security-mcp 1.1.3 → 1.3.1

package/skills/deep-link-fuzzer/SKILL.md

@@ -193,3 +193,112 @@ func handleDeepLink(_ url: URL) {
 - `requiredActions`: ordered action list
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true if finding goes beyond the SKILL.md mandate
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "Custom-scheme OAuth callback — register competing app to intercept tokens", "exploitHint": "Side-load APK declaring identical myapp:// scheme on Android < 12; no disambiguation dialog on older APIs" }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "HMAC-SHA256 deep-link token signing absent", "location": "deep link token parameter — verify signing is present and key rotation policy exists" }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "Deep link `url=` parameter forwarded to server-side fetch", "escalationPath": "Inject file:// or http://169.254.169.254 to reach cloud IMDS and exfiltrate IAM credentials" }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["PCI DSS Req 6.2.4", "OWASP M4:2024", "NIST SP 800-53 SI-10"], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+- **Android Intent Scheme Hijacking for OAuth Token Interception (CVE-2014-8962 class / ATT&CK T1406):** Malicious apps targeting Android < 12 register the same custom URI scheme (e.g., `myapp://`) as the victim app. When the OS presents an app-disambiguation dialog — or on older APIs silently routes to the attacker — OAuth `code` parameters in the callback deep link are intercepted and replayed. Test by: sideload a second APK declaring `<data android:scheme="myapp"/>` in a BROWSABLE intent filter; trigger a real OAuth flow and confirm the system routes the callback exclusively to the legitimate app (requires App Links with `assetlinks.json` SHA-256 pinning). Finding threshold: any app using a custom scheme for OAuth callbacks rather than `https://` Universal Links / App Links is CRITICAL regardless of Android version.
+
+- **AI-Generated APK Scheme Squatting (Emerging Supply Chain Risk, 2025–2027):** LLM-assisted toolkits (e.g., Frida-based APK mutation + LLM manifest rewriter) can enumerate thousands of published app schemes from public `AndroidManifest.xml` files in APK mirrors and auto-generate competing apps at scale. This is a supply chain threat to any app distributed outside official stores. Test by: query `apkcombo.com` / `apkpure.com` programmatically for any APK that declares the same scheme as the target; flag if a competing package exists. Detection: integrate `adb shell pm query-intent-activities -a android.intent.action.VIEW -d "myapp://"` into the CI regression gate to alert on multiple handlers.
+
+- **javascript: URI Percent-Encoding Bypass in WebView Deep Links (CWE-116 / OWASP M4:2024):** Deep link handlers that validate against a literal `javascript:` blocklist are bypassed by `%6Aavascript:`, `java%0dscript:`, or `&#106;avascript:` variants, which Android WebView decodes before execution. Researchers demonstrated this class of bypass against major banking apps (disclosed 2023 via HackerOne program reports). Test by: send `myapp://open?url=java%0Ascript%3Aalert%28document.cookie%29` — confirm the WebView does NOT execute script and rejects the URL after decoding. Finding threshold: any `WebView.loadUrl()` or `evaluateJavascript()` called with a deep-link-derived string that is not allowlist-validated post-decode is CRITICAL.
+
+- **Post-Quantum MITM of apple-app-site-association / assetlinks.json (NIST PQC Transition, 2028–2030):** Universal Links and App Links depend on TLS integrity of the `/.well-known/` domain-association files fetched at app install. A cryptographically relevant quantum computer (CRQC) breaking classical ECDH/RSA TLS would allow silent substitution of these files, redirecting all deep link traffic to an attacker-controlled app. Prepare now by: (1) ensure HSTS with `max-age >= 31536000; includeSubDomains; preload` is set on the serving domain; (2) add CAA DNS records limiting issuance to one CA; (3) monitor for any `sha256_cert_fingerprints` or `appID` change via external polling every 15 minutes and alert on deviation. Finding threshold: absence of HSTS preloading or CAA records on the domain serving association files is HIGH in the current window and will be CRITICAL by 2028.
+
+- **Deep Link Fragment Injection into SPA Router (Research: "URL Fragment Security" — Barth et al., Browser Security Handbook):** The URI fragment (`#...`) is stripped by native iOS/Android deep link handlers before the URL is passed to the OS, but single-page-app WebViews receive the raw URL including fragment. Client-side routers (React Navigation web fallback, Next.js App Router) that parse `window.location.hash` for navigation can be manipulated via `myapp://app/dashboard#/admin/users?impersonate=victim`. This class is invisible in server logs and missed by all server-side WAFs. Test by: construct a deep link with `#/admin` fragment and confirm the SPA router does not elevate privilege; verify that the native handler strips or normalises the fragment before passing the URL to any WebView. Finding threshold: any SPA router path elevation via fragment content is HIGH; privilege escalation to admin routes is CRITICAL.
+
+- **EU Cyber Resilience Act (CRA) Article 13 — Deep Links as External Interfaces Requiring Documented Security Testing (Regulatory, effective 2027):** The CRA classifies mobile app deep-link entry points as "remote network interfaces" requiring manufacturers to document threat models and supply evidence of security testing before CE marking. Apps shipping to EU markets without documented deep-link fuzz results and a published vulnerability disclosure policy will face market withdrawal orders. Test by: generate a CRA Article 13 evidence package — enumerate all deep-link entry points, attach the `coverageManifest` from this agent's output, and confirm a Coordinated Vulnerability Disclosure (CVD) policy is published at `/.well-known/security.txt`. Finding threshold: absence of a security.txt or any undocumented deep-link entry point is a COMPLIANCE BLOCKER for EU distribution beginning 2027.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 deep-link attack cases that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Intent redirect chain — deep link launches Intent B which launches Intent C | Scanner validates only the first-hop handler; the terminal Activity may be exported and unprotected | Trace all `startActivity`/`startActivityForResult` calls reachable from each deep link handler; verify terminal Activity is not `exported="true"` without a permission check |
+| 2 | Percent-encoded `javascript:` bypass in WebView deep link | Validation regex matches raw `javascript:` but not `%6aavascript:` or `java%0ascript:` | Send `myapp://open?url=java%0dscript:alert(1)` and `%6Aavascript:alert(1)` — confirm WebView rejects both after decoding |
+| 3 | Universal Link fallback to custom scheme on AASA fetch failure | When `apple-app-site-association` is unreachable (CDN outage, misconfigured server), iOS falls back to the custom-scheme handler which lacks the same host validation | Simulate AASA 404 by mocking the `.well-known` endpoint; confirm the fallback custom scheme handler applies identical host/path validation |
+| 4 | Deep link parameter smuggled via fragment (`#`) into single-page app router | Server-side and native handlers only inspect path and query string; the fragment is handed directly to client-side JS router | Send `myapp://app/screen#/admin?token=attacker` — verify the native handler strips or ignores the fragment before routing, and the SPA router does not elevate privilege based on fragment content |
+| 5 | Clone-and-replay OAuth deep link token across user sessions | Deep link OAuth tokens with long or no expiry can be reused by a different authenticated user by intercepting the callback URI | Record a legitimate `myapp://oauth/callback?code=XXX` invocation; replay it from a second device/session — confirm the token is single-use and bound to the originating session state |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that deep-link defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to Deep Links | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Android 15+ Intent resolution changes | 2025–2026 (active) | Google tightened implicit Intent resolution; apps targeting older `targetSdkVersion` may silently regress to insecure scheme matching | Pin `targetSdkVersion` to the current stable API level in CI; run deep-link intent resolution tests against API 35 emulator |
+| AI-assisted scheme-hijacking toolkits | 2025–2027 (active) | LLM-generated APKs that enumerate and register known app schemes from public manifests are already feasible; custom-scheme OAuth callbacks are primary target | Migrate all OAuth callbacks to Universal Links / App Links now; treat any remaining custom-scheme OAuth as CRITICAL |
+| EU Cyber Resilience Act (CRA) mobile requirements | 2026–2027 | Deep link input handling is in-scope as an "external interface" requiring documented security testing before CE marking | Document deep-link threat model and test evidence per CRA Article 13 requirements |
+| Post-quantum TLS — AASA / assetlinks.json fetch integrity | 2028–2030 | Universal Link / App Link domain association files fetched over TLS; classical TLS broken by CRQC would allow MITM substitution of association files | Ensure `assetlinks.json` and `apple-app-site-association` are served with HSTS + CAA DNS records to limit mis-issuance window |
+| WebView V8 sandbox escapes targeting deep-link-fed content | 2025–2028 | As renderer sandboxes tighten, deep-link-injected `javascript:` URIs that survive validation become higher-value exploitation primitives | Enforce `WebView.loadUrl` allowlist server-side, not just client-side; treat any client-only validation as insufficient |
+
+---
+
+## §DETECTION-GAP
+
+What current mobile security monitoring CANNOT detect in the deep-link domain, and what to build to close each gap.
+
+- **Scheme-hijacking by side-loaded app**: Play Protect / App Store review may miss a competing app registering the same custom URI scheme. No runtime event is emitted when Android resolves the intent to the wrong app. Need: instrument the app's OAuth callback to include a per-session `state` parameter validated server-side — a hijacked callback can intercept the code but cannot forge the server-side state check; alert on all state mismatches.
+- **Fragment-based SPA router injection**: Native deep-link handlers and most WAFs do not log or inspect the URI fragment. The attack is invisible in server logs. Need: client-side CSP reporting + SPA router audit logging — emit a structured log event every time the client-side router evaluates a fragment-provided route, including the raw fragment value.
+- **Universal Link AASA tampering via CDN misconfiguration**: If the `/.well-known/apple-app-site-association` file is served from a CDN with public write access, an attacker can substitute it. iOS caches the AASA; exploitation may not be detected for hours. Need: continuous external monitoring — poll the AASA and assetlinks.json endpoints every 15 minutes and alert on any change to the `appID` or `sha256_cert_fingerprints` fields.
+- **Percent-encoded bypass surviving logs**: Most log pipelines store the raw encoded URI, not the decoded form. Security analysts searching for `javascript:` will miss `%6Aavascript:`. Need: decode URI parameters before writing to SIEM; add detection rule that flags any decoded parameter value starting with `javascript:`, `file:`, `data:text/html`, or `vbscript:`.
+- **Cross-agent deep-link + SSRF chain**: A deep-link `url=` parameter that reaches a server-side fetch endpoint creates an SSRF chain invisible to either the deep-link-fuzzer or the SSRF agent alone. Need: CISO orchestrator Phase 1 synthesis — correlate deep-link open-redirect findings with ssrf-probe findings on the same parameter names before Phase 2.
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+Attack classes that MUST be accounted for:
+
+| Attack Class | Minimum Pattern Search |
+|---|---|
+| Custom-scheme OAuth callback hijacking | `android:scheme` in manifests, `CFBundleURLTypes` in plists — confirm scheme is NOT used for OAuth; if it is, flag CRITICAL |
+| `javascript:` / `data:` URI injection into WebView | `loadUrl`, `evaluateJavascript`, `stringByEvaluatingJavaScriptFromString` called with deep-link-derived string |
+| Open redirect via `url=` / `redirect=` / `next=` parameter | All deep-link query parameter names forwarded to navigation or `loadUrl` |
+| Unauthenticated deep link to protected screen | Handler code that skips authentication check when launched from Intent/URL |
+| Missing / misconfigured AASA or assetlinks.json | Presence and correctness of `.well-known/apple-app-site-association` and `.well-known/assetlinks.json` |
+| Exported Activity / BroadcastReceiver without permission | `exported="true"` without `android:permission` on any component in the deep-link intent filter |
+| Fragment injection into SPA router | URL fragment (`#`) passed to client-side router without stripping |
+| OAuth token replay across sessions | `state` parameter absent or not validated server-side in OAuth callback deep links |
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [
+      { "class": "Custom-scheme OAuth hijacking", "filesReviewed": 3, "patterns": ["android:scheme", "CFBundleURLTypes"], "result": "CLEAN" },
+      { "class": "WebView javascript: injection", "filesReviewed": 12, "patterns": ["loadUrl", "evaluateJavascript"], "result": "2 findings, both fixed" }
+    ],
+    "filesReviewed": 27,
+    "negativeAssertions": [
+      "Open redirect: no `url=`/`redirect=`/`next=` parameter forwarded to loadUrl across 27 files — 0 matches"
+    ],
+    "uncoveredReason": {}
+  }
+}
+```

package/skills/dependency-confusion-attacker/SKILL.md

@@ -76,3 +76,418 @@ If internet permitted:
 - Package name, current version, vulnerability ID, CVSSv4, EPSS, CISA KEV status, fix version
 - Whether fix has been applied to lockfile
 SBOM written to `.mcp/agent-runs/{agentRunId}/sbom.cyclonedx.json`
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+These six domain-specific expansions go beyond the base mandate. Each must be executed on
+every run — they are not optional enrichment.
+
+### 1. Manifest Confusion Attack (CVE-2023-35116 class)
+
+**Technique:** Attackers craft packages where the `package.json` presented to the registry
+differs from the one extracted by npm install. The registry reads a top-level `package.json`
+while npm resolves a nested or overridden one inside a tarball's subdirectory. This allows
+hiding malicious `postinstall` scripts or dependency overrides from registry-level scanners.
+
+**Detection:** For every package tarball in the lockfile, verify that the `_id` and `scripts`
+fields in the registry's published metadata match what is extracted to `node_modules/<pkg>/package.json`
+on disk after install. Run:
+```bash
+npm pack <package>@<version> --dry-run 2>&1 | grep -E "package.json"
+tar -tzf $(npm pack <package>@<version> 2>/dev/null) | grep package.json
+```
+Finding: more than one `package.json` in the tarball root, or a `package.json` that is not
+at the tarball root, is a manifest confusion candidate.
+
+### 2. GitHub Actions Supply Chain Injection (SLSA Level 0 Gap)
+
+**Technique:** CI pipelines that reference actions via floating tags (`uses: actions/checkout@v3`)
+rather than pinned SHA commits are vulnerable to tag-moving attacks. Maintainer account
+compromise, typosquatted action names (`actions/chekout`), or malicious forks pushed under
+a hijacked org all achieve arbitrary code execution in the CI build environment — where
+secrets, tokens, and cloud credentials are present.
+
+**Detection:** Grep all `.github/workflows/*.yml` for `uses:` lines not pinned to a full
+40-character SHA:
+```bash
+grep -rn "uses:" .github/workflows/ | grep -v "@[0-9a-f]\{40\}"
+```
+Every non-SHA pin is a finding. Cross-reference action names against the `step-security/harden-runner`
+known-bad-actions list. Finding: any floating-tag action reference = HIGH. Any action name
+with Levenshtein distance ≤ 1 from a known legitimate action = CRITICAL.
+
+### 3. Dependency Confusion via Internal Package Registry Priority Inversion
+
+**Technique:** Private registries configured with `registry=https://private.registry/` in
+`.npmrc` alongside `@scope:registry=https://private.registry/` can still resolve unscoped
+packages from the public registry if the private registry returns a 404 for those names.
+An attacker who discovers an internal unscoped package name (via job listings, error messages,
+open-source leaks, or OSINT) can publish a higher-versioned package to public npm, causing
+npm to prefer it via semver resolution even when a private copy exists.
+
+**Detection:**
+```bash
+# Extract all unscoped dependencies
+node -e "const p=require('./package.json'); console.log(Object.keys({...p.dependencies,...p.devDependencies}).filter(n=>!n.startsWith('@')))" 
+# For each, check if it exists on public npm
+for pkg in <unscoped-list>; do curl -sf "https://registry.npmjs.org/$pkg" | jq '.name' ; done
+```
+Finding: any unscoped private package name that resolves successfully on public npm = CRITICAL
+dependency confusion surface.
+
+### 4. PyPI Dependency Confusion and Wheel Filename Spoofing
+
+**Technique:** PyPI package names are normalised (hyphens and underscores are interchangeable,
+case-insensitive). A private package named `my_internal_lib` can be confused with
+`my-internal-lib` or `My_Internal_Lib` published to PyPI. Additionally, malicious wheel
+files can be crafted with platform tags that cause pip to prefer them on specific OS/arch
+combinations while the safe version is served on the CI platform.
+
+**Detection:**
+```bash
+# Normalise all requirement names and check PyPI
+pip index versions <package> 2>/dev/null | head -1
+# Check for wheel platform confusion
+pip download <package> --no-deps --dest /tmp/wheels/ && ls /tmp/wheels/
+```
+Finding: any `requirements.txt` package resolvable on PyPI whose PyPI maintainer differs from
+the expected internal team = HIGH. Wheel files with unexpected platform tags in lockfiles = MEDIUM.
+
+### 5. AI-Assisted Dependency Hallucination Attack (Emerging — Post-2024)
+
+**Technique:** LLM coding assistants (GitHub Copilot, Cursor, Claude, GPT-4) hallucinate
+package names that do not exist on public registries. Attackers monitor common hallucination
+patterns (e.g., `express-validator-middleware`, `react-auth-helper`) and pre-register those
+names on npm/PyPI. When a developer installs the hallucinated name based on an AI suggestion,
+they install the attacker's package. This attack class requires no typosquatting — the package
+name is invented from scratch by the AI.
+
+**Detection:** For every dependency added in the last 6 months (check git log on package.json),
+verify the package existed on the public registry before the date it was added to package.json:
+```bash
+git log --follow -p package.json | grep '^\+' | grep '"name-to-check"'
+# Cross with npm publish date: curl https://registry.npmjs.org/<pkg> | jq '.time.created'
+```
+Finding: a package whose first publish date on the public registry is within 30 days of
+its addition to the project's package.json, and which has <100 weekly downloads = HIGH
+AI-hallucination-squatting candidate.
+
+### 6. SLSA Provenance and Build Attestation Gaps (US EO 14028 / EU CRA)
+
+**Technique:** Without SLSA build provenance attestations, the build artifact cannot be
+cryptographically linked to the source commit that produced it. An attacker who compromises
+a build server can substitute a malicious artifact after the source checkout step, and
+downstream consumers have no way to detect the substitution. This applies to npm packages,
+container images, and Go modules alike.
+
+**Detection:** For each published package or container in this project:
+```bash
+# Check for SLSA provenance attestation
+gh attestation verify <artifact> --owner <org>
+# Check npm package for provenance
+npm audit signatures <package>@<version>
+# Check for sigstore signatures
+cosign verify <image>:<tag> --certificate-oidc-issuer https://token.actions.githubusercontent.com
+```
+Finding: any artifact published from CI without a verifiable SLSA L2+ provenance attestation
+= HIGH. Any container image without a cosign signature from a trusted OIDC issuer = HIGH.
+For projects subject to US EO 14028 or EU CRA: unsigned artifacts = CRITICAL compliance blocker.
+
+### 7. Go Module Proxy Cache Poisoning and Replace Directive Abuse
+
+**Technique:** Go's module proxy (proxy.golang.org) caches module zip files. If an attacker
+publishes a malicious module before the legitimate maintainer has claimed the module path,
+the proxy serves the malicious version to all subsequent downloads. Additionally, `replace`
+directives in `go.mod` that point to relative local paths or unverified GitHub forks
+introduce dependency substitution that is invisible to standard SCA tools.
+
+**Detection:**
+```bash
+grep -n "replace" go.mod
+# For each replace directive, verify the target
+# Local path replaces: acceptable only in development, NEVER in published modules
+grep -A1 "^replace" go.mod | grep -v "=>" | grep -v "^--$"
+# Check GOPROXY for each dependency
+GOPROXY=direct go mod download -json ./... 2>&1 | jq '.Path,.Version,.Dir'
+```
+Finding: any `replace` directive pointing to a local path in a production go.mod = HIGH.
+Any `replace` directive pointing to a GitHub fork without a `go.sum` entry = CRITICAL.
+
+### 8. Transitive Dependency Shadow and Phantom Dependency Exploitation
+
+**Technique:** Build tools that hoist transitive dependencies to the root `node_modules`
+(npm v3+, Yarn v1 hoisting) allow application code to `require()` packages that are not
+declared in the project's own `package.json`. These "phantom dependencies" can be exploited
+by introducing a malicious package that has the same name as a hoisted transitive dependency
+at a higher version — causing the malicious version to be resolved first. pnpm's strict
+mode prevents hoisting but is frequently disabled via `public-hoist-pattern=*`.
+
+**Detection:**
+```bash
+# Find phantom dependencies (imported but not declared)
+node -e "
+  const declared = new Set(Object.keys(require('./package.json').dependencies || {}));
+  const fs = require('fs');
+  // grep all source imports
+" 
+# Check pnpm config for disabled strict mode
+grep "public-hoist-pattern" .npmrc pnpm-workspace.yaml 2>/dev/null
+```
+Finding: any `require()` or `import` of a package not in `dependencies` or `devDependencies` = MEDIUM.
+`public-hoist-pattern=*` in a pnpm project = HIGH (eliminates pnpm's primary confusion defence).
+
+---
+
+## §DEPENDENCY_CONFUSION_ATTACKER-CHECKLIST
+
+Perform each item in order. Record the result inline before moving to the next.
+
+1. **Unscoped private package name collision** — For every unscoped package in `dependencies`
+   and `devDependencies`, query `https://registry.npmjs.org/<name>` and confirm the response
+   is 404 or is controlled by the organisation. Any 200 response where the maintainer is not
+   the internal team = CRITICAL. Grep: `jq '.dependencies, .devDependencies | keys[]' package.json | grep -v '^@'`
+
+2. **Registry priority order in `.npmrc`** — Confirm that `.npmrc` specifies the private
+   registry as the default (`registry=`) and that scoped packages are pinned to the private
+   registry with `@scope:registry=`. Absence of scope-pinning with a private registry configured
+   = HIGH. Grep: `cat .npmrc | grep -E "registry|scope"`
+
+3. **Lockfile integrity hash coverage** — Every entry in `package-lock.json` must have an
+   `integrity` field with a `sha512-` prefix. Missing or `sha1-` prefixed integrity values
+   indicate an old or tampered lockfile. Finding: `jq '.. | .integrity? | select(. != null) | select(startswith("sha1"))' package-lock.json`
+
+4. **Postinstall and lifecycle script network calls** — For every package with a `scripts.postinstall`,
+   `scripts.install`, `scripts.prepare`, or `scripts.preinstall` field, confirm the script
+   does not contain `curl`, `wget`, `fetch`, `http`, `https`, or `require('http')`. Any
+   network call in a lifecycle script = HIGH. Grep: `find node_modules -name package.json -maxdepth 3 | xargs grep -l "postinstall\|install\|prepare" | xargs grep -l "curl\|wget\|http"`
+
+5. **GitHub Actions floating tag pins** — All `uses:` references in `.github/workflows/` must
+   be pinned to a 40-character SHA. Floating tags (`@v1`, `@main`, `@latest`) = HIGH per
+   reference. Finding threshold: any unresolved floating tag. Grep: `grep -rn "uses:" .github/workflows/ | grep -v "@[0-9a-f]\{40\}"`
+
+6. **Go module replace directive audit** — Every `replace` directive in `go.mod` must reference
+   a published, version-tagged module or a workspace-local path that is explicitly declared
+   in `go.work`. Replace directives pointing to arbitrary GitHub branches = CRITICAL.
+   Grep: `grep -n "replace" go.mod`
+
+7. **Python hash pinning** — Every `requirements.txt` and `Pipfile.lock` must include SHA-256
+   hashes for each package. Absence of `--hash=sha256:` in requirements files = HIGH.
+   Finding: `grep -rL "hash" requirements*.txt 2>/dev/null`
+
+8. **SLSA attestation presence** — Run `npm audit signatures` for all production npm packages.
+   Run `gh attestation verify` for any GitHub-published artifacts. Absence of provenance
+   for packages published from this project's CI = HIGH. Finding: any package with
+   `missing` signature status in `npm audit signatures` output.
+
+9. **Abandoned and deprecated package detection** — For the top 20 production dependencies
+   by download count, check the npm registry `time` field for last publish date. Any package
+   with no publish in >730 days and >100 dependents = MEDIUM. Any package flagged `deprecated`
+   in registry metadata = HIGH. Check: `curl https://registry.npmjs.org/<pkg> | jq '.time | keys | last'`
+
+10. **Typosquatting Levenshtein scan** — Compute Levenshtein distance between each dependency
+    name and the top-1000 npm/PyPI packages. Distance ≤ 1 = CRITICAL. Distance = 2 with
+    >10K weekly downloads on the target = HIGH. Finding: report the pair `(project_dep, popular_pkg, distance)`.
+
+11. **AI hallucination squatting** — For every dependency added in the past 6 months, verify
+    the package publish date predates its addition to `package.json` by at least 30 days
+    AND the package has >1000 weekly downloads (indicating it is a known, established package).
+    Packages that fail both checks = HIGH. Check: cross `git log package.json` with
+    `curl https://registry.npmjs.org/<pkg> | jq '.time.created'`
+
+12. **CycloneDX SBOM completeness** — The generated SBOM must include all direct AND transitive
+    dependencies with PURL, license, and hash fields populated. Any component missing a PURL
+    or hash = MEDIUM SBOM quality gap. Verify with:
+    `cyclonedx-bom validate --input-format json sbom.cyclonedx.json`
+
+---
+
+## §POC-REQUIREMENT
+
+For every CRITICAL or HIGH finding in this domain, the following sequence is MANDATORY.
+Skipping any step downgrades the finding severity to MEDIUM automatically.
+
+**Step 1 — Write the working PoC FIRST:**
+Document the exact payload, exact command, or exact registry interaction that demonstrates
+the vulnerability is exploitable. For dependency confusion: show the exact package name,
+registry URL, and version number that would be resolved ahead of the intended private package.
+For typosquatting: show the Levenshtein-adjacent package name and its public npm page.
+For lifecycle script exfiltration: show the exact `postinstall` script content and the
+network destination it would reach.
+
+**Step 2 — Confirm reproduction:**
+Execute the PoC in a controlled environment (dry-run install, offline registry simulation,
+or a dedicated test namespace). Capture the output showing the malicious resolution path.
+Record the captured output verbatim.
+
+**Step 3 — Write the fix:**
+Apply the specific remediation: scope the package name, pin the registry, add hash integrity,
+remove the malicious script, or add a `no-install-scripts` policy.
+
+**Step 4 — Verify PoC fails against fix:**
+Re-run the PoC after applying the fix. Confirm the previously-demonstrated resolution path
+no longer occurs. Capture the output showing the fix is effective.
+
+**Step 5 — Record in findings JSON:**
+```json
+{
+  "findingId": "DEP-CONFUSION-001",
+  "severity": "CRITICAL",
+  "exploitPoC": {
+    "command": "npm install --registry https://registry.npmjs.org my-internal-lib",
+    "expectedOutcome": "npm resolves to attacker-controlled v99.0.0 from public registry",
+    "observedOutput": "<paste npm install output showing malicious version resolved>",
+    "reproduced": true
+  },
+  "fix": "Rename to @myorg/my-internal-lib and add @myorg:registry= to .npmrc",
+  "fixVerified": true,
+  "pocFailsAgainstFix": true
+}
+```
+
+---
+
+## §PROJECT-ESCALATION
+
+Immediately call `orchestration.update_agent_status` with flag `"CRITICAL_ESCALATION"` and
+halt normal processing to alert the orchestrator before completing under any of these conditions:
+
+1. **CISA KEV match in production dependency** — Any production dependency (direct or transitive
+   up to 3 levels deep) matches an entry in the current CISA Known Exploited Vulnerabilities
+   catalog. These vulnerabilities have confirmed real-world exploitation; the entire release
+   must be blocked until remediated.
+
+2. **Malicious postinstall script with live exfiltration target** — A package's lifecycle
+   script contains a hardcoded IP address or domain that resolves to a non-CDN, non-registry
+   endpoint. This indicates an active supply chain compromise, not a misconfiguration.
+   Escalate before attempting to remediate — the incident response team must be notified.
+
+3. **Dependency confusion with version higher than internal package** — Public npm already
+   has a package with the same unscoped name as a private internal package, at a version
+   number higher than the internal package. This means an active confusion attack may already
+   be exploitable or actively exploited in CI/CD pipelines.
+
+4. **Lockfile tampered or unsigned commit detected** — `package-lock.json` has been modified
+   without a corresponding change to `package.json` in the same commit, and the modifying
+   commit is not from a known CI bot or maintainer. This pattern is consistent with a lockfile
+   poisoning attack (e.g., CVE-2021-43616 class).
+
+5. **Go module path hijacking via GONOSUMCHECK or GONOSUMDB** — The project sets `GONOSUMCHECK`
+   or `GONOSUMDB` for a module path that is not an internal module. This disables the Go
+   checksum database for that module, allowing a substituted malicious version to be
+   downloaded without detection.
+
+6. **Action name typosquatting in CI** — A `.github/workflows/` file references a GitHub
+   Action whose name has Levenshtein distance ≤ 1 from a known legitimate action (e.g.,
+   `actions/chekout` vs `actions/checkout`). This is an active supply chain attack vector
+   with immediate code execution impact in the CI environment where secrets are present.
+
+7. **Phantom SBOM component — dependency present in node_modules but absent from all manifest files** —
+   A package directory exists under `node_modules/` with no corresponding entry in any
+   `package.json` (project or any workspace). This indicates either a compromised install
+   or a phantom inject. Escalate immediately — do not attempt automated remediation.
+
+8. **Published package SHA-512 mismatch between lockfile and registry** — The `integrity`
+   hash recorded in `package-lock.json` does not match the hash served by the registry for
+   the same package version. This is the clearest possible indicator of a compromised package
+   or a man-in-the-middle registry attack.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+---
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+**Domain-specific detection gaps for dependency-confusion-attacker:**
+
+- **Manifest confusion (tarball vs registry metadata mismatch)**: Standard SCA tools read registry metadata, not the extracted tarball content. No tool currently diffs the two automatically. Need: post-install hook that re-computes `package.json` hash from extracted `node_modules/<pkg>/package.json` and compares against registry-published hash.
+- **AI hallucination squatting — new package monitoring**: No existing scanner monitors for packages being registered on public npm/PyPI that match names generated by LLM coding assistants. Need: a custom monitor that alerts when a previously-nonexistent package name appears on a public registry within a configurable window of it being added to `package.json`.
+- **SLSA attestation forgery via compromised OIDC token**: Provenance attestations rely on OIDC tokens from GitHub Actions. A compromised workflow secret or repository-level write permission can produce a valid-but-fraudulent attestation. Need: out-of-band verification that the commit SHA in the attestation matches the release tag, and that the workflow file has not been modified since the attestation was issued.
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "Dependency Confusion", "filesReviewed": 12, "patterns": ["unscoped package names", "registry priority"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["Typosquatting: Levenshtein scan of 147 packages vs top-1000 — 0 matches at distance ≤ 2"],
+    "uncoveredReason": {}
+  }
+}
+```
+
+---
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{
+  "findingId": "FINDING_ID",
+  "agentName": "dependency-confusion-attacker",
+  "resolved": true,
+  "remediationTemplate": "one-line description of what was done",
+  "falsePositive": false
+}
+```
+Call `security.record_outcome` with this payload so the routing engine learns which agent resolves each finding class most successfully. If a finding is a false positive, set `falsePositive: true` — this prevents the false-positive pattern from being routed here again.