vibesafu 0.1.3 → 0.1.6

package/README.md

@@ -218,6 +218,39 @@ pnpm build
 pnpm verify
 ```
 
+## Security Model
+
+### What VibeSafu Protects Against
+
+VibeSafu provides **pre-execution review** of commands. It analyzes commands before they run and blocks dangerous patterns:
+
+- **Prompt Injection Attacks**: Blocks attempts to manipulate Claude into running malicious code
+- **Supply Chain Attacks**: Forces review of package installations and untrusted scripts
+- **Data Exfiltration**: Blocks commands that try to send sensitive data to external servers
+- **Reverse Shells**: Instant-blocks common reverse shell patterns
+- **Crypto Mining**: Blocks cryptocurrency mining commands
+
+### What VibeSafu Does NOT Protect Against
+
+VibeSafu is a **static pre-execution analyzer**, not a runtime sandbox. It cannot protect against:
+
+| Limitation | Description | Recommendation |
+|------------|-------------|----------------|
+| **TOCTOU Attacks** | File modified between analysis and execution | Use Docker/firejail sandbox |
+| **Environment Manipulation** | PATH, LD_PRELOAD, alias poisoning | Use isolated environments |
+| **Multi-stage Chains** | Only 1st level of downloads analyzed | Review scripts manually |
+| **Conditional Malware** | Code behaving differently based on environment | Use runtime monitoring |
+| **Runtime Exploits** | Vulnerabilities in executed code | Use security scanning tools |
+
+### Defense in Depth
+
+For maximum security, combine VibeSafu with:
+
+1. **Sandbox** (Docker, firejail) - Isolates execution environment
+2. **Network Monitoring** - Detects suspicious outbound connections
+3. **File Integrity** - Monitors file changes
+4. **Code Review** - Manual review of downloaded scripts
+
 ## FAQ
 
 ### Do I need an Anthropic API key?

package/dist/index.js

@@ -166,348 +166,462 @@ async function getApiKey() {
 import Anthropic from "@anthropic-ai/sdk";
 
 // src/config/patterns.ts
+var REVERSE_SHELL_RISK = "Remote attacker gains complete control of your system";
+var REVERSE_SHELL_LEGIT = ["Penetration testing", "CTF challenges", "Security research"];
 var REVERSE_SHELL_PATTERNS = [
   // Bash variants
   {
     name: "bash_reverse_shell",
     pattern: /bash\s+-i\s+>&\s*\/dev\/tcp/i,
     severity: "critical",
-    description: "Bash reverse shell via /dev/tcp"
+    description: "Bash reverse shell via /dev/tcp",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   {
     name: "sh_reverse_shell",
     pattern: /\bsh\s+-i\s+>&\s*\/dev\/tcp/i,
     severity: "critical",
-    description: "sh reverse shell via /dev/tcp"
+    description: "sh reverse shell via /dev/tcp",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   {
     name: "zsh_reverse_shell",
     pattern: /zsh\s+-i\s+>&\s*\/dev\/tcp/i,
     severity: "critical",
-    description: "Zsh reverse shell via /dev/tcp"
+    description: "Zsh reverse shell via /dev/tcp",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   {
     name: "ksh_reverse_shell",
     pattern: /ksh\s+-i\s+>&\s*\/dev\/tcp/i,
     severity: "critical",
-    description: "Ksh reverse shell via /dev/tcp"
+    description: "Ksh reverse shell via /dev/tcp",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   {
     name: "dash_reverse_shell",
     pattern: /dash\s+-i\s+>&\s*\/dev\/tcp/i,
     severity: "critical",
-    description: "Dash reverse shell via /dev/tcp"
+    description: "Dash reverse shell via /dev/tcp",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   // Generic /dev/tcp pattern (catches variable expansion bypasses)
   {
     name: "dev_tcp_redirect",
     pattern: />\s*&?\s*\/dev\/tcp\//i,
     severity: "critical",
-    description: "Redirection to /dev/tcp (reverse shell indicator)"
+    description: "Redirection to /dev/tcp (reverse shell indicator)",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   // Netcat variants
   {
     name: "netcat_reverse_shell",
     pattern: /nc\s+.*-e\s+(\/bin\/)?(ba)?sh/i,
     severity: "critical",
-    description: "Netcat reverse shell with -e flag"
+    description: "Netcat reverse shell with -e flag",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   {
     name: "netcat_c_flag",
     pattern: /nc\s+.*-c\s+(\/bin\/)?(ba)?sh/i,
     severity: "critical",
-    description: "Netcat reverse shell with -c flag"
+    description: "Netcat reverse shell with -c flag",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   {
     name: "ncat_reverse_shell",
     pattern: /ncat\s+.*-e\s+(\/bin\/)?(ba)?sh/i,
     severity: "critical",
-    description: "Ncat reverse shell"
+    description: "Ncat reverse shell",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   // Python reverse shells
   {
     name: "python_reverse_shell",
     pattern: /python[23]?\s+.*-c\s+.*socket.*connect/i,
     severity: "critical",
-    description: "Python socket-based reverse shell"
+    description: "Python socket-based reverse shell",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   {
     name: "python_pty_shell",
     pattern: /python[23]?\s+.*-c\s+.*pty\.spawn/i,
     severity: "critical",
-    description: "Python PTY spawn (shell upgrade)"
+    description: "Python PTY spawn (shell upgrade)",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   // Perl reverse shell
   {
     name: "perl_reverse_shell",
     pattern: /perl\s+.*(-e\s+.*)?(['"])?use\s+Socket/i,
     severity: "critical",
-    description: "Perl socket-based reverse shell"
+    description: "Perl socket-based reverse shell",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   // Ruby reverse shell
   {
     name: "ruby_reverse_shell",
     pattern: /ruby\s+.*-rsocket\s+-e/i,
     severity: "critical",
-    description: "Ruby socket-based reverse shell"
+    description: "Ruby socket-based reverse shell",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   {
     name: "ruby_socket_reverse",
     pattern: /ruby\s+.*-e\s+.*TCPSocket/i,
     severity: "critical",
-    description: "Ruby TCPSocket reverse shell"
+    description: "Ruby TCPSocket reverse shell",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   // PHP reverse shell
   {
     name: "php_reverse_shell",
     pattern: /php\s+.*-r\s+.*fsockopen/i,
     severity: "critical",
-    description: "PHP fsockopen reverse shell"
+    description: "PHP fsockopen reverse shell",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   // Socat
   {
     name: "socat_reverse_shell",
     pattern: /socat\s+.*exec.*sh/i,
     severity: "critical",
-    description: "Socat reverse shell"
+    description: "Socat reverse shell",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   },
   // Telnet reverse shell
   {
     name: "telnet_reverse_shell",
     pattern: /telnet\s+.*\|\s*\/bin\/(ba)?sh/i,
     severity: "critical",
-    description: "Telnet-based reverse shell"
+    description: "Telnet-based reverse shell",
+    risk: REVERSE_SHELL_RISK,
+    legitimateUses: REVERSE_SHELL_LEGIT
   }
 ];
+var DATA_EXFIL_RISK = "Sensitive data (API keys, secrets, credentials) sent to external server";
+var DATA_EXFIL_LEGIT = ["Sending auth headers to your own API", "Debugging with trusted services"];
 var DATA_EXFIL_PATTERNS = [
   // Environment variable exfiltration via curl
   {
     name: "curl_api_key",
     pattern: /curl.*\$\{?[A-Z_]*KEY/i,
     severity: "critical",
-    description: "curl with API key environment variable"
+    description: "curl with API key environment variable",
+    risk: DATA_EXFIL_RISK,
+    legitimateUses: DATA_EXFIL_LEGIT
   },
   {
     name: "curl_secret",
     pattern: /curl.*\$\{?[A-Z_]*SECRET/i,
     severity: "critical",
-    description: "curl with secret environment variable"
+    description: "curl with secret environment variable",
+    risk: DATA_EXFIL_RISK,
+    legitimateUses: DATA_EXFIL_LEGIT
   },
   {
     name: "curl_token",
     pattern: /curl.*\$\{?[A-Z_]*TOKEN/i,
     severity: "critical",
-    description: "curl with token environment variable"
+    description: "curl with token environment variable",
+    risk: DATA_EXFIL_RISK,
+    legitimateUses: DATA_EXFIL_LEGIT
   },
   {
     name: "curl_password",
     pattern: /curl.*\$\{?[A-Z_]*PASSWORD/i,
     severity: "critical",
-    description: "curl with password environment variable"
+    description: "curl with password environment variable",
+    risk: DATA_EXFIL_RISK,
+    legitimateUses: DATA_EXFIL_LEGIT
   },
   {
     name: "curl_credential",
     pattern: /curl.*\$\{?[A-Z_]*CREDENTIAL/i,
     severity: "critical",
-    description: "curl with credential environment variable"
+    description: "curl with credential environment variable",
+    risk: DATA_EXFIL_RISK,
+    legitimateUses: DATA_EXFIL_LEGIT
   },
   // Environment variable exfiltration via wget
   {
     name: "wget_key",
     pattern: /wget.*\$\{?[A-Z_]*KEY/i,
     severity: "critical",
-    description: "wget with API key environment variable"
+    description: "wget with API key environment variable",
+    risk: DATA_EXFIL_RISK,
+    legitimateUses: DATA_EXFIL_LEGIT
   },
   {
     name: "wget_secret",
     pattern: /wget.*\$\{?[A-Z_]*SECRET/i,
     severity: "critical",
-    description: "wget with secret environment variable"
+    description: "wget with secret environment variable",
+    risk: DATA_EXFIL_RISK,
+    legitimateUses: DATA_EXFIL_LEGIT
   },
   {
     name: "wget_token",
     pattern: /wget.*\$\{?[A-Z_]*TOKEN/i,
     severity: "critical",
-    description: "wget with token environment variable"
+    description: "wget with token environment variable",
+    risk: DATA_EXFIL_RISK,
+    legitimateUses: DATA_EXFIL_LEGIT
   },
   // POST data with env vars
   {
     name: "curl_data_env",
     pattern: /curl\s+.*(-d|--data|--data-raw)\s+.*\$\{?[A-Z_]/i,
     severity: "critical",
-    description: "curl POST with environment variable in data"
+    description: "curl POST with environment variable in data",
+    risk: DATA_EXFIL_RISK,
+    legitimateUses: DATA_EXFIL_LEGIT
   },
   {
     name: "curl_header_env",
     pattern: /curl\s+.*(-H|--header)\s+.*\$\{?[A-Z_]/i,
     severity: "critical",
-    description: "curl with environment variable in header"
+    description: "curl with environment variable in header",
+    risk: DATA_EXFIL_RISK,
+    legitimateUses: DATA_EXFIL_LEGIT
   },
   {
     name: "wget_post_env",
     pattern: /wget\s+.*--post-data.*\$\{?[A-Z_]/i,
     severity: "critical",
-    description: "wget POST with environment variable"
+    description: "wget POST with environment variable",
+    risk: DATA_EXFIL_RISK,
+    legitimateUses: DATA_EXFIL_LEGIT
   },
   {
     name: "wget_header_env",
     pattern: /wget\s+.*--header.*\$\{?[A-Z_]/i,
     severity: "critical",
-    description: "wget with environment variable in header"
+    description: "wget with environment variable in header",
+    risk: DATA_EXFIL_RISK,
+    legitimateUses: DATA_EXFIL_LEGIT
   },
   // Full environment dump
   {
     name: "env_pipe_curl",
     pattern: /\benv\b.*\|\s*curl/i,
     severity: "critical",
-    description: "Environment dump piped to curl"
+    description: "Environment dump piped to curl",
+    risk: "All environment variables (including secrets) sent to external server",
+    legitimateUses: ["Debugging in controlled environment"]
   },
   {
     name: "printenv_pipe",
     pattern: /printenv.*\|\s*(curl|nc|wget)/i,
     severity: "critical",
-    description: "Printenv piped to network command"
+    description: "Printenv piped to network command",
+    risk: "All environment variables sent to external server",
+    legitimateUses: ["Debugging in controlled environment"]
   },
   {
     name: "env_pipe_nc",
     pattern: /\benv\b.*\|\s*nc\b/i,
     severity: "critical",
-    description: "Environment dump piped to netcat"
+    description: "Environment dump piped to netcat",
+    risk: "All environment variables sent to external server",
+    legitimateUses: ["Debugging in controlled environment"]
   },
   // Sensitive file exfiltration
   {
     name: "ssh_key_exfil",
     pattern: /cat\s+.*\.ssh\/(id_rsa|id_ed25519|id_dsa).*\|\s*(curl|nc|wget)/i,
     severity: "critical",
-    description: "SSH private key exfiltration"
+    description: "SSH private key exfiltration",
+    risk: "SSH private key sent to external server - attacker can access your servers",
+    legitimateUses: ["Backing up keys to your own secure storage"]
   },
   {
     name: "aws_creds_exfil",
     pattern: /cat\s+.*\.aws\/(credentials|config).*\|\s*(curl|nc|wget)/i,
     severity: "critical",
-    description: "AWS credentials exfiltration"
+    description: "AWS credentials exfiltration",
+    risk: "AWS credentials sent to external server - attacker gains cloud access",
+    legitimateUses: ["Backing up config to your own secure storage"]
   },
   {
     name: "file_stdin_curl",
     pattern: /curl\s+.*-d\s*@-/i,
     severity: "high",
-    description: "curl reading from stdin (potential data exfil)"
+    description: "curl reading from stdin (potential data exfil)",
+    risk: "Piped data sent to external server",
+    legitimateUses: ["Uploading files to your own API", "CI/CD pipelines"]
   },
   // Reverse copy tools
   {
     name: "scp_outbound",
     pattern: /scp\s+.*[^@]+@[^:]+:/i,
     severity: "high",
-    description: "scp to remote host (potential data exfil)"
+    description: "scp to remote host (potential data exfil)",
+    risk: "Files copied to remote server",
+    legitimateUses: ["Deploying to your servers", "Backup operations"]
   },
   {
     name: "rsync_outbound",
     pattern: /rsync\s+.*[^@]+@/i,
     severity: "high",
-    description: "rsync to remote host (potential data exfil)"
+    description: "rsync to remote host (potential data exfil)",
+    risk: "Files synced to remote server",
+    legitimateUses: ["Deploying to your servers", "Backup operations"]
   },
   // Backtick command substitution with env vars
   {
     name: "backtick_env_exfil",
     pattern: /curl.*`.*\$[A-Z_]+.*`/i,
     severity: "critical",
-    description: "curl with backtick command substitution containing env var"
+    description: "curl with backtick command substitution containing env var",
+    risk: DATA_EXFIL_RISK,
+    legitimateUses: DATA_EXFIL_LEGIT
   },
   // DNS tunneling patterns
   {
     name: "dns_tunnel_dig",
     pattern: /dig\s+.*\$[A-Z_]/i,
     severity: "high",
-    description: "DNS query with environment variable (potential DNS tunnel)"
+    description: "DNS query with environment variable (potential DNS tunnel)",
+    risk: "Data exfiltration via DNS queries - bypasses firewalls",
+    legitimateUses: ["Dynamic DNS lookups", "DNS debugging"]
   },
   {
     name: "dns_tunnel_nslookup",
     pattern: /nslookup\s+.*\$[A-Z_]/i,
     severity: "high",
-    description: "nslookup with environment variable (potential DNS tunnel)"
+    description: "nslookup with environment variable (potential DNS tunnel)",
+    risk: "Data exfiltration via DNS queries - bypasses firewalls",
+    legitimateUses: ["Dynamic DNS lookups", "DNS debugging"]
   }
 ];
+var CRYPTO_RISK = "Uses your CPU/GPU for cryptocurrency mining, slowing system and increasing power costs";
+var CRYPTO_LEGIT = ["Intentional mining on your own hardware", "Mining pool testing"];
 var CRYPTO_MINING_PATTERNS = [
   {
     name: "xmrig",
     pattern: /xmrig/i,
     severity: "critical",
-    description: "XMRig cryptocurrency miner"
+    description: "XMRig cryptocurrency miner",
+    risk: CRYPTO_RISK,
+    legitimateUses: CRYPTO_LEGIT
   },
   {
     name: "minerd",
     pattern: /minerd/i,
     severity: "critical",
-    description: "Minerd cryptocurrency miner"
+    description: "Minerd cryptocurrency miner",
+    risk: CRYPTO_RISK,
+    legitimateUses: CRYPTO_LEGIT
   },
   {
     name: "cgminer",
     pattern: /cgminer/i,
     severity: "critical",
-    description: "CGMiner cryptocurrency miner"
+    description: "CGMiner cryptocurrency miner",
+    risk: CRYPTO_RISK,
+    legitimateUses: CRYPTO_LEGIT
   },
   {
     name: "bfgminer",
     pattern: /bfgminer/i,
     severity: "critical",
-    description: "BFGMiner cryptocurrency miner"
+    description: "BFGMiner cryptocurrency miner",
+    risk: CRYPTO_RISK,
+    legitimateUses: CRYPTO_LEGIT
   },
   {
     name: "stratum_protocol",
     pattern: /stratum\+tcp/i,
     severity: "critical",
-    description: "Stratum mining protocol"
+    description: "Stratum mining protocol",
+    risk: CRYPTO_RISK,
+    legitimateUses: CRYPTO_LEGIT
   }
 ];
+var OBFUSCATED_RISK = "Hidden/encoded commands executed - content cannot be reviewed before running";
+var OBFUSCATED_LEGIT = ["Running encoded payloads in security testing", "Decoding legitimate scripts"];
 var OBFUSCATED_EXEC_PATTERNS = [
   {
     name: "base64_pipe_bash",
     pattern: /\|\s*base64\s+-d\s*\|\s*(ba)?sh/i,
     severity: "critical",
-    description: "Base64 decode piped to shell"
+    description: "Base64 decode piped to shell",
+    risk: OBFUSCATED_RISK,
+    legitimateUses: OBFUSCATED_LEGIT
   },
   {
     name: "base64_decode_bash",
     pattern: /base64\s+(-d|--decode)\s+\S+\s*\|\s*(ba)?sh/i,
     severity: "critical",
-    description: "Base64 decode from file piped to shell"
+    description: "Base64 decode from file piped to shell",
+    risk: OBFUSCATED_RISK,
+    legitimateUses: OBFUSCATED_LEGIT
   },
   {
     name: "eval_base64_decode",
     pattern: /eval\s*\(\s*base64_decode/i,
     severity: "critical",
-    description: "PHP-style eval with base64 decode"
+    description: "PHP-style eval with base64 decode",
+    risk: OBFUSCATED_RISK,
+    legitimateUses: OBFUSCATED_LEGIT
   },
   // Bypass techniques
   {
     name: "eval_curl",
     pattern: /eval\s+.*\$\(.*curl/i,
     severity: "critical",
-    description: "eval with curl command substitution"
+    description: "eval with curl command substitution",
+    risk: "Remote code downloaded and executed immediately",
+    legitimateUses: ["Running installer scripts you trust"]
   },
   {
     name: "eval_wget",
     pattern: /eval\s+.*\$\(.*wget/i,
     severity: "critical",
-    description: "eval with wget command substitution"
+    description: "eval with wget command substitution",
+    risk: "Remote code downloaded and executed immediately",
+    legitimateUses: ["Running installer scripts you trust"]
   },
   {
     name: "bash_herestring_curl",
     pattern: /bash\s+<<<\s*.*\$\(.*curl/i,
     severity: "critical",
-    description: "bash here-string with curl"
+    description: "bash here-string with curl",
+    risk: "Remote code downloaded and executed via here-string",
+    legitimateUses: ["Running installer scripts you trust"]
   },
   {
     name: "bash_process_sub",
     pattern: /bash\s+<\(.*curl/i,
     severity: "critical",
-    description: "bash process substitution with curl"
+    description: "bash process substitution with curl",
+    risk: "Remote code downloaded and executed via process substitution",
+    legitimateUses: ["Running installer scripts you trust"]
   },
   {
     name: "bash_process_sub_wget",
     pattern: /bash\s+<\(.*wget/i,
     severity: "critical",
-    description: "bash process substitution with wget"
+    description: "bash process substitution with wget",
+    risk: "Remote code downloaded and executed via process substitution",
+    legitimateUses: ["Running installer scripts you trust"]
   }
 ];
 var DESTRUCTIVE_PATTERNS = [
@@ -515,61 +629,81 @@ var DESTRUCTIVE_PATTERNS = [
     name: "rm_rf_root",
     pattern: /rm\s+(-[a-zA-Z]*f[a-zA-Z]*\s+)*-[a-zA-Z]*r[a-zA-Z]*.*\s+\/(\s|$|;|&)/i,
     severity: "critical",
-    description: "rm -rf on root directory"
+    description: "rm -rf on root directory",
+    risk: "Deletes entire filesystem - complete data loss, unbootable system",
+    legitimateUses: ["Wiping a system intentionally before reinstall"]
   },
   {
     name: "rm_rf_home",
     pattern: /rm\s+(-[a-zA-Z]*f[a-zA-Z]*\s+)*-[a-zA-Z]*r[a-zA-Z]*.*\s+(~|\/home|\$HOME)/i,
     severity: "critical",
-    description: "rm -rf on home directory"
+    description: "rm -rf on home directory",
+    risk: "Deletes all user files - documents, configs, ssh keys, everything",
+    legitimateUses: ["Cleaning up a user account before deletion"]
   },
   {
     name: "rm_rf_star",
     pattern: /rm\s+(-[a-zA-Z]*f[a-zA-Z]*\s+)*-[a-zA-Z]*r[a-zA-Z]*\s+\*/i,
     severity: "critical",
-    description: "rm -rf with wildcard"
+    description: "rm -rf with wildcard",
+    risk: "Deletes all files in current directory recursively",
+    legitimateUses: ["Cleaning build artifacts", "Resetting test environment"]
   },
   {
     name: "mkfs_format",
     pattern: /mkfs(\.[a-z0-9]+)?\s+\/dev\//i,
     severity: "critical",
-    description: "mkfs filesystem format on device"
+    description: "mkfs filesystem format on device",
+    risk: "Formats disk - all data on device will be permanently lost",
+    legitimateUses: ["Setting up new disk", "Creating bootable drives"]
   },
   {
     name: "dd_destructive",
     pattern: /dd\s+.*of=\/dev\/[hs]d/i,
     severity: "critical",
-    description: "dd write to disk device"
+    description: "dd write to disk device",
+    risk: "Overwrites disk directly - data loss, potential boot failure",
+    legitimateUses: ["Creating bootable USB", "Disk imaging"]
   },
   {
     name: "dd_zero_device",
     pattern: /dd\s+.*if=\/dev\/(zero|urandom).*of=\/dev\//i,
     severity: "critical",
-    description: "dd zero/random write to device"
+    description: "dd zero/random write to device",
+    risk: "Wipes disk with zeros/random data - complete, unrecoverable data loss",
+    legitimateUses: ["Secure disk wiping", "Preparing disk for disposal"]
   },
   {
     name: "fork_bomb",
     pattern: /:\(\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;?\s*:/,
     severity: "critical",
-    description: "Fork bomb"
+    description: "Fork bomb",
+    risk: "Creates infinite processes - system freeze, requires hard reboot",
+    legitimateUses: ["Testing system limits", "Security demonstrations"]
   },
   {
     name: "fork_bomb_variant",
     pattern: /\w+\(\)\s*\{\s*\w+\s*\|\s*\w+\s*&\s*\}\s*;?\s*\w+/,
     severity: "critical",
-    description: "Fork bomb variant"
+    description: "Fork bomb variant",
+    risk: "Creates infinite processes - system freeze, requires hard reboot",
+    legitimateUses: ["Testing system limits", "Security demonstrations"]
   },
   {
     name: "chmod_recursive_777",
     pattern: /chmod\s+(-R|--recursive)\s+777\s+\//i,
     severity: "critical",
-    description: "chmod 777 recursive on system directories"
+    description: "chmod 777 recursive on system directories",
+    risk: "Makes all system files world-writable - severe security vulnerability",
+    legitimateUses: ["Almost never legitimate on system directories"]
   },
   {
     name: "chown_recursive_root",
     pattern: /chown\s+(-R|--recursive)\s+.*\s+\/(\s|$)/i,
     severity: "critical",
-    description: "chown recursive on root"
+    description: "chown recursive on root",
+    risk: "Changes ownership of all system files - can break system",
+    legitimateUses: ["System recovery operations"]
   }
 ];
 var INSTANT_BLOCK_PATTERNS = [
@@ -612,21 +746,23 @@ var CHECKPOINT_PATTERNS = [
 ];
 
 // src/guard/instant-block.ts
-function checkInstantBlock(command) {
+function checkHighRiskPatterns(command) {
   if (!command || !command.trim()) {
-    return { blocked: false };
+    return { detected: false };
   }
   for (const pattern of INSTANT_BLOCK_PATTERNS) {
     if (pattern.pattern.test(command)) {
       return {
-        blocked: true,
-        reason: `Blocked: Matches dangerous pattern - ${pattern.description}`,
+        detected: true,
         patternName: pattern.name,
-        severity: pattern.severity
+        severity: pattern.severity,
+        description: pattern.description,
+        risk: pattern.risk,
+        legitimateUses: pattern.legitimateUses
       };
     }
   }
-  return { blocked: false };
+  return { detected: false };
 }
 
 // src/guard/instant-allow.ts
@@ -906,67 +1042,325 @@ function checkTrustedDomains(command) {
 }
 
 // src/guard/file-tools.ts
-var WRITE_BLOCKED_PATHS = [
+var WRITE_SENSITIVE_PATHS = [
   // SSH - Critical (persistent access)
-  { pattern: /^~?\/?\.ssh\//i, description: "SSH directory", severity: "critical" },
-  { pattern: /\.ssh\/authorized_keys$/i, description: "SSH authorized_keys", severity: "critical" },
-  { pattern: /\.ssh\/config$/i, description: "SSH config", severity: "critical" },
+  {
+    pattern: /^~?\/?\.ssh\//i,
+    description: "SSH directory",
+    severity: "critical",
+    risk: "Attacker can add their key for persistent remote access",
+    legitimateUses: ["Adding new SSH keys", "Configuring SSH"]
+  },
+  {
+    pattern: /\.ssh\/authorized_keys$/i,
+    description: "SSH authorized_keys",
+    severity: "critical",
+    risk: "Attacker gains persistent SSH access to your machine",
+    legitimateUses: ["Adding authorized keys for remote access"]
+  },
+  {
+    pattern: /\.ssh\/config$/i,
+    description: "SSH config",
+    severity: "critical",
+    risk: "Can redirect SSH connections to attacker-controlled servers",
+    legitimateUses: ["Configuring SSH hosts and options"]
+  },
   // Cloud credentials - Critical
-  { pattern: /^~?\/?\.aws\//i, description: "AWS credentials directory", severity: "critical" },
-  { pattern: /^~?\/?\.azure\//i, description: "Azure credentials directory", severity: "critical" },
-  { pattern: /^~?\/?\.gcloud\//i, description: "GCloud credentials directory", severity: "critical" },
-  { pattern: /^~?\/?\.config\/gcloud\//i, description: "GCloud config directory", severity: "critical" },
+  {
+    pattern: /^~?\/?\.aws\//i,
+    description: "AWS credentials directory",
+    severity: "critical",
+    risk: "Attacker gains access to your AWS account",
+    legitimateUses: ["Configuring AWS CLI", "Setting up AWS profiles"]
+  },
+  {
+    pattern: /^~?\/?\.azure\//i,
+    description: "Azure credentials directory",
+    severity: "critical",
+    risk: "Attacker gains access to your Azure account",
+    legitimateUses: ["Configuring Azure CLI"]
+  },
+  {
+    pattern: /^~?\/?\.gcloud\//i,
+    description: "GCloud credentials directory",
+    severity: "critical",
+    risk: "Attacker gains access to your Google Cloud account",
+    legitimateUses: ["Configuring gcloud CLI"]
+  },
+  {
+    pattern: /^~?\/?\.config\/gcloud\//i,
+    description: "GCloud config directory",
+    severity: "critical",
+    risk: "Attacker gains access to your Google Cloud account",
+    legitimateUses: ["Configuring gcloud CLI"]
+  },
   // GPG/Crypto - Critical
-  { pattern: /^~?\/?\.gnupg\//i, description: "GPG directory", severity: "critical" },
+  {
+    pattern: /^~?\/?\.gnupg\//i,
+    description: "GPG directory",
+    severity: "critical",
+    risk: "Attacker can sign/encrypt as you or steal your keys",
+    legitimateUses: ["Managing GPG keys", "Configuring GPG"]
+  },
   // System config - Critical
-  { pattern: /^\/etc\//i, description: "System /etc directory", severity: "critical" },
-  { pattern: /^\/usr\//i, description: "System /usr directory", severity: "critical" },
-  { pattern: /^\/bin\//i, description: "System /bin directory", severity: "critical" },
-  { pattern: /^\/sbin\//i, description: "System /sbin directory", severity: "critical" },
+  {
+    pattern: /^\/etc\//i,
+    description: "System /etc directory",
+    severity: "critical",
+    risk: "Can modify system configuration, add users, change permissions",
+    legitimateUses: ["System administration", "Server configuration"]
+  },
+  {
+    pattern: /^\/usr\//i,
+    description: "System /usr directory",
+    severity: "critical",
+    risk: "Can replace system binaries with malicious versions",
+    legitimateUses: ["Installing software", "System administration"]
+  },
+  {
+    pattern: /^\/bin\//i,
+    description: "System /bin directory",
+    severity: "critical",
+    risk: "Can replace core system commands",
+    legitimateUses: ["System administration"]
+  },
+  {
+    pattern: /^\/sbin\//i,
+    description: "System /sbin directory",
+    severity: "critical",
+    risk: "Can replace system administration commands",
+    legitimateUses: ["System administration"]
+  },
   // Shell startup files - High (code execution on shell start)
-  { pattern: /^~?\/?\.bashrc$/i, description: "Bash startup file", severity: "high" },
-  { pattern: /^~?\/?\.bash_profile$/i, description: "Bash profile", severity: "high" },
-  { pattern: /^~?\/?\.zshrc$/i, description: "Zsh startup file", severity: "high" },
-  { pattern: /^~?\/?\.zprofile$/i, description: "Zsh profile", severity: "high" },
-  { pattern: /^~?\/?\.profile$/i, description: "Shell profile", severity: "high" },
-  { pattern: /^~?\/?\.bash_logout$/i, description: "Bash logout script", severity: "high" },
-  { pattern: /^~?\/?\.zlogout$/i, description: "Zsh logout script", severity: "high" },
+  {
+    pattern: /^~?\/?\.bashrc$/i,
+    description: "Bash startup file",
+    severity: "high",
+    risk: "Code runs every time you open a terminal",
+    legitimateUses: ["Adding aliases", "Setting environment variables", "Shell customization"]
+  },
+  {
+    pattern: /^~?\/?\.bash_profile$/i,
+    description: "Bash profile",
+    severity: "high",
+    risk: "Code runs on login shell startup",
+    legitimateUses: ["Login shell configuration"]
+  },
+  {
+    pattern: /^~?\/?\.zshrc$/i,
+    description: "Zsh startup file",
+    severity: "high",
+    risk: "Code runs every time you open a terminal",
+    legitimateUses: ["Adding aliases", "Setting environment variables", "Shell customization"]
+  },
+  {
+    pattern: /^~?\/?\.zprofile$/i,
+    description: "Zsh profile",
+    severity: "high",
+    risk: "Code runs on login shell startup",
+    legitimateUses: ["Login shell configuration"]
+  },
+  {
+    pattern: /^~?\/?\.profile$/i,
+    description: "Shell profile",
+    severity: "high",
+    risk: "Code runs on shell startup",
+    legitimateUses: ["Shell configuration"]
+  },
+  {
+    pattern: /^~?\/?\.bash_logout$/i,
+    description: "Bash logout script",
+    severity: "high",
+    risk: "Code runs when you close terminal",
+    legitimateUses: ["Cleanup scripts"]
+  },
+  {
+    pattern: /^~?\/?\.zlogout$/i,
+    description: "Zsh logout script",
+    severity: "high",
+    risk: "Code runs when you close terminal",
+    legitimateUses: ["Cleanup scripts"]
+  },
   // Cron - High (scheduled code execution)
-  { pattern: /crontab/i, description: "Crontab file", severity: "high" },
-  { pattern: /^\/var\/spool\/cron\//i, description: "Cron spool directory", severity: "high" },
+  {
+    pattern: /crontab/i,
+    description: "Crontab file",
+    severity: "high",
+    risk: "Can schedule malicious code to run periodically",
+    legitimateUses: ["Setting up scheduled tasks", "Automation"]
+  },
+  {
+    pattern: /^\/var\/spool\/cron\//i,
+    description: "Cron spool directory",
+    severity: "high",
+    risk: "Can schedule malicious code to run periodically",
+    legitimateUses: ["System cron job management"]
+  },
   // Git hooks - High (code execution on git operations)
-  { pattern: /\.git\/hooks\//i, description: "Git hooks directory", severity: "high" },
+  {
+    pattern: /\.git\/hooks\//i,
+    description: "Git hooks directory",
+    severity: "high",
+    risk: "Code runs automatically on git operations (commit, push, etc.)",
+    legitimateUses: ["Setting up pre-commit hooks", "CI/CD integration", "Code formatting"]
+  },
   // Package managers config (supply chain risk)
-  { pattern: /^~?\/?\.npmrc$/i, description: "NPM config (may contain tokens)", severity: "high" },
-  { pattern: /^~?\/?\.pypirc$/i, description: "PyPI config (may contain tokens)", severity: "high" },
-  // Claude Code config - High (could disable security)
-  { pattern: /CLAUDE\.md$/i, description: "Claude instructions file", severity: "high" },
-  { pattern: /^~?\/?\.claude\//i, description: "Claude config directory", severity: "high" }
+  {
+    pattern: /^~?\/?\.npmrc$/i,
+    description: "NPM config (may contain tokens)",
+    severity: "high",
+    risk: "Can steal npm tokens or redirect package installs",
+    legitimateUses: ["Configuring npm registry", "Setting up private packages"]
+  },
+  {
+    pattern: /^~?\/?\.pypirc$/i,
+    description: "PyPI config (may contain tokens)",
+    severity: "high",
+    risk: "Can steal PyPI tokens or redirect package installs",
+    legitimateUses: ["Configuring PyPI", "Publishing packages"]
+  },
+  // Claude Code config - High (could modify AI behavior)
+  {
+    pattern: /CLAUDE\.md$/i,
+    description: "Claude instructions file",
+    severity: "high",
+    risk: "Can modify AI behavior and disable security rules",
+    legitimateUses: ["Updating project instructions", "Configuring Claude behavior"]
+  },
+  {
+    pattern: /^~?\/?\.claude\//i,
+    description: "Claude config directory",
+    severity: "high",
+    risk: "Can modify Claude Code settings",
+    legitimateUses: ["Configuring Claude Code"]
+  }
 ];
-var READ_BLOCKED_PATHS = [
+var READ_SENSITIVE_PATHS = [
   // Private keys - Critical
-  { pattern: /\.ssh\/id_rsa$/i, description: "SSH private key (RSA)", severity: "critical" },
-  { pattern: /\.ssh\/id_ed25519$/i, description: "SSH private key (Ed25519)", severity: "critical" },
-  { pattern: /\.ssh\/id_ecdsa$/i, description: "SSH private key (ECDSA)", severity: "critical" },
-  { pattern: /\.ssh\/id_dsa$/i, description: "SSH private key (DSA)", severity: "critical" },
-  { pattern: /\.pem$/i, description: "PEM private key", severity: "critical" },
-  { pattern: /\.key$/i, description: "Private key file", severity: "critical" },
+  {
+    pattern: /\.ssh\/id_rsa$/i,
+    description: "SSH private key (RSA)",
+    severity: "critical",
+    risk: "Private key can be used to access all your SSH-protected servers",
+    legitimateUses: ["Backing up keys", "Key migration"]
+  },
+  {
+    pattern: /\.ssh\/id_ed25519$/i,
+    description: "SSH private key (Ed25519)",
+    severity: "critical",
+    risk: "Private key can be used to access all your SSH-protected servers",
+    legitimateUses: ["Backing up keys", "Key migration"]
+  },
+  {
+    pattern: /\.ssh\/id_ecdsa$/i,
+    description: "SSH private key (ECDSA)",
+    severity: "critical",
+    risk: "Private key can be used to access all your SSH-protected servers",
+    legitimateUses: ["Backing up keys", "Key migration"]
+  },
+  {
+    pattern: /\.ssh\/id_dsa$/i,
+    description: "SSH private key (DSA)",
+    severity: "critical",
+    risk: "Private key can be used to access all your SSH-protected servers",
+    legitimateUses: ["Backing up keys", "Key migration"]
+  },
+  {
+    pattern: /\.pem$/i,
+    description: "PEM private key",
+    severity: "critical",
+    risk: "Private key file - could grant access to servers or services",
+    legitimateUses: ["Certificate management", "Server configuration"]
+  },
+  {
+    pattern: /\.key$/i,
+    description: "Private key file",
+    severity: "critical",
+    risk: "Private key file - could grant access to servers or services",
+    legitimateUses: ["Certificate management", "SSL configuration"]
+  },
   // Cloud credentials - Critical
-  { pattern: /\.aws\/credentials$/i, description: "AWS credentials", severity: "critical" },
-  { pattern: /\.azure\/credentials$/i, description: "Azure credentials", severity: "critical" },
+  {
+    pattern: /\.aws\/credentials$/i,
+    description: "AWS credentials",
+    severity: "critical",
+    risk: "Full access to your AWS account - can create resources, access data",
+    legitimateUses: ["Credential rotation", "Backup"]
+  },
+  {
+    pattern: /\.azure\/credentials$/i,
+    description: "Azure credentials",
+    severity: "critical",
+    risk: "Full access to your Azure account",
+    legitimateUses: ["Credential rotation", "Backup"]
+  },
   // Environment files - High
-  { pattern: /\.env$/i, description: "Environment file", severity: "high" },
-  { pattern: /\.env\.local$/i, description: "Local environment file", severity: "high" },
-  { pattern: /\.env\.production$/i, description: "Production environment file", severity: "high" },
-  { pattern: /\.env\.development$/i, description: "Development environment file", severity: "high" },
+  {
+    pattern: /\.env$/i,
+    description: "Environment file",
+    severity: "high",
+    risk: "Contains API keys, database passwords, and other secrets",
+    legitimateUses: ["Debugging", "Environment setup", "Configuration review"]
+  },
+  {
+    pattern: /\.env\.local$/i,
+    description: "Local environment file",
+    severity: "high",
+    risk: "Contains local development secrets",
+    legitimateUses: ["Debugging", "Local development"]
+  },
+  {
+    pattern: /\.env\.production$/i,
+    description: "Production environment file",
+    severity: "high",
+    risk: "Contains production secrets - highest value target",
+    legitimateUses: ["Deployment configuration", "Debugging production issues"]
+  },
+  {
+    pattern: /\.env\.development$/i,
+    description: "Development environment file",
+    severity: "high",
+    risk: "Contains development secrets",
+    legitimateUses: ["Development setup"]
+  },
   // Password/credential files - Critical
-  { pattern: /^\/etc\/shadow$/i, description: "System shadow file", severity: "critical" },
-  { pattern: /^\/etc\/passwd$/i, description: "System passwd file", severity: "high" },
+  {
+    pattern: /^\/etc\/shadow$/i,
+    description: "System shadow file",
+    severity: "critical",
+    risk: "Contains hashed passwords for all system users",
+    legitimateUses: ["System administration", "Security auditing"]
+  },
+  {
+    pattern: /^\/etc\/passwd$/i,
+    description: "System passwd file",
+    severity: "high",
+    risk: "Contains user account information",
+    legitimateUses: ["System administration", "User management"]
+  },
   // Browser/app credentials
-  { pattern: /\.netrc$/i, description: "Netrc credentials", severity: "critical" },
-  { pattern: /\.docker\/config\.json$/i, description: "Docker config (may contain tokens)", severity: "high" },
+  {
+    pattern: /\.netrc$/i,
+    description: "Netrc credentials",
+    severity: "critical",
+    risk: "Contains plaintext passwords for FTP/HTTP authentication",
+    legitimateUses: ["Credential management"]
+  },
+  {
+    pattern: /\.docker\/config\.json$/i,
+    description: "Docker config (may contain tokens)",
+    severity: "high",
+    risk: "May contain registry authentication tokens",
+    legitimateUses: ["Docker configuration", "Registry setup"]
+  },
   // Keychain/secret stores
-  { pattern: /\.gnupg\/private-keys/i, description: "GPG private keys", severity: "critical" }
+  {
+    pattern: /\.gnupg\/private-keys/i,
+    description: "GPG private keys",
+    severity: "critical",
+    risk: "Can decrypt messages and sign as you",
+    legitimateUses: ["Key backup", "Key migration"]
+  }
 ];
 function normalizePath(filePath) {
   let normalized = filePath.replace(/\$HOME/g, "~").replace(/\$\{HOME\}/g, "~");
@@ -976,22 +1370,26 @@ function normalizePath(filePath) {
 function checkFilePath(filePath, action) {
   const normalized = normalizePath(filePath);
   if (action === "read") {
-    for (const { pattern, description, severity } of READ_BLOCKED_PATHS) {
+    for (const { pattern, description, severity, risk, legitimateUses } of READ_SENSITIVE_PATHS) {
       if (pattern.test(normalized)) {
         return {
           blocked: true,
-          reason: `Blocked: Reading ${description} (${normalized})`,
-          severity
+          reason: `Reading ${description} (${normalized})`,
+          severity,
+          risk,
+          legitimateUses
         };
       }
     }
   } else {
-    for (const { pattern, description, severity } of WRITE_BLOCKED_PATHS) {
+    for (const { pattern, description, severity, risk, legitimateUses } of WRITE_SENSITIVE_PATHS) {
       if (pattern.test(normalized)) {
         return {
           blocked: true,
-          reason: `Blocked: ${action === "write" ? "Writing to" : "Editing"} ${description} (${normalized})`,
-          severity
+          reason: `${action === "write" ? "Writing to" : "Editing"} ${description} (${normalized})`,
+          severity,
+          risk,
+          legitimateUses
         };
       }
     }
@@ -1128,7 +1526,18 @@ BLOCK - Obviously dangerous:
 Respond with ONLY this JSON structure:
 {"classification": "SELF_HANDLE" | "ESCALATE" | "BLOCK", "reason": "brief explanation", "risk_indicators": ["list", "of", "concerns"]}
 </response_format>`;
+var FORCE_ESCALATE_TYPES = [
+  "package_install"
+  // Supply chain attacks via postinstall scripts
+];
 async function triageWithHaiku(client, checkpoint) {
+  if (FORCE_ESCALATE_TYPES.includes(checkpoint.type)) {
+    return {
+      classification: "ESCALATE",
+      reason: `Package installation requires Sonnet review (supply chain risk)`,
+      riskIndicators: ["force_escalate_type", checkpoint.type]
+    };
+  }
   const sanitizedCommand = sanitizeForPrompt(checkpoint.command);
   const userPrompt = TRIAGE_USER_PROMPT.replace("{command}", escapeXml(sanitizedCommand)).replace("{checkpoint_type}", escapeXml(checkpoint.type)).replace("{context}", escapeXml(checkpoint.description));
   try {
@@ -1224,6 +1633,15 @@ var REVIEW_USER_PROMPT = `<task>Perform security review of this operation</task>
 1. Intent Analysis: What is this command trying to accomplish?
 2. Risk Assessment: What could go wrong?
 3. Mitigation: Are there safer alternatives?
+4. Secondary Downloads: Does this script/command download and execute additional code?
+   - Look for: curl|wget inside scripts, eval(), bash -c "$(curl ...)", exec()
+   - Check for embedded download URLs that will fetch more code
+5. Privilege Escalation Flow: Is this part of a dangerous pattern?
+   - download \u2192 chmod +x \u2192 execute \u2192 sudo sequence
+   - Commands requesting elevated permissions after downloading
+6. Dynamic Execution: Does this use dangerous dynamic execution?
+   - eval, exec, or command substitution with external input
+   - Code that builds and executes strings dynamically
 </analysis_required>
 
 <verdict_rules>
@@ -1231,11 +1649,16 @@ ALLOW - Safe to proceed autonomously:
 - Legitimate development operation
 - No significant risk to system or data
 - Source is verifiable and trusted
+- No secondary downloads or dynamic execution patterns
 
-ASK_USER - Need human approval:
+ASK_USER - Need human approval (choose this if ANY risky pattern detected):
 - Operation has potential risks but may be legitimate
 - User should understand what will happen
 - Provide clear explanation of risks
+- Contains secondary downloads (curl|wget inside script content)
+- Part of privilege escalation flow (download + execute + sudo)
+- Uses dynamic execution (eval, exec with external input)
+- Downloads content that will be executed later
 
 BLOCK - Do not allow:
 - Clear security risk
@@ -1332,10 +1755,18 @@ async function processPermissionRequest(input, anthropicClient) {
   if (input.tool_name === "Write" || input.tool_name === "Edit" || input.tool_name === "Read") {
     const fileCheck = checkFileTool(input.tool_name, input.tool_input);
     if (fileCheck.blocked) {
+      const severityLabel = fileCheck.severity === "critical" ? "SENSITIVE FILE" : "CAUTION";
+      const legitimateUsesText = fileCheck.legitimateUses?.length ? `
+Common uses: ${fileCheck.legitimateUses.join(", ")}` : "";
       return {
-        decision: "deny",
-        reason: fileCheck.reason ?? "Blocked: Sensitive file access",
-        source: "instant-block"
+        decision: "needs-review",
+        reason: `[${severityLabel}] ${fileCheck.reason}`,
+        source: "high-risk",
+        userMessage: `[${severityLabel}] ${fileCheck.reason}
+
+Potential risk: ${fileCheck.risk}${legitimateUsesText}
+
+Only proceed if you know what you're doing.`
       };
     }
     return {
@@ -1360,12 +1791,20 @@ async function processPermissionRequest(input, anthropicClient) {
       source: "instant-allow"
     };
   }
-  const blockResult = checkInstantBlock(command);
-  if (blockResult.blocked) {
+  const highRisk = checkHighRiskPatterns(command);
+  if (highRisk.detected) {
+    const severityLabel = highRisk.severity === "critical" ? "HIGH RISK" : "CAUTION";
+    const legitimateUsesText = highRisk.legitimateUses?.length ? `
+Common uses: ${highRisk.legitimateUses.join(", ")}` : "";
     return {
-      decision: "deny",
-      reason: blockResult.reason ?? "Blocked by instant block",
-      source: "instant-block"
+      decision: "needs-review",
+      reason: `[${severityLabel}] ${highRisk.description}`,
+      source: "high-risk",
+      userMessage: `[${severityLabel}] ${highRisk.description}
+
+Potential risk: ${highRisk.risk}${legitimateUsesText}
+
+Only proceed if you know what you're doing.`
     };
   }
   const checkpoint = detectCheckpoint(command);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vibesafu",
-  "version": "0.1.3",
+  "version": "0.1.6",
   "description": "Claude Code Security Guard - Permission request interceptor with LLM-powered security analysis",
   "type": "module",
   "main": "dist/index.js",