raqib 0.0.0-stage → 0.1.0

package/src/rules/coherence.js

@@ -0,0 +1,151 @@
+import { excerpt } from '../lib/text.js';
+
+/**
+ * Whether the instructions can actually be followed.
+ *
+ * Two failure modes, both silent: the file tells the agent to run a command
+ * the repository does not have, and two files tell it opposite things. Neither
+ * produces an error. The agent just guesses, and the guess looks like a bug in
+ * the model.
+ */
+
+/** Manifest that must exist for a given command to be runnable. */
+const COMMAND_REQUIRES = [
+  { re: /^(npm|npx|pnpm|yarn|bun)\b/, needs: ['package.json'], label: 'a Node package manifest' },
+  { re: /^(pytest|python -m pytest|tox|ruff|mypy|poetry)\b/, needs: ['pyproject.toml', 'setup.py', 'setup.cfg', 'requirements.txt', 'tox.ini'], label: 'a Python project file' },
+  { re: /^(cargo)\b/, needs: ['Cargo.toml'], label: 'Cargo.toml' },
+  { re: /^(go)\s+(build|test|run|vet)\b/, needs: ['go.mod'], label: 'go.mod' },
+  { re: /^(make)\b/, needs: ['Makefile', 'makefile', 'GNUmakefile'], label: 'a Makefile' },
+  { re: /^(mvn|mvnw)\b/, needs: ['pom.xml'], label: 'pom.xml' },
+  { re: /^(gradle|\.\/gradlew)\b/, needs: ['build.gradle', 'build.gradle.kts', 'settings.gradle'], label: 'a Gradle build file' },
+  { re: /^(bundle|rake|rails)\b/, needs: ['Gemfile'], label: 'a Gemfile' },
+  { re: /^(composer|artisan|php artisan)\b/, needs: ['composer.json'], label: 'composer.json' },
+  { re: /^(docker-compose|docker compose)\b/, needs: ['docker-compose.yml', 'docker-compose.yaml', 'compose.yml', 'compose.yaml'], label: 'a Compose file' },
+];
+
+/** Pull `backticked` single-line commands out of a document. */
+function commands(doc) {
+  const found = [];
+  const re = /`([^`\n]{2,120})`/g;
+  let match;
+  while ((match = re.exec(doc.content)) !== null) {
+    const text = match[1].trim();
+    if (!/^[a-z./][\w./-]*(\s|$)/.test(text)) continue;
+    found.push({ text, offset: match.index });
+  }
+  return found;
+}
+
+/**
+ * Directives of the form "use X" / "never use X", keyed on the identifier.
+ * Only backticked or capitalised identifiers count, which keeps this to
+ * library and tool names instead of every English noun.
+ */
+const BACKTICKED = /`([^`\n]{2,40})`/;
+const POSITIVE = /\b(use|prefer|always\s+use|adopt|switch\s+to|standardi[sz]e\s+on)\b/i;
+const NEGATIVE = /\b(never\s+use|do\s+not\s+use|don'?t\s+use|avoid\s+using|forbidden|banned|deprecated|no\s+longer\s+use)\b/i;
+
+/**
+ * The thing a directive is about, and only when the file names it as code.
+ *
+ * An earlier version fell back to the first capitalised word, which read
+ * "Never use X" as a rule about "Never" and turned every long prose bullet in
+ * a real repository into a contradiction. Requiring backticks costs some
+ * recall and buys the whole rule its credibility: instruction files name
+ * libraries, APIs and commands in backticks as a matter of course.
+ */
+function subjectOf(line, from = 0) {
+  const after = /`([^`\n]{2,40})`/g;
+  after.lastIndex = from;
+  const match = after.exec(line) ?? BACKTICKED.exec(line);
+  return match ? match[1].trim().toLowerCase() : null;
+}
+
+function directives(doc) {
+  const out = [];
+  doc.lines.forEach((line, index) => {
+    // "Never use" contains "use", so the positive test runs on what is left
+    // after the negative clause is removed. A line that still reads positive
+    // once the prohibition is cut out carries both polarities and no single
+    // subject, so it is skipped rather than guessed at.
+    const negative = NEGATIVE.exec(line);
+    const remainder = negative
+      ? `${line.slice(0, negative.index)} ${line.slice(negative.index + negative[0].length)}`
+      : line;
+    const positive = POSITIVE.test(remainder);
+    if (negative && positive) return;
+    if (!negative && !positive) return;
+    const name = subjectOf(line, negative ? negative.index + negative[0].length : 0);
+    if (!name || name.length < 2) return;
+    out.push({ name, polarity: negative ? 'forbid' : 'require', path: doc.path, line: index + 1, text: line });
+  });
+  return out;
+}
+
+export const rules = [
+  {
+    id: 'RAQIB060',
+    severity: 'medium',
+    title: 'Command the repository cannot run',
+    check: (doc, ctx) => {
+      // Without a file listing there is nothing to check against; stay silent
+      // rather than guess. A wrong finding here would train people to ignore
+      // the tool.
+      if (!ctx.repoFiles?.length) return [];
+      const names = new Set(ctx.repoFiles.map((f) => f.split('/').pop()));
+      const reported = new Set();
+      const findings = [];
+      for (const { text, offset } of commands(doc)) {
+        const rule = COMMAND_REQUIRES.find((r) => r.re.test(text));
+        if (!rule || rule.needs.some((n) => names.has(n))) continue;
+        if (reported.has(rule.label)) continue;
+        reported.add(rule.label);
+        const { line, column } = doc.locate(offset);
+        findings.push({
+          ruleId: 'RAQIB060',
+          path: doc.path,
+          line,
+          column,
+          severity: 'medium',
+          title: 'Command the repository cannot run',
+          message: `The instructions tell the agent to run \`${text}\`, but the repository is missing ${rule.label}.`,
+          excerpt: text,
+          remediation: 'Fix the command, or delete it. An agent handed a command that fails will invent a replacement.',
+        });
+      }
+      return findings;
+    },
+  },
+  {
+    id: 'RAQIB061',
+    severity: 'high',
+    title: 'Contradictory directives',
+    scope: 'project',
+    check: (_doc, ctx) => {
+      const all = ctx.docs.flatMap(directives);
+      const bySubject = new Map();
+      for (const d of all) {
+        if (!bySubject.has(d.name)) bySubject.set(d.name, []);
+        bySubject.get(d.name).push(d);
+      }
+      const findings = [];
+      for (const [name, group] of bySubject) {
+        const require = group.find((g) => g.polarity === 'require');
+        const forbid = group.find((g) => g.polarity === 'forbid');
+        if (!require || !forbid) continue;
+        findings.push({
+          ruleId: 'RAQIB061',
+          path: forbid.path,
+          line: forbid.line,
+          column: 1,
+          severity: 'high',
+          title: 'Contradictory directives',
+          message: `"${name}" is required at ${require.path}:${require.line} and forbidden at ${forbid.path}:${forbid.line}. Which one wins depends on ordering the agent does not expose.`,
+          excerpt: `${excerpt(require.text)}  ⟷  ${excerpt(forbid.text)}`,
+          remediation: 'Resolve it in the file, not in the model. Delete the stale directive or scope each one to a directory.',
+        });
+      }
+      return findings;
+    },
+  },
+];

package/src/rules/guardrails.js

@@ -0,0 +1,110 @@
+import { scan, isProhibition } from '../lib/text.js';
+
+/**
+ * Instructions that dismantle the checks standing between the agent and the
+ * repository. None of these are exotic. They are the lines people add on a
+ * Friday to make the agent stop nagging, and then forget.
+ */
+
+const RULES = [
+  {
+    id: 'RAQIB040',
+    severity: 'critical',
+    title: 'Permission prompts disabled',
+    pattern: /--dangerously-skip-permissions\b|--yolo\b|\bauto[- ]?approve\s+(all|every|any)\b/i,
+    message: 'Turns off the confirmation step for every action the agent takes, including destructive ones.',
+    remediation: 'Grant specific tools in an allowlist instead of removing the prompt entirely.',
+  },
+  {
+    id: 'RAQIB041',
+    severity: 'critical',
+    title: 'Recursive delete',
+    pattern: /\brm\s+-[a-zA-Z]*[rR][a-zA-Z]*f[a-zA-Z]*\s+(\/|~|\$HOME|\*)/,
+    message: 'A recursive force-delete rooted at the filesystem, the home directory, or a glob.',
+    remediation: 'Delete the line. If a clean step is genuinely needed, scope it to a named build directory.',
+  },
+  {
+    id: 'RAQIB042',
+    severity: 'high',
+    title: 'Confirmation waived',
+    pattern: /\b(never|do\s+not|don'?t)\s+(ask|prompt|request|wait)\s+(me\s+|the\s+user\s+)?(for\s+)?(confirmation|permission|approval|input)/i,
+    message: 'Removes the human decision point before the agent acts.',
+    remediation: 'Name the narrow set of actions that may run unattended rather than waiving confirmation wholesale.',
+    allowProhibition: true,
+  },
+  {
+    id: 'RAQIB043',
+    severity: 'high',
+    title: 'Verification step skipped',
+    pattern: /\b(skip|bypass|ignore|disable|don'?t\s+run|do\s+not\s+run|no\s+need\s+to\s+run)\s+(the\s+|any\s+|all\s+)?(tests?|test\s+suite|linting|linter|type\s?check\w*|ci\b|checks?|code\s?review|security\s+(scan|review|check))/i,
+    message: 'Tells the agent to ship without the verification the project otherwise runs.',
+    remediation: 'If a check is too slow, fix the check. An instruction file that disables it hides the problem from everyone.',
+    allowProhibition: true,
+  },
+  {
+    id: 'RAQIB044',
+    severity: 'high',
+    title: 'Git hooks bypassed',
+    pattern: /\bgit\s+(commit|push)\b[^\n]{0,80}--no-verify\b|--no-verify\b[^\n]{0,80}\bgit\s+(commit|push)\b/i,
+    message: 'Commits or pushes with pre-commit hooks disabled.',
+    remediation: 'Remove the flag. Hooks exist because someone decided the check was worth blocking on.',
+  },
+  {
+    id: 'RAQIB045',
+    severity: 'medium',
+    title: 'Force push',
+    pattern: /\b(git\s+)?push\s+(--force\b(?!-with-lease)|-f\b)/,
+    message: 'A force push overwrites history that other people may have pulled.',
+    remediation: 'Use --force-with-lease, which refuses when the remote has moved.',
+  },
+  {
+    id: 'RAQIB046',
+    severity: 'medium',
+    title: 'Direct commit to the default branch',
+    pattern: /\b(commit|push)\s+(changes\s+)?(directly\s+)?to\s+(the\s+)?(main|master|trunk)\b/i,
+    message: 'Directs the agent to write to the default branch without review.',
+    remediation: 'Have the agent branch first. Every review control the repository has hangs off the pull request.',
+  },
+  {
+    id: 'RAQIB047',
+    severity: 'medium',
+    title: 'Blanket permissions change',
+    pattern: /\bchmod\s+(-R\s+)?777\b/,
+    message: 'Makes files world-writable.',
+    remediation: 'Set the narrowest mode that lets the task run.',
+  },
+  {
+    id: 'RAQIB048',
+    severity: 'medium',
+    title: 'Unattended privilege escalation',
+    pattern: /\bsudo\s+(?!-h|--help)[a-z]/i,
+    message: 'The agent is told to run a command as root without a human in the loop.',
+    remediation: 'Run privileged steps yourself, or grant the specific capability the task needs.',
+    // A documented package install is the overwhelmingly common legitimate
+    // use, and reporting four of them at medium buries the one that matters.
+    downgradeWhen: /\b(apt|apt-get|dnf|yum|pacman|apk|zypper|brew|snap|port)\b/i,
+    downgradeTo: 'low',
+  },
+];
+
+export const rules = RULES.map((rule) => ({
+  id: rule.id,
+  severity: rule.severity,
+  title: rule.title,
+  check: (doc) =>
+    scan(doc, rule.pattern, (match, line, context) => {
+      // Most rules describe an action, so "never force push" must not fire.
+      // The context is the enclosing Markdown block, because prose wraps and
+      // the negation is often on the line above. A few rules are themselves
+      // phrased as prohibitions ("do not run the tests") and opt out.
+      if (!rule.allowProhibition && isProhibition(context)) return null;
+      const severity = rule.downgradeWhen?.test(line) ? rule.downgradeTo : rule.severity;
+      return {
+        ruleId: rule.id,
+        severity,
+        title: rule.title,
+        message: rule.message,
+        remediation: rule.remediation,
+      };
+    }),
+}));

package/src/rules/hidden.js

@@ -0,0 +1,121 @@
+import { scan, excerpt } from '../lib/text.js';
+
+/**
+ * Text the reviewer cannot see but the agent still reads.
+ *
+ * GitHub renders Markdown; the agent consumes bytes. Everything in this file
+ * is invisible or near-invisible in a pull request diff and fully legible to
+ * the model.
+ */
+
+/** Unicode tag block: an exact, invisible mirror of ASCII. Nothing benign uses it in prose. */
+const TAG_BLOCK = /[\u{E0000}-\u{E007F}]+/gu;
+
+/** Bidirectional overrides, the Trojan Source class (CVE-2021-42574). */
+const BIDI = /[‪-‮⁦-⁩]+/gu;
+
+/** Zero-width and invisible separators. */
+const ZERO_WIDTH = /[​-‏⁠-⁤­᠎]+/gu;
+
+const codePoints = (text) =>
+  [...text].map((c) => `U+${c.codePointAt(0).toString(16).toUpperCase().padStart(4, '0')}`).join(' ');
+
+/** Decode the tag block back to the ASCII it mirrors, so the report shows the payload. */
+const decodeTags = (text) =>
+  [...text]
+    .map((c) => String.fromCharCode(c.codePointAt(0) - 0xe0000))
+    .join('')
+    .replace(/[^\x20-\x7e]/g, '');
+
+const IMPERATIVE = /\b(ignore|disregard|you\s+must|you\s+should|always|never|do\s+not|don'?t|send|post|read|execute|run|delete|remove|instead|override|instruction)\b/i;
+
+export const rules = [
+  {
+    id: 'RAQIB020',
+    severity: 'critical',
+    title: 'Invisible Unicode tag payload',
+    check: (doc) =>
+      scan(doc, TAG_BLOCK, (match) => ({
+        ruleId: 'RAQIB020',
+        severity: 'critical',
+        title: 'Invisible Unicode tag payload',
+        message: `${[...match[0]].length} character(s) from the Unicode tag block, which renders as nothing and decodes to: "${excerpt(decodeTags(match[0]))}"`,
+        remediation: 'Delete the characters and treat the commit that introduced them as hostile.',
+      })),
+  },
+  {
+    id: 'RAQIB021',
+    severity: 'critical',
+    title: 'Bidirectional override character',
+    check: (doc) =>
+      scan(doc, BIDI, (match) => ({
+        ruleId: 'RAQIB021',
+        severity: 'critical',
+        title: 'Bidirectional override character',
+        message: `Text-direction control characters (${codePoints(match[0])}) can make a line display in an order different from the one the agent reads.`,
+        remediation: 'Delete the control characters. Genuine right-to-left content does not need explicit overrides.',
+      })),
+  },
+  {
+    id: 'RAQIB022',
+    severity: 'high',
+    title: 'Zero-width characters',
+    check: (doc) =>
+      scan(doc, ZERO_WIDTH, (match) => ({
+        ruleId: 'RAQIB022',
+        severity: 'high',
+        title: 'Zero-width characters',
+        message: `Invisible characters (${codePoints(match[0])}) embedded in the instructions.`,
+        remediation:
+          'Usually a copy-paste artefact, occasionally a smuggled payload. Strip them either way: they cost tokens and hide diffs.',
+      })),
+  },
+  {
+    id: 'RAQIB023',
+    severity: 'high',
+    title: 'Directive hidden in an HTML comment',
+    /**
+     * GitHub hides HTML comments when it renders Markdown. The agent does not.
+     * A comment holding prose is fine; one holding orders is a hiding place.
+     */
+    check: (doc) =>
+      scan(doc, /<!--([\s\S]{0,2000}?)-->/g, (match) => {
+        const body = match[1];
+        if (!IMPERATIVE.test(body)) return null;
+        return {
+          ruleId: 'RAQIB023',
+          severity: 'high',
+          title: 'Directive hidden in an HTML comment',
+          message: `An HTML comment carries what reads as an instruction: "${excerpt(body)}". GitHub hides this when rendering; the agent reads it.`,
+          remediation: 'Move the directive into the visible body of the file, or delete it.',
+        };
+      }),
+  },
+  {
+    id: 'RAQIB024',
+    severity: 'medium',
+    title: 'Payload past the visible edge',
+    /**
+     * A very long line pushes its tail beyond the horizontal cut-off of a diff
+     * view. The reviewer scrolls past; the agent reads to the end.
+     */
+    check: (doc) => {
+      const findings = [];
+      doc.lines.forEach((line, index) => {
+        if (line.length <= 2000) return;
+        findings.push({
+          ruleId: 'RAQIB024',
+          path: doc.path,
+          line: index + 1,
+          column: 2001,
+          severity: 'medium',
+          title: 'Payload past the visible edge',
+          message: `Line is ${line.length} characters long. Content this far right is not visible in a normal diff view.`,
+          excerpt: excerpt(line.slice(2000)),
+          remediation: 'Wrap the line so a reviewer sees everything the agent sees.',
+        });
+      });
+      return findings;
+    },
+  },
+];

package/src/rules/index.js

@@ -0,0 +1,25 @@
+import { rules as injection } from './injection.js';
+import { rules as hidden } from './hidden.js';
+import { rules as secrets } from './secrets.js';
+import { rules as guardrails } from './guardrails.js';
+import { rules as budget } from './budget.js';
+import { rules as coherence } from './coherence.js';
+
+/**
+ * Every rule, grouped by the question it answers.
+ *
+ * `scope: 'project'` rules run once over all documents instead of once per
+ * document; everything else runs per file.
+ */
+export const CATEGORIES = {
+  injection: { label: 'Prompt injection & hijacking', rules: injection },
+  hidden: { label: 'Hidden text', rules: hidden },
+  secrets: { label: 'Leaked credentials', rules: secrets },
+  guardrails: { label: 'Weakened guardrails', rules: guardrails },
+  budget: { label: 'Context budget & noise', rules: budget },
+  coherence: { label: 'Coherence', rules: coherence },
+};
+
+export const ALL_RULES = Object.entries(CATEGORIES).flatMap(([category, group]) =>
+  group.rules.map((rule) => ({ ...rule, category })),
+);

package/src/rules/injection.js

@@ -0,0 +1,152 @@
+import { scan, isProhibition } from '../lib/text.js';
+
+/**
+ * Prompt injection and agent hijacking.
+ *
+ * An instruction file is prepended to every request the coding agent makes.
+ * Anything written here is, from the model's point of view, indistinguishable
+ * from an order given by the repository owner. These rules look for text that
+ * tries to use that position against the operator.
+ */
+
+const OVERRIDE = [
+  {
+    id: 'RAQIB001',
+    severity: 'critical',
+    title: 'Instruction override',
+    pattern: /\b(ignore|disregard|forget)\s+(all\s+|any\s+|the\s+)?(previous|prior|above|earlier|preceding|system|foregoing)\s+(instructions?|directions?|rules?|prompts?|messages?|context)/i,
+    message: 'Orders the agent to discard instructions it was given before reaching this file.',
+    remediation: 'Delete the line. A repository instruction file has no legitimate reason to revoke the operator’s own configuration.',
+  },
+  {
+    id: 'RAQIB002',
+    severity: 'critical',
+    title: 'Safety control bypass',
+    pattern: /\b(disable|bypass|ignore|override|turn\s+off|switch\s+off|circumvent)\s+(your\s+|the\s+|all\s+)?(safety|guardrails?|security\s+(checks?|controls?)|restrictions?|content\s+polic\w*|filters?|limitations?)/i,
+    message: 'Instructs the agent to switch off its own safety or policy controls.',
+    remediation: 'Delete the line and review who added it.',
+  },
+  {
+    id: 'RAQIB003',
+    severity: 'critical',
+    title: 'Concealment from the operator',
+    pattern: /\b(do\s+not|don'?t|never)\s+(tell|inform|notify|mention\s+to|reveal\s+to|show|disclose\s+to|report\s+to)\s+(the\s+)?(user|operator|developer|human|maintainer)/i,
+    message: 'Tells the agent to hide part of its behaviour from the person running it.',
+    remediation: 'Delete the line. Instructions that ask an agent to keep secrets from its operator are hostile by construction.',
+  },
+  {
+    id: 'RAQIB004',
+    severity: 'high',
+    title: 'Silent action',
+    pattern: /\bwithout\s+(asking|telling|informing|notifying|consulting|confirming\s+with)\s+(the\s+)?(user|operator|anyone|permission)/i,
+    message: 'Removes the confirmation step between the agent and an action.',
+    remediation: 'State explicitly which narrow actions may proceed unattended, rather than granting blanket silence.',
+  },
+  {
+    id: 'RAQIB005',
+    severity: 'high',
+    title: 'Precedence claim',
+    pattern: /\bth(is|ese)\s+(file|instructions?|rules?|directives?)\s+(take|takes|have|has|override|overrides?)\s+(absolute\s+|complete\s+|full\s+)?(precedence|priority|authority)\s+over\b/i,
+    message: 'Asserts authority over instructions from the operator or the platform.',
+    remediation: 'Instruction files describe a repository. They do not outrank the person running the agent.',
+  },
+  {
+    id: 'RAQIB006',
+    severity: 'high',
+    title: 'Persona reset',
+    pattern: /\byou\s+are\s+(no\s+longer|not)\s+(bound|restricted|limited|constrained|required)\b|\bfrom\s+now\s+on\s+you\s+(are|will\s+be|must\s+act)\b/i,
+    message: 'Attempts to redefine the agent’s role or lift its constraints.',
+    remediation: 'Describe the codebase, not the agent’s identity.',
+  },
+];
+
+/** Files and paths that carry credentials. Reading them is the precondition to leaking them. */
+const SECRET_PATH = /(\.env(?:\.[\w.-]+)?|~\/\.ssh\/?[\w.-]*|id_[rd]sa|\.aws\/credentials|\.npmrc|\.netrc|\.git-credentials|kubeconfig|\.docker\/config\.json|secrets?\.(?:ya?ml|json|toml))/i;
+
+/** Verbs that turn a mention of a secret file into an instruction to open it. */
+const READ_VERB = /\b(read|cat|open|load|include|print|dump|show|display|parse|inspect|access|fetch)\b/i;
+
+/** Verbs that move data off the machine. */
+const SEND_VERB = /\b(send|post|upload|exfiltrat\w*|transmit|forward|attach|share|report|submit|push|email|curl|wget)\b/i;
+
+export const rules = [
+  ...OVERRIDE.map((rule) => ({
+    id: rule.id,
+    severity: rule.severity,
+    title: rule.title,
+    check: (doc) =>
+      scan(doc, rule.pattern, () => ({
+        ruleId: rule.id,
+        severity: rule.severity,
+        title: rule.title,
+        message: rule.message,
+        remediation: rule.remediation,
+      })),
+  })),
+
+  {
+    id: 'RAQIB010',
+    severity: 'critical',
+    title: 'Credential exfiltration',
+    /**
+     * Fires only when a line both names a credential store and tells the agent
+     * to move it somewhere. "Never commit .env" names the same file and must
+     * not fire, which is why the prohibition check comes first.
+     */
+    check: (doc) =>
+      scan(doc, SECRET_PATH, (match, line, context) => {
+        if (isProhibition(context)) return null;
+        const sends = SEND_VERB.test(line);
+        const reads = READ_VERB.test(line);
+        if (!sends && !reads) return null;
+        return {
+          ruleId: 'RAQIB010',
+          severity: sends ? 'critical' : 'high',
+          title: sends ? 'Credential exfiltration' : 'Credential access',
+          message: sends
+            ? `Instructs the agent to move the contents of ${match[0]} somewhere else.`
+            : `Instructs the agent to read ${match[0]}, which holds credentials.`,
+          remediation:
+            'Remove the directive. If the agent genuinely needs a value, name the environment variable it should expect rather than the file that stores every secret.',
+        };
+      }),
+  },
+
+  {
+    id: 'RAQIB011',
+    severity: 'critical',
+    title: 'Remote code execution',
+    check: (doc) =>
+      scan(
+        doc,
+        /\b(curl|wget|iwr|Invoke-WebRequest)\b[^\n|]{0,200}\|\s*(sudo\s+)?(ba|z|k)?sh\b|\bbase64\s+(-d|--decode|-D)\b[^\n|]{0,120}\|\s*(ba|z|k)?sh\b/i,
+        (match, line, context) => (isProhibition(context) ? null : {
+          ruleId: 'RAQIB011',
+          severity: 'critical',
+          title: 'Remote code execution',
+          message: 'Pipes downloaded or decoded content straight into a shell.',
+          remediation:
+            'Pin an installer to a version and a checksum, or vendor the script into the repository where it can be reviewed.',
+        }),
+      ),
+  },
+
+  {
+    id: 'RAQIB012',
+    severity: 'high',
+    title: 'Unattended outbound request',
+    check: (doc) =>
+      scan(
+        doc,
+        /\b(curl|wget|fetch|axios|requests\.(?:post|put)|Invoke-WebRequest|nc|netcat)\b[^\n]{0,160}?https?:\/\/(?!(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]))([\w.-]+)/i,
+        (match, line, context) => (isProhibition(context) ? null : {
+          ruleId: 'RAQIB012',
+          severity: 'high',
+          title: 'Unattended outbound request',
+          message: `Directs the agent to contact ${match[2]} on its own.`,
+          remediation:
+            'Name the host in an allowlist your operator controls, and say what may be sent to it.',
+        }),
+      ),
+  },
+];

package/src/rules/secrets.js

@@ -0,0 +1,82 @@
+import { scan } from '../lib/text.js';
+
+/**
+ * Credentials pasted into the instruction file itself.
+ *
+ * This happens constantly: someone tells the agent "use this key to call the
+ * staging API" and commits it. The file is public, indexed, and copied into
+ * every fork.
+ */
+
+const PLACEHOLDER = /(x{4,}|your[_-]?|example|placeholder|changeme|dummy|redacted|<[^>]+>|\.\.\.|abc123|sample|fake|test[_-]?key|insert)/i;
+
+const PATTERNS = [
+  { id: 'RAQIB030', label: 'GitHub token', re: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/ },
+  { id: 'RAQIB030', label: 'GitHub fine-grained token', re: /\bgithub_pat_[A-Za-z0-9_]{22,255}\b/ },
+  { id: 'RAQIB031', label: 'OpenAI API key', re: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}\b/ },
+  { id: 'RAQIB032', label: 'Anthropic API key', re: /\bsk-ant-[A-Za-z0-9_-]{20,}\b/ },
+  { id: 'RAQIB033', label: 'AWS access key id', re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/ },
+  { id: 'RAQIB034', label: 'Slack token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/ },
+  { id: 'RAQIB035', label: 'Google API key', re: /\bAIza[0-9A-Za-z_-]{35}\b/ },
+  { id: 'RAQIB036', label: 'Stripe secret key', re: /\b(?:sk|rk)_live_[0-9A-Za-z]{20,}\b/ },
+];
+
+/** Mask everything but the shape, so the report itself never leaks the value. */
+const mask = (value) =>
+  value.length <= 12 ? `${value.slice(0, 4)}…` : `${value.slice(0, 6)}…${value.slice(-2)} (${value.length} chars)`;
+
+export const rules = [
+  ...PATTERNS.map(({ id, label, re }) => ({
+    id,
+    severity: 'critical',
+    title: `Hardcoded ${label}`,
+    check: (doc) =>
+      scan(doc, re, (match) =>
+        PLACEHOLDER.test(match[0])
+          ? null
+          : {
+              ruleId: id,
+              severity: 'critical',
+              title: `Hardcoded ${label}`,
+              message: `A live-looking ${label} sits in the instruction file: ${mask(match[0])}`,
+              remediation: `Rotate the credential now, since it is in the git history regardless of the next commit, then reference an environment variable instead.`,
+            },
+      ),
+  })),
+
+  {
+    id: 'RAQIB037',
+    severity: 'critical',
+    title: 'Private key block',
+    check: (doc) =>
+      scan(doc, /-----BEGIN\s+[A-Z ]{0,30}PRIVATE KEY-----/g, () => ({
+        ruleId: 'RAQIB037',
+        severity: 'critical',
+        title: 'Private key block',
+        message: 'A PEM private key is embedded in the instruction file.',
+        remediation: 'Revoke and reissue the key pair, then purge it from the history.',
+      })),
+  },
+
+  {
+    id: 'RAQIB038',
+    severity: 'high',
+    title: 'Credential-shaped assignment',
+    check: (doc) =>
+      scan(
+        doc,
+        /\b(api[_-]?key|secret|token|password|passwd|credential)\b\s*[:=]\s*["']([^"'\s]{16,})["']/gi,
+        (match) =>
+          PLACEHOLDER.test(match[2])
+            ? null
+            : {
+                ruleId: 'RAQIB038',
+                severity: 'high',
+                title: 'Credential-shaped assignment',
+                message: `A value is assigned to \`${match[1]}\` in plain text: ${mask(match[2])}`,
+                remediation:
+                  'If it is real, rotate it. If it is an example, make it obviously fake (YOUR_API_KEY_HERE) so neither a reader nor a scanner has to guess.',
+              },
+      ),
+  },
+];