@kenhkl/agent-moss 0.16.13 → 0.16.14

package/dist/rules/manifest.json

@@ -0,0 +1,6 @@
+{
+  "_comment": "规则包清单。schema_version 是**契约**：引擎启动时按自己认识的版本校验，不匹配直接报错（不会'读不懂就当空'）。结构有破坏性变更时才 +1；新增文件/新增可选键不用动。",
+  "schema_version": 1,
+  "name": "agent-moss-rules",
+  "description": "AgentMoss 内置规则包：L1/L2/L3 规则、平台特征、脚本与形式化引擎识别名单。契约与校验见 agent_moss/rules_contract.py。"
+}

package/dist/rules/platform_traits.json

@@ -0,0 +1,389 @@
+{
+  "_comment": [
+    "平台行为特征（Platform Traits）—— 双端共用的单一事实源。",
+    "Python: agent_moss/profiles/*.py  ← rules_loader.load_platform_traits()",
+    "TS:     ts/src/engine/platform-traits.ts ← rules-loader.loadPlatformTraits()",
+    "",
+    "这些不是『检测规则』而是『放行/豁免的边界』，直接决定判定的宽严，改动务必谨慎：",
+    "  fully_safe_commands            首段命令命中 → 跳过 L2 + L3",
+    "  readonly_sensitive_commands    首段命令命中 → 跳 L3，保留 L2（L1 敏感路径照常）",
+    "  read_only_commands             命令词命中 → 重定向 > 视为输出而非写文件",
+    "  write_command_res              命令词命中 → 视为写/删意图（词边界正则）",
+    "  write_keywords / read_keywords 意图关键词（子串匹配，不加词边界）",
+    "  safe_action_types              action_type 命中 → 跳过 L2 + L3",
+    "  readonly_sensitive_action_types action_type 命中 → 跳 L3，保留 L2",
+    "",
+    "macos / harmony 继承 linux（同为类 Unix 命令集），只写 inherits 即可。",
+    "列表类字段保持顺序（与源码一致）；集合类字段（read_only_commands / safe_action_types /",
+    "readonly_sensitive_action_types）已按字典序排列 —— 仅做成员判断，顺序无语义。",
+    "改动后自查：python3 -m pytest tests/test_platform_traits.py"
+  ],
+  "_schema": 1,
+  "linux": {
+    "write_keywords": [
+      "write",
+      "写入",
+      "save",
+      "保存",
+      "modify",
+      "修改",
+      "update",
+      "更新",
+      "delete",
+      "删除",
+      "remove",
+      "移除",
+      "create",
+      "创建",
+      "append",
+      "追加",
+      "truncate",
+      "截断",
+      "overwrite",
+      "覆盖",
+      "replace",
+      "替换",
+      "edit"
+    ],
+    "read_keywords": [
+      "read",
+      "读取",
+      "cat",
+      "head",
+      "tail",
+      "less",
+      "more",
+      "view",
+      "查看",
+      "open",
+      "打开",
+      "load",
+      "加载",
+      "grep",
+      "search",
+      "搜索",
+      "find",
+      "查找"
+    ],
+    "write_command_res": [
+      "\\brm\\b",
+      "\\bunlink\\b",
+      "\\brmdir\\b",
+      "\\bshred\\b",
+      "\\bcp\\b",
+      "\\bmv\\b",
+      "\\binstall\\b",
+      "\\btee\\b",
+      "\\bdd\\b",
+      "\\bmkfs\\b",
+      "\\b(fdisk|parted|cfdisk|sfdisk)\\b",
+      "\\bchmod\\b",
+      "\\bchown\\b",
+      "\\btruncate\\b"
+    ],
+    "read_only_commands": [
+      "arch",
+      "arp",
+      "awk",
+      "blockdev",
+      "cat",
+      "cut",
+      "df",
+      "dir",
+      "dmesg",
+      "dmidecode",
+      "du",
+      "echo",
+      "ethtool",
+      "fdisk",
+      "file",
+      "find",
+      "free",
+      "getconf",
+      "getent",
+      "grep",
+      "head",
+      "hexdump",
+      "hostnamectl",
+      "hwinfo",
+      "id",
+      "ifconfig",
+      "inxi",
+      "iostat",
+      "ip",
+      "journalctl",
+      "last",
+      "less",
+      "localectl",
+      "ls",
+      "lsblk",
+      "lscpu",
+      "lsmem",
+      "lsmod",
+      "lsns",
+      "lsof",
+      "lspci",
+      "lsusb",
+      "modinfo",
+      "more",
+      "mpstat",
+      "netstat",
+      "nl",
+      "nmcli",
+      "nproc",
+      "od",
+      "parted",
+      "pgrep",
+      "pidof",
+      "printf",
+      "ps",
+      "rev",
+      "route",
+      "sed",
+      "smartctl",
+      "sort",
+      "ss",
+      "stat",
+      "strings",
+      "sysctl",
+      "systemctl",
+      "tac",
+      "tail",
+      "timedatectl",
+      "top",
+      "tr",
+      "tree",
+      "udevadm",
+      "uname",
+      "uniq",
+      "uptime",
+      "vmstat",
+      "w",
+      "wc",
+      "who",
+      "whoami",
+      "xxd"
+    ],
+    "fully_safe_commands": [
+      "^ls(?:\\s|$)",
+      "^dir(?:\\s|$)",
+      "^pwd(?:\\s|$)",
+      "^which\\s+",
+      "^whereis\\s+",
+      "^realpath\\s+",
+      "^basename\\s+",
+      "^dirname\\s+",
+      "^file\\s+",
+      "^stat\\s+",
+      "^du(?:\\s|$)",
+      "^echo\\s+",
+      "^printf\\s+",
+      "^type\\s+",
+      "^command\\s+",
+      "^whoami(?:\\s|$)",
+      "^id(?:\\s|$)",
+      "^hostname(?:\\s|$)",
+      "^uname(?:\\s|$)",
+      "^date(?:\\s|$)",
+      "^env(?:\\s|$)",
+      "^printenv(?:\\s|$)",
+      "^tty(?:\\s|$)",
+      "^arch(?:\\s|$)",
+      "^uptime(?:\\s|$)",
+      "^groups(?:\\s|$)",
+      "^logname(?:\\s|$)",
+      "^df(?:\\s|$)",
+      "^free(?:\\s|$)",
+      "^vmstat(?:\\s|$)",
+      "^nproc(?:\\s|$)",
+      "^lscpu(?:\\s|$)",
+      "^lsblk(?:\\s|$)",
+      "^lspci(?:\\s|$)",
+      "^lsusb(?:\\s|$)",
+      "^lsmod(?:\\s|$)"
+    ],
+    "readonly_sensitive_commands": [
+      "^cat\\s+\\S",
+      "^head(?:\\s|$)",
+      "^tail(?:\\s|$)",
+      "^less(?:\\s|$)",
+      "^more(?:\\s|$)",
+      "^wc(?:\\s|$)",
+      "^grep(?:\\s|$)",
+      "^find\\s+",
+      "^ag(?:\\s|$)",
+      "^rg(?:\\s|$)",
+      "^awk\\s+",
+      "^(?!.*(?:\\s|['\\\"])-[a-zA-Z]*i[a-zA-Z]*\\b)(?!.*(?:\\s|['\\\"])--in-place)sed\\s+",
+      "^cut\\s+",
+      "^sort(?:\\s|$)",
+      "^uniq(?:\\s|$)",
+      "^ps(?:\\s|$)",
+      "^ss(?:\\s|$)",
+      "^netstat(?:\\s|$)",
+      "^lsof(?:\\s|$)",
+      "^systemctl\\s+(?:status|is-active|is-enabled|is-failed|list-units|list-unit-files|list-dependencies|show|cat)\\b",
+      "^service\\s+\\S+\\s+status\\b",
+      "^journalctl\\b(?!.*--(?:vacuum-size|vacuum-time|vacuum-files|rotate|flush|sync)\\b)"
+    ],
+    "safe_action_types": [
+      "ask_user_question",
+      "count_text_length",
+      "filemgr-globfiles",
+      "glob",
+      "list_dir",
+      "ls"
+    ],
+    "readonly_sensitive_action_types": [
+      "file_read",
+      "filemgr-grepfiles",
+      "filemgr-readfile",
+      "grep",
+      "head",
+      "read",
+      "read_file",
+      "tail"
+    ]
+  },
+  "windows": {
+    "write_keywords": [
+      "write",
+      "写入",
+      "save",
+      "保存",
+      "modify",
+      "修改",
+      "update",
+      "更新",
+      "delete",
+      "删除",
+      "remove",
+      "移除",
+      "create",
+      "创建",
+      "append",
+      "追加",
+      "overwrite",
+      "覆盖",
+      "replace",
+      "替换",
+      "set",
+      "设置"
+    ],
+    "read_keywords": [
+      "read",
+      "读取",
+      "type",
+      "findstr",
+      "dir",
+      "view",
+      "查看",
+      "open",
+      "打开",
+      "load",
+      "加载",
+      "search",
+      "搜索",
+      "find",
+      "查找",
+      "get",
+      "获取"
+    ],
+    "write_command_res": [
+      "\\b(del|erase)\\b",
+      "\\brmdir\\b",
+      "\\b(rd)\\b",
+      "\\bcopy\\b",
+      "\\b(xcopy|robocopy)\\b",
+      "\\b(move|movefile)\\b",
+      "\\breplace\\b",
+      "\\bicacls\\b",
+      "\\battrib\\b",
+      "\\breg(?:\\.exe)?\\s+(?:add|delete|copy|save|restore|import|load|unload)\\b",
+      "\\bformat\\b",
+      "\\bdiskpart\\b",
+      "\\bmkdir\\b",
+      "\\bmd\\b",
+      "\\bsetx\\b",
+      "\\bwmic\\b"
+    ],
+    "read_only_commands": [
+      "cls",
+      "cmd",
+      "comp",
+      "dir",
+      "diskpart",
+      "driverquery",
+      "echo",
+      "fc",
+      "find",
+      "findstr",
+      "getmac",
+      "help",
+      "hostname",
+      "ipconfig",
+      "more",
+      "netstat",
+      "powershell",
+      "query",
+      "reg",
+      "sort",
+      "systeminfo",
+      "tasklist",
+      "tree",
+      "type",
+      "ver",
+      "w32tm",
+      "where",
+      "whoami",
+      "wmic"
+    ],
+    "fully_safe_commands": [
+      "^dir(?:\\s|$)",
+      "^where\\s+",
+      "^echo\\s+",
+      "^cd(?:\\s|$)",
+      "^tree(?:\\s|$)",
+      "^help(?:\\s|$)",
+      "^cls(?:\\s|$)",
+      "^ver(?:\\s|$)",
+      "^whoami(?:\\s|$)",
+      "^hostname(?:\\s|$)",
+      "^systeminfo(?:\\s|$)",
+      "^tasklist(?:\\s|$)",
+      "^getmac(?:\\s|$)",
+      "^driverquery(?:\\s|$)",
+      "^netstat(?:\\s|$)"
+    ],
+    "readonly_sensitive_commands": [
+      "^type\\s+",
+      "^findstr\\s+",
+      "^sc\\s+query\\b",
+      "^reg\\s+query\\b"
+    ],
+    "safe_action_types": [
+      "ask_user_question",
+      "count_text_length",
+      "filemgr-globfiles",
+      "glob",
+      "list_dir",
+      "ls"
+    ],
+    "readonly_sensitive_action_types": [
+      "file_read",
+      "filemgr-grepfiles",
+      "filemgr-readfile",
+      "grep",
+      "head",
+      "read",
+      "read_file",
+      "tail"
+    ]
+  },
+  "macos": {
+    "inherits": "linux"
+  },
+  "harmony": {
+    "inherits": "linux"
+  }
+}

package/dist/rules/script_rules.json

@@ -0,0 +1,311 @@
+{
+  "_comment": "脚本内容分析的高风险词表（Python script_content_analyzer/script_analyzer ↔ TS script-content-analyzer/script-analyzer 单一事实源）。suspicious_patterns 与 script_exec_patterns 的 flags 是语义标志（i/s/m）；keyword_combination_risks 的 group1/group2 里以 $ 开头的字符串是对 keyword_sets 的引用。script_exec_patterns 分两份是**历史原因**：chain 供递归追踪（识别解释器 + 任意后缀），legacy 只认 .sh（供 L3 提示词用），两者不可互相替换。",
+  "keyword_sets": {
+    "network_post": [
+      "curl POST",
+      "curl --data",
+      "curl -d",
+      "wget --post-data",
+      "wget --post-file"
+    ]
+  },
+  "suspicious_patterns": [
+    {
+      "name": "curl POST",
+      "pattern": "curl\\s+(.*\\s)?-X\\s+POST",
+      "flags": "i"
+    },
+    {
+      "name": "curl --data",
+      "pattern": "curl\\s+(.*\\s)?--data",
+      "flags": "i"
+    },
+    {
+      "name": "curl -d",
+      "pattern": "curl\\s+(.*\\s)?-d\\s",
+      "flags": "i"
+    },
+    {
+      "name": "wget --post-data",
+      "pattern": "wget\\s+(.*\\s)?--post-data",
+      "flags": "i"
+    },
+    {
+      "name": "wget --post-file",
+      "pattern": "wget\\s+(.*\\s)?--post-file",
+      "flags": "i"
+    },
+    {
+      "name": "nc -e",
+      "pattern": "\\bnc\\s+.*-e\\b",
+      "flags": ""
+    },
+    {
+      "name": "ncat -e",
+      "pattern": "\\bncat\\s+.*-e\\b",
+      "flags": ""
+    },
+    {
+      "name": "/dev/tcp",
+      "pattern": "/dev/tcp/",
+      "flags": ""
+    },
+    {
+      "name": "/dev/udp",
+      "pattern": "/dev/udp/",
+      "flags": ""
+    },
+    {
+      "name": "$(base64",
+      "pattern": "\\$\\(\\s*base64",
+      "flags": ""
+    },
+    {
+      "name": "`base64",
+      "pattern": "`\\s*base64",
+      "flags": ""
+    },
+    {
+      "name": "base64 decode pipe",
+      "pattern": "base64\\s+(-d|--decode)\\s*\\|",
+      "flags": ""
+    },
+    {
+      "name": "/etc/shadow",
+      "pattern": "/etc/shadow",
+      "flags": ""
+    },
+    {
+      "name": "id_rsa",
+      "pattern": "\\bid_rsa\\b",
+      "flags": ""
+    },
+    {
+      "name": "id_ed25519",
+      "pattern": "\\bid_ed25519\\b",
+      "flags": ""
+    },
+    {
+      "name": "crontab install",
+      "pattern": "crontab\\s+-",
+      "flags": ""
+    },
+    {
+      "name": "authorized_keys",
+      "pattern": "authorized_keys",
+      "flags": ""
+    },
+    {
+      "name": "ssh no host key check",
+      "pattern": "ssh\\s+.*StrictHostKeyChecking\\s*=\\s*no",
+      "flags": ""
+    }
+  ],
+  "keyword_combination_risks": [
+    {
+      "group1": "$network_post",
+      "group2": [
+        "$(base64",
+        "`base64",
+        "base64 decode pipe"
+      ],
+      "level": "critical",
+      "reason": "检测到网络数据发送 + Base64编码组合，构成 Critical 级别数据外传风险。攻击者可能将敏感数据编码后外传。"
+    },
+    {
+      "group1": "$network_post",
+      "group2": [
+        "/etc/shadow",
+        "id_ed25519",
+        "id_rsa"
+      ],
+      "level": "critical",
+      "reason": "检测到网络数据发送 + 敏感文件访问组合，构成 Critical 级别凭证外传风险。"
+    },
+    {
+      "group1": [
+        "/dev/tcp",
+        "/dev/udp",
+        "nc -e",
+        "ncat -e"
+      ],
+      "group2": [],
+      "level": "high",
+      "reason": "检测到反弹 Shell 特征，攻击者可能建立远程控制通道。"
+    },
+    {
+      "group1": [
+        "authorized_keys",
+        "crontab install",
+        "ssh no host key check"
+      ],
+      "group2": [],
+      "level": "high",
+      "reason": "检测到持久化后门特征，攻击者可能在系统中植入后门。"
+    }
+  ],
+  "single_keyword_risks": {
+    "curl POST": {
+      "level": "high",
+      "reason": "检测到 curl POST 请求，可能向外部服务器发送数据。"
+    },
+    "curl --data": {
+      "level": "high",
+      "reason": "检测到 curl --data 参数，可能向外部服务器发送数据。"
+    },
+    "curl -d": {
+      "level": "high",
+      "reason": "检测到 curl -d 参数，可能向外部服务器发送数据。"
+    },
+    "wget --post-data": {
+      "level": "high",
+      "reason": "检测到 wget POST 请求，可能向外部服务器发送数据。"
+    },
+    "wget --post-file": {
+      "level": "high",
+      "reason": "检测到 wget 文件上传，可能向外部服务器发送文件。"
+    },
+    "nc -e": {
+      "level": "critical",
+      "reason": "检测到 nc -e 反弹 Shell 特征。"
+    },
+    "ncat -e": {
+      "level": "critical",
+      "reason": "检测到 ncat -e 反弹 Shell 特征。"
+    },
+    "/dev/tcp": {
+      "level": "critical",
+      "reason": "检测到 /dev/tcp 反弹 Shell 特征。"
+    },
+    "/dev/udp": {
+      "level": "critical",
+      "reason": "检测到 /dev/udp 反弹 Shell 特征。"
+    },
+    "$(base64": {
+      "level": "high",
+      "reason": "检测到 Base64 编码执行，可能是混淆逃逸。"
+    },
+    "`base64": {
+      "level": "high",
+      "reason": "检测到 Base64 编码执行，可能是混淆逃逸。"
+    },
+    "base64 decode pipe": {
+      "level": "high",
+      "reason": "检测到 Base64 解码后管道执行，可能是混淆逃逸。"
+    },
+    "/etc/shadow": {
+      "level": "critical",
+      "reason": "检测到访问系统密码文件。"
+    },
+    "id_rsa": {
+      "level": "critical",
+      "reason": "检测到访问 SSH 私钥。"
+    },
+    "id_ed25519": {
+      "level": "critical",
+      "reason": "检测到访问 SSH 私钥。"
+    },
+    "crontab install": {
+      "level": "high",
+      "reason": "检测到修改定时任务，可能是持久化后门。"
+    },
+    "authorized_keys": {
+      "level": "high",
+      "reason": "检测到修改 SSH 授权密钥，可能是持久化后门。"
+    },
+    "ssh no host key check": {
+      "level": "high",
+      "reason": "检测到 SSH 跳过主机密钥验证，可能是横向移动。"
+    }
+  },
+  "env_exfil_patterns": [
+    "$env",
+    "$(env)",
+    "$USER",
+    "$(hostname)",
+    "$(pwd)",
+    "$HOME"
+  ],
+  "script_exec_patterns": {
+    "chain": [
+      {
+        "pattern": "(?:^|\\s|&&|\\|\\|)\\s*bash\\s+(\\S+)",
+        "flags": "i"
+      },
+      {
+        "pattern": "(?:^|\\s|&&|\\|\\|)\\s*/bin/bash\\s+(\\S+)",
+        "flags": "i"
+      },
+      {
+        "pattern": "(?:^|\\s|&&|\\|\\|)\\s*sh\\s+(\\S+)",
+        "flags": "i"
+      },
+      {
+        "pattern": "(?:^|\\s|&&|\\|\\|)\\s*zsh\\s+(\\S+)",
+        "flags": "i"
+      },
+      {
+        "pattern": "\\./(\\S+)",
+        "flags": "i"
+      },
+      {
+        "pattern": "(?:^|\\s|&&|\\|\\|)\\s*source\\s+(\\S+)",
+        "flags": "i"
+      },
+      {
+        "pattern": "(?:^|\\s|&&|\\|\\|)\\s*\\.\\s+(\\S+)",
+        "flags": "i"
+      },
+      {
+        "pattern": "(?:^|\\s|&&|\\|\\|)\\s*python3?\\s+(\\S+\\.py)",
+        "flags": "i"
+      },
+      {
+        "pattern": "(?:^|\\s|&&|\\|\\|)\\s*node\\s+(\\S+\\.js)",
+        "flags": "i"
+      },
+      {
+        "pattern": "(?:^|\\s|&&|\\|\\|)\\s*ruby\\s+(\\S+\\.rb)",
+        "flags": "i"
+      },
+      {
+        "pattern": "(?:^|\\s|&&|\\|\\|)\\s*perl\\s+(\\S+\\.pl)",
+        "flags": "i"
+      },
+      {
+        "pattern": "(?:^|\\s|&&|\\|\\|)\\s*php\\s+(\\S+\\.php)",
+        "flags": "i"
+      },
+      {
+        "pattern": "(?:^|\\s|&&|\\|\\|)\\s*lua\\s+(\\S+\\.lua)",
+        "flags": "i"
+      }
+    ],
+    "legacy": [
+      {
+        "pattern": "bash\\s+(\\S+\\.sh)",
+        "flags": ""
+      },
+      {
+        "pattern": "sh\\s+(\\S+\\.sh)",
+        "flags": ""
+      },
+      {
+        "pattern": "\\./(\\S+\\.sh)",
+        "flags": ""
+      },
+      {
+        "pattern": "source\\s+(\\S+\\.sh)",
+        "flags": ""
+      },
+      {
+        "pattern": "\\.\\s+(\\S+\\.sh)",
+        "flags": ""
+      },
+      {
+        "pattern": "zsh\\s+(\\S+\\.sh)",
+        "flags": ""
+      }
+    ]
+  }
+}