cleartoship 0.10.3 → 0.11.0

package/README.md

@@ -109,7 +109,12 @@ could act on. Each list carries a reason per rule in
 `src/scanners/community.ts`. Run `--no-community` to use only ClearToShip's
 rules. See [ATTRIBUTION.md](ATTRIBUTION.md).
 
-Findings map to **OWASP Top 10:2025** and CWE.
+Findings map to **OWASP Top 10:2025** and CWE, and the ones that are about an
+LLM or an agent carry an **OWASP Top 10 for LLM Applications** category as well
+(in `meta.llm`). The vendored ruleset labels categories inconsistently —
+Injection arrives as both `A02:2025` and `A03:2025`, Security Misconfiguration
+as `A05:2025` and `A05:2021` — so labels are normalised to one taxonomy on the
+way out, with the original kept in `meta.owaspUpstream`.
 
 ## OWASP Top 10:2025 coverage — honest version
 
@@ -127,7 +132,37 @@ it is strongest exactly where AI-generated code fails. Coverage by category:
 | **A09** Logging & Alerting Failures | 🟡 Targeted | **Secrets / PII written to logs** (CTS070) — the statically knowable slice |
 | **A10** Mishandling Exceptions | 🟡 Targeted | **Fail-open / swallowed error on a security check** (CTS071) |
 | **A08** Data & Integrity Failures | 🟡 Targeted | Unverified webhooks (CTS042), **insecure deserialization** (CTS072) |
-| **A06** Insecure Design | 🔴 Not statically detectable | Missing threat modeling is an architecture concern — no static scanner covers it, and we don't pretend to |
+| **A06** Insecure Design | 🔴 Not detectable first-party | Missing threat modeling is an architecture concern. 13 vendored rules carry the label; none of ClearToShip's own do, deliberately |
+
+Counts, measured across the vendored ruleset after normalisation: A01 121,
+A05 112, A04 78, A02 59, A03 32, A07 17, A06 13, A08 11, A09 2. ClearToShip's
+own 45 rules add A01 19, A03 9, A04 7, A08 3, A05 2, and one each for A07, A09
+and A10 — which is the category no vendored rule reaches.
+
+## OWASP Top 10 for LLM Applications — coverage
+
+Worth stating separately, because "we cover the OWASP Top 10" and "we cover the
+LLM Top 10" are different claims and only one of them is usually meant. **41
+vendored rules map to 7 of the 10 LLM categories**, and first-party findings
+join them when the finding itself names a provider — a hardcoded OpenAI key
+(CTS030), an AI client configured to run in the browser (CTS045).
+
+| Category | Rules | What we detect |
+| --- | --- | --- |
+| **LLM01** Prompt Injection | 12 | User input, fetched pages and query results reaching a prompt unbounded; instructions hidden in a tool description |
+| **LLM02** Sensitive Information Disclosure | 11 (+ CTS030, CTS045) | Provider keys in client code or a `NEXT_PUBLIC_` variable, `dangerouslyAllowBrowser`, a base URL pointed at somebody else's endpoint |
+| **LLM06** Excessive Agency | 9 | MCP servers with permissive tool access, `allowedTools` wildcards, auto-approve bypassing the permission prompt, settings hooks that fetch or pipe |
+| **LLM05** Improper Output Handling | 4 | Model output rendered as raw HTML or markdown images, or used in a dangerous sink |
+| **LLM08** Vector & Embedding Weaknesses | 3 | Retrieval results interpolated into a prompt, unauthenticated vector upserts |
+| **LLM03** Supply Chain | 1 | MCP server pinned to `@latest` |
+| **LLM07** System Prompt Leakage | 1 | System prompt returned in an error response |
+| **LLM04** Data & Model Poisoning | — | Needs training-pipeline and dataset provenance, which is not in the source tree |
+| **LLM09** Misinformation | — | A model-output-quality property; nothing static to check |
+| **LLM10** Unbounded Consumption | — | Real and detectable in principle (no token ceiling, no rate limit on an inference route) — an honest gap, not a claim |
+
+The mapping is derived from each rule's own text rather than a hand-kept list of
+ids, so re-vendoring upstream cannot silently drop it, and it is deliberately
+conservative: a rule that does not clearly belong to a category gets none.
 
 Two honest points a reviewer would raise, answered up front:
 
@@ -218,7 +253,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.10.3
+      - uses: murtazaozdemir/cleartoship@v0.11.0
         with:
           fail-on: critical
           comment: true
@@ -240,7 +275,7 @@ above `fail-on`) for use in later steps. The comment is *sticky* — re-runs edi
 the same comment instead of piling up.
 
 By default the action runs the scanner version its own ref declares, so
-`@v0.10.3` runs `cleartoship@0.10.3` and pinning the ref pins the behaviour. If
+`@v0.11.0` runs `cleartoship@0.11.0` and pinning the ref pins the behaviour. If
 that version is not on the registry, it builds from its own checkout instead, so
 `uses: …@ref` works against an unpublished commit.
 
@@ -303,6 +338,12 @@ uploaded, and no database is connected to.
   call chained to it, and stand down when the values are bound. They still fire
   when any interpolation reads from the request, so a query that binds one value
   and concatenates another is reported.
+- **The scan stays inside the directory you pointed at.** A symlink that
+  resolves outside the scan root is not followed. It sounds academic until you
+  run this in CI on a pull request: `vendor-config -> /home/runner/.ssh` would
+  otherwise be read, and quoted, into a public comment. Symlink loops are walked
+  once rather than a dozen times, and the report says how many links were
+  refused.
 - **A match in a comment is prose about code, not code.** The scanner lexes each
   file once for strings and comments — properly, tracking quotes, so a URL
   inside a string is not mistaken for the start of one — and a community rule

package/SECURITY.md

@@ -22,7 +22,7 @@ supported one; older versions are not backported.
 | **Never writes to the scanned project** | The only writes in the codebase are the report file you ask for with `--output <path>` and the registry cache. Verify: `grep -rn "writeFileSync\|mkdirSync\|rmSync\|unlink" src/ --exclude-dir=vendor` — five lines, of which two are imports and three are those call sites. Neither path is derived from the scan root. |
 | **Never executes your code** | The scanner has no `child_process`, `exec`, `spawn`, `eval`, `new Function`, or dynamic `import()` of scanned files. Your code is read as text, parsed by Babel into an AST, and matched against regexes. Verify: `grep -rn "child_process\|execSync\|spawn\|eval(\|new Function" src/ --exclude-dir=vendor` — one hit, and it is a *pattern string* in the rule that detects those calls in **your** install hooks. (Drop `--exclude-dir=vendor` and the extra hits are rule text in the vendored ruleset, matched against your code, never run.) |
 | **Never connects to your database** | The Row Level Security scanner replays your `.sql` migration files to model the resulting schema. There is no database driver in the dependency tree and no connection string is ever read. |
-| **Reads only what it scans** | Files are gathered by walking the scan root, skipping `node_modules`, build output, virtualenvs and anything your own `.gitignore` excludes. Ignore rules are read from the scan root downwards only — never from a parent directory — so nothing outside the root is read except the cache directory. |
+| **Reads only what it scans** | Files are gathered by walking the scan root, skipping `node_modules`, build output, virtualenvs and anything your own `.gitignore` excludes. Ignore rules are read from the scan root downwards only — never from a parent directory. **A symlink that resolves outside the root is not followed**, so a repository cannot make the scanner read `~/.ssh` and quote it back into a report; the count of refused links appears in the output. Nothing outside the root is read except the cache directory. |
 
 ## What leaves your machine
 
@@ -65,6 +65,9 @@ are visible in the diff and cannot change under you between releases:
   categories no static scanner can reach.
 - **Not a sandbox.** It reads whatever you point it at. Pointing it at a
   repository you do not trust is as safe as opening that repository in an
-  editor — no more, and no less.
+  editor — no more, and no less. What it will not do is read *beyond* what you
+  pointed it at: symlinks out of the tree are refused, and a malformed pattern
+  in the repository's own `.gitignore` is skipped rather than allowed to end
+  the scan.
 - **Not a secret scanner of record.** Secrets already committed to git history
   are out of scope; ClearToShip reads the working tree, not past commits.

package/action.yml

@@ -29,7 +29,7 @@ inputs:
   version:
     description: >-
       Version of the cleartoship npm package to run. Defaults to the version this
-      action's own ref declares, so `uses: …@v0.10.3` runs cleartoship@0.10.3. Set
+      action's own ref declares, so `uses: …@v0.11.0` runs cleartoship@0.11.0. Set
       `latest` to always track the newest release, or `local` to build from the checkout.
     required: false
     default: ''
@@ -76,7 +76,7 @@ runs:
       run: |
         # With no version pinned, run the exact version this action's checkout
         # declares. That keeps the action ref and the scanner in lockstep:
-        # `uses: <owner>/cleartoship@v0.10.3` runs cleartoship@0.10.3 instead of
+        # `uses: <owner>/cleartoship@v0.11.0` runs cleartoship@0.11.0 instead of
         # whatever npm happens to tag `latest` at the time.
         ver="$INPUT_VERSION"
         if [ -z "$ver" ]; then

package/dist/report.js

@@ -118,6 +118,7 @@ export function renderJson(scan) {
         framework: scan.framework,
         fileCount: scan.fileCount,
         gitIgnoredCount: scan.gitIgnoredCount,
+        escapingSymlinkCount: scan.escapingSymlinkCount,
         durationMs: scan.durationMs,
         verdict: scan.counts.critical > 0 ? 'hold' : scan.counts.high > 0 ? 'conditional' : 'clear',
         counts: scan.counts,

package/dist/scan.d.ts

@@ -19,6 +19,8 @@ export interface FullScan {
     fileCount: number;
     /** Paths left unscanned because the repository's own ignore rules exclude them. */
     gitIgnoredCount: number;
+    /** Symlinks that pointed outside the scan root and were not followed. */
+    escapingSymlinkCount: number;
     findings: Finding[];
     checks: CheckSummary[];
     warnings: string[];

package/dist/scan.js

@@ -6,6 +6,7 @@ import { detectFramework } from './utils/detect.js';
 import { SCANNERS, communityScanner } from './scanners/index.js';
 import { GUARDVIBE_CVE_RULE_IDS } from './vendor/guardvibe/index.js';
 import { SEVERITY_ORDER } from './types.js';
+import { normaliseOwasp, llmCategory } from './utils/owasp.js';
 export async function scan(options) {
     const started = Date.now();
     const root = resolve(options.root);
@@ -13,6 +14,7 @@ export async function scan(options) {
     const walked = roots.map((r) => walk(r, { respectGitignore: !options.noGitignore }));
     const files = [...new Set(walked.flatMap((w) => w.files))];
     const gitIgnoredCount = walked.reduce((n, w) => n + w.gitIgnored, 0);
+    const escapingSymlinkCount = walked.reduce((n, w) => n + w.escapingSymlinks, 0);
     const framework = detectFramework(root, files);
     const ctx = {
         root,
@@ -58,6 +60,24 @@ export async function scan(options) {
         const floor = SEVERITY_ORDER[options.minSeverity];
         filtered = filtered.filter((f) => SEVERITY_ORDER[f.severity] >= floor);
     }
+    // One taxonomy on the way out, and a second label for the findings that are
+    // about an LLM or an agent rather than a web app. Both are applied here, so
+    // every scanner's output is consistent without each one having to know.
+    filtered = filtered.map((f) => {
+        const canonical = normaliseOwasp(f.owasp);
+        const llm = llmCategory(`${f.title} ${f.detail}`);
+        if (!canonical && !llm)
+            return f;
+        return {
+            ...f,
+            owasp: canonical ?? f.owasp,
+            meta: {
+                ...f.meta,
+                ...(canonical && canonical !== f.owasp ? { owaspUpstream: f.owasp } : {}),
+                ...(llm ? { llm } : {}),
+            },
+        };
+    });
     filtered.sort((a, b) => {
         const bySeverity = SEVERITY_ORDER[b.severity] - SEVERITY_ORDER[a.severity];
         if (bySeverity !== 0)
@@ -76,6 +96,14 @@ export async function scan(options) {
                 'checkout. Use --no-gitignore to scan them anyway.',
         });
     }
+    if (escapingSymlinkCount > 0) {
+        checks.push({
+            label: `Symlinks leaving the scan root not followed (${escapingSymlinkCount})`,
+            passed: true,
+            note: 'they point outside the directory you asked about, so their contents are not ' +
+                'this project and are never read or quoted in this report',
+        });
+    }
     const counts = { critical: 0, high: 0, medium: 0, low: 0, info: 0 };
     for (const f of filtered)
         counts[f.severity]++;
@@ -84,6 +112,7 @@ export async function scan(options) {
         framework: framework.describe(),
         fileCount: files.length,
         gitIgnoredCount,
+        escapingSymlinkCount,
         findings: filtered,
         checks,
         warnings,

package/dist/utils/files.d.ts

@@ -2,6 +2,8 @@ export interface WalkResult {
     files: string[];
     /** How many paths were left out because the repository ignores them. */
     gitIgnored: number;
+    /** How many symlinks pointed outside the scan root and were not followed. */
+    escapingSymlinks: number;
 }
 export declare function walk(root: string, options?: {
     respectGitignore?: boolean;

package/dist/utils/files.js

@@ -1,4 +1,4 @@
-import { readdirSync, statSync, readFileSync, existsSync } from 'node:fs';
+import { readdirSync, statSync, readFileSync, existsSync, realpathSync } from 'node:fs';
 import { join, relative, sep } from 'node:path';
 import { Gitignore, extendedAt, repositoryExcludes } from './gitignore.js';
 const SKIP_DIRS = new Set([
@@ -63,6 +63,25 @@ export function walk(root, options = {}) {
         ? extendedAt(repositoryExcludes(root, read), root, read)
         : Gitignore.empty();
     const stack = [{ dir: root, rules: rootRules }];
+    // A symlinked directory that points back into the tree — `self -> .`, or the
+    // A→B→A pair a workspace layout can produce — otherwise gets walked again on
+    // every pass, reporting the same file at a dozen different paths. Resolving
+    // each directory once and remembering it costs one syscall per directory.
+    const visited = new Set();
+    let escapingSymlinks = 0;
+    // A symlink that leaves the tree is not part of the project, and following one
+    // would be worse than useless: `vendor-config -> /home/runner/.ssh` makes the
+    // scanner read that directory and quote what it finds — into a pull-request
+    // comment, in the Action. So the scan stays inside what it was pointed at.
+    let rootReal;
+    try {
+        rootReal = realpathSync(root);
+    }
+    catch {
+        rootReal = root;
+    }
+    visited.add(rootReal);
+    const insideRoot = (real) => real === rootReal || real.startsWith(rootReal.endsWith('/') ? rootReal : rootReal + '/');
     while (stack.length) {
         const { dir, rules } = stack.pop();
         let entries;
@@ -81,9 +100,23 @@ export function walk(root, options = {}) {
             catch {
                 continue;
             }
+            let real;
+            try {
+                real = realpathSync(full);
+            }
+            catch {
+                continue;
+            }
+            if (!insideRoot(real)) {
+                escapingSymlinks++;
+                continue;
+            }
             if (st.isDirectory()) {
                 if (SKIP_DIRS.has(entry))
                     continue;
+                if (visited.has(real))
+                    continue;
+                visited.add(real);
                 // git never descends into an ignored directory, and neither do we —
                 // which is also where most of the saving comes from.
                 if (respect && rules.ignores(full, true)) {
@@ -113,7 +146,7 @@ export function walk(root, options = {}) {
             }
         }
     }
-    return { files: found.sort(), gitIgnored };
+    return { files: found.sort(), gitIgnored, escapingSymlinks };
 }
 export function read(file) {
     try {

package/dist/utils/owasp.d.ts

@@ -0,0 +1,48 @@
+/**
+ * One taxonomy out, whatever went in.
+ *
+ * ClearToShip's own rules label findings against the OWASP Top 10:2025. The
+ * vendored ruleset does not: measured across it, "Injection" arrives as both
+ * `A02:2025` and `A03:2025`, "Security Misconfiguration" as `A05:2025` and
+ * `A05:2021`, and a handful of rules carry API Top 10 categories instead. A
+ * user filtering a report by category, or reading the SARIF in a dashboard,
+ * would see three Injections and no way to total them.
+ *
+ * So the labels are normalised on the way out. The upstream string is kept in
+ * `meta.owaspUpstream` — this is a relabelling, not a correction of somebody
+ * else's judgement, and it should stay checkable.
+ */
+export declare const OWASP_2025: {
+    readonly A01: 'A01:2025 - Broken Access Control';
+    readonly A02: 'A02:2025 - Security Misconfiguration';
+    readonly A03: 'A03:2025 - Software Supply Chain Failures';
+    readonly A04: 'A04:2025 - Cryptographic Failures';
+    readonly A05: 'A05:2025 - Injection';
+    readonly A06: 'A06:2025 - Insecure Design';
+    readonly A07: 'A07:2025 - Authentication Failures';
+    readonly A08: 'A08:2025 - Software & Data Integrity Failures';
+    readonly A09: 'A09:2025 - Security Logging & Alerting Failures';
+    readonly A10: 'A10:2025 - Mishandling of Exceptional Conditions';
+};
+/**
+ * The canonical 2025 category for a rule's own label, or null when it belongs
+ * to a different standard. API Top 10 categories are left alone: they are
+ * accurate about a different list, and flattening them into the web Top 10
+ * would invent a mapping nobody published.
+ */
+export declare function normaliseOwasp(raw: string | undefined): string | null;
+/** OWASP Top 10 for LLM Applications (2025). */
+export declare const OWASP_LLM: {
+    readonly LLM01: 'LLM01:2025 - Prompt Injection';
+    readonly LLM02: 'LLM02:2025 - Sensitive Information Disclosure';
+    readonly LLM03: 'LLM03:2025 - Supply Chain';
+    readonly LLM04: 'LLM04:2025 - Data and Model Poisoning';
+    readonly LLM05: 'LLM05:2025 - Improper Output Handling';
+    readonly LLM06: 'LLM06:2025 - Excessive Agency';
+    readonly LLM07: 'LLM07:2025 - System Prompt Leakage';
+    readonly LLM08: 'LLM08:2025 - Vector and Embedding Weaknesses';
+    readonly LLM09: 'LLM09:2025 - Misinformation';
+    readonly LLM10: 'LLM10:2025 - Unbounded Consumption';
+};
+/** The LLM category a rule's own words place it in, if any. */
+export declare function llmCategory(text: string): string | null;

package/dist/utils/owasp.js

@@ -0,0 +1,132 @@
+/**
+ * One taxonomy out, whatever went in.
+ *
+ * ClearToShip's own rules label findings against the OWASP Top 10:2025. The
+ * vendored ruleset does not: measured across it, "Injection" arrives as both
+ * `A02:2025` and `A03:2025`, "Security Misconfiguration" as `A05:2025` and
+ * `A05:2021`, and a handful of rules carry API Top 10 categories instead. A
+ * user filtering a report by category, or reading the SARIF in a dashboard,
+ * would see three Injections and no way to total them.
+ *
+ * So the labels are normalised on the way out. The upstream string is kept in
+ * `meta.owaspUpstream` — this is a relabelling, not a correction of somebody
+ * else's judgement, and it should stay checkable.
+ */
+export const OWASP_2025 = {
+    A01: 'A01:2025 - Broken Access Control',
+    A02: 'A02:2025 - Security Misconfiguration',
+    A03: 'A03:2025 - Software Supply Chain Failures',
+    A04: 'A04:2025 - Cryptographic Failures',
+    A05: 'A05:2025 - Injection',
+    A06: 'A06:2025 - Insecure Design',
+    A07: 'A07:2025 - Authentication Failures',
+    A08: 'A08:2025 - Software & Data Integrity Failures',
+    A09: 'A09:2025 - Security Logging & Alerting Failures',
+    A10: 'A10:2025 - Mishandling of Exceptional Conditions',
+};
+/**
+ * Two of these are judgement calls, made once and written down rather than
+ * left to vary per rule: the 2025 list has no standalone SSRF category (it sits
+ * under Broken Access Control) and no standalone Vulnerable Components category
+ * (it sits under Software Supply Chain Failures).
+ */
+const NORMALISE = [
+    [/broken access control|object level authorization|object property level|function level auth/i, OWASP_2025.A01],
+    [/server-?side request forgery|\bssrf\b/i, OWASP_2025.A01],
+    [/security misconfiguration/i, OWASP_2025.A02],
+    [/supply chain|vulnerable (and outdated )?components/i, OWASP_2025.A03],
+    [/cryptographic failures|sensitive data exposure/i, OWASP_2025.A04],
+    [/injection|cross-?site scripting|\bxss\b/i, OWASP_2025.A05],
+    [/insecure design/i, OWASP_2025.A06],
+    [/auth(entication)? failures|identification and auth|broken auth/i, OWASP_2025.A07],
+    [/data integrity failures/i, OWASP_2025.A08],
+    [/logging|monitoring|alerting/i, OWASP_2025.A09],
+    [/mishandling|exceptional conditions/i, OWASP_2025.A10],
+];
+/**
+ * The canonical 2025 category for a rule's own label, or null when it belongs
+ * to a different standard. API Top 10 categories are left alone: they are
+ * accurate about a different list, and flattening them into the web Top 10
+ * would invent a mapping nobody published.
+ */
+export function normaliseOwasp(raw) {
+    if (!raw)
+        return null;
+    // The API Security Top 10 is a different list with its own numbering, and a
+    // few rules cite it — sometimes without the `API` prefix, as `A04:2023`.
+    // Anything from the 2023 list is left as it is rather than flattened into a
+    // web category nobody published a mapping for.
+    if (/^API\d/i.test(raw.trim()) || /:2023\b/.test(raw))
+        return null;
+    for (const [pattern, canonical] of NORMALISE) {
+        if (pattern.test(raw))
+            return canonical;
+    }
+    return null;
+}
+/** OWASP Top 10 for LLM Applications (2025). */
+export const OWASP_LLM = {
+    LLM01: 'LLM01:2025 - Prompt Injection',
+    LLM02: 'LLM02:2025 - Sensitive Information Disclosure',
+    LLM03: 'LLM03:2025 - Supply Chain',
+    LLM04: 'LLM04:2025 - Data and Model Poisoning',
+    LLM05: 'LLM05:2025 - Improper Output Handling',
+    LLM06: 'LLM06:2025 - Excessive Agency',
+    LLM07: 'LLM07:2025 - System Prompt Leakage',
+    LLM08: 'LLM08:2025 - Vector and Embedding Weaknesses',
+    LLM09: 'LLM09:2025 - Misinformation',
+    LLM10: 'LLM10:2025 - Unbounded Consumption',
+};
+/**
+ * A second, independent label for the findings that are about an LLM or agent
+ * rather than a web app. Matched on the rule's own words, not on a hand-kept
+ * list of ids, so re-vendoring the upstream ruleset does not silently drop the
+ * mapping. Deliberately conservative: a rule that does not clearly belong to a
+ * category gets none, because a wrong category is worse than no category.
+ */
+const LLM_RULES = [
+    // Ordered deliberately: "LLM output used in a dangerous sink" is about
+    // handling the output, even though its description discusses injection.
+    [
+        /(llm|ai|model) output[^.]{0,60}(unescaped|innerhtml|dangerouslysetinnerhtml|render|eval|exec|sink|shell|command|markdown)|(unescaped|unsanitised|unsanitized)[^.]{0,30}(llm|ai|model) output/i,
+        OWASP_LLM.LLM05,
+    ],
+    [
+        /prompt injection|injected instruction|hidden instruction|jailbreak|(tool|skill) (description|definition)[^.]{0,40}(instruction|encoded|obfuscat|inject)|untrusted content into (the )?prompt/i,
+        OWASP_LLM.LLM01,
+    ],
+    [/system prompt[^.]{0,40}(leak|expos|client|bundle|browser)/i, OWASP_LLM.LLM07],
+    [
+        // A hardcoded provider key is disclosure wherever it sits, so no exposure
+        // word is required after a *named* provider. The generic "llm"/"ai" wording
+        // still needs one, or every mention of an AI feature would qualify.
+        /(openai|anthropic|gemini|claude|mistral|cohere|huggingface|replicate|groq|perplexity|xai|pinecone)[^.]{0,40}(api[ _-]?key|token|secret)|(llm|\bai\b)[^.]{0,40}(api[ _-]?key|token|secret)[^.]{0,40}(expos|public|client|browser|bundle)|base_?url[^.]{0,40}(non-|redirect)|dangerouslyallowbrowser/i,
+        OWASP_LLM.LLM02,
+    ],
+    [/(mcp|model|agent)[^.]{0,40}(@latest|unpinned|unverified|untrusted (source|registry))/i, OWASP_LLM.LLM03],
+    [
+        // "Hook" is overloaded: an npm `postinstall` hook that shells out is a
+        // supply-chain finding, not an agent given too much authority. The AI
+        // context has to be in the text.
+        /auto[- ]?approve|allowedtools|excessive agency|(mcp|agent|assistant|settings|claude|ai)[- ]?(config|hook|tool)[^.]{0,60}(execut|pipes|network|write|permissive|broad|access)|permission prompt[^.]{0,40}(bypass|skip)|overly (broad|permissive)[^.]{0,30}tool/i,
+        OWASP_LLM.LLM06,
+    ],
+    // "Embedding media" is not a vector embedding — matching the bare word put a
+    // TinyMCE XSS rule in this category.
+    [
+        /vector (store|database|db|index|search)\b|\bembeddings\b|embedding (vector|model|store)|\brag\b[^.]{0,30}(poison|inject)/i,
+        OWASP_LLM.LLM08,
+    ],
+    [
+        /(llm|ai|model|token)[^.]{0,40}(unbounded|no (rate|token) limit|runaway|budget)|unbounded consumption/i,
+        OWASP_LLM.LLM10,
+    ],
+];
+/** The LLM category a rule's own words place it in, if any. */
+export function llmCategory(text) {
+    for (const [pattern, category] of LLM_RULES) {
+        if (pattern.test(text))
+            return category;
+    }
+    return null;
+}

package/examples/security.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.10.3
+      - uses: murtazaozdemir/cleartoship@v0.11.0
         with:
           fail-on: critical   # block the PR only on criticals
           comment: true        # post a summary comment on the PR

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "cleartoship",
-  "version": "0.10.3",
+  "version": "0.11.0",
   "description": "The 30-second pre-launch security clearance for AI-built & vibe-coded apps. Catches missing Server Action auth, Supabase RLS holes, hallucinated npm packages and leaked keys.",
   "keywords": [
     "security",