praxis-sec 1.0.0

package/cli/agents/memory-poisoning-agent.js

@@ -0,0 +1,305 @@
+/**
+ * Memory Poisoning Detection Agent
+ * ==================================
+ *
+ * Detects instruction injection in AI agent memory and context files.
+ *
+ * Memory poisoning occurs when an adversary implants false or malicious
+ * instructions into an agent's persistent storage — the agent "learns"
+ * the instruction and recalls it in future sessions.
+ *
+ * Targets:
+ *   - Claude Code memory files (.claude/memory/*.md, CLAUDE.md)
+ *   - Cursor rules (.cursorrules, .cursor/rules/*.mdc)
+ *   - Continue config (.continue/config.json, .continue/rules/*.md)
+ *   - Windsurf rules (.windsurfrules)
+ *   - Cody config (.cody/)
+ *   - Gemini CLI (.gemini/)
+ *   - Project docs that agents ingest (README, CONTRIBUTING, docs/)
+ *
+ * Attack vectors detected:
+ *   1. Direct instruction injection — "ignore previous instructions"
+ *   2. Hidden directives in markdown — invisible chars, HTML comments
+ *   3. Exfiltration instructions — "send", "upload", "POST to"
+ *   4. Tool abuse instructions — "run bash", "write to", "delete"
+ *   5. Persona hijacking — "you are now", "your new role"
+ *   6. Memory persistence — instructions designed to survive context resets
+ *
+ * Maps to: OWASP Agentic ASI01 (Agent Goal Hijacking),
+ *          ASI05 (Memory/Context Poisoning)
+ */
+
+import path from 'path';
+import fg from 'fast-glob';
+import { BaseAgent, createFinding } from './base-agent.js';
+
+// =============================================================================
+// MEMORY / CONTEXT FILES TO SCAN
+// =============================================================================
+
+const MEMORY_GLOBS = [
+  // Claude Code
+  '.claude/memory/*.md',
+  '.claude/commands/*.md',
+  'CLAUDE.md',
+  // Cursor
+  '.cursorrules',
+  '.cursor/rules/*.mdc',
+  '.cursor/rules/*.md',
+  // Windsurf
+  '.windsurfrules',
+  // Continue
+  '.continue/config.json',
+  '.continue/rules/*.md',
+  // Cody
+  '.cody/*.md',
+  '.cody/config.json',
+  // Gemini CLI
+  '.gemini/*.md',
+  '.gemini/settings.json',
+  // Copilot
+  '.github/copilot-instructions.md',
+  // Aider
+  '.aider.conf.yml',
+];
+
+// Project docs that agents commonly ingest as context
+const DOC_GLOBS = [
+  'README.md',
+  'CONTRIBUTING.md',
+  'docs/**/*.md',
+  'AGENTS.md',
+  '.github/PULL_REQUEST_TEMPLATE.md',
+  '.github/ISSUE_TEMPLATE/*.md',
+];
+
+// =============================================================================
+// DETECTION PATTERNS
+// =============================================================================
+
+export const INJECTION_PATTERNS = [
+  {
+    regex: /(?:ignore|disregard|forget|override)\s+(?:all\s+)?(?:previous|prior|above|earlier|system)\s+(?:instructions?|rules?|prompts?|constraints?|guidelines?)/gi,
+    rule: 'MEMORY_POISON_OVERRIDE',
+    title: 'Instruction Override in Agent Memory',
+    severity: 'critical',
+    description: 'File contains instructions to override previous agent rules. This is a classic prompt injection pattern that persists in agent memory.',
+    owasp: 'ASI01',
+    cwe: 'CWE-74',
+    fix: 'Remove the override instruction. If intentional, use the agent\'s official configuration mechanism instead.',
+  },
+  {
+    regex: /(?:you\s+are\s+now|your\s+new\s+(?:role|persona|identity)|from\s+now\s+on\s+you\s+(?:are|will|must|should))\s+/gi,
+    rule: 'MEMORY_POISON_PERSONA',
+    title: 'Persona Hijacking in Agent Memory',
+    severity: 'high',
+    description: 'File attempts to redefine the agent\'s persona or role. If this file is ingested as context, the agent may adopt the injected persona in future sessions.',
+    owasp: 'ASI01',
+    cwe: 'CWE-74',
+    fix: 'Remove the persona redefinition. Use the agent\'s system prompt or official configuration to set roles.',
+  },
+  {
+    regex: /(?:send|upload|post|transmit|exfiltrate|forward)\s+(?:all|any|the|this)?\s*(?:code|data|files?|contents?|secrets?|keys?|tokens?|credentials?|env|environment)\s+(?:to|via|using|through)\s+/gi,
+    rule: 'MEMORY_POISON_EXFILTRATE',
+    title: 'Exfiltration Instruction in Agent Memory',
+    severity: 'critical',
+    description: 'File instructs an agent to exfiltrate data to an external destination. If persisted in memory, the agent may execute this across sessions.',
+    owasp: 'ASI01',
+    cwe: 'CWE-200',
+    fix: 'Remove the exfiltration instruction immediately. Audit agent memory for other injected directives.',
+  },
+  {
+    regex: /(?:do\s+not|don'?t|never)\s+(?:tell|inform|show|reveal|display|mention|report|log)\s+(?:the\s+user|anyone|them)/gi,
+    rule: 'MEMORY_POISON_SUPPRESS',
+    title: 'Output Suppression Instruction',
+    severity: 'critical',
+    description: 'File instructs the agent to hide actions from the user. This matches the ToxicSkills "output suppression" pattern — the agent does something harmful but doesn\'t report it.',
+    owasp: 'ASI01',
+    cwe: 'CWE-200',
+    fix: 'Remove the suppression instruction. Agents should always report their actions transparently.',
+  },
+  {
+    regex: /(?:whenever|every\s+time|always|each\s+time)\s+(?:you|the\s+agent)\s+(?:start|begin|open|run|execute|encounter)/gi,
+    rule: 'MEMORY_POISON_PERSISTENT',
+    title: 'Persistent Trigger Instruction',
+    severity: 'high',
+    description: 'File contains instructions designed to trigger on every session or action — a hallmark of persistent memory poisoning. Unlike a one-time injection, this survives context resets.',
+    owasp: 'ASI05',
+    cwe: 'CWE-74',
+    fix: 'Remove the persistent trigger. If you need recurring behavior, configure it through the agent\'s official hook or startup mechanism.',
+  },
+  {
+    regex: /(?:run|execute|invoke|call|use)\s+(?:bash|shell|terminal|cmd|system|exec|subprocess|os\.system|child_process)/gi,
+    rule: 'MEMORY_POISON_TOOL_ABUSE',
+    title: 'Shell Execution Instruction in Memory',
+    severity: 'high',
+    description: 'File instructs the agent to execute shell commands. If persisted in memory, this enables remote code execution via prompt injection.',
+    owasp: 'ASI02',
+    cwe: 'CWE-78',
+    fix: 'Remove direct shell execution instructions. Use the agent\'s sandboxed tool API instead.',
+  },
+  {
+    regex: /(?:fetch|curl|wget|http\.get|axios\.get|request)\s*\(\s*['"`]https?:\/\//gi,
+    rule: 'MEMORY_POISON_NETWORK',
+    title: 'Network Request Instruction in Memory',
+    severity: 'high',
+    description: 'File instructs the agent to make network requests to hardcoded URLs. A poisoned memory file can use this to phone home or exfiltrate context.',
+    owasp: 'ASI01',
+    cwe: 'CWE-918',
+    fix: 'Remove the hardcoded network request. If the agent needs to fetch data, configure it through approved MCP servers or tools.',
+  },
+];
+
+// Hidden content patterns (invisible chars, encoded payloads)
+const HIDDEN_CONTENT_PATTERNS = [
+  {
+    // Unicode zero-width chars used to hide instructions
+    // eslint-disable-next-line no-misleading-character-class -- intentional: detects zero-width char clusters that hide injected instructions
+    regex: /[\u200B\u200C\u200D\u2060\uFEFF]{3,}/g,
+    rule: 'MEMORY_HIDDEN_UNICODE',
+    title: 'Hidden Unicode Content in Agent File',
+    severity: 'critical',
+    description: 'File contains clusters of zero-width Unicode characters. These are invisible to humans but may encode hidden instructions that the agent processes.',
+    owasp: 'ASI01',
+    cwe: 'CWE-116',
+    fix: 'Strip all zero-width characters from this file. Use a hex editor to inspect for hidden content.',
+  },
+  {
+    // HTML comments in markdown that could contain injected instructions
+    regex: /<!--[\s\S]*?(?:ignore|override|system|role|always|execute|send\s+to|curl|bash)[\s\S]*?-->/gi,
+    rule: 'MEMORY_HIDDEN_COMMENT',
+    title: 'Suspicious HTML Comment in Agent File',
+    severity: 'high',
+    description: 'An HTML comment contains what appears to be an injected instruction. Some agents process HTML comments as context, making this a viable injection vector.',
+    owasp: 'ASI05',
+    cwe: 'CWE-74',
+    fix: 'Remove the suspicious HTML comment or move the content to a visible location.',
+  },
+  {
+    // Base64 encoded content in markdown/config files
+    regex: /(?:^|[\s"':=])([A-Za-z0-9+/]{60,}={0,2})(?:[\s"',]|$)/gm,
+    rule: 'MEMORY_HIDDEN_BASE64',
+    title: 'Base64-Encoded Content in Agent File',
+    severity: 'medium',
+    description: 'File contains a long base64-encoded string. This could hide instructions or payloads that the agent decodes and executes.',
+    owasp: 'ASI05',
+    cwe: 'CWE-116',
+    confidence: 'medium',
+    fix: 'Decode the base64 content and verify it is benign. Remove if it contains instructions or executable content.',
+  },
+];
+
+// =============================================================================
+// AGENT
+// =============================================================================
+
+export class MemoryPoisoningAgent extends BaseAgent {
+  constructor() {
+    super(
+      'MemoryPoisoningAgent',
+      'Detects instruction injection in AI agent memory and context files',
+      'agentic'
+    );
+  }
+
+  shouldRun() {
+    return true; // Always run — memory poisoning applies to any project
+  }
+
+  async analyze(context) {
+    const { rootPath } = context;
+    const findings = [];
+
+    // Discover all memory/context files
+    const memoryFiles = await fg(MEMORY_GLOBS, {
+      cwd: rootPath,
+      absolute: true,
+      dot: true,
+    });
+
+    const docFiles = await fg(DOC_GLOBS, {
+      cwd: rootPath,
+      absolute: true,
+      dot: true,
+    });
+
+    // Scan memory files with higher severity (direct agent context)
+    for (const file of memoryFiles) {
+      findings.push(...this._scanFile(file, true));
+    }
+
+    // Scan doc files with slightly lower confidence (indirect context)
+    for (const file of docFiles) {
+      findings.push(...this._scanFile(file, false));
+    }
+
+    return findings;
+  }
+
+  _scanFile(filePath, isDirectMemory) {
+    const content = this.readFile(filePath);
+    if (!content) return [];
+
+    const findings = [];
+    const lines = content.split('\n');
+
+    // Check injection patterns
+    for (const pattern of INJECTION_PATTERNS) {
+      for (let i = 0; i < lines.length; i++) {
+        const line = lines[i];
+        if (this.isSuppressed(line)) continue;
+
+        pattern.regex.lastIndex = 0;
+        const match = pattern.regex.exec(line);
+        if (match) {
+          findings.push(createFinding({
+            file: filePath,
+            line: i + 1,
+            severity: pattern.severity,
+            category: 'agentic',
+            rule: pattern.rule,
+            title: pattern.title,
+            description: pattern.description + (isDirectMemory
+              ? ' This file is directly loaded into agent context.'
+              : ' This file may be ingested by agents as project context.'),
+            matched: match[0],
+            confidence: isDirectMemory ? 'high' : 'medium',
+            cwe: pattern.cwe,
+            owasp: pattern.owasp,
+            fix: pattern.fix,
+          }));
+        }
+      }
+    }
+
+    // Check hidden content patterns (full content, not per-line)
+    for (const pattern of HIDDEN_CONTENT_PATTERNS) {
+      pattern.regex.lastIndex = 0;
+      const match = pattern.regex.exec(content);
+      if (match) {
+        // Find approximate line number
+        const beforeMatch = content.slice(0, match.index);
+        const lineNum = (beforeMatch.match(/\n/g) || []).length + 1;
+
+        findings.push(createFinding({
+          file: filePath,
+          line: lineNum,
+          severity: pattern.severity,
+          category: 'agentic',
+          rule: pattern.rule,
+          title: pattern.title,
+          description: pattern.description,
+          matched: match[0].slice(0, 100),
+          confidence: pattern.confidence || (isDirectMemory ? 'high' : 'medium'),
+          cwe: pattern.cwe,
+          owasp: pattern.owasp,
+          fix: pattern.fix,
+        }));
+      }
+    }
+
+    return findings;
+  }
+}
+
+export default MemoryPoisoningAgent;

package/cli/agents/mobile-scanner.js

@@ -0,0 +1,231 @@
+/**
+ * MobileScanner Agent
+ * ====================
+ *
+ * Security scanning for React Native, Expo, Flutter,
+ * and native mobile codebases.
+ * Based on OWASP Mobile Top 10 2024.
+ */
+
+import fs from 'fs';
+import path from 'path';
+import { BaseAgent, createFinding } from './base-agent.js';
+
+export const PATTERNS = [
+  // ── M1: Improper Credential Usage ──────────────────────────────────────────
+  {
+    rule: 'MOBILE_HARDCODED_KEY',
+    title: 'Mobile: Hardcoded API Key in Bundle',
+    regex: /(?:apiKey|api_key|API_KEY|secret|SECRET)\s*[:=]\s*["'][a-zA-Z0-9_\-]{20,}["']/g,
+    severity: 'critical',
+    cwe: 'CWE-798',
+    owasp: 'M1',
+    description: 'Hardcoded API key in mobile code. Mobile bundles are easily decompiled.',
+    fix: 'Store secrets server-side. Use expo-secure-store or EncryptedSharedPreferences.',
+  },
+  {
+    rule: 'MOBILE_KEY_IN_CONFIG',
+    title: 'Mobile: Secret in app.json/app.config.js',
+    regex: /(?:apiKey|apiSecret|secret|token|password|private_key)\s*["']?\s*[:=]\s*["'][^"']{8,}["']/gi,
+    severity: 'high',
+    cwe: 'CWE-798',
+    owasp: 'M1',
+    description: 'Secret in app config file. This gets bundled into the app binary.',
+    fix: 'Move to environment variables or server-side configuration',
+  },
+
+  // ── M3: Insecure Authentication/Authorization ──────────────────────────────
+  {
+    rule: 'MOBILE_LOCAL_AUTH_ONLY',
+    title: 'Mobile: Client-Only Authentication',
+    regex: /(?:isAuthenticated|isLoggedIn|isAdmin)\s*[:=]\s*(?:AsyncStorage|localStorage|SecureStore)/g,
+    severity: 'high',
+    cwe: 'CWE-603',
+    owasp: 'M3',
+    description: 'Authentication state stored only on client. Attacker can bypass by modifying storage.',
+    fix: 'Verify authentication server-side on every API request',
+  },
+
+  // ── M4: Insufficient Input/Output Validation ──────────────────────────────
+  {
+    rule: 'MOBILE_WEBVIEW_JS',
+    title: 'Mobile: WebView JavaScript Enabled',
+    regex: /(?:javaScriptEnabled|javascriptEnabled)\s*[:=]\s*(?:\{?\s*true|True)/g,
+    severity: 'medium',
+    cwe: 'CWE-79',
+    owasp: 'M4',
+    description: 'WebView with JavaScript enabled can be exploited via injected content.',
+    fix: 'Disable JavaScript in WebViews loading untrusted content, or sanitize loaded HTML',
+  },
+  {
+    rule: 'MOBILE_DEEPLINK_INJECTION',
+    title: 'Mobile: Deep Link Parameter Injection',
+    regex: /(?:Linking\.getInitialURL|useURL|addEventListener\s*\(\s*['"]url['"])/g,
+    severity: 'high',
+    cwe: 'CWE-20',
+    owasp: 'M4',
+    confidence: 'low',
+    description: 'Deep link URL handler detected. Ensure parameters from deep links are validated before use.',
+    fix: 'Validate and sanitize all parameters from deep links before use',
+  },
+
+  // ── M5: Insecure Communication ─────────────────────────────────────────────
+  {
+    rule: 'MOBILE_HTTP_ENDPOINT',
+    title: 'Mobile: HTTP (Non-HTTPS) Endpoint',
+    regex: /(?:baseURL|apiUrl|endpoint|url|API_URL)\s*[:=]\s*["']http:\/\//gi,
+    severity: 'high',
+    cwe: 'CWE-319',
+    owasp: 'M5',
+    description: 'HTTP endpoint in mobile app. All traffic is unencrypted and interceptable.',
+    fix: 'Use HTTPS for all endpoints. Configure ATS (iOS) and cleartextTraffic (Android).',
+  },
+  {
+    rule: 'MOBILE_NO_CERT_PINNING',
+    title: 'Mobile: Missing Certificate Pinning',
+    regex: /(?:fetch|axios|http)\s*\(\s*(?!.*pin|certificate)/g,
+    severity: 'medium',
+    cwe: 'CWE-295',
+    owasp: 'M5',
+    confidence: 'low',
+    description: 'No certificate pinning detected. MITM attacks possible on compromised networks.',
+    fix: 'Implement cert pinning with react-native-ssl-pinning or TrustKit',
+  },
+
+  // ── M6: Inadequate Privacy Controls ────────────────────────────────────────
+  {
+    rule: 'MOBILE_EXCESSIVE_PERMISSIONS',
+    title: 'Mobile: Excessive Permissions',
+    regex: /(?:CAMERA|CONTACTS|LOCATION|MICROPHONE|CALENDAR|READ_SMS|CALL_LOG|READ_PHONE_STATE)\s*(?:[,\]])/g,
+    severity: 'medium',
+    cwe: 'CWE-250',
+    owasp: 'M6',
+    confidence: 'low',
+    description: 'Multiple sensitive permissions requested. Only request what is needed.',
+    fix: 'Remove unnecessary permissions. Request at runtime with clear justification.',
+  },
+
+  // ── M8: Security Misconfiguration ──────────────────────────────────────────
+  {
+    rule: 'MOBILE_DEBUG_BUILD',
+    title: 'Mobile: Debug Mode in Release',
+    regex: /(?:__DEV__|debuggable\s*[:=]\s*true|android:debuggable="true"|DEBUG_MODE\s*[:=]\s*true)/g,
+    severity: 'high',
+    cwe: 'CWE-215',
+    owasp: 'M8',
+    description: 'Debug mode enabled. Exposes debugging interfaces and detailed error messages.',
+    fix: 'Ensure __DEV__ checks are used correctly. Set debuggable=false in release builds.',
+  },
+  {
+    rule: 'MOBILE_BACKUP_ENABLED',
+    title: 'Mobile: App Backup Enabled',
+    regex: /(?:android:allowBackup="true"|allowsBackup\s*[:=]\s*true)/g,
+    severity: 'medium',
+    cwe: 'CWE-312',
+    owasp: 'M8',
+    description: 'App backup enabled. Sensitive data can be extracted from backups.',
+    fix: 'Set android:allowBackup="false" and exclude sensitive files from backup',
+  },
+
+  // ── M9: Insecure Data Storage ──────────────────────────────────────────────
+  {
+    rule: 'MOBILE_ASYNCSTORAGE_SECRET',
+    title: 'Mobile: Secret in AsyncStorage',
+    regex: /AsyncStorage\.setItem\s*\(\s*["'](?:.*(?:token|key|secret|password|credential|session))/gi,
+    severity: 'high',
+    cwe: 'CWE-312',
+    owasp: 'M9',
+    description: 'Storing secrets in AsyncStorage (unencrypted). Use expo-secure-store or Keychain.',
+    fix: 'Use expo-secure-store (Expo) or react-native-keychain for sensitive data',
+  },
+  {
+    rule: 'MOBILE_LOCALSTORAGE_SECRET',
+    title: 'Mobile: Secret in localStorage',
+    regex: /localStorage\.setItem\s*\(\s*["'](?:.*(?:token|key|secret|password|credential|session))/gi,
+    severity: 'high',
+    cwe: 'CWE-312',
+    owasp: 'M9',
+    description: 'Storing secrets in localStorage (unencrypted). Use secure storage APIs.',
+    fix: 'Use platform-specific secure storage: Keychain (iOS), EncryptedSharedPreferences (Android)',
+  },
+  {
+    rule: 'MOBILE_LOG_SENSITIVE',
+    title: 'Mobile: Sensitive Data in Logs',
+    regex: /console\.(?:log|info|warn|debug)\s*\(\s*.*(?:token|password|secret|key|credential|session|auth)/gi,
+    severity: 'medium',
+    cwe: 'CWE-532',
+    owasp: 'M9',
+    confidence: 'medium',
+    description: 'Sensitive data logged to console. Logs are accessible on rooted/jailbroken devices.',
+    fix: 'Remove sensitive data from console.log. Use __DEV__ check for debug logging.',
+  },
+
+  // ── M10: Insufficient Cryptography ─────────────────────────────────────────
+  {
+    rule: 'MOBILE_HARDCODED_CRYPTO_KEY',
+    title: 'Mobile: Hardcoded Encryption Key',
+    regex: /(?:encrypt|cipher|aes|crypto).*(?:key|iv|salt)\s*[:=]\s*["'][a-zA-Z0-9+/=]{8,}["']/gi,
+    severity: 'critical',
+    cwe: 'CWE-321',
+    owasp: 'M10',
+    description: 'Hardcoded encryption key in mobile code. Easily extracted from decompiled binary.',
+    fix: 'Derive keys from user credentials or fetch from server at runtime',
+  },
+
+  // ── Flutter-specific ───────────────────────────────────────────────────────
+  {
+    rule: 'FLUTTER_SHARED_PREFS_SECRET',
+    title: 'Flutter: Secret in SharedPreferences',
+    regex: /SharedPreferences.*(?:setString|setInt)\s*\(\s*["'](?:.*(?:token|key|secret|password|api))/gi,
+    severity: 'high',
+    cwe: 'CWE-312',
+    owasp: 'M9',
+    description: 'Storing secrets in SharedPreferences (unencrypted). Use flutter_secure_storage.',
+    fix: 'Use flutter_secure_storage package for sensitive data',
+  },
+];
+
+export class MobileScanner extends BaseAgent {
+  constructor() {
+    super('MobileScanner', 'Mobile security scanning (OWASP Mobile Top 10)', 'mobile');
+  }
+
+  shouldRun(recon) {
+    return recon?.frameworks?.some(f =>
+      ['react-native', 'flutter', 'expo'].includes(f)
+    ) ?? false;
+  }
+
+  async analyze(context) {
+    const { rootPath, files, recon } = context;
+
+    // Only run if mobile framework detected
+    const isMobile = recon?.frameworks?.some(f =>
+      ['react-native', 'flutter', 'expo'].includes(f)
+    );
+
+    // Also check for mobile-specific files
+    const hasMobileFiles = files.some(f => {
+      const basename = path.basename(f);
+      return ['app.json', 'app.config.js', 'app.config.ts',
+              'pubspec.yaml', 'AndroidManifest.xml', 'Info.plist',
+              'expo-env.d.ts'].includes(basename);
+    });
+
+    if (!isMobile && !hasMobileFiles) return [];
+
+    const codeFiles = files.filter(f => {
+      const ext = path.extname(f).toLowerCase();
+      return ['.js', '.jsx', '.ts', '.tsx', '.dart', '.swift', '.kt',
+              '.java', '.xml', '.plist', '.json'].includes(ext);
+    });
+
+    let findings = [];
+    for (const file of codeFiles) {
+      findings = findings.concat(this.scanFileWithPatterns(file, PATTERNS));
+    }
+    return findings;
+  }
+}
+
+export default MobileScanner;