@weave_protocol/mund 0.1.12 → 0.1.13
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/SKILL.md +60 -0
- package/package.json +1 -1
package/SKILL.md
ADDED
|
@@ -0,0 +1,60 @@
|
|
|
1
|
+
---
|
|
2
|
+
name: security-scanning
|
|
3
|
+
description: Scan content for secrets, PII, prompt injection, and dangerous patterns. Vet MCP servers before installation. Use when checking for API keys, detecting personal information, preventing injection attacks, or evaluating MCP server security.
|
|
4
|
+
---
|
|
5
|
+
|
|
6
|
+
# Security Scanning with Mund
|
|
7
|
+
|
|
8
|
+
## Overview
|
|
9
|
+
|
|
10
|
+
Mund detects security issues in content and MCP servers. Use it before processing untrusted input or installing MCP servers.
|
|
11
|
+
|
|
12
|
+
## MCP Tools
|
|
13
|
+
|
|
14
|
+
| Tool | Purpose |
|
|
15
|
+
|------|---------|
|
|
16
|
+
| `mund_scan` | Scan content for all security issues |
|
|
17
|
+
| `mund_check_secret` | Check if a string is a secret |
|
|
18
|
+
| `mund_check_pii` | Detect personally identifiable information |
|
|
19
|
+
| `mund_scan_mcp_server` | Vet MCP server manifest before install |
|
|
20
|
+
| `mund_check_typosquatting` | Detect name squatting attacks |
|
|
21
|
+
| `mund_audit_mcp_permissions` | Analyze MCP tool capabilities |
|
|
22
|
+
|
|
23
|
+
## Quick Examples
|
|
24
|
+
|
|
25
|
+
### Scan for secrets
|
|
26
|
+
```
|
|
27
|
+
mund_scan({ content: "API key: sk-abc123..." })
|
|
28
|
+
→ { safe: false, issues: [{ rule_id: "openai_api_key", severity: "critical" }] }
|
|
29
|
+
```
|
|
30
|
+
|
|
31
|
+
### Vet MCP server
|
|
32
|
+
```
|
|
33
|
+
mund_scan_mcp_server({ manifest: "<server.json>" })
|
|
34
|
+
→ { recommendation: "DO_NOT_INSTALL", issues: [...] }
|
|
35
|
+
```
|
|
36
|
+
|
|
37
|
+
### Check typosquatting
|
|
38
|
+
```
|
|
39
|
+
mund_check_typosquatting({ name: "githib-mcp" })
|
|
40
|
+
→ { is_suspicious: true, similar_to: ["github"] }
|
|
41
|
+
```
|
|
42
|
+
|
|
43
|
+
## Detection Categories
|
|
44
|
+
|
|
45
|
+
- **Secrets**: API keys, tokens, private keys, database URLs
|
|
46
|
+
- **PII**: SSN, credit cards, emails, phone numbers
|
|
47
|
+
- **Injection**: Prompt injection, jailbreak, instruction override
|
|
48
|
+
- **MCP Servers**: Malicious descriptions, typosquatting, dangerous permissions
|
|
49
|
+
|
|
50
|
+
## When to Use
|
|
51
|
+
|
|
52
|
+
1. Before processing any untrusted input
|
|
53
|
+
2. Before adding MCP servers to claude_desktop_config.json
|
|
54
|
+
3. When handling user-provided content
|
|
55
|
+
4. Periodically in long-running conversations
|
|
56
|
+
|
|
57
|
+
## Links
|
|
58
|
+
|
|
59
|
+
- npm: https://www.npmjs.com/package/@weave_protocol/mund
|
|
60
|
+
- MCP Registry: io.github.Tyox-all/mund
|