guard-scanner 4.0.0 → 4.0.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (4) hide show
  1. package/README.md +9 -9
  2. package/SKILL.md +7 -9
  3. package/package.json +2 -2
  4. package/src/scanner.js +1 -1
package/README.md CHANGED
@@ -12,7 +12,7 @@
12
12
  <img src="https://img.shields.io/badge/dependencies-0-success?style=flat-square" alt="Zero Dependencies">
13
13
  <img src="https://img.shields.io/badge/tests-133%2F133-brightgreen?style=flat-square" alt="Tests Passing">
14
14
  <img src="https://img.shields.io/badge/OWASP_Agentic-90%25-green?style=flat-square" alt="OWASP Agentic 90%">
15
- <img src="https://img.shields.io/badge/patterns-190%2B-blueviolet?style=flat-square" alt="190+ Patterns">
15
+ <img src="https://img.shields.io/badge/patterns-210%2B-blueviolet?style=flat-square" alt="210+ Patterns">
16
16
  </p>
17
17
  <p align="center">
18
18
  <a href="#quick-start">Quick Start</a> •
@@ -50,8 +50,8 @@ The AI agent skill ecosystem has the same supply-chain security problem that npm
50
50
  | Feature | Description |
51
51
  |---|---|
52
52
  | **22 Threat Categories** | Snyk ToxicSkills + OWASP Agentic Top 10 + Identity Hijack + PII + Trust Exploitation |
53
- | **190+ Static Patterns** | Regex-based static analysis covering code, docs, and data files |
54
- | **26 Runtime Checks** | Real-time `before_tool_call` hook — 5-layer defense (v3.4.0) |
53
+ | **210+ Static Patterns** | Regex-based static analysis covering code, docs, and data files |
54
+ | **26 Runtime Checks** | Real-time `before_tool_call` hook — 5-layer defense (v4.0.0) |
55
55
  | **IoC Database** | Known malicious IPs, domains, URLs, usernames, and typosquat names |
56
56
  | **Data Flow Analysis** | Lightweight JS analysis: secret reads → network calls → exec chains |
57
57
  | **Cross-File Analysis** | Phantom references, base64 fragment assembly, multi-file exfil detection |
@@ -92,7 +92,7 @@ npx guard-scanner ./skills/ --verbose --check-deps --json --sarif --html
92
92
 
93
93
  **Output looks like this:**
94
94
  ```
95
- 🛡️ guard-scanner v3.4.0
95
+ 🛡️ guard-scanner v4.0.0
96
96
  ══════════════════════════════════════════════════════
97
97
  📂 Scanning: ./skills/
98
98
  📦 Skills found: 5
@@ -131,7 +131,7 @@ Layer 4: Brain / Behavioral — 3 checks (research skip, blind trust, chain
131
131
  Layer 5: Trust Exploitation — 4 checks (OWASP ASI09: authority/trust/audit abuse)
132
132
  ```
133
133
 
134
- > **v3.4.0** — Runtime Guard now available as standalone JS module (`src/runtime-guard.js`) + OpenClaw plugin (`hooks/guard-scanner/plugin.ts`).
134
+ > **v4.0.0** — Runtime Guard now available as standalone JS module (`src/runtime-guard.js`) + OpenClaw plugin (`hooks/guard-scanner/plugin.ts`).
135
135
 
136
136
  ### Quick Start
137
137
 
@@ -608,7 +608,7 @@ OpenClaw's official [`THREAT-MODEL-ATLAS.md`](https://github.com/openclaw/opencl
608
608
 
609
609
  | Gap (from ATLAS / Source Code) | OpenClaw Status | guard-scanner |
610
610
  |---|---|---|
611
- | _"Simple regex easily bypassed"_ — ClawHub moderation | ⚠️ Basic `FLAG_RULES` | ✅ 129 patterns, 21 categories |
611
+ | _"Simple regex easily bypassed"_ — ClawHub moderation | ⚠️ Basic `FLAG_RULES` | ✅ 129 patterns, 22 categories |
612
612
  | _"Does not analyze actual skill code content"_ | ❌ Not implemented | ✅ Full code + doc + data flow analysis |
613
613
  | No SOUL.md / IDENTITY.md integrity verification | ❌ Not implemented | ✅ Identity hijacking detection (Cat 17) |
614
614
  | `skill:before_install` hook | ❌ Not implemented | 🔜 Proposed ([Issue #18677](https://github.com/openclaw/openclaw/issues/18677)) |
@@ -719,7 +719,7 @@ clawhub install guava-suite
719
719
 
720
720
  | | guard-scanner (Free) | GuavaSuite ($GUAVA) |
721
721
  |---|---|---|
722
- | Static scan (129 patterns, 21 categories) | ✅ | ✅ |
722
+ | Static scan (129 patterns, 22 categories) | ✅ | ✅ |
723
723
  | Runtime Guard — `enforce` (block CRITICAL) | ✅ | ✅ |
724
724
  | **Runtime Guard — `strict` (block HIGH + CRITICAL)** | ❌ | ✅ |
725
725
  | **Soul Lock** (SOUL.md integrity + auto-rollback) | ❌ | ✅ |
@@ -739,7 +739,7 @@ guard-scanner is and always will be **free, open-source, and zero-dependency**.
739
739
  | v2.0.0 ✅ | **Plugin Hook Runtime Guard** | `block`/`blockReason` API, 3 modes, 91 tests |
740
740
  | v2.1.0 ✅ | **PII Exposure + Shadow AI** | 13 PII patterns, OWASP LLM02/06, 99 tests |
741
741
  | v3.0.0 ✅ | **TypeScript Rewrite** | Full TS, OWASP LLM Top 10 mapping |
742
- | v3.4.0 ✅ | **Runtime Guard Module + OWASP ASI** | 26 runtime checks (5 layers), ASI01-10 verified, 133 tests |
742
+ | v4.0.0 ✅ | **Runtime Guard Module + OWASP ASI** | 26 runtime checks (5 layers), ASI01-10 verified, 133 tests |
743
743
  | **v4.0** 🔜 | **LLM + OS + Multi-tool** | See below |
744
744
 
745
745
  ### v4.0 Vision (feedback welcome!)
@@ -748,7 +748,7 @@ guard-scanner is and always will be **free, open-source, and zero-dependency**.
748
748
  |-----------|------|-----|
749
749
  | 🧠 **LLM-assisted detection** | Pass suspicious (not certain) cases to a lightweight LLM (Haiku/Flash) for intent analysis | Regex can be evaded; LLMs understand intent |
750
750
  | 🔒 **OS-level enforcement** | File watcher (auto-rollback SOUL.md/.env), process monitor (kill netcat/socat), daemon mode | Works regardless of which AI tool you use |
751
- | 🔌 **Multi-tool support** | Adapters for Claude Code, Cursor, Antigravity, Windsurf, MCP servers | Same 190+ patterns, different skill discovery per tool |
751
+ | 🔌 **Multi-tool support** | Adapters for Claude Code, Cursor, Antigravity, Windsurf, MCP servers | Same 210+ patterns, different skill discovery per tool |
752
752
 
753
753
  > **Which matters most to you?** Open an issue or join the discussion! We're building this for the community.
754
754
 
package/SKILL.md CHANGED
@@ -5,7 +5,7 @@ description: >
5
5
  from ClawHub or external sources. Detects prompt injection, credential theft,
6
6
  exfiltration, identity hijacking, sandbox violations, code complexity, config impact,
7
7
  and 17 more threat categories.
8
- Includes a Runtime Guard hook (22 patterns, 4 layers) that blocks dangerous tool calls in real-time.
8
+ Includes a Runtime Guard hook (26 patterns, 5 layers, 0.016ms/scan) that blocks dangerous tool calls in real-time.
9
9
  homepage: https://github.com/koatora20/guard-scanner
10
10
  metadata:
11
11
  clawdbot:
@@ -29,7 +29,7 @@ metadata:
29
29
  # guard-scanner 🛡️
30
30
 
31
31
  Static + runtime security scanner for AI agent skills.
32
- **186+ threat patterns (static) + 22 runtime patterns (4 layers)** across **20 categories** — zero dependencies.
32
+ **210+ threat patterns (static) + 26 runtime patterns (5 layers)** across **22 categories** — zero dependencies. **0.016ms/scan.**
33
33
 
34
34
  ## When To Use This Skill
35
35
 
@@ -54,9 +54,9 @@ Scan a specific skill:
54
54
  node skills/guard-scanner/src/cli.js /path/to/new-skill/ --strict --verbose
55
55
  ```
56
56
 
57
- ### 2. Runtime Guard (OpenClaw) — ⚠️ warn-only currently
57
+ ### 2. Runtime Guard (OpenClaw Plugin Hook)
58
58
 
59
- > **Note:** OpenClaw `InternalHookEvent` does not yet expose cancel/veto. Runtime hook detections are warning + audit log until [Issue #18677](https://github.com/openclaw/openclaw/issues/18677) is adopted.
59
+ Blocks dangerous tool calls in real-time via `before_tool_call` hook. 26 patterns, 5 layers, 3 enforcement modes.
60
60
 
61
61
  ```bash
62
62
  openclaw hooks install skills/guard-scanner/hooks/guard-scanner
@@ -82,10 +82,8 @@ Set in `openclaw.json` → `hooks.internal.entries.guard-scanner.mode`:
82
82
  | Mode | Intended Behavior | Current Status |
83
83
  |------|-------------------|----------------|
84
84
  | `monitor` | Log all, never block | ✅ Fully working |
85
- | `enforce` (default) | Block CRITICAL threats | ⚠️ Warn only (cancel API pending) |
86
- | `strict` | Block HIGH + CRITICAL | ⚠️ Warn only (cancel API pending) |
87
-
88
- > **Note:** OpenClaw's `InternalHookEvent` does not yet expose a `cancel`/`veto` mechanism. All detections are currently logged and warned via `event.messages`, but tool execution cannot be blocked. Blocking will be enabled when the cancel API is added.
85
+ | `enforce` (default) | Block CRITICAL threats | ✅ Fully working |
86
+ | `strict` | Block HIGH + CRITICAL | ✅ Fully working |
89
87
 
90
88
  ## Threat Categories
91
89
 
@@ -141,7 +139,7 @@ an AI agent's SOUL.md personality file, and no existing tool could detect it.
141
139
 
142
140
  - **Open source**: Full source code available at https://github.com/koatora20/guard-scanner
143
141
  - **Zero dependencies**: Nothing to audit, no transitive risks
144
- - **Test suite**: 55 tests across 13 sections, 100% pass rate
142
+ - **Test suite**: 133 tests across 24 suites, 100% pass rate
145
143
  - **Taxonomy**: Based on Snyk ToxicSkills (Feb 2026), OWASP MCP Top 10, and original research
146
144
  - **Complementary to VirusTotal**: Detects prompt injection and LLM-specific attacks
147
145
  that VirusTotal's signature-based scanning cannot catch
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "guard-scanner",
3
- "version": "4.0.0",
4
- "description": "Agent security scanner + runtime guard — 190+ static patterns, 26 runtime checks (5 layers), 0.016ms/scan, before_tool_call hook, CLI, SARIF. OpenClaw-compatible plugin.",
3
+ "version": "4.0.1",
4
+ "description": "Agent security scanner + runtime guard — 210+ static patterns (22 categories), 26 runtime checks (5 layers), 0.016ms/scan, before_tool_call hook, CLI, SARIF. OpenClaw-compatible plugin.",
5
5
  "openclaw.extensions": "./openclaw.plugin.json",
6
6
  "main": "dist/index.js",
7
7
  "types": "dist/index.d.ts",
package/src/scanner.js CHANGED
@@ -31,7 +31,7 @@ const { KNOWN_MALICIOUS } = require('./ioc-db.js');
31
31
  const { generateHTML } = require('./html-template.js');
32
32
 
33
33
  // ===== CONFIGURATION =====
34
- const VERSION = '4.0.0';
34
+ const VERSION = '4.0.1';
35
35
 
36
36
  const THRESHOLDS = {
37
37
  normal: { suspicious: 30, malicious: 80 },