473
|
"risk_level": "high",
|
|
1465
|
-
"lang": "en"
|
|
1474
|
+
"lang": "en",
|
|
1475
|
+
"os": "all"
|
|
1466
1476
|
},
|
|
1467
1477
|
{
|
|
1468
1478
|
"keyword": "new instructions",
|
|
1469
1479
|
"risk_level": "high",
|
|
1470
|
-
"lang": "en"
|
|
1480
|
+
"lang": "en",
|
|
1481
|
+
"os": "all"
|
|
1471
1482
|
},
|
|
1472
1483
|
{
|
|
1473
1484
|
"keyword": "from now on, you",
|
|
1474
1485
|
"risk_level": "high",
|
|
1475
|
-
"lang": "en"
|
|
1486
|
+
"lang": "en",
|
|
1487
|
+
"os": "all"
|
|
1476
1488
|
},
|
|
1477
1489
|
{
|
|
1478
1490
|
"keyword": "你现在是一个",
|
|
1479
1491
|
"risk_level": "high",
|
|
1480
|
-
"lang": "zh"
|
|
1492
|
+
"lang": "zh",
|
|
1493
|
+
"os": "all"
|
|
1481
1494
|
},
|
|
1482
1495
|
{
|
|
1483
1496
|
"keyword": "你不再是一个",
|
|
1484
1497
|
"risk_level": "high",
|
|
1485
|
-
"lang": "zh"
|
|
1498
|
+
"lang": "zh",
|
|
1499
|
+
"os": "all"
|
|
1486
1500
|
},
|
|
1487
1501
|
{
|
|
1488
1502
|
"keyword": "从现在开始你",
|
|
1489
1503
|
"risk_level": "high",
|
|
1490
|
-
"lang": "zh"
|
|
1504
|
+
"lang": "zh",
|
|
1505
|
+
"os": "all"
|
|
1491
1506
|
},
|
|
1492
1507
|
{
|
|
1493
1508
|
"keyword": "你的新角色是",
|
|
1494
1509
|
"risk_level": "high",
|
|
1495
|
-
"lang": "zh"
|
|
1510
|
+
"lang": "zh",
|
|
1511
|
+
"os": "all"
|
|
1496
1512
|
},
|
|
1497
1513
|
{
|
|
1498
1514
|
"keyword": "system prompt",
|
|
1499
1515
|
"risk_level": "high",
|
|
1500
|
-
"lang": "en"
|
|
1516
|
+
"lang": "en",
|
|
1517
|
+
"os": "all"
|
|
1501
1518
|
},
|
|
1502
1519
|
{
|
|
1503
1520
|
"keyword": "reveal your instructions",
|
|
1504
1521
|
"risk_level": "high",
|
|
1505
|
-
"lang": "en"
|
|
1522
|
+
"lang": "en",
|
|
1523
|
+
"os": "all"
|
|
1506
1524
|
},
|
|
1507
1525
|
{
|
|
1508
1526
|
"keyword": "output your instructions",
|
|
1509
1527
|
"risk_level": "high",
|
|
1510
|
-
"lang": "en"
|
|
1528
|
+
"lang": "en",
|
|
1529
|
+
"os": "all"
|
|
1511
1530
|
},
|
|
1512
1531
|
{
|
|
1513
1532
|
"keyword": "repeat your instructions",
|
|
1514
1533
|
"risk_level": "medium",
|
|
1515
|
-
"lang": "en"
|
|
1534
|
+
"lang": "en",
|
|
1535
|
+
"os": "all"
|
|
1516
1536
|
},
|
|
1517
1537
|
{
|
|
1518
1538
|
"keyword": "系统提示",
|
|
1519
1539
|
"risk_level": "high",
|
|
1520
|
-
"lang": "zh"
|
|
1540
|
+
"lang": "zh",
|
|
1541
|
+
"os": "all"
|
|
1521
1542
|
},
|
|
1522
1543
|
{
|
|
1523
1544
|
"keyword": "输出你的指令",
|
|
1524
1545
|
"risk_level": "high",
|
|
1525
|
-
"lang": "zh"
|
|
1546
|
+
"lang": "zh",
|
|
1547
|
+
"os": "all"
|
|
1526
1548
|
},
|
|
1527
1549
|
{
|
|
1528
1550
|
"keyword": "重复你的指令",
|
|
1529
1551
|
"risk_level": "medium",
|
|
1530
|
-
"lang": "zh"
|
|
1552
|
+
"lang": "zh",
|
|
1553
|
+
"os": "all"
|
|
1531
1554
|
},
|
|
1532
1555
|
{
|
|
1533
1556
|
"keyword": "this is an authorized test",
|
|
1534
1557
|
"risk_level": "high",
|
|
1535
|
-
"lang": "en"
|
|
1558
|
+
"lang": "en",
|
|
1559
|
+
"os": "all"
|
|
1536
1560
|
},
|
|
1537
1561
|
{
|
|
1538
1562
|
"keyword": "security audit approved",
|
|
1539
1563
|
"risk_level": "high",
|
|
1540
|
-
"lang": "en"
|
|
1564
|
+
"lang": "en",
|
|
1565
|
+
"os": "all"
|
|
1541
1566
|
},
|
|
1542
1567
|
{
|
|
1543
1568
|
"keyword": "admin override",
|
|
1544
1569
|
"risk_level": "critical",
|
|
1545
|
-
"lang": "en"
|
|
1570
|
+
"lang": "en",
|
|
1571
|
+
"os": "all"
|
|
1546
1572
|
},
|
|
1547
1573
|
{
|
|
1548
1574
|
"keyword": "debug mode",
|
|
1549
1575
|
"risk_level": "high",
|
|
1550
|
-
"lang": "en"
|
|
1576
|
+
"lang": "en",
|
|
1577
|
+
"os": "all"
|
|
1551
1578
|
},
|
|
1552
1579
|
{
|
|
1553
1580
|
"keyword": "maintenance mode",
|
|
1554
1581
|
"risk_level": "high",
|
|
1555
|
-
"lang": "en"
|
|
1582
|
+
"lang": "en",
|
|
1583
|
+
"os": "all"
|
|
1556
1584
|
},
|
|
1557
1585
|
{
|
|
1558
1586
|
"keyword": "这是授权的测试",
|
|
1559
1587
|
"risk_level": "high",
|
|
1560
|
-
"lang": "zh"
|
|
1588
|
+
"lang": "zh",
|
|
1589
|
+
"os": "all"
|
|
1561
1590
|
},
|
|
1562
1591
|
{
|
|
1563
1592
|
"keyword": "安全审计已批准",
|
|
1564
1593
|
"risk_level": "high",
|
|
1565
|
-
"lang": "zh"
|
|
1594
|
+
"lang": "zh",
|
|
1595
|
+
"os": "all"
|
|
1566
1596
|
},
|
|
1567
1597
|
{
|
|
1568
1598
|
"keyword": "管理员覆盖",
|
|
1569
1599
|
"risk_level": "critical",
|
|
1570
|
-
"lang": "zh"
|
|
1600
|
+
"lang": "zh",
|
|
1601
|
+
"os": "all"
|
|
1571
1602
|
},
|
|
1572
1603
|
{
|
|
1573
1604
|
"keyword": "调试模式",
|
|
1574
1605
|
"risk_level": "high",
|
|
1575
|
-
"lang": "zh"
|
|
1606
|
+
"lang": "zh",
|
|
1607
|
+
"os": "all"
|
|
1576
1608
|
},
|
|
1577
1609
|
{
|
|
1578
1610
|
"keyword": "<script>",
|
|
1579
1611
|
"risk_level": "high",
|
|
1580
|
-
"lang": "en"
|
|
1612
|
+
"lang": "en",
|
|
1613
|
+
"os": "all"
|
|
1581
1614
|
},
|
|
1582
1615
|
{
|
|
1583
1616
|
"keyword": "javascript:",
|
|
1584
1617
|
"risk_level": "high",
|
|
1585
|
-
"lang": "en"
|
|
1618
|
+
"lang": "en",
|
|
1619
|
+
"os": "all"
|
|
1586
1620
|
},
|
|
1587
1621
|
{
|
|
1588
1622
|
"keyword": "onerror=",
|
|
1589
1623
|
"risk_level": "high",
|
|
1590
|
-
"lang": "en"
|
|
1624
|
+
"lang": "en",
|
|
1625
|
+
"os": "all"
|
|
1591
1626
|
},
|
|
1592
1627
|
{
|
|
1593
1628
|
"keyword": "onload=",
|
|
1594
1629
|
"risk_level": "high",
|
|
1595
|
-
"lang": "en"
|
|
1630
|
+
"lang": "en",
|
|
1631
|
+
"os": "all"
|
|
1596
1632
|
},
|
|
1597
1633
|
{
|
|
1598
1634
|
"keyword": "=== END OF",
|
|
1599
1635
|
"risk_level": "high",
|
|
1600
|
-
"lang": "en"
|
|
1636
|
+
"lang": "en",
|
|
1637
|
+
"os": "all"
|
|
1601
1638
|
},
|
|
1602
1639
|
{
|
|
1603
1640
|
"keyword": "--- END SYSTEM",
|
|
1604
1641
|
"risk_level": "high",
|
|
1605
|
-
"lang": "en"
|
|
1642
|
+
"lang": "en",
|
|
1643
|
+
"os": "all"
|
|
1606
1644
|
},
|
|
1607
1645
|
{
|
|
1608
1646
|
"keyword": "[END OF",
|
|
1609
1647
|
"risk_level": "high",
|
|
1610
|
-
"lang": "en"
|
|
1648
|
+
"lang": "en",
|
|
1649
|
+
"os": "all"
|
|
1611
1650
|
},
|
|
1612
1651
|
{
|
|
1613
1652
|
"keyword": "=== 结束",
|
|
1614
1653
|
"risk_level": "high",
|
|
1615
|
-
"lang": "zh"
|
|
1654
|
+
"lang": "zh",
|
|
1655
|
+
"os": "all"
|
|
1616
1656
|
},
|
|
1617
1657
|
{
|
|
1618
1658
|
"keyword": "--- 结束系统",
|
|
1619
1659
|
"risk_level": "high",
|
|
1620
|
-
"lang": "zh"
|
|
1660
|
+
"lang": "zh",
|
|
1661
|
+
"os": "all"
|
|
1621
1662
|
},
|
|
1622
1663
|
{
|
|
1623
1664
|
"keyword": "developer mode",
|
|
1624
1665
|
"risk_level": "critical",
|
|
1625
|
-
"lang": "en"
|
|
1666
|
+
"lang": "en",
|
|
1667
|
+
"os": "all"
|
|
1626
1668
|
},
|
|
1627
1669
|
{
|
|
1628
1670
|
"keyword": "DAN mode",
|
|
1629
1671
|
"risk_level": "critical",
|
|
1630
|
-
"lang": "en"
|
|
1672
|
+
"lang": "en",
|
|
1673
|
+
"os": "all"
|
|
1631
1674
|
},
|
|
1632
1675
|
{
|
|
1633
1676
|
"keyword": "jailbreak",
|
|
1634
1677
|
"risk_level": "critical",
|
|
1635
|
-
"lang": "en"
|
|
1678
|
+
"lang": "en",
|
|
1679
|
+
"os": "all"
|
|
1636
1680
|
},
|
|
1637
1681
|
{
|
|
1638
1682
|
"keyword": "开发者模式",
|
|
1639
1683
|
"risk_level": "critical",
|
|
1640
|
-
"lang": "zh"
|
|
1684
|
+
"lang": "zh",
|
|
1685
|
+
"os": "all"
|
|
1641
1686
|
},
|
|
1642
1687
|
{
|
|
1643
1688
|
"keyword": "越狱",
|
|
1644
1689
|
"risk_level": "critical",
|
|
1645
|
-
"lang": "zh"
|
|
1690
|
+
"lang": "zh",
|
|
1691
|
+
"os": "all"
|
|
1646
1692
|
},
|
|
1647
1693
|
{
|
|
1648
1694
|
"keyword": "ignore all security",
|
|
1649
1695
|
"risk_level": "critical",
|
|
1650
|
-
"lang": "en"
|
|
1696
|
+
"lang": "en",
|
|
1697
|
+
"os": "all"
|
|
1651
1698
|
},
|
|
1652
1699
|
{
|
|
1653
1700
|
"keyword": "bypass audit",
|
|
1654
1701
|
"risk_level": "high",
|
|
1655
|
-
"lang": "en"
|
|
1702
|
+
"lang": "en",
|
|
1703
|
+
"os": "all"
|
|
1704
|
+
},
|
|
1705
|
+
{
|
|
1706
|
+
"keyword": "disable guard",
|
|
1707
|
+
"risk_level": "critical",
|
|
1708
|
+
"lang": "en",
|
|
1709
|
+
"os": "windows"
|
|
1710
|
+
},
|
|
1711
|
+
{
|
|
1712
|
+
"keyword": "绕过审计",
|
|
1713
|
+
"risk_level": "critical",
|
|
1714
|
+
"lang": "zh",
|
|
1715
|
+
"os": "windows"
|
|
1716
|
+
},
|
|
1717
|
+
{
|
|
1718
|
+
"keyword": "禁用安全检查",
|
|
1719
|
+
"risk_level": "critical",
|
|
1720
|
+
"lang": "zh",
|
|
1721
|
+
"os": "windows"
|
|
1656
1722
|
}
|
|
1657
1723
|
],
|
|
1658
1724
|
"sensitive_path_access": [
|
|
@@ -2328,4 +2394,4 @@
|
|
|
2328
2394
|
}
|
|
2329
2395
|
],
|
|
2330
2396
|
"_comment": "\n2026-09-11 新增：iptables 防火墙规则修改（T1562.004）+ SSH 跳过密钥验证（横向移动），原在 user_rules.json 下沉至此——攻击形态清晰、可静态判定，user_rules 回归仅存用户自定义例外的本位。"
|
|
2331
|
-
}
|
|
2397
|
+
}
|
|
@@ -0,0 +1,73 @@
|
|
|
1
|
+
{
|
|
2
|
+
"_comment": "L2 逻辑规则的识别词表（Python engine/logic_rules.py ↔ TS engine/logic-rules.ts 单一事实源）。全部为子串匹配，被匹配文本先转小写。",
|
|
3
|
+
"_dir_traversal_note": "目录遍历词表不在这里：它复用 inline_rules.json 的 dir_traversal_keywords —— 两处原本就是逐字相同的 10 条，再放一份就是给自己造双份维护。",
|
|
4
|
+
"indirect_file_access": {
|
|
5
|
+
"_comment": "间接文件访问（Rule 4.5）：内联脚本用目录遍历动态发现文件 + 读写/执行调用。四组词分别决定「有没有文件操作」和「是读还是写/执行」—— 写/执行时所有敏感文件都拦，只读时只拦凭据文件。",
|
|
6
|
+
"read_keywords": [
|
|
7
|
+
"read(",
|
|
8
|
+
"readline",
|
|
9
|
+
"readlines",
|
|
10
|
+
"fread",
|
|
11
|
+
"fgets",
|
|
12
|
+
"load(",
|
|
13
|
+
"getpass",
|
|
14
|
+
"file_get_contents"
|
|
15
|
+
],
|
|
16
|
+
"write_keywords": [
|
|
17
|
+
"write(",
|
|
18
|
+
"writelines",
|
|
19
|
+
"fwrite",
|
|
20
|
+
"file_put_contents"
|
|
21
|
+
],
|
|
22
|
+
"exec_keywords": [
|
|
23
|
+
"system(",
|
|
24
|
+
"exec(",
|
|
25
|
+
"eval(",
|
|
26
|
+
"popen(",
|
|
27
|
+
"os.system",
|
|
28
|
+
"os.popen",
|
|
29
|
+
"subprocess",
|
|
30
|
+
"os.exec",
|
|
31
|
+
"os.spawn",
|
|
32
|
+
"shell=true",
|
|
33
|
+
"check_output",
|
|
34
|
+
"check_call",
|
|
35
|
+
"run(",
|
|
36
|
+
"passthru",
|
|
37
|
+
"shell_exec",
|
|
38
|
+
"proc_open"
|
|
39
|
+
],
|
|
40
|
+
"open_keywords": [
|
|
41
|
+
"open(",
|
|
42
|
+
"fopen("
|
|
43
|
+
]
|
|
44
|
+
},
|
|
45
|
+
"_more": "另有几组「谁算写操作 / 谁算临时目录」的通用名单，原先散在 logic_rules.py 的三个函数里各写一份。",
|
|
46
|
+
"non_write_tool_prefixes": [
|
|
47
|
+
"memory-",
|
|
48
|
+
"skill-manager-",
|
|
49
|
+
"mailbox-",
|
|
50
|
+
"app-"
|
|
51
|
+
],
|
|
52
|
+
"_non_write_tool_prefixes_comment": "写判定豁免的非写工具前缀（不含 skill-，与 heuristic 的敏感路径排除名单刻意差一项）。",
|
|
53
|
+
"write_commands": [
|
|
54
|
+
"cp",
|
|
55
|
+
"mv",
|
|
56
|
+
"install",
|
|
57
|
+
"tee",
|
|
58
|
+
"dd",
|
|
59
|
+
"truncate",
|
|
60
|
+
"mkfs",
|
|
61
|
+
"fdisk",
|
|
62
|
+
"parted"
|
|
63
|
+
],
|
|
64
|
+
"_write_commands_comment": "写/删命令集合（逐段首词判定，供重定向/通配判定用）。",
|
|
65
|
+
"source_arg_commands": [
|
|
66
|
+
"cp",
|
|
67
|
+
"mv",
|
|
68
|
+
"install",
|
|
69
|
+
"rsync"
|
|
70
|
+
],
|
|
71
|
+
"_source_arg_commands_comment": "第一个位置参数是「源文件」的命令：源在敏感目录 → 视为读取。",
|
|
72
|
+
"_reused": "不重复存的两组：① 写/删命令词边界正则 = platform_traits.json 的 write_command_res（逐字相同）；② 工具排除前缀 = heuristic_rules.json 的 sensitive_excluded_prefixes（逐字相同）；③ 临时目录名单 = heuristic_rules.json 的 temp_dirs（L1/L2 共用一份）。"
|
|
73
|
+
}
|