security-mcp 1.1.4 → 1.3.3

package/skills/dependency-confusion-attacker/SKILL.md

@@ -22,6 +22,15 @@ Audit every dependency for: confusion attacks, typosquatting, known CVEs, CISA K
 abandoned packages, and missing integrity verification. Generate an SBOM. Write fixes to
 lockfiles and package.json.
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `dependencies` + `supply-chain-deep` + `sbom` detection modules (`src/gate/checks/dependencies.ts`, `src/gate/checks/supply-chain-deep.ts`, `src/gate/checks/sbom.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** correlate an unscoped name in `package.json`, the registry-priority ordering in `.npmrc`, and the actual lockfile `resolved` URL together — confusion only exists when all three line up; no single-file rule sees that.
+- **Semantic / effective-state analysis:** build the full direct+transitive dependency tree, then model whether a higher public version would win semver resolution over the intended private package; diff the tarball's extracted `package.json` against the registry metadata (manifest confusion); follow lifecycle-script taint (`postinstall` → network sink).
+- **External corroboration:** WebSearch/WebFetch for the current CISA KEV catalog, OSV.dev advisories, and npm/PyPI publish dates to catch AI-hallucination-squatting and abandoned packages.
+- **Apply & prove:** write the fix inline (scope the name, pin `.npmrc`, add SHA-512 integrity, SHA-pin GitHub Actions), re-run the `dependencies`/`supply-chain-deep`/`sbom` checks plus `osv-scanner` and `cyclonedx-bom validate` as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs with the secure default.
+
 ## EXECUTION
 
 1. Read all package manifests: `package.json`, `package-lock.json`, `yarn.lock`, `pnpm-lock.yaml`,
@@ -76,3 +85,418 @@ If internet permitted:
 - Package name, current version, vulnerability ID, CVSSv4, EPSS, CISA KEV status, fix version
 - Whether fix has been applied to lockfile
 SBOM written to `.mcp/agent-runs/{agentRunId}/sbom.cyclonedx.json`
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "...", "exploitHint": "..." }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "...", "location": "..." }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "...", "escalationPath": "..." }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["..."], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+These six domain-specific expansions go beyond the base mandate. Each must be executed on
+every run — they are not optional enrichment.
+
+### 1. Manifest Confusion Attack (CVE-2023-35116 class)
+
+**Technique:** Attackers craft packages where the `package.json` presented to the registry
+differs from the one extracted by npm install. The registry reads a top-level `package.json`
+while npm resolves a nested or overridden one inside a tarball's subdirectory. This allows
+hiding malicious `postinstall` scripts or dependency overrides from registry-level scanners.
+
+**Detection:** For every package tarball in the lockfile, verify that the `_id` and `scripts`
+fields in the registry's published metadata match what is extracted to `node_modules/<pkg>/package.json`
+on disk after install. Run:
+```bash
+npm pack <package>@<version> --dry-run 2>&1 | grep -E "package.json"
+tar -tzf $(npm pack <package>@<version> 2>/dev/null) | grep package.json
+```
+Finding: more than one `package.json` in the tarball root, or a `package.json` that is not
+at the tarball root, is a manifest confusion candidate.
+
+### 2. GitHub Actions Supply Chain Injection (SLSA Level 0 Gap)
+
+**Technique:** CI pipelines that reference actions via floating tags (`uses: actions/checkout@v3`)
+rather than pinned SHA commits are vulnerable to tag-moving attacks. Maintainer account
+compromise, typosquatted action names (`actions/chekout`), or malicious forks pushed under
+a hijacked org all achieve arbitrary code execution in the CI build environment — where
+secrets, tokens, and cloud credentials are present.
+
+**Detection:** Grep all `.github/workflows/*.yml` for `uses:` lines not pinned to a full
+40-character SHA:
+```bash
+grep -rn "uses:" .github/workflows/ | grep -v "@[0-9a-f]\{40\}"
+```
+Every non-SHA pin is a finding. Cross-reference action names against the `step-security/harden-runner`
+known-bad-actions list. Finding: any floating-tag action reference = HIGH. Any action name
+with Levenshtein distance ≤ 1 from a known legitimate action = CRITICAL.
+
+### 3. Dependency Confusion via Internal Package Registry Priority Inversion
+
+**Technique:** Private registries configured with `registry=https://private.registry/` in
+`.npmrc` alongside `@scope:registry=https://private.registry/` can still resolve unscoped
+packages from the public registry if the private registry returns a 404 for those names.
+An attacker who discovers an internal unscoped package name (via job listings, error messages,
+open-source leaks, or OSINT) can publish a higher-versioned package to public npm, causing
+npm to prefer it via semver resolution even when a private copy exists.
+
+**Detection:**
+```bash
+# Extract all unscoped dependencies
+node -e "const p=require('./package.json'); console.log(Object.keys({...p.dependencies,...p.devDependencies}).filter(n=>!n.startsWith('@')))" 
+# For each, check if it exists on public npm
+for pkg in <unscoped-list>; do curl -sf "https://registry.npmjs.org/$pkg" | jq '.name' ; done
+```
+Finding: any unscoped private package name that resolves successfully on public npm = CRITICAL
+dependency confusion surface.
+
+### 4. PyPI Dependency Confusion and Wheel Filename Spoofing
+
+**Technique:** PyPI package names are normalised (hyphens and underscores are interchangeable,
+case-insensitive). A private package named `my_internal_lib` can be confused with
+`my-internal-lib` or `My_Internal_Lib` published to PyPI. Additionally, malicious wheel
+files can be crafted with platform tags that cause pip to prefer them on specific OS/arch
+combinations while the safe version is served on the CI platform.
+
+**Detection:**
+```bash
+# Normalise all requirement names and check PyPI
+pip index versions <package> 2>/dev/null | head -1
+# Check for wheel platform confusion
+pip download <package> --no-deps --dest /tmp/wheels/ && ls /tmp/wheels/
+```
+Finding: any `requirements.txt` package resolvable on PyPI whose PyPI maintainer differs from
+the expected internal team = HIGH. Wheel files with unexpected platform tags in lockfiles = MEDIUM.
+
+### 5. AI-Assisted Dependency Hallucination Attack (Emerging — Post-2024)
+
+**Technique:** LLM coding assistants (GitHub Copilot, Cursor, Claude, GPT-4) hallucinate
+package names that do not exist on public registries. Attackers monitor common hallucination
+patterns (e.g., `express-validator-middleware`, `react-auth-helper`) and pre-register those
+names on npm/PyPI. When a developer installs the hallucinated name based on an AI suggestion,
+they install the attacker's package. This attack class requires no typosquatting — the package
+name is invented from scratch by the AI.
+
+**Detection:** For every dependency added in the last 6 months (check git log on package.json),
+verify the package existed on the public registry before the date it was added to package.json:
+```bash
+git log --follow -p package.json | grep '^\+' | grep '"name-to-check"'
+# Cross with npm publish date: curl https://registry.npmjs.org/<pkg> | jq '.time.created'
+```
+Finding: a package whose first publish date on the public registry is within 30 days of
+its addition to the project's package.json, and which has <100 weekly downloads = HIGH
+AI-hallucination-squatting candidate.
+
+### 6. SLSA Provenance and Build Attestation Gaps (US EO 14028 / EU CRA)
+
+**Technique:** Without SLSA build provenance attestations, the build artifact cannot be
+cryptographically linked to the source commit that produced it. An attacker who compromises
+a build server can substitute a malicious artifact after the source checkout step, and
+downstream consumers have no way to detect the substitution. This applies to npm packages,
+container images, and Go modules alike.
+
+**Detection:** For each published package or container in this project:
+```bash
+# Check for SLSA provenance attestation
+gh attestation verify <artifact> --owner <org>
+# Check npm package for provenance
+npm audit signatures <package>@<version>
+# Check for sigstore signatures
+cosign verify <image>:<tag> --certificate-oidc-issuer https://token.actions.githubusercontent.com
+```
+Finding: any artifact published from CI without a verifiable SLSA L2+ provenance attestation
+= HIGH. Any container image without a cosign signature from a trusted OIDC issuer = HIGH.
+For projects subject to US EO 14028 or EU CRA: unsigned artifacts = CRITICAL compliance blocker.
+
+### 7. Go Module Proxy Cache Poisoning and Replace Directive Abuse
+
+**Technique:** Go's module proxy (proxy.golang.org) caches module zip files. If an attacker
+publishes a malicious module before the legitimate maintainer has claimed the module path,
+the proxy serves the malicious version to all subsequent downloads. Additionally, `replace`
+directives in `go.mod` that point to relative local paths or unverified GitHub forks
+introduce dependency substitution that is invisible to standard SCA tools.
+
+**Detection:**
+```bash
+grep -n "replace" go.mod
+# For each replace directive, verify the target
+# Local path replaces: acceptable only in development, NEVER in published modules
+grep -A1 "^replace" go.mod | grep -v "=>" | grep -v "^--$"
+# Check GOPROXY for each dependency
+GOPROXY=direct go mod download -json ./... 2>&1 | jq '.Path,.Version,.Dir'
+```
+Finding: any `replace` directive pointing to a local path in a production go.mod = HIGH.
+Any `replace` directive pointing to a GitHub fork without a `go.sum` entry = CRITICAL.
+
+### 8. Transitive Dependency Shadow and Phantom Dependency Exploitation
+
+**Technique:** Build tools that hoist transitive dependencies to the root `node_modules`
+(npm v3+, Yarn v1 hoisting) allow application code to `require()` packages that are not
+declared in the project's own `package.json`. These "phantom dependencies" can be exploited
+by introducing a malicious package that has the same name as a hoisted transitive dependency
+at a higher version — causing the malicious version to be resolved first. pnpm's strict
+mode prevents hoisting but is frequently disabled via `public-hoist-pattern=*`.
+
+**Detection:**
+```bash
+# Find phantom dependencies (imported but not declared)
+node -e "
+  const declared = new Set(Object.keys(require('./package.json').dependencies || {}));
+  const fs = require('fs');
+  // grep all source imports
+" 
+# Check pnpm config for disabled strict mode
+grep "public-hoist-pattern" .npmrc pnpm-workspace.yaml 2>/dev/null
+```
+Finding: any `require()` or `import` of a package not in `dependencies` or `devDependencies` = MEDIUM.
+`public-hoist-pattern=*` in a pnpm project = HIGH (eliminates pnpm's primary confusion defence).
+
+---
+
+## §DEPENDENCY_CONFUSION_ATTACKER-CHECKLIST
+
+Perform each item in order. Record the result inline before moving to the next.
+
+1. **Unscoped private package name collision** — For every unscoped package in `dependencies`
+   and `devDependencies`, query `https://registry.npmjs.org/<name>` and confirm the response
+   is 404 or is controlled by the organisation. Any 200 response where the maintainer is not
+   the internal team = CRITICAL. Grep: `jq '.dependencies, .devDependencies | keys[]' package.json | grep -v '^@'`
+
+2. **Registry priority order in `.npmrc`** — Confirm that `.npmrc` specifies the private
+   registry as the default (`registry=`) and that scoped packages are pinned to the private
+   registry with `@scope:registry=`. Absence of scope-pinning with a private registry configured
+   = HIGH. Grep: `cat .npmrc | grep -E "registry|scope"`
+
+3. **Lockfile integrity hash coverage** — Every entry in `package-lock.json` must have an
+   `integrity` field with a `sha512-` prefix. Missing or `sha1-` prefixed integrity values
+   indicate an old or tampered lockfile. Finding: `jq '.. | .integrity? | select(. != null) | select(startswith("sha1"))' package-lock.json`
+
+4. **Postinstall and lifecycle script network calls** — For every package with a `scripts.postinstall`,
+   `scripts.install`, `scripts.prepare`, or `scripts.preinstall` field, confirm the script
+   does not contain `curl`, `wget`, `fetch`, `http`, `https`, or `require('http')`. Any
+   network call in a lifecycle script = HIGH. Grep: `find node_modules -name package.json -maxdepth 3 | xargs grep -l "postinstall\|install\|prepare" | xargs grep -l "curl\|wget\|http"`
+
+5. **GitHub Actions floating tag pins** — All `uses:` references in `.github/workflows/` must
+   be pinned to a 40-character SHA. Floating tags (`@v1`, `@main`, `@latest`) = HIGH per
+   reference. Finding threshold: any unresolved floating tag. Grep: `grep -rn "uses:" .github/workflows/ | grep -v "@[0-9a-f]\{40\}"`
+
+6. **Go module replace directive audit** — Every `replace` directive in `go.mod` must reference
+   a published, version-tagged module or a workspace-local path that is explicitly declared
+   in `go.work`. Replace directives pointing to arbitrary GitHub branches = CRITICAL.
+   Grep: `grep -n "replace" go.mod`
+
+7. **Python hash pinning** — Every `requirements.txt` and `Pipfile.lock` must include SHA-256
+   hashes for each package. Absence of `--hash=sha256:` in requirements files = HIGH.
+   Finding: `grep -rL "hash" requirements*.txt 2>/dev/null`
+
+8. **SLSA attestation presence** — Run `npm audit signatures` for all production npm packages.
+   Run `gh attestation verify` for any GitHub-published artifacts. Absence of provenance
+   for packages published from this project's CI = HIGH. Finding: any package with
+   `missing` signature status in `npm audit signatures` output.
+
+9. **Abandoned and deprecated package detection** — For the top 20 production dependencies
+   by download count, check the npm registry `time` field for last publish date. Any package
+   with no publish in >730 days and >100 dependents = MEDIUM. Any package flagged `deprecated`
+   in registry metadata = HIGH. Check: `curl https://registry.npmjs.org/<pkg> | jq '.time | keys | last'`
+
+10. **Typosquatting Levenshtein scan** — Compute Levenshtein distance between each dependency
+    name and the top-1000 npm/PyPI packages. Distance ≤ 1 = CRITICAL. Distance = 2 with
+    >10K weekly downloads on the target = HIGH. Finding: report the pair `(project_dep, popular_pkg, distance)`.
+
+11. **AI hallucination squatting** — For every dependency added in the past 6 months, verify
+    the package publish date predates its addition to `package.json` by at least 30 days
+    AND the package has >1000 weekly downloads (indicating it is a known, established package).
+    Packages that fail both checks = HIGH. Check: cross `git log package.json` with
+    `curl https://registry.npmjs.org/<pkg> | jq '.time.created'`
+
+12. **CycloneDX SBOM completeness** — The generated SBOM must include all direct AND transitive
+    dependencies with PURL, license, and hash fields populated. Any component missing a PURL
+    or hash = MEDIUM SBOM quality gap. Verify with:
+    `cyclonedx-bom validate --input-format json sbom.cyclonedx.json`
+
+---
+
+## §POC-REQUIREMENT
+
+For every CRITICAL or HIGH finding in this domain, the following sequence is MANDATORY.
+Skipping any step downgrades the finding severity to MEDIUM automatically.
+
+**Step 1 — Write the working PoC FIRST:**
+Document the exact payload, exact command, or exact registry interaction that demonstrates
+the vulnerability is exploitable. For dependency confusion: show the exact package name,
+registry URL, and version number that would be resolved ahead of the intended private package.
+For typosquatting: show the Levenshtein-adjacent package name and its public npm page.
+For lifecycle script exfiltration: show the exact `postinstall` script content and the
+network destination it would reach.
+
+**Step 2 — Confirm reproduction:**
+Execute the PoC in a controlled environment (dry-run install, offline registry simulation,
+or a dedicated test namespace). Capture the output showing the malicious resolution path.
+Record the captured output verbatim.
+
+**Step 3 — Write the fix:**
+Apply the specific remediation: scope the package name, pin the registry, add hash integrity,
+remove the malicious script, or add a `no-install-scripts` policy.
+
+**Step 4 — Verify PoC fails against fix:**
+Re-run the PoC after applying the fix. Confirm the previously-demonstrated resolution path
+no longer occurs. Capture the output showing the fix is effective.
+
+**Step 5 — Record in findings JSON:**
+```json
+{
+  "findingId": "DEP-CONFUSION-001",
+  "severity": "CRITICAL",
+  "exploitPoC": {
+    "command": "npm install --registry https://registry.npmjs.org my-internal-lib",
+    "expectedOutcome": "npm resolves to attacker-controlled v99.0.0 from public registry",
+    "observedOutput": "<paste npm install output showing malicious version resolved>",
+    "reproduced": true
+  },
+  "fix": "Rename to @myorg/my-internal-lib and add @myorg:registry= to .npmrc",
+  "fixVerified": true,
+  "pocFailsAgainstFix": true
+}
+```
+
+---
+
+## §PROJECT-ESCALATION
+
+Immediately call `orchestration.update_agent_status` with flag `"CRITICAL_ESCALATION"` and
+halt normal processing to alert the orchestrator before completing under any of these conditions:
+
+1. **CISA KEV match in production dependency** — Any production dependency (direct or transitive
+   up to 3 levels deep) matches an entry in the current CISA Known Exploited Vulnerabilities
+   catalog. These vulnerabilities have confirmed real-world exploitation; the entire release
+   must be blocked until remediated.
+
+2. **Malicious postinstall script with live exfiltration target** — A package's lifecycle
+   script contains a hardcoded IP address or domain that resolves to a non-CDN, non-registry
+   endpoint. This indicates an active supply chain compromise, not a misconfiguration.
+   Escalate before attempting to remediate — the incident response team must be notified.
+
+3. **Dependency confusion with version higher than internal package** — Public npm already
+   has a package with the same unscoped name as a private internal package, at a version
+   number higher than the internal package. This means an active confusion attack may already
+   be exploitable or actively exploited in CI/CD pipelines.
+
+4. **Lockfile tampered or unsigned commit detected** — `package-lock.json` has been modified
+   without a corresponding change to `package.json` in the same commit, and the modifying
+   commit is not from a known CI bot or maintainer. This pattern is consistent with a lockfile
+   poisoning attack (e.g., CVE-2021-43616 class).
+
+5. **Go module path hijacking via GONOSUMCHECK or GONOSUMDB** — The project sets `GONOSUMCHECK`
+   or `GONOSUMDB` for a module path that is not an internal module. This disables the Go
+   checksum database for that module, allowing a substituted malicious version to be
+   downloaded without detection.
+
+6. **Action name typosquatting in CI** — A `.github/workflows/` file references a GitHub
+   Action whose name has Levenshtein distance ≤ 1 from a known legitimate action (e.g.,
+   `actions/chekout` vs `actions/checkout`). This is an active supply chain attack vector
+   with immediate code execution impact in the CI environment where secrets are present.
+
+7. **Phantom SBOM component — dependency present in node_modules but absent from all manifest files** —
+   A package directory exists under `node_modules/` with no corresponding entry in any
+   `package.json` (project or any workspace). This indicates either a compromised install
+   or a phantom inject. Escalate immediately — do not attempt automated remediation.
+
+8. **Published package SHA-512 mismatch between lockfile and registry** — The `integrity`
+   hash recorded in `package-lock.json` does not match the hash served by the registry for
+   the same package version. This is the clearest possible indicator of a compromised package
+   or a man-in-the-middle registry attack.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in this domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Second-order / stored payload executed in different context | Scanner checks input context, not execution context | Store payload safely; trigger in separate request/session |
+| 2 | Unicode normalisation bypass | Regex filters run before normalisation; attacker uses homoglyphs or composed forms | Submit Ⅰ (U+2160) or ＜ (U+FF1C) variants of known-bad strings |
+| 3 | Polyglot payload active in multiple sinks simultaneously | Scanners test one injection class per payload | `'"><script>{{7*7}}</script><!--` — SQL + XSS + SSTI in one request |
+| 4 | Out-of-band exfiltration (DNS/HTTP callback) | Scanner looks for inline response difference; OOB leaves no visible trace | Use Burp Collaborator / interactsh; inject DNS lookup payload |
+| 5 | Race condition between check and use (TOCTOU) | Sequential scanners don't model concurrency | Send two simultaneous requests to the same state-changing endpoint |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to This Domain | Prepare Now By |
+|--------|--------------|--------------------------|----------------|
+| Cryptographically Relevant Quantum Computer (CRQC) | 2028–2032 | Harvest-now-decrypt-later attacks active today; RSA/ECDSA keys signed today will be broken | Inventory all RSA/ECDSA usage; migrate long-lived data to ML-KEM (FIPS 203) |
+| AI-assisted adversaries at scale | 2025–2027 (active) | LLM-powered fuzzing finds 10× more edge cases; automated PoC generation | Assume attackers have LLM help; expand test surface to match |
+| EU AI Act full enforcement | 2026 | High-risk AI systems require mandatory conformity assessments | Classify all AI features against AI Act tiers now |
+| Post-quantum TLS migration deadline | 2028–2030 | Browser vendors will drop classical-only TLS connections | Begin TLS agility assessment; test hybrid key exchange |
+| Mandatory SBOM + build provenance (US EO 14028 / EU CRA) | 2025–2026 (active) | SBOM and SLSA attestation are becoming legally required | Achieve SLSA L2 minimum; generate CycloneDX SBOM per release |
+
+---
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in this domain, and what to build to close each gap.
+
+**Standard gaps that MUST be checked:**
+
+- **Second-order attack execution**: The storage request looks safe; only the retrieval+execution step is dangerous. Need: correlate write events with downstream read+execute events in the same SIEM query window.
+- **Timing-side-channel leakage**: No log event emitted; only observable as microsecond response-time variance. Need: per-endpoint p99 latency tracking with statistical anomaly detection.
+- **Low-and-slow credential stuffing**: Individually, each request is under rate limits. Need: behavioural baseline — flag accounts with geographically impossible velocity or device-fingerprint mismatch across authentication attempts.
+- **Insider exfiltration via legitimate process**: Authorised exports, reports, and data downloads that individually are permitted but collectively constitute data exfiltration. Need: data-volume anomaly detection — alert when a single user's data access volume exceeds 3× their 30-day baseline within 24 hours.
+- **Cross-agent attack chains**: Phase 1 finding A + Phase 1 finding B = CRITICAL chain invisible to either agent alone. Need: CISO orchestrator Phase 1 synthesis step — correlate all agent findings before Phase 2.
+
+**Domain-specific detection gaps for dependency-confusion-attacker:**
+
+- **Manifest confusion (tarball vs registry metadata mismatch)**: Standard SCA tools read registry metadata, not the extracted tarball content. No tool currently diffs the two automatically. Need: post-install hook that re-computes `package.json` hash from extracted `node_modules/<pkg>/package.json` and compares against registry-published hash.
+- **AI hallucination squatting — new package monitoring**: No existing scanner monitors for packages being registered on public npm/PyPI that match names generated by LLM coding assistants. Need: a custom monitor that alerts when a previously-nonexistent package name appears on a public registry within a configurable window of it being added to `package.json`.
+- **SLSA attestation forgery via compromised OIDC token**: Provenance attestations rely on OIDC tokens from GitHub Actions. A compromised workflow secret or repository-level write permission can produce a valid-but-fraudulent attestation. Need: out-of-band verification that the commit SHA in the attestation matches the release tag, and that the workflow file has not been modified since the attestation was issued.
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [{ "class": "Dependency Confusion", "filesReviewed": 12, "patterns": ["unscoped package names", "registry priority"], "result": "CLEAN" }],
+    "filesReviewed": 47,
+    "negativeAssertions": ["Typosquatting: Levenshtein scan of 147 packages vs top-1000 — 0 matches at distance ≤ 2"],
+    "uncoveredReason": {}
+  }
+}
+```
+
+---
+
+## LEARNING SIGNAL
+
+On every finding resolved, emit:
+```json
+{
+  "findingId": "FINDING_ID",
+  "agentName": "dependency-confusion-attacker",
+  "resolved": true,
+  "remediationTemplate": "one-line description of what was done",
+  "falsePositive": false
+}
+```
+Call `security.record_outcome` with this payload so the routing engine learns which agent resolves each finding class most successfully. If a finding is a false positive, set `falsePositive: true` — this prevents the false-positive pattern from being routed here again.

package/skills/device-integrity-aggregator/SKILL.md

@@ -34,6 +34,15 @@ On every finding resolved, emit:
 }
 ```
 
+## BEYOND THE CHECKS — AUTONOMOUS DETECT & FIX
+
+The `mobile-android` + `mobile-ios` detection modules (`src/gate/checks/mobile-android.ts`, `src/gate/checks/mobile-ios.ts`) are your deterministic floor, not your ceiling. Treat their finding IDs as the minimum, then reason past single-line/single-file pattern matching — and APPLY the fix (Edit), not just advise:
+
+- **Cross-file / data-flow reasoning the regex can't do:** a `CertificatePinner` in one file means nothing if `network_security_config.xml` still sets `cleartextTrafficPermitted="true"` for the same domain, or if `android:allowBackup="true"` lets the data those keys protect leave via `adb backup` — correlate the pinning code, the manifest, and the keystore usage as one chain.
+- **Semantic / effective-state analysis:** model the attestation taint chain — is the Play Integrity / App Attest token bound to a server nonce, re-checked before each sensitive op, and denied (not silently downgraded) when the API is unreachable? Verify pinning validates the chain, not just the leaf hash.
+- **External corroboration:** WebSearch/WebFetch for current Play Integrity / DeviceCheck API guidance, Frida bypass advisories, and CVEs for the attestation SDK versions in use.
+- **Apply & prove:** write the fix inline (NSC pin-set with backup pin, `allowBackup=false`, nonce-bound attestation, `minifyEnabled true`), re-run the `mobile-android`/`mobile-ios` checks plus `apkleaks`/`mobsf` and an `objection`/Frida bypass attempt as a regression floor, then re-audit. Emit the LEARNING SIGNAL per fix; surface trade-offs with the secure default.
+
 ## EXECUTION
 
 ### Phase 1 — Reconnaissance
@@ -219,3 +228,111 @@ If internet permitted:
 - `requiredActions`: ordered action list
 - `complianceImpact`: framework mappings
 - `beyondSkillMd`: true if finding goes beyond the SKILL.md mandate
+
+Every findings JSON MUST include `intelligenceForOtherAgents`:
+```json
+{
+  "intelligenceForOtherAgents": {
+    "forPentestTeam": [{ "type": "HIGH_VALUE_TARGET", "description": "Bypassable certificate pinning on /api/payments — leaf-only check confirmed", "exploitHint": "Use Frida script to hook SecTrustEvaluate / OkHttp CertificatePinner; leaf reissue or custom CA in emulator bypasses" }],
+    "forCryptoSpecialist": [{ "type": "CRYPTO_WEAKNESS_REFERENCE", "algorithm": "RSA-2048 (DeviceCheck key)", "location": "iOS KeychainWrapper.swift line 47 — key not backed by Secure Enclave" }],
+    "forCloudSpecialist": [{ "type": "SSRF_TO_CLOUD_CHAIN", "ssrfLocation": "Attestation token verification endpoint accepts caller-supplied verification URL", "escalationPath": "Attacker controls verification server → always-valid attestation response → IMDS access from backend" }],
+    "forComplianceGrc": [{ "type": "COMPLIANCE_BLOCKER", "frameworks": ["PCI DSS Req 4.2.1", "NIST SP 800-53 SC-8", "OWASP M5:2024"], "releaseBlock": true }]
+  }
+}
+```
+
+---
+
+## BEYOND SKILL.MD — MANDATORY EXPANSIONS
+
+- **AI-Generated Frida Bypass Scripts (ATT&CK T1629.003 — Impair Defenses: Disable or Modify Tools):** LLM-assisted tooling (e.g., FridaGPT, GPT-4-generated Frida hooks) can generate working certificate pinning and RASP bypass scripts in seconds for common frameworks (OkHttp, TrustKit, Cordova). The barrier to attack has effectively collapsed. Test by: prompt an LLM with the app's framework stack and ask for a Frida bypass script; if the generated script works unmodified against the app's jailbreak/root and pinning checks, those checks are trivially bypassable. Finding threshold: any RASP or pinning check that a publicly documented Frida snippet circumvents within one attempt is a CRITICAL finding.
+
+- **Supply Chain Compromise of Attestation SDK (ATT&CK T1195.002 — Compromise Software Supply Chain):** The Play Integrity API client library and DCAppAttestService are distributed via Google Maven and Apple's SDK respectively — malicious or tampered versions could suppress integrity verdicts silently. CVE-2021-39749 (Google Play Core) demonstrated that SDK-level supply chain attacks are realistic. Test by: verify the SHA-256 checksum of `play-integrity` and `device_check` artifacts against the official published checksums in `gradle/verification-metadata.xml`; confirm Gradle dependency verification is enabled with `--verify-metadata`. Finding threshold: absent `gradle/verification-metadata.xml` or disabled checksum verification (`verification-mode=off`) is a HIGH finding.
+
+- **Post-Quantum Harvest-Now-Decrypt-Later Against Attestation Tokens (NIST IR 8413, ATT&CK T1557):** Attestation tokens signed with ECDSA P-256 (the current standard for both Play Integrity and App Attest) are vulnerable to retroactive forgery once a Cryptographically Relevant Quantum Computer (CRQC) exists. Adversaries collecting today's tokens can forge device identity assertions in the 2030–2035 window. Test by: audit the attestation token TTL configured on the backend verification server; if token validity exceeds 15 minutes or tokens are stored without expiry, the replay/forgery window is unacceptably large. Finding threshold: token TTL > 15 minutes or lack of short-lived nonce binding in attestation flows is a MEDIUM finding today, escalating to HIGH once NIST PQC standards (ML-DSA / FIPS 204) have platform support.
+
+- **Insecure StrongBox / Secure Enclave Key Export via Backup API (CVE-2023-20963 — Android WorkSource Parceling; related: adb backup extraction):** Android's `FLAG_SECURE` and StrongBox-backed keys are hardware-protected, but the data _encrypted_ by those keys (databases, SharedPreferences) may still be extracted via `adb backup` if `android:allowBackup="true"` and no `fullBackupContent` exclusion rule is set. iOS equivalents exist when `kSecAttrAccessibleAlways` is used without `kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly`. Test by: run `adb backup -apk -shared com.targetapp`; use `android-backup-extractor` to convert the `.ab` file; inspect for token, session, or credential files not excluded from backup. Finding threshold: any credential or session file present in the backup archive is a CRITICAL finding.
+
+- **Play Integrity Verdict Downgrade via Network Interception (ATT&CK T1557.002 — AiTM; Google Play Integrity API documentation — error handling):** When the Play Integrity API call fails (network timeout, API quota exhaustion, transient error), many apps fall back to accepting the operation without attestation rather than denying it. An attacker-controlled network can force API failures to trigger this silent downgrade. Test by: intercept and drop all traffic to `https://playintegrity.googleapis.com` using a proxy rule while performing a sensitive in-app operation; confirm the app blocks the operation rather than proceeding. Finding threshold: any sensitive operation (payment, account change, admin action) that completes successfully when the attestation API is unreachable is a CRITICAL finding.
+
+- **EU Cyber Resilience Act (CRA) Annex I — Device Integrity as a Mandatory Security Property (enforcement 2027):** CRA Annex I, Part I, §1 requires that connected app products be placed on the market only with documented vulnerability handling and integrity assurance mechanisms. Failure to implement certificate pinning, attestation, or key protection for apps distributed in the EU constitutes a documented CRA non-conformity. Test by: map each existing control (pinning config, attestation call, keystore usage) against CRA Annex I Essential Requirements §1–§13; document each gap with the specific requirement reference. Finding threshold: absence of any attested device integrity mechanism for apps processing personal or financial data in EU markets is a MEDIUM compliance finding now and a blocking HIGH after October 2027 enforcement date.
+
+---
+
+## §EDGE-CASE-MATRIX
+
+The 5 attack cases in the device integrity domain that automated scanners and naive manual review universally miss. MANDATORY checks — do not skip.
+
+| # | Edge Case | Why Scanners Miss It | Concrete Test |
+|---|-----------|----------------------|---------------|
+| 1 | Leaf-only certificate pinning bypass via intermediate CA swap | Static analysis confirms a pin is set; scanners don't model chain validation. If only the leaf hash is pinned, an attacker with a compromised intermediate CA can issue a new leaf that passes the pin check on chain-trusting implementations | Build a test CA chain; issue a new leaf with a matching subject but different public key; confirm app rejects it — if it accepts, pinning is leaf-only and bypassable |
+| 2 | Attestation token replay across devices or sessions | Attestation APIs return a signed token; scanners verify the call exists but not that the server enforces nonce freshness or device binding. A token captured from a genuine device is replayed from an emulator/rooted device | Capture a valid Play Integrity / App Attest token; replay it from a different device ID within the token TTL; the backend must reject based on nonce or device binding |
+| 3 | SafetyNet/Play Integrity result cached without re-attestation window | The attestation check fires once at app launch; scanners see the API call but not the cache lifetime. Attacker roots the device after the initial check passes and the positive result stays valid indefinitely | Force root/jailbreak the device after the positive attestation result; navigate to sensitive features; confirm the app re-attests before each sensitive operation, not only at launch |
+| 4 | RASP / jailbreak detection bypass via Frida early instrumentation | RASP hooks run at app layer; Frida can inject before the detection fires using spawn-gating. Scanner sees jailbreak checks in code but cannot model the runtime hook order | Attach Frida with `--pause` flag; hook `isJailbroken()` before the app's first instruction executes; confirm the app detects the Frida process itself via `/proc/self/maps` or similar |
+| 5 | Keystore key extraction via Android backup API (adb backup) | Static analysis confirms `AndroidKeyStore` usage; scanners don't check `android:allowBackup` or `android:fullBackupContent` exclusion rules. Keys stored in hardware-backed keystore cannot be extracted, but the data encrypted with them may be backed up, enabling offline brute force | Run `adb backup -apk -shared com.yourapp`; inspect the backup archive for SharedPreferences or database files; confirm the backup agent excludes all sensitive data or that `android:allowBackup="false"` is set |
+
+---
+
+## §TEMPORAL-THREATS
+
+Threats materialising in the 2025–2030 window that device integrity defences designed today must account for.
+
+| Threat | Est. Timeline | Relevance to Device Integrity | Prepare Now By |
+|--------|--------------|-------------------------------|----------------|
+| Play Integrity API v3 — stronger device verdict granularity | 2025–2026 (active) | `MEETS_STRONG_INTEGRITY` verdict will become the bar for high-value operations; apps still checking `MEETS_BASIC_INTEGRITY` will be under-enforcing | Audit all attestation verdict checks; upgrade to `MEETS_STRONG_INTEGRITY` or `MEETS_DEVICE_INTEGRITY` for payment/auth flows |
+| Apple removing DeviceCheck fallback for non-App Attest devices | 2026–2027 | DeviceCheck tokens carry no device integrity assertion; App Attest is the only signal that the app binary is unmodified on a genuine device. Apple has signalled progressive tightening | Migrate all attestation flows from DeviceCheck to App Attest (`DCAppAttestService`) now; maintain DeviceCheck only as a fallback for iOS <14 |
+| Cryptographically Relevant Quantum Computer (CRQC) — harvest-now-decrypt-later | 2028–2032 | Attestation tokens signed with ECDSA today can be stockpiled and forged retroactively once CRQC exists; long-lived device identity keys are highest risk | Inventory all ECDSA device-identity keys; plan migration to ML-DSA (FIPS 204) when platform support arrives; enforce short-lived token TTLs now to limit replay window |
+| EU Cyber Resilience Act (CRA) mandatory device security requirements | 2027 (enforcement) | CRA mandates vulnerability handling and update mechanisms for connected devices/apps sold in EU; insufficient device integrity controls are a CRA compliance gap | Map current controls to CRA Annex I essential requirements; document attestation architecture in security technical file |
+| AI-assisted Frida script generation for pinning/RASP bypass | 2025–2027 (active) | LLMs already generate working Frida bypass scripts for common frameworks in seconds; threshold to attack has collapsed | Assume Frida bypasses for any check that looks at userspace symbols; move integrity checks into native code / TEE where possible; detect Frida presence via `/proc/self/maps` fd scan |
+
+---
+
+## §DETECTION-GAP
+
+What current security monitoring CANNOT detect in the device integrity domain, and what to build to close each gap.
+
+**Domain-specific gaps that MUST be checked:**
+
+- **Attestation token replay post-compromise**: The token verification log shows a valid signature from Apple/Google — it does not show that the underlying device was rooted after attestation. Need: server-side session binding — tie each attestation token to a session ID and device fingerprint; flag any reuse across differing fingerprints within the token TTL.
+- **Gradual pin expiration drift**: No alert fires when a pinned certificate approaches its expiration date. Apps silently break when the cert expires if no backup pin was staged. Need: certificate expiry monitoring — parse all `network_security_config.xml` and `TrustKit` config pin expiration dates at build time; fail the CI pipeline if any pin expires within 60 days without a backup.
+- **ProGuard/R8 regression in a new build variant**: ProGuard is enabled for the `release` variant but a new `releaseStaging` variant was added without inheriting the rule. Static analysis checks the canonical release config. Need: build-variant audit — assert that every non-debug variant in `build.gradle` has `minifyEnabled true` and `shrinkResources true`; add this as a lint rule.
+- **Silent attestation downgrade**: The app falls back to a weaker check (e.g., SafetyNet BasicIntegrity) if the Play Integrity API is unreachable. No error is surfaced to the user or backend. Need: attestation failure logging — emit a distinct event when the app falls back to a weaker attestation path; alert if fallback rate exceeds 1% of sessions (legitimate network errors are rare, coordinated downgrade attacks are not).
+- **Cross-agent chain: MITM + weak attestation**: A MITM finding from the network-security agent combined with a leaf-only pinning finding from this agent creates a CRITICAL exploitable chain that neither agent flags alone. Need: CISO orchestrator Phase 1 synthesis — correlate all agent findings before Phase 2; any MITM-capable finding paired with a pinning weakness must be escalated to CRITICAL regardless of individual severity.
+
+---
+
+## §ZERO-MISS-MANDATE
+
+This agent CANNOT declare any attack class clean without explicit evidence of checking. For each item, output one of:
+- `CHECKED: [N files] | [patterns used] | CLEAN`
+- `CHECKED: [N files] | [patterns used] | [N findings, all fixed]`
+- `SKIPPED: [reason — must be "not applicable: [evidence]"]`
+
+**Silent skip = FAILED COVERAGE.** The orchestrator flags this as a quality gap.
+
+**Attack classes that must be explicitly covered:**
+
+| Attack Class | Patterns to Search | Minimum Evidence Required |
+|---|---|---|
+| Disabled ATS / cleartext permitted | `NSAllowsArbitraryLoads`, `cleartextTrafficPermitted` | Grep result + file list |
+| Missing or leaf-only certificate pinning | `checkServerTrusted`, `return null`, `pinnedCertificates`, `pin-set` | Config file content |
+| Attestation absent or cached indefinitely | `PlayIntegrityAPI`, `DCAppAttestService`, `SafetyNet` | Call site + nonce freshness |
+| Custom TrustManager that accepts all certs | `X509TrustManager`, `checkClientTrusted`, `checkServerTrusted` | All implementations reviewed |
+| Backup-enabled keystore data | `android:allowBackup`, `fullBackupContent` | Manifest check |
+| ProGuard/R8 disabled on non-debug variant | `minifyEnabled`, `build.gradle` | All variants enumerated |
+| Secret in SharedPreferences / NSUserDefaults | `SharedPreferences`, `NSUserDefaults`, key names containing `token|secret|key|password` | Grep with key names |
+
+The output findings JSON MUST include a `coverageManifest` key:
+```json
+{
+  "coverageManifest": {
+    "attackClassesCovered": [
+      { "class": "Disabled ATS / cleartext permitted", "filesReviewed": 3, "patterns": ["NSAllowsArbitraryLoads", "cleartextTrafficPermitted"], "result": "CLEAN" },
+      { "class": "Leaf-only certificate pinning", "filesReviewed": 12, "patterns": ["pinnedCertificates", "pin-set", "CertificatePinner"], "result": "1 finding, fixed" }
+    ],
+    "filesReviewed": 47,
+    "negativeAssertions": ["Custom TrustManager: checkServerTrusted searched across 47 files — 0 instances return null without chain validation"],
+    "uncoveredReason": {}
+  }
+}
+```