renma 0.6.1 → 0.8.0

package/dist/security-diagnostics.js

@@ -18,6 +18,7 @@ const RULES = {
         ],
         llmHint: "Add small frontmatter policy fields that describe whether network access, external uploads, and secret material are allowed for this artifact.",
         confidence: "medium",
+        riskClass: "advisory",
     },
     policyContradiction: {
         id: DIAGNOSTIC_IDS.SEC_POLICY_CONTRADICTION,
@@ -35,6 +36,7 @@ const RULES = {
         ],
         llmHint: "Resolve the policy by choosing the stricter allowed behavior or by separating instructions into different assets with explicit metadata.",
         confidence: "high",
+        riskClass: "violation",
     },
     bodyPolicyContradiction: {
         id: DIAGNOSTIC_IDS.SEC_BODY_POLICY_CONTRADICTION,
@@ -52,6 +54,7 @@ const RULES = {
         ],
         llmHint: "Resolve body and metadata conflicts by choosing the stricter behavior or separating conflicting instructions into different assets.",
         confidence: "high",
+        riskClass: "violation",
     },
     policyProfileNotFound: {
         id: DIAGNOSTIC_IDS.SEC_POLICY_PROFILE_NOT_FOUND,
@@ -69,6 +72,7 @@ const RULES = {
         ],
         llmHint: "Use a configured security_profile value, or add the missing profile under security.profiles with explicit policy fields.",
         confidence: "high",
+        riskClass: "violation",
     },
     policyProfileCycle: {
         id: DIAGNOSTIC_IDS.SEC_POLICY_PROFILE_CYCLE,
@@ -86,6 +90,7 @@ const RULES = {
         ],
         llmHint: "Remove or rewrite the cyclic profile reference so the selected security profile has a deterministic parent chain.",
         confidence: "high",
+        riskClass: "violation",
     },
     policyOverrideContradiction: {
         id: DIAGNOSTIC_IDS.SEC_POLICY_OVERRIDE_CONTRADICTION,
@@ -103,6 +108,7 @@ const RULES = {
         ],
         llmHint: "Treat explicit false policy fields in the artifact as authoritative and adjust the referenced profile or repo-level security config.",
         confidence: "high",
+        riskClass: "violation",
     },
     forbiddenInputInstruction: {
         id: DIAGNOSTIC_IDS.SEC_FORBIDDEN_INPUT_INSTRUCTION,
@@ -120,6 +126,7 @@ const RULES = {
         ],
         llmHint: "Rewrite the instruction so it avoids profile-forbidden inputs such as secrets, credentials, private keys, or customer data.",
         confidence: "high",
+        riskClass: "violation",
     },
     instructionViolatesPolicy: {
         id: DIAGNOSTIC_IDS.SEC_INSTRUCTION_VIOLATES_POLICY,
@@ -137,6 +144,7 @@ const RULES = {
         ],
         llmHint: "Find the instruction that asks for denied behavior and rewrite it to stay within the artifact's declared security policy.",
         confidence: "high",
+        riskClass: "violation",
     },
     missingHumanApprovalGuard: {
         id: DIAGNOSTIC_IDS.SEC_MISSING_HUMAN_APPROVAL_GUARD,
@@ -154,6 +162,7 @@ const RULES = {
         ],
         llmHint: "Insert an explicit human approval requirement next to upload, POST, cloud sync, or external sharing instructions.",
         confidence: "medium",
+        riskClass: "violation",
     },
     sensitiveFileReference: {
         id: DIAGNOSTIC_IDS.SEC_SENSITIVE_FILE_REFERENCE,
@@ -171,6 +180,7 @@ const RULES = {
         ],
         llmHint: "Inspect this reference and either replace it with a safe placeholder or add explicit no-disclosure handling instructions.",
         confidence: "high",
+        riskClass: "violation",
     },
     secretMaterialInstruction: {
         id: DIAGNOSTIC_IDS.SEC_SECRET_MATERIAL_INSTRUCTION,
@@ -188,6 +198,7 @@ const RULES = {
         ],
         llmHint: "Rewrite this instruction so secret-bearing files are never copied into prompts, logs, uploads, or diagnostics.",
         confidence: "high",
+        riskClass: "violation",
     },
     externalUploadInstruction: {
         id: DIAGNOSTIC_IDS.SEC_EXTERNAL_UPLOAD_INSTRUCTION,
@@ -205,6 +216,7 @@ const RULES = {
         ],
         llmHint: "Add a human approval gate and approved destination metadata, or replace the upload with a local-only workflow.",
         confidence: "high",
+        riskClass: "suspicious",
     },
     unapprovedNetworkDestination: {
         id: DIAGNOSTIC_IDS.SEC_UNAPPROVED_NETWORK_DESTINATION,
@@ -222,6 +234,7 @@ const RULES = {
         ],
         llmHint: "Compare the referenced URL or host to approved_network_destinations and either approve it explicitly or remove the instruction.",
         confidence: "high",
+        riskClass: "violation",
     },
     unapprovedUploadDestination: {
         id: DIAGNOSTIC_IDS.SEC_UNAPPROVED_UPLOAD_DESTINATION,
@@ -239,6 +252,7 @@ const RULES = {
         ],
         llmHint: "Compare the referenced upload URL or host to security.approvedUploadDomains and either approve it explicitly or remove the instruction.",
         confidence: "high",
+        riskClass: "violation",
     },
     bulkDataSharingInstruction: {
         id: DIAGNOSTIC_IDS.SEC_BULK_DATA_SHARING_INSTRUCTION,
@@ -256,6 +270,7 @@ const RULES = {
         ],
         llmHint: "Replace broad sharing language with scoped file paths, limited snippets, and redaction requirements.",
         confidence: "medium",
+        riskClass: "suspicious",
     },
     cloudUploadInstruction: {
         id: DIAGNOSTIC_IDS.SEC_CLOUD_UPLOAD_INSTRUCTION,
@@ -273,6 +288,7 @@ const RULES = {
         ],
         llmHint: "Turn the cloud upload into a local-only output, or add policy metadata and a human approval guard.",
         confidence: "medium",
+        riskClass: "suspicious",
     },
     overbroadContextInstruction: {
         id: DIAGNOSTIC_IDS.SEC_OVERBROAD_CONTEXT_INSTRUCTION,
@@ -290,6 +306,7 @@ const RULES = {
         ],
         llmHint: "Replace broad context collection with bounded paths, task-relevant snippets, and explicit exclusions for secrets.",
         confidence: "medium",
+        riskClass: "suspicious",
     },
     noRedactionInstruction: {
         id: DIAGNOSTIC_IDS.SEC_NO_REDACTION_INSTRUCTION,
@@ -307,6 +324,7 @@ const RULES = {
         ],
         llmHint: "Replace no-redaction wording with explicit redaction requirements for secrets and sensitive data.",
         confidence: "high",
+        riskClass: "violation",
     },
     unpinnedRemoteScript: {
         id: DIAGNOSTIC_IDS.SEC_UNPINNED_REMOTE_SCRIPT,
@@ -324,6 +342,7 @@ const RULES = {
         ],
         llmHint: "Rewrite the install instruction to download a pinned artifact and verify it before execution.",
         confidence: "high",
+        riskClass: "suspicious",
     },
     unpinnedDependencyInstall: {
         id: DIAGNOSTIC_IDS.SEC_UNPINNED_DEPENDENCY_INSTALL,
@@ -341,6 +360,7 @@ const RULES = {
         ],
         llmHint: "Pin packages, images, or formulas in setup instructions, or route through the repository's lockfile command.",
         confidence: "medium",
+        riskClass: "suspicious",
     },
     privilegedCommandWithoutGuard: {
         id: DIAGNOSTIC_IDS.SEC_PRIVILEGED_COMMAND_WITHOUT_GUARD,
@@ -358,6 +378,27 @@ const RULES = {
         ],
         llmHint: "Add an explicit approval requirement before sudo, chmod/chown, docker privileged operations, or system writes.",
         confidence: "medium",
+        riskClass: "suspicious",
+    },
+    destructiveCommand: {
+        id: DIAGNOSTIC_IDS.SEC_DESTRUCTIVE_COMMAND,
+        category: "safety",
+        title: "Destructive command lacks a review guard",
+        whyItMatters: "Destructive commands in agent-facing guidance can erase files, reset Git state, remove containers, or delete infrastructure when copied or followed by an agent.",
+        remediation: "Remove the destructive command, replace it with a safer scoped command, or add explicit human approval, dry-run, backup, and rollback guidance.",
+        constraints: [
+            "Do not normalize destructive commands as routine setup.",
+            "Keep any required destructive action narrowly scoped.",
+            "Keep approval and recovery guidance close to the command.",
+        ],
+        verificationSteps: [
+            "Run renma scan.",
+            "Confirm destructive commands are removed or guarded.",
+            "Review any remaining command for scope, backup, and rollback guidance.",
+        ],
+        llmHint: "Replace forced deletion, hard reset, clean, prune, or delete commands with safer alternatives, or add explicit approval plus verification and rollback steps.",
+        confidence: "high",
+        riskClass: "violation",
     },
     dangerousToolInstruction: {
         id: DIAGNOSTIC_IDS.SEC_DANGEROUS_TOOL_INSTRUCTION,
@@ -375,6 +416,7 @@ const RULES = {
         ],
         llmHint: "Check security.disallowedCommands and remove instructions that invoke those commands or services.",
         confidence: "high",
+        riskClass: "violation",
     },
     credentialInCommandArg: {
         id: DIAGNOSTIC_IDS.SEC_CREDENTIAL_IN_COMMAND_ARG,
@@ -392,6 +434,7 @@ const RULES = {
         ],
         llmHint: "Replace literal credential command arguments with safe placeholders and approved secret handling guidance.",
         confidence: "high",
+        riskClass: "violation",
     },
     predictableTempPath: {
         id: DIAGNOSTIC_IDS.SEC_PREDICTABLE_TEMP_PATH,
@@ -409,6 +452,7 @@ const RULES = {
         ],
         llmHint: "Replace predictable /tmp paths for profiles, credentials, certs, logs, or tokens with secure temporary directory handling.",
         confidence: "medium",
+        riskClass: "suspicious",
     },
 };
 const BOOLEAN_POLICY_FIELDS = new Map([
@@ -465,11 +509,15 @@ const BULK_DATA_RE = /\b(entire|whole|all|full|complete|raw)\b.*\b(repo|reposito
 const UNDISCLOSED_DATA_RE = /\b(include|attach|paste|upload|send|share|dump|export|print|collect|provide)\b.*\b(all|entire|full|complete|raw)\b.*\b(environment variables|env vars|env|process\.env|secrets?|credentials?|tokens?)\b/i;
 const OVERBROAD_CONTEXT_RE = /\b(load|read|include|attach|paste|ingest|collect|provide|send)\b.*\b(entire|whole|all|full|complete|raw)\b.*\b(repo|repository|workspace|codebase|context|logs?|files?)\b/i;
 const NO_REDACTION_RE = /\b(do not|don't|without|no|never)\b.{0,30}\b(redact|redaction|sanitize|mask|obfuscate)\b|\b(redact|sanitize|mask|obfuscate)\b.{0,30}\b(disabled|false|off)\b/i;
-const APPROVAL_RE = /\b(human|user|owner|maintainer|reviewer|security)\b.{0,40}\b(approve|approval|confirm|confirmation|review|consent|authorize|authorization)\b|\b(ask|require|obtain|wait for)\b.{0,40}\b(approval|confirmation|consent|authorization)\b/i;
+const APPROVAL_RE = /\b(ask|prompt|require|obtain|wait for)\b.{0,50}\b(human|user|owner|maintainer|reviewer|security)?\s*(approval|confirmation|consent|authorization|review)\b|\b(human|user|owner|maintainer|reviewer|security)\b.{0,50}\b(approve|approval|confirm|confirmation|review|consent|authorize|authorization)\b|\bonly\b.{0,20}\b(after|with)\b.{0,40}\b(explicit\s+)?(human|user|owner|maintainer|reviewer|security)?\s*(approval|confirmation|review|authorization)\b|\bdo\s+not\s+run\s+automatically\b.{0,60}\b(human|user|maintainer|review|approval|confirmation)\b/i;
+const WEAK_OR_NEGATED_APPROVAL_RE = /\b(no approval|approval is not|approval isn't|approved by default|approval by default|without approval|automatically approved|safe|run carefully|make sure it works)\b/i;
+const RECOVERY_GUARD_RE = /\b(create|make|take|keep|verify|confirm|document|check|use|run)\b.{0,40}\b(backup|rollback|roll back|restore|dry[- ]run|revert)\b|\b(backup|rollback|roll back|restore|dry[- ]run|revert)\b.{0,40}\b(first|before|steps?|plan|guidance|confirm|verify|check)\b/i;
 const SECRET_WORD_RE = /\b(secret|secrets|credential|credentials|token|password|passwd|api key|apikey|private key|ssh key|signing key|certificate|cert|auth)\b/i;
 const SECRET_ACTION_RE = /\b(copy|print|cat|echo|paste|upload|send|share|attach|include|dump|export|log|summari[sz]e|read)\b/i;
 const SAFE_NEGATION_RE = /\b(not|never|avoid|exclude|without|redact|mock|fake|sample|placeholder|dummy)\b.{0,40}\b(secret|secrets|credential|credentials|token|password|private key)\b|\b(secret|secrets|credential|credentials|token|password|private key)\b.{0,40}\b(not|never|avoid|exclude|redact|mock|fake|sample|placeholder|dummy)\b/i;
-const REMOTE_SCRIPT_RE = /\b(curl|wget)\b[^\n]*?(https?:\/\/[^\s|`'")]+)[^\n]*(\|\s*(sh|bash|zsh)|\b(sh|bash|zsh)\b)/i;
+const DEFENSIVE_ACTION_RE = /\b(do\s+not|don't|never|avoid|exclude|skip|omit|forbid|forbidden|disallow|block)\b.{0,80}\b(upload|send|post|put|share|attach|submit|sync|push|publish|copy|paste|include|print|cat|echo|log|dump|curl|wget|pipe|bash|sh|sudo|chmod|chown|rm\s+-|git\s+reset|git\s+clean|delete|install|add)\b/i;
+const GUARDED_ACTION_RE = /\b(only|unless|after|with|before)\b.{0,80}\b(approval|approved|confirmation|confirm|human review|maintainer review|redact|redacted|redaction|dry[- ]run|backup|rollback)\b|\b(redact|redacted|redaction|approval|approved|confirmation|confirm|human review|maintainer review|dry[- ]run|backup|rollback)\b.{0,80}\b(before|after|upload|send|post|put|share|sudo|rm\s+-|git\s+reset|git\s+clean|delete|install|add)\b/i;
+const REMOTE_SCRIPT_RE = /\b(curl|wget)\b[^\n]*?(https?:\/\/[^\s|`'")]+)[^\n]*\|\s*(sh|bash|zsh)\b/i;
 const PRIVILEGED_COMMAND_RE = /\b(sudo|chmod\s+(777|666|\+w|a\+w)|chown\b|docker\s+run\b[^\n]*(--privileged|-v\s+\/|--pid=host)|mount\b|launchctl\b|systemctl\b)\b/i;
 const DESTRUCTIVE_COMMAND_RE = /\b(rm\s+-[^\n]*[rf][^\n]*|git\s+reset\s+--hard|git\s+clean\s+-[^\n]*[xdf][^\n]*|docker\s+(?:rm|rmi|system\s+prune|volume\s+rm)\b|kubectl\s+delete\b|drop\s+database|truncate\s+table)\b/i;
 const CREDENTIAL_ARG_RE = /--?(token|password|passwd|secret|credential|api[-_]?key|key|cert|certificate|signing[-_]?key|auth)(=|\s+)(?!<|\$|\{|\[|REDACTED|redacted|xxx|XXX|placeholder|example)[^\s"'`]+/i;
@@ -503,7 +551,8 @@ function securityFindingsForArtifact(artifact, securityConfig) {
         : -1;
     const scanStart = frontmatterEnd > 0 ? frontmatterEnd + 1 : 0;
     let inFence = false;
-    let recentApprovalLine = 0;
+    let recentHumanApprovalLine = 0;
+    let recentRiskMitigationLine = 0;
     if ((artifact.kind === "skill" || artifact.kind === "context") &&
         effectiveAllowedDataClass(policy) === undefined &&
         effectiveAllowedDataList(policy).length === 0) {
@@ -534,28 +583,36 @@ function securityFindingsForArtifact(artifact, securityConfig) {
         if (isPolicyLine(line)) {
             continue;
         }
-        const hasApprovalGuard = hasNearbyApprovalLanguage(line) ||
-            (recentApprovalLine > 0 && lineNumber - recentApprovalLine <= 2);
+        const hasHumanApprovalGuard = hasExplicitHumanApprovalGuard(line) ||
+            (recentHumanApprovalLine > 0 &&
+                lineNumber - recentHumanApprovalLine <= 2);
+        const hasCommandRiskGuard = hasHumanApprovalGuard ||
+            hasLocalRiskMitigationGuard(line) ||
+            (recentRiskMitigationLine > 0 &&
+                lineNumber - recentRiskMitigationLine <= 2);
         const commandLine = !shellComment &&
             (inFence ||
                 isCommandLike(line) ||
                 CREDENTIAL_ARG_ANY_RE.test(line) ||
                 CREDENTIAL_HEADER_RE.test(line));
-        detections.push(...policyDetections(line, lineNumber, policy, hasApprovalGuard));
+        detections.push(...policyDetections(line, lineNumber, policy, hasHumanApprovalGuard));
         detections.push(...disallowedCommandDetections(line, lineNumber, policy));
         if (!commandLine || referencesSensitiveFile(line)) {
             detections.push(...sensitiveDataDetections(line, lineNumber, policy));
         }
-        if (!commandLine || policy.declared.size > 0) {
+        if (!commandLine || policy.declared.size > 0 || isUploadInstruction(line)) {
             detections.push(...networkAndUploadDetections(line, lineNumber, policy));
         }
         detections.push(...contextScopeDetections(line, lineNumber));
         detections.push(...predictableTempDetections(line, lineNumber));
         if (commandLine) {
-            detections.push(...commandDetections(line, lineNumber, hasApprovalGuard));
+            detections.push(...commandDetections(line, lineNumber, hasCommandRiskGuard));
         }
-        if (hasNearbyApprovalLanguage(line)) {
-            recentApprovalLine = lineNumber;
+        if (hasExplicitHumanApprovalGuard(line)) {
+            recentHumanApprovalLine = lineNumber;
+        }
+        if (hasLocalRiskMitigationGuard(line)) {
+            recentRiskMitigationLine = lineNumber;
         }
     }
     detections.push(...policyContradictions(policy));
@@ -623,9 +680,13 @@ function bodyPolicyContradictionDetections(content, policy) {
     }
     return detections;
 }
-function policyDetections(line, lineNumber, policy, hasApprovalGuard) {
+function policyDetections(line, lineNumber, policy, hasHumanApprovalGuard) {
     const detections = [];
-    if (policy.networkAllowed === false && NETWORK_ACTION_RE.test(line)) {
+    const defensiveAction = isDefensiveActionInstruction(line);
+    const safeOrGuarded = isDefensiveOrGuardedActionInstruction(line);
+    if (policy.networkAllowed === false &&
+        NETWORK_ACTION_RE.test(line) &&
+        !safeOrGuarded) {
         detections.push({
             metadata: RULES.instructionViolatesPolicy,
             severity: "high",
@@ -645,7 +706,9 @@ function policyDetections(line, lineNumber, policy, hasApprovalGuard) {
             });
         }
     }
-    if (policy.externalUploadAllowed === false && isUploadInstruction(line)) {
+    if (policy.externalUploadAllowed === false &&
+        isUploadInstruction(line) &&
+        !safeOrGuarded) {
         detections.push({
             metadata: RULES.instructionViolatesPolicy,
             severity: "high",
@@ -685,9 +748,10 @@ function policyDetections(line, lineNumber, policy, hasApprovalGuard) {
             snippet: line,
         });
     }
-    const needsApproval = (EXTERNAL_UPLOAD_RE.test(line) || CLOUD_UPLOAD_RE.test(line)) &&
-        policy.humanApprovalRequired === true &&
-        !hasApprovalGuard;
+    const needsApproval = policy.humanApprovalRequired === true &&
+        requiresHumanApprovalGuard(line) &&
+        !hasHumanApprovalGuard &&
+        !defensiveAction;
     if (needsApproval) {
         detections.push({
             metadata: RULES.missingHumanApprovalGuard,
@@ -755,6 +819,9 @@ function isSafeSensitiveHandlingInstruction(line) {
 }
 function networkAndUploadDetections(line, lineNumber, policy) {
     const detections = [];
+    if (isDefensiveOrGuardedActionInstruction(line)) {
+        return detections;
+    }
     if (EXTERNAL_UPLOAD_RE.test(line)) {
         detections.push({
             metadata: RULES.externalUploadInstruction,
@@ -801,22 +868,24 @@ function contextScopeDetections(line, lineNumber) {
     }
     return detections;
 }
-function commandDetections(line, lineNumber, hasApprovalGuard) {
+function commandDetections(line, lineNumber, hasCommandRiskGuard) {
     const detections = [];
+    const defensiveAction = isDefensiveOrGuardedActionInstruction(line);
     const remoteScript = line.match(REMOTE_SCRIPT_RE);
-    if (remoteScript && !hasPinnedRemoteScript(line)) {
+    if (remoteScript && !hasPinnedRemoteScript(line) && !defensiveAction) {
+        const fetchCommand = remoteScript[1] ?? "curl";
         const remoteUrl = (remoteScript[2] ?? line).replace(/[.,;:]+$/, "");
-        const shell = remoteScript[4] ?? remoteScript[5] ?? "sh";
+        const shell = remoteScript[3] ?? "sh";
         detections.push({
             metadata: RULES.unpinnedRemoteScript,
             severity: "high",
             startLine: lineNumber,
-            snippet: `curl ${remoteUrl} | ${shell}`,
+            snippet: `${fetchCommand} ${remoteUrl} | ${shell}`,
             dedupeKey: `${RULES.unpinnedRemoteScript.id}:${remoteUrl}`,
         });
     }
     const unpinnedInstall = unpinnedDependencyInstall(line);
-    if (unpinnedInstall) {
+    if (unpinnedInstall && !defensiveAction) {
         detections.push({
             metadata: RULES.unpinnedDependencyInstall,
             severity: "medium",
@@ -824,7 +893,9 @@ function commandDetections(line, lineNumber, hasApprovalGuard) {
             snippet: line,
         });
     }
-    if (PRIVILEGED_COMMAND_RE.test(line) && !hasApprovalGuard) {
+    if (PRIVILEGED_COMMAND_RE.test(line) &&
+        !hasCommandRiskGuard &&
+        !defensiveAction) {
         detections.push({
             metadata: RULES.privilegedCommandWithoutGuard,
             severity: "medium",
@@ -832,6 +903,16 @@ function commandDetections(line, lineNumber, hasApprovalGuard) {
             snippet: line,
         });
     }
+    if (DESTRUCTIVE_COMMAND_RE.test(line) &&
+        !hasCommandRiskGuard &&
+        !defensiveAction) {
+        detections.push({
+            metadata: RULES.destructiveCommand,
+            severity: "high",
+            startLine: lineNumber,
+            snippet: line,
+        });
+    }
     if (CREDENTIAL_ARG_RE.test(line) || CREDENTIAL_HEADER_RE.test(line)) {
         detections.push({
             metadata: RULES.credentialInCommandArg,
@@ -1307,9 +1388,36 @@ function isPolicyLine(line) {
 function isCommandLike(line) {
     return /\b(npm|pnpm|yarn|pip3?|brew|docker|curl|wget|sudo|chmod|chown|git|gh|aws|gcloud|az|kubectl|echo|cat|cp|mv|rm|touch|mkdir)\b/i.test(line);
 }
-function hasNearbyApprovalLanguage(line) {
-    return (APPROVAL_RE.test(line) ||
-        /\b(approved|approval|confirm|confirmed|ask|asking|asked|review|reviewed|authorize|authorized|permission|consent|guardrail|guard)\b/i.test(line));
+function hasExplicitHumanApprovalGuard(line) {
+    if (WEAK_OR_NEGATED_APPROVAL_RE.test(line)) {
+        return false;
+    }
+    return APPROVAL_RE.test(line);
+}
+function hasLocalRiskMitigationGuard(line) {
+    return RECOVERY_GUARD_RE.test(line);
+}
+function requiresHumanApprovalGuard(line) {
+    return (EXTERNAL_UPLOAD_RE.test(line) ||
+        CLOUD_UPLOAD_RE.test(line) ||
+        referencesConcreteNetworkDestination(line) ||
+        (SECRET_ACTION_RE.test(line) && SECRET_WORD_RE.test(line)) ||
+        (referencesSensitiveFile(line) &&
+            !isSafeSensitiveHandlingInstruction(line)) ||
+        PRIVILEGED_COMMAND_RE.test(line) ||
+        DESTRUCTIVE_COMMAND_RE.test(line));
+}
+function referencesConcreteNetworkDestination(line) {
+    return (NETWORK_ACTION_RE.test(line) && extractNetworkDestinations(line).length > 0);
+}
+function isDefensiveOrGuardedActionInstruction(line) {
+    return isDefensiveActionInstruction(line) || GUARDED_ACTION_RE.test(line);
+}
+function isDefensiveActionInstruction(line) {
+    if (/\b(no approval is needed|approved by default|safe to run)\b/i.test(line)) {
+        return false;
+    }
+    return DEFENSIVE_ACTION_RE.test(line);
 }
 function hasPinnedRemoteScript(line) {
     return /\b(sha256|sha512|checksum|gpg|cosign|sigstore|version|v\d+\.\d+\.\d+|@[a-f0-9]{7,40})\b/i.test(line);
@@ -1323,7 +1431,7 @@ function unpinnedDependencyInstall(line) {
     if (pnpm && splitCommandArgs(pnpm[1] ?? "").some(isUnpinnedNpmPackage)) {
         return true;
     }
-    const yarn = line.match(/\byarn\s+add\s+([^\n#]+)/i);
+    const yarn = line.match(/\byarn\s+(?:global\s+)?add\s+([^\n#]+)/i);
     if (yarn && splitCommandArgs(yarn[1] ?? "").some(isUnpinnedNpmPackage)) {
         return true;
     }
@@ -1414,6 +1522,7 @@ function findingFromDetection(artifact, detection) {
         verificationSteps: detection.metadata.verificationSteps,
         llmHint: detection.metadata.llmHint,
         confidence: detection.metadata.confidence,
+        riskClass: detection.metadata.riskClass,
     };
 }
 function snippet(value) {