cleartoship 0.12.2 → 0.13.0

package/README.md

@@ -1,19 +1,37 @@
 # ClearToShip
 
-> The 30-second pre-launch security clearance for AI-built & vibe-coded apps.
+> The 30-second pre-launch security clearance for AI-built apps — including the agent
+> surface a runtime scanner cannot reach until after you have already deployed it.
 
 AI coding assistants write code fast, but they optimise for *"runs without errors"*, not
 *"runs without leaks"*. The failure mode is almost never a dangerous line of code — it's an
 **absent** one: the session check that was never written, the RLS policy that was never
-enabled, the package name the model invented.
+enabled, the package name the model invented, the approval step the agent tool never had.
 
 `cleartoship` is a static pre-flight check for exactly those gaps. No database connection, no
 account, no upload — it reads your repo and exits non-zero if you shouldn't deploy.
 
+### Where this is not like the other scanners
+
+The serious LLM security tools are **runtime**: they probe a deployed endpoint and report how
+it answered. That is a real and different job, and this does not compete with it. What none of
+them does is read your *source*, before it ships, and tell you that the system prompt is
+compiled into the client bundle, that the model call has no token ceiling, that the agent tool
+which deletes rows has nothing asking a person first, or that an answer is being used as the
+access check.
+
+Six first-party rules read that surface directly, mapped to the **2026** OWASP LLM Top 10 —
+and the coverage table below names the one category this refuses to fake. Everything else here
+is the ordinary web surface, which is table stakes: you still ship on the same day that a
+missing RLS policy would have leaked the table.
+
 ```bash
 npx cleartoship
 ```
 
+**Free while in beta** — no account, no key, no tier. It runs on your machine and
+reports to your terminal.
+
 ## What it checks
 
 **Next.js server surface** — Server Actions, Route Handlers, client boundary
@@ -86,6 +104,9 @@ reaches a manifest.
 | **CTS080** | high | Caller-supplied text interpolated into the instruction text itself — prompt injection by construction, not by filter (LLM01) |
 | **CTS081** | medium | A request-reachable model call with no `max_tokens` ceiling: the answer's length, and its bill, chosen by whoever wrote the input (LLM06) |
 | **CTS082** | medium | A system prompt in a `'use client'` module — compiled into the bundle, readable in devtools (LLM08) |
+| **CTS083** | high | An agent tool the model may call on its own whose body **cannot be taken back** — deletes rows, moves money, sends mail, runs a shell — with nothing asking a person first (LLM03) |
+| **CTS084** | critical/high | The model's own answer traced into a sink that *runs* it: `eval`, `new Function`, a shell, raw SQL, `innerHTML`, `dangerouslySetInnerHTML` (LLM10) |
+| **CTS085** | high | A branch or a check that turns on what the model returned — the guess decides access (LLM07) |
 
 **Logging, error-handling & deserialization** — the detectable slices of A08/A09/A10
 
@@ -144,7 +165,7 @@ it is strongest exactly where AI-generated code fails. Coverage by category:
 
 Counts, measured across the vendored ruleset after normalisation: A01 121,
 A05 112, A04 78, A02 59, A03 32, A07 17, A06 13, A08 11, A09 2. ClearToShip's
-own 45 rules add A01 19, A03 9, A04 7, A08 3, A05 2, and one each for A07, A09
+own 48 rules add A01 21, A03 9, A04 7, A08 3, A05 3, and one each for A07, A09
 and A10 — which is the category no vendored rule reaches.
 
 ## OWASP Top 10 for LLM Applications (2026) — coverage
@@ -160,24 +181,31 @@ broadened into **Hidden Context Exposure**.
 | --- | --- | --- |
 | **LLM01** Prompt Injection | 12 + **CTS080** | Caller text interpolated into the instruction text itself; fetched pages and query results reaching a prompt unbounded; instructions hidden in a tool description |
 | **LLM02** Sensitive Information Disclosure | 11 (+ CTS030, CTS045) | Provider keys in client code or a `NEXT_PUBLIC_` variable, `dangerouslyAllowBrowser`, a base URL pointed at somebody else's endpoint |
-| **LLM03** Excessive Agency | 9 | MCP servers with permissive tool access, `allowedTools` wildcards, auto-approve bypassing the permission prompt, settings hooks that fetch or pipe |
+| **LLM03** Excessive Agency | 9 + **CTS083** | MCP servers with permissive tool access, `allowedTools` wildcards, auto-approve bypassing the permission prompt, settings hooks that fetch or pipe; and a tool handed to a model whose body takes an action nobody can undo, with no approval step in it |
 | **LLM04** Supply Chain | 1 | MCP server pinned to `@latest` |
 | **LLM06** Unbounded Consumption | **CTS081** | A request-reachable model call with no `max_tokens` ceiling — the answer's length, and its cost, decided by whoever wrote the input |
+| **LLM07** Misinformation | **CTS085** | Whether an answer is *true* is not a property of the source. What is in the source is the answer being **believed**: a branch, or a function that reads as a check, turning on what the model returned |
 | **LLM08** Hidden Context Exposure | 1 + **CTS082** | A system prompt held in a `'use client'` module, so it ships in the bundle; a prompt returned in an error response |
 | **LLM09** Vector & Embedding Weaknesses | 3 | Retrieval results interpolated into a prompt, unauthenticated vector upserts |
-| **LLM10** Improper Output Handling | 4 | Model output rendered as raw HTML or markdown images, or used in a dangerous sink |
+| **LLM10** Improper Output Handling | 4 + **CTS084** | Model output rendered as raw HTML or markdown images, or used in a dangerous sink — and, first-party, the answer followed from the call that produced it into `eval`, `new Function`, a shell, raw SQL or the DOM |
 | **LLM05** Data & Model Poisoning | — | Needs training-pipeline and dataset provenance. Nothing in a web app's source tree answers it, and a rule that pretended otherwise would be box-checking |
-| **LLM07** Misinformation | — | A property of what the model says, not of the code that calls it. The adjacent detectable case — model output driving a security decision — would be a real rule, and is not written yet |
 
 The mapping is derived from each rule's own text rather than a hand-kept list of
 ids, so re-vendoring upstream cannot silently drop it, and it is deliberately
 conservative: a rule that does not clearly belong to a category gets none.
 
-**Eight of ten have first-party or vendored detection. Two do not, and will not
-get a rule for the sake of the table** — LLM05 needs artefacts that are not in
-the repository, and LLM07 is about the truthfulness of an answer. A tool that
-claimed those would be lying about what it checked, which is the failure mode
-this project exists to avoid.
+**Nine of ten have first-party or vendored detection. One does not, and will not
+get a rule for the sake of the table** — LLM05 needs training-pipeline and dataset
+provenance, and nothing in a web app's source tree answers it. A tool that claimed
+it would be lying about what it checked, which is the failure mode this project
+exists to avoid.
+
+LLM07 left that group in 0.13.0, and it is worth being exact about how. Nothing here
+judges whether an answer is true; that is still not a property of the source. What
+the source does show is the answer being *trusted* — `if (verdict === 'safe')`, or a
+function named like a check handing back whatever the model said. That is the
+detectable half, it was named as missing in this table for two releases, and it is
+now CTS085.
 
 ## Usage
 
@@ -251,7 +279,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.12.2
+      - uses: murtazaozdemir/cleartoship@v0.13.0
         with:
           fail-on: critical
           comment: true
@@ -273,7 +301,7 @@ above `fail-on`) for use in later steps. The comment is *sticky* — re-runs edi
 the same comment instead of piling up.
 
 By default the action runs the scanner version its own ref declares, so
-`@v0.12.2` runs `cleartoship@0.12.2` and pinning the ref pins the behaviour. If
+`@v0.13.0` runs `cleartoship@0.13.0` and pinning the ref pins the behaviour. If
 that version is not on the registry, it builds from its own checkout instead, so
 `uses: …@ref` works against an unpublished commit.
 
@@ -378,6 +406,27 @@ uploaded, and no database is connected to.
   aliases) and credits a call whose helper authenticates, directly or through
   another helper. Third-party packages are never followed, so a call into
   `node_modules` still proves nothing on its own.
+- **A rule about model output has to prove the output came from a model.**
+  `dangerouslySetInnerHTML` is everywhere — theme scripts, chart CSS, sanitized
+  markdown — and reporting all of it would be a regex, not a finding. CTS084 and
+  CTS085 first collect every binding in the file that holds what a model
+  returned, following it through the shapes the SDKs actually produce
+  (`const { text } = await generateText(...)`, `message.content[0].text`,
+  `completion.choices[0].message.content`) and one hop onward, then ask whether
+  *that* value reaches the sink. Across five dogfooded repos the rules fired
+  zero times; on a probe corpus written to break them, `SLUG.exec(slug)` and
+  `seen.delete(key)` on a `Map` stayed silent while a Supabase delete, a Drizzle
+  delete and a two-hop Anthropic answer reaching `execSync` all fired.
+- **An approval gate is code, not a description.** CTS083 stands down when
+  something in the tool puts a person in front of the effect — a confirmation, a
+  permission check, `needsApproval: true`. That test reads identifiers and
+  property keys only, never string values: a tool whose `description` says
+  "review this before approving" has written prose, and prose must not be able
+  to talk the rule out of firing.
+- **Writing a row is not excessive agency.** An agent that inserts and updates is
+  the ordinary case, and reporting it would bury CTS083 in its own output. What
+  it reports is the subset a wrong answer cannot be undone from: rows deleted,
+  money moved, mail sent to somebody, a shell command, a file removed.
 - **A machine endpoint authenticates differently.** Comparing an `Authorization`
   header against a server-side secret is the auth check for a cron or
   webhook route, and a verified provider signature *is* the caller's identity —

package/SECURITY.md

@@ -17,6 +17,21 @@ supported one; older versions are not backported.
 
 ## What it does to your project
 
+**You do not need access to the source repository to check any of this.** The
+published package contains the code that actually runs:
+
+```bash
+npm pack cleartoship && tar xzf cleartoship-*.tgz   # gives you package/dist
+```
+
+The greps in the table below are written against `src/`. Run the same greps
+against `package/dist` and they answer the same question — every hit that comes
+back is a comment, a regex pattern string or the text of a rule that is *matched
+against your code*, never a call site. That is worth checking rather than
+believing: a scanner that looks for `eval` necessarily contains the word `eval`,
+and the difference between naming a dangerous call and making one is the whole
+claim.
+
 | Guarantee | Why it holds |
 | --- | --- |
 | **Never writes to the scanned project** | The only writes in the codebase are the report file you ask for with `--output <path>` and the registry cache. Verify: `grep -rn "writeFileSync\|mkdirSync\|rmSync\|unlink" src/ --exclude-dir=vendor` — five lines, of which two are imports and three are those call sites. Neither path is derived from the scan root. |

package/action.yml

@@ -29,7 +29,7 @@ inputs:
   version:
     description: >-
       Version of the cleartoship npm package to run. Defaults to the version this
-      action's own ref declares, so `uses: …@v0.12.2` runs cleartoship@0.12.2. Set
+      action's own ref declares, so `uses: …@v0.13.0` runs cleartoship@0.13.0. Set
       `latest` to always track the newest release, or `local` to build from the checkout.
     required: false
     default: ''
@@ -76,7 +76,7 @@ runs:
       run: |
         # With no version pinned, run the exact version this action's checkout
         # declares. That keeps the action ref and the scanner in lockstep:
-        # `uses: <owner>/cleartoship@v0.12.2` runs cleartoship@0.12.2 instead of
+        # `uses: <owner>/cleartoship@v0.13.0` runs cleartoship@0.13.0 instead of
         # whatever npm happens to tag `latest` at the time.
         ver="$INPUT_VERSION"
         if [ -z "$ver" ]; then

package/dist/banner.js

@@ -8,7 +8,7 @@ const ART = String.raw `
 export function banner(version) {
     return (pc.cyan(ART) +
         '\n  ' +
-        pc.dim('Pre-flight security check for AI-built & vibe-coded apps') +
+        pc.dim('Pre-flight security check for AI-built apps, agents included') +
         pc.dim(` • v${version}`) +
         '\n');
 }

package/dist/scanners/community.js

@@ -259,6 +259,11 @@ const MATCH_GUARDS = {
     // `expiresIn` stops at the first `)`, which here belongs to `getJwtSecret()`.
     // Read the whole call before saying the option is absent.
     VG061: (_match, source, index) => !/\b(expiresIn|exp\s*:|setExpirationTime)\b/.test(source.slice(index, index + 300)),
+    // `console.log("[App] Got idToken, running audit...")` is a progress message,
+    // not a logged credential: "idToken," satisfies the rule's `token` + delimiter
+    // because both sit inside the string. What matters is whether the *value* is
+    // being logged, and CTS070 checks that against the AST.
+    VG080: (match, source, index, spans) => !isInside(spans, index + match.length - 1, 'string'),
     // The "sink" half of the upload rule matched the word *upload* inside a
     // sentence — "Please upload a CSV file exported from Shopify". A filename
     // reaching a string is not a filename reaching a filesystem.

package/dist/scanners/logic.js

@@ -12,8 +12,11 @@ import { OWASP_LLM } from '../utils/owasp.js';
  *   A10 (Exceptional Conditions)— fail-open / swallowed errors on a security path
  *   A08 (Integrity Failures)    — insecure deserialization of untrusted data
  *   LLM01 (Prompt Injection)    — request data concatenated into prompt text
- *   LLM07 (System Prompt Leak)  — a system prompt shipped to the browser
- *   LLM10 (Unbounded Consumption) — a model call with no ceiling on what it spends
+ *   LLM03 (Excessive Agency)    — an agent tool that acts irreversibly, ungated
+ *   LLM06 (Unbounded Consumption) — a model call with no ceiling on what it spends
+ *   LLM07 (Misinformation)      — a security decision made from the model's answer
+ *   LLM08 (Hidden Context)      — a system prompt shipped to the browser
+ *   LLM10 (Improper Output Handling) — model output executed or rendered as HTML
  *
  * Each rule is deliberately narrow: the goal is a true positive a developer will
  * act on, not coverage for its own sake.
@@ -87,6 +90,289 @@ function isPermissiveReturn(node) {
     }
     return false;
 }
+/**
+ * The shape of a tool a model is allowed to invoke on its own: a description, an
+ * argument schema, and a body that does the work. Vercel's `tool({...})`, an
+ * OpenAI function definition and MCP's `registerTool` all reduce to it.
+ */
+const TOOL_BODY_KEY = /^(execute|handler|run|fn|func|callback)$/;
+const TOOL_SHAPE_KEY = /^(description|parameters|inputSchema|input_schema|schema|args)$/;
+const TOOL_REGISTER = /^(registerTool|addTool|setRequestHandler|tool)$/;
+/**
+ * Actions an agent cannot take back. Ordinary inserts and updates are left out
+ * deliberately — an agent that writes a row is the normal case, and reporting
+ * every one of those would bury the rule. What is reported is the subset that a
+ * wrong answer cannot be undone from: data deleted, money moved, a message sent
+ * to somebody, a shell command, a file removed.
+ */
+const IRREVERSIBLE = [
+    [
+        /^(db|prisma|supabase|sql|knex|drizzle|conn|pool|client|collection|table|model|repo|repository)[\w.]*\.(delete|deleteMany|deleteOne|destroy|drop|truncate)$/i,
+        'deletes rows',
+    ],
+    [/(^|\.)\$(execute|query)Raw(Unsafe)?$/, 'executes raw SQL'],
+    [/(^|\.)(rmSync|rmdir|rmdirSync|unlink|unlinkSync|rimraf)$|(^|\.)fs\.rm$|^rm$/, 'removes files'],
+    // Bare `exec` is the child_process import; `re.exec(s)` is a regex match and
+    // must not read as a shell. So a member call has to name the module.
+    [
+        /^(exec|execSync|execFile|execFileSync|spawn|spawnSync)$|^(child_process|cp|shell)\.(exec|execSync|execFile|spawn|spawnSync)$/,
+        'runs a shell command',
+    ],
+    [/(refunds|charges|paymentIntents|transfers|payouts|invoices|subscriptions)\.(create|cancel|update|del)$/i, 'moves money'],
+    [
+        /(resend|sendgrid|nodemailer|transporter|mailer|postmark|ses|emails)[\w.]*\.(send|sendMail|sendEmail)$/i,
+        'sends email',
+    ],
+];
+/**
+ * Anything that puts a person between the model's decision and the effect —
+ * a confirmation step, a permission check, a dry run. Its presence is taken as
+ * the gate; judging whether the gate is *correct* is not something a static
+ * read can do, and claiming otherwise would be the kind of coverage theatre
+ * this project avoids.
+ *
+ * Matched against identifiers and property keys only, never string values. A
+ * tool whose `description` says "review this before approving" has written
+ * prose, not a gate, and must not be able to talk the rule out of firing.
+ */
+const APPROVAL_GATE = /(confirm|approv|consent|agree|acknowledg|human|operator|reviewer|dry[_-]?run|checkpermission|haspermission|require(admin|user|owner|human)|assertowner|authoriz|authoris|verifyowner|pending)/i;
+/** Sinks where a model's answer stops being text and starts being behaviour. */
+const OUTPUT_SINKS = [
+    [/^eval$/, 'evaluated as code', 'critical'],
+    [
+        /^(exec|execSync|execFile|execFileSync|spawn|spawnSync)$|^(child_process|cp|shell)\.(exec|execSync|execFile|spawn|spawnSync)$/,
+        'run as a shell command',
+        'critical',
+    ],
+    [/(^|\.)\$(execute|query)RawUnsafe$/, 'concatenated into raw SQL', 'critical'],
+];
+/** Answers a model is asked to give when it is being used as a guard. */
+const DECISION_WORD = /^(yes|no|true|false|allow|allowed|deny|denied|safe|unsafe|approved|rejected|authorized|authorised|admin|ok|okay|pass|fail|valid|invalid|clean|abusive|spam)$/i;
+/** Properties that hold the text a model returned, across the SDKs. */
+const MODEL_TEXT_PROP = /^(text|content|output_text|outputText|message|choices|candidates|completion)$/;
+/**
+ * Did this expression come out of a model call — directly, or through a binding
+ * that did? Walks the spine of the expression rather than the whole subtree, so
+ * `answer.trim()` counts and `{ answer }.other` does not.
+ */
+function fromModel(node, bindings) {
+    let cur = node;
+    let guard = 0;
+    while (cur && guard++ < 24) {
+        switch (cur.type) {
+            case 'AwaitExpression':
+                cur = cur.argument;
+                continue;
+            case 'TSNonNullExpression':
+            case 'TSAsExpression':
+            case 'ParenthesizedExpression':
+                cur = cur.expression;
+                continue;
+            case 'MemberExpression':
+            case 'OptionalMemberExpression':
+                cur = cur.object;
+                continue;
+            case 'CallExpression':
+            case 'OptionalCallExpression':
+                if (matchesModelCall(calleeName(cur.callee)))
+                    return true;
+                cur = cur.callee;
+                continue;
+            case 'Identifier':
+                return bindings.has(cur.name);
+            default:
+                return false;
+        }
+    }
+    return false;
+}
+/**
+ * Every binding in the file that holds what a model returned. Two passes, so
+ * `const res = await generateText(...)` on one line and `const answer = res.text`
+ * on the next both count — which is how every one of these SDKs reads in
+ * practice.
+ */
+function collectModelBindings(ast) {
+    const bindings = new Set();
+    const record = (id) => {
+        if (id?.type === 'Identifier')
+            bindings.add(id.name);
+        else if (id?.type === 'ObjectPattern') {
+            // `const { text } = await generateText(...)` — the whole destructured
+            // result came from the model, so every name it binds did too.
+            for (const p of id.properties ?? []) {
+                const value = p?.value ?? p?.argument;
+                if (value?.type === 'Identifier')
+                    bindings.add(value.name);
+            }
+        }
+    };
+    for (let pass = 0; pass < 2; pass++) {
+        traverse(ast, {
+            VariableDeclarator(path) {
+                if (path.node.init && fromModel(path.node.init, bindings))
+                    record(path.node.id);
+            },
+            AssignmentExpression(path) {
+                const { left, right } = path.node;
+                if (left?.type === 'Identifier' && fromModel(right, bindings))
+                    bindings.add(left.name);
+            },
+        });
+    }
+    return bindings;
+}
+/** The first model-derived identifier anywhere inside a subtree, if there is one. */
+function referencesModel(node, bindings) {
+    let found = null;
+    const seen = new Set();
+    const walk = (n, depth) => {
+        if (found || !n || typeof n !== 'object' || depth > 14 || seen.has(n))
+            return;
+        seen.add(n);
+        if (Array.isArray(n)) {
+            for (const child of n)
+                walk(child, depth + 1);
+            return;
+        }
+        if (typeof n.type !== 'string')
+            return;
+        if (n.type === 'Identifier' && bindings.has(n.name)) {
+            found = n.name;
+            return;
+        }
+        for (const key of Object.keys(n)) {
+            if (key === 'loc' || key === 'start' || key === 'end' || key === 'range' || key === 'extra')
+                continue;
+            if (key === 'leadingComments' || key === 'trailingComments' || key === 'comments')
+                continue;
+            walk(n[key], depth + 1);
+        }
+    };
+    walk(node, 0);
+    return found;
+}
+/** True when any string literal in the subtree reads as a verdict. */
+function hasDecisionLiteral(node) {
+    let found = false;
+    const walk = (n, depth) => {
+        if (found || !n || typeof n !== 'object' || depth > 10)
+            return;
+        if (Array.isArray(n)) {
+            for (const child of n)
+                walk(child, depth + 1);
+            return;
+        }
+        if (n.type === 'StringLiteral' && DECISION_WORD.test(String(n.value).trim())) {
+            found = true;
+            return;
+        }
+        for (const key of Object.keys(n)) {
+            if (key === 'loc' || key === 'start' || key === 'end' || key === 'range' || key === 'extra')
+                continue;
+            walk(n[key], depth + 1);
+        }
+    };
+    walk(node, 0);
+    return found;
+}
+/** Name of the nearest enclosing function, for judging what a block guards. */
+function enclosingFunctionName(path) {
+    let name = '';
+    let p = path.parentPath;
+    let hops = 0;
+    while (p && hops++ < 10) {
+        const n = p.node;
+        if (n?.type === 'FunctionDeclaration' || n?.type === 'FunctionExpression') {
+            name = n.id?.name ?? name;
+            if (name)
+                break;
+        }
+        if (n?.type === 'VariableDeclarator' && n.id?.type === 'Identifier') {
+            name = n.id.name;
+            break;
+        }
+        if (n?.type === 'ObjectProperty' && n.key) {
+            name = (n.key.name ?? n.key.value ?? '');
+            if (name)
+                break;
+        }
+        p = p.parentPath;
+    }
+    return name;
+}
+/** Does this function body take an action that cannot be undone? */
+function irreversibleAction(body) {
+    let hit = null;
+    const seen = new Set();
+    const walk = (n, depth) => {
+        if (hit || !n || typeof n !== 'object' || depth > 18 || seen.has(n))
+            return;
+        seen.add(n);
+        if (Array.isArray(n)) {
+            for (const child of n)
+                walk(child, depth + 1);
+            return;
+        }
+        if (typeof n.type !== 'string')
+            return;
+        if (n.type === 'CallExpression' || n.type === 'OptionalCallExpression') {
+            const full = calleeName(n.callee);
+            for (const [pattern, kind] of IRREVERSIBLE) {
+                if (pattern.test(full)) {
+                    hit = { name: full, kind, line: n.loc?.start.line ?? 0 };
+                    return;
+                }
+            }
+        }
+        for (const key of Object.keys(n)) {
+            if (key === 'loc' || key === 'start' || key === 'end' || key === 'range' || key === 'extra')
+                continue;
+            if (key === 'leadingComments' || key === 'trailingComments' || key === 'comments')
+                continue;
+            walk(n[key], depth + 1);
+        }
+    };
+    walk(body, 0);
+    return hit;
+}
+/** Is there anything here that puts a person in front of the effect? */
+function hasApprovalGate(scope) {
+    let found = false;
+    const seen = new Set();
+    const walk = (n, depth) => {
+        if (found || !n || typeof n !== 'object' || depth > 20 || seen.has(n))
+            return;
+        seen.add(n);
+        if (Array.isArray(n)) {
+            for (const child of n)
+                walk(child, depth + 1);
+            return;
+        }
+        if (typeof n.type !== 'string')
+            return;
+        if (n.type === 'Identifier' && APPROVAL_GATE.test(n.name)) {
+            found = true;
+            return;
+        }
+        if ((n.type === 'ObjectProperty' || n.type === 'ObjectMethod') && n.key) {
+            const key = n.key.name ?? n.key.value;
+            if (typeof key === 'string' && APPROVAL_GATE.test(key)) {
+                found = true;
+                return;
+            }
+        }
+        for (const key of Object.keys(n)) {
+            if (key === 'loc' || key === 'start' || key === 'end' || key === 'range' || key === 'extra')
+                continue;
+            if (key === 'leadingComments' || key === 'trailingComments' || key === 'comments')
+                continue;
+            walk(n[key], depth + 1);
+        }
+    };
+    walk(scope, 0);
+    return found;
+}
 export const logicScanner = {
     name: 'Logging, exception-handling & deserialization',
     applies(ctx) {
@@ -144,6 +430,65 @@ export const logicScanner = {
             if (!ast)
                 continue;
             analysed++;
+            // Every binding in this file that holds what a model returned. Collected
+            // once, up front, so the three rules below can ask the only question that
+            // makes them precise: did this value come out of a model at all?
+            const modelBindings = collectModelBindings(ast);
+            const reportedAgency = new Set();
+            const reportedDecision = new Set();
+            const reportExcessiveAgency = (scope, body, name, fallback) => {
+                const action = irreversibleAction(body);
+                if (!action)
+                    return;
+                if (hasApprovalGate(scope))
+                    return;
+                const line = action.line || fallback;
+                if (reportedAgency.has(line))
+                    return;
+                reportedAgency.add(line);
+                push({
+                    id: 'CTS083',
+                    severity: 'high',
+                    title: 'Agent tool takes an action that cannot be taken back',
+                    detail: `\`${name}\` is handed to a model as a tool it may call on its own, and the body ` +
+                        `${action.kind} (\`${action.name}\`). Nothing in it asks a person first, so the decision ` +
+                        'to run it belongs to the model — made from whatever text happened to reach the context ' +
+                        'window. A support ticket, a fetched page or a retrieved document that says "delete the ' +
+                        'old records" is then not a description of an action, it is the action.',
+                    fix: 'Put a person in front of the half that cannot be undone: have the tool return a proposed ' +
+                        'action for confirmation rather than performing it, or gate the call behind an explicit ' +
+                        'approval step. Where that is impractical, narrow the tool instead — scope it to the ' +
+                        "caller's own rows, cap how much one call can affect, and make the effect recoverable " +
+                        '(soft-delete, refundable, queued) so a wrong answer is survivable.',
+                    line,
+                    cwe: 'CWE-250: Execution with Unnecessary Privileges',
+                    owasp: 'A01:2025 - Broken Access Control',
+                    meta: { llm: OWASP_LLM.LLM03, tool: name, action: action.name, effect: action.kind },
+                });
+            };
+            const reportModelDecision = (binding, line, lead) => {
+                if (reportedDecision.has(line))
+                    return;
+                reportedDecision.add(line);
+                push({
+                    id: 'CTS085',
+                    severity: 'high',
+                    title: "A security decision is made from the model's answer",
+                    detail: `${lead}, which holds what the model returned. A model's answer ` +
+                        'is a probabilistic guess about text, not a fact about your system: it can be wrong on ' +
+                        'ordinary input, and it can be *made* wrong by anyone whose text reached the prompt. ' +
+                        'Using it as the gate means the guess decides access — and the caller who wrote the ' +
+                        'input is the one steering the guess.',
+                    fix: 'Decide in code. Let the model classify, summarise or suggest, then enforce the rule ' +
+                        'against something you control — a row you own, a permission lookup, a signed claim. If ' +
+                        'a model result must influence the outcome, make it fail closed and treat it as one ' +
+                        'signal beside a real check, never as the check itself.',
+                    line,
+                    cwe: 'CWE-807: Reliance on Untrusted Inputs in a Security Decision',
+                    owasp: 'A01:2025 - Broken Access Control',
+                    meta: { llm: OWASP_LLM.LLM07, source: binding },
+                });
+            };
             // A module marked 'use client' is compiled into the browser bundle, so
             // anything it holds is readable by anyone who opens devtools.
             const clientModule = /^\s*(['"])use client\1/m.test(source.slice(0, 400));
@@ -269,6 +614,48 @@ export const logicScanner = {
                             }
                         }
                     }
+                    // --- LLM03: a registered tool whose body cannot be taken back ---
+                    // MCP and the SDK registries pass the handler as its own argument,
+                    // so the tool-shaped object literal below never sees it.
+                    if (TOOL_REGISTER.test(tail)) {
+                        const handler = (node.arguments ?? []).find((a) => a?.type === 'ArrowFunctionExpression' || a?.type === 'FunctionExpression');
+                        if (handler) {
+                            const named = (node.arguments ?? []).find((a) => a?.type === 'StringLiteral');
+                            reportExcessiveAgency(node, handler.body, named?.value ?? tail, node.loc?.start.line ?? 0);
+                        }
+                    }
+                    // --- LLM10: a model's answer reaching a sink that runs it ---
+                    for (const [pattern, effect, severity] of OUTPUT_SINKS) {
+                        if (!pattern.test(full))
+                            continue;
+                        for (const arg of node.arguments ?? []) {
+                            const binding = referencesModel(arg, modelBindings);
+                            if (!binding)
+                                continue;
+                            push({
+                                id: 'CTS084',
+                                severity,
+                                title: 'Model output is executed rather than displayed',
+                                detail: `\`${binding}\` holds what the model returned, and here it is ${effect} by ` +
+                                    `\`${full}(...)\`. Everything upstream of the prompt — the user's message, a ` +
+                                    'retrieved document, a fetched page, a tool result — now reaches this call, because ' +
+                                    'a model will repeat text it was given. The model does not have to be jailbroken ' +
+                                    'for this to run the wrong thing; it only has to be helpful.',
+                                fix: 'Never route a model\'s answer into an interpreter. Have the model choose from a ' +
+                                    'fixed set of operations you implement, or return structured JSON you validate ' +
+                                    'against a schema and then act on in code. If the answer really is code, it belongs ' +
+                                    'in a sandbox with no credentials and no network, not in this process.',
+                                line: node.loc?.start.line ?? 0,
+                                cwe: effect.includes('SQL')
+                                    ? 'CWE-89: Improper Neutralization of Special Elements used in an SQL Command'
+                                    : 'CWE-94: Improper Control of Generation of Code',
+                                owasp: 'A05:2025 - Injection',
+                                meta: { llm: OWASP_LLM.LLM10, source: binding, sink: full },
+                            });
+                            break;
+                        }
+                        break;
+                    }
                     // --- A09: secrets / PII written to a log ---
                     const base = full.slice(0, full.lastIndexOf('.'));
                     const isLog = LOG_METHODS.has(tail) && (LOG_OBJECTS.test(base) || base === '' || /log$/i.test(base));
@@ -325,6 +712,146 @@ export const logicScanner = {
                         }
                     }
                 },
+                // --- LLM03: a tool-shaped object literal given an irreversible body ---
+                // `tool({ description, parameters, execute })` — Vercel's AI SDK, an
+                // OpenAI function definition and a hand-rolled registry all read alike:
+                // something that describes itself to a model, and something that runs.
+                ObjectExpression(path) {
+                    const props = (path.node.properties ?? []).filter((p) => p?.type === 'ObjectProperty');
+                    const keyOf = (p) => (p.key?.name ?? p.key?.value ?? '');
+                    const bodyProp = props.find((p) => TOOL_BODY_KEY.test(keyOf(p)) &&
+                        (p.value?.type === 'ArrowFunctionExpression' || p.value?.type === 'FunctionExpression'));
+                    if (!bodyProp)
+                        return;
+                    // A description or an argument schema is what makes it a *tool* rather
+                    // than any object that happens to hold a function.
+                    if (!props.some((p) => TOOL_SHAPE_KEY.test(keyOf(p))))
+                        return;
+                    const named = props.find((p) => keyOf(p) === 'name');
+                    const name = (named?.value?.type === 'StringLiteral' ? named.value.value : null) ??
+                        (path.parent?.type === 'ObjectProperty'
+                            ? (path.parent.key?.name ?? path.parent.key?.value)
+                            : null) ??
+                        (path.parentPath?.parentPath?.node?.type === 'VariableDeclarator'
+                            ? path.parentPath.parentPath.node.id?.name
+                            : null) ??
+                        'this tool';
+                    reportExcessiveAgency(path.node, bodyProp.value.body, String(name), path.node.loc?.start.line ?? 0);
+                },
+                // --- LLM10: model output assigned straight into the DOM ---
+                AssignmentExpression(path) {
+                    if (modelBindings.size === 0)
+                        return;
+                    const { left, right } = path.node;
+                    if (left?.type !== 'MemberExpression')
+                        return;
+                    const prop = left.property?.name ?? left.property?.value;
+                    if (prop !== 'innerHTML' && prop !== 'outerHTML')
+                        return;
+                    const binding = referencesModel(right, modelBindings);
+                    if (!binding)
+                        return;
+                    push({
+                        id: 'CTS084',
+                        severity: 'high',
+                        title: 'Model output is written to the page as HTML',
+                        detail: `\`${binding}\` holds what the model returned and is assigned to \`${prop}\`, which ` +
+                            'parses it as markup. Anything that reached the prompt can come back as a tag: a ' +
+                            'retrieved document, a filename, another user\'s message. The model is not the ' +
+                            'attacker here — it is the delivery mechanism.',
+                        fix: 'Render the answer as text (`textContent`, or JSX interpolation, which escapes). If it ' +
+                            'genuinely has to be rich, sanitize it with a real HTML sanitizer against an allow-list ' +
+                            'of tags and attributes before it goes near the DOM.',
+                        line: path.node.loc?.start.line ?? 0,
+                        cwe: 'CWE-79: Improper Neutralization of Input During Web Page Generation',
+                        owasp: 'A05:2025 - Injection',
+                        meta: { llm: OWASP_LLM.LLM10, source: binding, sink: prop },
+                    });
+                },
+                // --- LLM10: the React spelling of the same sink ---
+                JSXAttribute(path) {
+                    if (modelBindings.size === 0)
+                        return;
+                    if (path.node.name?.name !== 'dangerouslySetInnerHTML')
+                        return;
+                    const binding = referencesModel(path.node.value, modelBindings);
+                    if (!binding)
+                        return;
+                    push({
+                        id: 'CTS084',
+                        severity: 'high',
+                        title: 'Model output is rendered as raw HTML',
+                        detail: `\`dangerouslySetInnerHTML\` is given \`${binding}\`, which holds what the model ` +
+                            'returned. React escapes every other value you interpolate; this is the one prop that ' +
+                            'opts out, and the string it is opting out for is one an attacker upstream of the ' +
+                            'prompt can influence.',
+                        fix: 'Render the answer as a normal child (`{answer}`) so React escapes it. If it has to be ' +
+                            'formatted, parse it to a restricted set of nodes — a markdown renderer with HTML ' +
+                            'disabled, or a sanitizer with an allow-list — rather than trusting the string.',
+                        line: path.node.loc?.start.line ?? 0,
+                        cwe: 'CWE-79: Improper Neutralization of Input During Web Page Generation',
+                        owasp: 'A05:2025 - Injection',
+                        meta: { llm: OWASP_LLM.LLM10, source: binding, sink: 'dangerouslySetInnerHTML' },
+                    });
+                },
+                // --- LLM10: `new Function(answer)` is `eval` with extra steps ---
+                NewExpression(path) {
+                    if (modelBindings.size === 0)
+                        return;
+                    if (calleeTail(path.node.callee) !== 'Function')
+                        return;
+                    const binding = (path.node.arguments ?? [])
+                        .map((a) => referencesModel(a, modelBindings))
+                        .find(Boolean);
+                    if (!binding)
+                        return;
+                    push({
+                        id: 'CTS084',
+                        severity: 'critical',
+                        title: 'Model output is compiled into a function',
+                        detail: `\`new Function(${binding})\` compiles what the model returned and runs it in this ` +
+                            'process, with this process\'s credentials. It is `eval` under another name, and the ' +
+                            'string being compiled is downstream of every piece of text that reached the prompt.',
+                        fix: 'Have the model pick from operations you implement, or return JSON you validate against ' +
+                            'a schema and act on in code. Generated code belongs in a sandbox with no credentials ' +
+                            'and no network, never in the request path.',
+                        line: path.node.loc?.start.line ?? 0,
+                        cwe: 'CWE-94: Improper Control of Generation of Code',
+                        owasp: 'A05:2025 - Injection',
+                        meta: { llm: OWASP_LLM.LLM10, source: binding, sink: 'new Function' },
+                    });
+                },
+                // --- LLM07: the model's answer used as the guard ---
+                IfStatement(path) {
+                    if (modelBindings.size === 0)
+                        return;
+                    const binding = referencesModel(path.node.test, modelBindings);
+                    if (!binding)
+                        return;
+                    const fnName = enclosingFunctionName(path);
+                    // Either the branch sits in something whose name says it guards, or it
+                    // compares the answer against a verdict word — "yes", "safe",
+                    // "allowed". A model result merely being *read* in a condition is not
+                    // this rule; being *believed* is.
+                    if (!SECURITY_FN.test(fnName) && !SENSITIVE_NAME.test(fnName) && !hasDecisionLiteral(path.node.test)) {
+                        return;
+                    }
+                    reportModelDecision(binding, path.node.loc?.start.line ?? 0, `The branch here turns on \`${binding}\``);
+                },
+                // --- LLM07: a check that returns what the model said ---
+                ReturnStatement(path) {
+                    if (modelBindings.size === 0)
+                        return;
+                    if (!path.node.argument)
+                        return;
+                    const binding = referencesModel(path.node.argument, modelBindings);
+                    if (!binding)
+                        return;
+                    const fnName = enclosingFunctionName(path);
+                    if (!SECURITY_FN.test(fnName))
+                        return;
+                    reportModelDecision(binding, path.node.loc?.start.line ?? 0, `\`${fnName}\` reads as a security check, and returns \`${binding}\``);
+                },
                 // --- A10: fail-open / swallowed error on a security path ---
                 CatchClause(path) {
                     const node = path.node;

package/examples/security.yml

@@ -22,7 +22,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v7
-      - uses: murtazaozdemir/cleartoship@v0.12.2
+      - uses: murtazaozdemir/cleartoship@v0.13.0
         with:
           fail-on: critical   # block the PR only on criticals
           comment: true        # post a summary comment on the PR

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "cleartoship",
-  "version": "0.12.2",
-  "description": "The 30-second pre-launch security clearance for AI-built & vibe-coded apps. Catches missing Server Action auth, Supabase RLS holes, hallucinated npm packages and leaked keys.",
+  "version": "0.13.0",
+  "description": "The 30-second pre-launch security clearance for AI-built apps. Statically checks the agent surface no runtime scanner sees before deploy — ungated tools, model output in a shell, prompts in the client bundle — plus missing Server Action auth, Supabase RLS holes, hallucinated npm packages and leaked keys. Free while in beta.",
   "keywords": [
     "security",
     "sast",
@@ -12,7 +12,12 @@
     "slopsquatting",
     "hallucinated-packages",
     "vibe-coding",
-    "ai-code-review"
+    "ai-code-review",
+    "llm-security",
+    "owasp-llm-top-10",
+    "ai-agents",
+    "prompt-injection",
+    "mcp"
   ],
   "license": "MIT",
   "type": "module",