@shomra/agent 0.3.17 → 0.3.19

package/src/detect/sast/taint.mjs

@@ -0,0 +1,71 @@
+import { contextChunk, escapeRe, isCommentLine, physicalIdx } from './source-lines.mjs';
+
+function parseAssign(text) {
+  const m = /^\s*(?:export\s+)?(?:const|let|var|await\s+)?\s*([A-Za-z_$][\w$]*(?:\s*,\s*[A-Za-z_$][\w$]*)*)\s*(?::[^=\n]+?)?=(?![=>])\s*([\s\S]+)$/.exec(text);
+  if (!m) return null;
+  const vars = m[1].split(',').map((s) => s.trim()).filter(Boolean);
+  return { vars, rhs: m[2] };
+}
+
+export function taintFindings(lines, units, file, cfg) {
+  const tainted = new Set();
+
+  for (let pass = 0; pass < 2; pass++) {
+    for (const unit of units) {
+      const a = parseAssign(unit.text);
+      if (!a) continue;
+      let taint = cfg.aiCall.test(a.rhs);
+      if (!taint) {
+        for (const t of tainted) {
+          if (new RegExp(`\\b${escapeRe(t)}\\b`).test(a.rhs)) { taint = true; break; }
+        }
+      }
+      if (taint) for (const v of a.vars) tainted.add(v);
+    }
+    if (!tainted.size) break;
+  }
+  if (!tainted.size) return [];
+
+  const out = [];
+  const seen = new Set();
+  for (const unit of units) {
+    cfg.execSink.lastIndex = 0;
+    let m;
+    while ((m = cfg.execSink.exec(unit.text))) {
+
+      const paren = unit.text.indexOf('(', m.index);
+      const argRegion = paren >= 0 ? unit.text.slice(paren) : '';
+      let via = null;
+      for (const t of tainted) {
+        if (new RegExp(`\\b${escapeRe(t)}\\b`).test(argRegion)) { via = t; break; }
+      }
+      if (via) {
+        const idx = physicalIdx(unit, m.index);
+        const trimmed = (lines[idx] ?? '').trim();
+        if (trimmed && !isCommentLine(trimmed) && !seen.has(idx)) {
+          seen.add(idx);
+          const sink = m[0].replace(/\s*\($/, '').trim();
+          out.push({
+            ruleId: cfg.ruleId,
+            title: 'LLM output may reach a code-execution sink (heuristic)',
+
+            severity: 'HIGH',
+            category: 'taint-heuristic',
+            confidence: 0.5,
+            file,
+            line: idx + 1,
+            sink: sink.slice(0, 120),
+            source: 'LLM output',
+            taint: `${via} (LLM output) → ${sink} (heuristic name match - confirm)`,
+            ...contextChunk(lines, idx),
+            message: `A variable that appears to derive from an LLM call ("${via}") is used in ${sink}. If that value really is model-controlled, a prompt-injected instruction becomes code execution in the host - a critical agent vulnerability. Flagged by a name-propagation heuristic (no dataflow proof), so confirm the value is actually the model output and not reassigned/sanitized before this line.`,
+            remediation: 'If confirmed, never pass model output to eval/exec/subprocess. Constrain the model to structured output (a fixed schema / tool-call allowlist), validate it, and dispatch on named handlers - never execute it.',
+            cwe: 'CWE-94',
+          });
+        }
+      }
+      if (!cfg.execSink.global) break;
+    }
+  }
+  return out;
+}

package/src/detect/signals/artifacts.mjs

@@ -0,0 +1,113 @@
+import { assessUrl } from './egress.mjs';
+import { lineAt, lineOf } from './lines.mjs';
+import { MALICIOUS_PACKAGE_SEED, POPULAR_PACKAGES, editDistance, packageFromCommand } from './packages.mjs';
+import { SECRET_PATTERNS } from './secrets.mjs';
+
+export const HIGH_IMPACT_TOOLS = ['bash', 'shell', 'exec', 'execute', 'run', 'terminal', 'command', 'write', 'edit', 'multiedit', 'writefile', 'write_file', 'create', 'delete', 'remove', 'rm', 'webfetch', 'web_fetch', 'fetch', 'browser', 'network', 'http', 'curl', 'computer', 'automation'];
+
+export function isWildcardGrant(t) { const s = t.trim().toLowerCase().replace(/^["']|["']$/g, ''); return s === '*' || s === 'all' || s === 'any'; }
+
+export function baseToolName(t) { return t.split(/[(:\s]/)[0].trim().toLowerCase(); }
+
+export function toToolList(v) {
+  if (v == null) return [];
+  if (Array.isArray(v)) return v.map((x) => String(x).trim()).filter(Boolean);
+  return String(v).replace(/^\[|\]$/g, '').split(/[,\n]+/).map((t) => t.replace(/^["']|["']$/g, '').trim()).filter(Boolean);
+}
+
+export function frontmatter(text) {
+  const m = /^?---\r?\n([\s\S]*?)\r?\n---\r?\n?/.exec(text || '');
+  if (!m) return {};
+  const data = {};
+  let key = null;
+  for (const raw of m[1].split(/\r?\n/)) {
+    if (!raw.trim() || raw.trim().startsWith('#')) continue;
+    const li = /^\s*-\s+(.*)$/.exec(raw);
+    if (li && key) { (Array.isArray(data[key]) ? data[key] : (data[key] = [])).push(li[1].trim().replace(/^["']|["']$/g, '')); continue; }
+    const kv = /^([A-Za-z0-9_.-]+)\s*:\s*(.*)$/.exec(raw);
+    if (!kv) continue;
+    key = kv[1];
+    const val = kv[2].trim();
+    data[key] = val === '' ? (data[key] ?? null) : val.startsWith('[') ? toToolList(val) : val.replace(/^["']|["']$/g, '');
+  }
+  return data;
+}
+
+function mcpServersFrom(content) {
+  let json;
+  try { json = JSON.parse(content); } catch { return []; }
+  const map = json?.mcpServers ?? json?.servers ?? json?.mcp?.servers ?? json?.context_servers ?? {};
+  if (!map || typeof map !== 'object') return [];
+  return Object.entries(map).map(([name, cfg]) => ({ name, ...(cfg && typeof cfg === 'object' ? cfg : {}) }));
+}
+
+export function localMcp(content) {
+  const out = [];
+  const push = (severity, title, remediationText, line) => out.push({ severity, title, remediationText, ...(line ? { line } : {}) });
+  for (const s of mcpServersFrom(content)) {
+    const cmdLine = [s.command, ...(s.args ?? [])].filter(Boolean).join(' ');
+    if (s.url && String(s.url).startsWith('http://')) {
+      push('MEDIUM', `MCP server "${s.name}" uses plaintext HTTP`, 'Use an https:// endpoint and require an authenticated bearer token.', lineOf(content, String(s.url)));
+    }
+    const envBlob = JSON.stringify(s.env ?? {});
+    for (const { name, re } of SECRET_PATTERNS) {
+      if (re.test(envBlob) || re.test(cmdLine)) {
+        push('CRITICAL', `Static credential in MCP server "${s.name}"`, 'Rotate the credential and pass it via a runtime env reference, not a literal in the config.', lineOf(content, re));
+        break;
+      }
+    }
+    const pkg = packageFromCommand(s.command, s.args ?? []);
+    if (pkg) {
+      if (MALICIOUS_PACKAGE_SEED.has(pkg)) {
+        push('CRITICAL', `MCP server "${s.name}" runs a known-malicious package (${pkg})`, 'Remove this server and audit for compromise. Replace with a vetted alternative.', lineOf(content, pkg));
+      } else {
+        const squat = POPULAR_PACKAGES.find((p) => p !== pkg && editDistance(pkg, p) === 1);
+        if (squat) push('MEDIUM', `Possible typosquat in "${s.name}": ${pkg} (looks like "${squat}")`, `Confirm the intended package is "${squat}", not "${pkg}", and pin it.`, lineOf(content, pkg));
+      }
+    }
+  }
+  return out;
+}
+
+export function localAgentCard(content) {
+  const out = [];
+  const push = (severity, title, remediationText, line) => out.push({ severity, title, remediationText, ...(line ? { line } : {}) });
+  let card;
+  try { card = JSON.parse(content); } catch { return out; }
+  const urls = new Set();
+  if (card?.url) urls.add(String(card.url));
+  for (const key of ['endpoints', 'endpoint', 'servers']) {
+    const v = card?.[key];
+    if (Array.isArray(v)) v.forEach((x) => typeof x === 'string' && urls.add(x));
+    else if (typeof v === 'string') urls.add(v);
+  }
+  for (const sk of Array.isArray(card?.skills) ? card.skills : []) if (sk?.url) urls.add(String(sk.url));
+  const seen = new Set();
+  for (const raw of urls) {
+    const u = assessUrl(raw);
+    if (!u) continue;
+    const line = lineOf(content, u.url);
+    if (u.metadataEndpoint && !seen.has('metadata')) { seen.add('metadata'); push('CRITICAL', `Agent card targets the cloud metadata endpoint (${u.url})`, 'Remove this card immediately - a known SSRF credential-theft pattern.', line); }
+    else if (u.privateNetwork && !seen.has('private')) { seen.add('private'); push('MEDIUM', `Agent card declares a private-network endpoint (${u.url})`, 'Publish only public, TLS-protected endpoints in shared agent cards.', line); }
+    if (u.suspiciousHost && !seen.has('exfil')) { seen.add('exfil'); push('HIGH', `Agent card points at an exfiltration-style endpoint (${u.suspiciousHost})`, 'Do not interoperate with this agent; replace the endpoint with the vendor\'s real domain.', line); }
+    if (u.plaintext && !u.privateNetwork && !seen.has('plaintext')) { seen.add('plaintext'); push('MEDIUM', `Agent card uses plaintext HTTP (${u.url})`, 'Serve the agent over https:// only.', line); }
+    if (u.rawIp && !u.privateNetwork && !seen.has('rawip')) { seen.add('rawip'); push('LOW', `Agent card addresses its endpoint by raw IP (${u.url})`, 'Use a DNS hostname with a valid TLS certificate.', line); }
+  }
+  const hasAuth = !!(card?.securitySchemes || card?.authentication || card?.security || card?.auth);
+  if (card?.url && !hasAuth) push('MEDIUM', 'Agent card declares no authentication scheme', 'Declare and enforce an auth scheme (OAuth2 / API key / mTLS) and reject unauthenticated requests.');
+  return out;
+}
+
+export function localCommandExtras(content) {
+  const out = [];
+  const body = content || '';
+  const bang = [...body.matchAll(/^!\s*`?([^`\n]+)`?/gm)];
+  if (bang.length) {
+    const line = bang[0].index != null ? lineAt(body, bang[0].index) : undefined;
+    out.push({ severity: 'LOW', title: `Command runs ${bang.length} shell command(s) before the prompt`, remediationText: 'Confirm each "!" command is fixed and safe; avoid interpolating untrusted arguments.', ...(line ? { line } : {}) });
+  }
+  const atRefs = [...body.matchAll(/(?:^|\s)@([~./][^\s`]+)/g)].map((m) => m[1]);
+  const sensitive = atRefs.find((r) => /(\.env|\.ssh|id_rsa|secret|credential|\.pem|\.key)/i.test(r));
+  if (sensitive) out.push({ severity: 'MEDIUM', title: `Command attaches a sensitive file (@${sensitive})`, remediationText: 'Do not auto-attach secret/key files to prompts; reference only non-sensitive, scoped files.', line: lineOf(body, `@${sensitive}`) });
+  return out;
+}

package/src/detect/signals/autonomy.mjs

@@ -0,0 +1,55 @@
+import { isDocumentationLine, prohibitsAt } from './prose-context.mjs';
+
+const AUTONOMY_RULES = [
+  { family: 'confirmation', label: 'Acts without asking', re: /\b(?:without (?:asking|confirming|prompting|waiting for|seeking)(?:\s+(?:the\s+)?(?:user|me|anyone|permission|approval|confirmation))?|do(?:es)? not (?:ask|prompt|wait|check|confirm)[^.\n]{0,30}\b(?:for|before|first|permission|approval|confirmation)|no need to (?:ask|confirm|check with))\b/i },
+  { family: 'confirmation', label: 'Approval pre-granted', re: /\b(?:auto(?:matically)?[- ]?approve|always approve|approve (?:all|every|any)[^.\n]{0,24}\b(?:tool|call|action|command|change)s?|treat (?:all|every|any)[^.\n]{0,24}\bas (?:pre-?)?approved|consider (?:this|it|yourself) (?:pre-?)?authoriz)/i },
+  { family: 'confirmation', label: 'Confirmation step skipped', re: /\b(?:skip|bypass|suppress|omit)(?:\s+\w+){0,2}\s+(?:the\s+)?(?:confirmation|approval|permission|consent)\b/i },
+  { family: 'concealment', label: 'Own actions hidden from the user', re: /\b(?:do(?:es)? not|don'?t|never)\s+(?:mention|tell|inform|notify|report to|disclose to|reveal to|show)\s+(?:the\s+)?(?:user|human|operator|them|anyone)\b|\bwithout (?:telling|informing|notifying|alerting)\s+(?:the\s+)?(?:user|human|operator|anyone)\b/i },
+  { family: 'concealment', label: 'Work not reported back', re: /\b(?:do(?:es)? not|don'?t|never)\s+(?:summari[sz]e|report|log|record|list|describe|explain)[^.\n]{0,40}\b(?:what you (?:did|changed|ran|edited|deleted|installed)|the (?:changes|commands|actions|edits) you|your (?:changes|actions|edits|commands))\b/i },
+  { family: 'concealment', label: 'Instructions kept secret', re: /\b(?:do(?:es)? not|don'?t|never)\s+(?:mention|reveal|disclose|quote|repeat|share|output)[^.\n]{0,30}\b(?:these|this|your|the)\s+(?:instructions?|rules?|prompt|guidelines?|file)\b|\bkeep (?:this|these|it) (?:secret|hidden|confidential|between us|to yourself)\b/i },
+  { family: 'guardrail', label: 'Safety control overridden', re: /\b(?:ignore|disable|bypass|override|turn off|switch off|work around|circumvent|disregard)(?:\s+\w+){0,3}\s+(?:the\s+|any\s+|all\s+)?(?:safety|guardrails?|guard|security (?:check|control|policy)|restrictions?|limitations?|policies|policy|safeguards?|protections?)\b/i },
+  { family: 'verification', label: 'Verification waived', re: /\b(?:do(?:es)? not|don'?t|never|no need to|skip)\s+(?:bother\s+)?(?:run(?:ning)?|execut\w+)?\s*(?:the\s+)?(?:tests?|test suite|linter|lint|type ?check|build|review|checks)\s*(?:before|first|prior to)\b|\b(?:skip|bypass)\s+(?:the\s+)?(?:review|code review|tests?|test suite|ci)\b/i },
+];
+
+function insideQuotedSpan(line, at) {
+  let dq = 0;
+  let tick = 0;
+  for (let i = 0; i < at && i < line.length; i++) {
+    const c = line[i];
+    if (c === '"' || c === '“' || c === '”') dq++;
+    else if (c === '`') tick++;
+  }
+  return dq % 2 === 1 || tick % 2 === 1;
+}
+
+export function localAutonomy(text) {
+  const body = String(text ?? '');
+  if (!body.trim()) return [];
+  const out = [];
+  const seen = new Set();
+  const lines = body.split(/\r?\n/).slice(0, 4000);
+  for (let i = 0; i < lines.length && out.length < 12; i++) {
+    const line = lines[i];
+    if (!line || line.length > 2000) continue;
+    for (const rule of AUTONOMY_RULES) {
+      if (seen.has(rule.label)) continue;
+      const m = rule.re.exec(line);
+      if (!m) continue;
+      if (isDocumentationLine(line)) continue;
+      if (prohibitsAt(line, m.index)) continue;
+      if (insideQuotedSpan(line, m.index)) continue;
+      seen.add(rule.label);
+      out.push({ family: rule.family, label: rule.label, line: i + 1 });
+    }
+  }
+  return out;
+}
+
+export function autonomySeverity(signals) {
+  if (!signals.length) return null;
+  const f = new Set(signals.map((s) => s.family));
+  if (f.has('confirmation') && f.has('concealment')) return 'CRITICAL';
+  if (f.has('guardrail')) return 'HIGH';
+  if (f.size >= 2) return 'HIGH';
+  return 'MEDIUM';
+}

package/src/detect/signals/config-markers.mjs

@@ -0,0 +1,28 @@
+import { markerRe } from './text-match.mjs';
+
+export const RISKY_CONFIG_MARKERS = [
+  'yolo', 'auto-approve', 'autoapprove', 'auto_approve', 'autorun', 'auto-run',
+  'always allow', 'alwaysallow', 'dangerously', 'skip confirmation', 'no confirmation',
+  'disable safety', 'bypass approval', 'full access', 'unrestricted',
+];
+
+const FLAG_BEFORE = /(?:^|\s)--?[\w-]*$/;
+
+const ENABLE_AFTER = /^["'`\]]?\s*[:=]/;
+
+const ENABLE_BEFORE = /[:=]\s*["'`\[]?\s*$/;
+
+function isEnablement(text, at, len) {
+  const before = text.slice(Math.max(0, at - 24), at);
+  const after = text.slice(at + len, at + len + 12);
+  return FLAG_BEFORE.test(before) || ENABLE_AFTER.test(after) || ENABLE_BEFORE.test(before);
+}
+
+export function riskyConfigHit(text, marker) {
+  const re = markerRe(marker);
+  let m;
+  while ((m = re.exec(text)) !== null) {
+    if (isEnablement(text, m.index, m[0].length)) return { start: m.index, end: m.index + m[0].length };
+  }
+  return null;
+}

package/src/detect/signals/credential-harvest.mjs

@@ -0,0 +1,64 @@
+import { isDocumentationLine, prohibitsAt } from './prose-context.mjs';
+
+const HARVEST_PROMPTS = [
+  { re: /\bosascript\b[\s\S]{0,200}?\bdisplay\s+dialog\b[\s\S]{0,200}?\bhidden\s+answer\b/i, label: 'osascript password dialog (hidden answer)' },
+  { re: /\bdo\s+shell\s+script\b[\s\S]{0,160}?\bwith\s+administrator\s+privileges\b/i, label: 'AppleScript privilege elevation' },
+  { re: /\bosascript\b[\s\S]{0,200}?\bdisplay\s+dialog\b[\s\S]{0,160}?\b(?:password|passcode|credential|keychain|unlock)\b/i, label: 'osascript credential dialog' },
+  { re: /\b(?:zenity|kdialog|yad)\b[^\n]{0,120}?--password\b/i, label: 'desktop password dialog' },
+  { re: /\bSUDO_ASKPASS\s*=|\bsudo\s+-A\b/i, label: 'sudo askpass helper' },
+  { re: /\b(?:Get-Credential|PromptForCredential|CredUIPromptForCredentials)\b/i, label: 'Windows credential prompt' },
+];
+
+const HARVEST_STORES = [
+  { re: /\bsecurity\s+(?:dump-keychain|find-(?:generic|internet)-password|export)\b/i, family: 'credential-store', label: 'macOS keychain read' },
+  { re: /(?:~|\$HOME|\/Users\/[^/\s]+)\/Library\/Keychains\b/i, family: 'credential-store', label: 'macOS keychain files' },
+  { re: /\bLogin\s?Data\b|\bLocal\s?State\b(?=[\s\S]{0,80}(?:Chrome|Chromium|Edge|Brave))/i, family: 'credential-store', label: 'Chromium credential database' },
+  { re: /\b(?:logins\.json|key[34]\.db|cert9\.db)\b/i, family: 'credential-store', label: 'Firefox credential database' },
+  { re: /\bcookies\.sqlite\b|\bCookies\b(?=[\s\S]{0,80}(?:Chrome|Chromium|Edge|Brave|Safari))/i, family: 'credential-store', label: 'browser cookie store' },
+  { re: /(?:~|\$HOME)\/\.(?:mozilla|config\/google-chrome|config\/chromium|config\/BraveSoftware)\b/i, family: 'credential-store', label: 'browser profile directory' },
+  { re: /\b(?:Exodus|Electrum|Coinomi|Atomic\s?Wallet|MetaMask|Ledger\s?Live|Trezor\s?Suite)\b|\bwallet\.dat\b|(?:~|\$HOME)\/\.ethereum\/keystore\b/i, family: 'wallet', label: 'cryptocurrency wallet store' },
+];
+
+const HARVEST_TOKEN_PATH =
+  /(?:~|\$HOME)\/\.(?:npmrc|pypirc|netrc|docker\/config\.json|kube\/config|config\/gh\/hosts\.yml|config\/gcloud\/credentials\.db|cargo\/credentials(?:\.toml)?)\b/i;
+
+const HARVEST_EXFIL_VERB = /\b(?:cp|copy|mv|scp|rsync|tar|zip|curl|wget|base64|cat|xxd|upload|post|send|exfil\w*)\b/i;
+
+const HARVEST_MOVE_VERB = /\b(?:cp|copy|mv|scp|rsync|tar|zip|curl|wget|base64|xxd|upload|post|send|exfil\w*)\b/i;
+
+const HARVEST_READ_VERB = /\b(?:cat|cp|copy|mv|scp|rsync|tar|zip|dd|xxd|base64|open|read|sqlite3?|strings|python\d?|node|osascript|security|plutil|defaults)\b|[<>|]/i;
+
+export function detectCredentialHarvest(text) {
+  const body = String(text ?? '');
+  if (!body.trim()) return [];
+  const out = [];
+  const seen = new Set();
+  const push = (family, label, severity, i, line) => {
+    if (seen.has(label) || out.length >= 12) return;
+    seen.add(label);
+    out.push({ family, label, severity, line: i + 1, sample: line.trim().slice(0, 200) });
+  };
+  const lines = body.split(/\r?\n/);
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    if (!line.trim() || line.length > 2000) continue;
+    for (const p of HARVEST_PROMPTS) {
+      const m = p.re.exec(line);
+      if (!m) continue;
+      if (isDocumentationLine(line) || prohibitsAt(line, m.index)) continue;
+      push('interactive-prompt', p.label, 'CRITICAL', i, line);
+    }
+    for (const s of HARVEST_STORES) {
+      const m = s.re.exec(line);
+      if (!m) continue;
+      if (!HARVEST_READ_VERB.test(line)) continue;
+      if (isDocumentationLine(line) || prohibitsAt(line, m.index)) continue;
+      push(s.family, s.label, HARVEST_EXFIL_VERB.test(line) ? 'CRITICAL' : 'HIGH', i, line);
+    }
+    const t = HARVEST_TOKEN_PATH.exec(line);
+    if (t && HARVEST_EXFIL_VERB.test(line) && !isDocumentationLine(line) && !prohibitsAt(line, t.index)) {
+      push('token-store', `developer token file (${t[0]})`, HARVEST_MOVE_VERB.test(line) ? 'HIGH' : 'MEDIUM', i, line);
+    }
+  }
+  return out;
+}

package/src/detect/signals/durable-claims.mjs

@@ -0,0 +1,73 @@
+import { citationGoverns, isDescriptiveLine } from './prose-context.mjs';
+
+const CLAIM_FRAMING = [
+  /\b(?:the\s+)?user\s+(?:has\s+|had\s+)?(?:confirmed|indicated|agreed|approved|stated|noted|prefers?|does\s*n[o']t\s+want|doesn'?t\s+want|no\s+longer\s+wants?)\b/i,
+  /\b(?:is|are|was|were)\s+(?:now\s+)?(?:pre[-\s]?)?(?:approved|vetted|verified|trusted|whitelisted|allow[-\s]?listed|safe|exempt|sanctioned)\b/i,
+  /\b(?:standing|blanket|permanent|ongoing)\s+(?:approval|permission|authorisation|authorization|consent|exemption)\b/i,
+  /\b(?:has|have)\s+been\s+(?:granted|given|pre[-\s]?approved|waived|disabled)\b/i,
+  /\b(?:no\s+longer\s+needs?|does\s+not\s+need\s+to\s+be|need\s+not\s+be|is\s+not\s+required)\b/i,
+  /\b(?:the|our|its|a|team'?s)\s+(?:[\w-]+\s+){0,3}(?:contact|recipient|endpoint|destination|webhook|mailbox|address|url)\s+(?:for\s+[^.\n]{0,60}?\s+)?(?:is|are)\b/i,
+  /\b(?:can|may)\s+be\s+(?:treated|considered|regarded)\s+as\s+(?:trusted|safe|internal|verified)\b/i,
+];
+
+const CLAIM_CONSENT = /\b(?:approvals?|approve[ds]?|confirm\w*|permission|authoris\w+|authoriz\w+|sign[-\s]?off|consent|prompt(?:ed|s)?|ask(?:ed|ing)?)\b/i;
+
+const CLAIM_TRUST = /\b(?:trust\w*|vetted|verif\w+|safe|internal|allow[-\s]?list\w*|whitelist\w*|sanctioned|exempt)\b/i;
+
+const CLAIM_ROUTING = /(?:\b(?:endpoint|recipient|contact|destination|webhook|mailbox|upload|forward(?:ed|s)?|cc|bcc)\b|[\w.%+-]{1,64}@[\w-]{1,63}(?:\.[\w-]{1,63}){1,4}|https?:\/\/)/i;
+
+const CLAIM_SUPPRESSION = /\b(?:review\w*|audit\w*|guardrail\w*|safety\s+check|scan\w*|verif\w+|notif\w+|alert\w*|approval\s+step|human\s+in\s+the\s+loop)\b/i;
+
+const CLAIM_REFUSAL =
+  /\b(?:not|never|no)\s+(?:been\s+|yet\s+|longer\s+)?(?:approved|granted|confirmed|vetted|trusted|verified|authoris\w*|authoriz\w*|sanctioned|safe)\b|\bun(?:trusted|verified|approved|vetted)\b|\brefus\w+|\bden(?:y|ied)\b|\bmust\s+still\b|\balways\s+(?:ask|confirm|verify|check|review)\b/i;
+
+export const CLAIM_LABEL = {
+  consent: 'Approval Recorded As Already Given',
+  trust: 'A Source Recorded As Trusted',
+  routing: 'A Durable Destination Recorded',
+  suppression: 'A Control Recorded As Unwanted',
+};
+
+const CLAIM_LEADING_LABEL = /^\s*(?:[-*+]\s*)?(?:note|context|fyi|reminder|memo|user\s+preference|preference|background)\s*:\s*/i;
+
+function claimFamilyOf(line) {
+  if (CLAIM_CONSENT.test(line)) return 'consent';
+  if (CLAIM_TRUST.test(line)) return 'trust';
+  if (CLAIM_SUPPRESSION.test(line)) return 'suppression';
+  if (CLAIM_ROUTING.test(line)) return 'routing';
+  return null;
+}
+
+export function detectDurableClaims(text) {
+  const body = String(text ?? '');
+  if (!body.trim()) return [];
+  const out = [];
+  const lines = body.split(/\r?\n/);
+  for (let i = 0; i < lines.length && out.length < 20; i++) {
+    const line = lines[i];
+    if (line.length < 12 || line.length > 600) continue;
+
+    const stripped = line.replace(CLAIM_LEADING_LABEL, '');
+
+    for (const re of CLAIM_FRAMING) {
+      const m = re.exec(stripped);
+      if (!m) continue;
+      if (citationGoverns(stripped, m.index)) continue;
+
+      const object = (stripped.slice(0, m.index) + ' ' + stripped.slice(m.index + m[0].length)).trim();
+
+      if (isDescriptiveLine(object)) continue;
+      const family = claimFamilyOf(object);
+      if (!family) continue;
+      if (family !== 'routing' && CLAIM_REFUSAL.test(stripped)) continue;
+      out.push({ family, label: CLAIM_LABEL[family], line: i + 1, sample: line.trim().slice(0, 200) });
+      break;
+    }
+  }
+  return out;
+}
+
+export function claimSeverity(claims) {
+  if (!claims.length) return null;
+  return new Set(claims.map((c) => c.family)).size >= 2 ? 'HIGH' : 'MEDIUM';
+}

package/src/detect/signals/egress.mjs

@@ -0,0 +1,56 @@
+export const SUSPICIOUS_EGRESS_HOSTS = [
+  'webhook.site', 'requestbin', 'pipedream.net', 'ngrok.io', 'ngrok-free.app', 'ngrok.app',
+  'trycloudflare.com', 'serveo.net', 'localhost.run', 'interact.sh', 'oastify.com', 'oast.pro',
+  'oast.fun', 'burpcollaborator.net', 'canarytokens.com', 'beeceptor.com', 'requestcatcher.com',
+  'c-net.org', 'pastebin.com', 'paste.ee', 'hastebin.com', 'dpaste.com', 'dpaste.org', 'ix.io',
+  'sprunge.us', 'termbin.com', 'rentry.co', 'controlc.com', 'privatebin.net', 'ghostbin.com',
+  'justpaste.it', 'transfer.sh', '0x0.st', 'file.io', 'gofile.io', 'anonfiles.com',
+  'bashupload.com', 'tmpfiles.org', 'catbox.moe', 'litterbox.catbox.moe', 'temp.sh', 'oshi.at', 'x0.at',
+
+  'webhook.cool', 'hookb.in', 'postb.in', 'webhookrelay.com', 'webhookinbox.com', 'webhook.win',
+  'smee.io', 'mockbin.org', 'requestrepo.com', 'webhook-test.com', 'dnslog.cn', 'ceye.io',
+  'tunnelto.dev', 'loca.lt', 'bore.pub', 'pinggy.io', 'telebit.cloud', 'expose.sh', 'lhr.life',
+  'serveousercontent.com', 'paste.rs', 'bpa.st', 'vpaste.net', 'clbin.com', 'pastes.io',
+  'nopaste.net', 'zerobin.net', 'pastecode.io', 'filebin.net', 'wormhole.app', 'uguu.se',
+  'ufile.io', 'fileditch.com', 'keep.sh', 'envs.sh', 'send.vis.ee', 'pixeldrain.com', 'filetransfer.io',
+];
+
+const EGRESS_RE_CACHE = new Map();
+
+function egressHostRe(host) {
+  let re = EGRESS_RE_CACHE.get(host);
+  if (!re) {
+    re = new RegExp(`(^|[^a-z0-9-])${host.replace(/[.]/g, '\\.')}($|[^a-z0-9.-])`, 'i');
+    EGRESS_RE_CACHE.set(host, re);
+  }
+  return re;
+}
+
+export function egressHost(text) {
+  if (!text) return null;
+  const low = text.toLowerCase();
+  return SUSPICIOUS_EGRESS_HOSTS.find((h) => egressHostRe(h).test(low)) ?? null;
+}
+
+const PRIVATE_HOST_RE = /^(localhost|127\.|10\.|192\.168\.|169\.254\.|0\.0\.0\.0$|172\.(1[6-9]|2\d|3[01])\.)/i;
+
+const RAW_IP_RE = /^\d{1,3}(\.\d{1,3}){3}$/;
+
+export function assessUrl(raw) {
+  const s = String(raw ?? '').trim();
+  if (!s) return null;
+  let u;
+  try { u = new URL(s); } catch { return null; }
+  if (u.protocol !== 'http:' && u.protocol !== 'https:') return null;
+  const host = u.hostname.toLowerCase();
+  return {
+    url: s,
+    plaintext: u.protocol === 'http:',
+    privateNetwork: PRIVATE_HOST_RE.test(host),
+    metadataEndpoint: host === '169.254.169.254' || host === 'metadata.google.internal',
+    suspiciousHost: SUSPICIOUS_EGRESS_HOSTS.find((h) => host === h || host.endsWith('.' + h)) ?? null,
+    rawIp: RAW_IP_RE.test(host),
+  };
+}
+
+export const LOCAL_URL_RE = /\bhttps?:\/\/(localhost|127\.\d+|0\.0\.0\.0|\[::1\]|192\.168\.|10\.\d+|172\.(1[6-9]|2\d|3[01])\.)/i;

package/src/detect/signals/execution-hijack.mjs

@@ -0,0 +1,128 @@
+const HIJACK_LOADERS = [
+  { keys: ['BASH_ENV'], key: 'BASH_ENV', governs: 'every non-interactive bash' },
+  { keys: ['ZDOTDIR'], key: 'ZDOTDIR', governs: 'every zsh startup' },
+  { keys: ['ENV'], key: 'ENV', governs: 'every sh startup', requires: /[/$]|\.sh\b/ },
+  { keys: ['PROMPT_COMMAND'], key: 'PROMPT_COMMAND', governs: 'every bash prompt' },
+  { keys: ['PYTHONSTARTUP'], key: 'PYTHONSTARTUP', governs: 'every interactive python' },
+  { keys: ['PYTHONBREAKPOINT'], key: 'PYTHONBREAKPOINT', governs: 'python, at any breakpoint()' },
+
+  { keys: ['NODE_OPTIONS'], key: 'NODE_OPTIONS', governs: 'every node process', requires: /(?:^|\s)--(?:require|import|experimental-loader|loader|env-file)\b|(?:^|\s)-r\s/, foreignOnly: true },
+  { keys: ['PERL5OPT'], key: 'PERL5OPT', governs: 'every perl process', requires: /(?:^|\s)-[Mm]\S/, foreignOnly: true },
+  { keys: ['RUBYOPT'], key: 'RUBYOPT', governs: 'every ruby process', requires: /(?:^|\s)-r\S/, foreignOnly: true },
+  { keys: ['JAVA_TOOL_OPTIONS', '_JAVA_OPTIONS'], key: 'JAVA_TOOL_OPTIONS', governs: 'every JVM', requires: /-(?:javaagent|agentpath|agentlib|Xbootclasspath)/i, foreignOnly: true },
+  { keys: ['NODE_REPL_EXTERNAL_MODULE'], key: 'NODE_REPL_EXTERNAL_MODULE', governs: 'every node repl' },
+  { keys: ['GIT_EXTERNAL_DIFF'], key: 'GIT_EXTERNAL_DIFF', governs: 'every git diff' },
+  { keys: ['GIT_PROXY_COMMAND'], key: 'GIT_PROXY_COMMAND', governs: 'every git fetch over git://' },
+  { keys: ['GIT_TEMPLATE_DIR'], key: 'GIT_TEMPLATE_DIR', governs: 'every git init / clone (hooks)' },
+  { keys: ['GIT_CONFIG_GLOBAL', 'GIT_CONFIG_SYSTEM'], key: 'GIT_CONFIG_GLOBAL', governs: 'every git command' },
+  { keys: ['LESSOPEN', 'LESSCLOSE'], key: 'LESSOPEN', governs: 'every less / pager invocation' },
+];
+
+const HIJACK_SLOTS = [
+  { keys: ['GIT_PAGER'], key: 'GIT_PAGER', governs: 'every git command that pages' },
+  { keys: ['GIT_EDITOR'], key: 'GIT_EDITOR', governs: 'every git commit / rebase' },
+  { keys: ['GIT_SEQUENCE_EDITOR'], key: 'GIT_SEQUENCE_EDITOR', governs: 'every git rebase -i' },
+  { keys: ['GIT_SSH', 'GIT_SSH_COMMAND'], key: 'GIT_SSH_COMMAND', governs: 'every git fetch / push over ssh' },
+  { keys: ['GIT_ASKPASS', 'SSH_ASKPASS'], key: 'GIT_ASKPASS', governs: 'every credential prompt' },
+  { keys: ['EDITOR', 'VISUAL'], key: 'EDITOR', governs: 'git, crontab, and anything that opens an editor' },
+  { keys: ['PAGER', 'MANPAGER'], key: 'PAGER', governs: 'every command that pages' },
+];
+
+const HIJACK_PRELOADS = /\b(LD_PRELOAD|LD_AUDIT|DYLD_INSERT_LIBRARIES)\b/;
+
+const GIT_EXEC_KEYS =
+  /\b(core\.pager|core\.editor|core\.sshCommand|core\.fsmonitor|core\.hooksPath|core\.askpass|sequence\.editor|diff\.external|diff\.[\w-]+\.textconv|filter\.[\w-]+\.(?:clean|smudge|process)|merge\.[\w-]+\.driver|credential\.helper|uploadpack\.packObjectsHook)\b/i;
+
+const GIT_ALIAS_KEY = /\balias\.[\w-]+\b/i;
+
+const HIJACK_PLAIN_PROGRAM = /^[\w./-]{1,64}(?:\s+-{1,2}[\w-]{1,32}){0,4}$/;
+
+const HIJACK_SHELLY = /[;&|`$(){}<>]|\s-c\s|(?<![.\w])(?:sh|bash|zsh|dash|python\d?|node|perl|ruby|eval)\b/i;
+
+const HIJACK_WORLD_WRITABLE = /(^|[\s'"=:])(\/tmp\/|\/var\/tmp\/|\/dev\/shm\/|~\/\.cache\/|\$TMPDIR|\/private\/tmp\/)/i;
+
+const HIJACK_ASSIGN =
+  /(?:^|[\s;&|(]|\b(?:export|declare|typeset|setenv|set\s+-x)\s+)([A-Za-z_][A-Za-z0-9_]*)\s*=\s*("([^"]*)"|'([^']*)'|[^\s;&|)]*)/g;
+
+const HIJACK_GIT_CONFIG =
+  /\bgit\s+config\s+(?:--(?:global|system|local|worktree|add|replace-all)\s+|--file\s+\S+\s+)*([\w.*-]+)\s+("[^"]*"|'[^']*'|\S+)/i;
+
+const hijackUnquote = (raw) => String(raw ?? '').replace(/^["']|["']$/g, '');
+
+function hijackForeignTarget(value) {
+  if (HIJACK_SHELLY.test(value)) return true;
+  for (const raw of String(value).split(/[\s,]+/)) {
+    const token = raw.replace(/^--?[A-Za-z][\w-]*[=:]?/, '').replace(/^file:\/\//, '');
+    if (/^~?\//.test(token)) return true;
+  }
+  return false;
+}
+
+const hijackLoaderSeverity = (v) => (!String(v).trim() ? 'MEDIUM' : HIJACK_SHELLY.test(v) || HIJACK_WORLD_WRITABLE.test(v) ? 'CRITICAL' : 'HIGH');
+
+function hijackPathShadow(value) {
+  const head = hijackUnquote(value).split(':')[0]?.trim();
+  if (!head || /\$PATH/.test(head)) return null;
+  if (/^(\.|\.\/|\$\{?PWD\}?|\$\{?CI_PROJECT_DIR\}?|\$\{?GITHUB_WORKSPACE\}?|node_modules|\$\{?HOME\}?\/\.(?:local|nvm|rbenv|pyenv|cargo|bun|deno|volta)\b|~\/\.(?:local|nvm|rbenv|pyenv|cargo|bun|deno|volta)\b)/i.test(head)) return null;
+  if (!HIJACK_WORLD_WRITABLE.test(head) && !/^[^/$~]/.test(head)) return null;
+  return {
+    vector: 'path-shadow', key: 'PATH', governs: 'every command resolved by name',
+    severity: HIJACK_WORLD_WRITABLE.test(head) ? 'HIGH' : 'MEDIUM', value: head,
+    detail: `PATH is prepended with "${head}", which is outside the workspace. Every later command resolved by NAME - including any an allowlist names - can be shadowed from there.`,
+  };
+}
+
+export function detectExecutionHijack(command) {
+  const text = String(command ?? '');
+  if (!text.trim()) return [];
+  const out = [];
+  for (const m of text.matchAll(HIJACK_ASSIGN)) {
+    const key = m[1];
+    const value = hijackUnquote(m[2] ?? '');
+    if (key === 'PATH') {
+      const p = hijackPathShadow(m[2] ?? '');
+      if (p) out.push(p);
+      continue;
+    }
+    const loader = HIJACK_LOADERS.find((l) => l.keys.includes(key));
+    if (loader && (!loader.requires || loader.requires.test(value)) && (!loader.foreignOnly || hijackForeignTarget(value))) {
+      out.push({
+        vector: 'env-var', key: loader.key, governs: loader.governs, severity: hijackLoaderSeverity(value), value,
+        detail: `${loader.key} names code that ${loader.governs} loads before doing anything else. Setting it turns an already-approved command into one that runs "${value || '(empty)'}" first - no dangerous command is ever issued.`,
+      });
+      continue;
+    }
+    if (HIJACK_PRELOADS.test(key)) {
+      out.push({
+        vector: 'env-var', key, governs: 'every dynamically linked process', severity: 'CRITICAL', value,
+        detail: `${key} injects "${value}" into every process started afterwards, whatever the allowlist says about the command that starts it.`,
+      });
+      continue;
+    }
+    const slot = HIJACK_SLOTS.find((p) => p.keys.includes(key));
+    if (slot && value && !HIJACK_PLAIN_PROGRAM.test(value.trim())) {
+      out.push({
+        vector: 'env-var', key: slot.key, governs: slot.governs, severity: HIJACK_SHELLY.test(value) ? 'CRITICAL' : 'HIGH', value,
+        detail: `${slot.key} is set to "${value}", which is a command line rather than an editor or pager. ${slot.governs} will run it - the hijack rides an approved command, not a refused one.`,
+      });
+    }
+  }
+  for (const line of text.split(/[\n;]|&&|\|\|/)) {
+    const m = HIJACK_GIT_CONFIG.exec(line);
+    if (!m) continue;
+    const key = m[1];
+    const value = hijackUnquote(m[2].trim());
+    const isAlias = GIT_ALIAS_KEY.test(key) && /^\s*!/.test(value);
+    if (!GIT_EXEC_KEYS.test(key) && !isAlias) continue;
+    const shelly = HIJACK_SHELLY.test(value) || HIJACK_WORLD_WRITABLE.test(value) || isAlias;
+    if (!shelly && HIJACK_PLAIN_PROGRAM.test(value)) continue;
+    out.push({
+      vector: 'git-config', key,
+      governs: isAlias ? `git ${key.split('.')[1]}` : 'every later git command that reaches this hook',
+      severity: shelly ? 'CRITICAL' : 'HIGH', value,
+      detail: `git config "${key}" is set to "${value}". Git executes this value, so every later git command - including ones an allowlist names - runs it. The configuration outlives the session.`,
+    });
+  }
+  const seen = new Set();
+  return out.filter((s) => (seen.has(`${s.vector}:${s.key}`) ? false : (seen.add(`${s.vector}:${s.key}`), true)));
+}