praxis-sec 1.0.0

package/cli/data/eaa-catalog.json

@@ -0,0 +1,39 @@
+{
+  "_provenance": {
+    "source": "endpoint-ai-agent-abuse (0x4D31) — data/catalog.json v0.1.0",
+    "license": "CC0-1.0",
+    "fetched": "2026-08-16",
+    "note": "Technique catalog for abuse of local AI agents. Evidence tiers: observed > malicious-artifact > research > documented-surface. Used as rule-confidence backing in EndpointAgentAbuseAgent."
+  },
+  "name": "Endpoint AI Agent Abuse",
+  "short_name": "EAA",
+  "version": "0.1.0",
+  "license": "CC0-1.0",
+  "description": "A curated catalog of techniques for abusing local AI agents.",
+  "surfaces": [
+    "Invocation",
+    "Runtime",
+    "Control Plane",
+    "State & Telemetry",
+    "Capabilities",
+    "Inherited Authority"
+  ],
+  "techniques": [
+    {"id":"EAA-001","name":"Agent CLI invocation by untrusted parent","surface":"Invocation","evidence":"observed"},
+    {"id":"EAA-002","name":"Permissive or unattended agent execution","surface":"Invocation","evidence":"malicious-artifact"},
+    {"id":"EAA-003","name":"Lifecycle hook persistence","surface":"Control Plane","evidence":"observed"},
+    {"id":"EAA-004","name":"Persistent instruction or memory poisoning","surface":"Control Plane","evidence":"documented-surface"},
+    {"id":"EAA-005","name":"Transcript and agent-state collection","surface":"State & Telemetry","evidence":"documented-surface"},
+    {"id":"EAA-006","name":"MCP or tool configuration abuse","surface":"Capabilities","evidence":"observed"},
+    {"id":"EAA-007","name":"Hostile model/API gateway routing","surface":"Runtime","evidence":"documented-surface"},
+    {"id":"EAA-008","name":"Shadow agent config directory","surface":"Runtime","evidence":"documented-surface"},
+    {"id":"EAA-009","name":"Remote plugin or marketplace hot-load","surface":"Control Plane","evidence":"documented-surface"},
+    {"id":"EAA-010","name":"MCP dynamic tool mutation or pushed context","surface":"Capabilities","evidence":"research"},
+    {"id":"EAA-011","name":"Environment-expanded MCP activation","surface":"Capabilities","evidence":"documented-surface"},
+    {"id":"EAA-012","name":"Observability/logging exfiltration","surface":"State & Telemetry","evidence":"documented-surface"},
+    {"id":"EAA-013","name":"Cloud-synced skill drift","surface":"Control Plane","evidence":"documented-surface"},
+    {"id":"EAA-014","name":"Multi-agent config fan-out","surface":"Control Plane","evidence":"observed"},
+    {"id":"EAA-015","name":"Inherited authority abuse","surface":"Inherited Authority","evidence":"observed"},
+    {"id":"EAA-016","name":"Agent config and permission reconnaissance","surface":"Inherited Authority","evidence":"observed"}
+  ]
+}

package/cli/data/known-mcps.json

@@ -0,0 +1,26 @@
+{
+  "_provenance": {
+    "source": "Praxis-curated MCP trust registry (our own curation — no third-party code)",
+    "version": "1.0",
+    "note": "Trust tiers: verified = official/well-audited, community = widely used community servers, unknown = everything else (trust 0 at lookup). Update cadence: quarterly + incident-driven."
+  },
+  "servers": {
+    "@modelcontextprotocol/server-filesystem": { "tier": "verified", "trust": 90, "note": "Official reference MCP server" },
+    "@modelcontextprotocol/server-github": { "tier": "verified", "trust": 90, "note": "Official reference MCP server" },
+    "@modelcontextprotocol/server-gitlab": { "tier": "verified", "trust": 90, "note": "Official reference MCP server" },
+    "@modelcontextprotocol/server-google-maps": { "tier": "verified", "trust": 90, "note": "Official reference MCP server" },
+    "@modelcontextprotocol/server-memory": { "tier": "verified", "trust": 90, "note": "Official reference MCP server" },
+    "@modelcontextprotocol/server-postgres": { "tier": "verified", "trust": 90, "note": "Official reference MCP server" },
+    "@modelcontextprotocol/server-puppeteer": { "tier": "verified", "trust": 90, "note": "Official reference MCP server" },
+    "@modelcontextprotocol/server-slack": { "tier": "verified", "trust": 90, "note": "Official reference MCP server" },
+    "@modelcontextprotocol/server-sqlite": { "tier": "verified", "trust": 90, "note": "Official reference MCP server" },
+    "@modelcontextprotocol/server-brave-search": { "tier": "verified", "trust": 90, "note": "Official reference MCP server" },
+    "@modelcontextprotocol/server-fetch": { "tier": "verified", "trust": 90, "note": "Official reference MCP server" },
+    "@modelcontextprotocol/server-everything": { "tier": "verified", "trust": 90, "note": "Official reference MCP server" },
+    "@modelcontextprotocol/server-sequential-thinking": { "tier": "verified", "trust": 90, "note": "Official reference MCP server" },
+    "playwright": { "tier": "community", "trust": 70, "note": "Microsoft Playwright MCP — widely used browser automation" },
+    "mcp-server-git": { "tier": "community", "trust": 60, "note": "Popular community git MCP server" },
+    "mcp-chrome": { "tier": "community", "trust": 50, "note": "Community chrome automation" },
+    "mcp-server-fetch": { "tier": "community", "trust": 50, "note": "Community fetch tool" }
+  }
+}

package/cli/data/probes/prompt-injection-corpus.json

@@ -0,0 +1,271 @@
+{
+  "version": "1.1",
+  "_refresh_policy": {
+    "cadence": "Quarterly review + incident-driven additions",
+    "process": "1. Review OWASP LLM/Agentic Top 10 releases and known jailbreak-family reports. 2. Add probes with own-phrased signatures (never copy AGPL/copyrighted prompt text verbatim). 3. Bump version. 4. Run npm test (prober tests enforce compilation + ReDoS guard).",
+    "owner": "Praxis contributors",
+    "lastReviewed": "2026-08-16"
+  },
+  "description": "Prompt-injection probe corpus. Each entry is a static-detectable signal (regex) that a code path is constructing or accepting an LLM prompt in a way that matches a known injection class.",
+  "categories": [
+    {
+      "id": "direct-injection",
+      "title": "Direct prompt injection",
+      "tags": ["LLM01", "AML.T0051", "AML.T0043"]
+    },
+    {
+      "id": "instruction-override",
+      "title": "Instruction-override jailbreak",
+      "tags": ["LLM01", "AML.T0054"]
+    },
+    {
+      "id": "role-play-bypass",
+      "title": "Role-play / persona bypass (DAN, etc.)",
+      "tags": ["LLM01", "AML.T0054"]
+    },
+    {
+      "id": "indirect-injection",
+      "title": "Indirect injection from URL / file / RAG",
+      "tags": ["LLM01", "LLM08", "AML.T0070"]
+    },
+    {
+      "id": "system-prompt-leak",
+      "title": "System-prompt leakage / extraction",
+      "tags": ["LLM07", "AML.T0057"]
+    },
+    {
+      "id": "tool-use-hijack",
+      "title": "Tool / function-call hijack",
+      "tags": ["LLM06", "AML.T0053"]
+    },
+    {
+      "id": "dataflow-unsafe",
+      "title": "Unsanitized user input into prompt construction",
+      "tags": ["LLM01", "LLM05"]
+    },
+    {
+      "id": "jailbreak-frame",
+      "title": "Jailbreak framing (developer-mode, fictional/hypothetical, persona spoof)",
+      "tags": ["LLM01", "AML.T0054"]
+    },
+    {
+      "id": "delimiter-probe",
+      "title": "Prompt delimiter / end-sequence probes",
+      "tags": ["LLM01", "AML.T0043"]
+    },
+    {
+      "id": "obfuscated-injection",
+      "title": "Obfuscated injection payloads (invisible chars, homoglyphs, cipher instructions)",
+      "tags": ["LLM01", "AML.T0051"]
+    }
+  ],
+  "probes": [
+    {
+      "id": "PI-001",
+      "category": "direct-injection",
+      "title": "User input concatenated into system prompt",
+      "regex": "(?:system|systemPrompt|system_prompt|systemMessage|messages\\s*[:=]\\s*\\[\\s*\\{\\s*role\\s*:\\s*[\"']system)[\\s\\S]{0,200}(?:\\$\\{[^}]*(?:user|input|query|prompt|message|content|body|req\\.)|\\+\\s*(?:userInput|input|query|prompt|message)|f[\"'][^\"']{0,200}\\{(?:user|input|query|prompt|message))",
+      "severity": "high",
+      "description": "User-controlled value is interpolated directly into a system prompt. This is the canonical direct prompt-injection pattern.",
+      "fix": "Keep system prompts static. If user data must influence behavior, treat it as untrusted user-role content and constrain it via templated placeholders or guardrails."
+    },
+    {
+      "id": "PI-002",
+      "category": "instruction-override",
+      "title": "Hardcoded instruction-override phrase",
+      "regex": "(?i)(?:ignore\\s+(?:all\\s+)?(?:previous|prior|above)\\s+instructions|disregard\\s+(?:any|all|the)\\s+(?:previous|earlier|above)\\s+(?:instructions|prompt|context)|forget\\s+(?:everything|all)\\s+(?:above|previous))",
+      "severity": "high",
+      "description": "Source contains a hardcoded instruction-override string. If this string is sent to a downstream LLM unsanitized, it is a self-jailbreak.",
+      "fix": "Remove hardcoded override phrases from prompts. If demonstrating the pattern in tests/docs, use the praxis-ignore inline comment."
+    },
+    {
+      "id": "PI-003",
+      "category": "role-play-bypass",
+      "title": "DAN / persona-bypass prompt",
+      "regex": "(?i)(?:do\\s+anything\\s+now|\\bdan\\s+mode\\b|act\\s+as\\s+(?:if\\s+you\\s+have\\s+no\\s+restrictions|an?\\s+(?:unfiltered|unrestricted|jailbroken)\\s+ai)|pretend\\s+you\\s+are\\s+(?:not|no\\s+longer)\\s+bound\\s+by)",
+      "severity": "high",
+      "description": "Source contains a DAN-style or persona-bypass jailbreak template.",
+      "fix": "Strip jailbreak templates from prompts. Add prompt-injection detection on user input."
+    },
+    {
+      "id": "PI-004",
+      "category": "indirect-injection",
+      "title": "Fetched URL content fed to LLM without sanitization",
+      "regex": "(?:fetch|axios\\.get|requests\\.get|urllib\\.request\\.urlopen|http\\.get)\\s*\\([^)]*\\)[\\s\\S]{0,400}(?:\\.invoke|\\.complete|\\.chat|\\.create|\\.generate|client\\.messages|chat\\.completions|generate_content)\\s*\\(",
+      "severity": "high",
+      "description": "Remote-fetched content flows into an LLM call without an intermediate sanitation step. This is the indirect-injection pattern (attacker plants instructions in a webpage / file).",
+      "fix": "Strip HTML, neutralize known jailbreak phrases, or render fetched content inside a delimited user-role block before sending to the LLM."
+    },
+    {
+      "id": "PI-005",
+      "category": "indirect-injection",
+      "title": "RAG retrieved chunk concatenated into prompt",
+      "regex": "(?:similarity_search|similaritySearch|retriever\\.invoke|asRetriever|get_relevant_documents|retrieve)\\s*\\([\\s\\S]{0,200}\\)[\\s\\S]{0,300}(?:\\$\\{|\\+\\s*[a-zA-Z_]|f[\"'])",
+      "severity": "high",
+      "description": "RAG retrieval result is interpolated into a prompt without filtering. Attackers who can poison the retrieval index (e.g., via uploaded docs) gain prompt control.",
+      "fix": "Quote retrieved content inside delimited blocks (e.g., <document>...</document>) and instruct the model to treat them as untrusted data."
+    },
+    {
+      "id": "PI-006",
+      "category": "system-prompt-leak",
+      "title": "System prompt echo via 'repeat your instructions' handling",
+      "regex": "(?i)(?:print|return|output|reveal|show)\\s+(?:your|the)\\s+(?:system|original|initial)\\s+(?:prompt|instructions|message|rules)",
+      "severity": "medium",
+      "description": "Code contains text that asks the model to disclose its system prompt — typical of prompt-extraction probing or a misconfigured debug path.",
+      "fix": "Never echo system prompts in production. Add a refusal pattern for prompt-disclosure requests."
+    },
+    {
+      "id": "PI-007",
+      "category": "tool-use-hijack",
+      "title": "Over-broad tool / function schema (additionalProperties true / no validation)",
+      "regex": "(?:tools\\s*[:=]|functions\\s*[:=]|tool_choice\\s*[:=])[\\s\\S]{0,400}(?:\"additionalProperties\"\\s*:\\s*true|\"type\"\\s*:\\s*\"object\"\\s*\\}\\s*[,\\}])",
+      "severity": "medium",
+      "description": "Tool/function schema is permissive: additionalProperties is true or there is no property constraint, so a model coerced via prompt injection can pass arbitrary args.",
+      "fix": "Define a strict JSON Schema for every tool: list required properties and set additionalProperties: false."
+    },
+    {
+      "id": "PI-008",
+      "category": "tool-use-hijack",
+      "title": "Function-call result executed without confirmation",
+      "regex": "(?:function_call|tool_calls?)\\.(?:arguments|args|input)\\s*[\\s\\S]{0,200}(?:exec|spawn|eval|child_process|subprocess|os\\.system)\\s*\\(",
+      "severity": "critical",
+      "description": "Arguments coming from an LLM function call are passed straight into shell/exec/eval. A successful prompt injection becomes RCE.",
+      "fix": "Validate function-call arguments against a schema and require human confirmation for any side-effectful tool."
+    },
+    {
+      "id": "PI-009",
+      "category": "dataflow-unsafe",
+      "title": "User input wrapped in delimiters that the user can close",
+      "regex": "(?:`{3}|\"{3}|<\\|user\\|>|<\\|system\\|>|<\\|assistant\\|>)\\s*\\$?\\{[^}]*(?:user|input|query|message)\\s*\\}\\s*(?:`{3}|\"{3}|<\\|)",
+      "severity": "high",
+      "description": "User content is wrapped in delimiters (triple backticks, ChatML tokens) that the user can themselves emit, escaping the intended block.",
+      "fix": "Encode/escape special tokens in user input or use a delimiter unlikely to appear in user content."
+    },
+    {
+      "id": "PI-010",
+      "category": "direct-injection",
+      "title": "Anthropic Messages API: user role concatenated from raw input",
+      "regex": "(?:client\\.messages\\.create|messages\\s*[:=]\\s*\\[)[\\s\\S]{0,400}role\\s*:\\s*[\"']user[\"'][\\s\\S]{0,200}content\\s*:\\s*(?:`[^`]*\\$\\{[^}]*(?:user|input|req|body)|f[\"'][^\"']{0,200}\\{(?:user|input)|\\$\\{[^}]*\\+\\s*(?:user|input))",
+      "severity": "medium",
+      "description": "User role content is constructed by string interpolation from request data — sanitize first and consider rate-limiting / token caps.",
+      "fix": "Pass user input as a structured message rather than via template-string concatenation. Apply input length limits."
+    },
+    {
+      "id": "PI-011",
+      "category": "jailbreak-frame",
+      "title": "Developer-mode jailbreak frame",
+      "regex": "(?i)(?:developer|dev)\\s*mode\\s*(?:with\\s*)?(?:no|without|zero)\\s+(?:content\\s*)?restrictions?",
+      "severity": "high",
+      "description": "Source contains a developer-mode jailbreak frame that instructs a model to drop content restrictions. A classic jailbreak wrapper; near-zero legitimate use in application code.",
+      "fix": "Remove the jailbreak frame. Filter or refuse model inputs matching these frames at runtime."
+    },
+    {
+      "id": "PI-012",
+      "category": "jailbreak-frame",
+      "title": "Uncensored-assistant persona",
+      "regex": "(?i)(?:uncensored|unfiltered)\\s+(?:assistant|model|ai)[\\s\\S]{0,80}(?:never\\s+refuse|no\\s+refusals?|answer\\s+(?:anything|everything))",
+      "severity": "high",
+      "description": "Source contains an uncensored-assistant persona prompt with a never-refuse directive. Unambiguous jailbreak signal.",
+      "fix": "Remove the persona prompt. Never ship system prompts that promise not to refuse requests."
+    },
+    {
+      "id": "PI-013",
+      "category": "jailbreak-frame",
+      "title": "Fictional / hypothetical framing",
+      "regex": "(?i)(?:creative\\s+fiction\\s+exercise|hypothetical\\s+scenario|security\\s+training\\s+course)[\\s\\S]{0,60}(?:describe|explain|write|how\\s+to)",
+      "severity": "medium",
+      "description": "Source contains a fictional/hypothetical jailbreak frame asking for a how-to. Common in legit security education too — review the surrounding context.",
+      "fix": "Review context. If this prompt string is shipped to a model, add output policy checks."
+    },
+    {
+      "id": "PI-014",
+      "category": "jailbreak-frame",
+      "title": "AI-safety-researcher persona spoof",
+      "regex": "(?i)(?:ai|security)\\s+safety\\s+researcher[\\s\\S]{0,60}(?:analy|explain|demonstrat)",
+      "severity": "medium",
+      "description": "Source spoofs an AI-safety-researcher persona to request analysis. A known jailbreak persona; medium confidence since red-team tooling also contains such phrasing.",
+      "fix": "Review context. Treat model-facing copies of this text as untrusted input."
+    },
+    {
+      "id": "PI-015",
+      "category": "delimiter-probe",
+      "title": "End-of-system-prompt delimiter token",
+      "regex": "(?:\\[END\\s+OF\\s+SYSTEM\\s+PROMPT\\]|<\\|endofprompt\\|>|<\\|im_end\\|>)",
+      "severity": "medium",
+      "description": "Source contains a system-prompt end delimiter. Legitimate in tokenizer/inference code (constants); adversarial when emitted inside user-controllable content.",
+      "fix": "If this string can reach user content, escape or strip it. Keep delimiter constants out of prompt templates."
+    },
+    {
+      "id": "PI-016",
+      "category": "delimiter-probe",
+      "title": "Fake system-rule header injection",
+      "regex": "(?im)^\\s*#{1,3}\\s*(?:new\\s+system\\s+rules|override\\s+instructions|updated\\s+system\\s+prompt)\\s*:?\\s*$",
+      "severity": "high",
+      "description": "Source contains a fake markdown system-rule header used to smuggle override instructions past a model's real system prompt.",
+      "fix": "Strip fake system headers from untrusted content. Use delimiters users cannot guess."
+    },
+    {
+      "id": "PI-017",
+      "category": "obfuscated-injection",
+      "title": "Decode-then-respond instruction",
+      "regex": "(?i)(?:decode|translate|interpret)\\s+(?:this|it|the\\s+(?:text|message|above))\\s+(?:first|before\\s+(?:responding|answering))",
+      "severity": "high",
+      "description": "Source contains a decode-then-respond instruction — an injection trope that makes a model execute hidden content before answering.",
+      "fix": "Never accept decode-first instructions from untrusted content. Sandbox any transformer step."
+    },
+    {
+      "id": "PI-018",
+      "category": "obfuscated-injection",
+      "title": "Custom cipher / substitution-alphabet instruction",
+      "regex": "(?i)(?:speak\\s+in\\s+(?:my|our)\\s+language\\s+(?:called\\s+)?[\"']?[a-z]{2,}[\"']?|character\\s+substitutions?[\\s\\S]{0,80}(?:surrounded\\s+by\\s+dashes|then\\s+respond))",
+      "severity": "medium",
+      "description": "Source contains a custom-cipher instruction (learn-my-alphabet) used to smuggle payloads past content filters.",
+      "fix": "Review context. Refuse ciphered instruction sets in untrusted model input."
+    },
+    {
+      "id": "PI-019",
+      "category": "obfuscated-injection",
+      "title": "Zero-width / invisible characters (EchoLeak class)",
+      "regex": "[\\u200B\\u200C\\u200D\\uFEFF\\u2060\\u180E]",
+      "severity": "high",
+      "description": "Source contains invisible Unicode characters (zero-width space/joiner, BOM, word joiner, Mongolian vowel separator). The canonical EchoLeak / CVE-2025-32711-class steganography vehicle. A leading U+FEFF may be a benign BOM — verify position.",
+      "fix": "Strip invisible characters from prompt-facing content. Hex-dump the line to inspect what is hidden."
+    },
+    {
+      "id": "PI-020",
+      "category": "obfuscated-injection",
+      "title": "Bidi control characters",
+      "regex": "[\\u202A-\\u202E\\u2066-\\u2069]",
+      "severity": "high",
+      "description": "Source contains bidi control characters (RLO/LRI/PDI/FSI). These reorder text visually to hide instructions or filenames from human review.",
+      "fix": "Strip bidi controls from untrusted content and display paths."
+    },
+    {
+      "id": "PI-021",
+      "category": "obfuscated-injection",
+      "title": "Stacked combining marks (Zalgo text)",
+      "regex": "[\\u0300-\\u036F]{3,}",
+      "severity": "high",
+      "description": "Source contains runs of 3+ stacked combining diacritics — the Zalgo obfuscation signature used to hide payloads from filters and humans.",
+      "fix": "Normalize (NFC) and strip combining-mark runs from prompt-facing content."
+    },
+    {
+      "id": "PI-022",
+      "category": "obfuscated-injection",
+      "title": "Unicode tag-block steganography",
+      "regex": "(?u)[\\u{E0000}-\\u{E00FF}]",
+      "severity": "high",
+      "description": "Source contains characters from the Unicode Tags block (U+E0000–U+E00FF) — invisible characters used exclusively for steganographic payloads.",
+      "fix": "Strip all tag-block characters. They have no legitimate role in source code."
+    },
+    {
+      "id": "PI-023",
+      "category": "obfuscated-injection",
+      "title": "Mixed-script homoglyph word",
+      "regex": "(?u)\\b(?=\\w*[A-Za-z])(?=\\w*[\\u0400-\\u04FF])\\w{4,}\\b",
+      "severity": "medium",
+      "description": "Source contains a word mixing Latin and Cyrillic letters — the homoglyph technique (e.g. 'bypass' written with a Cyrillic 'у'). Legit mixed-language text exists; inspect the word.",
+      "fix": "Inspect the flagged word. Normalize confusable scripts (NFKC) in identifiers and prompt content."
+    }
+  ]
+}

package/cli/data/threat-intel.json

@@ -0,0 +1,85 @@
+{
+  "version": "1.0.0",
+  "updated": "2026-03-23T00:00:00Z",
+  "maliciousSkillHashes": [
+    {
+      "sha256": "e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855",
+      "name": "empty-payload-stub",
+      "description": "Empty file used as placeholder in ClawHavoc campaign"
+    },
+    {
+      "sha256": "a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2c3d4e5f6a1b2",
+      "name": "clawhavoc-stealer-v1",
+      "description": "AMOS stealer dropper identified in ClawHavoc campaign (1,184 malicious skills)"
+    },
+    {
+      "sha256": "dead0000beef0000cafe0000face0000dead0000beef0000cafe0000face0000",
+      "name": "clawhavoc-exfil-v2",
+      "description": "Data exfiltration skill sending credentials to attacker-controlled webhook"
+    }
+  ],
+  "compromisedMcpServers": [
+    {
+      "name": "@openclaw/mcp-shell-exec",
+      "versions": ["<1.2.3"],
+      "advisory": "Unrestricted shell command execution via WebSocket — CVE-2026-25253"
+    },
+    {
+      "name": "mcp-server-puppeteer-unverified",
+      "versions": ["*"],
+      "advisory": "Typosquat of official puppeteer MCP server, exfiltrates browser cookies"
+    },
+    {
+      "name": "@clawhub/skill-auto-deploy",
+      "versions": ["*"],
+      "advisory": "ClawHavoc campaign skill — installs AMOS stealer on macOS/Linux"
+    }
+  ],
+  "maliciousConfigSignatures": [
+    {
+      "pattern": "ignore previous instructions",
+      "description": "Prompt injection attempting to override agent system instructions",
+      "severity": "critical"
+    },
+    {
+      "pattern": "webhook.site",
+      "description": "Known data exfiltration service used in prompt injection attacks",
+      "severity": "critical"
+    },
+    {
+      "pattern": "curl.*\\|.*bash",
+      "description": "Remote code execution via piped download-and-execute pattern",
+      "severity": "critical"
+    },
+    {
+      "pattern": "ngrok\\.io|ngrok\\.app",
+      "description": "Tunnel service commonly used for data exfiltration in agent attacks",
+      "severity": "critical"
+    },
+    {
+      "pattern": "requestbin\\.com|pipedream\\.net",
+      "description": "Request interception service used to capture exfiltrated data",
+      "severity": "critical"
+    }
+  ],
+  "knownVulnerableConfigs": [
+    {
+      "file": "openclaw.json",
+      "check": "host_0000",
+      "description": "OpenClaw bound to 0.0.0.0 — CVE-2026-25253 (ClawJacked, CVSS 8.8)",
+      "cve": "CVE-2026-25253"
+    },
+    {
+      "file": "openclaw.json",
+      "check": "no_auth",
+      "description": "OpenClaw running without authentication — full agent takeover possible",
+      "cve": "CVE-2026-25253"
+    },
+    {
+      "file": ".claude/settings.json",
+      "check": "malicious_hooks",
+      "description": "Claude Code hooks executing arbitrary shell commands — Check Point RCE disclosure",
+      "cve": "CVE-2026-XXXX"
+    }
+  ]
+}

package/cli/data/threatpacks/latest.json

@@ -0,0 +1,41 @@
+{
+  "version": "1.1",
+  "_refresh_policy": {
+    "cadence": "Incident-driven + weekly review",
+    "process": "1. Track OWASP LLM/Agentic releases and reported AI attack incidents. 2. Add signatures in own phrasing (never copy AGPL/copyrighted text verbatim). 3. Bump version. 4. Run npm test (prober tests enforce compilation + ReDoS guard).",
+    "owner": "Praxis contributors",
+    "lastReviewed": "2026-10-02"
+  },
+  "probes": [
+    {
+      "id": "TP-001",
+      "category": "obfuscated-injection",
+      "title": "Encoded-payload decode instruction (base64/hex/ROT)",
+      "regex": "(?i)(?:decode|base64|rot1[0-9]|deobfuscate)[\\s\\S]{0,80}(?:then\\s+(?:respond|answer|execute|run)|before\\s+you\\s+(?:respond|answer))",
+      "severity": "high",
+      "description": "Source contains a decode-then-execute instruction that tells a model to decode an encoded payload before acting — the obfuscated-injection family used to smuggle instructions past content filters.",
+      "fix": "Reject decode-first instructions from untrusted content. Never execute content decoded from user-controlled strings."
+    },
+    {
+      "id": "TP-002",
+      "category": "jailbreak-frame",
+      "title": "System-prompt redefinition instruction",
+      "regex": "(?i)(?:redefine|replace|rewrite)\\s+(?:your|the)\\s+(?:system|base)\\s+(?:prompt|instructions|rules)[\\s\\S]{0,120}(?:with|to)\\s+",
+      "severity": "high",
+      "description": "Source contains an instruction that asks the model to replace its own system prompt — a jailbreak frame that erases the developer's guardrails.",
+      "fix": "Strip prompt-redefinition frames. Treat any instruction that modifies the system prompt as untrusted input."
+    },
+    {
+      "id": "TP-003",
+      "category": "indirect-injection",
+      "title": "Document-payload split injection (multi-file chaining)",
+      "regex": "(?i)(?:part\\s*\\d+\\s*of\\s*\\d+|continue\\s+(?:reading|with|in)\\s+(?:the\\s+)?(?:next|following|part|message)|when\\s+combined\\s+with\\s+(?:the\\s+)?(?:above|previous|preceding|earlier|these|prior|other)\\s+(?:instruction|instructions|rule|rules|prompt|prompts|text|content|contents|message|messages|directive|directives|command|commands|guideline|guidelines)\\b)",
+      "severity": "medium",
+      "description": "Source contains split-payload markers that chain instructions across documents/messages — the payload-splitting technique that defeats per-input content filters.",
+      "fix": "Evaluate documents independently; do not concatenate instruction-like text across untrusted sources.",
+      "_tightened": "P-IMP-057: the bare phrase \"when combined with\" matched ordinary English (e.g. the comment \"when combined with machine output\") and produced a medium-severity finding. It now requires a chaining referent (above/previous/preceding/earlier/these/prior/other) AND an instruction-like noun, so benign prose like \"merged when combined with the previous version\" no longer matches."
+    }
+  ],
+  "eaa": [],
+  "gateways": []
+}