skill-checker 0.1.13 → 0.1.15

package/dist/index.js

@@ -977,6 +977,40 @@ var DELIMITER_PATTERNS = [
   /\[INST\]/i,
   /\[\/INST\]/i
 ];
+var DANGEROUS_ROLE_PATTERN = "(?:(?:an?\\s+)?(?:hacker|attacker|cracker|root|admin(?:istrator)?|superuser|unrestricted|jailbroken|evil|malicious|unfiltered|uncensored)\\b|DAN\\b|(?:a\\s+)?different\\b)";
+var IDENTITY_HIJACKING_PATTERNS = [
+  new RegExp(`\\byou\\s+are\\s+now\\s+${DANGEROUS_ROLE_PATTERN}`, "i"),
+  new RegExp(`\\bact\\s+as\\s+${DANGEROUS_ROLE_PATTERN}`, "i"),
+  new RegExp(`\\bpretend\\s+(?:you\\s+are|to\\s+be)\\s+${DANGEROUS_ROLE_PATTERN}`, "i"),
+  new RegExp(`\\broleplay\\s+(?:as|like)\\s+${DANGEROUS_ROLE_PATTERN}`, "i"),
+  new RegExp(`\\bassume\\s+the\\s+role\\s+of\\s+${DANGEROUS_ROLE_PATTERN}`, "i"),
+  /\byou\s+are\s+no\s+longer\s+claude\b/i,
+  /\bfrom\s+now\s+on,?\s+you\s+are\b/i
+];
+var DECEPTION_SECRECY_PATTERNS = [
+  /\bdo\s+not\s+tell\s+(the\s+)?(user|human|person|operator)\b/i,
+  /\bdo\s+not\s+(mention|reveal|disclose|expose)\s+(this|that|the|any|these)\b/i,
+  /\bnever\s+(tell|mention|reveal|disclose)\s+(the\s+)?(user|human|person|operator)\b/i,
+  /\bkeep\s+this\s+(secret|hidden|private|confidential)\b(?!\s+key)/i,
+  /\bhide\s+this\s+(from|action|operation|instruction)\b/i,
+  /\bwithout\s+(the\s+)?(user|human)('?s)?\s+(knowledge|knowing|awareness|consent)\b/i,
+  /\bsilently\s+(execute|run|perform|install|download|delete|modify|send)\b/i
+];
+var CONFIG_TAMPERING_PATTERNS = [
+  /\b(modify|change|update|edit|alter|rewrite)\s+(your|my)\s+(memory|config|configuration|settings?|instructions?|behavior|personality)\b/i,
+  /\bwrite\s+to\s+(CLAUDE\.md|\.claude|settings\.json|memory\.md)\b/i,
+  /\b(append|prepend|add|insert)\s+.{0,30}\bto\s+(CLAUDE\.md|\.claude|memory\.md)\b/i,
+  /\boverwrite\s+(your|the)\s+(system|core)\s+(prompt|instructions?|config)\b/i,
+  /\bpersist\s+(this|these|the)\s+(instruction|change|modification|setting)s?\b/i
+];
+var VERIFICATION_BYPASS_PATTERNS = [
+  /\btrust\s+(this|the|these|that|my)\s+(result|output|response|answer|value|data|input)s?\b/i,
+  /\bno\s+need\s+to\s+(check|verify|validate|review|confirm|inspect)\b/i,
+  /\bdo\s+not\s+(verify|validate|check|review|confirm|inspect)\s+(the|this|that|any|these)\b/i,
+  /\b(assume|consider)\s+(it|this|that)\s+(is|to\s+be)\s+(correct|safe|valid|trusted|clean|secure|legitimate)\b/i,
+  /\baccept\s+(this|the|these|that)\s+without\s+(checking|verifying|validating|questioning)\b/i,
+  /\bblindly\s+(trust|accept|execute|run|follow|apply)\b/i
+];
 var injectionChecks = {
   name: "Injection Detection",
   category: "INJ",
@@ -1073,6 +1107,65 @@ var injectionChecks = {
           break;
         }
       }
+      const trimmedLine = line.trim();
+      const nextLine = i + 1 < skill.bodyLines.length ? skill.bodyLines[i + 1] : "";
+      const crossLine = trimmedLine && nextLine ? `${line} ${nextLine}` : line;
+      for (const pattern of IDENTITY_HIJACKING_PATTERNS) {
+        if (pattern.test(crossLine)) {
+          results.push({
+            id: "INJ-010",
+            category: "INJ",
+            severity: "CRITICAL",
+            title: "Social engineering: identity hijacking",
+            message: `Line ${lineNum}: Attempts to hijack the model's identity.`,
+            line: lineNum,
+            snippet: line.trim().slice(0, 120)
+          });
+          break;
+        }
+      }
+      for (const pattern of DECEPTION_SECRECY_PATTERNS) {
+        if (pattern.test(crossLine)) {
+          results.push({
+            id: "INJ-010",
+            category: "INJ",
+            severity: "CRITICAL",
+            title: "Social engineering: deception/secrecy",
+            message: `Line ${lineNum}: Instructs the model to hide actions from the user.`,
+            line: lineNum,
+            snippet: line.trim().slice(0, 120)
+          });
+          break;
+        }
+      }
+      for (const pattern of CONFIG_TAMPERING_PATTERNS) {
+        if (pattern.test(crossLine)) {
+          results.push({
+            id: "INJ-010",
+            category: "INJ",
+            severity: "HIGH",
+            title: "Social engineering: configuration tampering",
+            message: `Line ${lineNum}: Attempts to tamper with model configuration or memory.`,
+            line: lineNum,
+            snippet: line.trim().slice(0, 120)
+          });
+          break;
+        }
+      }
+      for (const pattern of VERIFICATION_BYPASS_PATTERNS) {
+        if (pattern.test(crossLine)) {
+          results.push({
+            id: "INJ-010",
+            category: "INJ",
+            severity: "HIGH",
+            title: "Social engineering: verification bypass",
+            message: `Line ${lineNum}: Attempts to bypass verification or validation.`,
+            line: lineNum,
+            snippet: line.trim().slice(0, 120)
+          });
+          break;
+        }
+      }
     }
     const commentRegex = /<!--([\s\S]*?)-->/g;
     let commentMatch;
@@ -1124,7 +1217,10 @@ function hasInstructionLikeContent(text) {
     /\brm\s+-rf\b/i,
     /\bcurl\b.*\bsh\b/i,
     /\beval\b/i,
-    /\bexec\b/i
+    /\bexec\b/i,
+    /\bdo\s+not\s+tell\s+(the\s+)?(user|human)/i,
+    /\bpretend\s+(you\s+are|to\s+be)/i,
+    /\bsilently\s+(execute|run|install)/i
   ];
   return instructionPatterns.some((p) => p.test(text));
 }
@@ -1280,6 +1376,79 @@ var PERMISSION_PATTERNS = [
   /\bsetuid\b/,
   /\bsetgid\b/
 ];
+var PERSISTENCE_GROUPS = [
+  {
+    title: "Scheduled task persistence (cron)",
+    patterns: [
+      /\bcrontab\b/,
+      /\/etc\/cron\.(?:d|hourly|daily|weekly|monthly)\b/,
+      /\/var\/spool\/cron\b/
+    ]
+  },
+  {
+    title: "System service persistence (launchd)",
+    patterns: [
+      /\bLaunchAgents?\b/,
+      /\bLaunchDaemons?\b/,
+      /\blaunchctl\s+(?:load|bootstrap|submit)\b/i
+    ]
+  },
+  {
+    title: "System service persistence (systemd/init.d)",
+    patterns: [
+      /\bsystemctl\s+(?:enable|daemon-reload)\b/i,
+      /\/etc\/systemd\/system\b/,
+      /\.config\/systemd\/user\b/,
+      /\/etc\/init\.d\b/,
+      /\/etc\/rc\.local\b/,
+      /\bupdate-rc\.d\b/,
+      /\bchkconfig\b.*\b(?:--add|on)\b/
+    ]
+  },
+  {
+    title: "Shell profile modification",
+    patterns: [
+      /\.(?:bashrc|bash_profile|bash_login|profile|zshrc|zshenv|zprofile|zlogin)\b/,
+      /\/etc\/(?:profile(?:\.d)?|bash\.bashrc|zshrc|zshenv)\b/,
+      /\.config\/fish\/config\.fish\b/
+    ]
+  },
+  {
+    title: "Autostart / login item persistence",
+    patterns: [
+      /\.config\/autostart\b/,
+      /\/etc\/xdg\/autostart\b/,
+      /\bosascript\b[^\n]*\blogin\s+item\b/i
+    ]
+  },
+  {
+    title: "SSH key persistence",
+    patterns: [
+      /\.ssh\/authorized_keys2?\b/
+    ]
+  },
+  {
+    title: "Library injection persistence",
+    patterns: [
+      /\/etc\/ld\.so\.preload\b/,
+      /\bLD_PRELOAD\b/,
+      /\bDYLD_INSERT_LIBRARIES\b/
+    ]
+  },
+  {
+    title: "Git hooks manipulation",
+    patterns: [
+      /\.git\/hooks\/(?:pre-commit|post-commit|pre-push|post-checkout|post-merge|pre-rebase)\b/,
+      /\bgit\s+config\b[^\n]*\bcore\.hooksPath\b/
+    ]
+  },
+  {
+    title: "macOS periodic script persistence",
+    patterns: [
+      /\/etc\/periodic\/(?:daily|weekly|monthly)\b/
+    ]
+  }
+];
 var codeSafetyChecks = {
   name: "Code Safety",
   category: "CODE",
@@ -1388,16 +1557,27 @@ var codeSafetyChecks = {
           lineNum,
           source
         });
-        {
-          const isDoc = isInDocumentationContext(lines, i);
-          if (!isDoc) {
-            checkPatterns(results, line, PERMISSION_PATTERNS, {
-              id: "CODE-012",
+        const isDoc = isInDocumentationContext(lines, i);
+        if (!isDoc) {
+          checkPatterns(results, line, PERMISSION_PATTERNS, {
+            id: "CODE-012",
+            severity: "HIGH",
+            title: "Permission escalation",
+            loc,
+            lineNum,
+            source
+          });
+        }
+        if (!isDoc) {
+          for (const group of PERSISTENCE_GROUPS) {
+            checkPatterns(results, line, group.patterns, {
+              id: "CODE-016",
               severity: "HIGH",
-              title: "Permission escalation",
+              title: group.title,
               loc,
               lineNum,
-              source
+              source,
+              codeBlockCtx: cbCtx
             });
           }
         }
@@ -2526,7 +2706,7 @@ function deduplicateResults(results) {
   };
   for (const r of results) {
     const sourceKey = r.source ?? `_no_source_:${r.category}:${r.line ?? ""}`;
-    const key = `${r.id}::${sourceKey}`;
+    const key = `${r.id}::${r.title}::${sourceKey}`;
     const group = groups.get(key);
     if (group) {
       group.push(r);