hackmyagent 0.11.3 → 0.11.5

package/dist/hardening/scanner.js

@@ -104,6 +104,8 @@ const CHECK_PROJECT_TYPES = {
     'DNA-': ['all'],
     // Skill memory manipulation checks
     'SKILL-MEM-': ['openclaw', 'mcp'],
+    // NemoClaw/sandbox static analysis checks
+    'NEMO-': ['all'],
 };
 // Patterns for detecting exposed credentials
 // Each pattern is carefully tuned to minimize false positives
@@ -218,6 +220,11 @@ const SEVERITY_WEIGHTS = {
 };
 const MAX_FILE_SIZE = 10 * 1024 * 1024; // 10MB max file size to prevent memory exhaustion
 const MAX_LINE_LENGTH = 10000; // 10KB max line length for regex safety
+/** Shell-escape a string for safe interpolation into advisory fix commands. */
+function shellEscape(s) {
+    // Wrap in single quotes and escape embedded single quotes: ' -> '\''
+    return "'" + s.replace(/'/g, "'\\''") + "'";
+}
 class HardeningScanner {
     constructor() {
         this.cliName = 'hackmyagent';
@@ -378,6 +385,9 @@ class HardeningScanner {
         // Skill memory manipulation checks
         const skillMemFindings = await this.checkSkillMemory(targetDir, shouldFix);
         findings.push(...skillMemFindings);
+        // NemoClaw codebase pattern checks
+        const nemoFindings = await this.checkNemoClawPatterns(targetDir, shouldFix);
+        findings.push(...nemoFindings);
         // Enrich findings with attack taxonomy mapping
         (0, taxonomy_1.enrichWithTaxonomy)(findings);
         // Layer 2: Structural analysis (always on)
@@ -3756,7 +3766,7 @@ dist/
             await fs.access(backupBaseDir);
         }
         catch {
-            throw new Error('No backup found. Run hackmyagent harden --fix <dir> first to create a backup.');
+            throw new Error('No backup found. Run hackmyagent secure --fix <dir> first to create a backup.');
         }
         // Find the most recent backup
         const backups = await fs.readdir(backupBaseDir);
@@ -3765,7 +3775,7 @@ dist/
             .sort()
             .reverse();
         if (sortedBackups.length === 0) {
-            throw new Error('No backup found. Run hackmyagent harden --fix <dir> first to create a backup.');
+            throw new Error('No backup found. Run hackmyagent secure --fix <dir> first to create a backup.');
         }
         const latestBackup = sortedBackups[0];
         const backupDir = path.join(backupBaseDir, latestBackup);
@@ -4883,8 +4893,8 @@ dist/
                 if (!this.isPathWithinDirectory(fullPath, targetDir)) {
                     continue;
                 }
-                // Skip node_modules and .git directories
-                if (entryName === 'node_modules' || entryName === '.git') {
+                // Skip node_modules, .git, and backup directories
+                if (entryName === 'node_modules' || entryName === '.git' || entryName === '.hackmyagent-backup') {
                     continue;
                 }
                 let stat;
@@ -6224,7 +6234,9 @@ dist/
      */
     async checkUnicodeSteganography(targetDir, _autoFix) {
         const findings = [];
-        const sourceFiles = await this.findSourceFiles(targetDir, targetDir);
+        // Scan expanded file types beyond JS/TS (configs, docs, and Python are attack surfaces too)
+        const stegoExtensions = ['.ts', '.js', '.mjs', '.cjs', '.tsx', '.jsx', '.py', '.md', '.txt', '.yaml', '.yml', '.json', '.toml'];
+        const sourceFiles = await this.walkDirectory(targetDir, stegoExtensions);
         for (const filePath of sourceFiles) {
             const relativePath = path.relative(targetDir, filePath);
             let rawBuffer;
@@ -6238,12 +6250,22 @@ dist/
             if (rawBuffer.length > MAX_FILE_SIZE)
                 continue;
             // UNICODE-STEGO-001: Invisible Codepoint Detection
-            // Scan for variation selectors U+FE00-FE0F (UTF-8: EF B8 80-8F)
-            // and tag characters U+E0100-E01EF (UTF-8: F3 A0 84 80 - F3 A0 87 AF)
+            // Scan for:
+            //   - Variation selectors U+FE00-FE0F (UTF-8: EF B8 80-8F)
+            //   - Tag characters U+E0100-E01EF (UTF-8: F3 A0 84 80 - F3 A0 87 AF)
+            //   - Zero-width chars: U+200B (E2 80 8B), U+200C (E2 80 8C), U+200D (E2 80 8D)
+            //   - Mid-file BOM: U+FEFF (EF BB BF) -- skip offset 0
+            //   - Bidi overrides: U+202A-202E (E2 80 AA-AE), U+2066-2069 (E2 81 A6-A9)
             let hasVariationSelectors = false;
             let variationSelectorLine = 1;
             let hasTagCharsIn001 = false;
             let tagCharLine001 = 1;
+            let hasZeroWidth = false;
+            let zeroWidthLine = 1;
+            let hasMidFileBom = false;
+            let midFileBomLine = 1;
+            let hasBidiOverride = false;
+            let bidiOverrideLine = 1;
             let currentLine = 1;
             for (let i = 0; i < rawBuffer.length; i++) {
                 if (rawBuffer[i] === 0x0A) {
@@ -6272,25 +6294,86 @@ dist/
                         tagCharLine001 = currentLine;
                     }
                 }
+                // Zero-width chars: U+200B/200C/200D = E2 80 8B/8C/8D
+                if (rawBuffer[i] === 0xE2 &&
+                    i + 2 < rawBuffer.length &&
+                    rawBuffer[i + 1] === 0x80 &&
+                    rawBuffer[i + 2] >= 0x8B &&
+                    rawBuffer[i + 2] <= 0x8D) {
+                    if (!hasZeroWidth) {
+                        hasZeroWidth = true;
+                        zeroWidthLine = currentLine;
+                    }
+                }
+                // Mid-file BOM: U+FEFF = EF BB BF (skip if at offset 0)
+                if (i > 0 &&
+                    rawBuffer[i] === 0xEF &&
+                    i + 2 < rawBuffer.length &&
+                    rawBuffer[i + 1] === 0xBB &&
+                    rawBuffer[i + 2] === 0xBF) {
+                    if (!hasMidFileBom) {
+                        hasMidFileBom = true;
+                        midFileBomLine = currentLine;
+                    }
+                }
+                // Bidi overrides: U+202A-202E = E2 80 AA-AE
+                if (rawBuffer[i] === 0xE2 &&
+                    i + 2 < rawBuffer.length &&
+                    rawBuffer[i + 1] === 0x80 &&
+                    rawBuffer[i + 2] >= 0xAA &&
+                    rawBuffer[i + 2] <= 0xAE) {
+                    if (!hasBidiOverride) {
+                        hasBidiOverride = true;
+                        bidiOverrideLine = currentLine;
+                    }
+                }
+                // Bidi isolates: U+2066-2069 = E2 81 A6-A9
+                if (rawBuffer[i] === 0xE2 &&
+                    i + 2 < rawBuffer.length &&
+                    rawBuffer[i + 1] === 0x81 &&
+                    rawBuffer[i + 2] >= 0xA6 &&
+                    rawBuffer[i + 2] <= 0xA9) {
+                    if (!hasBidiOverride) {
+                        hasBidiOverride = true;
+                        bidiOverrideLine = currentLine;
+                    }
+                }
             }
-            if (hasVariationSelectors || hasTagCharsIn001) {
+            // Bidi and variation/tag chars are critical; zero-width-only is high
+            const hasCriticalInvisible = hasVariationSelectors || hasTagCharsIn001 || hasBidiOverride;
+            const hasAnyInvisible = hasCriticalInvisible || hasZeroWidth || hasMidFileBom;
+            if (hasAnyInvisible) {
                 const detectedTypes = [];
                 if (hasVariationSelectors)
                     detectedTypes.push('variation selectors (U+FE00-FE0F)');
                 if (hasTagCharsIn001)
                     detectedTypes.push('tag characters (U+E0100-E01EF)');
+                if (hasZeroWidth)
+                    detectedTypes.push('zero-width characters (U+200B-200D)');
+                if (hasMidFileBom)
+                    detectedTypes.push('mid-file BOM (U+FEFF)');
+                if (hasBidiOverride)
+                    detectedTypes.push('bidi overrides (U+202A-202E, U+2066-2069)');
+                // Determine first line hit for reporting
+                const firstLine = Math.min(...[
+                    hasVariationSelectors ? variationSelectorLine : Infinity,
+                    hasTagCharsIn001 ? tagCharLine001 : Infinity,
+                    hasZeroWidth ? zeroWidthLine : Infinity,
+                    hasMidFileBom ? midFileBomLine : Infinity,
+                    hasBidiOverride ? bidiOverrideLine : Infinity,
+                ]);
                 findings.push({
                     checkId: 'UNICODE-STEGO-001',
                     name: 'Invisible Unicode Codepoints Detected',
                     description: 'Source file contains invisible Unicode codepoints that can hide malicious payloads (GlassWorm attack vector)',
                     category: 'unicode-stego',
-                    severity: 'critical',
+                    severity: hasCriticalInvisible ? 'critical' : 'high',
                     passed: false,
                     message: `Found ${detectedTypes.join(' and ')} in ${relativePath}`,
                     file: relativePath,
-                    line: hasVariationSelectors ? variationSelectorLine : tagCharLine001,
+                    line: firstLine,
                     fixable: false,
-                    fix: 'Inspect the file with a hex editor (e.g., xxd) to identify and remove invisible Unicode codepoints. Run: xxd ' + relativePath + ' | grep -E "fe0[0-9a-f]|f3a0"',
+                    fix: 'Inspect the file with a hex editor (e.g., xxd) to identify and remove invisible Unicode codepoints. Run: xxd ' + shellEscape(relativePath) + ' | grep -iE "e280[8-9a-e]|efbb|efb8|f3a0"',
                 });
             }
             // UNICODE-STEGO-002: GlassWorm Decoder Pattern
@@ -6380,7 +6463,7 @@ dist/
                         file: relativePath,
                         line: evalLine,
                         fixable: false,
-                        fix: 'Remove the eval/Function call and inspect the string argument with a hex editor. The string likely contains invisible Unicode characters encoding a malicious payload. Run: node -e "const fs=require(\'fs\'); const s=fs.readFileSync(\'' + relativePath + '\',\'utf8\'); console.log([...s].filter(c=>c.codePointAt(0)>0x200).map(c=>c.codePointAt(0).toString(16)))"',
+                        fix: 'Remove the eval/Function call and inspect the string argument with a hex editor. The string likely contains invisible Unicode characters encoding a malicious payload. Run: node -e "const fs=require(\'fs\'); const s=fs.readFileSync(' + JSON.stringify(relativePath) + ',\'utf8\'); console.log([...s].filter(c=>c.codePointAt(0)>0x200).map(c=>c.codePointAt(0).toString(16)))"',
                     });
                     break; // One finding per file
                 }
@@ -6422,10 +6505,654 @@ dist/
                         file: relativePath,
                         line: tagBlockLine,
                         fixable: false,
-                        fix: 'Inspect the file with a hex editor to identify tag block characters (byte sequence starting with F3 A0). These characters are invisible and have no legitimate use in source code. Run: xxd ' + relativePath + ' | grep "f3a0"',
+                        fix: 'Inspect the file with a hex editor to identify tag block characters (byte sequence starting with F3 A0). These characters are invisible and have no legitimate use in source code. Run: xxd ' + shellEscape(relativePath) + ' | grep "f3a0"',
                     });
                 }
             }
+            // UNICODE-STEGO-005: Homoglyph Confusable Detection
+            // Detect Cyrillic/Greek characters that look identical to Latin but have different codepoints.
+            // These can be used to bypass code review and hide malicious identifiers.
+            const homoglyphCodepoints = new Set([
+                // Cyrillic uppercase that look like Latin: A, B, C, E, H, K, M, O, P, T, X
+                0x0410, 0x0412, 0x0421, 0x0415, 0x041D, 0x041A, 0x041C, 0x041E, 0x0420, 0x0422, 0x0425,
+                // Cyrillic lowercase that look like Latin: a, e, o, p, c, x
+                0x0430, 0x0435, 0x043E, 0x0440, 0x0441, 0x0445,
+                // Fullwidth Latin (U+FF21-FF3A, U+FF41-FF5A) -- spot-check common ones
+                0xFF21, 0xFF22, 0xFF41, 0xFF42,
+            ]);
+            let homoglyphFound = false;
+            let homoglyphLine = 1;
+            let homoglyphChar = '';
+            const contentForHomoglyph = content || rawBuffer.toString('utf-8');
+            const homoglyphLines = contentForHomoglyph.split('\n');
+            for (let lineIdx = 0; lineIdx < homoglyphLines.length; lineIdx++) {
+                const line = homoglyphLines[lineIdx];
+                if (line.length > MAX_LINE_LENGTH)
+                    continue;
+                // Skip comment lines
+                const trimmed = line.trimStart();
+                if (trimmed.startsWith('//') || trimmed.startsWith('#') || trimmed.startsWith('*'))
+                    continue;
+                for (const ch of line) {
+                    const cp = ch.codePointAt(0);
+                    if (homoglyphCodepoints.has(cp)) {
+                        homoglyphFound = true;
+                        homoglyphLine = lineIdx + 1;
+                        homoglyphChar = `U+${cp.toString(16).toUpperCase().padStart(4, '0')}`;
+                        break;
+                    }
+                }
+                if (homoglyphFound)
+                    break;
+            }
+            if (homoglyphFound) {
+                findings.push({
+                    checkId: 'UNICODE-STEGO-005',
+                    name: 'Homoglyph Confusable Characters Detected',
+                    description: 'Source file contains characters from non-Latin scripts (Cyrillic, Greek, Fullwidth) that visually resemble Latin letters. These can be used to create identifiers that look identical in code review but behave differently at runtime.',
+                    category: 'unicode-stego',
+                    severity: 'high',
+                    passed: false,
+                    message: `Found homoglyph confusable character (${homoglyphChar}) in ${relativePath} at line ${homoglyphLine}`,
+                    file: relativePath,
+                    line: homoglyphLine,
+                    fixable: false,
+                    fix: 'Inspect the file for characters that look like Latin letters but are actually Cyrillic, Greek, or Fullwidth. Replace them with their ASCII equivalents. Run: node -e "const fs=require(\'fs\'); [...fs.readFileSync(' + JSON.stringify(relativePath) + ',\'utf8\')].forEach((c,i)=>{const cp=c.codePointAt(0); if(cp>0x7F && cp<0xFFFF) console.log(i, cp.toString(16), c)})"',
+                });
+            }
+        }
+        return findings;
+    }
+    /**
+     * NemoClaw static analysis checks (NEMO-001 through NEMO-010)
+     * Detects vulnerability patterns in any codebase: unsafe installs, missing
+     * digest verification, injection vectors, secret leaks, deserialization, and
+     * egress policy gaps.
+     */
+    async checkNemoClawPatterns(targetDir, _shouldFix) {
+        const findings = [];
+        // Collect source files by extension (max depth 5, skips node_modules/.git/dist/build)
+        const shFiles = await this.walkDirectory(targetDir, ['.sh'], 0, 5);
+        const tsJsFiles = await this.walkDirectory(targetDir, ['.ts', '.js'], 0, 5);
+        const pyFiles = await this.walkDirectory(targetDir, ['.py'], 0, 5);
+        const yamlFiles = await this.walkDirectory(targetDir, ['.yaml', '.yml'], 0, 5);
+        // Cap file counts to avoid scanning enormous repos
+        const maxFiles = 200;
+        const cappedSh = shFiles.slice(0, maxFiles);
+        const cappedTsJs = tsJsFiles.slice(0, maxFiles);
+        const cappedPy = pyFiles.slice(0, maxFiles);
+        const cappedYaml = yamlFiles.slice(0, maxFiles);
+        // ---------- NEMO-001: Curl-pipe install without checksum ----------
+        let nemo001Found = false;
+        for (const file of cappedSh) {
+            try {
+                const content = await fs.readFile(file, 'utf-8');
+                const lines = content.split('\n');
+                for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    if (/curl.*\|\s*(ba)?sh/i.test(line) || /curl.*\|\s*sudo/i.test(line)) {
+                        // Check surrounding 20 lines for checksum verification
+                        const windowStart = Math.max(0, i - 10);
+                        const windowEnd = Math.min(lines.length, i + 11);
+                        const window = lines.slice(windowStart, windowEnd).join('\n').toLowerCase();
+                        if (!window.includes('sha256') && !window.includes('checksum') && !window.includes('gpg --verify')) {
+                            nemo001Found = true;
+                            findings.push({
+                                checkId: 'NEMO-001',
+                                name: 'Curl-pipe install without checksum',
+                                description: 'A shell script pipes curl output directly into a shell interpreter without verifying a checksum or GPG signature. An attacker who compromises the remote host can inject arbitrary code.',
+                                category: 'nemo-install',
+                                severity: 'critical',
+                                passed: false,
+                                message: `Curl-pipe install without integrity check at line ${i + 1}`,
+                                fixable: false,
+                                file: path.relative(targetDir, file),
+                                line: i + 1,
+                                fix: 'Download to temp file, verify checksum, then execute: curl -o /tmp/install.sh URL && echo "EXPECTED_SHA256 /tmp/install.sh" | sha256sum -c && bash /tmp/install.sh',
+                            });
+                        }
+                    }
+                }
+            }
+            catch { /* skip unreadable */ }
+        }
+        if (!nemo001Found && cappedSh.length > 0) {
+            findings.push({
+                checkId: 'NEMO-001',
+                name: 'Curl-pipe install without checksum',
+                description: 'No curl-pipe-to-shell patterns found without checksum verification.',
+                category: 'nemo-install',
+                severity: 'critical',
+                passed: true,
+                message: 'No unsafe curl-pipe installs detected',
+                fixable: false,
+            });
+        }
+        // ---------- NEMO-002: Blueprint/artifact digest verification gap ----------
+        let nemo002Found = false;
+        // Check YAML files for empty digest fields
+        for (const file of cappedYaml) {
+            try {
+                const content = await fs.readFile(file, 'utf-8');
+                const lines = content.split('\n');
+                for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    if (/digest:\s*["']?\s*["']?\s*$/.test(line) || /digest:\s*["']{2}/.test(line)) {
+                        nemo002Found = true;
+                        findings.push({
+                            checkId: 'NEMO-002',
+                            name: 'Empty digest field in blueprint/artifact',
+                            description: 'A YAML manifest declares a digest field with an empty value. Artifacts without digests cannot be verified for integrity, enabling supply-chain injection.',
+                            category: 'nemo-integrity',
+                            severity: 'critical',
+                            passed: false,
+                            message: `Empty digest field at line ${i + 1}`,
+                            fixable: false,
+                            file: path.relative(targetDir, file),
+                            line: i + 1,
+                            fix: 'Require non-empty digest; fail verification if digest is missing. Compute with: sha256sum <artifact>',
+                        });
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        // Check TS/JS files for digest skip logic
+        for (const file of cappedTsJs) {
+            try {
+                const content = await fs.readFile(file, 'utf-8');
+                const lines = content.split('\n');
+                for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    if (/if\s*\(\s*!?.*digest\s*&&/.test(line) || /if\s*\(\s*!.*digest\s*\)/.test(line)) {
+                        nemo002Found = true;
+                        findings.push({
+                            checkId: 'NEMO-002',
+                            name: 'Digest verification skipped on falsy value',
+                            description: 'Code skips digest verification when the digest field is falsy. An attacker who removes the digest from a manifest bypasses integrity checks entirely.',
+                            category: 'nemo-integrity',
+                            severity: 'critical',
+                            passed: false,
+                            message: `Digest verification skipped when falsy at line ${i + 1}`,
+                            fixable: false,
+                            file: path.relative(targetDir, file),
+                            line: i + 1,
+                            fix: 'Require non-empty digest; fail verification if digest is missing instead of skipping the check.',
+                        });
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        if (!nemo002Found && (cappedYaml.length > 0 || cappedTsJs.length > 0)) {
+            findings.push({
+                checkId: 'NEMO-002',
+                name: 'Blueprint/artifact digest verification gap',
+                description: 'No empty digest fields or digest-skip logic found.',
+                category: 'nemo-integrity',
+                severity: 'critical',
+                passed: true,
+                message: 'No digest verification gaps detected',
+                fixable: false,
+            });
+        }
+        // ---------- NEMO-003: Hot-reload policy paths reachable from user input ----------
+        let nemo003Found = false;
+        for (const file of cappedTsJs) {
+            try {
+                const content = await fs.readFile(file, 'utf-8');
+                const lines = content.split('\n');
+                for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    if (/policy.*reload|reload.*policy|hot.*reload/i.test(line)) {
+                        // Check surrounding 10 lines for user input references
+                        const windowStart = Math.max(0, i - 5);
+                        const windowEnd = Math.min(lines.length, i + 6);
+                        const window = lines.slice(windowStart, windowEnd).join('\n');
+                        if (/req\.|request\.|input\.|user\./i.test(window)) {
+                            nemo003Found = true;
+                            findings.push({
+                                checkId: 'NEMO-003',
+                                name: 'Hot-reload policy path reachable from user input',
+                                description: 'A policy reload mechanism is within code proximity of user input handling. An attacker could trigger policy changes through crafted requests.',
+                                category: 'nemo-policy',
+                                severity: 'high',
+                                passed: false,
+                                message: `Policy reload near user input handling at line ${i + 1}`,
+                                fixable: false,
+                                file: path.relative(targetDir, file),
+                                line: i + 1,
+                                fix: 'Gate policy reload behind operator authentication, not agent output or user requests.',
+                            });
+                        }
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        if (!nemo003Found && cappedTsJs.length > 0) {
+            findings.push({
+                checkId: 'NEMO-003',
+                name: 'Hot-reload policy paths reachable from user input',
+                description: 'No policy reload paths reachable from user input found.',
+                category: 'nemo-policy',
+                severity: 'high',
+                passed: true,
+                message: 'No unsafe policy reload paths detected',
+                fixable: false,
+            });
+        }
+        // ---------- NEMO-004: API key passed as CLI argument ----------
+        let nemo004Found = false;
+        const nemo004Files = [...cappedTsJs, ...cappedPy];
+        for (const file of nemo004Files) {
+            try {
+                const content = await fs.readFile(file, 'utf-8');
+                const lines = content.split('\n');
+                for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    if (/--credential.*\$\{.*key/i.test(line) ||
+                        /--api-key.*\$\{/i.test(line) ||
+                        /--token.*\$\{/i.test(line) ||
+                        /execSync.*--credential/i.test(line) ||
+                        /spawn.*--credential/i.test(line) ||
+                        /subprocess.*--credential/i.test(line)) {
+                        nemo004Found = true;
+                        findings.push({
+                            checkId: 'NEMO-004',
+                            name: 'API key passed as CLI argument',
+                            description: 'Credentials are passed as command-line arguments to a subprocess. CLI arguments are visible in process listings (ps aux) and shell history.',
+                            category: 'nemo-secrets',
+                            severity: 'high',
+                            passed: false,
+                            message: `Credential passed as CLI argument at line ${i + 1}`,
+                            fixable: false,
+                            file: path.relative(targetDir, file),
+                            line: i + 1,
+                            fix: 'Pass credentials via environment variables or stdin, not command-line arguments.',
+                        });
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        if (!nemo004Found && nemo004Files.length > 0) {
+            findings.push({
+                checkId: 'NEMO-004',
+                name: 'API key passed as CLI argument',
+                description: 'No credentials passed as CLI arguments detected.',
+                category: 'nemo-secrets',
+                severity: 'high',
+                passed: true,
+                message: 'No CLI credential exposure detected',
+                fixable: false,
+            });
+        }
+        // ---------- NEMO-005: exec() with user-controlled string interpolation ----------
+        let nemo005Found = false;
+        for (const file of cappedTsJs) {
+            try {
+                const content = await fs.readFile(file, 'utf-8');
+                const lines = content.split('\n');
+                for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    // Match exec( or execSync( with template literal containing user-controlled vars
+                    // Exclude execFile (safe) patterns
+                    if (/\bexec(Sync)?\s*\(/.test(line) &&
+                        !/\bexecFile/.test(line) &&
+                        /`[^`]*\$\{[^}]*(name|Name|id|Id|input|arg|param|flag|option)/i.test(line)) {
+                        nemo005Found = true;
+                        findings.push({
+                            checkId: 'NEMO-005',
+                            name: 'exec() with user-controlled string interpolation',
+                            description: 'exec() or execSync() is called with a template literal containing user-controlled variables. This enables command injection.',
+                            category: 'nemo-injection',
+                            severity: 'critical',
+                            passed: false,
+                            message: `exec() with user-controlled interpolation at line ${i + 1}`,
+                            fixable: false,
+                            file: path.relative(targetDir, file),
+                            line: i + 1,
+                            fix: 'Use execFile() or spawn() with array arguments instead of exec() with string interpolation.',
+                        });
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        if (!nemo005Found && cappedTsJs.length > 0) {
+            findings.push({
+                checkId: 'NEMO-005',
+                name: 'exec() with user-controlled string interpolation',
+                description: 'No exec() calls with user-controlled string interpolation found.',
+                category: 'nemo-injection',
+                severity: 'critical',
+                passed: true,
+                message: 'No command injection via exec() detected',
+                fixable: false,
+            });
+        }
+        // ---------- NEMO-006: Predictable /tmp paths without mktemp ----------
+        let nemo006Found = false;
+        for (const file of cappedSh) {
+            try {
+                const content = await fs.readFile(file, 'utf-8');
+                const lines = content.split('\n');
+                for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    // Skip lines that ARE mktemp commands
+                    if (/mktemp/.test(line))
+                        continue;
+                    // Match hardcoded /tmp/ writes
+                    if (/\/tmp\//.test(line) &&
+                        (/>/.test(line) || />>/.test(line) || /-o\s+\/tmp\//.test(line) || /install.*\/tmp\//.test(line))) {
+                        nemo006Found = true;
+                        findings.push({
+                            checkId: 'NEMO-006',
+                            name: 'Predictable /tmp path without mktemp',
+                            description: 'A shell script writes to a hardcoded /tmp path instead of using mktemp. Predictable temp file names enable symlink attacks (CWE-377).',
+                            category: 'nemo-filesystem',
+                            severity: 'high',
+                            passed: false,
+                            message: `Hardcoded /tmp path at line ${i + 1}`,
+                            fixable: false,
+                            file: path.relative(targetDir, file),
+                            line: i + 1,
+                            fix: 'Use mktemp for all temporary files; add trap EXIT for cleanup: TMPDIR=$(mktemp -d) && trap "rm -rf $TMPDIR" EXIT',
+                        });
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        if (!nemo006Found && cappedSh.length > 0) {
+            findings.push({
+                checkId: 'NEMO-006',
+                name: 'Predictable /tmp paths without mktemp',
+                description: 'No hardcoded /tmp paths found in shell scripts.',
+                category: 'nemo-filesystem',
+                severity: 'high',
+                passed: true,
+                message: 'No predictable temp file paths detected',
+                fixable: false,
+            });
+        }
+        // ---------- NEMO-007: Full process.env passthrough to subprocess ----------
+        let nemo007Found = false;
+        for (const file of cappedTsJs) {
+            try {
+                const content = await fs.readFile(file, 'utf-8');
+                const lines = content.split('\n');
+                for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    if (/env:\s*\{[^}]*\.\.\.process\.env/.test(line)) {
+                        nemo007Found = true;
+                        findings.push({
+                            checkId: 'NEMO-007',
+                            name: 'Full process.env passthrough to subprocess',
+                            description: 'process.env is spread into subprocess options, leaking all environment variables (including secrets) to child processes.',
+                            category: 'nemo-secrets',
+                            severity: 'high',
+                            passed: false,
+                            message: `Full process.env spread into subprocess at line ${i + 1}`,
+                            fixable: false,
+                            file: path.relative(targetDir, file),
+                            line: i + 1,
+                            fix: 'Use an explicit env var allowlist instead of spreading process.env: env: { PATH: process.env.PATH, NODE_ENV: process.env.NODE_ENV }',
+                        });
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        if (!nemo007Found && cappedTsJs.length > 0) {
+            findings.push({
+                checkId: 'NEMO-007',
+                name: 'Full process.env passthrough to subprocess',
+                description: 'No full process.env passthrough to subprocesses found.',
+                category: 'nemo-secrets',
+                severity: 'high',
+                passed: true,
+                message: 'No process.env leakage to subprocesses detected',
+                fixable: false,
+            });
+        }
+        // ---------- NEMO-008: TOCTOU race between verify and apply ----------
+        let nemo008Found = false;
+        // Heuristic: look for verify/validate in one file AND exec/spawn in the same directory tree
+        const dirVerifyMap = new Map();
+        const dirExecMap = new Map();
+        for (const file of cappedTsJs) {
+            try {
+                const content = await fs.readFile(file, 'utf-8');
+                const lines = content.split('\n');
+                const dir = path.dirname(file);
+                for (let i = 0; i < lines.length; i++) {
+                    if (/verify.*digest|validate.*hash|check.*integrity/i.test(lines[i])) {
+                        if (!dirVerifyMap.has(dir)) {
+                            dirVerifyMap.set(dir, { verifyFile: file, verifyLine: i + 1 });
+                        }
+                    }
+                    if (/\bspawn\s*\(|\bexec\s*\(|\bexecSync\s*\(|\bexecFile\s*\(/.test(lines[i])) {
+                        if (!dirExecMap.has(dir)) {
+                            dirExecMap.set(dir, { execFile: file, execLine: i + 1 });
+                        }
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        for (const [dir, verify] of dirVerifyMap) {
+            const exec = dirExecMap.get(dir);
+            if (exec && verify.verifyFile !== exec.execFile) {
+                nemo008Found = true;
+                findings.push({
+                    checkId: 'NEMO-008',
+                    name: 'TOCTOU race between verify and apply',
+                    description: 'Integrity verification and execution happen in separate files, creating a time-of-check-time-of-use window where the artifact can be swapped between verification and use.',
+                    category: 'nemo-integrity',
+                    severity: 'high',
+                    passed: false,
+                    message: `Verify in ${path.relative(targetDir, verify.verifyFile)}:${verify.verifyLine}, exec in ${path.relative(targetDir, exec.execFile)}:${exec.execLine}`,
+                    fixable: false,
+                    file: path.relative(targetDir, verify.verifyFile),
+                    line: verify.verifyLine,
+                    fix: 'Copy artifact to temp dir, verify the copy, execute from the copy (atomic verify-then-execute in the same function).',
+                });
+            }
+        }
+        if (!nemo008Found && cappedTsJs.length > 0) {
+            findings.push({
+                checkId: 'NEMO-008',
+                name: 'TOCTOU race between verify and apply',
+                description: 'No verify/apply TOCTOU patterns detected.',
+                category: 'nemo-integrity',
+                severity: 'high',
+                passed: true,
+                message: 'No TOCTOU race conditions detected',
+                fixable: false,
+            });
+        }
+        // ---------- NEMO-009: Unsafe deserialization of untrusted data ----------
+        let nemo009Found = false;
+        // Python files: pickle.load, yaml.load without SafeLoader, eval(), exec()
+        for (const file of cappedPy) {
+            try {
+                const content = await fs.readFile(file, 'utf-8');
+                const lines = content.split('\n');
+                for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    if (/pickle\.load/i.test(line)) {
+                        nemo009Found = true;
+                        findings.push({
+                            checkId: 'NEMO-009',
+                            name: 'Unsafe deserialization: pickle.load',
+                            description: 'pickle.load() deserializes arbitrary Python objects, enabling remote code execution if the data source is untrusted.',
+                            category: 'nemo-deserialization',
+                            severity: 'critical',
+                            passed: false,
+                            message: `pickle.load() at line ${i + 1}`,
+                            fixable: false,
+                            file: path.relative(targetDir, file),
+                            line: i + 1,
+                            fix: 'Use json.load() or a restricted deserializer instead of pickle for untrusted data.',
+                        });
+                    }
+                    if (/yaml\.load\s*\(/.test(line) && !/Loader\s*=\s*SafeLoader/.test(line) && !/safe_load/.test(line)) {
+                        nemo009Found = true;
+                        findings.push({
+                            checkId: 'NEMO-009',
+                            name: 'Unsafe deserialization: yaml.load without SafeLoader',
+                            description: 'yaml.load() without SafeLoader can execute arbitrary Python code embedded in YAML documents.',
+                            category: 'nemo-deserialization',
+                            severity: 'high',
+                            passed: false,
+                            message: `yaml.load() without SafeLoader at line ${i + 1}`,
+                            fixable: false,
+                            file: path.relative(targetDir, file),
+                            line: i + 1,
+                            fix: 'Use yaml.safe_load() or yaml.load(data, Loader=yaml.SafeLoader).',
+                        });
+                    }
+                    if (/\beval\s*\(/.test(line) || /\bexec\s*\(/.test(line)) {
+                        nemo009Found = true;
+                        findings.push({
+                            checkId: 'NEMO-009',
+                            name: 'Unsafe deserialization: eval/exec in Python',
+                            description: 'eval() or exec() executes arbitrary code. If the input originates from untrusted sources, this enables code injection.',
+                            category: 'nemo-deserialization',
+                            severity: 'critical',
+                            passed: false,
+                            message: `eval()/exec() at line ${i + 1}`,
+                            fixable: false,
+                            file: path.relative(targetDir, file),
+                            line: i + 1,
+                            fix: 'Replace eval/exec with ast.literal_eval() for data parsing, or use a safe DSL.',
+                        });
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        // TS/JS files: eval(), new Function(), JSON5.parse
+        for (const file of cappedTsJs) {
+            try {
+                const content = await fs.readFile(file, 'utf-8');
+                const lines = content.split('\n');
+                for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i];
+                    if (/\beval\s*\(/.test(line)) {
+                        nemo009Found = true;
+                        findings.push({
+                            checkId: 'NEMO-009',
+                            name: 'Unsafe deserialization: eval()',
+                            description: 'eval() executes arbitrary JavaScript code. If the input comes from untrusted sources, this enables code injection.',
+                            category: 'nemo-deserialization',
+                            severity: 'critical',
+                            passed: false,
+                            message: `eval() at line ${i + 1}`,
+                            fixable: false,
+                            file: path.relative(targetDir, file),
+                            line: i + 1,
+                            fix: 'Use JSON.parse() for data, or a sandboxed evaluator for expressions.',
+                        });
+                    }
+                    if (/new\s+Function\s*\(/.test(line)) {
+                        nemo009Found = true;
+                        findings.push({
+                            checkId: 'NEMO-009',
+                            name: 'Unsafe deserialization: new Function()',
+                            description: 'new Function() creates executable code from strings, equivalent to eval() for code injection risks.',
+                            category: 'nemo-deserialization',
+                            severity: 'critical',
+                            passed: false,
+                            message: `new Function() at line ${i + 1}`,
+                            fixable: false,
+                            file: path.relative(targetDir, file),
+                            line: i + 1,
+                            fix: 'Use JSON.parse() for data, or a sandboxed evaluator for expressions.',
+                        });
+                    }
+                    if (/JSON5\.parse/.test(line)) {
+                        nemo009Found = true;
+                        findings.push({
+                            checkId: 'NEMO-009',
+                            name: 'Unsafe deserialization: JSON5.parse',
+                            description: 'JSON5.parse() is more lenient than JSON.parse(), accepting comments, trailing commas, and unquoted keys. This expanded surface can introduce parsing ambiguities.',
+                            category: 'nemo-deserialization',
+                            severity: 'high',
+                            passed: false,
+                            message: `JSON5.parse() at line ${i + 1}`,
+                            fixable: false,
+                            file: path.relative(targetDir, file),
+                            line: i + 1,
+                            fix: 'Use JSON.parse() instead of JSON5.parse() for untrusted data.',
+                        });
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        if (!nemo009Found && (cappedPy.length > 0 || cappedTsJs.length > 0)) {
+            findings.push({
+                checkId: 'NEMO-009',
+                name: 'Unsafe deserialization of untrusted data',
+                description: 'No unsafe deserialization patterns detected.',
+                category: 'nemo-deserialization',
+                severity: 'critical',
+                passed: true,
+                message: 'No unsafe deserialization detected',
+                fixable: false,
+            });
+        }
+        // ---------- NEMO-010: Network egress policy allows data exfiltration ----------
+        let nemo010Found = false;
+        const egressEndpoints = [
+            'api.telegram.org',
+            'discord.com/api',
+            'hooks.slack.com',
+            'webhook.site',
+            'requestbin',
+        ];
+        for (const file of cappedYaml) {
+            try {
+                const content = await fs.readFile(file, 'utf-8');
+                const lines = content.split('\n');
+                for (let i = 0; i < lines.length; i++) {
+                    const line = lines[i].toLowerCase();
+                    for (const endpoint of egressEndpoints) {
+                        if (line.includes(endpoint.toLowerCase())) {
+                            nemo010Found = true;
+                            findings.push({
+                                checkId: 'NEMO-010',
+                                name: 'Messaging API in egress policy',
+                                description: `Sandbox policy pre-allows access to ${endpoint}. Agents can exfiltrate data via messaging APIs without explicit operator approval.`,
+                                category: 'nemo-egress',
+                                severity: 'high',
+                                passed: false,
+                                message: `Messaging endpoint "${endpoint}" in egress policy at line ${i + 1}`,
+                                fixable: false,
+                                file: path.relative(targetDir, file),
+                                line: i + 1,
+                                fix: 'Remove messaging APIs from base sandbox policy; require explicit operator opt-in per deployment.',
+                            });
+                        }
+                    }
+                }
+            }
+            catch { /* skip */ }
+        }
+        if (!nemo010Found && cappedYaml.length > 0) {
+            findings.push({
+                checkId: 'NEMO-010',
+                name: 'Network egress policy allows data exfiltration',
+                description: 'No messaging API endpoints found in egress policies.',
+                category: 'nemo-egress',
+                severity: 'high',
+                passed: true,
+                message: 'No exfiltration-prone egress endpoints detected',
+                fixable: false,
+            });
         }
         return findings;
     }