npm - agent-threat-rules - Versions diffs - 3.5.11 → 4.0.0 - Mend

agent-threat-rules 3.5.11 → 4.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (896) hide show

package/rules/skill-compromise/ATR-2026-00200-agent-memory-config-tampering.yaml CHANGED Viewed

@@ -16,11 +16,11 @@ severity: critical
 references:
   owasp_llm:
-    - "LLM01:2025 - Prompt Injection"
-    - "LLM08:2025 - Excessive Agency"
+    - "LLM01:2025"
+    - "LLM08:2025"
   owasp_agentic:
-    - "ASI04:2026 - Identity and Access Management Failures"
-    - "ASI07:2026 - Insecure Third-Party Agent"
+    - "ASI04:2026"
+    - "ASI07:2026"
   mitre_atlas:
     - "AML.T0051.001 - Indirect"
   mitre_attack:

package/rules/skill-compromise/ATR-2026-00214-credential-theft.yaml CHANGED Viewed

@@ -12,9 +12,9 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - "LLM01:2025 - Prompt Injection"
+    - "LLM01:2025"
   owasp_agentic:
-    - "ASI03:2026 - Data Exfiltration"
+    - "ASI03:2026"
   mitre_atlas:
     - AML.T0010 - AI Supply Chain Compromise
 compliance:

package/rules/skill-compromise/ATR-2026-00217-credential-harvesting.yaml CHANGED Viewed

@@ -16,9 +16,9 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - "LLM01:2025 - Prompt Injection"
+    - "LLM01:2025"
   owasp_agentic:
-    - "ASI04:2026 - Unbounded Consumption"
+    - "ASI04:2026"
   mitre_atlas:
     - "AML.T0024"
 compliance:
@@ -95,7 +95,11 @@ detection:
     - 'System administration scripts with secure credential handling'
     - 'DevOps deployment tools mentioning backup procedures in documentation'
 response:
-  actions: [alert, block_tool]
+  actions: [alert]
+  actions_rationale: >-
+    response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 588/5352 =
+    10.99% exceeds the 2% automatic-demotion line; ceiling = observe. Removed
+    block_tool(interrupt). Detection unchanged — recall cost is zero.
   message_template: >
     [ATR-2026-00217] Detected credential harvesting disguised as backup tool
 test_cases:

package/rules/skill-compromise/ATR-2026-00220-malware-dropper.yaml CHANGED Viewed

@@ -12,9 +12,9 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - "LLM07:2025 - System Message Leakage"
+    - "LLM07:2025"
   owasp_agentic:
-    - "ASI04:2026 - Unbounded Consumption"
+    - "ASI04:2026"
   mitre_atlas:
     - "AML.T0048"
 compliance:

package/rules/skill-compromise/ATR-2026-00222-credential-harvesting.yaml CHANGED Viewed

@@ -14,9 +14,9 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - "LLM01:2025 - Prompt Injection"
+    - "LLM01:2025"
   owasp_agentic:
-    - "ASI02:2026 - Malicious Tool Integration"
+    - "ASI02:2026"
   mitre_atlas:
     - "AML.T0040"
 compliance:

package/rules/skill-compromise/ATR-2026-00223-reverse-shell-dropper.yaml CHANGED Viewed

@@ -12,9 +12,9 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - "LLM01:2025 - Prompt Injection"
+    - "LLM01:2025"
   owasp_agentic:
-    - "ASI05:2026 - Supply Chain Compromise"
+    - "ASI05:2026"
   mitre_atlas:
     - "AML.T0051"
 compliance:

package/rules/skill-compromise/ATR-2026-00224-credential-exfiltration.yaml CHANGED Viewed

@@ -14,9 +14,9 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - "LLM01:2025 - Prompt Injection"
+    - "LLM01:2025"
   owasp_agentic:
-    - "ASI04:2026 - Unauthorized Code Execution"
+    - "ASI04:2026"
   mitre_atlas:
     - "AML.T0040"
 compliance:
@@ -87,7 +87,11 @@ detection:
     - 'Security training materials describing attack patterns as examples'
     - 'Official cloud provider SDKs with proper credential handling'
 response:
-  actions: [alert, block_tool]
+  actions: [alert]
+  actions_rationale: >-
+    response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 118/5352 =
+    2.20% exceeds the 2% automatic-demotion line; ceiling = observe. Removed
+    block_tool(interrupt). Detection unchanged — recall cost is zero.
   message_template: >
     [ATR-2026-00224] Malicious credential exfiltration detected in fake DevOps toolkit initialization
 test_cases:

package/rules/skill-compromise/ATR-2026-00225-c2-communication.yaml CHANGED Viewed

@@ -15,9 +15,9 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - "LLM09:2025 - Overreliance"
+    - "LLM09:2025"
   owasp_agentic:
-    - "ASI04:2026 - Unbounded Consumption"
+    - "ASI04:2026"
   mitre_atlas:
     - "AML.T0048"
 compliance:

package/rules/skill-compromise/ATR-2026-00260-package-hallucination.yaml CHANGED Viewed

@@ -17,10 +17,10 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - "LLM09:2025 - Misinformation"
-    - "LLM02:2025 - Insecure Output Handling"
+    - "LLM09:2025"
+    - "LLM02:2025"
   owasp_agentic:
-    - "ASI07:2026 - Supply Chain"
+    - "ASI07:2026"
   mitre_atlas:
     - "AML.T0060 - Publish Hallucinated Entities"
   research:

package/rules/skill-compromise/ATR-2026-00262-av-evasion-code-gen.yaml CHANGED Viewed

@@ -16,9 +16,9 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - "LLM05:2025 - Improper Output Handling"
+    - "LLM05:2025"
   owasp_agentic:
-    - "ASI08:2026 - Output Handling"
+    - "ASI08:2026"
   mitre_atlas:
     - "AML.T0053 - AI Agent Tool Invocation"
   research:

package/rules/skill-compromise/ATR-2026-00263-credential-file-read-gen.yaml CHANGED Viewed

@@ -16,10 +16,10 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - "LLM06:2025 - Excessive Agency"
-    - "LLM05:2025 - Improper Output Handling"
+    - "LLM06:2025"
+    - "LLM05:2025"
   owasp_agentic:
-    - "ASI03:2026 - Tool Misuse"
+    - "ASI03:2026"
   mitre_atlas:
     - "AML.T0053 - AI Agent Tool Invocation"
     - "AML.T0057 - LLM Data Leakage"

package/rules/skill-compromise/ATR-2026-00266-malware-dropper-gen.yaml CHANGED Viewed

@@ -16,9 +16,9 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - "LLM05:2025 - Improper Output Handling"
+    - "LLM05:2025"
   owasp_agentic:
-    - "ASI08:2026 - Output Handling"
+    - "ASI08:2026"
   mitre_atlas:
     - "AML.T0053 - AI Agent Tool Invocation"
   research:

package/rules/skill-compromise/ATR-2026-00283-malwaregen-generic-virus-payload-request.yaml CHANGED Viewed

@@ -20,9 +20,9 @@ maturity: test
 severity: high
 references:
   owasp_llm:
-    - "LLM02:2025 - Insecure Output Handling"
+    - "LLM02:2025"
   owasp_agentic:
-    - "ASI08:2026 - Output Handling"
+    - "ASI08:2026"
   mitre_atlas:
     - "AML.T0057 - LLM Data Leakage"
   research:

package/rules/skill-compromise/ATR-2026-00398-huggingface-unsafe-model-artifact-load.yaml CHANGED Viewed

@@ -26,11 +26,11 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - "LLM06:2025 - Excessive Agency"
-    - "LLM05:2025 - Improper Output Handling"
+    - "LLM06:2025"
+    - "LLM05:2025"
   owasp_agentic:
-    - "ASI07:2026 - Supply Chain"
-    - "ASI03:2026 - Tool Misuse"
+    - "ASI07:2026"
+    - "ASI03:2026"
   mitre_atlas:
     - "AML.T0011.000 - Unsafe AI Artifacts"
     - "AML.T0010 - AI Supply Chain Compromise"

package/rules/skill-compromise/ATR-2026-00425-nl-persistent-covert-hook.yaml CHANGED Viewed

@@ -23,10 +23,10 @@ references:
     - AML.T0044 - Full AI Model Access
     - AML.T0024 - Exfiltration via AI Inference API
   owasp_llm:
-    - LLM06:2025 - Excessive Agency
+    - LLM06:2025
   owasp_agentic:
-    - ASI04:2026 - Insufficient User Consent
-    - ASI01:2026 - Agent Goal Hijack
+    - ASI04:2026
+    - ASI01:2026
   owasp_ast:
     - AST01:2026 - Malicious Skills
 compliance:
@@ -102,7 +102,10 @@ response:
   actions:
     - block_tool
     - alert
-    - quarantine_session
+  actions_rationale: >-
+    response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): 0/5352 benign FP, but
+    maturity is "test" — only stable is rated for irreversible actions; ceiling = degrade.
+    Removed quarantine_session(terminate). Detection unchanged — recall cost is zero.
   message_template: |
     [ATR-2026-00425] Natural-language persistent covert hook detected.
     The skill establishes an ongoing covert action triggered on every (or each)

package/rules/skill-compromise/ATR-2026-00427-nl-fake-error-instruction-bypass.yaml CHANGED Viewed

@@ -20,10 +20,10 @@ references:
   mitre_atlas:
     - AML.T0044 - Full AI Model Access
   owasp_llm:
-    - LLM06:2025 - Excessive Agency
+    - LLM06:2025
   owasp_agentic:
-    - ASI04:2026 - Insufficient User Consent
-    - ASI01:2026 - Agent Goal Hijack
+    - ASI04:2026
+    - ASI01:2026
   owasp_ast:
     - AST01:2026 - Malicious Skills
 compliance:
@@ -95,7 +95,10 @@ response:
   actions:
     - block_tool
     - alert
-    - quarantine_session
+  actions_rationale: >-
+    response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): 0/5352 benign FP, but
+    maturity is "test" — only stable is rated for irreversible actions; ceiling = degrade.
+    Removed quarantine_session(terminate). Detection unchanged — recall cost is zero.
   message_template: |
     [ATR-2026-00427] Fake-error instruction bypass detected.
     The skill instructs the agent to mislead the user with a fake error message

package/rules/skill-compromise/ATR-2026-00429-nl-skill-self-modification.yaml CHANGED Viewed

@@ -21,9 +21,9 @@ references:
     - AML.T0010 - AI Supply Chain Compromise
     - AML.T0044 - Full AI Model Access
   owasp_llm:
-    - LLM06:2025 - Excessive Agency
+    - LLM06:2025
   owasp_agentic:
-    - ASI06:2026 - Insufficient Access Controls
+    - ASI06:2026
   owasp_ast:
     - AST01:2026 - Malicious Skills
 compliance:
@@ -111,7 +111,10 @@ response:
   actions:
     - block_tool
     - alert
-    - quarantine_session
+  actions_rationale: >-
+    response-action eligibility (docs/RESPONSE-ACTION-ELIGIBILITY.md): benign FP 1/5352 = 0.02%
+    meets the 0.5% ceiling but is not zero; ceiling = degrade. Removed
+    quarantine_session(terminate). Detection unchanged — recall cost is zero.
   message_template: |
     [ATR-2026-00429] Skill self-modification / persistence instruction.
     The skill directs the agent to write to skill files, install additional

package/rules/skill-compromise/ATR-2026-00523-claude-code-hooks-session-start-pre-trust-rce.yaml CHANGED Viewed

@@ -30,12 +30,12 @@ severity: critical
 references:
   owasp_llm:
-    - "LLM05:2025 - Improper Output Handling"
-    - "LLM06:2025 - Excessive Agency"
+    - "LLM05:2025"
+    - "LLM06:2025"
   owasp_agentic:
-    - "ASI04:2026 - Supply Chain"
-    - "ASI05:2026 - Unexpected Code Execution"
-    - "ASI09:2026 - Identity Spoofing and Impersonation"
+    - "ASI04:2026"
+    - "ASI05:2026"
+    - "ASI09:2026"
   mitre_atlas:
     - "AML.T0010 - AI Supply Chain Compromise"
     - "AML.T0050 - Command and Scripting Interpreter"
@@ -94,8 +94,6 @@ compliance:
     - clause: "8.3"
       context: "ISO/IEC 42001 Clause 8.3 (AI risk treatment) is supported by this rule, which implements runtime detection of the skill supply-chain compromise (Claude Code Hooks SessionStart Pre-Trust RCE (CVE-2025-59536)) as a treatment control."
       strength: secondary
-  safe_mcp:
-    - "SMCP-T010"
 tags:
   category: skill-compromise

package/rules/skill-compromise/ATR-2026-00525-mini-shai-hulud-gh-token-monitor-persistence.yaml CHANGED Viewed

@@ -25,9 +25,9 @@ severity: critical
 references:
   owasp_llm:
-    - "LLM03:2025 - Supply Chain"
+    - "LLM03:2025"
   owasp_agentic:
-    - "ASI05:2026 - Supply Chain Compromise"
+    - "ASI05:2026"
   mitre_atlas:
     - "AML.T0010 - AI Supply Chain Compromise"
 compliance:

package/rules/skill-compromise/ATR-2026-00527-skill-silent-git-remote-mirror-exfiltration.yaml CHANGED Viewed

@@ -22,10 +22,10 @@ severity: critical
 references:
   owasp_llm:
-    - "LLM06:2025 - Excessive Agency"
-    - "LLM10:2025 - Unbounded Consumption"
+    - "LLM06:2025"
+    - "LLM10:2025"
   owasp_agentic:
-    - "ASI04:2026 - Code Execution & Data Exfiltration"
+    - "ASI04:2026"
   mitre_atlas:
     - "AML.T0024 - Exfiltration via AI Inference API"
     - "AML.T0048 - External Harms"

package/rules/skill-compromise/ATR-2026-01755-backdoor-pot-linguistic-trigger-phrase.yaml CHANGED Viewed

@@ -25,10 +25,10 @@ severity: critical
 references:
   owasp_llm:
-    - "LLM04:2025 - Data and Model Poisoning"
-    - "LLM01:2025 - Prompt Injection"
+    - "LLM04:2025"
+    - "LLM01:2025"
   owasp_agentic:
-    - "ASI03:2026 - Agent Supply Chain Compromise"
+    - "ASI03:2026"
   mitre_atlas:
     - "AML.T0018.000 - Poison AI Model"
     - "AML.T0020 - Poison Training Data"

package/rules/skill-compromise/ATR-2026-01756-backdoor-pot-symbol-emoticon-trigger.yaml CHANGED Viewed

@@ -16,15 +16,15 @@ author: "ATR Community"
 date: "2026/06/12"
 schema_version: "0.1"
 detection_tier: semantic
-maturity: experimental
+maturity: test
 severity: critical
 references:
   owasp_llm:
-    - "LLM04:2025 - Data and Model Poisoning"
-    - "LLM01:2025 - Prompt Injection"
+    - "LLM04:2025"
+    - "LLM01:2025"
   owasp_agentic:
-    - "ASI03:2026 - Agent Supply Chain Compromise"
+    - "ASI03:2026"
   mitre_atlas:
     - "AML.T0018.000 - Poison AI Model"
     - "AML.T0051 - LLM Prompt Injection"

package/rules/skill-compromise/ATR-2026-02261-code-credential-exfil-chain.yaml CHANGED Viewed

@@ -21,10 +21,10 @@ maturity: test
 severity: critical
 references:
   owasp_llm:
-    - "LLM06:2025 - Excessive Agency"
-    - "LLM03:2025 - Supply Chain Vulnerabilities"
+    - "LLM06:2025"
+    - "LLM03:2025"
   owasp_agentic:
-    - "ASI06:2026 - Data and Information Integrity Issues"
+    - "ASI06:2026"
   mitre_atlas:
     - "AML.T0051.001 - Indirect"
   mitre_attack: