@oculum/scanner 1.0.12 → 1.0.13

package/dist/detect/ai-code/rag-safety.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rag-safety.js","sourceRoot":"","sources":["../../../src/detect/ai-code/rag-safety.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AAgvBH,sDAoNC;AAGQ,4CAAgB;AAn8BzB,iEAOoC;AAEpC,MAAM,eAAe,GAAG,IAAI,CAAA;AAE5B,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;;GAGG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,mBAAmB,GAAG;QAC1B,qCAAqC;QACrC,kCAAkC;QAClC,uCAAuC;QACvC,kBAAkB;QAClB,qCAAqC;QACrC,oCAAoC;QACpC,8BAA8B;QAC9B,oCAAoC;QACpC,mCAAmC;QACnC,sCAAsC;KACvC,CAAA;IACD,OAAO,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACvD,CAAC;AAED;;;GAGG;AACH,SAAS,qBAAqB,CAAC,WAAmB;IAChD,MAAM,oBAAoB,GAAG;QAC3B,gCAAgC;QAChC,kBAAkB;QAClB,qBAAqB;QACrB,kBAAkB;QAClB,sBAAsB;QACtB,oBAAoB;QACpB,yBAAyB;QACzB,oBAAoB;QACpB,kBAAkB;QAClB,uBAAuB;QACvB,qBAAqB;QACrB,YAAY;QACZ,8CAA8C;QAC9C,6BAA6B;QAC7B,6BAA6B;QAC7B,6BAA6B;QAC7B,6BAA6B;QAC7B,kBAAkB;QAClB,iBAAiB;QACjB,gBAAgB;QAChB,oBAAoB;QACpB,mBAAmB;QACnB,wBAAwB;QACxB,kBAAkB;QAClB,yBAAyB;QACzB,wBAAwB;QACxB,cAAc;QACd,mDAAmD;QACnD,oBAAoB,EAAG,mBAAmB;KAC3C,CAAA;IACD,OAAO,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC3C,MAAM,kBAAkB,GAAG;QACzB,sBAAsB;QACtB,gCAAgC;QAChC,sBAAsB;QACtB,sBAAsB;QACtB,qBAAqB;QACrB,oBAAoB;QACpB,sCAAsC;QACtC,qCAAqC;QACrC,mBAAmB;QACnB,oBAAoB;QACpB,+BAA+B;QAC/B,WAAW;QACX,cAAc;QACd,aAAa;KACd,CAAA;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,SAAS,gBAAgB,CAAC,QAAgB,EAAE,OAAe;IACzD,wEAAwE;IACxE,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;QACrC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,8DAA8D;IAC9D,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;QACnC,OAAO,KAAK,CAAA;IACd,CAAC;IAED,mCAAmC;IACnC,MAAM,eAAe,GAAG;QACtB,2DAA2D;QAC3D,yCAAyC;QACzC,oEAAoE;QACpE,oDAAoD;KACrD,CAAA;IAED,IAAI,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAChD,OAAO,IAAI,CAAA;IACb,CAAC;IAED,8EAA8E;IAC9E,MAAM,kBAAkB,GAAG;QACzB,wDAAwD;QACxD,oCAAoC;QACpC,0CAA0C;QAC1C,4CAA4C;QAC5C,+CAA+C;QAC/C,+EAA+E;QAC/E,8DAA8D;QAC9D,oBAAoB;QACpB,0DAA0D;QAC1D,oEAAoE;QACpE,yBAAyB;QACzB,gDAAgD;QAChD,yBAAyB;QACzB,oCAAoC;QACpC,6BAA6B;KAC9B,CAAA;IAED,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,SAAS,uBAAuB,CAAC,OAAe;IAC9C,MAAM,cAAc,GAAG;QACrB,sBAAsB;QACtB,sCAAsC;QACtC,yDAAyD;QACzD,oBAAoB;QACpB,6CAA6C;QAC7C,oCAAoC;QACpC,uCAAuC;QACvC,mBAAmB;QACnB,yBAAyB;QACzB,2DAA2D;QAC3D,4CAA4C;KAC7C,CAAA;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,oBAAoB,CAAC,OAAe;IAC3C,MAAM,cAAc,GAAG;QACrB,oBAAoB;QACpB,8CAA8C;QAC9C,gBAAgB;QAChB,6BAA6B;QAC7B,iCAAiC;QACjC,8DAA8D;KAC/D,CAAA;IACD,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AAClD,CAAC;AAED;;GAEG;AACH,SAAS,0BAA0B,CAAC,OAAe;IACjD,MAAM,YAAY,GAAG;QACnB,6CAA6C;QAC7C,mCAAmC;QACnC,wCAAwC;QACxC,qCAAqC;QACrC,wBAAwB;QACxB,gCAAgC;KACjC,CAAA;IACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AAChD,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,OAAe,EAAE,SAAiB,EAAE,aAAqB,EAAE;IACxF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC,CAAA;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC,CAAA;IAC1D,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC3C,CAAC;AAeD;;;GAGG;AACH,MAAM,2BAA2B,GAAuB;IACtD,+BAA+B;IAC/B;QACE,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,+FAA+F;QACxG,QAAQ,EAAE,oBAAoB;QAC9B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,mIAAmI;QAChJ,YAAY,EAAE,uGAAuG;KACtH;IACD,6BAA6B;IAC7B;QACE,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,6FAA6F;QACtG,QAAQ,EAAE,oBAAoB;QAC9B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,oGAAoG;QACjH,YAAY,EAAE,kGAAkG;KACjH;IACD,0BAA0B;IAC1B;QACE,IAAI,EAAE,wCAAwC;QAC9C,OAAO,EAAE,qDAAqD;QAC9D,QAAQ,EAAE,oBAAoB;QAC9B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,gGAAgG;QAC7G,YAAY,EAAE,6EAA6E;KAC5F;IACD,iBAAiB;IACjB;QACE,IAAI,EAAE,wCAAwC;QAC9C,OAAO,EAAE,qDAAqD;QAC9D,QAAQ,EAAE,oBAAoB;QAC9B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,gFAAgF;QAC7F,YAAY,EAAE,4FAA4F;KAC3G;IACD,eAAe;IACf;QACE,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,2DAA2D;QACpE,QAAQ,EAAE,oBAAoB;QAC9B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,kFAAkF;QAC/F,YAAY,EAAE,0FAA0F;KACzG;IACD,kBAAkB;IAClB;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,4CAA4C;QACrD,QAAQ,EAAE,oBAAoB;QAC9B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,wFAAwF;QACrG,YAAY,EAAE,8HAA8H;KAC7I;IACD,yBAAyB;IACzB;QACE,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,0CAA0C;QACnD,QAAQ,EAAE,oBAAoB;QAC9B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,6EAA6E;QAC1F,YAAY,EAAE,yFAAyF;KACxG;CACF,CAAA;AAED;;;GAGG;AACH,MAAM,yBAAyB,GAAuB;IACpD,wCAAwC;IACxC;QACE,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,uGAAuG;QAChH,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,0HAA0H;QACvI,YAAY,EAAE,iHAAiH;KAChI;IACD,oCAAoC;IACpC;QACE,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EAAE,8FAA8F;QACvG,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,wFAAwF;QACrG,YAAY,EAAE,iGAAiG;KAChH;IACD,2CAA2C;IAC3C;QACE,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,+DAA+D;QACxE,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,sFAAsF;QACnG,YAAY,EAAE,sFAAsF;KACrG;IACD,oCAAoC;IACpC;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,yFAAyF;QAClG,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,kFAAkF;QAC/F,YAAY,EAAE,2FAA2F;KAC1G;CACF,CAAA;AAED;;;GAGG;AACH,MAAM,wBAAwB,GAAuB;IACnD,8BAA8B;IAC9B;QACE,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,uFAAuF;QAChG,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,gGAAgG;QAC7G,YAAY,EAAE,8EAA8E;KAC7F;IACD,mCAAmC;IACnC;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,qFAAqF;QAC9F,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,kGAAkG;QAC/G,YAAY,EAAE,mFAAmF;KAClG;IACD,+BAA+B;IAC/B;QACE,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,6FAA6F;QACtG,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,mFAAmF;QAChG,YAAY,EAAE,wFAAwF;KACvG;IACD,+BAA+B;IAC/B;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,0FAA0F;QACnG,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,2FAA2F;QACxG,YAAY,EAAE,iFAAiF;KAChG;CACF,CAAA;AAED,+EAA+E;AAC/E,uDAAuD;AACvD,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,yBAAyB,GAAuB;IACpD,iCAAiC;IACjC;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,uIAAuI;QAChJ,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,8HAA8H;QAC3I,YAAY,EAAE,2GAA2G;KAC1H;IACD,wCAAwC;IACxC;QACE,IAAI,EAAE,8CAA8C;QACpD,OAAO,EAAE,sFAAsF;QAC/F,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,qHAAqH;QAClI,YAAY,EAAE,wFAAwF;KACvG;IACD,4CAA4C;IAC5C;QACE,IAAI,EAAE,2CAA2C;QACjD,OAAO,EAAE,iGAAiG;QAC1G,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,0GAA0G;QACvH,YAAY,EAAE,4FAA4F;KAC3G;IACD,yBAAyB;IACzB;QACE,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,6EAA6E;QACtF,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,8FAA8F;QAC3G,YAAY,EAAE,8FAA8F;KAC7G;IACD,qCAAqC;IACrC;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,0EAA0E;QACnF,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,iFAAiF;QAC9F,YAAY,EAAE,iFAAiF;KAChG;CACF,CAAA;AAED;;;GAGG;AACH,MAAM,oBAAoB,GAAuB;IAC/C,yBAAyB;IACzB;QACE,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,wGAAwG;QACjH,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,iGAAiG;QAC9G,YAAY,EAAE,yGAAyG;KACxH;IACD,sCAAsC;IACtC;QACE,IAAI,EAAE,4CAA4C;QAClD,OAAO,EAAE,qGAAqG;QAC9G,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,UAAU;QACxB,WAAW,EAAE,+FAA+F;QAC5G,YAAY,EAAE,6FAA6F;KAC5G;IACD,qCAAqC;IACrC;QACE,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,4FAA4F;QACrG,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,UAAU;QACxB,WAAW,EAAE,uFAAuF;QACpG,YAAY,EAAE,uFAAuF;KACtG;IACD,kCAAkC;IAClC;QACE,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,gFAAgF;QACzF,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,6FAA6F;QAC1G,YAAY,EAAE,+FAA+F;KAC9G;IACD,oCAAoC;IACpC;QACE,IAAI,EAAE,uCAAuC;QAC7C,OAAO,EAAE,mEAAmE;QAC5E,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,uDAAuD;QACpE,YAAY,EAAE,sEAAsE;KACrF;CACF,CAAA;AAED,+EAA+E;AAC/E,6DAA6D;AAC7D,+EAA+E;AAE/E;;;GAGG;AACH,MAAM,wBAAwB,GAAuB;IACnD,4CAA4C;IAC5C;QACE,IAAI,EAAE,wCAAwC;QAC9C,OAAO,EAAE,wIAAwI;QACjJ,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,2GAA2G;QACxH,YAAY,EAAE,qFAAqF;KACpG;IACD,6CAA6C;IAC7C;QACE,IAAI,EAAE,4CAA4C;QAClD,OAAO,EAAE,qIAAqI;QAC9I,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,kFAAkF;QAC/F,YAAY,EAAE,+EAA+E;KAC9F;IACD,+CAA+C;IAC/C;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,uFAAuF;QAChG,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,0FAA0F;QACvG,YAAY,EAAE,wEAAwE;KACvF;IACD,kCAAkC;IAClC;QACE,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,yJAAyJ;QAClK,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,4EAA4E;QACzF,YAAY,EAAE,4EAA4E;KAC3F;IACD,6BAA6B;IAC7B;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,gIAAgI;QACzI,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,uEAAuE;QACpF,YAAY,EAAE,qGAAqG;KACpH;CACF,CAAA;AAED;;;GAGG;AACH,MAAM,4BAA4B,GAAuB;IACvD,4CAA4C;IAC5C;QACE,IAAI,EAAE,2CAA2C;QACjD,OAAO,EAAE,mKAAmK;QAC5K,QAAQ,EAAE,qBAAqB;QAC/B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,wFAAwF;QACrG,YAAY,EAAE,0FAA0F;KACzG;IACD,yCAAyC;IACzC;QACE,IAAI,EAAE,wCAAwC;QAC9C,OAAO,EAAE,uHAAuH;QAChI,QAAQ,EAAE,qBAAqB;QAC/B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,iGAAiG;QAC9G,YAAY,EAAE,+EAA+E;KAC9F;IACD,wCAAwC;IACxC;QACE,IAAI,EAAE,6CAA6C;QACnD,OAAO,EAAE,wIAAwI;QACjJ,QAAQ,EAAE,qBAAqB;QAC/B,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,qFAAqF;QAClG,YAAY,EAAE,mEAAmE;KAClF;IACD,oCAAoC;IACpC;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,4GAA4G;QACrH,QAAQ,EAAE,qBAAqB;QAC/B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,4FAA4F;QACzG,YAAY,EAAE,8DAA8D;KAC7E;IACD,gCAAgC;IAChC;QACE,IAAI,EAAE,wCAAwC;QAC9C,OAAO,EAAE,qGAAqG;QAC9G,QAAQ,EAAE,qBAAqB;QAC/B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,sFAAsF;QACnG,YAAY,EAAE,mFAAmF;KAClG;CACF,CAAA;AAED;;;GAGG;AACH,MAAM,qBAAqB,GAAuB;IAChD,4CAA4C;IAC5C;QACE,IAAI,EAAE,2CAA2C;QACjD,OAAO,EAAE,qMAAqM;QAC9M,QAAQ,EAAE,oBAAoB;QAC9B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,uHAAuH;QACpI,YAAY,EAAE,kHAAkH;KACjI;IACD,0CAA0C;IAC1C;QACE,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,wJAAwJ;QACjK,QAAQ,EAAE,oBAAoB;QAC9B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,gGAAgG;QAC7G,YAAY,EAAE,gFAAgF;KAC/F;IACD,8BAA8B;IAC9B;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,4MAA4M;QACrN,QAAQ,EAAE,oBAAoB;QAC9B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,mGAAmG;QAChH,YAAY,EAAE,4FAA4F;KAC3G;IACD,uCAAuC;IACvC;QACE,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EAAE,6JAA6J;QACtK,QAAQ,EAAE,oBAAoB;QAC9B,YAAY,EAAE,UAAU;QACxB,WAAW,EAAE,4FAA4F;QACzG,YAAY,EAAE,wEAAwE;KACvF;IACD,8CAA8C;IAC9C;QACE,IAAI,EAAE,2CAA2C;QACjD,OAAO,EAAE,4JAA4J;QACrK,QAAQ,EAAE,kBAAkB;QAC5B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,yGAAyG;QACtH,YAAY,EAAE,4FAA4F;KAC3G;IACD,mCAAmC;IACnC;QACE,IAAI,EAAE,0CAA0C;QAChD,OAAO,EAAE,8HAA8H;QACvI,QAAQ,EAAE,oBAAoB;QAC9B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,4GAA4G;QACzH,YAAY,EAAE,2FAA2F;KAC1G;IACD,qCAAqC;IACrC;QACE,IAAI,EAAE,4CAA4C;QAClD,OAAO,EAAE,2FAA2F;QACpG,QAAQ,EAAE,oBAAoB;QAC9B,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,8EAA8E;QAC3F,YAAY,EAAE,4EAA4E;KAC3F;IACD,mCAAmC;IACnC;QACE,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,yJAAyJ;QAClK,QAAQ,EAAE,oBAAoB;QAC9B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,0FAA0F;QACvG,YAAY,EAAE,mEAAmE;KAClF;CACF,CAAA;AAED;;;GAGG;AACH,MAAM,wBAAwB,GAAuB;IACnD,oDAAoD;IACpD;QACE,IAAI,EAAE,yCAAyC;QAC/C,OAAO,EAAE,oMAAoM;QAC7M,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,4FAA4F;QACzG,YAAY,EAAE,yEAAyE;KACxF;IACD,oCAAoC;IACpC;QACE,IAAI,EAAE,0CAA0C;QAChD,OAAO,EAAE,iFAAiF;QAC1F,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,6FAA6F;QAC1G,YAAY,EAAE,oEAAoE;KACnF;IACD,iCAAiC;IACjC;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,kGAAkG;QAC3G,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,wFAAwF;QACrG,YAAY,EAAE,4EAA4E;KAC3F;IACD,uBAAuB;IACvB;QACE,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,6IAA6I;QACtJ,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,mFAAmF;QAChG,YAAY,EAAE,uFAAuF;KACtG;IACD,uCAAuC;IACvC;QACE,IAAI,EAAE,uCAAuC;QAC7C,OAAO,EAAE,qFAAqF;QAC9F,QAAQ,EAAE,iBAAiB;QAC3B,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,wFAAwF;QACrG,YAAY,EAAE,uFAAuF;KACtG;CACF,CAAA;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;GAEG;AACH,SAAS,qBAAqB,CAAC,QAAsC;IACnE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,kBAAkB;YACrB,OAAO,yBAAyB,CAAA;QAClC,KAAK,aAAa;YAChB,OAAO,oBAAoB,CAAA;QAC7B,KAAK,iBAAiB;YACpB,OAAO,wBAAwB,CAAA;QACjC,KAAK,qBAAqB;YACxB,OAAO,4BAA4B,CAAA;QACrC,KAAK,iBAAiB;YACpB,OAAO,wBAAwB,CAAA;QACjC;YACE,OAAO,qBAAqB,CAAA;IAChC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAgB,qBAAqB,CACnC,OAAe,EACf,QAAgB,EAChB,OAAiC;IAEjC,MAAM,eAAe,GAAoB,EAAE,CAAA;IAE3C,4BAA4B;IAC5B,IAAI,IAAA,wCAAsB,EAAC,QAAQ,CAAC;QAAE,OAAO,eAAe,CAAA;IAC5D,IAAI,IAAA,qCAAmB,EAAC,QAAQ,CAAC;QAAE,OAAO,eAAe,CAAA;IAEzD,iCAAiC;IACjC,IAAI,CAAC,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACzC,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,IAAA,kCAAgB,EAAC,QAAQ,CAAC,CAAA;IAC7C,MAAM,SAAS,GAAG,IAAA,oCAAkB,EAAC,QAAQ,CAAC,CAAA;IAC9C,MAAM,SAAS,GAAG,IAAA,+BAAa,EAAC,QAAQ,CAAC,CAAA;IACzC,MAAM,OAAO,GAAG,0BAA0B,CAAC,OAAO,CAAC,CAAA;IAEnD,iCAAiC;IACjC,MAAM,WAAW,GAAuB;QACtC,GAAG,2BAA2B;QAC9B,GAAG,yBAAyB;QAC5B,GAAG,wBAAwB;QAC3B,+BAA+B;QAC/B,GAAG,yBAAyB;QAC5B,GAAG,oBAAoB;QACvB,8BAA8B;QAC9B,GAAG,wBAAwB;QAC3B,GAAG,4BAA4B;QAC/B,GAAG,wBAAwB;QAC3B,kCAAkC;QAClC,GAAG,qBAAqB;KACzB,CAAA;IAED,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACvE,IAAI,KAAK,CAAA;QAET,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;YACvE,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;YAEvD,gBAAgB;YAChB,IAAI,IAAA,2BAAS,EAAC,WAAW,CAAC;gBAAE,SAAQ;YAEpC,8DAA8D;YAC9D,IAAI,qBAAqB,CAAC,WAAW,CAAC;gBAAE,SAAQ;YAEhD,uCAAuC;YACvC,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,UAAU,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;YAElE,sCAAsC;YACtC,IAAI,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAA;YACnC,IAAI,WAAW,GAAG,OAAO,CAAC,WAAW,CAAA;YACrC,MAAM,KAAK,GAAa,EAAE,CAAA;YAE1B,2CAA2C;YAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,oBAAoB,EAAE,CAAC;gBAC9C,kDAAkD;gBAClD,IAAI,uBAAuB,CAAC,OAAO,CAAC,EAAE,CAAC;oBACrC,QAAQ,GAAG,MAAM,CAAA;oBACjB,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAA;gBACtD,CAAC;qBAAM,IAAI,CAAC,OAAO,EAAE,CAAC;oBACpB,+BAA+B;oBAC/B,IAAI,QAAQ,KAAK,QAAQ;wBAAE,QAAQ,GAAG,MAAM,CAAA;oBAC5C,KAAK,CAAC,IAAI,CAAC,yCAAyC,CAAC,CAAA;gBACvD,CAAC;YACH,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;gBAC5C,gCAAgC;gBAChC,IAAI,oBAAoB,CAAC,OAAO,CAAC,EAAE,CAAC;oBAClC,QAAQ,GAAG,MAAM,CAAA;oBACjB,KAAK,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAA;gBAC3C,CAAC;qBAAM,IAAI,CAAC,OAAO,EAAE,CAAC;oBACpB,0DAA0D;oBAC1D,IAAI,QAAQ,KAAK,QAAQ;wBAAE,QAAQ,GAAG,MAAM,CAAA;oBAC5C,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;gBAC/C,CAAC;YACH,CAAC;YAED,4CAA4C;YAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,kBAAkB,EAAE,CAAC;gBAC5C,4CAA4C;gBAC5C,IAAI,uCAAuC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1D,QAAQ,GAAG,MAAM,CAAA;oBACjB,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,CAAA;gBACpD,CAAC;gBACD,4CAA4C;gBAC5C,IAAI,wCAAwC,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC3D,QAAQ,GAAG,MAAM,CAAA;oBACjB,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;gBACzC,CAAC;YACH,CAAC;YAED,yDAAyD;YACzD,IAAI,OAAO,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBACvC,kCAAkC;gBAClC,IAAI,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/D,QAAQ,GAAG,MAAM,CAAA;oBACjB,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;gBACtC,CAAC;gBACD,mEAAmE;gBACnE,IAAI,kBAAkB,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;oBACxD,wCAAwC;gBAC1C,CAAC;YACH,CAAC;YAED,+CAA+C;YAC/C,IAAI,OAAO,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;gBAC3C,0CAA0C;gBAC1C,IAAI,6DAA6D,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChF,QAAQ,GAAG,KAAK,CAAA;oBAChB,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAA;gBAChD,CAAC;gBACD,2CAA2C;gBAC3C,IAAI,qDAAqD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxE,IAAI,QAAQ,KAAK,MAAM;wBAAE,QAAQ,GAAG,QAAQ,CAAA;oBAC5C,KAAK,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAA;gBAC1C,CAAC;gBACD,0BAA0B;gBAC1B,IAAI,6BAA6B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAChD,IAAI,QAAQ,KAAK,MAAM;wBAAE,QAAQ,GAAG,QAAQ,CAAA;oBAC5C,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAA;gBACtC,CAAC;YACH,CAAC;YAED,qDAAqD;YACrD,IAAI,OAAO,CAAC,QAAQ,KAAK,qBAAqB,EAAE,CAAC;gBAC/C,iCAAiC;gBACjC,IAAI,4CAA4C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC/D,QAAQ,GAAG,KAAK,CAAA;oBAChB,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;gBAClD,CAAC;gBACD,mCAAmC;gBACnC,IAAI,sDAAsD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACzE,QAAQ,GAAG,MAAM,CAAA;oBACjB,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;gBAC/C,CAAC;gBACD,iCAAiC;gBACjC,IAAI,8CAA8C,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACjE,IAAI,QAAQ,KAAK,QAAQ;wBAAE,QAAQ,GAAG,KAAK,CAAA;oBAC3C,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAA;gBAC/C,CAAC;YACH,CAAC;YAED,+CAA+C;YAC/C,IAAI,OAAO,CAAC,QAAQ,KAAK,iBAAiB,EAAE,CAAC;gBAC3C,iCAAiC;gBACjC,IAAI,iEAAiE,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACpF,QAAQ,GAAG,MAAM,CAAA;oBACjB,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;gBACzC,CAAC;gBACD,4BAA4B;gBAC5B,IAAI,yDAAyD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC5E,IAAI,QAAQ,KAAK,KAAK;wBAAE,QAAQ,GAAG,MAAM,CAAA;oBACzC,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;gBACzC,CAAC;gBACD,kCAAkC;gBAClC,IAAI,qDAAqD,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxE,IAAI,QAAQ,KAAK,QAAQ;wBAAE,QAAQ,GAAG,KAAK,CAAA;oBAC3C,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAA;gBACjD,CAAC;YACH,CAAC;YAED,uBAAuB;YACvB,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,GAAG,MAAM,CAAA;gBACjB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;YAC5B,CAAC;YAED,qCAAqC;YACrC,IAAI,SAAS,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACrC,QAAQ,GAAG,MAAM,CAAA;gBACjB,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAA;YACzC,CAAC;YAED,kEAAkE;YAClE,IAAI,SAAS,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;gBACrC,QAAQ,GAAG,MAAM,CAAA;gBACjB,KAAK,CAAC,IAAI,CAAC,8CAA8C,CAAC,CAAA;YAC5D,CAAC;YAED,0BAA0B;YAC1B,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,WAAW,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;YACzC,CAAC;YAED,eAAe,CAAC,IAAI,CAAC;gBACnB,EAAE,EAAE,UAAU,QAAQ,IAAI,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;gBAC3E,QAAQ;gBACR,UAAU;gBACV,WAAW;gBACX,QAAQ;gBACR,QAAQ,EAAE,qBAAqB,CAAC,OAAO,CAAC,QAAQ,CAAC;gBACjD,KAAK,EAAE,OAAO,CAAC,IAAI;gBACnB,WAAW;gBACX,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,UAAU,EAAE,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBAClD,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,SAAkB;gBAC1B,oBAAoB,EAAE,QAAQ,KAAK,MAAM,IAAI,OAAO,CAAC,QAAQ,KAAK,iBAAiB;gBACnF,cAAc,EAAE,eAAe;aAChC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAA;AACxB,CAAC"}

package/dist/detect/ai-code/schema-validation.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Layer 2: AI Schema/Tooling Validation Detection
+ * Detects missing or weak validation of AI-generated structured outputs
+ *
+ * Covers:
+ * - M5.3: Schema/tooling mismatch
+ * - Unvalidated JSON parsing of AI outputs
+ * - Weak schema patterns (any, permissive)
+ * - Tool invocation parameters not validated
+ */
+import type { Vulnerability } from '../../shared/types';
+import type { ParsedFile } from '../../shared/parsed-file';
+/**
+ * Check if file is in an AI/LLM context
+ */
+declare function isAIContextFile(filePath: string, content: string): boolean;
+/**
+ * Check if there's schema validation in the context
+ */
+declare function hasSchemaValidation(context: string): boolean;
+/**
+ * Main detection function for AI schema/tooling validation issues
+ */
+export declare function detectAISchemaValidation(content: string, filePath: string, options?: {
+    parsed?: ParsedFile;
+}): Vulnerability[];
+export { isAIContextFile, hasSchemaValidation };
+//# sourceMappingURL=schema-validation.d.ts.map

package/dist/detect/ai-code/schema-validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-validation.d.ts","sourceRoot":"","sources":["../../../src/detect/ai-code/schema-validation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,oBAAoB,CAAA;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAc1D;;GAEG;AACH,iBAAS,eAAe,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAsBnE;AAED;;GAEG;AACH,iBAAS,mBAAmB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAyBrD;AA+ND;;GAEG;AACH,wBAAgB,wBAAwB,CACtC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE;IAAE,MAAM,CAAC,EAAE,UAAU,CAAA;CAAE,GAChC,aAAa,EAAE,CAgHjB;AAGD,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,CAAA"}

package/dist/detect/ai-code/schema-validation.js

@@ -0,0 +1,378 @@
+"use strict";
+/**
+ * Layer 2: AI Schema/Tooling Validation Detection
+ * Detects missing or weak validation of AI-generated structured outputs
+ *
+ * Covers:
+ * - M5.3: Schema/tooling mismatch
+ * - Unvalidated JSON parsing of AI outputs
+ * - Weak schema patterns (any, permissive)
+ * - Tool invocation parameters not validated
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectAISchemaValidation = detectAISchemaValidation;
+exports.isAIContextFile = isAIContextFile;
+exports.hasSchemaValidation = hasSchemaValidation;
+const file_classifier_1 = require("../../parse/file-classifier");
+const BASE_CONFIDENCE = 0.40;
+// ============================================================================
+// Context Detection
+// ============================================================================
+/**
+ * Check if file is in an AI/LLM context
+ */
+function isAIContextFile(filePath, content) {
+    // File path patterns
+    const aiPathPatterns = [
+        /\/(ai|llm|chat|openai|anthropic|agents?|tools?)\//i,
+        /(ai|llm|chat|agent|tool|function).*\.(ts|js|tsx|jsx|py)$/i,
+    ];
+    if (aiPathPatterns.some(p => p.test(filePath))) {
+        return true;
+    }
+    // Content patterns
+    const aiContentPatterns = [
+        /openai\.|anthropic\.|ChatCompletion|MessageCreate/i,
+        /\.chat\.completions?\.create/i,
+        /\.messages\.create/i,
+        /generateText|streamText|generateObject/i,
+        /tool_calls?|function_call|functionCall/i,
+        /from\s+['"](?:openai|@anthropic-ai|langchain)/i,
+    ];
+    return aiContentPatterns.some(p => p.test(content));
+}
+/**
+ * Check if there's schema validation in the context
+ */
+function hasSchemaValidation(context) {
+    const validationPatterns = [
+        // Zod
+        /z\.(?:parse|safeParse|parseAsync)\s*\(/i,
+        /\.parse\s*\([^)]*response/i,
+        /zodSchema|z\.object/i,
+        // Ajv
+        /ajv\.(?:compile|validate)/i,
+        /\.validate\s*\([^)]*schema/i,
+        // Joi
+        /joi\.(?:object|string|number).*\.validate/i,
+        /\.validate\s*\([^)]*joi/i,
+        // Yup
+        /yup\.(?:object|string|number).*\.validate/i,
+        // TypeBox
+        /Type\.(?:Object|String|Number)/i,
+        /Value\.(?:Check|Decode)/i,
+        // Generic validation
+        /validateSchema|schemaValidator/i,
+        /JSON\.parse.*try.*catch.*schema/i,
+        // OpenAI Structured Outputs
+        /response_format.*json_schema/i,
+        /json_schema\s*:/i,
+    ];
+    return validationPatterns.some(p => p.test(context));
+}
+/**
+ * Check if there's a security-sensitive sink after parsing
+ */
+function hasSecuritySink(context) {
+    const sinkPatterns = [
+        // Execution sinks
+        /eval\s*\(/i,
+        /Function\s*\(/i,
+        /exec\s*\(|spawn\s*\(/i,
+        /child_process/i,
+        // Database sinks
+        /\.query\s*\(/i,
+        /\.execute\s*\(/i,
+        /\.raw\s*\(/i,
+        /\$\{.*\}.*(?:SELECT|INSERT|UPDATE|DELETE)/i,
+        // File system sinks
+        /fs\.(?:readFile|writeFile|unlink|mkdir)/i,
+        /readFileSync|writeFileSync/i,
+        // Network sinks
+        /fetch\s*\(|axios\.|request\s*\(/i,
+        // DOM sinks (if applicable)
+        /innerHTML|dangerouslySetInnerHTML/i,
+    ];
+    return sinkPatterns.some(p => p.test(context));
+}
+/**
+ * Check if there's try-catch around the parsing
+ */
+function hasTryCatch(content, lineIndex) {
+    const lines = content.split('\n');
+    const start = Math.max(0, lineIndex - 15);
+    const end = Math.min(lines.length, lineIndex + 5);
+    const context = lines.slice(start, end).join('\n');
+    // Simple check for try block wrapping
+    const tryPattern = /try\s*\{[^}]*$/;
+    const beforeContext = lines.slice(start, lineIndex).join('\n');
+    return tryPattern.test(beforeContext);
+}
+/**
+ * Get surrounding context
+ */
+function getSurroundingContext(content, lineIndex, windowSize = 20) {
+    const lines = content.split('\n');
+    const start = Math.max(0, lineIndex - windowSize);
+    const end = Math.min(lines.length, lineIndex + windowSize);
+    return lines.slice(start, end).join('\n');
+}
+/**
+ * Unvalidated AI output parsing patterns
+ */
+const UNVALIDATED_PARSING_PATTERNS = [
+    // JSON.parse on AI response content
+    {
+        name: 'AI response content parsed without validation',
+        pattern: /JSON\.parse\s*\(\s*(?:response|result|completion|output|message)(?:\.\w+)*(?:\.content|\.text|\.message)?/gi,
+        riskType: 'unvalidated_parse',
+        baseSeverity: 'medium',
+        description: 'AI-generated JSON parsed without schema validation. Model may return malformed or malicious structures.',
+        suggestedFix: 'Validate with schema: const data = schema.parse(JSON.parse(response.content)) // using zod',
+    },
+    // OpenAI choices parsing
+    {
+        name: 'OpenAI response parsed directly',
+        pattern: /JSON\.parse\s*\(\s*(?:\w+\.)?choices\[\d+\]\.message\.content/gi,
+        riskType: 'unvalidated_parse',
+        baseSeverity: 'medium',
+        description: 'OpenAI response content parsed without validation. AI output structure should be verified.',
+        suggestedFix: 'Use OpenAI Structured Outputs (response_format: { type: "json_schema", json_schema: {...} }) or validate with zod.',
+    },
+    // Anthropic content parsing
+    {
+        name: 'Anthropic response parsed directly',
+        pattern: /JSON\.parse\s*\(\s*(?:\w+\.)?content\[0\]\.text/gi,
+        riskType: 'unvalidated_parse',
+        baseSeverity: 'medium',
+        description: 'Anthropic response parsed without validation. AI output may not match expected schema.',
+        suggestedFix: 'Validate response structure with zod or similar schema validation library.',
+    },
+    // Tool call arguments parsing
+    {
+        name: 'Tool call arguments parsed without validation',
+        pattern: /JSON\.parse\s*\(\s*(?:\w+\.)?(?:tool_calls?|function_call)(?:\[\d+\])?\.(?:function\.)?arguments/gi,
+        riskType: 'unvalidated_parse',
+        baseSeverity: 'medium',
+        description: 'Function calling arguments parsed without schema validation. Tool parameters should be verified.',
+        suggestedFix: 'Define and validate tool argument schema: const args = toolSchema.parse(JSON.parse(toolCall.function.arguments))',
+    },
+    // Generic AI output parsing
+    {
+        name: 'AI output assigned without parsing/validation',
+        pattern: /(?:const|let|var)\s+\w+\s*=\s*(?:response|completion|result)\.(?:content|text|data)\s*;?\s*(?!.*(?:parse|validate|schema))/gi,
+        riskType: 'unvalidated_parse',
+        baseSeverity: 'low',
+        description: 'AI output assigned directly to variable. If used as structured data, validate first.',
+        suggestedFix: 'If expecting JSON: const data = schema.safeParse(JSON.parse(response.content))',
+    },
+];
+/**
+ * Weak schema patterns
+ */
+const WEAK_SCHEMA_PATTERNS = [
+    // any type for AI response
+    {
+        name: 'AI response typed as any',
+        pattern: /(?:response|aiResponse|completion|result)\s*:\s*any\b/gi,
+        riskType: 'weak_schema',
+        baseSeverity: 'low',
+        description: 'AI response typed as `any`. TypeScript cannot catch type errors at compile time.',
+        suggestedFix: 'Define explicit interface and use runtime validation: interface AIResponse { ... }; const data: AIResponse = schema.parse(response)',
+    },
+    // Permissive zod schemas
+    {
+        name: 'Permissive zod schema for AI output',
+        pattern: /z\.(?:any|unknown)\s*\(\s*\).*(?:response|output|completion)/gi,
+        riskType: 'weak_schema',
+        baseSeverity: 'low',
+        description: 'Using z.any() or z.unknown() defeats the purpose of schema validation.',
+        suggestedFix: 'Define specific schema: z.object({ field: z.string(), ... }).strict()',
+    },
+    // Passthrough schemas
+    {
+        name: 'Passthrough schema allowing extra properties',
+        pattern: /z\.object\s*\([^)]+\)\.passthrough\s*\(\s*\)/gi,
+        riskType: 'weak_schema',
+        baseSeverity: 'info',
+        description: 'Schema uses passthrough() allowing unexpected properties from AI output.',
+        suggestedFix: 'Use .strict() instead to reject unexpected properties from AI responses.',
+    },
+    // Record<string, any>
+    {
+        name: 'Record<string, any> for AI data',
+        pattern: /Record<string,\s*any>\s*.*(?:response|result|output|completion|aiData)/gi,
+        riskType: 'weak_schema',
+        baseSeverity: 'low',
+        description: 'Generic Record<string, any> type used for AI output provides no type safety.',
+        suggestedFix: 'Define specific interface or use zod schema for runtime validation.',
+    },
+    // Object type without specifics
+    {
+        name: 'Generic object type for AI response',
+        pattern: /(?:response|completion|aiOutput)\s*:\s*(?:object|Object|{})\b/gi,
+        riskType: 'weak_schema',
+        baseSeverity: 'info',
+        description: 'Generic object type for AI response. Consider defining specific interface.',
+        suggestedFix: 'Replace with specific interface that documents expected AI output structure.',
+    },
+];
+/**
+ * Tool parameter validation issues
+ */
+const TOOL_PARAM_PATTERNS = [
+    // Tool parameters used directly in paths
+    {
+        name: 'Tool parameter used in file path',
+        pattern: /(?:tool|args|parameters)(?:\.\w+)*\.(?:path|filename|filepath|file).*(?:readFile|writeFile|fs\.|path\.)/gi,
+        riskType: 'tool_params',
+        baseSeverity: 'high',
+        description: 'AI-generated file path used without validation. Path traversal attack possible.',
+        suggestedFix: 'Validate path against allowlist: if (!allowedPaths.some(p => resolvedPath.startsWith(p))) throw new Error("Invalid path")',
+    },
+    // Tool parameters in commands
+    {
+        name: 'Tool parameter used in shell command',
+        pattern: /(?:tool|args|parameters)(?:\.\w+)*\.(?:command|cmd|script).*(?:exec|spawn|shell)/gi,
+        riskType: 'tool_params',
+        baseSeverity: 'critical',
+        description: 'AI-generated command executed without validation. Command injection possible.',
+        suggestedFix: 'Use allowlist for permitted commands. Never execute arbitrary AI-generated commands.',
+    },
+    // Tool parameters in URLs
+    {
+        name: 'Tool parameter used in URL',
+        pattern: /(?:tool|args|parameters)(?:\.\w+)*\.(?:url|endpoint|host).*(?:fetch|axios|request|http)/gi,
+        riskType: 'tool_params',
+        baseSeverity: 'high',
+        description: 'AI-generated URL used without validation. SSRF attack possible.',
+        suggestedFix: 'Validate URL against allowlist of permitted hosts before making request.',
+    },
+    // Tool parameters in database queries
+    {
+        name: 'Tool parameter used in database query',
+        pattern: /(?:tool|args|parameters)(?:\.\w+)*\.(?:query|sql|table|column).*(?:\.query|\.execute|\.raw)/gi,
+        riskType: 'tool_params',
+        baseSeverity: 'high',
+        description: 'AI-generated value used in database query. SQL injection possible.',
+        suggestedFix: 'Use parameterized queries. Validate table/column names against allowlist.',
+    },
+    // Function call name used in switch/if
+    {
+        name: 'Tool/function call routed without validation',
+        pattern: /(?:tool_call|function_call|functionCall)\.(?:name|function\.name).*(?:switch|if|\[.*\])/gi,
+        riskType: 'tool_params',
+        baseSeverity: 'medium',
+        description: 'AI-selected function name used for routing. Validate against allowed functions.',
+        suggestedFix: 'Check function name against allowlist: const allowedFunctions = ["search", "calculate"]; if (!allowedFunctions.includes(name)) throw',
+    },
+];
+// ============================================================================
+// Main Detection Function
+// ============================================================================
+/**
+ * Main detection function for AI schema/tooling validation issues
+ */
+function detectAISchemaValidation(content, filePath, options) {
+    const vulnerabilities = [];
+    // Skip non-applicable files
+    if ((0, file_classifier_1.isScannerOrFixtureFile)(filePath))
+        return vulnerabilities;
+    if ((0, file_classifier_1.isDocumentationFile)(filePath))
+        return vulnerabilities;
+    // Only scan files in AI context
+    if (!isAIContextFile(filePath, content)) {
+        return vulnerabilities;
+    }
+    const lines = options?.parsed?.lines ?? content.split('\n');
+    const isTestFile = (0, file_classifier_1.isTestOrMockFile)(filePath);
+    // Check file-level validation presence
+    const fileHasValidation = hasSchemaValidation(content);
+    // Process all pattern categories
+    const allPatterns = [
+        ...UNVALIDATED_PARSING_PATTERNS,
+        ...WEAK_SCHEMA_PATTERNS,
+        ...TOOL_PARAM_PATTERNS,
+    ];
+    for (const pattern of allPatterns) {
+        const regex = new RegExp(pattern.pattern.source, pattern.pattern.flags);
+        let match;
+        while ((match = regex.exec(content)) !== null) {
+            const lineNumber = content.substring(0, match.index).split('\n').length;
+            const lineContent = lines[lineNumber - 1]?.trim() || '';
+            // Skip comments
+            if ((0, file_classifier_1.isComment)(lineContent))
+                continue;
+            // Get surrounding context
+            const context = getSurroundingContext(content, lineNumber - 1, 20);
+            // Check for local validation
+            const localHasValidation = hasSchemaValidation(context);
+            const localHasTryCatch = hasTryCatch(content, lineNumber - 1);
+            const localHasSecuritySink = hasSecuritySink(context);
+            // Calculate severity based on context
+            let severity = pattern.baseSeverity;
+            const notes = [];
+            // Apply context-aware adjustments
+            if (pattern.riskType === 'unvalidated_parse') {
+                if (localHasValidation || fileHasValidation) {
+                    severity = 'info';
+                    notes.push('Schema validation detected nearby');
+                }
+                else if (localHasSecuritySink) {
+                    // Elevate if used in security-sensitive context
+                    if (severity === 'medium')
+                        severity = 'high';
+                    notes.push('Used in security-sensitive context');
+                }
+                else if (localHasTryCatch && !localHasSecuritySink) {
+                    // Try-catch without sink is minor
+                    severity = 'low';
+                    notes.push('Has try-catch but no schema validation');
+                }
+            }
+            if (pattern.riskType === 'weak_schema') {
+                // Weak schemas at API boundaries are more concerning
+                if (/export|handler|route|api/i.test(context)) {
+                    if (severity === 'low')
+                        severity = 'medium';
+                    notes.push('At API boundary');
+                }
+            }
+            if (pattern.riskType === 'tool_params') {
+                // Already high/critical, check for mitigation
+                if (localHasValidation) {
+                    severity = severity === 'critical' ? 'medium' : 'low';
+                    notes.push('Validation detected');
+                }
+            }
+            // Downgrade test files
+            if (isTestFile) {
+                severity = 'info';
+                notes.push('in test file');
+            }
+            // Build final description
+            let description = pattern.description;
+            if (notes.length > 0) {
+                description += ` (${notes.join('; ')})`;
+            }
+            vulnerabilities.push({
+                id: `ai-schema-${filePath}-${lineNumber}-${pattern.name.replace(/\s+/g, '-')}`,
+                filePath,
+                lineNumber,
+                lineContent,
+                severity,
+                category: 'ai_schema_mismatch',
+                title: pattern.name,
+                description,
+                suggestedFix: pattern.suggestedFix,
+                confidence: severity === 'info' ? 'low' : 'medium',
+                layer: 2,
+                source: 'ai_code',
+                requiresAIValidation: true, // Tier B - always validate with AI
+                baseConfidence: BASE_CONFIDENCE,
+            });
+        }
+    }
+    return vulnerabilities;
+}
+//# sourceMappingURL=schema-validation.js.map

package/dist/detect/ai-code/schema-validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-validation.js","sourceRoot":"","sources":["../../../src/detect/ai-code/schema-validation.ts"],"names":[],"mappings":";AAAA;;;;;;;;;GASG;;AA0SH,4DAoHC;AAGQ,0CAAe;AAAE,kDAAmB;AA7Z7C,iEAKoC;AAEpC,MAAM,eAAe,GAAG,IAAI,CAAA;AAE5B,+EAA+E;AAC/E,oBAAoB;AACpB,+EAA+E;AAE/E;;GAEG;AACH,SAAS,eAAe,CAAC,QAAgB,EAAE,OAAe;IACxD,qBAAqB;IACrB,MAAM,cAAc,GAAG;QACrB,oDAAoD;QACpD,2DAA2D;KAC5D,CAAA;IAED,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,IAAI,CAAA;IACb,CAAC;IAED,mBAAmB;IACnB,MAAM,iBAAiB,GAAG;QACxB,oDAAoD;QACpD,+BAA+B;QAC/B,qBAAqB;QACrB,yCAAyC;QACzC,yCAAyC;QACzC,gDAAgD;KACjD,CAAA;IAED,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACrD,CAAC;AAED;;GAEG;AACH,SAAS,mBAAmB,CAAC,OAAe;IAC1C,MAAM,kBAAkB,GAAG;QACzB,MAAM;QACN,yCAAyC;QACzC,4BAA4B;QAC5B,sBAAsB;QACtB,MAAM;QACN,4BAA4B;QAC5B,6BAA6B;QAC7B,MAAM;QACN,4CAA4C;QAC5C,0BAA0B;QAC1B,MAAM;QACN,4CAA4C;QAC5C,UAAU;QACV,iCAAiC;QACjC,0BAA0B;QAC1B,qBAAqB;QACrB,iCAAiC;QACjC,kCAAkC;QAClC,4BAA4B;QAC5B,+BAA+B;QAC/B,kBAAkB;KACnB,CAAA;IACD,OAAO,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AACtD,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,YAAY,GAAG;QACnB,kBAAkB;QAClB,YAAY;QACZ,gBAAgB;QAChB,uBAAuB;QACvB,gBAAgB;QAChB,iBAAiB;QACjB,eAAe;QACf,iBAAiB;QACjB,aAAa;QACb,4CAA4C;QAC5C,oBAAoB;QACpB,0CAA0C;QAC1C,6BAA6B;QAC7B,gBAAgB;QAChB,kCAAkC;QAClC,4BAA4B;QAC5B,oCAAoC;KACrC,CAAA;IACD,OAAO,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAA;AAChD,CAAC;AAED;;GAEG;AACH,SAAS,WAAW,CAAC,OAAe,EAAE,SAAiB;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,EAAE,CAAC,CAAA;IACzC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG,CAAC,CAAC,CAAA;IACjD,MAAM,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAElD,sCAAsC;IACtC,MAAM,UAAU,GAAG,gBAAgB,CAAA;IACnC,MAAM,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAC9D,OAAO,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;AACvC,CAAC;AAED;;GAEG;AACH,SAAS,qBAAqB,CAAC,OAAe,EAAE,SAAiB,EAAE,aAAqB,EAAE;IACxF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,SAAS,GAAG,UAAU,CAAC,CAAA;IACjD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,SAAS,GAAG,UAAU,CAAC,CAAA;IAC1D,OAAO,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AAC3C,CAAC;AAeD;;GAEG;AACH,MAAM,4BAA4B,GAA8B;IAC9D,oCAAoC;IACpC;QACE,IAAI,EAAE,+CAA+C;QACrD,OAAO,EAAE,6GAA6G;QACtH,QAAQ,EAAE,mBAAmB;QAC7B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,yGAAyG;QACtH,YAAY,EAAE,4FAA4F;KAC3G;IACD,yBAAyB;IACzB;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,iEAAiE;QAC1E,QAAQ,EAAE,mBAAmB;QAC7B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,4FAA4F;QACzG,YAAY,EAAE,oHAAoH;KACnI;IACD,4BAA4B;IAC5B;QACE,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,mDAAmD;QAC5D,QAAQ,EAAE,mBAAmB;QAC7B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,wFAAwF;QACrG,YAAY,EAAE,4EAA4E;KAC3F;IACD,8BAA8B;IAC9B;QACE,IAAI,EAAE,+CAA+C;QACrD,OAAO,EAAE,oGAAoG;QAC7G,QAAQ,EAAE,mBAAmB;QAC7B,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,kGAAkG;QAC/G,YAAY,EAAE,kHAAkH;KACjI;IACD,4BAA4B;IAC5B;QACE,IAAI,EAAE,+CAA+C;QACrD,OAAO,EAAE,8HAA8H;QACvI,QAAQ,EAAE,mBAAmB;QAC7B,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,sFAAsF;QACnG,YAAY,EAAE,gFAAgF;KAC/F;CACF,CAAA;AAED;;GAEG;AACH,MAAM,oBAAoB,GAA8B;IACtD,2BAA2B;IAC3B;QACE,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,yDAAyD;QAClE,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,kFAAkF;QAC/F,YAAY,EAAE,qIAAqI;KACpJ;IACD,yBAAyB;IACzB;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,gEAAgE;QACzE,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,wEAAwE;QACrF,YAAY,EAAE,uEAAuE;KACtF;IACD,sBAAsB;IACtB;QACE,IAAI,EAAE,8CAA8C;QACpD,OAAO,EAAE,gDAAgD;QACzD,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,0EAA0E;QACvF,YAAY,EAAE,0EAA0E;KACzF;IACD,sBAAsB;IACtB;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,0EAA0E;QACnF,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,KAAK;QACnB,WAAW,EAAE,8EAA8E;QAC3F,YAAY,EAAE,qEAAqE;KACpF;IACD,gCAAgC;IAChC;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,iEAAiE;QAC1E,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,4EAA4E;QACzF,YAAY,EAAE,8EAA8E;KAC7F;CACF,CAAA;AAED;;GAEG;AACH,MAAM,mBAAmB,GAA8B;IACrD,yCAAyC;IACzC;QACE,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,2GAA2G;QACpH,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,iFAAiF;QAC9F,YAAY,EAAE,2HAA2H;KAC1I;IACD,8BAA8B;IAC9B;QACE,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EAAE,oFAAoF;QAC7F,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,UAAU;QACxB,WAAW,EAAE,+EAA+E;QAC5F,YAAY,EAAE,sFAAsF;KACrG;IACD,0BAA0B;IAC1B;QACE,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,2FAA2F;QACpG,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,iEAAiE;QAC9E,YAAY,EAAE,0EAA0E;KACzF;IACD,sCAAsC;IACtC;QACE,IAAI,EAAE,uCAAuC;QAC7C,OAAO,EAAE,+FAA+F;QACxG,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,MAAM;QACpB,WAAW,EAAE,oEAAoE;QACjF,YAAY,EAAE,2EAA2E;KAC1F;IACD,uCAAuC;IACvC;QACE,IAAI,EAAE,8CAA8C;QACpD,OAAO,EAAE,2FAA2F;QACpG,QAAQ,EAAE,aAAa;QACvB,YAAY,EAAE,QAAQ;QACtB,WAAW,EAAE,iFAAiF;QAC9F,YAAY,EAAE,sIAAsI;KACrJ;CACF,CAAA;AAED,+EAA+E;AAC/E,0BAA0B;AAC1B,+EAA+E;AAE/E;;GAEG;AACH,SAAgB,wBAAwB,CACtC,OAAe,EACf,QAAgB,EAChB,OAAiC;IAEjC,MAAM,eAAe,GAAoB,EAAE,CAAA;IAE3C,4BAA4B;IAC5B,IAAI,IAAA,wCAAsB,EAAC,QAAQ,CAAC;QAAE,OAAO,eAAe,CAAA;IAC5D,IAAI,IAAA,qCAAmB,EAAC,QAAQ,CAAC;QAAE,OAAO,eAAe,CAAA;IAEzD,gCAAgC;IAChC,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC;QACxC,OAAO,eAAe,CAAA;IACxB,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,EAAE,MAAM,EAAE,KAAK,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAA;IAC3D,MAAM,UAAU,GAAG,IAAA,kCAAgB,EAAC,QAAQ,CAAC,CAAA;IAE7C,uCAAuC;IACvC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;IAEtD,iCAAiC;IACjC,MAAM,WAAW,GAA8B;QAC7C,GAAG,4BAA4B;QAC/B,GAAG,oBAAoB;QACvB,GAAG,mBAAmB;KACvB,CAAA;IAED,KAAK,MAAM,OAAO,IAAI,WAAW,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,CAAA;QACvE,IAAI,KAAK,CAAA;QAET,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;YAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAA;YACvE,MAAM,WAAW,GAAG,KAAK,CAAC,UAAU,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAA;YAEvD,gBAAgB;YAChB,IAAI,IAAA,2BAAS,EAAC,WAAW,CAAC;gBAAE,SAAQ;YAEpC,0BAA0B;YAC1B,MAAM,OAAO,GAAG,qBAAqB,CAAC,OAAO,EAAE,UAAU,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;YAElE,6BAA6B;YAC7B,MAAM,kBAAkB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAA;YACvD,MAAM,gBAAgB,GAAG,WAAW,CAAC,OAAO,EAAE,UAAU,GAAG,CAAC,CAAC,CAAA;YAC7D,MAAM,oBAAoB,GAAG,eAAe,CAAC,OAAO,CAAC,CAAA;YAErD,sCAAsC;YACtC,IAAI,QAAQ,GAAG,OAAO,CAAC,YAAY,CAAA;YACnC,MAAM,KAAK,GAAa,EAAE,CAAA;YAE1B,kCAAkC;YAClC,IAAI,OAAO,CAAC,QAAQ,KAAK,mBAAmB,EAAE,CAAC;gBAC7C,IAAI,kBAAkB,IAAI,iBAAiB,EAAE,CAAC;oBAC5C,QAAQ,GAAG,MAAM,CAAA;oBACjB,KAAK,CAAC,IAAI,CAAC,mCAAmC,CAAC,CAAA;gBACjD,CAAC;qBAAM,IAAI,oBAAoB,EAAE,CAAC;oBAChC,gDAAgD;oBAChD,IAAI,QAAQ,KAAK,QAAQ;wBAAE,QAAQ,GAAG,MAAM,CAAA;oBAC5C,KAAK,CAAC,IAAI,CAAC,oCAAoC,CAAC,CAAA;gBAClD,CAAC;qBAAM,IAAI,gBAAgB,IAAI,CAAC,oBAAoB,EAAE,CAAC;oBACrD,kCAAkC;oBAClC,QAAQ,GAAG,KAAK,CAAA;oBAChB,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAA;gBACtD,CAAC;YACH,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBACvC,qDAAqD;gBACrD,IAAI,2BAA2B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC9C,IAAI,QAAQ,KAAK,KAAK;wBAAE,QAAQ,GAAG,QAAQ,CAAA;oBAC3C,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;gBAC/B,CAAC;YACH,CAAC;YAED,IAAI,OAAO,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;gBACvC,8CAA8C;gBAC9C,IAAI,kBAAkB,EAAE,CAAC;oBACvB,QAAQ,GAAG,QAAQ,KAAK,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAA;oBACrD,KAAK,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAA;gBACnC,CAAC;YACH,CAAC;YAED,uBAAuB;YACvB,IAAI,UAAU,EAAE,CAAC;gBACf,QAAQ,GAAG,MAAM,CAAA;gBACjB,KAAK,CAAC,IAAI,CAAC,cAAc,CAAC,CAAA;YAC5B,CAAC;YAED,0BAA0B;YAC1B,IAAI,WAAW,GAAG,OAAO,CAAC,WAAW,CAAA;YACrC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,WAAW,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;YACzC,CAAC;YAED,eAAe,CAAC,IAAI,CAAC;gBACnB,EAAE,EAAE,aAAa,QAAQ,IAAI,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE;gBAC9E,QAAQ;gBACR,UAAU;gBACV,WAAW;gBACX,QAAQ;gBACR,QAAQ,EAAE,oBAAoB;gBAC9B,KAAK,EAAE,OAAO,CAAC,IAAI;gBACnB,WAAW;gBACX,YAAY,EAAE,OAAO,CAAC,YAAY;gBAClC,UAAU,EAAE,QAAQ,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ;gBAClD,KAAK,EAAE,CAAC;gBACR,MAAM,EAAE,SAAkB;gBAC1B,oBAAoB,EAAE,IAAI,EAAE,mCAAmC;gBAC/D,cAAc,EAAE,eAAe;aAChC,CAAC,CAAA;QACJ,CAAC;IACH,CAAC;IAED,OAAO,eAAe,CAAA;AACxB,CAAC"}

package/dist/detect/config/agent-skill-injection.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Layer 1: Agent Skill Injection Detection
+ * Detects prompt injection, data exfiltration, and hidden execution
+ * patterns in AI agent skill/configuration files.
+ *
+ * Scans:
+ * - SKILL.md, AGENTS.md, skills.json/yaml
+ * - .cursor/rules/, .cursorrules
+ * - .claude/commands/, .claude/skills/, .claude/tools/
+ * - .github/copilot-instructions.md, .github/agents/
+ * - MCP configs (mcp.json, claude-desktop-config.json)
+ * - .aider, .moltbot, .openclaw configs
+ *
+ * Detection Groups:
+ * 1. Prompt Injection in Skill Prose (HIGH)
+ * 2. Data Exfiltration (CRITICAL)
+ * 3. Hidden Execution (HIGH)
+ * 4. Tool/Function Description Poisoning (HIGH)
+ */
+import type { Vulnerability } from '../../shared/types';
+import type { ParsedFile } from '../../shared/parsed-file';
+interface DetectorOptions {
+    parsed?: ParsedFile;
+}
+export declare function detectAgentSkillInjection(content: string, filePath: string, options?: DetectorOptions): Vulnerability[];
+export {};
+//# sourceMappingURL=agent-skill-injection.d.ts.map

package/dist/detect/config/agent-skill-injection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-skill-injection.d.ts","sourceRoot":"","sources":["../../../src/detect/config/agent-skill-injection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,oBAAoB,CAAA;AAC9E,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAA;AAwY1D,UAAU,eAAe;IACvB,MAAM,CAAC,EAAE,UAAU,CAAA;CACpB;AAED,wBAAgB,yBAAyB,CACvC,OAAO,EAAE,MAAM,EACf,QAAQ,EAAE,MAAM,EAChB,OAAO,CAAC,EAAE,eAAe,GACxB,aAAa,EAAE,CAoGjB"}