@stroq/cli 0.10.1 → 0.12.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +19 -12
- package/dist/asi.json +19 -0
- package/dist/atlas.json +993 -0
- package/dist/corpus.json +362 -0
- package/dist/index.js +2274 -508
- package/dist/scope.json +426 -0
- package/openclaw-plugin/openclaw.plugin.json +1 -1
- package/openclaw-plugin/package.json +1 -1
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -36,18 +36,25 @@ MCP proxy note: for clients with no hook API, `--agent mcp` rewrites the client'
|
|
|
36
36
|
|
|
37
37
|
## Commands
|
|
38
38
|
|
|
39
|
-
| Command
|
|
40
|
-
|
|
|
41
|
-
| `stroq init [--agent <name>] [--user] [--dry-run]`
|
|
42
|
-
| `stroq hook <agent>`
|
|
43
|
-
| `stroq mcp --server <name> -- <cmd>`
|
|
44
|
-
| `stroq doctor`
|
|
45
|
-
| `stroq log [--count 20]`
|
|
46
|
-
| `stroq verify`
|
|
47
|
-
| `stroq untaint [--session <id>] [--all]`
|
|
48
|
-
| `stroq why [--seq <n>]`
|
|
49
|
-
| `stroq canary [--name <NAME>]`
|
|
50
|
-
| `stroq attack [--json] [--only <id>]`
|
|
39
|
+
| Command | What it does |
|
|
40
|
+
| ------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
|
|
41
|
+
| `stroq init [--agent <name>] [--user] [--dry-run]` | Install hooks for `claude-code`, `cursor`, `codex`, `copilot`, `openclaw` or `windsurf`, or wrap an MCP client's stdio servers with `--agent mcp --client <name>` or `--config <path>` (`--user` for the home-directory copy) |
|
|
42
|
+
| `stroq hook <agent>` | Hook entrypoint (reads the event on stdin; `copilot` and `openclaw` take a `pre`/`post` argument, the others do not) |
|
|
43
|
+
| `stroq mcp --server <name> -- <cmd>` | MCP stdio proxy: judges every `tools/call` and scans every result for one wrapped server |
|
|
44
|
+
| `stroq doctor` | Check Node version, rules, hooks for every agent, self-test |
|
|
45
|
+
| `stroq log [--count 20]` | Show recent audit entries |
|
|
46
|
+
| `stroq verify` | Verify the audit hash chain |
|
|
47
|
+
| `stroq untaint [--session <id>] [--all]` | Clear a false-positive session's taint and provenance, or every session's |
|
|
48
|
+
| `stroq why [--seq <n>]` | Explain the most recent denied/asked action: rule, provenance, taint |
|
|
49
|
+
| `stroq canary [--name <NAME>]` | Print a canary secret to plant; its outbound use is denied and taints the session |
|
|
50
|
+
| `stroq attack [--json] [--only <id>] [--fuzz]` | Replay 20 recorded incidents against your policy; `--fuzz` crosses every scenario with a deterministic mutation set and reports the variants that still reach `allow`; exit 1 if any gets through |
|
|
51
|
+
| `stroq exposure [--probe] [--share] [--json]` | Map this machine's agent surface and report what reaches you; exit 1 on any finding |
|
|
52
|
+
| `stroq bench [--corpus <dir>] [--json] [--verbose]` | Measure the shipped rule set's false-positive rate against a corpus of benign developer documentation; `--verbose` lists the flagged files |
|
|
53
|
+
| `stroq coverage [--format <table\|navigator>] [--json]` | Print the control mapping against MITRE ATLAS and OWASP ASI, built from the attack corpus's own scenario tags; `--format=navigator` emits an ATT&CK Navigator layer |
|
|
54
|
+
|
|
55
|
+
`stroq exposure` reads files only. `--probe` is the one flag that starts a process: it launches each configured stdio MCP server, asks once for `tools/list`, scans the tool descriptions and shuts the server down — no tool is ever called. Without it, tool-description poisoning is not covered by the run, and the report says so. `--share` prints a redacted summary built from a whitelist, locally; nothing is transmitted.
|
|
56
|
+
|
|
57
|
+
The corpus `stroq bench` measures against ships with this repository, not with the npm package; on an installed CLI, point it at your own documentation with `stroq bench --corpus <dir>` — the published number in [`docs/BENCH.md`](https://github.com/AGGIB/Stroq/blob/main/docs/BENCH.md) is exactly that command run against the vendored corpus.
|
|
51
58
|
|
|
52
59
|
## Learn more
|
|
53
60
|
|
package/dist/asi.json
ADDED
|
@@ -0,0 +1,19 @@
|
|
|
1
|
+
{
|
|
2
|
+
"source": "OWASP GenAI Security Project — OWASP Top 10 for Agentic Applications for 2026",
|
|
3
|
+
"edition": "2026",
|
|
4
|
+
"published": "2025-12-09",
|
|
5
|
+
"url": "https://genai.owasp.org/resource/owasp-top-10-for-agentic-applications-for-2026/",
|
|
6
|
+
"note": "Unlike MITRE ATLAS, OWASP publishes this list as a PDF only — the OWASP Agentic Security Initiative has no machine-readable release. The ten ids and names below are transcribed by hand from that document, which is why this layer is secondary and version-pinned rather than vendored and hashed like atlas.json. This is a different taxonomy from the earlier OWASP 'Agentic AI Threats and Mitigations' (v1.0, February 2025), which numbers its threats T1 through T15; the ASI-prefixed ids here belong only to the 2026 Top 10 for Agentic Applications. Two per-scenario tags in corpus.json depart from their cohort deliberately: `07-settings-hook-removal` and `14-agents-md-invisible-hook-disable` carry no ASI06 because both steps empty or disable the hooks block of `.claude/settings.json` — subtracting a control, not poisoning context with persistent misleading content, unlike `19-dependency-postinstall-persistence`'s planted `UserPromptSubmit` hook, which is the textbook case; and `02-sentry-agentjacking` carries ASI05 like every other `effect: \"exec\"` scenario because its `ask` rather than `deny` expectation reflects Stroq's confidence in blocking, not whether the scenario demonstrates unexpected code execution.",
|
|
7
|
+
"risks": [
|
|
8
|
+
{ "id": "ASI01", "name": "Agent Goal Hijack" },
|
|
9
|
+
{ "id": "ASI02", "name": "Tool Misuse" },
|
|
10
|
+
{ "id": "ASI03", "name": "Identity & Privilege Abuse" },
|
|
11
|
+
{ "id": "ASI04", "name": "Agentic Supply Chain Compromise" },
|
|
12
|
+
{ "id": "ASI05", "name": "Unexpected Code Execution" },
|
|
13
|
+
{ "id": "ASI06", "name": "Memory & Context Poisoning" },
|
|
14
|
+
{ "id": "ASI07", "name": "Insecure Inter-Agent Communication" },
|
|
15
|
+
{ "id": "ASI08", "name": "Cascading Agent Failures" },
|
|
16
|
+
{ "id": "ASI09", "name": "Human-Agent Trust Exploitation" },
|
|
17
|
+
{ "id": "ASI10", "name": "Rogue Agents" }
|
|
18
|
+
]
|
|
19
|
+
}
|