vibesafu 0.1.2 → 0.1.5

package/README.md

@@ -218,6 +218,39 @@ pnpm build
 pnpm verify
 ```
 
+## Security Model
+
+### What VibeSafu Protects Against
+
+VibeSafu provides **pre-execution review** of commands. It analyzes commands before they run and blocks dangerous patterns:
+
+- **Prompt Injection Attacks**: Blocks attempts to manipulate Claude into running malicious code
+- **Supply Chain Attacks**: Forces review of package installations and untrusted scripts
+- **Data Exfiltration**: Blocks commands that try to send sensitive data to external servers
+- **Reverse Shells**: Instant-blocks common reverse shell patterns
+- **Crypto Mining**: Blocks cryptocurrency mining commands
+
+### What VibeSafu Does NOT Protect Against
+
+VibeSafu is a **static pre-execution analyzer**, not a runtime sandbox. It cannot protect against:
+
+| Limitation | Description | Recommendation |
+|------------|-------------|----------------|
+| **TOCTOU Attacks** | File modified between analysis and execution | Use Docker/firejail sandbox |
+| **Environment Manipulation** | PATH, LD_PRELOAD, alias poisoning | Use isolated environments |
+| **Multi-stage Chains** | Only 1st level of downloads analyzed | Review scripts manually |
+| **Conditional Malware** | Code behaving differently based on environment | Use runtime monitoring |
+| **Runtime Exploits** | Vulnerabilities in executed code | Use security scanning tools |
+
+### Defense in Depth
+
+For maximum security, combine VibeSafu with:
+
+1. **Sandbox** (Docker, firejail) - Isolates execution environment
+2. **Network Monitoring** - Detects suspicious outbound connections
+3. **File Integrity** - Monitors file changes
+4. **Code Review** - Manual review of downloaded scripts
+
 ## FAQ
 
 ### Do I need an Anthropic API key?

package/dist/index.js

@@ -1128,7 +1128,18 @@ BLOCK - Obviously dangerous:
 Respond with ONLY this JSON structure:
 {"classification": "SELF_HANDLE" | "ESCALATE" | "BLOCK", "reason": "brief explanation", "risk_indicators": ["list", "of", "concerns"]}
 </response_format>`;
+var FORCE_ESCALATE_TYPES = [
+  "package_install"
+  // Supply chain attacks via postinstall scripts
+];
 async function triageWithHaiku(client, checkpoint) {
+  if (FORCE_ESCALATE_TYPES.includes(checkpoint.type)) {
+    return {
+      classification: "ESCALATE",
+      reason: `Package installation requires Sonnet review (supply chain risk)`,
+      riskIndicators: ["force_escalate_type", checkpoint.type]
+    };
+  }
   const sanitizedCommand = sanitizeForPrompt(checkpoint.command);
   const userPrompt = TRIAGE_USER_PROMPT.replace("{command}", escapeXml(sanitizedCommand)).replace("{checkpoint_type}", escapeXml(checkpoint.type)).replace("{context}", escapeXml(checkpoint.description));
   try {
@@ -1224,6 +1235,15 @@ var REVIEW_USER_PROMPT = `<task>Perform security review of this operation</task>
 1. Intent Analysis: What is this command trying to accomplish?
 2. Risk Assessment: What could go wrong?
 3. Mitigation: Are there safer alternatives?
+4. Secondary Downloads: Does this script/command download and execute additional code?
+   - Look for: curl|wget inside scripts, eval(), bash -c "$(curl ...)", exec()
+   - Check for embedded download URLs that will fetch more code
+5. Privilege Escalation Flow: Is this part of a dangerous pattern?
+   - download \u2192 chmod +x \u2192 execute \u2192 sudo sequence
+   - Commands requesting elevated permissions after downloading
+6. Dynamic Execution: Does this use dangerous dynamic execution?
+   - eval, exec, or command substitution with external input
+   - Code that builds and executes strings dynamically
 </analysis_required>
 
 <verdict_rules>
@@ -1231,11 +1251,16 @@ ALLOW - Safe to proceed autonomously:
 - Legitimate development operation
 - No significant risk to system or data
 - Source is verifiable and trusted
+- No secondary downloads or dynamic execution patterns
 
-ASK_USER - Need human approval:
+ASK_USER - Need human approval (choose this if ANY risky pattern detected):
 - Operation has potential risks but may be legitimate
 - User should understand what will happen
 - Provide clear explanation of risks
+- Contains secondary downloads (curl|wget inside script content)
+- Part of privilege escalation flow (download + execute + sudo)
+- Uses dynamic execution (eval, exec with external input)
+- Downloads content that will be executed later
 
 BLOCK - Do not allow:
 - Clear security risk

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibesafu",
-  "version": "0.1.2",
+  "version": "0.1.5",
   "description": "Claude Code Security Guard - Permission request interceptor with LLM-powered security analysis",
   "type": "module",
   "main": "dist/index.js",