@kenhkl/agent-moss 0.16.14 → 0.17.0

package/dist/rules/l1_rules.json

@@ -439,10 +439,10 @@
       "reason": "检测到定时任务执行世界可写目录（/tmp、/var/tmp、/dev/shm）下的脚本（cron 持久化后门：任何用户可替换该脚本，重启/定时以任务属主身份执行）"
     },
     {
-      "pattern": "\\b(?:while\\s+(?:true|:|1)\\b|for\\s*\\(\\s*\\(?\\s*(?:;|;;)\\s*\\)?\\s*)",
+      "pattern": "\\b(?:while\\s+(?:true\\b|1\\b|:(?=\\s|;|$|\\)))|until\\s+false\\b|for\\s*\\(\\s*\\(?\\s*(?:;|;;)\\s*\\)?\\s*)",
       "risk_level": "high",
       "risk_type": "resource_exhaustion",
-      "reason": "检测到无限循环（while true/for(;;)/while :），可能用于拒绝服务攻击或资源滥用"
+      "reason": "检测到无限循环（while true / while 1 / while : / until false / for(;;)），可能用于拒绝服务攻击或资源滥用"
     },
     {
       "pattern": "\\byes\\s*(?:>\\s*/dev/null\\s*&|>/dev/null\\s*&\\s*$)",
@@ -2053,6 +2053,55 @@
       "deny_mode": "deny_both",
       "scope": "credential"
     },
+    {
+      "path": ".config/agentmoss/auth_token",
+      "risk_level": "critical",
+      "desc": "AgentMoss 访问 token（拿到即可冒充 agent 调用分析接口、读取其历史）",
+      "deny_mode": "deny_both",
+      "scope": "home"
+    },
+    {
+      "path": ".agentmoss/stateful_chains",
+      "risk_level": "critical",
+      "desc": "AgentMoss 组合链状态库（各 agent 的动作历史与反例路径）",
+      "deny_mode": "deny_both",
+      "scope": "home"
+    },
+    {
+      "path": "agent_moss_policy_cache",
+      "risk_level": "medium",
+      "desc": "AgentMoss policy 缓存（含会话 id 与策略文档）",
+      "deny_mode": "deny_read",
+      "scope": "root"
+    },
+    {
+      "path": "agent_moss/rules",
+      "risk_level": "medium",
+      "desc": "AgentMoss 内置检测规则（读=暴露检测逻辑，可据此构造绕过）",
+      "deny_mode": "deny_read",
+      "scope": "root"
+    },
+    {
+      "path": "agent_moss/skills",
+      "risk_level": "medium",
+      "desc": "AgentMoss 内置 Skill（L3 语义检测口径，读=暴露判定标准）",
+      "deny_mode": "deny_read",
+      "scope": "root"
+    },
+    {
+      "path": "agent_moss/agents/",
+      "risk_level": "medium",
+      "desc": "三方 agent 定制规则目录（读=暴露针对该 agent 的检测规则）",
+      "deny_mode": "deny_read",
+      "scope": "root"
+    },
+    {
+      "path": "agent_moss/scenarios/",
+      "risk_level": "medium",
+      "desc": "场景定制规则目录（读=暴露客户沙箱的目录白名单等部署约束）",
+      "deny_mode": "deny_read",
+      "scope": "root"
+    },
     {
       "path": ".config/agentmoss/config.json",
       "risk_level": "critical",

package/dist/rules/l2_rules.json

@@ -173,7 +173,8 @@
         "(?:cat|head|tail|less|more|grep)\\s+[^;&|\\n]*known_hosts",
         "\\bpython3?\\s+-c\\s+['\\\"][\\s\\S]{0,200}?(?:base64\\.b64encode|open\\s*\\(|Path\\(|io\\.open\\s*\\(|read_text\\s*\\(|read\\s*\\()[\\s\\S]{0,200}?(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)",
         "(?:grep|find|cat)\\s+[^;&|\\n]*\\b(?:password|secret|passwd|shadow|credential|api[_-]?key)\\b[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)",
-        "(?:cp|mv|dd|curl)\\s+[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)"
+        "(?:cp|mv|dd|curl)\\s+[^;&|\\n]*(?:/etc/shadow|/etc/passwd|id_rsa|credentials|\\.ssh)",
+        "(?:cat|head|tail|less|more|sed|awk|strings|base64|dd|cp|mv|grep|xxd|od)\\s+[^;&|\\n]*(?:\\.config/agentmoss/auth_token|\\.agentmoss/stateful_chains|agent_moss_policy_cache|agent_moss/rules|agent_moss/skills|agent_moss/agents/|agent_moss/scenarios/)"
       ],
       "PERSIST": [
         "(?:echo|printf|cat)\\b[^;\\n]*\\|[^;\\n]*(?:crontab|at\\b)\\s*-",