agent-security-scanner-mcp 3.0.0 → 3.2.0

package/rules/generic/secrets/security/detected-slack-token.yaml

@@ -0,0 +1,28 @@
+rules:
+- id: detected-slack-token
+  pattern-either:
+  - pattern-regex: (xox[pboa]-[0-9]{12}-[0-9]{12}-[0-9]{12}-[a-z0-9]{32})
+  - pattern-regex: xox.-[0-9]{12}-[0-9]{12}-[0-9a-zA-Z]{24}
+  languages: [regex]
+  message: Slack Token detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
+    references:
+    - https://github.com/davidburkitt/python-secret-scanner/blob/335a1f6dab8de59cf39063e57aea39a58951e939/patterns.txt#L58
+    category: security
+    technology:
+    - secrets
+    - slack
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM

package/rules/generic/secrets/security/detected-slack-webhook.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: detected-slack-webhook
+  patterns:
+    - pattern-regex: https://hooks\.slack\.com/services/T[a-zA-Z0-9_]{8,10}/B[a-zA-Z0-9_]{8,10}/[a-zA-Z0-9_]{24}
+  languages: [regex]
+  message: Slack Webhook detected
+  severity: ERROR
+  metadata:
+    references:
+    - https://api.slack.com/messaging/webhooks
+    source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
+    category: security
+    technology:
+    - secrets
+    - slack
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM

package/rules/generic/secrets/security/detected-snyk-api-key.yaml

@@ -0,0 +1,26 @@
+rules:
+- id: detected-snyk-api-key
+  pattern-regex: |-
+    (?i)snyk.{0,50}['|"|`]?[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}['"\s]?
+  languages: [regex]
+  message: Snyk API Key detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    category: security
+    technology:
+    - secrets
+    - snyk
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM

package/rules/generic/secrets/security/detected-softlayer-api-key.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: detected-softlayer-api-key
+  pattern-regex: |-
+    (?i)softlayer.{0,50}["|'|`]?[a-z0-9]{64}["|'|`]?
+  languages: [regex]
+  message: SoftLayer API Key detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/Yelp/detect-secrets/blob/master/detect_secrets/plugins/softlayer.py
+    category: security
+    technology:
+    - secrets
+    - softlayer
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM

package/rules/generic/secrets/security/detected-sonarqube-docs-api-key.yaml

@@ -0,0 +1,40 @@
+rules:
+- id: detected-sonarqube-docs-api-key
+  pattern-regex: |-
+    (?i)sonar.{0,50}(\\\"|'|`)?[0-9a-f]{40}(\\\"|'|`)?
+  languages: [regex]
+  message: SonarQube Docs API Key detected
+  severity: ERROR
+  paths:
+    exclude:
+      - "*.svg"
+      - "*go.sum"
+      - "*cargo.lock"
+      - "*package.json"
+      - "*yarn.lock"
+      - "*package-lock.json"
+      - "*bundle.js"
+      - "*pnpm-lock*"
+      - "*Podfile.lock"
+      - "**/*/openssl/*.h"
+      - "*.xcscmblueprint"
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
+    category: security
+    technology:
+    - secrets
+    - sonarqube
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM

package/rules/generic/secrets/security/detected-square-access-token.yaml

@@ -0,0 +1,26 @@
+rules:
+- id: detected-square-access-token
+  pattern-regex: sq0atp-[0-9A-Za-z\-_]{22}
+  languages: [regex]
+  message: Square Access Token detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
+    category: security
+    technology:
+    - secrets
+    - square
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM

package/rules/generic/secrets/security/detected-square-oauth-secret.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: detected-square-oauth-secret
+  pattern-regex: |-
+    sq0csp-[0-9A-Za-z\\\-_]{43}
+  languages: [regex]
+  message: Square OAuth Secret detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
+    references:
+    - https://github.com/Yelp/detect-secrets/blob/master/tests/plugins/square_oauth_test.py
+    category: security
+    technology:
+    - secrets
+    - square
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM

package/rules/generic/secrets/security/detected-ssh-password.yaml

@@ -0,0 +1,27 @@
+rules:
+- id: detected-ssh-password
+  pattern-regex: |-
+    sshpass -p\s*['|\\\"][^%]
+  languages: [regex]
+  message: SSH Password detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
+    category: security
+    technology:
+    - secrets
+    - ssh
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM

package/rules/generic/secrets/security/detected-stripe-api-key.yaml

@@ -0,0 +1,26 @@
+rules:
+- id: detected-stripe-api-key
+  pattern-regex: sk_live_[0-9a-zA-Z]{24}
+  languages: [regex]
+  message: Stripe API Key detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
+    category: security
+    technology:
+    - secrets
+    - stripe
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM

package/rules/generic/secrets/security/detected-stripe-restricted-api-key.yaml

@@ -0,0 +1,26 @@
+rules:
+- id: detected-stripe-restricted-api-key
+  pattern-regex: rk_live_[0-9a-zA-Z]{24}
+  languages: [regex]
+  message: Stripe Restricted API Key detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
+    category: security
+    technology:
+    - secrets
+    - stripe
+    confidence: MEDIUM
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: LOW

package/rules/generic/secrets/security/detected-telegram-bot-api-key.yaml

@@ -0,0 +1,30 @@
+rules:
+- id: detected-telegram-bot-api-key
+  patterns:
+  - pattern-regex: '[0-9]+:AA[0-9A-Za-z\-_]{33}'
+  - pattern-not-regex: go\.mod.*
+  - pattern-not-regex: v[\d]+\.[\d]+\.[\d]+.*
+  languages:
+  - regex
+  message: Telegram Bot API Key detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
+    category: security
+    technology:
+    - secrets
+    - telegram
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM

package/rules/generic/secrets/security/detected-twilio-api-key.yaml

@@ -0,0 +1,26 @@
+rules:
+- id: detected-twilio-api-key
+  pattern-regex: SK[0-9a-fA-F]{32}
+  languages: [regex]
+  message: Twilio API Key detected
+  severity: ERROR
+  metadata:
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    source-rule-url: https://github.com/dxa4481/truffleHogRegexes/blob/master/truffleHogRegexes/regexes.json
+    category: security
+    technology:
+    - secrets
+    - twilio
+    confidence: LOW
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    references:
+    - https://owasp.org/Top10/A07_2021-Identification_and_Authentication_Failures
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - audit
+    likelihood: LOW
+    impact: MEDIUM

package/rules/generic/secrets/security/detected-username-and-password-in-uri.yaml

@@ -0,0 +1,35 @@
+rules:
+- id: detected-username-and-password-in-uri
+  patterns:
+  - pattern: $PROTOCOL://$...USERNAME:$...PASSWORD@$END
+  - metavariable-regex:
+      metavariable: $...USERNAME
+      regex: \A({?)([A-Za-z])([A-Za-z0-9_-]){5,31}(}?)\Z
+  - metavariable-regex:
+      metavariable: $...PASSWORD
+      regex: (?!.*[\s])(?=.*[0-9])(?=.*[a-z])(?=.*[A-Z])(?=.*[!"#$%&'()*+,-./:;<=>?@[\]^_`{|}~]){6,32}
+  - metavariable-regex:
+      metavariable: $PROTOCOL
+      regex: (.*http.*)|(.*sql.*)|(.*ftp.*)|(.*smtp.*)
+  languages:
+  - generic
+  message: Username and password in URI detected
+  severity: ERROR
+  metadata:
+    owasp:
+    - A07:2021 - Identification and Authentication Failures
+    - A07:2025 - Authentication Failures
+    cwe:
+    - 'CWE-798: Use of Hard-coded Credentials'
+    references:
+    - https://github.com/grab/secret-scanner/blob/master/scanner/signatures/pattern.go
+    category: security
+    technology:
+    - secrets
+    confidence: MEDIUM
+    cwe2022-top25: true
+    cwe2021-top25: true
+    subcategory:
+    - vuln
+    likelihood: MEDIUM
+    impact: MEDIUM

package/rules/generic/secrets/security/google-maps-apikeyleak.yaml

@@ -0,0 +1,25 @@
+rules:
+  - id: google-maps-apikeyleak
+    patterns:
+      - pattern-regex: ^(AIza[0-9A-Za-z_-]{35}(?!\S))$
+    message: Detects potential Google Maps API keys in code
+    languages:
+      - generic
+    severity: WARNING
+    metadata:
+      description: Detects potential Google Maps API keys in code
+      severity: MEDIUM
+      category: security
+      confidence: MEDIUM
+      impact: HIGH
+      likelihood: MEDIUM
+      subcategory:
+        - audit
+      owasp:
+        - A3:2017 Sensitive Data Exposure
+      references:
+        - https://ozguralp.medium.com/unauthorized-google-maps-api-key-usage-cases-and-why-you-need-to-care-1ccb28bf21e
+      cwe:
+        - "CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory"
+      technology:
+        - Google Maps

package/rules/prompt-injection.security.yaml

@@ -530,6 +530,10 @@ rules:
       - "(?i)respond\\s+(as|like)\\s+a\\s+(hacker|attacker|criminal)"
       - "(?i)switch\\s+to\\s+unrestricted\\s+mode"
       - "(?i)behave\\s+(as|like)\\s+(a\\s+)?(hacker|attacker|criminal)"
+      - "(?i)^system\\s*:\\s*you\\s+are\\s+(a|an)\\s+"
+      - "(?i)^(system|assistant|user)\\s*:\\s*(you\\s+are|act\\s+as|pretend|behave\\s+as)"
+      - "(?i)you\\s+are\\s+(a|an)\\s+(hacking|malicious|evil|harmful|dangerous)\\s+tool"
+      - "(?i)your\\s+(new\\s+)?role\\s+is\\s+(to\\s+)?(hack|attack|exploit|compromise)"
     metadata:
       cwe: "CWE-77"
       owasp: "LLM01 - Prompt Injection"