aura-security 1.0.0 → 1.0.2

package/dist/agents/slop/chain-mapper-agent.d.ts

@@ -100,6 +100,7 @@ export declare class ChainMapperAgent extends SLOPAgent {
     private buildPath;
     private findingToNode;
     private canConnect;
+    private categorizeType;
     private getConnectionAction;
     private calculateProbability;
     private severityScore;

package/dist/agents/slop/chain-mapper-agent.js

@@ -12,7 +12,8 @@
  * - analyze-blast-radius: Calculate impact radius of a finding
  */
 import { SLOPAgent } from './base.js';
-// MITRE ATT&CK mapping for common finding types
+import { normalizeFinding, } from './types.js';
+// MITRE ATT&CK mapping for finding categories
 const MITRE_MAPPING = {
     'secret': [
         { technique: 'T1552.001', tactic: 'Credential Access - Credentials In Files' },
@@ -26,6 +27,16 @@ const MITRE_MAPPING = {
         { technique: 'T1059', tactic: 'Execution - Command and Scripting Interpreter' },
         { technique: 'T1055', tactic: 'Defense Evasion - Process Injection' },
     ],
+    'injection': [
+        { technique: 'T1190', tactic: 'Initial Access - Exploit Public-Facing Application' },
+        { technique: 'T1059', tactic: 'Execution - Command and Scripting Interpreter' },
+        { technique: 'T1027', tactic: 'Defense Evasion - Obfuscated Files' },
+    ],
+    'auth': [
+        { technique: 'T1078', tactic: 'Persistence - Valid Accounts' },
+        { technique: 'T1110', tactic: 'Credential Access - Brute Force' },
+        { technique: 'T1548', tactic: 'Privilege Escalation - Abuse Elevation Control' },
+    ],
     'docker': [
         { technique: 'T1611', tactic: 'Privilege Escalation - Escape to Host' },
         { technique: 'T1610', tactic: 'Execution - Deploy Container' },
@@ -34,6 +45,15 @@ const MITRE_MAPPING = {
         { technique: 'T1538', tactic: 'Discovery - Cloud Service Dashboard' },
         { technique: 'T1580', tactic: 'Discovery - Cloud Infrastructure Discovery' },
     ],
+    'escalation': [
+        { technique: 'T1548', tactic: 'Privilege Escalation - Abuse Elevation Control' },
+        { technique: 'T1068', tactic: 'Privilege Escalation - Exploitation for Privilege Escalation' },
+    ],
+    'data': [
+        { technique: 'T1005', tactic: 'Collection - Data from Local System' },
+        { technique: 'T1039', tactic: 'Collection - Data from Network Shared Drive' },
+        { technique: 'T1567', tactic: 'Exfiltration - Exfiltration Over Web Service' },
+    ],
 };
 // Attack chain templates
 const CHAIN_TEMPLATES = [
@@ -163,20 +183,22 @@ export class ChainMapperAgent extends SLOPAgent {
     }
     async handleToolCall(call) {
         const { tool, arguments: args } = call;
+        // Normalize external findings to internal format
+        const normalizeFindings = (findings) => (findings || []).map(normalizeFinding);
         try {
             switch (tool) {
                 case 'trace-path':
-                    return { result: await this.tracePath(args.findings, args.entryPoint, args.maxDepth) };
+                    return { result: await this.tracePath(normalizeFindings(args.findings), args.entryPoint, args.maxDepth) };
                 case 'find-pivots':
-                    return { result: await this.findPivots(args.findings) };
+                    return { result: await this.findPivots(normalizeFindings(args.findings)) };
                 case 'simulate-attack':
                     return { result: await this.simulateAttack(args.path, args.verbose) };
                 case 'generate-report':
-                    return { result: await this.generateReport(args.findings, args.format) };
+                    return { result: await this.generateReport(normalizeFindings(args.findings), args.format) };
                 case 'analyze-blast-radius':
-                    return { result: await this.analyzeBlastRadius(args.finding, args.context) };
+                    return { result: await this.analyzeBlastRadius(normalizeFinding(args.finding), args.context) };
                 case 'map-mitre':
-                    return { result: await this.mapToMitre(args.findings) };
+                    return { result: await this.mapToMitre(normalizeFindings(args.findings)) };
                 default:
                     return { error: `Unknown tool: ${tool}` };
             }
@@ -193,8 +215,13 @@ export class ChainMapperAgent extends SLOPAgent {
         // Find entry points (secrets and high-severity vulns are common entries)
         const entryPoints = entryPoint
             ? findings.filter(f => f.id === entryPoint)
-            : findings.filter(f => f.type === 'secret' ||
-                (f.type === 'vulnerability' && f.severity === 'critical'));
+            : findings.filter(f => {
+                const category = this.categorizeType(f.type);
+                return category === 'secret' ||
+                    category === 'injection' ||
+                    (category === 'vulnerability' && f.severity === 'critical') ||
+                    f.severity === 'critical';
+            });
         if (entryPoints.length === 0 && findings.length > 0) {
             // Use highest severity as entry
             entryPoints.push(findings.sort((a, b) => this.severityScore(b.severity) - this.severityScore(a.severity))[0]);
@@ -388,7 +415,8 @@ export class ChainMapperAgent extends SLOPAgent {
         const allTechniques = new Set();
         const allTactics = new Set();
         for (const finding of findings) {
-            const techniques = MITRE_MAPPING[finding.type] || [];
+            const category = this.categorizeType(finding.type);
+            const techniques = MITRE_MAPPING[category] || [];
             mappings.push({ finding, techniques });
             for (const t of techniques) {
                 allTechniques.add(t.technique);
@@ -445,27 +473,83 @@ export class ChainMapperAgent extends SLOPAgent {
         };
     }
     findingToNode(finding, type) {
+        const category = this.categorizeType(finding.type);
         return {
-            id: finding.id,
+            id: finding.id || `finding-${Math.random().toString(36).slice(2, 9)}`,
             findingId: finding.id,
             type,
-            name: finding.title,
-            description: finding.description,
-            technique: MITRE_MAPPING[finding.type]?.[0]?.technique,
-            severity: finding.severity,
-            exploitability: this.severityScore(finding.severity) * 10,
+            name: finding.title || finding.type || 'Unknown Finding',
+            description: finding.description || finding.message || '',
+            technique: MITRE_MAPPING[category]?.[0]?.technique,
+            severity: finding.severity || 'medium',
+            exploitability: this.severityScore(finding.severity || 'medium') * 10,
+            metadata: { originalType: finding.type, category },
         };
     }
     canConnect(from, to) {
-        // Define connection rules
+        const fromCategory = this.categorizeType(from.type);
+        const toCategory = this.categorizeType(to.type);
+        // Define connection rules between categories
         const connections = {
-            'secret': ['vulnerability', 'code-issue', 'iac'],
-            'vulnerability': ['code-issue', 'docker', 'secret'],
-            'code-issue': ['vulnerability', 'secret'],
-            'docker': ['vulnerability', 'iac'],
-            'iac': ['secret', 'vulnerability'],
+            'secret': ['vulnerability', 'code-issue', 'iac', 'auth', 'injection'],
+            'vulnerability': ['code-issue', 'docker', 'secret', 'escalation', 'data'],
+            'code-issue': ['vulnerability', 'secret', 'injection', 'data'],
+            'injection': ['data', 'auth', 'escalation', 'code-issue'],
+            'auth': ['data', 'escalation', 'secret'],
+            'docker': ['vulnerability', 'iac', 'escalation'],
+            'iac': ['secret', 'vulnerability', 'escalation'],
+            'escalation': ['data', 'secret', 'vulnerability'],
+            'data': ['secret'],
         };
-        return connections[from.type]?.includes(to.type) || false;
+        return connections[fromCategory]?.includes(toCategory) || false;
+    }
+    categorizeType(type) {
+        const t = type.toLowerCase();
+        // Secrets
+        if (t.includes('secret') || t.includes('credential') || t.includes('key') ||
+            t.includes('token') || t.includes('password') || t.includes('api-key') ||
+            t.includes('aws') || t.includes('private-key')) {
+            return 'secret';
+        }
+        // Injection vulnerabilities
+        if (t.includes('injection') || t.includes('sqli') || t.includes('xss') ||
+            t.includes('xxe') || t.includes('ssti') || t.includes('command-injection') ||
+            t.includes('code-injection') || t.includes('rce') || t.includes('eval')) {
+            return 'injection';
+        }
+        // Authentication/Authorization issues
+        if (t.includes('auth') || t.includes('bypass') || t.includes('broken-access') ||
+            t.includes('idor') || t.includes('privilege') || t.includes('session') ||
+            t.includes('jwt') || t.includes('csrf')) {
+            return 'auth';
+        }
+        // Docker/Container issues
+        if (t.includes('docker') || t.includes('container') || t.includes('kubernetes') ||
+            t.includes('k8s') || t.includes('helm')) {
+            return 'docker';
+        }
+        // Infrastructure as Code
+        if (t.includes('iac') || t.includes('terraform') || t.includes('cloudformation') ||
+            t.includes('misconfiguration') || t.includes('s3') || t.includes('cloud')) {
+            return 'iac';
+        }
+        // Privilege escalation
+        if (t.includes('escalation') || t.includes('privesc') || t.includes('root') ||
+            t.includes('admin') || t.includes('sudo')) {
+            return 'escalation';
+        }
+        // Data exposure
+        if (t.includes('data') || t.includes('leak') || t.includes('exposure') ||
+            t.includes('sensitive') || t.includes('pii') || t.includes('ssrf')) {
+            return 'data';
+        }
+        // Vulnerabilities (CVEs, dependencies)
+        if (t.includes('vuln') || t.includes('cve') || t.includes('dependency') ||
+            t.includes('outdated') || t.includes('package')) {
+            return 'vulnerability';
+        }
+        // Default to code-issue for SAST findings
+        return 'code-issue';
     }
     getConnectionAction(from, to) {
         if (from.type === 'secret' && to.type === 'vulnerability') {

package/dist/agents/slop/redteam-agent.js

@@ -218,22 +218,29 @@ export class RedTeamAgent extends SLOPAgent {
         let falsePositive = false;
         let riskLevel = 'needs-verification';
         logs.push(`[RedTeam] Starting validation for ${finding.id}: ${finding.title}`);
+        // Normalize finding type (handle different naming conventions)
+        const normalizedType = (finding.type || '').toLowerCase();
+        const isSecret = normalizedType === 'secret' || normalizedType === 'secrets';
+        const isVuln = normalizedType === 'vulnerability' || normalizedType === 'vuln' || normalizedType === 'package';
+        const isCode = normalizedType === 'code-issue' || normalizedType === 'code' || normalizedType === 'sast';
+        const isIac = normalizedType === 'iac' || normalizedType === 'infrastructure';
+        const isDocker = normalizedType === 'docker' || normalizedType === 'container';
         // Validate based on finding type
-        if (finding.type === 'secret') {
+        if (isSecret) {
             const secretResult = await this.analyzeSecret(finding);
             exploitable = secretResult.likelyValid;
             confidence = secretResult.confidence;
             evidence.push(...secretResult.evidence);
             logs.push(...secretResult.logs);
         }
-        else if (finding.type === 'vulnerability') {
+        else if (isVuln) {
             const vulnResult = await this.analyzeVulnerability(finding, aggressive);
             exploitable = vulnResult.likelyExploitable;
             confidence = vulnResult.confidence;
             evidence.push(...vulnResult.evidence);
             logs.push(...vulnResult.logs);
         }
-        else if (finding.type === 'code-issue') {
+        else if (isCode || isIac || isDocker) {
             const codeResult = await this.analyzeCodeIssue(finding);
             exploitable = codeResult.likelyExploitable;
             confidence = codeResult.confidence;
@@ -242,7 +249,7 @@ export class RedTeamAgent extends SLOPAgent {
         }
         else {
             confidence = 50;
-            logs.push(`[RedTeam] No specific validation for ${finding.type}, using heuristics`);
+            logs.push(`[RedTeam] No specific validation for ${finding.type} (normalized: ${normalizedType}), using heuristics`);
         }
         // Determine risk level
         if (exploitable && confidence >= 80) {

package/dist/agents/slop/scanner-agent.js

@@ -176,6 +176,24 @@ export class ScannerAgent extends SLOPAgent {
     async runGitleaks(target) {
         const findings = [];
         const tempFile = `/tmp/gitleaks-${Date.now()}.json`;
+        // Patterns to exclude (false positives)
+        const excludePatterns = [
+            /\.secrets\.baseline$/, // detect-secrets baseline files
+            /\.test\.[jt]sx?$/, // Test files (.test.ts, .test.js, .test.tsx, .test.jsx)
+            /\.spec\.[jt]sx?$/, // Spec files (.spec.ts, .spec.js)
+            /test\.py$/, // Python test files
+            /_test\.go$/, // Go test files
+            /\.fuzz\.test\.[jt]s$/, // Fuzz test files
+            /\/tests?\//i, // Files in test directories
+            /\/fixtures?\//i, // Test fixtures
+            /\/mocks?\//i, // Mock files
+        ];
+        // Rule + path combinations to exclude (documentation examples)
+        const excludeRulePaths = [
+            { rule: /curl-auth-header/, path: /\.md$/ }, // curl examples in docs
+            { rule: /generic-api-key/, path: /\.md$/ }, // API key examples in docs
+            { rule: /generic-api-key/, path: /\.example$/ }, // Example files
+        ];
         try {
             // Gitleaks exits with code 1 when it finds leaks - that's not an error!
             const result = await this.executeCommand('gitleaks', ['detect', '--source', target, '--report-format', 'json', '--report-path', tempFile, '--no-git']);
@@ -187,7 +205,20 @@ export class ScannerAgent extends SLOPAgent {
                 if (jsonContent && jsonContent.trim()) {
                     const gitleaksFindings = JSON.parse(jsonContent);
                     if (Array.isArray(gitleaksFindings)) {
+                        let skipped = 0;
                         for (const f of gitleaksFindings) {
+                            const filePath = f.File || '';
+                            const ruleId = f.RuleID || f.Rule || f.rule || '';
+                            // Skip files matching exclusion patterns
+                            if (excludePatterns.some(pattern => pattern.test(filePath))) {
+                                skipped++;
+                                continue;
+                            }
+                            // Skip rule+path combinations (documentation examples)
+                            if (excludeRulePaths.some(({ rule, path }) => rule.test(ruleId) && path.test(filePath))) {
+                                skipped++;
+                                continue;
+                            }
                             findings.push({
                                 id: `gitleaks-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`,
                                 type: 'secret',
@@ -199,7 +230,7 @@ export class ScannerAgent extends SLOPAgent {
                                 metadata: { rule: f.RuleID || f.Rule || f.rule, match: f.Match?.substring(0, 100) },
                             });
                         }
-                        console.log(`[Scanner] Gitleaks found ${findings.length} secrets`);
+                        console.log(`[Scanner] Gitleaks found ${findings.length} secrets (${skipped} filtered as false positives)`);
                     }
                 }
             }

package/dist/agents/slop/types.d.ts

@@ -49,7 +49,7 @@ export interface AgentMessage {
 }
 export interface Finding {
     id: string;
-    type: 'secret' | 'vulnerability' | 'code-issue' | 'iac' | 'docker';
+    type: string;
     severity: 'critical' | 'high' | 'medium' | 'low';
     title: string;
     description: string;
@@ -59,8 +59,29 @@ export interface Finding {
     version?: string;
     cve?: string;
     cwe?: string;
+    rule?: string;
+    scanner?: string;
+    message?: string;
     metadata?: Record<string, unknown>;
 }
+export interface ExternalFinding {
+    id?: string;
+    type: string;
+    severity?: 'critical' | 'high' | 'medium' | 'low';
+    title?: string;
+    description?: string;
+    message?: string;
+    file?: string;
+    line?: number;
+    package?: string;
+    version?: string;
+    cve?: string;
+    cwe?: string;
+    rule?: string;
+    scanner?: string;
+    metadata?: Record<string, unknown>;
+}
+export declare function normalizeFinding(f: ExternalFinding): Finding;
 export interface TriageResult {
     finding: Finding;
     validated: boolean;

package/dist/agents/slop/types.js

@@ -3,4 +3,23 @@
  *
  * Types for SLOP-native multi-agent communication
  */
-export {};
+// Helper to convert external finding to internal format
+export function normalizeFinding(f) {
+    return {
+        id: f.id || `finding-${Date.now()}-${Math.random().toString(36).slice(2, 9)}`,
+        type: f.type,
+        severity: f.severity || 'medium',
+        title: f.title || f.type || 'Unknown Finding',
+        description: f.description || f.message || '',
+        file: f.file,
+        line: f.line,
+        package: f.package,
+        version: f.version,
+        cve: f.cve,
+        cwe: f.cwe,
+        rule: f.rule,
+        scanner: f.scanner,
+        message: f.message,
+        metadata: f.metadata,
+    };
+}

package/dist/index.d.ts

@@ -25,3 +25,7 @@ export { AuditorWebSocket, getWebSocketServer, closeWebSocketServer } from './we
 export type { WSMessage, AuditStartedPayload, AuditCompletedPayload, FindingPayload } from './websocket/index.js';
 export { performTrustScan } from './integrations/trust-scanner.js';
 export type { TrustScanResult, TrustCheck, TrustMetrics } from './integrations/trust-scanner.js';
+export { performAIVerification } from './integrations/ai-verifier.js';
+export type { AIVerifyResult } from './integrations/ai-verifier.js';
+export { detectScamPatterns, quickScamScan, getScamSignatures, addScamSignature } from './integrations/scam-detector.js';
+export type { ScamSignature, ScamDetectionResult, SimilarityMatch } from './integrations/scam-detector.js';