chainwall 0.1.0 → 2.1.0

package/dist/rules/mining-rules.js

@@ -0,0 +1,239 @@
+/**
+ * Validate that a match appears in a code/config context, not documentation.
+ * Returns true if this looks like actual mining code/config, false for docs.
+ */
+function notDocContext(_match, line) {
+    const trimmed = line.trim();
+    if (/^\s*(?:#|\/\/|\*|<!--|-->)/.test(trimmed))
+        return false;
+    if (/\b(?:README|EXAMPLE|DOCUMENTATION|CHANGELOG)\b/i.test(line))
+        return false;
+    return true;
+}
+/**
+ * Validate that algo name appears in JSON/config context (has : or = nearby).
+ */
+function inConfigContext(_match, line) {
+    if (!notDocContext(_match, line))
+        return false;
+    return /[=:]/.test(line);
+}
+/**
+ * Rules for detecting cryptocurrency mining activity.
+ * These are added to allRules and run against ALL scanned files.
+ */
+export const miningRules = [
+    // ── CRITICAL: Mining Pool URLs ────────────────────────────────────────
+    {
+        id: 'mine-stratum-tcp',
+        name: 'Mining Pool URL (stratum+tcp)',
+        regex: /stratum\+tcp:\/\/\S+/i,
+        severity: 'critical',
+        category: 'cryptojacking',
+        description: 'Stratum mining pool connection URL — active mining configuration',
+        tags: ['mining-pool', 'stratum'],
+        validate: notDocContext,
+    },
+    {
+        id: 'mine-stratum-ssl',
+        name: 'Mining Pool URL (stratum+ssl)',
+        regex: /stratum\+ssl:\/\/\S+/i,
+        severity: 'critical',
+        category: 'cryptojacking',
+        description: 'Stratum SSL mining pool connection URL — active mining configuration',
+        tags: ['mining-pool', 'stratum'],
+        validate: notDocContext,
+    },
+    {
+        id: 'mine-known-pool-domain',
+        name: 'Known Mining Pool Domain',
+        regex: /(?:pool\.minergate\.com|(?:xmr|eth|btc)\.(?:nanopool|f2pool|2miners|herominers)\.org|(?:monero|mining)pool\.\S+|(?:nicehash|ethermine|flexpool|hiveon)\.(?:com|org|io))/i,
+        severity: 'critical',
+        category: 'cryptojacking',
+        description: 'Connection to known cryptocurrency mining pool',
+        tags: ['mining-pool'],
+        validate: notDocContext,
+    },
+    // ── HIGH: Mining Pool Ports ───────────────────────────────────────────
+    {
+        id: 'mine-pool-port',
+        name: 'Mining Pool Port in Connection',
+        regex: /(?::\s*(?:3333|4444|5555|8888|9999|14444|14433|45700)\b)/,
+        severity: 'high',
+        category: 'cryptojacking',
+        description: 'Common mining pool port in connection configuration',
+        tags: ['mining-pool', 'port'],
+        validate(match, line) {
+            if (!notDocContext(match, line))
+                return false;
+            // Require pool/stratum/mining context
+            return /(?:pool|stratum|miner|mining|worker|hashrate)/i.test(line);
+        },
+    },
+    // ── HIGH: Miner Binaries ──────────────────────────────────────────────
+    {
+        id: 'mine-xmrig-binary',
+        name: 'XMRig Miner Reference',
+        regex: /\bxmrig(?:\.exe|\.json|\.config|\.log)?\b/i,
+        severity: 'high',
+        category: 'cryptojacking',
+        description: 'Reference to XMRig cryptocurrency miner',
+        tags: ['miner-binary', 'xmrig'],
+        validate: notDocContext,
+    },
+    {
+        id: 'mine-known-miner-binary',
+        name: 'Known Miner Binary',
+        regex: /\b(?:ethminer|cgminer|bfgminer|phoenixminer|cpuminer|minerd|claymore|t-rex|lolminer|nbminer|gminer)\b/i,
+        severity: 'high',
+        category: 'cryptojacking',
+        description: 'Reference to known cryptocurrency mining software',
+        tags: ['miner-binary'],
+        validate: notDocContext,
+    },
+    // ── HIGH: Mining Algorithm Config ─────────────────────────────────────
+    {
+        id: 'mine-algo-config',
+        name: 'Mining Algorithm in Config',
+        regex: /\b(?:randomx|ethash|kawpow|cryptonight(?:[-_]?(?:lite|heavy|pico|r|v[12]))?|equihash|scrypt|sha256d|blake2[sb]?|lyra2re[v2]*|x11|x13|x16[rs])\b/i,
+        severity: 'high',
+        category: 'cryptojacking',
+        description: 'Mining algorithm specification in configuration context',
+        tags: ['mining-algo'],
+        validate: inConfigContext,
+    },
+    // ── CRITICAL: WebAssembly Mining (Browser Miners) ─────────────────────
+    {
+        id: 'mine-coinhive',
+        name: 'CoinHive/Web Miner',
+        regex: /\b(?:CoinHive|coinhive|AuthedMine|authedmine)\b/,
+        severity: 'critical',
+        category: 'cryptojacking',
+        description: 'CoinHive browser-based cryptocurrency miner',
+        tags: ['web-mining', 'coinhive'],
+        validate: notDocContext,
+    },
+    {
+        id: 'mine-cryptoloot',
+        name: 'CryptoLoot Web Miner',
+        regex: /\b(?:cryptoloot|CryptoLoot|crypto-loot)\b/i,
+        severity: 'critical',
+        category: 'cryptojacking',
+        description: 'CryptoLoot browser-based cryptocurrency miner',
+        tags: ['web-mining'],
+        validate: notDocContext,
+    },
+    {
+        id: 'mine-wasm-miner',
+        name: 'WebAssembly Mining Module',
+        regex: /cryptonight\.wasm|(?:miner|mining)\.wasm/i,
+        severity: 'critical',
+        category: 'cryptojacking',
+        description: 'WebAssembly cryptocurrency mining module',
+        tags: ['web-mining', 'wasm'],
+        validate: notDocContext,
+    },
+    // ── MEDIUM: Mining Library Imports ────────────────────────────────────
+    {
+        id: 'mine-js-import',
+        name: 'Mining Library Import (JS)',
+        regex: /(?:require|import)\s*\(\s*['"](?:coinhive|xmr-miner|cryptonight-(?:wasm|asmjs)|monero-miner|webmine)/i,
+        severity: 'medium',
+        category: 'cryptojacking',
+        description: 'JavaScript import of cryptocurrency mining library',
+        tags: ['mining-lib', 'javascript'],
+    },
+    {
+        id: 'mine-python-import',
+        name: 'Mining Library Import (Python)',
+        regex: /(?:^|\s)(?:import|from)\s+(?:pyxmrig|minerlib|coinhive|cpuminer)/,
+        severity: 'medium',
+        category: 'cryptojacking',
+        description: 'Python import of cryptocurrency mining library',
+        tags: ['mining-lib', 'python'],
+    },
+    // ── HIGH: Monero Wallet in Config ─────────────────────────────────────
+    {
+        id: 'mine-monero-wallet',
+        name: 'Monero Wallet Address in Config',
+        regex: /(?:wallet|address|user)\s*[=:"']\s*4[0-9A-Za-z]{94}/,
+        severity: 'high',
+        category: 'cryptojacking',
+        description: 'Monero wallet address in mining configuration context',
+        tags: ['wallet', 'monero'],
+        validate: notDocContext,
+    },
+    // ── HIGH: Mining Environment Variables ────────────────────────────────
+    {
+        id: 'mine-env-vars',
+        name: 'Mining Environment Variables',
+        regex: /\b(?:MINING_WALLET|MINER_WALLET|POOL_WALLET|MINING_POOL|MINER_POOL|WORKER_NAME|MINING_THREADS|HASHRATE_TARGET)\s*=/i,
+        severity: 'high',
+        category: 'cryptojacking',
+        description: 'Environment variable associated with mining configuration',
+        tags: ['mining-env'],
+    },
+    // ── HIGH: Miner Config Files (filename scope) ─────────────────────────
+    {
+        id: 'mine-config-file-xmrig',
+        name: 'XMRig Config File',
+        regex: /\bxmrig\.json\b/i,
+        severity: 'high',
+        category: 'cryptojacking',
+        description: 'XMRig miner configuration file',
+        tags: ['miner-config'],
+        scope: 'filename',
+    },
+    {
+        id: 'mine-config-file-pools',
+        name: 'Mining Pools Config File',
+        regex: /\bpools\.txt\b/i,
+        severity: 'high',
+        category: 'cryptojacking',
+        description: 'Mining pool configuration file',
+        tags: ['miner-config'],
+        scope: 'filename',
+        validate(match, line) {
+            // Only flag if in a mining context
+            return /(?:miner|mining|xmrig|stratum)/i.test(line);
+        },
+    },
+    {
+        id: 'mine-config-file-generic',
+        name: 'Miner Config File',
+        regex: /\bminer\.conf\b/i,
+        severity: 'high',
+        category: 'cryptojacking',
+        description: 'Generic miner configuration file',
+        tags: ['miner-config'],
+        scope: 'filename',
+    },
+    // ── HIGH: Mining Hashrate/Worker Config ───────────────────────────────
+    {
+        id: 'mine-hashrate-config',
+        name: 'Mining Hashrate Configuration',
+        regex: /(?:hashrate|hash_rate|threads|max-threads-hint)\s*[=:"']\s*\d+/i,
+        severity: 'high',
+        category: 'cryptojacking',
+        description: 'Mining hashrate or thread configuration',
+        tags: ['mining-config'],
+        validate(match, line) {
+            if (!notDocContext(match, line))
+                return false;
+            // Require mining context to avoid false positives on generic thread configs
+            return /(?:miner|mining|pool|stratum|worker|xmrig|hashrate|coin)/i.test(line);
+        },
+    },
+    // ── CRITICAL: Mining Process Launch ───────────────────────────────────
+    {
+        id: 'mine-process-launch',
+        name: 'Mining Process Launch',
+        regex: /(?:\.\/|\/usr\/(?:local\/)?bin\/)(?:xmrig|minerd|cpuminer|ethminer|cgminer|bfgminer)\b/,
+        severity: 'critical',
+        category: 'cryptojacking',
+        description: 'Direct launch of cryptocurrency mining binary',
+        tags: ['miner-launch'],
+        validate: notDocContext,
+    },
+];
+//# sourceMappingURL=mining-rules.js.map

package/dist/rules/mining-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"mining-rules.js","sourceRoot":"","sources":["../../src/rules/mining-rules.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,SAAS,aAAa,CAAC,MAAwB,EAAE,IAAY;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,iDAAiD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,eAAe,CAAC,MAAwB,EAAE,IAAY;IAC7D,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,MAAM,WAAW,GAAW;IACjC,yEAAyE;IACzE;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,+BAA+B;QACrC,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,kEAAkE;QAC/E,IAAI,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC;QAChC,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,+BAA+B;QACrC,KAAK,EAAE,uBAAuB;QAC9B,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,sEAAsE;QACnF,IAAI,EAAE,CAAC,aAAa,EAAE,SAAS,CAAC;QAChC,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,0KAA0K;QACjL,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,gDAAgD;QAC7D,IAAI,EAAE,CAAC,aAAa,CAAC;QACrB,QAAQ,EAAE,aAAa;KACxB;IAED,yEAAyE;IACzE;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,gCAAgC;QACtC,KAAK,EAAE,0DAA0D;QACjE,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,qDAAqD;QAClE,IAAI,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC;QAC7B,QAAQ,CAAC,KAAK,EAAE,IAAI;YAClB,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9C,sCAAsC;YACtC,OAAO,gDAAgD,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACrE,CAAC;KACF;IAED,yEAAyE;IACzE;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,4CAA4C;QACnD,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,yCAAyC;QACtD,IAAI,EAAE,CAAC,cAAc,EAAE,OAAO,CAAC;QAC/B,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,wGAAwG;QAC/G,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,mDAAmD;QAChE,IAAI,EAAE,CAAC,cAAc,CAAC;QACtB,QAAQ,EAAE,aAAa;KACxB;IAED,yEAAyE;IACzE;QACE,EAAE,EAAE,kBAAkB;QACtB,IAAI,EAAE,4BAA4B;QAClC,KAAK,EAAE,kJAAkJ;QACzJ,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,yDAAyD;QACtE,IAAI,EAAE,CAAC,aAAa,CAAC;QACrB,QAAQ,EAAE,eAAe;KAC1B;IAED,yEAAyE;IACzE;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,iDAAiD;QACxD,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,CAAC,YAAY,EAAE,UAAU,CAAC;QAChC,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,4CAA4C;QACnD,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,+CAA+C;QAC5D,IAAI,EAAE,CAAC,YAAY,CAAC;QACpB,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,2BAA2B;QACjC,KAAK,EAAE,2CAA2C;QAClD,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,0CAA0C;QACvD,IAAI,EAAE,CAAC,YAAY,EAAE,MAAM,CAAC;QAC5B,QAAQ,EAAE,aAAa;KACxB;IAED,yEAAyE;IACzE;QACE,EAAE,EAAE,gBAAgB;QACpB,IAAI,EAAE,4BAA4B;QAClC,KAAK,EAAE,uGAAuG;QAC9G,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,oDAAoD;QACjE,IAAI,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;KACnC;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,gCAAgC;QACtC,KAAK,EAAE,kEAAkE;QACzE,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,gDAAgD;QAC7D,IAAI,EAAE,CAAC,YAAY,EAAE,QAAQ,CAAC;KAC/B;IAED,yEAAyE;IACzE;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,iCAAiC;QACvC,KAAK,EAAE,qDAAqD;QAC5D,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,uDAAuD;QACpE,IAAI,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC;QAC1B,QAAQ,EAAE,aAAa;KACxB;IAED,yEAAyE;IACzE;QACE,EAAE,EAAE,eAAe;QACnB,IAAI,EAAE,8BAA8B;QACpC,KAAK,EAAE,qHAAqH;QAC5H,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,2DAA2D;QACxE,IAAI,EAAE,CAAC,YAAY,CAAC;KACrB;IAED,yEAAyE;IACzE;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,kBAAkB;QACzB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,gCAAgC;QAC7C,IAAI,EAAE,CAAC,cAAc,CAAC;QACtB,KAAK,EAAE,UAAU;KAClB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,iBAAiB;QACxB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,gCAAgC;QAC7C,IAAI,EAAE,CAAC,cAAc,CAAC;QACtB,KAAK,EAAE,UAAU;QACjB,QAAQ,CAAC,KAAK,EAAE,IAAI;YAClB,mCAAmC;YACnC,OAAO,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtD,CAAC;KACF;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,kBAAkB;QACzB,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,kCAAkC;QAC/C,IAAI,EAAE,CAAC,cAAc,CAAC;QACtB,KAAK,EAAE,UAAU;KAClB;IAED,yEAAyE;IACzE;QACE,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,+BAA+B;QACrC,KAAK,EAAE,iEAAiE;QACxE,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,yCAAyC;QACtD,IAAI,EAAE,CAAC,eAAe,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,IAAI;YAClB,IAAI,CAAC,aAAa,CAAC,KAAK,EAAE,IAAI,CAAC;gBAAE,OAAO,KAAK,CAAC;YAC9C,4EAA4E;YAC5E,OAAO,2DAA2D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChF,CAAC;KACF;IAED,yEAAyE;IACzE;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,wFAAwF;QAC/F,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,eAAe;QACzB,WAAW,EAAE,+CAA+C;QAC5D,IAAI,EAAE,CAAC,cAAc,CAAC;QACtB,QAAQ,EAAE,aAAa;KACxB;CACF,CAAC"}

package/dist/rules/skill-rules.d.ts

@@ -0,0 +1,10 @@
+import type { Rule } from './types.js';
+/**
+ * Rules for detecting malicious patterns in AI skill/instruction files.
+ * These target shell payloads, exfiltration, credential harvesting, and
+ * obfuscated code hidden in SKILL.md, CLAUDE.md, AGENTS.md, etc.
+ *
+ * Separate from allRules — only run against skill/instruction files.
+ */
+export declare const skillFileRules: Rule[];
+//# sourceMappingURL=skill-rules.d.ts.map

package/dist/rules/skill-rules.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-rules.d.ts","sourceRoot":"","sources":["../../src/rules/skill-rules.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAcvC;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,EAAE,IAAI,EAuRhC,CAAC"}

package/dist/rules/skill-rules.js

@@ -0,0 +1,293 @@
+/**
+ * Validate that the match is NOT inside a documentation/comment context.
+ * Returns true if this looks like a real threat, false for docs/examples.
+ */
+function notDocContext(_match, line) {
+    const trimmed = line.trim();
+    // Skip documentation lines
+    if (/^\s*(?:#|\/\/|\*|<!--|-->)/.test(trimmed))
+        return false;
+    if (/\b(?:README|EXAMPLE|DOCUMENTATION|CHANGELOG)\b/i.test(line))
+        return false;
+    return true;
+}
+/**
+ * Rules for detecting malicious patterns in AI skill/instruction files.
+ * These target shell payloads, exfiltration, credential harvesting, and
+ * obfuscated code hidden in SKILL.md, CLAUDE.md, AGENTS.md, etc.
+ *
+ * Separate from allRules — only run against skill/instruction files.
+ */
+export const skillFileRules = [
+    // ── CRITICAL: Shell Code in Markdown ──────────────────────────────────
+    {
+        id: 'skill-curl-pipe-shell',
+        name: 'Curl Pipe to Shell',
+        regex: /curl\s+(?:-[sSfLk]+\s+)*https?:\/\/\S+\s*\|\s*(?:bash|sh|zsh)/i,
+        severity: 'critical',
+        category: 'skill_threat',
+        description: 'Downloads and executes remote script via curl pipe to shell',
+        tags: ['shell', 'download-execute'],
+        validate: notDocContext,
+    },
+    {
+        id: 'skill-wget-pipe-shell',
+        name: 'Wget Pipe to Shell',
+        regex: /wget\s+(?:-[qO-]+\s+)*https?:\/\/\S+\s*(?:\|\s*(?:bash|sh|zsh)|;\s*(?:bash|sh|zsh))/i,
+        severity: 'critical',
+        category: 'skill_threat',
+        description: 'Downloads and executes remote script via wget',
+        tags: ['shell', 'download-execute'],
+        validate: notDocContext,
+    },
+    {
+        id: 'skill-reverse-shell',
+        name: 'Reverse Shell Payload',
+        regex: /(?:\/dev\/tcp\/|nc\s+-[elp]+|ncat\s|mkfifo\s+\/tmp\/|bash\s+-i\s+>&\s*\/dev\/tcp)/i,
+        severity: 'critical',
+        category: 'skill_threat',
+        description: 'Reverse shell pattern that connects back to an attacker',
+        tags: ['shell', 'reverse-shell'],
+        validate: notDocContext,
+    },
+    {
+        id: 'skill-rm-rf',
+        name: 'Destructive rm Command',
+        regex: /rm\s+-[rfR]{2,}\s+(?:\/|~|\$HOME|\$\{HOME\}|\.\.)/,
+        severity: 'critical',
+        category: 'skill_threat',
+        description: 'Destructive recursive delete targeting important directories',
+        tags: ['shell', 'destructive'],
+        validate: notDocContext,
+    },
+    {
+        id: 'skill-chmod-777',
+        name: 'chmod 777 (World Writable)',
+        regex: /chmod\s+(?:-R\s+)?777\s/,
+        severity: 'high',
+        category: 'skill_threat',
+        description: 'Sets world-writable permissions, enabling unauthorized modification',
+        tags: ['shell', 'permissions'],
+        validate: notDocContext,
+    },
+    // ── CRITICAL: Data Exfiltration ──────────────────────────────────────
+    {
+        id: 'skill-curl-post-data',
+        name: 'curl POST Exfiltration',
+        regex: /curl\s+(?:.*\s)?-(?:X\s+POST|d\s|--data)\s.*(?:\.env|\$\(|`cat\b|process\.env|credentials|secret|token|password)/i,
+        severity: 'critical',
+        category: 'skill_threat',
+        description: 'Exfiltrates sensitive data via HTTP POST request',
+        tags: ['exfiltration', 'curl'],
+        validate: notDocContext,
+    },
+    {
+        id: 'skill-webhook-send',
+        name: 'Webhook Data Send',
+        regex: /(?:webhook|hook|callback)\S*\s*[=:]\s*["']?https?:\/\/\S+/i,
+        severity: 'high',
+        category: 'skill_threat',
+        description: 'Sends data to an external webhook endpoint',
+        tags: ['exfiltration', 'webhook'],
+        validate: notDocContext,
+    },
+    {
+        id: 'skill-encoded-url-exfil',
+        name: 'Encoded URL Exfiltration',
+        regex: /https?:\/\/\S+\?[^"'\s]*(?:data|token|key|secret|password|env)=[^"'\s]*\$\(/i,
+        severity: 'critical',
+        category: 'skill_threat',
+        description: 'Exfiltrates data via encoded URL parameters with command substitution',
+        tags: ['exfiltration', 'url-params'],
+        validate: notDocContext,
+    },
+    // ── HIGH: External URL Fetches / Install ─────────────────────────────
+    {
+        id: 'skill-url-pip-install',
+        name: 'pip Install from URL',
+        regex: /pip3?\s+install\s+(?:--[a-z-]+\s+)*https?:\/\/\S+/i,
+        severity: 'high',
+        category: 'skill_threat',
+        description: 'Installs Python package from arbitrary URL instead of PyPI',
+        tags: ['supply-chain', 'pip'],
+        validate: notDocContext,
+    },
+    {
+        id: 'skill-npm-install-url',
+        name: 'npm Install from URL/Git',
+        regex: /npm\s+install\s+(?:--[a-z-]+\s+)*(?:https?:\/\/|git\+|github:)\S+/i,
+        severity: 'high',
+        category: 'skill_threat',
+        description: 'Installs npm package from arbitrary URL or git repo',
+        tags: ['supply-chain', 'npm'],
+        validate: notDocContext,
+    },
+    // ── HIGH/CRITICAL: Obfuscated Payloads ───────────────────────────────
+    {
+        id: 'skill-hex-escape-sequence',
+        name: 'Long Hex Escape Sequence',
+        regex: /(?:\\x[0-9a-fA-F]{2}){8,}/,
+        severity: 'high',
+        category: 'skill_threat',
+        description: 'Long hex escape sequence that may hide executable commands',
+        tags: ['obfuscation', 'hex'],
+    },
+    {
+        id: 'skill-long-base64',
+        name: 'Long Base64 String',
+        regex: /(?:base64\s+(?:-d|--decode)|atob|Buffer\.from)\s*[("'`]\s*[A-Za-z0-9+/=]{100,}/,
+        severity: 'high',
+        category: 'skill_threat',
+        description: 'Decoding a long base64 string — may contain hidden payload',
+        tags: ['obfuscation', 'base64'],
+        validate: notDocContext,
+    },
+    {
+        id: 'skill-eval-string-concat',
+        name: 'Eval with String Concatenation',
+        regex: /eval\s*\(\s*(?:["'][^"']*["']\s*\+\s*){2,}/,
+        severity: 'high',
+        category: 'skill_threat',
+        description: 'Eval with concatenated strings — obfuscation technique',
+        tags: ['obfuscation', 'eval'],
+    },
+    // ── HIGH: Hidden Instructions ────────────────────────────────────────
+    {
+        id: 'skill-html-comment-action',
+        name: 'HTML Comment with Action Keywords',
+        regex: /<!--\s*(?:curl|wget|fetch|exec|run|send|post|download|install|eval)\b[^>]{5,}-->/i,
+        severity: 'high',
+        category: 'skill_threat',
+        description: 'HTML comment containing executable action keywords',
+        tags: ['hidden', 'html-comment'],
+    },
+    {
+        id: 'skill-unicode-bidi',
+        name: 'Unicode Bidirectional Override',
+        regex: /[\u200F\u200E\u202A-\u202E\u2066-\u2069]/,
+        severity: 'high',
+        category: 'skill_threat',
+        description: 'Unicode bidirectional override character can hide malicious text',
+        tags: ['hidden', 'unicode'],
+    },
+    {
+        id: 'skill-script-iframe-tag',
+        name: 'Script/Iframe Tag in Instruction',
+        regex: /<\s*(?:script|iframe)\b[^>]*>/i,
+        severity: 'high',
+        category: 'skill_threat',
+        description: 'Script or iframe tag in an instruction file',
+        tags: ['hidden', 'html'],
+    },
+    {
+        id: 'skill-zero-width-chars',
+        name: 'Zero-Width Characters',
+        regex: /[\u200B\u200C\u200D\uFEFF]{3,}/,
+        severity: 'medium',
+        category: 'skill_threat',
+        description: 'Cluster of zero-width characters may hide invisible instructions',
+        tags: ['hidden', 'unicode'],
+    },
+    // ── CRITICAL: Credential Harvesting ──────────────────────────────────
+    {
+        id: 'skill-read-ssh-key',
+        name: 'SSH Key Read Instruction',
+        regex: /(?:read|cat|open|display|print|output|show)\s+(?:the\s+)?(?:contents?\s+(?:of\s+)?)?~?\/?(?:\.ssh\/id_(?:rsa|ed25519|ecdsa)|\.ssh\/(?:config|known_hosts|authorized_keys))/i,
+        severity: 'critical',
+        category: 'skill_threat',
+        description: 'Instruction to read SSH private keys or config',
+        tags: ['credential-harvest', 'ssh'],
+    },
+    {
+        id: 'skill-read-aws-creds',
+        name: 'AWS Credentials Read Instruction',
+        regex: /(?:read|cat|open|display|print|output|show)\s+(?:the\s+)?(?:contents?\s+(?:of\s+)?)?~?\/?\.aws\/(?:credentials|config)/i,
+        severity: 'critical',
+        category: 'skill_threat',
+        description: 'Instruction to read AWS credentials file',
+        tags: ['credential-harvest', 'aws'],
+    },
+    {
+        id: 'skill-read-env-file',
+        name: '.env File Read Instruction',
+        regex: /(?:read|cat|open|display|print|output|show)\s+(?:the\s+)?(?:contents?\s+(?:of\s+)?)?(?:\.env|\.env\.local|\.env\.production)/i,
+        severity: 'critical',
+        category: 'skill_threat',
+        description: 'Instruction to read .env file containing secrets',
+        tags: ['credential-harvest', 'env'],
+        validate: notDocContext,
+    },
+    {
+        id: 'skill-dump-env-vars',
+        name: 'Environment Variable Dump',
+        regex: /(?:print|echo|output|dump|list|show)\s+(?:all\s+)?(?:the\s+)?(?:env(?:ironment)?\s*(?:variables?|vars?))/i,
+        severity: 'high',
+        category: 'skill_threat',
+        description: 'Instruction to dump all environment variables',
+        tags: ['credential-harvest', 'env'],
+        validate: notDocContext,
+    },
+    // ── CRITICAL: System Modification ────────────────────────────────────
+    {
+        id: 'skill-modify-bashrc',
+        name: 'Shell Profile Modification',
+        regex: /(?:add|append|write|insert|modify|edit)\s+(?:to\s+)?(?:the\s+)?(?:~\/?)?\.(?:bashrc|zshrc|profile|bash_profile|zprofile)/i,
+        severity: 'critical',
+        category: 'skill_threat',
+        description: 'Instruction to modify shell profile for persistent access',
+        tags: ['system-mod', 'persistence'],
+        validate: notDocContext,
+    },
+    {
+        id: 'skill-crontab-add',
+        name: 'Crontab Modification',
+        regex: /(?:crontab|cron)\s+(?:-[elr]\s+)?.*(?:add|write|install|create)/i,
+        severity: 'critical',
+        category: 'skill_threat',
+        description: 'Instruction to add crontab entry for persistent execution',
+        tags: ['system-mod', 'persistence'],
+        validate: notDocContext,
+    },
+    {
+        id: 'skill-write-etc',
+        name: 'Write to /etc/ Directory',
+        regex: /(?:write|echo|cat|tee)\s+.*(?:>|>>)\s*\/etc\//,
+        severity: 'critical',
+        category: 'skill_threat',
+        description: 'Writing to system configuration directory',
+        tags: ['system-mod', 'system-config'],
+        validate: notDocContext,
+    },
+    // ── HIGH: Security Bypass ────────────────────────────────────────────
+    {
+        id: 'skill-disable-security-tool',
+        name: 'Security Tool Disable Instruction',
+        regex: /(?:disable|remove|uninstall|stop|kill|bypass)\s+(?:the\s+)?(?:chainwall|security|antivirus|firewall|gatekeeper|sip)/i,
+        severity: 'critical',
+        category: 'skill_threat',
+        description: 'Instruction to disable security tools including ChainWall',
+        tags: ['security-bypass'],
+        validate: notDocContext,
+    },
+    {
+        id: 'skill-disable-ssl',
+        name: 'SSL/TLS Verification Disable',
+        regex: /(?:--(?:no-check-certificate|insecure)|NODE_TLS_REJECT_UNAUTHORIZED\s*=\s*["']?0|verify\s*=\s*False|SSL_VERIFY\s*=\s*(?:false|0))/i,
+        severity: 'high',
+        category: 'skill_threat',
+        description: 'Disabling SSL/TLS certificate verification',
+        tags: ['security-bypass', 'ssl'],
+    },
+    // ── HIGH: Password-Protected Archives ────────────────────────────────
+    {
+        id: 'skill-password-archive',
+        name: 'Password-Protected Archive Extraction',
+        regex: /(?:unzip|7z|7za)\s+(?:.*\s)?-[pP]\s*\S+/,
+        severity: 'high',
+        category: 'skill_threat',
+        description: 'Extracting password-protected archive — may contain hidden payloads',
+        tags: ['archive', 'password'],
+        validate: notDocContext,
+    },
+];
+//# sourceMappingURL=skill-rules.js.map

package/dist/rules/skill-rules.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-rules.js","sourceRoot":"","sources":["../../src/rules/skill-rules.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,SAAS,aAAa,CAAC,MAAwB,EAAE,IAAY;IAC3D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,2BAA2B;IAC3B,IAAI,4BAA4B,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7D,IAAI,iDAAiD,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAW;IACpC,yEAAyE;IACzE;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,gEAAgE;QACvE,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,6DAA6D;QAC1E,IAAI,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACnC,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,sFAAsF;QAC7F,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,+CAA+C;QAC5D,IAAI,EAAE,CAAC,OAAO,EAAE,kBAAkB,CAAC;QACnC,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,oFAAoF;QAC3F,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,yDAAyD;QACtE,IAAI,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC;QAChC,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EAAE,mDAAmD;QAC1D,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,8DAA8D;QAC3E,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;QAC9B,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,4BAA4B;QAClC,KAAK,EAAE,yBAAyB;QAChC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,qEAAqE;QAClF,IAAI,EAAE,CAAC,OAAO,EAAE,aAAa,CAAC;QAC9B,QAAQ,EAAE,aAAa;KACxB;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,wBAAwB;QAC9B,KAAK,EAAE,mHAAmH;QAC1H,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,kDAAkD;QAC/D,IAAI,EAAE,CAAC,cAAc,EAAE,MAAM,CAAC;QAC9B,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,mBAAmB;QACzB,KAAK,EAAE,4DAA4D;QACnE,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,4CAA4C;QACzD,IAAI,EAAE,CAAC,cAAc,EAAE,SAAS,CAAC;QACjC,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,8EAA8E;QACrF,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,uEAAuE;QACpF,IAAI,EAAE,CAAC,cAAc,EAAE,YAAY,CAAC;QACpC,QAAQ,EAAE,aAAa;KACxB;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,oDAAoD;QAC3D,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,4DAA4D;QACzE,IAAI,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC;QAC7B,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,uBAAuB;QAC3B,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,oEAAoE;QAC3E,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,qDAAqD;QAClE,IAAI,EAAE,CAAC,cAAc,EAAE,KAAK,CAAC;QAC7B,QAAQ,EAAE,aAAa;KACxB;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,2BAA2B;QAClC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,4DAA4D;QACzE,IAAI,EAAE,CAAC,aAAa,EAAE,KAAK,CAAC;KAC7B;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,oBAAoB;QAC1B,KAAK,EAAE,gFAAgF;QACvF,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,4DAA4D;QACzE,IAAI,EAAE,CAAC,aAAa,EAAE,QAAQ,CAAC;QAC/B,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,0BAA0B;QAC9B,IAAI,EAAE,gCAAgC;QACtC,KAAK,EAAE,4CAA4C;QACnD,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,wDAAwD;QACrE,IAAI,EAAE,CAAC,aAAa,EAAE,MAAM,CAAC;KAC9B;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,2BAA2B;QAC/B,IAAI,EAAE,mCAAmC;QACzC,KAAK,EAAE,mFAAmF;QAC1F,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,oDAAoD;QACjE,IAAI,EAAE,CAAC,QAAQ,EAAE,cAAc,CAAC;KACjC;IACD;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,gCAAgC;QACtC,KAAK,EAAE,0CAA0C;QACjD,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,kEAAkE;QAC/E,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;KAC5B;IACD;QACE,EAAE,EAAE,yBAAyB;QAC7B,IAAI,EAAE,kCAAkC;QACxC,KAAK,EAAE,gCAAgC;QACvC,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,6CAA6C;QAC1D,IAAI,EAAE,CAAC,QAAQ,EAAE,MAAM,CAAC;KACzB;IACD;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,uBAAuB;QAC7B,KAAK,EAAE,gCAAgC;QACvC,QAAQ,EAAE,QAAQ;QAClB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,kEAAkE;QAC/E,IAAI,EAAE,CAAC,QAAQ,EAAE,SAAS,CAAC;KAC5B;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,oBAAoB;QACxB,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,6KAA6K;QACpL,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,gDAAgD;QAC7D,IAAI,EAAE,CAAC,oBAAoB,EAAE,KAAK,CAAC;KACpC;IACD;QACE,EAAE,EAAE,sBAAsB;QAC1B,IAAI,EAAE,kCAAkC;QACxC,KAAK,EAAE,yHAAyH;QAChI,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,0CAA0C;QACvD,IAAI,EAAE,CAAC,oBAAoB,EAAE,KAAK,CAAC;KACpC;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,4BAA4B;QAClC,KAAK,EAAE,+HAA+H;QACtI,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,kDAAkD;QAC/D,IAAI,EAAE,CAAC,oBAAoB,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,2BAA2B;QACjC,KAAK,EAAE,2GAA2G;QAClH,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,+CAA+C;QAC5D,IAAI,EAAE,CAAC,oBAAoB,EAAE,KAAK,CAAC;QACnC,QAAQ,EAAE,aAAa;KACxB;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,qBAAqB;QACzB,IAAI,EAAE,4BAA4B;QAClC,KAAK,EAAE,2HAA2H;QAClI,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,2DAA2D;QACxE,IAAI,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;QACnC,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,sBAAsB;QAC5B,KAAK,EAAE,kEAAkE;QACzE,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,2DAA2D;QACxE,IAAI,EAAE,CAAC,YAAY,EAAE,aAAa,CAAC;QACnC,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,iBAAiB;QACrB,IAAI,EAAE,0BAA0B;QAChC,KAAK,EAAE,+CAA+C;QACtD,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,2CAA2C;QACxD,IAAI,EAAE,CAAC,YAAY,EAAE,eAAe,CAAC;QACrC,QAAQ,EAAE,aAAa;KACxB;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,6BAA6B;QACjC,IAAI,EAAE,mCAAmC;QACzC,KAAK,EAAE,sHAAsH;QAC7H,QAAQ,EAAE,UAAU;QACpB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,2DAA2D;QACxE,IAAI,EAAE,CAAC,iBAAiB,CAAC;QACzB,QAAQ,EAAE,aAAa;KACxB;IACD;QACE,EAAE,EAAE,mBAAmB;QACvB,IAAI,EAAE,8BAA8B;QACpC,KAAK,EAAE,oIAAoI;QAC3I,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,4CAA4C;QACzD,IAAI,EAAE,CAAC,iBAAiB,EAAE,KAAK,CAAC;KACjC;IAED,wEAAwE;IACxE;QACE,EAAE,EAAE,wBAAwB;QAC5B,IAAI,EAAE,uCAAuC;QAC7C,KAAK,EAAE,yCAAyC;QAChD,QAAQ,EAAE,MAAM;QAChB,QAAQ,EAAE,cAAc;QACxB,WAAW,EAAE,qEAAqE;QAClF,IAAI,EAAE,CAAC,SAAS,EAAE,UAAU,CAAC;QAC7B,QAAQ,EAAE,aAAa;KACxB;CACF,CAAC"}

package/dist/rules/types.d.ts

@@ -1,5 +1,5 @@
 export type Severity = 'critical' | 'high' | 'medium' | 'low';
-export type Category = 'credential' | 'private_key' | 'dangerous_command' | 'pii' | 'injection' | 'prompt_injection' | 'supply_chain' | 'crypto' | 'permission';
+export type Category = 'credential' | 'private_key' | 'dangerous_command' | 'pii' | 'injection' | 'prompt_injection' | 'supply_chain' | 'crypto' | 'skill_threat' | 'cryptojacking' | 'permission';
 export type RuleScope = 'content' | 'filename';
 export type RuleAction = 'block' | 'warn';
 export interface Rule {

package/dist/rules/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/rules/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,MAAM,QAAQ,GAChB,YAAY,GACZ,aAAa,GACb,mBAAmB,GACnB,KAAK,GACL,WAAW,GACX,kBAAkB,GAClB,cAAc,GACd,QAAQ,GACR,YAAY,CAAC;AAEjB,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAC/C,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1C,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC9D,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,MAAM;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,eAAe,CAAC;IAC3B,SAAS,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/rules/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,QAAQ,GAAG,UAAU,GAAG,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;AAE9D,MAAM,MAAM,QAAQ,GAChB,YAAY,GACZ,aAAa,GACb,mBAAmB,GACnB,KAAK,GACL,WAAW,GACX,kBAAkB,GAClB,cAAc,GACd,QAAQ,GACR,cAAc,GACd,eAAe,GACf,YAAY,CAAC;AAEjB,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,UAAU,CAAC;AAC/C,MAAM,MAAM,UAAU,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1C,MAAM,WAAW,IAAI;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,KAAK,CAAC,EAAE,SAAS,CAAC;IAClB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC;IAC9D,MAAM,CAAC,EAAE,UAAU,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,QAAQ,CAAC;IACnB,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,UAAU,CAAC;IACnB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,WAAW,EAAE,CAAC;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB;AAED,MAAM,WAAW,MAAM;IACrB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,SAAS,EAAE,eAAe,CAAC;IAC3B,SAAS,EAAE,eAAe,CAAC;IAC3B,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;CACrB"}

package/dist/scanner/filesystem-scanner.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filesystem-scanner.d.ts","sourceRoot":"","sources":["../../src/scanner/filesystem-scanner.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,eAAO,MAAM,SAAS,aAmFpB,CAAC;AAEH,eAAO,MAAM,SAAS,aAGpB,CAAC;AAEH,eAAO,MAAM,eAAe,aAQ1B,CAAC;AAEH,eAAO,MAAM,aAAa,UAAY,CAAC;AAqBvC,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIzD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIjD;AAED,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAejE;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAOD,wBAAgB,YAAY,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAU/D;AAoCD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAuB,SAAS,CAC9B,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,WAAW,GACpB,cAAc,CAAC,WAAW,CAAC,CAoD7B;AAID,wBAAuB,iBAAiB,CACtC,OAAO,EAAE,UAAU,EAAE,EACrB,KAAK,CAAC,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,WAAW,GACnB,cAAc,CAAC,WAAW,CAAC,CAiF7B"}
+{"version":3,"file":"filesystem-scanner.d.ts","sourceRoot":"","sources":["../../src/scanner/filesystem-scanner.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEtD,eAAO,MAAM,SAAS,aAmFpB,CAAC;AAEH,eAAO,MAAM,SAAS,aAGpB,CAAC;AAEH,eAAO,MAAM,eAAe,aAQ1B,CAAC;AAaH,eAAO,MAAM,aAAa,UAAY,CAAC;AAqBvC,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIzD;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAIjD;AAED,wBAAsB,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAejE;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,SAAS;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,YAAY,EAAE,MAAM,CAAC;CACtB;AAOD,wBAAgB,YAAY,CAAC,OAAO,CAAC,EAAE,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,CAU/D;AAoCD,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,wBAAuB,SAAS,CAC9B,OAAO,EAAE,MAAM,EACf,KAAK,CAAC,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,WAAW,GACpB,cAAc,CAAC,WAAW,CAAC,CA4D7B;AAID,wBAAuB,iBAAiB,CACtC,OAAO,EAAE,UAAU,EAAE,EACrB,KAAK,CAAC,EAAE,SAAS,EACjB,MAAM,CAAC,EAAE,WAAW,GACnB,cAAc,CAAC,WAAW,CAAC,CAiF7B"}

package/dist/scanner/filesystem-scanner.js

@@ -1,4 +1,5 @@
 import { opendir, lstat, open, readFile } from 'node:fs/promises';
+import { readFileSync } from 'node:fs';
 import { join, basename } from 'node:path';
 export const SKIP_DIRS = new Set([
     'node_modules',
@@ -97,6 +98,18 @@ export const SKIP_EXTENSIONS = new Set([
     '.mp3', '.mp4', '.wav', '.avi', '.mov',
     '.lock',
 ]);
+// Directories containing rule/pattern definitions that trigger false positives
+// when scanning the chainwall project itself
+const CHAINWALL_SOURCE_DIRS = ['hooks', 'patterns', 'skill', 'commands', 'rules'];
+function isChainwallProject(rootDir) {
+    try {
+        const pkg = JSON.parse(readFileSync(join(rootDir, 'package.json'), 'utf-8'));
+        return pkg.name === 'chainwall';
+    }
+    catch {
+        return false;
+    }
+}
 export const MAX_FILE_SIZE = 1_048_576; // 1MB
 const DEFAULT_MAX_DEPTH = 50;
 const HOME_MAX_DEPTH = 10;
@@ -197,9 +210,16 @@ export async function* walkFiles(rootDir, stats, signal, options) {
     const maxDepth = options?.maxDepth ?? DEFAULT_MAX_DEPTH;
     const maxFiles = options?.maxFiles ?? DEFAULT_MAX_FILES;
     const skipSet = buildSkipSet(options);
+    // Skip chainwall's own rule/pattern directories to avoid false positives
+    let effectiveSkipSet = skipSet;
+    if (isChainwallProject(rootDir)) {
+        effectiveSkipSet = new Set(skipSet);
+        for (const d of CHAINWALL_SOURCE_DIRS)
+            effectiveSkipSet.add(d);
+    }
     let count = 0;
     let yielded = 0;
-    for await (const fullPath of streamWalk(rootDir, maxDepth, skipSet)) {
+    for await (const fullPath of streamWalk(rootDir, maxDepth, effectiveSkipSet)) {
         if (++count % 50 === 0 && signal?.aborted)
             return;
         if (yielded >= maxFiles)