codegate-ai 0.16.2 → 1.0.0

package/dist/layer2-static/detectors/known-bad.js

@@ -0,0 +1,116 @@
+import { createHash } from "node:crypto";
+import { hasKnownBadIndicators } from "../../content/known-bad.js";
+import { buildFindingFingerprint } from "../../report/finding-fingerprint.js";
+import { collectMcpPackageLaunches, parsePackageLocator } from "./mcp-package-hygiene.js";
+export const KNOWN_BAD_MATCH_KIND = {
+    FileHash: "file-hash",
+    PackageName: "package-name",
+    UrlPattern: "url-pattern",
+};
+export const KNOWN_BAD_RULE_ID = "known-malicious-content";
+const URL_PATTERN = /https?:\/\/[^\s"'`<>)\]}]+/giu;
+const MATCH_KIND_CATEGORY = {
+    [KNOWN_BAD_MATCH_KIND.FileHash]: "CONFIG_PRESENT",
+    [KNOWN_BAD_MATCH_KIND.PackageName]: "COMMAND_EXEC",
+    [KNOWN_BAD_MATCH_KIND.UrlPattern]: "CONFIG_PRESENT",
+};
+function makeKnownBadFinding(input, kind, field, description, evidence) {
+    return {
+        rule_id: KNOWN_BAD_RULE_ID,
+        finding_id: `KNOWN_MALICIOUS_CONTENT-${kind}-${input.filePath}-${field}-${evidence}`,
+        severity: "CRITICAL",
+        category: MATCH_KIND_CATEGORY[kind],
+        layer: "L2",
+        file_path: input.filePath,
+        location: { field },
+        description,
+        affected_tools: ["claude-code", "codex-cli", "opencode", "cursor", "windsurf"],
+        cve: null,
+        owasp: ["ASI05"],
+        cwe: "CWE-506",
+        confidence: "HIGH",
+        fixable: true,
+        remediation_actions: ["quarantine_file", "remove_field"],
+        metadata: {
+            sources: [input.filePath, field],
+            risk_tags: ["known-bad", kind],
+            origin: "known-bad",
+        },
+        evidence,
+        suppressed: false,
+    };
+}
+function detectFileHashMatch(input) {
+    const hash = createHash("sha256").update(input.textContent, "utf8").digest("hex");
+    if (!input.indicators.fileSha256.has(hash)) {
+        return [];
+    }
+    return [
+        makeKnownBadFinding(input, KNOWN_BAD_MATCH_KIND.FileHash, "content", `File content matches a known-malicious SHA-256 indicator (${hash}). ` +
+            "Quarantine this file and audit how it got here.", `sha256:${hash}`),
+    ];
+}
+function detectPackageNameMatches(input) {
+    const findings = [];
+    for (const launch of collectMcpPackageLaunches(input.parsed)) {
+        const { name } = parsePackageLocator(launch.registry, launch.locator);
+        if (!input.indicators.packageNames.has(name.toLowerCase())) {
+            continue;
+        }
+        findings.push(makeKnownBadFinding(input, KNOWN_BAD_MATCH_KIND.PackageName, launch.serverPath, `MCP server runs ${launch.registry} package "${name}", which is a known-malicious package. ` +
+            "Remove this server configuration immediately.", `${launch.serverPath}: ${launch.locator}`));
+    }
+    return findings;
+}
+function detectUrlPatternMatches(input) {
+    const findings = [];
+    const reported = new Set();
+    for (const match of input.textContent.matchAll(URL_PATTERN)) {
+        const url = match[0];
+        const normalized = url.toLowerCase();
+        const pattern = input.indicators.urlPatterns.find((entry) => normalized.includes(entry));
+        if (!pattern || reported.has(normalized)) {
+            continue;
+        }
+        reported.add(normalized);
+        findings.push(makeKnownBadFinding(input, KNOWN_BAD_MATCH_KIND.UrlPattern, "content", `File references "${url}", which matches the known-malicious URL indicator "${pattern}". ` +
+            "Remove the reference and audit anything fetched from it.", url));
+    }
+    return findings;
+}
+export function detectKnownBadContent(input) {
+    if (!hasKnownBadIndicators(input.indicators)) {
+        return [];
+    }
+    return [
+        ...detectFileHashMatch(input),
+        ...detectPackageNameMatches(input),
+        ...detectUrlPatternMatches(input),
+    ];
+}
+/**
+ * Escalate findings whose stable fingerprint appears in the known-bad
+ * indicator set to CRITICAL. Runs on the assembled finding list so it also
+ * covers findings produced outside the static engine.
+ */
+export function escalateKnownBadFindings(findings, indicators) {
+    if (indicators.findingFingerprints.size === 0) {
+        return findings;
+    }
+    return findings.map((finding) => {
+        const fingerprint = finding.fingerprint ?? buildFindingFingerprint(finding);
+        if (!indicators.findingFingerprints.has(fingerprint)) {
+            return finding;
+        }
+        return {
+            ...finding,
+            severity: "CRITICAL",
+            description: `${finding.description} This finding matches a known-malicious indicator ` +
+                "and has been escalated to CRITICAL.",
+            metadata: {
+                ...finding.metadata,
+                risk_tags: [...(finding.metadata?.risk_tags ?? []), "known-bad"],
+            },
+        };
+    });
+}

package/dist/layer2-static/detectors/mcp-package-hygiene.d.ts

@@ -0,0 +1,28 @@
+import type { Finding } from "../../types/finding.js";
+export interface McpPackageHygieneInput {
+    filePath: string;
+    parsed: unknown;
+    knownSafeMcpServers: string[];
+}
+export declare const PACKAGE_REGISTRY: {
+    readonly Npm: "npm";
+    readonly Pypi: "pypi";
+};
+export type PackageRegistry = (typeof PACKAGE_REGISTRY)[keyof typeof PACKAGE_REGISTRY];
+export interface PackageLaunch {
+    registry: PackageRegistry;
+    locator: string;
+    serverPath: string;
+    autoConfirm: boolean;
+}
+interface ParsedLocator {
+    name: string;
+    version: string | null;
+}
+export declare function parsePackageLocator(registry: PackageRegistry, locator: string): ParsedLocator;
+export declare function isPinnedLocator(registry: PackageRegistry, locator: string): boolean;
+export declare function findLikelyTyposquatTarget(registry: PackageRegistry, name: string): string | null;
+/** MCP server package launches (npx/uvx/pipx style) found in a parsed config. */
+export declare function collectMcpPackageLaunches(parsed: unknown): PackageLaunch[];
+export declare function detectMcpPackageHygiene(input: McpPackageHygieneInput): Finding[];
+export {};

package/dist/layer2-static/detectors/mcp-package-hygiene.js

@@ -0,0 +1,191 @@
+import { activePopularMcpPackages } from "../data/popular-mcp-packages.js";
+import { damerauLevenshtein } from "../text/edit-distance.js";
+const MCP_SERVER_CONTAINER_KEYS = ["mcpServers", "mcp_servers", "context_servers"];
+export const PACKAGE_REGISTRY = {
+    Npm: "npm",
+    Pypi: "pypi",
+};
+const NPM_LAUNCHERS = new Set(["npx", "pnpx", "bunx"]);
+const PYPI_LAUNCHERS = new Set(["uvx", "pipx"]);
+// Exact versions pin the executed code; tags and ranges resolve at launch time.
+const EXACT_NPM_VERSION_PATTERN = /^\d+\.\d+\.\d+(?:-[\w.]+)?$/u;
+const EXACT_PYPI_VERSION_PATTERN = /^==\s*\d+(?:\.\d+)*(?:[a-z0-9.]*)$/iu;
+const MIN_TYPOSQUAT_NAME_LENGTH = 4;
+function isRecord(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function parseNpmLocator(locator) {
+    const versionIndex = locator.lastIndexOf("@");
+    if (versionIndex > 0) {
+        return { name: locator.slice(0, versionIndex), version: locator.slice(versionIndex + 1) };
+    }
+    return { name: locator, version: null };
+}
+function parsePypiLocator(locator) {
+    const specIndex = locator.search(/[=<>!~]/u);
+    if (specIndex > 0) {
+        return { name: locator.slice(0, specIndex), version: locator.slice(specIndex) };
+    }
+    return { name: locator, version: null };
+}
+export function parsePackageLocator(registry, locator) {
+    return registry === PACKAGE_REGISTRY.Npm ? parseNpmLocator(locator) : parsePypiLocator(locator);
+}
+export function isPinnedLocator(registry, locator) {
+    const { version } = parsePackageLocator(registry, locator);
+    if (version === null) {
+        return false;
+    }
+    return registry === PACKAGE_REGISTRY.Npm
+        ? EXACT_NPM_VERSION_PATTERN.test(version)
+        : EXACT_PYPI_VERSION_PATTERN.test(version);
+}
+function typosquatThreshold(name) {
+    return name.length >= 10 ? 2 : 1;
+}
+export function findLikelyTyposquatTarget(registry, name) {
+    const popular = activePopularMcpPackages()[registry];
+    const normalized = name.toLowerCase();
+    if (normalized.length < MIN_TYPOSQUAT_NAME_LENGTH || popular.includes(normalized)) {
+        return null;
+    }
+    let best = null;
+    for (const candidate of popular) {
+        const distance = damerauLevenshtein(normalized, candidate);
+        if (distance > 0 && distance <= typosquatThreshold(normalized)) {
+            if (!best || distance < best.distance) {
+                best = { target: candidate, distance };
+            }
+        }
+    }
+    return best?.target ?? null;
+}
+function commandTokens(config) {
+    if (Array.isArray(config.command) && config.command.every((entry) => typeof entry === "string")) {
+        return config.command;
+    }
+    if (typeof config.command === "string") {
+        const args = Array.isArray(config.args)
+            ? config.args.filter((entry) => typeof entry === "string")
+            : [];
+        return [config.command, ...args];
+    }
+    return [];
+}
+function firstNonFlag(tokens, startIndex) {
+    for (let index = startIndex; index < tokens.length; index += 1) {
+        const token = tokens[index];
+        if (typeof token !== "string" || token.length === 0 || token.startsWith("-")) {
+            continue;
+        }
+        return token;
+    }
+    return null;
+}
+function hasAutoConfirmFlag(tokens) {
+    return tokens.some((token) => token === "-y" || token === "--yes");
+}
+function collectPackageLaunches(value, path, launches) {
+    if (!isRecord(value)) {
+        return;
+    }
+    for (const containerKey of MCP_SERVER_CONTAINER_KEYS) {
+        const container = value[containerKey];
+        if (!isRecord(container)) {
+            continue;
+        }
+        for (const [serverName, serverConfig] of Object.entries(container)) {
+            if (!isRecord(serverConfig)) {
+                continue;
+            }
+            const tokens = commandTokens(serverConfig);
+            if (tokens.length === 0) {
+                continue;
+            }
+            const launcher = (tokens[0] ?? "").toLowerCase();
+            const registry = NPM_LAUNCHERS.has(launcher)
+                ? PACKAGE_REGISTRY.Npm
+                : PYPI_LAUNCHERS.has(launcher)
+                    ? PACKAGE_REGISTRY.Pypi
+                    : null;
+            if (!registry) {
+                continue;
+            }
+            const locator = firstNonFlag(tokens, 1);
+            if (!locator) {
+                continue;
+            }
+            launches.push({
+                registry,
+                locator,
+                serverPath: `${path}${containerKey}.${serverName}`,
+                autoConfirm: hasAutoConfirmFlag(tokens),
+            });
+        }
+    }
+    for (const [key, nested] of Object.entries(value)) {
+        if (MCP_SERVER_CONTAINER_KEYS.includes(key)) {
+            continue;
+        }
+        collectPackageLaunches(nested, `${path}${key}.`, launches);
+    }
+}
+function makeFinding(input, launch, ruleId, severity, description) {
+    return {
+        rule_id: ruleId,
+        finding_id: `${ruleId.toUpperCase().replaceAll("-", "_")}-${input.filePath}-${launch.serverPath}`,
+        severity,
+        category: "COMMAND_EXEC",
+        layer: "L2",
+        file_path: input.filePath,
+        location: { field: launch.serverPath },
+        description,
+        affected_tools: ["claude-code", "codex-cli", "opencode", "cursor", "windsurf"],
+        cve: null,
+        owasp: ["ASI05"],
+        cwe: "CWE-829",
+        confidence: "HIGH",
+        fixable: true,
+        remediation_actions: ["remove_field", "replace_with_default"],
+        metadata: {
+            sources: [input.filePath, launch.serverPath],
+            risk_tags: ["mcp", "supply-chain"],
+            origin: "mcp-package-hygiene",
+        },
+        evidence: `${launch.serverPath}: ${launch.locator}`,
+        suppressed: false,
+    };
+}
+/** MCP server package launches (npx/uvx/pipx style) found in a parsed config. */
+export function collectMcpPackageLaunches(parsed) {
+    const launches = [];
+    collectPackageLaunches(parsed, "", launches);
+    return launches;
+}
+export function detectMcpPackageHygiene(input) {
+    const launches = collectMcpPackageLaunches(input.parsed);
+    if (launches.length === 0) {
+        return [];
+    }
+    const knownSafe = new Set(input.knownSafeMcpServers.map((entry) => entry.toLowerCase()));
+    const findings = [];
+    for (const launch of launches) {
+        const { name } = parsePackageLocator(launch.registry, launch.locator);
+        if (knownSafe.has(name.toLowerCase())) {
+            continue;
+        }
+        if (!isPinnedLocator(launch.registry, launch.locator)) {
+            const autoConfirmNote = launch.autoConfirm
+                ? " The launcher auto-confirms installation (-y), so new versions run without any prompt."
+                : "";
+            findings.push(makeFinding(input, launch, "mcp-unpinned-package", "MEDIUM", `MCP server runs ${launch.registry} package "${launch.locator}" without an exact version pin, ` +
+                `so it executes whatever the registry serves at launch time.${autoConfirmNote}`));
+        }
+        const typosquatTarget = findLikelyTyposquatTarget(launch.registry, name);
+        if (typosquatTarget) {
+            findings.push(makeFinding(input, launch, "mcp-possible-typosquat", "HIGH", `MCP server package "${name}" is one edit away from the well-known package ` +
+                `"${typosquatTarget}". Verify this is the intended package and not a typosquat.`));
+        }
+    }
+    return findings;
+}

package/dist/layer2-static/detectors/rule-file.js

@@ -1,22 +1,8 @@
 import { buildFindingEvidence } from "../evidence.js";
-const DIRECT_OVERRIDE_PHRASES = [
-    "ignore previous instructions",
-    "skip permissions",
-    "bypass permissions",
-];
-const NEGATION_PATTERN = /\b(?:must not|should not|do not|don't|never)\b/iu;
-const SENSITIVE_READ_PATTERN = /\b(?:read|cat)\s+(?:~\/\.ssh(?:\/[^\s]+)?|\.env\b|~\/\.[a-z0-9._-]+(?:\/[^\s]+)*)/iu;
-const OUTBOUND_TRANSFER_PATTERN = /\b(?:upload externally|send to (?:an |a )?(?:external )?(?:webhook|endpoint|server)|curl\b|wget\b|invoke-webrequest\b|post to\b|https?:\/\/|exfiltrat(?:e|ion|ing))\b/iu;
-const SUSPICIOUS_LONG_LINE_PATTERN = /\b(?:ignore previous instructions|skip permissions|bypass permissions|upload externally|curl\b|wget\b|https?:\/\/|bash\s+-lc|sh\s+-c|powershell\b|base64\b|~\/\.ssh|\.env\b)\b/iu;
-const REMOTE_SHELL_PATTERN = /\b(?:curl|wget)\b[^\n|]{0,240}\|\s*(?:bash|sh)\b|\b(?:invoke-webrequest|iwr)\b[^\n|]{0,240}\|\s*(?:iex|invoke-expression)\b/iu;
-const HTML_COMMENT_PATTERN = /<!--([\s\S]*?)-->/gu;
-const COMMENT_PAYLOAD_PATTERN = /\b(?:secret instructions|ignore previous instructions|curl\b|wget\b|invoke-webrequest\b|bash\b|powershell\b|session share\b|profile sync\b)\b/iu;
-const COOKIE_EXPORT_PATTERN = /\bcookies?\s+(?:export|import|get)\b/iu;
-const SESSION_SHARE_PATTERN = /\bsession\s+share\b|\blive url\b/iu;
-const PROFILE_SYNC_PATTERN = /\bprofile\s+sync\b|\breal chrome\b|\blogin sessions\b|\bsession tokens?\b|--profile\b/iu;
-const BOOTSTRAP_INSTALL_PATTERN = /\b(?:npm|pnpm|yarn|bun)\s+install\s+-g\b|\bbrew\s+install\b|\bpipx\s+install\b|\bgo\s+install\b|\b(?:npx|pnpx|uvx)\b[^\n`]{0,160}@latest\b/iu;
-const AGENT_CONTROL_POINT_PATTERN = /\.claude\/hooks\/|\.claude\/settings\.json|\.claude\/agents\/|\bclaude\.md\b|\bagents\.md\b|\bmcp configuration\b/iu;
-const RESTART_LOAD_PATTERN = /\brestart\b.*\b(?:load|take effect|activate|reload|work)\b|\bonly load after restart\b|\bafter restarting\b/iu;
+import { scanEncodedPayloads } from "../text/encoded-payloads.js";
+import { normalizeForMatching } from "../text/normalize.js";
+import { AGENT_CONTROL_POINT_PATTERN, BOOTSTRAP_INSTALL_PATTERN, COMMENT_PAYLOAD_PATTERN, COOKIE_EXPORT_PATTERN, HTML_COMMENT_PATTERN, NEGATION_PATTERN, OUTBOUND_TRANSFER_PATTERN, PROFILE_SYNC_PATTERN, REMOTE_INSTRUCTION_INDIRECTION_PATTERN, REMOTE_SHELL_PATTERN, RESTART_LOAD_PATTERN, SENSITIVE_READ_PATTERN, SESSION_SHARE_PATTERN, SUSPICIOUS_LONG_LINE_PATTERN, findOverridePhrase, hasNegationBefore, } from "../text/threat-patterns.js";
+import { HIDDEN_UNICODE_CLASS, findHiddenUnicode } from "../text/unicode.js";
 function makeFinding(filePath, field, ruleId, description, evidence, severity = "HIGH", narrative = {}) {
     const location = { field };
     if (typeof evidence?.line === "number") {
@@ -79,53 +65,45 @@ function buildMultilineEvidence(lines, lineNumbers) {
         column: 1,
     };
 }
-function hasNearbyNegation(line, matchIndex) {
-    const prefix = line.slice(Math.max(0, matchIndex - 24), matchIndex);
-    return NEGATION_PATTERN.test(prefix);
-}
 function detectSuspiciousInstruction(lines) {
-    for (let index = 0; index < lines.length; index += 1) {
-        const line = lines[index] ?? "";
-        const lower = line.toLowerCase();
-        for (const phrase of DIRECT_OVERRIDE_PHRASES) {
-            const matchIndex = lower.indexOf(phrase);
-            if (matchIndex < 0 || hasNearbyNegation(lower, matchIndex)) {
-                continue;
-            }
+    for (let index = 0; index < lines.normalized.length; index += 1) {
+        const normalized = lines.normalized[index] ?? "";
+        const original = lines.original[index] ?? "";
+        const overrideMatch = findOverridePhrase(normalized);
+        if (overrideMatch) {
             return {
-                phrase,
-                evidence: buildLineEvidence(line, index + 1, matchIndex + 1),
+                phrase: overrideMatch.phrase,
+                evidence: buildLineEvidence(original, index + 1, overrideMatch.index + 1),
             };
         }
-        const sensitiveReadMatch = line.match(SENSITIVE_READ_PATTERN);
-        const outboundMatch = line.match(OUTBOUND_TRANSFER_PATTERN);
+        const sensitiveReadMatch = normalized.match(SENSITIVE_READ_PATTERN);
+        const outboundMatch = normalized.match(OUTBOUND_TRANSFER_PATTERN);
         if (!sensitiveReadMatch || !outboundMatch) {
             continue;
         }
-        const outboundIndex = outboundMatch.index ?? line.length;
-        if (hasNearbyNegation(lower, outboundIndex)) {
+        const outboundIndex = outboundMatch.index ?? normalized.length;
+        if (hasNegationBefore(normalized, outboundIndex)) {
             continue;
         }
-        const phrase = outboundMatch[0].toLowerCase();
         return {
-            phrase,
-            evidence: buildLineEvidence(line, index + 1, outboundIndex + 1),
+            phrase: outboundMatch[0].toLowerCase(),
+            evidence: buildLineEvidence(original, index + 1, outboundIndex + 1),
         };
     }
     return null;
 }
 function detectRemoteShell(lines) {
-    for (let index = 0; index < lines.length; index += 1) {
-        const line = lines[index] ?? "";
-        const match = line.match(REMOTE_SHELL_PATTERN);
+    for (let index = 0; index < lines.normalized.length; index += 1) {
+        const normalized = lines.normalized[index] ?? "";
+        const match = normalized.match(REMOTE_SHELL_PATTERN);
         if (!match) {
             continue;
         }
         const matchIndex = match.index ?? 0;
-        if (hasNearbyNegation(line.toLowerCase(), matchIndex)) {
+        if (hasNegationBefore(normalized, matchIndex)) {
             continue;
         }
-        return buildLineEvidence(line, index + 1, matchIndex + 1);
+        return buildLineEvidence(lines.original[index] ?? "", index + 1, matchIndex + 1);
     }
     return null;
 }
@@ -143,12 +121,12 @@ function shellLabelFromEvidence(evidence) {
     return "a shell";
 }
 function detectHiddenCommentPayload(input, lines) {
-    HTML_COMMENT_PATTERN.lastIndex = 0;
-    let match = HTML_COMMENT_PATTERN.exec(input.textContent);
+    const commentRegex = new RegExp(HTML_COMMENT_PATTERN.source, "gu");
+    let match = commentRegex.exec(input.textContent);
     while (match) {
-        const commentBody = match[1] ?? "";
+        const commentBody = normalizeForMatching(match[1] ?? "");
         if (!COMMENT_PAYLOAD_PATTERN.test(commentBody)) {
-            match = HTML_COMMENT_PATTERN.exec(input.textContent);
+            match = commentRegex.exec(input.textContent);
             continue;
         }
         const startLine = input.textContent.slice(0, match.index ?? 0).split(/\r?\n/u).length;
@@ -161,22 +139,21 @@ function detectHiddenCommentPayload(input, lines) {
 function detectSessionTransfer(lines) {
     const matchedLines = [];
     const categories = new Set();
-    for (let index = 0; index < lines.length; index += 1) {
-        const line = lines[index] ?? "";
-        const lower = line.toLowerCase();
-        if (NEGATION_PATTERN.test(lower)) {
+    for (let index = 0; index < lines.normalized.length; index += 1) {
+        const normalized = lines.normalized[index] ?? "";
+        if (NEGATION_PATTERN.test(normalized)) {
             continue;
         }
         let matched = false;
-        if (COOKIE_EXPORT_PATTERN.test(line)) {
+        if (COOKIE_EXPORT_PATTERN.test(normalized)) {
             categories.add("cookies");
             matched = true;
         }
-        if (SESSION_SHARE_PATTERN.test(line)) {
+        if (SESSION_SHARE_PATTERN.test(normalized)) {
             categories.add("session_share");
             matched = true;
         }
-        if (PROFILE_SYNC_PATTERN.test(line)) {
+        if (PROFILE_SYNC_PATTERN.test(normalized)) {
             categories.add("profile");
             matched = true;
         }
@@ -187,52 +164,110 @@ function detectSessionTransfer(lines) {
     if (categories.size < 2 || matchedLines.length < 2) {
         return null;
     }
-    return buildMultilineEvidence(lines, matchedLines.slice(0, 4));
+    return buildMultilineEvidence(lines.original, matchedLines.slice(0, 4));
 }
 function detectBootstrapControlPoints(lines) {
     const installLines = [];
     const controlPointLines = [];
     const restartLines = [];
-    for (let index = 0; index < lines.length; index += 1) {
-        const line = lines[index] ?? "";
+    for (let index = 0; index < lines.normalized.length; index += 1) {
+        const normalized = lines.normalized[index] ?? "";
         const lineNumber = index + 1;
-        if (BOOTSTRAP_INSTALL_PATTERN.test(line)) {
+        if (BOOTSTRAP_INSTALL_PATTERN.test(normalized)) {
             installLines.push(lineNumber);
         }
-        if (AGENT_CONTROL_POINT_PATTERN.test(line)) {
+        if (AGENT_CONTROL_POINT_PATTERN.test(normalized)) {
             controlPointLines.push(lineNumber);
         }
-        if (RESTART_LOAD_PATTERN.test(line)) {
+        if (RESTART_LOAD_PATTERN.test(normalized)) {
             restartLines.push(lineNumber);
         }
     }
     if (installLines.length === 0 || controlPointLines.length === 0 || restartLines.length === 0) {
         return null;
     }
-    return buildMultilineEvidence(lines, [
+    return buildMultilineEvidence(lines.original, [
         ...installLines.slice(0, 2),
         ...controlPointLines.slice(0, 2),
         restartLines[0],
     ]);
 }
-export function detectRuleFileIssues(input) {
+function hiddenUnicodeFindings(input) {
+    if (input.unicodeAnalysis === false) {
+        return [];
+    }
+    const matches = findHiddenUnicode(input.textContent);
+    if (matches.length === 0) {
+        return [];
+    }
     const findings = [];
-    const hiddenUnicodeRegex = /(?:\u200B|\u200C|\u200D|\u2060|\uFEFF|[\u202A-\u202E])/u;
-    const hiddenRemoteShellIncident = {
-        incidentId: "hidden-remote-shell-payload",
-        incidentTitle: "Hidden remote shell payload in skill file",
-    };
-    const hiddenMatch = input.unicodeAnalysis === false ? null : input.textContent.match(hiddenUnicodeRegex);
-    if (hiddenMatch?.[0]) {
+    const tagMatches = matches.filter((match) => match.class === HIDDEN_UNICODE_CLASS.Tags);
+    const otherMatches = matches.filter((match) => match.class !== HIDDEN_UNICODE_CLASS.Tags);
+    if (otherMatches.length > 0) {
+        const firstChar = String.fromCodePoint(otherMatches[0]?.codePoint ?? 0x200b);
         const evidence = buildFindingEvidence({
             textContent: input.textContent,
-            searchTerms: [hiddenMatch[0]],
+            searchTerms: [firstChar],
             fallbackValue: "hidden Unicode character detected",
         });
         findings.push(makeFinding(input.filePath, "hidden_unicode", "rule-file-hidden-unicode", "Rule file contains hidden Unicode characters", evidence));
     }
-    const lines = input.textContent.split(/\r?\n/u);
-    const hiddenCommentPayload = detectHiddenCommentPayload(input, lines);
+    if (tagMatches.length > 0) {
+        const lineNumber = input.textContent.slice(0, tagMatches[0]?.index ?? 0).split(/\r?\n/u).length;
+        findings.push(makeFinding(input.filePath, "hidden_unicode_tags", "rule-file-hidden-unicode-tags", `Rule file contains ${tagMatches.length} Unicode tag character(s) (U+E0000-U+E007F), ` +
+            "an ASCII-smuggling channel that hides instructions from human reviewers", { evidence: `line ${lineNumber}: ${tagMatches.length} tag character(s)`, line: lineNumber }, "HIGH", {
+            observed: [
+                "The file embeds Unicode tag characters that render as nothing in editors and diffs.",
+                "Tag characters encode invisible ASCII that still reaches models that read the file.",
+            ],
+            inference: "Invisible tag-character content is a known prompt-injection smuggling technique.",
+            notVerified: ["CodeGate did not decode or follow any smuggled instruction."],
+        }));
+    }
+    return findings;
+}
+function encodedPayloadFindings(input, lines) {
+    return scanEncodedPayloads(input.textContent).map((match) => {
+        const severity = match.matchesRemoteShell ? "CRITICAL" : "HIGH";
+        const behaviors = [
+            match.matchesRemoteShell ? "remote shell execution" : null,
+            match.matchesOverridePhrase ? "instruction override" : null,
+            match.matchesSensitiveExfil ? "sensitive-data exfiltration" : null,
+            match.matchesCommandExecution ? "command execution" : null,
+        ].filter((entry) => entry !== null);
+        const sourceLine = lines[match.line - 1] ?? "";
+        const evidence = {
+            evidence: `line ${match.line}\n${match.line} | ${sourceLine.slice(0, 200)}\n` +
+                `decoded (${match.kind}): ${match.decodedExcerpt}`,
+            line: match.line,
+            column: 1,
+        };
+        return makeFinding(input.filePath, `encoded_payload:${match.line}`, "rule-file-encoded-payload", `Rule file contains a ${match.kind}-encoded payload that decodes to ${behaviors.join(", ")}`, evidence, severity, {
+            observed: [
+                `An encoded ${match.kind} blob decodes to readable instructions.`,
+                `The decoded content matches: ${behaviors.join(", ")}.`,
+            ],
+            inference: "Encoding hides the payload from human review while keeping it machine-usable.",
+            notVerified: [
+                "CodeGate did not execute any decoded instruction.",
+                "CodeGate did not fetch any URL referenced by the decoded content.",
+            ],
+        });
+    });
+}
+export function detectRuleFileIssues(input) {
+    const findings = [];
+    const hiddenRemoteShellIncident = {
+        incidentId: "hidden-remote-shell-payload",
+        incidentTitle: "Hidden remote shell payload in skill file",
+    };
+    findings.push(...hiddenUnicodeFindings(input));
+    const originalLines = input.textContent.split(/\r?\n/u);
+    const lines = {
+        original: originalLines,
+        normalized: originalLines.map((line) => normalizeForMatching(line)),
+    };
+    const hiddenCommentPayload = detectHiddenCommentPayload(input, lines.original);
     if (hiddenCommentPayload) {
         findings.push(makeFinding(input.filePath, "hidden_comment_payload", "rule-file-hidden-comment-payload", "Rule file contains a hidden comment payload with executable or override instructions", hiddenCommentPayload, "CRITICAL", {
             ...hiddenRemoteShellIncident,
@@ -290,11 +325,29 @@ export function detectRuleFileIssues(input) {
             ],
         }));
     }
-    const longLineIndex = lines.findIndex((line) => line.length > 300 && SUSPICIOUS_LONG_LINE_PATTERN.test(line) && !NEGATION_PATTERN.test(line));
+    for (let index = 0; index < lines.normalized.length; index += 1) {
+        const normalized = lines.normalized[index] ?? "";
+        const match = normalized.match(REMOTE_INSTRUCTION_INDIRECTION_PATTERN);
+        if (!match || hasNegationBefore(normalized, match.index ?? 0)) {
+            continue;
+        }
+        findings.push(makeFinding(input.filePath, "remote_instruction_indirection", "rule-file-remote-instruction-indirection", "Rule file directs the agent to fetch and follow instructions from a remote URL", buildLineEvidence(lines.original[index] ?? "", index + 1, (match.index ?? 0) + 1), "HIGH", {
+            observed: [
+                "The file tells the agent to read or follow instructions hosted at an external URL.",
+            ],
+            inference: "Remote instructions can change at any time after review, so the effective behavior is not what was audited.",
+            notVerified: ["CodeGate did not fetch the referenced URL."],
+        }));
+        break;
+    }
+    findings.push(...encodedPayloadFindings(input, lines.original));
+    const longLineIndex = lines.normalized.findIndex((normalized, index) => (lines.original[index] ?? "").length > 300 &&
+        SUSPICIOUS_LONG_LINE_PATTERN.test(normalized) &&
+        !NEGATION_PATTERN.test(normalized));
     if (longLineIndex >= 0) {
         const lineNumber = longLineIndex + 1;
         const evidence = {
-            evidence: `line ${lineNumber}\n${lineNumber} | ${lines[longLineIndex]}`,
+            evidence: `line ${lineNumber}\n${lineNumber} | ${lines.original[longLineIndex]}`,
             line: lineNumber,
             column: 1,
         };

package/dist/layer2-static/detectors/skill-frontmatter.d.ts

@@ -0,0 +1,6 @@
+import type { Finding } from "../../types/finding.js";
+export interface SkillFrontmatterInput {
+    filePath: string;
+    textContent: string;
+}
+export declare function detectSkillFrontmatterIssues(input: SkillFrontmatterInput): Finding[];