hackmyagent 0.10.0 → 0.11.0

package/dist/hardening/scanner.js

@@ -39,8 +39,12 @@ var __importStar = (this && this.__importStar) || (function () {
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.HardeningScanner = void 0;
 const fs = __importStar(require("fs/promises"));
+const crypto = __importStar(require("crypto"));
 const path = __importStar(require("path"));
 const semantic_1 = require("../semantic");
+const taxonomy_1 = require("./taxonomy");
+const skill_context_1 = require("./skill-context");
+const skill_capability_validator_1 = require("./skill-capability-validator");
 /**
  * Defines which checks apply to which project types
  * Key: check ID prefix or full ID
@@ -88,6 +92,18 @@ const CHECK_PROJECT_TYPES = {
     'SEC-': ['webapp', 'api', 'mcp'],
     // Semantic analysis - applies to all project types
     'SEM-': ['all'],
+    // Unicode steganography - applies to all projects
+    'UNICODE-STEGO-': ['all'],
+    // Agent memory/context checks
+    'MEM-': ['all'],
+    // RAG poisoning checks
+    'RAG-': ['all'],
+    // Agent identity checks
+    'AIM-': ['all'],
+    // Agent DNA integrity checks
+    'DNA-': ['all'],
+    // Skill memory manipulation checks
+    'SKILL-MEM-': ['openclaw', 'mcp'],
 };
 // Patterns for detecting exposed credentials
 // Each pattern is carefully tuned to minimize false positives
@@ -344,6 +360,26 @@ class HardeningScanner {
         // OpenClaw CVE-specific checks
         const cveFindings = await this.checkOpenclawCVE(targetDir, shouldFix);
         findings.push(...cveFindings);
+        // Unicode steganography checks (GlassWorm detection)
+        const unicodeStegoFindings = await this.checkUnicodeSteganography(targetDir, shouldFix);
+        findings.push(...unicodeStegoFindings);
+        // Memory/context poisoning checks
+        const memFindings = await this.checkMemoryPoisoning(targetDir, shouldFix);
+        findings.push(...memFindings);
+        // RAG poisoning checks
+        const ragFindings = await this.checkRAGPoisoning(targetDir, shouldFix);
+        findings.push(...ragFindings);
+        // Agent identity checks
+        const aimFindings = await this.checkAgentIdentity(targetDir, shouldFix);
+        findings.push(...aimFindings);
+        // Agent DNA integrity checks
+        const dnaFindings = await this.checkAgentDNA(targetDir, shouldFix);
+        findings.push(...dnaFindings);
+        // Skill memory manipulation checks
+        const skillMemFindings = await this.checkSkillMemory(targetDir, shouldFix);
+        findings.push(...skillMemFindings);
+        // Enrich findings with attack taxonomy mapping
+        (0, taxonomy_1.enrichWithTaxonomy)(findings);
         // Layer 2: Structural analysis (always on)
         let layer2Count = 0;
         let layer3Count = 0;
@@ -3846,19 +3882,33 @@ dist/
             const lines = content.split('\n').map(line => line.length > MAX_LINE_LENGTH ? line.substring(0, MAX_LINE_LENGTH) : line);
             // SKILL-001: Unsigned Skill
             const hasSignature = content.includes('opena2a_signature:') ||
-                content.includes('-----BEGIN SIGNATURE-----');
+                content.includes('-----BEGIN SIGNATURE-----') ||
+                content.includes('<!-- opena2a-guard hash=');
+            let skill001Fixed = false;
+            if (!hasSignature && autoFix) {
+                const hash = crypto.createHash('sha256').update(content).digest('hex');
+                const signedDate = new Date().toISOString();
+                const signatureBlock = `\n<!-- opena2a-guard hash="sha256:${hash}" signed="${signedDate}" -->`;
+                content = content + signatureBlock;
+                await fs.writeFile(skillFile, content);
+                skill001Fixed = true;
+            }
             findings.push({
                 checkId: 'SKILL-001',
                 name: 'Unsigned Skill',
                 description: 'Skill file lacks cryptographic signature for authenticity verification',
                 category: 'skill',
                 severity: 'medium',
-                passed: hasSignature,
+                passed: hasSignature || skill001Fixed,
                 message: hasSignature
                     ? 'Skill has cryptographic signature'
-                    : 'Skill is unsigned - cannot verify authenticity or integrity',
+                    : skill001Fixed
+                        ? 'Skill was unsigned - signature added'
+                        : 'Skill is unsigned - cannot verify authenticity or integrity',
                 file: relativePath,
-                fixable: false,
+                fixable: true,
+                fixed: skill001Fixed,
+                fixMessage: skill001Fixed ? 'Added SHA-256 signature block to skill file' : undefined,
                 fix: 'Sign the skill using: openclaw sign skill.md --key ~/.openclaw/signing-key.pem',
             });
             // SKILL-002: Remote Fetch Pattern
@@ -3907,26 +3957,45 @@ dist/
                 }
             }
             // SKILL-004: Filesystem Write Outside Sandbox
-            const filesystemWildcardPattern = /filesystem:\s*\*|filesystem:\s*~\/\*|filesystem:\s*\//gi;
+            const filesystemWildcardPattern = /filesystem:\s*\*|filesystem:\s*~\/|filesystem:\s*\//gi;
+            let skill004FileModified = false;
             for (let i = 0; i < lines.length; i++) {
                 const line = lines[i];
                 filesystemWildcardPattern.lastIndex = 0;
                 if (filesystemWildcardPattern.test(line)) {
+                    let fixApplied = false;
+                    if (autoFix) {
+                        const originalLine = lines[i];
+                        lines[i] = lines[i].replace(/filesystem:\s*\*/gi, 'filesystem:./');
+                        lines[i] = lines[i].replace(/filesystem:\s*~\//gi, 'filesystem:./data/');
+                        if (lines[i] !== originalLine) {
+                            fixApplied = true;
+                            skill004FileModified = true;
+                        }
+                    }
                     findings.push({
                         checkId: 'SKILL-004',
                         name: 'Filesystem Write Outside Sandbox',
                         description: 'Skill requests broad filesystem access outside sandbox',
                         category: 'skill',
                         severity: 'critical',
-                        passed: false,
-                        message: `Broad filesystem access requested: "${line.trim()}"`,
+                        passed: fixApplied,
+                        message: fixApplied
+                            ? `Broad filesystem access restricted: "${lines[i].trim()}"`
+                            : `Broad filesystem access requested: "${line.trim()}"`,
                         file: relativePath,
                         line: i + 1,
-                        fixable: false,
+                        fixable: true,
+                        fixed: fixApplied,
+                        fixMessage: fixApplied ? 'Restricted filesystem access to sandbox scope' : undefined,
                         fix: 'Restrict filesystem access to specific directories (e.g., filesystem:./data/*)',
                     });
                 }
             }
+            if (skill004FileModified) {
+                content = lines.join('\n');
+                await fs.writeFile(skillFile, content);
+            }
             // SKILL-005: Credential File Access
             for (let i = 0; i < lines.length; i++) {
                 const line = lines[i];
@@ -4050,12 +4119,16 @@ dist/
                     break; // One typosquatting finding per skill file
                 }
             }
-            // SKILL-010: Env File Exfiltration
+            // SKILL-010: Env File Exfiltration (context-aware)
             const envFilePattern = /\.env|dotenv|process\.env|environ|getenv/gi;
             for (let i = 0; i < lines.length; i++) {
                 const line = lines[i];
                 envFilePattern.lastIndex = 0;
                 if (envFilePattern.test(line)) {
+                    const section = (0, skill_context_1.classifySkillSection)(content, i);
+                    if ((0, skill_context_1.isLikelyFalsePositive)('SKILL-010', line, section, content)) {
+                        continue;
+                    }
                     findings.push({
                         checkId: 'SKILL-010',
                         name: 'Env File Exfiltration',
@@ -4071,12 +4144,16 @@ dist/
                     });
                 }
             }
-            // SKILL-011: Browser Data Access
+            // SKILL-011: Browser Data Access (context-aware)
             const browserDataPattern = /chrome|firefox|cookies|localStorage|sessionStorage|browser.*data|chromium|safari.*cookies/gi;
             for (let i = 0; i < lines.length; i++) {
                 const line = lines[i];
                 browserDataPattern.lastIndex = 0;
                 if (browserDataPattern.test(line)) {
+                    const section = (0, skill_context_1.classifySkillSection)(content, i);
+                    if ((0, skill_context_1.isLikelyFalsePositive)('SKILL-011', line, section, content)) {
+                        continue;
+                    }
                     findings.push({
                         checkId: 'SKILL-011',
                         name: 'Browser Data Access',
@@ -4092,12 +4169,16 @@ dist/
                     });
                 }
             }
-            // SKILL-012: Crypto Wallet Access
+            // SKILL-012: Crypto Wallet Access (context-aware)
             const cryptoWalletPattern = /wallet|solana|phantom|metamask|ledger|seed\s*phrase|mnemonic|\.sol\b|\.eth\b|private\s*key/gi;
             for (let i = 0; i < lines.length; i++) {
                 const line = lines[i];
                 cryptoWalletPattern.lastIndex = 0;
                 if (cryptoWalletPattern.test(line)) {
+                    const section = (0, skill_context_1.classifySkillSection)(content, i);
+                    if ((0, skill_context_1.isLikelyFalsePositive)('SKILL-012', line, section, content)) {
+                        continue;
+                    }
                     findings.push({
                         checkId: 'SKILL-012',
                         name: 'Crypto Wallet Access',
@@ -4113,6 +4194,84 @@ dist/
                     });
                 }
             }
+            // SKILL-018: Undeclared Capability Validation
+            const declaredCaps = (0, skill_capability_validator_1.parseDeclaredCapabilities)(content);
+            const inferredCaps = (0, skill_capability_validator_1.inferActualCapabilities)(content);
+            const capFindings = (0, skill_capability_validator_1.validateCapabilities)(declaredCaps, inferredCaps, relativePath);
+            findings.push(...capFindings);
+            // SKILL-019: Stale Skill Signature
+            const signatureMatch = content.match(/<!-- opena2a-guard hash="sha256:([a-f0-9]+)" signed="([^"]+)"(?: expires_at="([^"]+)")? -->/);
+            if (signatureMatch) {
+                const storedHash = signatureMatch[1];
+                const signatureBlock = signatureMatch[0];
+                // Compute hash of content excluding the signature block
+                const contentWithoutSig = content.replace(signatureBlock, '').replace(/\n$/, '');
+                const computedHash = crypto.createHash('sha256').update(contentWithoutSig).digest('hex');
+                if (storedHash !== computedHash) {
+                    let skill019Fixed = false;
+                    if (autoFix) {
+                        const newHash = crypto.createHash('sha256').update(contentWithoutSig).digest('hex');
+                        const newDate = new Date().toISOString();
+                        const expiresAt = signatureMatch[3]
+                            ? ` expires_at="${new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString()}"`
+                            : '';
+                        const newSigBlock = `<!-- opena2a-guard hash="sha256:${newHash}" signed="${newDate}"${expiresAt} -->`;
+                        content = content.replace(signatureBlock, newSigBlock);
+                        await fs.writeFile(skillFile, content);
+                        skill019Fixed = true;
+                    }
+                    findings.push({
+                        checkId: 'SKILL-019',
+                        name: 'Stale Skill Signature',
+                        description: 'Skill content has changed since it was signed - signature hash mismatch',
+                        category: 'skill',
+                        severity: 'medium',
+                        passed: skill019Fixed,
+                        message: skill019Fixed
+                            ? 'Stale signature detected and re-signed'
+                            : 'Signature hash does not match current content - skill may have been tampered with',
+                        file: relativePath,
+                        fixable: true,
+                        fixed: skill019Fixed,
+                        fixMessage: skill019Fixed ? 'Re-computed hash and updated signature block' : undefined,
+                        fix: 'Re-sign the skill to update the hash: hackmyagent secure --fix',
+                    });
+                }
+                // HEARTBEAT-007: Expired Heartbeat (check expires_at in signature block)
+                if (signatureMatch[3]) {
+                    const expiresAt = new Date(signatureMatch[3]);
+                    const now = new Date();
+                    if (expiresAt < now) {
+                        let hb007Fixed = false;
+                        if (autoFix) {
+                            const contentWithoutSig = content.replace(signatureMatch[0], '').replace(/\n$/, '');
+                            const newHash = crypto.createHash('sha256').update(contentWithoutSig).digest('hex');
+                            const newDate = new Date().toISOString();
+                            const newExpiry = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString();
+                            const newSigBlock = `<!-- opena2a-guard hash="sha256:${newHash}" signed="${newDate}" expires_at="${newExpiry}" -->`;
+                            content = content.replace(signatureMatch[0], newSigBlock);
+                            await fs.writeFile(skillFile, content);
+                            hb007Fixed = true;
+                        }
+                        findings.push({
+                            checkId: 'HEARTBEAT-007',
+                            name: 'Expired Heartbeat',
+                            description: 'Skill signature has expired and needs renewal',
+                            category: 'skill',
+                            severity: 'high',
+                            passed: hb007Fixed,
+                            message: hb007Fixed
+                                ? 'Expired signature renewed with 7-day validity'
+                                : `Skill signature expired at ${signatureMatch[3]}`,
+                            file: relativePath,
+                            fixable: true,
+                            fixed: hb007Fixed,
+                            fixMessage: hb007Fixed ? 'Updated expiry to 7 days from now and re-signed' : undefined,
+                            fix: 'Re-sign the skill with a new expiry: hackmyagent secure --fix',
+                        });
+                    }
+                }
+            }
         }
         return findings;
     }
@@ -5452,6 +5611,824 @@ dist/
         }
         return findings;
     }
+    /**
+     * Recursively find source files (.ts, .js, .mjs, .cjs, .tsx, .jsx)
+     * Skips node_modules, dist, .git, and hidden directories
+     */
+    async findSourceFiles(dir, baseDir, depth = 0) {
+        if (depth > 10)
+            return [];
+        const sourceExtensions = new Set(['.ts', '.js', '.mjs', '.cjs', '.tsx', '.jsx']);
+        const skipDirs = new Set(['node_modules', 'dist', '.git']);
+        const files = [];
+        let entries;
+        try {
+            entries = await fs.readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            return files;
+        }
+        for (const entry of entries) {
+            const fullPath = path.join(dir, entry.name);
+            // Validate path is within directory (no path traversal)
+            if (!this.isPathWithinDirectory(fullPath, baseDir)) {
+                continue;
+            }
+            if (entry.isDirectory()) {
+                // Skip node_modules, dist, .git, and hidden directories
+                if (skipDirs.has(entry.name))
+                    continue;
+                if (entry.name.startsWith('.'))
+                    continue;
+                // Skip symlinks to prevent path traversal
+                try {
+                    const stats = await fs.lstat(fullPath);
+                    if (stats.isSymbolicLink())
+                        continue;
+                }
+                catch {
+                    continue;
+                }
+                const subFiles = await this.findSourceFiles(fullPath, baseDir, depth + 1);
+                files.push(...subFiles);
+            }
+            else if (entry.isFile()) {
+                const ext = path.extname(entry.name).toLowerCase();
+                if (sourceExtensions.has(ext)) {
+                    files.push(fullPath);
+                }
+            }
+        }
+        return files;
+    }
+    /**
+     * Walk a directory recursively and return files matching the given extensions.
+     * Skips node_modules, dist, .git, and hidden directories.
+     */
+    async walkDirectory(dir, extensions, depth = 0, maxDepth = 10) {
+        if (depth > maxDepth)
+            return [];
+        const extSet = new Set(extensions.map((e) => e.toLowerCase()));
+        const skipDirs = new Set(['node_modules', 'dist', '.git', '__pycache__', '.venv']);
+        const files = [];
+        let entries;
+        try {
+            entries = await fs.readdir(dir, { withFileTypes: true });
+        }
+        catch {
+            return files;
+        }
+        for (const entry of entries) {
+            const fullPath = path.join(dir, entry.name);
+            if (entry.isSymbolicLink())
+                continue;
+            if (entry.isDirectory()) {
+                if (skipDirs.has(entry.name))
+                    continue;
+                if (entry.name.startsWith('.'))
+                    continue;
+                const subFiles = await this.walkDirectory(fullPath, extensions, depth + 1, maxDepth);
+                files.push(...subFiles);
+            }
+            else if (entry.isFile()) {
+                const ext = path.extname(entry.name).toLowerCase();
+                if (extSet.has(ext)) {
+                    files.push(fullPath);
+                }
+            }
+        }
+        return files;
+    }
+    /**
+     * Check for memory/context poisoning risks
+     * Detects patterns that could allow attackers to poison agent memory or conversation context
+     */
+    async checkMemoryPoisoning(targetDir, _autoFix) {
+        const findings = [];
+        // MEM-001: Unvalidated memory persistence
+        // Check for memory/context files that accept external input without validation
+        const memoryFiles = ['memory.json', 'context.json', '.memory', 'agent-memory.json', 'conversation-history.json'];
+        for (const memFile of memoryFiles) {
+            const filePath = path.join(targetDir, memFile);
+            try {
+                const content = await fs.readFile(filePath, 'utf-8');
+                // Check if memory file is world-writable or contains unvalidated external refs
+                if (content.includes('$ref') || content.includes('__proto__') || content.includes('constructor')) {
+                    findings.push({
+                        checkId: 'MEM-001',
+                        name: 'Unvalidated memory persistence',
+                        description: 'Memory file contains prototype pollution vectors or unvalidated external references that could be exploited to inject malicious context',
+                        category: 'memory-poisoning',
+                        severity: 'high',
+                        passed: false,
+                        message: `Memory file ${memFile} contains potentially dangerous patterns ($ref, __proto__, constructor)`,
+                        fixable: false,
+                        file: memFile,
+                        fix: 'Sanitize all memory entries before persistence. Remove __proto__ and constructor keys. Validate $ref URIs.',
+                    });
+                }
+            }
+            catch { /* file doesn't exist - skip */ }
+        }
+        // MEM-002: No memory integrity verification
+        // Check if conversation/memory files have integrity checks
+        const configFiles = ['agent-config.json', 'config.json', 'settings.json', '.agent.json'];
+        for (const cfgFile of configFiles) {
+            const filePath = path.join(targetDir, cfgFile);
+            try {
+                const content = await fs.readFile(filePath, 'utf-8');
+                const config = JSON.parse(content);
+                if (config.memory || config.context || config.conversationHistory) {
+                    const hasIntegrity = config.memoryIntegrity || config.contextVerification ||
+                        config.memory?.signatureVerification || config.memory?.hashValidation;
+                    if (!hasIntegrity) {
+                        findings.push({
+                            checkId: 'MEM-002',
+                            name: 'No memory integrity verification',
+                            description: 'Agent configuration enables memory/context persistence without integrity verification. An attacker with file access could inject malicious context.',
+                            category: 'memory-poisoning',
+                            severity: 'medium',
+                            passed: false,
+                            message: `${cfgFile} enables memory persistence without integrity checks`,
+                            fixable: false,
+                            file: cfgFile,
+                            fix: 'Enable memory integrity verification: add hash validation or signature checks for persisted context.',
+                        });
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        // MEM-003: Context window overflow risk
+        // Check for agents that load large context without size limits
+        for (const cfgFile of configFiles) {
+            const filePath = path.join(targetDir, cfgFile);
+            try {
+                const content = await fs.readFile(filePath, 'utf-8');
+                const config = JSON.parse(content);
+                if (config.contextWindow || config.maxTokens || config.memory) {
+                    const hasLimits = config.maxContextSize || config.contextWindow?.maxSize ||
+                        config.memory?.maxEntries || config.memory?.maxSize;
+                    if (!hasLimits) {
+                        findings.push({
+                            checkId: 'MEM-003',
+                            name: 'No context size limits',
+                            description: 'Agent loads context/memory without size limits. An attacker could craft inputs that overflow the context window, pushing safety instructions out of scope.',
+                            category: 'memory-poisoning',
+                            severity: 'medium',
+                            passed: false,
+                            message: `${cfgFile} has no context size limits configured`,
+                            fixable: false,
+                            file: cfgFile,
+                            fix: 'Set explicit context size limits: maxContextSize, memory.maxEntries, or memory.maxSize.',
+                        });
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        // MEM-004: Shared memory without isolation
+        // Check for multi-agent setups with shared memory
+        const multiAgentFiles = ['agents.json', 'orchestrator.json', 'multi-agent.json', '.agents'];
+        for (const maFile of multiAgentFiles) {
+            const filePath = path.join(targetDir, maFile);
+            try {
+                const content = await fs.readFile(filePath, 'utf-8');
+                const config = JSON.parse(content);
+                const agents = config.agents || config.workers || [];
+                if (Array.isArray(agents) && agents.length > 1) {
+                    const sharedMem = config.sharedMemory || config.shared?.memory || config.commonContext;
+                    if (sharedMem) {
+                        const hasIsolation = sharedMem.isolation || sharedMem.sandboxed || sharedMem.perAgent;
+                        if (!hasIsolation) {
+                            findings.push({
+                                checkId: 'MEM-004',
+                                name: 'Shared memory without isolation',
+                                description: 'Multiple agents share memory without isolation boundaries. A compromised agent could poison the shared context to influence other agents.',
+                                category: 'memory-poisoning',
+                                severity: 'high',
+                                passed: false,
+                                message: `${maFile} configures shared memory for ${agents.length} agents without isolation`,
+                                fixable: false,
+                                file: maFile,
+                                fix: 'Enable memory isolation: set sharedMemory.isolation=true or use per-agent memory scopes.',
+                            });
+                        }
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        // MEM-005: Conversation history injection
+        // Check source files for patterns that build prompts from unvalidated history
+        try {
+            const srcDir = path.join(targetDir, 'src');
+            const srcExists = await fs.access(srcDir).then(() => true).catch(() => false);
+            if (srcExists) {
+                const files = await this.walkDirectory(srcDir, ['.ts', '.js', '.py', '.mjs']);
+                for (const file of files.slice(0, 50)) {
+                    try {
+                        const content = await fs.readFile(file, 'utf-8');
+                        const lines = content.split('\n');
+                        for (let i = 0; i < lines.length; i++) {
+                            const line = lines[i];
+                            // Detect direct concatenation of history into system prompts
+                            if ((line.includes('systemPrompt') || line.includes('system_prompt') || line.includes('system_message')) &&
+                                (line.includes('history') || line.includes('previousMessages') || line.includes('conversation'))) {
+                                if (!line.includes('sanitize') && !line.includes('validate') && !line.includes('filter')) {
+                                    findings.push({
+                                        checkId: 'MEM-005',
+                                        name: 'Conversation history injection',
+                                        description: 'System prompt includes unvalidated conversation history. An attacker could craft messages in history that inject instructions into the system prompt.',
+                                        category: 'memory-poisoning',
+                                        severity: 'high',
+                                        passed: false,
+                                        message: 'System prompt concatenates unvalidated conversation history',
+                                        fixable: false,
+                                        file: path.relative(targetDir, file),
+                                        line: i + 1,
+                                        fix: 'Sanitize conversation history before including in system prompts. Strip instruction-like patterns.',
+                                    });
+                                    break; // One finding per file
+                                }
+                            }
+                        }
+                    }
+                    catch { /* skip unreadable */ }
+                }
+            }
+        }
+        catch { /* skip */ }
+        return findings;
+    }
+    /**
+     * Check for RAG (Retrieval-Augmented Generation) poisoning risks
+     * Detects patterns that could allow attackers to inject malicious content into RAG pipelines
+     */
+    async checkRAGPoisoning(targetDir, _autoFix) {
+        const findings = [];
+        // RAG-001: Unvalidated retrieval sources
+        const ragConfigFiles = ['rag.json', 'retrieval.json', 'vector-store.json', 'embeddings.json'];
+        for (const ragFile of ragConfigFiles) {
+            const filePath = path.join(targetDir, ragFile);
+            try {
+                const content = await fs.readFile(filePath, 'utf-8');
+                const config = JSON.parse(content);
+                const sources = config.sources || config.dataSources || config.indices || [];
+                if (Array.isArray(sources)) {
+                    for (const source of sources) {
+                        const sourceUrl = source.url || source.endpoint || source.uri || '';
+                        if (sourceUrl && !source.verified && !source.trustedSource && !source.signatureCheck) {
+                            findings.push({
+                                checkId: 'RAG-001',
+                                name: 'Unvalidated RAG retrieval source',
+                                description: 'RAG pipeline retrieves from an unverified source. An attacker who controls the source could inject malicious content into agent responses.',
+                                category: 'rag-poisoning',
+                                severity: 'high',
+                                passed: false,
+                                message: `RAG source ${sourceUrl} has no verification or trust validation`,
+                                fixable: false,
+                                file: ragFile,
+                                fix: 'Add source verification: set trustedSource=true only for validated endpoints, or enable signatureCheck.',
+                            });
+                        }
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        // RAG-002: No content sanitization in retrieval pipeline
+        try {
+            const srcDir = path.join(targetDir, 'src');
+            const srcExists = await fs.access(srcDir).then(() => true).catch(() => false);
+            if (srcExists) {
+                const files = await this.walkDirectory(srcDir, ['.ts', '.js', '.py', '.mjs']);
+                for (const file of files.slice(0, 50)) {
+                    try {
+                        const content = await fs.readFile(file, 'utf-8');
+                        const lines = content.split('\n');
+                        for (let i = 0; i < lines.length; i++) {
+                            const line = lines[i];
+                            if ((line.includes('retrieve') || line.includes('vectorSearch') || line.includes('similarity_search') ||
+                                line.includes('query_engine')) &&
+                                (line.includes('context') || line.includes('prompt') || line.includes('augment'))) {
+                                // Check surrounding lines for sanitization
+                                const surroundingLines = lines.slice(Math.max(0, i - 3), Math.min(lines.length, i + 4)).join(' ');
+                                if (!surroundingLines.includes('sanitize') && !surroundingLines.includes('validate') &&
+                                    !surroundingLines.includes('filter') && !surroundingLines.includes('escape')) {
+                                    findings.push({
+                                        checkId: 'RAG-002',
+                                        name: 'No RAG content sanitization',
+                                        description: 'Retrieved content is passed to the LLM without sanitization. Poisoned documents could inject instructions into the prompt.',
+                                        category: 'rag-poisoning',
+                                        severity: 'high',
+                                        passed: false,
+                                        message: 'Retrieved content flows to LLM without sanitization',
+                                        fixable: false,
+                                        file: path.relative(targetDir, file),
+                                        line: i + 1,
+                                        fix: 'Sanitize retrieved content before including in prompts. Strip instruction-like patterns and markup.',
+                                    });
+                                    break;
+                                }
+                            }
+                        }
+                    }
+                    catch { /* skip */ }
+                }
+            }
+        }
+        catch { /* skip */ }
+        // RAG-003: Public-writable vector store
+        for (const ragFile of ragConfigFiles) {
+            const filePath = path.join(targetDir, ragFile);
+            try {
+                const content = await fs.readFile(filePath, 'utf-8');
+                const config = JSON.parse(content);
+                if (config.writeAccess === 'public' || config.allowPublicIngestion || config.openIngestion) {
+                    findings.push({
+                        checkId: 'RAG-003',
+                        name: 'Public-writable vector store',
+                        description: 'Vector store allows public write access. An attacker could insert poisoned documents that will be retrieved and influence agent responses.',
+                        category: 'rag-poisoning',
+                        severity: 'critical',
+                        passed: false,
+                        message: `${ragFile} allows public write access to vector store`,
+                        fixable: false,
+                        file: ragFile,
+                        fix: 'Restrict vector store write access. Require authentication for document ingestion.',
+                    });
+                }
+            }
+            catch { /* skip */ }
+        }
+        // RAG-004: No provenance tracking on retrieved content
+        for (const ragFile of ragConfigFiles) {
+            const filePath = path.join(targetDir, ragFile);
+            try {
+                const content = await fs.readFile(filePath, 'utf-8');
+                const config = JSON.parse(content);
+                if (config.sources || config.dataSources || config.indices) {
+                    if (!config.provenance && !config.sourceTracking && !config.metadata?.trackSource) {
+                        findings.push({
+                            checkId: 'RAG-004',
+                            name: 'No provenance tracking',
+                            description: 'RAG pipeline does not track provenance of retrieved content. Without provenance, poisoned content cannot be traced back to its source.',
+                            category: 'rag-poisoning',
+                            severity: 'medium',
+                            passed: false,
+                            message: `${ragFile} has no content provenance tracking`,
+                            fixable: false,
+                            file: ragFile,
+                            fix: 'Enable provenance tracking: set sourceTracking=true to track which source each document came from.',
+                        });
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        return findings;
+    }
+    /**
+     * Check for agent identity spoofing risks
+     * Detects missing or weak agent identity verification
+     */
+    async checkAgentIdentity(targetDir, _autoFix) {
+        const findings = [];
+        // AIM-001: No agent identity declaration
+        const identityFiles = ['agent-card.json', 'agent.json', '.well-known/agent.json', 'aim.json'];
+        let hasIdentity = false;
+        for (const idFile of identityFiles) {
+            const filePath = path.join(targetDir, idFile);
+            try {
+                await fs.access(filePath);
+                hasIdentity = true;
+                const content = await fs.readFile(filePath, 'utf-8');
+                const config = JSON.parse(content);
+                // AIM-002: Identity without cryptographic binding
+                if (config.agentId || config.name || config.identity) {
+                    if (!config.publicKey && !config.keyId && !config.jwk && !config.x509) {
+                        findings.push({
+                            checkId: 'AIM-002',
+                            name: 'Identity without cryptographic binding',
+                            description: 'Agent declares an identity but has no cryptographic key binding. Any agent could claim this identity without proof.',
+                            category: 'identity-spoofing',
+                            severity: 'high',
+                            passed: false,
+                            message: `${idFile} declares identity without cryptographic key binding`,
+                            fixable: false,
+                            file: idFile,
+                            fix: 'Bind agent identity to a cryptographic key pair. Add publicKey or keyId field to the agent card.',
+                        });
+                    }
+                }
+                // AIM-003: No identity verification endpoint
+                if (config.agentId || config.identity) {
+                    if (!config.verificationEndpoint && !config.oidcIssuer && !config.wellKnown) {
+                        findings.push({
+                            checkId: 'AIM-003',
+                            name: 'No identity verification endpoint',
+                            description: 'Agent identity has no verification endpoint. Other agents cannot verify this agent\'s identity claims.',
+                            category: 'identity-spoofing',
+                            severity: 'medium',
+                            passed: false,
+                            message: `${idFile} has no identity verification endpoint (verificationEndpoint, oidcIssuer, or wellKnown)`,
+                            fixable: false,
+                            file: idFile,
+                            fix: 'Add a verification endpoint: verificationEndpoint URL or oidcIssuer for federated identity.',
+                        });
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        // Also check package.json or A2A agent card
+        if (!hasIdentity) {
+            try {
+                const pkgPath = path.join(targetDir, 'package.json');
+                const pkgContent = await fs.readFile(pkgPath, 'utf-8');
+                const pkg = JSON.parse(pkgContent);
+                if (pkg.agentCard || pkg.a2a || pkg.keywords?.some((k) => k.includes('agent') || k.includes('a2a'))) {
+                    findings.push({
+                        checkId: 'AIM-001',
+                        name: 'No agent identity declaration',
+                        description: 'Project appears to be an AI agent but has no formal identity declaration. Without identity, the agent cannot be verified by other agents or registries.',
+                        category: 'identity-spoofing',
+                        severity: 'medium',
+                        passed: false,
+                        message: 'Agent project has no identity declaration file (agent-card.json, agent.json, aim.json)',
+                        fixable: false,
+                        file: 'package.json',
+                        fix: 'Create an agent-card.json with agentId, name, publicKey, and capabilities fields.',
+                    });
+                }
+            }
+            catch { /* skip */ }
+        }
+        return findings;
+    }
+    /**
+     * Check for agent DNA/behavioral fingerprint forgery risks
+     * Detects integrity issues with agent behavioral profiles
+     */
+    async checkAgentDNA(targetDir, _autoFix) {
+        const findings = [];
+        // DNA-001: No behavioral fingerprint
+        const dnaFiles = ['agent-dna.json', '.agent-dna', 'behavioral-profile.json'];
+        const soulFileNames = ['SOUL.md', 'system-prompt.md', '.cursorrules', 'CLAUDE.md'];
+        let hasDna = false;
+        let hasSoul = false;
+        let foundSoulFile = '';
+        for (const dnaFile of dnaFiles) {
+            try {
+                await fs.access(path.join(targetDir, dnaFile));
+                hasDna = true;
+                const content = await fs.readFile(path.join(targetDir, dnaFile), 'utf-8');
+                const config = JSON.parse(content);
+                // DNA-002: Unsigned behavioral profile
+                if (!config.signature && !config.hash && !config.contentHash) {
+                    findings.push({
+                        checkId: 'DNA-002',
+                        name: 'Unsigned behavioral profile',
+                        description: 'Agent DNA/behavioral profile exists but is not signed. An attacker could modify the profile to change agent behavior without detection.',
+                        category: 'agent-dna',
+                        severity: 'high',
+                        passed: false,
+                        message: `${dnaFile} has no signature or content hash`,
+                        fixable: false,
+                        file: dnaFile,
+                        fix: 'Sign the behavioral profile: add a contentHash (SHA-256) or signature field verified at startup.',
+                    });
+                }
+                // DNA-003: No behavioral drift detection
+                if (!config.baselineHash && !config.driftThreshold && !config.monitoringEnabled) {
+                    findings.push({
+                        checkId: 'DNA-003',
+                        name: 'No behavioral drift detection',
+                        description: 'Agent DNA has no drift detection configured. Gradual behavioral changes would go undetected.',
+                        category: 'agent-dna',
+                        severity: 'medium',
+                        passed: false,
+                        message: `${dnaFile} has no behavioral drift detection (baselineHash, driftThreshold, monitoring)`,
+                        fixable: false,
+                        file: dnaFile,
+                        fix: 'Enable behavioral drift detection: set baselineHash and driftThreshold for continuous monitoring.',
+                    });
+                }
+            }
+            catch { /* skip */ }
+        }
+        for (const soulFile of soulFileNames) {
+            try {
+                await fs.access(path.join(targetDir, soulFile));
+                hasSoul = true;
+                if (!foundSoulFile)
+                    foundSoulFile = soulFile;
+            }
+            catch { /* skip */ }
+        }
+        // If agent has a SOUL/system prompt but no DNA fingerprint
+        if (hasSoul && !hasDna) {
+            // Check if this is actually an agent project
+            try {
+                const pkgPath = path.join(targetDir, 'package.json');
+                const pkgContent = await fs.readFile(pkgPath, 'utf-8');
+                const pkg = JSON.parse(pkgContent);
+                if (pkg.agentCard || pkg.a2a || pkg.keywords?.some((k) => k.includes('agent'))) {
+                    findings.push({
+                        checkId: 'DNA-001',
+                        name: 'No behavioral fingerprint',
+                        description: 'Agent has behavioral instructions (SOUL.md/system prompt) but no behavioral fingerprint. Without a fingerprint, behavioral integrity cannot be verified.',
+                        category: 'agent-dna',
+                        severity: 'medium',
+                        passed: false,
+                        message: 'Agent has behavioral instructions but no DNA fingerprint file',
+                        fixable: false,
+                        file: foundSoulFile || 'SOUL.md',
+                        fix: 'Create agent-dna.json with contentHash of SOUL.md, baselineHash, and signature for integrity verification.',
+                    });
+                }
+            }
+            catch { /* skip */ }
+        }
+        return findings;
+    }
+    /**
+     * Check for skill-based memory manipulation risks
+     */
+    async checkSkillMemory(targetDir, _autoFix) {
+        const findings = [];
+        // SKILL-MEM-001: Skills with memory write access
+        // Check SKILL.md for memory manipulation patterns
+        try {
+            const skillMdPath = path.join(targetDir, 'SKILL.md');
+            const content = await fs.readFile(skillMdPath, 'utf-8');
+            const lowerContent = content.toLowerCase();
+            if ((lowerContent.includes('memory') || lowerContent.includes('context') || lowerContent.includes('state')) &&
+                (lowerContent.includes('write') || lowerContent.includes('modify') || lowerContent.includes('update') || lowerContent.includes('set'))) {
+                if (!lowerContent.includes('read-only') && !lowerContent.includes('readonly') && !lowerContent.includes('immutable')) {
+                    findings.push({
+                        checkId: 'SKILL-MEM-001',
+                        name: 'Skill with unrestricted memory access',
+                        description: 'A skill declares memory/context write capabilities without explicit restrictions. A malicious skill could manipulate agent memory to alter future behavior.',
+                        category: 'skill-memory',
+                        severity: 'high',
+                        passed: false,
+                        message: 'SKILL.md declares memory write access without read-only constraints',
+                        fixable: false,
+                        file: 'SKILL.md',
+                        fix: 'Restrict skill memory access: declare explicit read-only or scoped-write permissions in SKILL.md.',
+                    });
+                }
+            }
+        }
+        catch { /* no SKILL.md */ }
+        // Check skills directory for memory manipulation patterns
+        try {
+            const skillsDir = path.join(targetDir, 'skills');
+            const dirExists = await fs.access(skillsDir).then(() => true).catch(() => false);
+            if (dirExists) {
+                const files = await this.walkDirectory(skillsDir, ['.ts', '.js', '.py', '.md']);
+                for (const file of files.slice(0, 30)) {
+                    try {
+                        const content = await fs.readFile(file, 'utf-8');
+                        if ((content.includes('writeMemory') || content.includes('setContext') ||
+                            content.includes('updateState') || content.includes('persistMemory')) &&
+                            !content.includes('readOnly') && !content.includes('read_only')) {
+                            findings.push({
+                                checkId: 'SKILL-MEM-001',
+                                name: 'Skill with unrestricted memory access',
+                                description: 'Skill file contains memory write operations without read-only guards.',
+                                category: 'skill-memory',
+                                severity: 'high',
+                                passed: false,
+                                message: 'Skill writes to agent memory without restrictions',
+                                fixable: false,
+                                file: path.relative(targetDir, file),
+                                fix: 'Add read-only guards or scope memory writes to skill-specific namespaces.',
+                            });
+                            break; // One per skill dir
+                        }
+                    }
+                    catch { /* skip */ }
+                }
+            }
+        }
+        catch { /* skip */ }
+        return findings;
+    }
+    /**
+     * Check for Unicode steganography attacks (GlassWorm detection)
+     * Detects invisible codepoints, decoder patterns, eval on empty strings,
+     * and tag character block presence in source files.
+     */
+    async checkUnicodeSteganography(targetDir, _autoFix) {
+        const findings = [];
+        const sourceFiles = await this.findSourceFiles(targetDir, targetDir);
+        for (const filePath of sourceFiles) {
+            const relativePath = path.relative(targetDir, filePath);
+            let rawBuffer;
+            try {
+                rawBuffer = await fs.readFile(filePath);
+            }
+            catch {
+                continue;
+            }
+            // Skip files larger than MAX_FILE_SIZE
+            if (rawBuffer.length > MAX_FILE_SIZE)
+                continue;
+            // UNICODE-STEGO-001: Invisible Codepoint Detection
+            // Scan for variation selectors U+FE00-FE0F (UTF-8: EF B8 80-8F)
+            // and tag characters U+E0100-E01EF (UTF-8: F3 A0 84 80 - F3 A0 87 AF)
+            let hasVariationSelectors = false;
+            let variationSelectorLine = 1;
+            let hasTagCharsIn001 = false;
+            let tagCharLine001 = 1;
+            let currentLine = 1;
+            for (let i = 0; i < rawBuffer.length; i++) {
+                if (rawBuffer[i] === 0x0A) {
+                    currentLine++;
+                    continue;
+                }
+                // Variation selectors: EF B8 80-8F
+                if (rawBuffer[i] === 0xEF &&
+                    i + 2 < rawBuffer.length &&
+                    rawBuffer[i + 1] === 0xB8 &&
+                    rawBuffer[i + 2] >= 0x80 &&
+                    rawBuffer[i + 2] <= 0x8F) {
+                    if (!hasVariationSelectors) {
+                        hasVariationSelectors = true;
+                        variationSelectorLine = currentLine;
+                    }
+                }
+                // Tag characters in U+E0100-E01EF: F3 A0 84 80 through F3 A0 87 AF
+                if (rawBuffer[i] === 0xF3 &&
+                    i + 2 < rawBuffer.length &&
+                    rawBuffer[i + 1] === 0xA0 &&
+                    rawBuffer[i + 2] >= 0x84 &&
+                    rawBuffer[i + 2] <= 0x87) {
+                    if (!hasTagCharsIn001) {
+                        hasTagCharsIn001 = true;
+                        tagCharLine001 = currentLine;
+                    }
+                }
+            }
+            if (hasVariationSelectors || hasTagCharsIn001) {
+                const detectedTypes = [];
+                if (hasVariationSelectors)
+                    detectedTypes.push('variation selectors (U+FE00-FE0F)');
+                if (hasTagCharsIn001)
+                    detectedTypes.push('tag characters (U+E0100-E01EF)');
+                findings.push({
+                    checkId: 'UNICODE-STEGO-001',
+                    name: 'Invisible Unicode Codepoints Detected',
+                    description: 'Source file contains invisible Unicode codepoints that can hide malicious payloads (GlassWorm attack vector)',
+                    category: 'unicode-stego',
+                    severity: 'critical',
+                    passed: false,
+                    message: `Found ${detectedTypes.join(' and ')} in ${relativePath}`,
+                    file: relativePath,
+                    line: hasVariationSelectors ? variationSelectorLine : tagCharLine001,
+                    fixable: false,
+                    fix: 'Inspect the file with a hex editor (e.g., xxd) to identify and remove invisible Unicode codepoints. Run: xxd ' + relativePath + ' | grep -E "fe0[0-9a-f]|f3a0"',
+                });
+            }
+            // UNICODE-STEGO-002: GlassWorm Decoder Pattern
+            // Detect .codePointAt( combined with hex literals in the variation selector or tag range
+            const content = rawBuffer.toString('utf-8');
+            const lines = content.split('\n');
+            let hasCodePointAt = false;
+            let hasHexLiteral = false;
+            let decoderLine = 1;
+            const hexPattern = /0x(?:FE0[0-9A-Fa-f]|fe0[0-9a-f]|E010[0-9A-Fa-f]|e010[0-9a-f]|E01[0-9A-Ea-e][0-9A-Fa-f]|e01[0-9a-e][0-9a-f])/;
+            for (let i = 0; i < lines.length; i++) {
+                const line = lines[i];
+                if (line.length > MAX_LINE_LENGTH)
+                    continue;
+                if (line.includes('.codePointAt(')) {
+                    hasCodePointAt = true;
+                    if (!decoderLine || decoderLine === 1)
+                        decoderLine = i + 1;
+                }
+                if (hexPattern.test(line)) {
+                    hasHexLiteral = true;
+                }
+            }
+            if (hasCodePointAt && hasHexLiteral) {
+                findings.push({
+                    checkId: 'UNICODE-STEGO-002',
+                    name: 'GlassWorm Decoder Pattern Detected',
+                    description: 'Source file contains .codePointAt() usage combined with Unicode variation selector or tag character hex literals - this is the decoder half of a GlassWorm attack',
+                    category: 'unicode-stego',
+                    severity: 'critical',
+                    passed: false,
+                    message: `Found GlassWorm decoder pattern (.codePointAt + hex range literals) in ${relativePath}`,
+                    file: relativePath,
+                    line: decoderLine,
+                    fixable: false,
+                    fix: 'Review the file for suspicious .codePointAt() logic that decodes hidden data from variation selectors (0xFE00-0xFE0F) or tag characters (0xE0100-0xE01EF). Remove the decoder function and audit the file for tampering.',
+                });
+            }
+            // UNICODE-STEGO-003: Eval on Empty String
+            // Find eval() or Function() calls where the string argument has few visible chars but many bytes
+            const evalPattern = /(?:eval|Function)\s*\(\s*(['"`])([\s\S]*?)\1\s*\)/g;
+            let evalMatch;
+            while ((evalMatch = evalPattern.exec(content)) !== null) {
+                const matchedStr = evalMatch[2];
+                // Count truly visible characters by excluding invisible Unicode ranges:
+                // - Control characters (U+0000-001F, U+007F-009F)
+                // - Variation selectors (U+FE00-FE0F)
+                // - Zero-width characters (U+200B-200F, U+2060, U+FEFF)
+                // - Tag characters (U+E0000-E01EF)
+                // - Combining marks and other invisible codepoints
+                let visibleChars = 0;
+                for (const ch of matchedStr) {
+                    const cp = ch.codePointAt(0);
+                    if (cp <= 0x1F)
+                        continue; // C0 controls
+                    if (cp >= 0x7F && cp <= 0x9F)
+                        continue; // C1 controls
+                    if (cp >= 0x200B && cp <= 0x200F)
+                        continue; // zero-width chars
+                    if (cp === 0x2060 || cp === 0xFEFF)
+                        continue; // word joiner, BOM
+                    if (cp >= 0xFE00 && cp <= 0xFE0F)
+                        continue; // variation selectors
+                    if (cp >= 0xE0000 && cp <= 0xE01EF)
+                        continue; // tag characters
+                    if (cp >= 0xE0100 && cp <= 0xE01EF)
+                        continue; // variation selector supplement
+                    visibleChars++;
+                }
+                const byteLength = Buffer.byteLength(matchedStr, 'utf-8');
+                if (visibleChars < 5 && byteLength > 100) {
+                    // Find the line number
+                    const offset = evalMatch.index;
+                    let evalLine = 1;
+                    for (let j = 0; j < offset && j < content.length; j++) {
+                        if (content[j] === '\n')
+                            evalLine++;
+                    }
+                    findings.push({
+                        checkId: 'UNICODE-STEGO-003',
+                        name: 'Eval on String with Hidden Payload',
+                        description: 'eval() or Function() is called with a string that has very few visible characters but a large byte footprint - indicates invisible Unicode payload',
+                        category: 'unicode-stego',
+                        severity: 'critical',
+                        passed: false,
+                        message: `Found eval/Function with ${visibleChars} visible chars but ${byteLength} bytes in ${relativePath}`,
+                        file: relativePath,
+                        line: evalLine,
+                        fixable: false,
+                        fix: 'Remove the eval/Function call and inspect the string argument with a hex editor. The string likely contains invisible Unicode characters encoding a malicious payload. Run: node -e "const fs=require(\'fs\'); const s=fs.readFileSync(\'' + relativePath + '\',\'utf8\'); console.log([...s].filter(c=>c.codePointAt(0)>0x200).map(c=>c.codePointAt(0).toString(16)))"',
+                    });
+                    break; // One finding per file
+                }
+            }
+            // UNICODE-STEGO-004: Tag Character Block Presence
+            // Scan for any U+E0000-U+E01EF characters (broader than 001, covers entire tag block)
+            // UTF-8 encoding: F3 A0 80 80 through F3 A0 87 AF
+            let hasTagBlock = false;
+            let tagBlockLine = 1;
+            currentLine = 1;
+            for (let i = 0; i < rawBuffer.length; i++) {
+                if (rawBuffer[i] === 0x0A) {
+                    currentLine++;
+                    continue;
+                }
+                if (rawBuffer[i] === 0xF3 &&
+                    i + 3 < rawBuffer.length &&
+                    rawBuffer[i + 1] === 0xA0 &&
+                    rawBuffer[i + 2] >= 0x80 &&
+                    rawBuffer[i + 2] <= 0x87) {
+                    hasTagBlock = true;
+                    tagBlockLine = currentLine;
+                    break;
+                }
+            }
+            if (hasTagBlock) {
+                // Only add UNICODE-STEGO-004 if we did not already flag tag chars in 001
+                // (004 is broader - covers U+E0000-U+E01EF, 001 only covers U+E0100-E01EF)
+                const already001 = findings.some((f) => f.checkId === 'UNICODE-STEGO-001' && f.file === relativePath);
+                if (!already001) {
+                    findings.push({
+                        checkId: 'UNICODE-STEGO-004',
+                        name: 'Unicode Tag Character Block Detected',
+                        description: 'Source file contains characters from the Unicode Tag block (U+E0000-U+E01EF) which have no visible rendering and can be used to hide data',
+                        category: 'unicode-stego',
+                        severity: 'high',
+                        passed: false,
+                        message: `Found Unicode tag block characters in ${relativePath}`,
+                        file: relativePath,
+                        line: tagBlockLine,
+                        fixable: false,
+                        fix: 'Inspect the file with a hex editor to identify tag block characters (byte sequence starting with F3 A0). These characters are invisible and have no legitimate use in source code. Run: xxd ' + relativePath + ' | grep "f3a0"',
+                    });
+                }
+            }
+        }
+        return findings;
+    }
 }
 exports.HardeningScanner = HardeningScanner;
 // Files that may be created or modified during auto-fix