vigile-scan 0.2.6 → 3.0.0

package/README.md

@@ -160,15 +160,15 @@ When you run `--sentinel`, Vigile intercepts outbound network traffic from your
 - **DNS tunneling** — data exfiltration hidden in DNS queries
 - **Unexpected destinations** — connections to IPs/domains outside the expected set
 
-Sentinel is available on Pro ($9.99/mo) and Pro+ ($29.99/mo) plans. Free users can run static scans with no limits.
+Sentinel is available on Pro ($29/mo) and Pro+ ($99/mo) plans. Free users can run static scans with no limits.
 
 ## Pricing
 
 | Tier | Price | Highlights |
 |------|-------|------------|
 | Free | $0/forever | Unlimited CLI scans, 50 API scans/month, registry browsing |
-| Pro | $9.99/mo | Sentinel monitoring (5 min, 3 servers), 1,000 API scans |
-| Pro+ | $29.99/mo | Sentinel (30 min, 10 servers), DNS tunneling & C2 detection, alerts |
+| Pro | $29/mo | Sentinel monitoring (5 min, 3 servers), 1,000 API scans |
+| Pro+ | $99/mo | Sentinel (30 min, 10 servers), DNS tunneling & C2 detection, alerts |
 
 ## Links
 

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "vigile-scan",
-      version: "0.2.6",
+      version: "3.0.0",
       description: "Security scanner for AI agent tools \u2014 detect tool poisoning, permission abuse, and supply chain attacks in MCP servers and agent skills",
       main: "dist/index.js",
       bin: {
@@ -1277,13 +1277,61 @@ var SKILL_EXFILTRATION_PATTERNS = [
     recommendation: "Review why this skill needs access to all environment variables."
   }
 ];
+var LOCATION_PATTERNS = [
+  {
+    id: "SK-060",
+    category: "location-privacy",
+    severity: "high",
+    title: "Browser geolocation access",
+    pattern: /(?:navigator\s*\.\s*geolocation|getCurrentPosition|watchPosition|GeolocationPosition|geolocation\s*\.\s*(?:get|watch|clear))/i,
+    description: "Skill accesses browser geolocation API, which reveals the user's precise physical location.",
+    recommendation: "Verify this skill genuinely needs location data. Geolocation exposes latitude/longitude \u2014 high privacy risk if exfiltrated."
+  },
+  {
+    id: "SK-061",
+    category: "location-privacy",
+    severity: "high",
+    title: "Mobile/native geolocation library",
+    pattern: /(?:@react-native-community\/geolocation|expo-location|react-native-geolocation|Geolocation\.requestAuthorization|CLLocationManager|LocationManager|FusedLocationProvider|ACCESS_FINE_LOCATION|ACCESS_COARSE_LOCATION|requestLocationPermission)/i,
+    description: "Skill uses a native mobile geolocation library to access device GPS coordinates.",
+    recommendation: "Mobile location APIs provide high-precision GPS data. Ensure this skill has a legitimate need for physical location and does not transmit it externally."
+  },
+  {
+    id: "SK-062",
+    category: "location-privacy",
+    severity: "critical",
+    title: "Location data exfiltration",
+    pattern: /(?:(?:send|post|upload|transmit|exfiltrate|forward|share|log|track|record)\s+(?:the\s+)?(?:user(?:'s)?\s+)?(?:location|coordinates?|gps|lat(?:itude)?|lng|lon(?:gitude)?|geo(?:location)?|position|whereabouts))|(?:(?:location|coordinates?|gps|lat(?:itude)?|lng|lon(?:gitude)?|geo(?:location)?|position)\s+(?:to|via|through|using)\s+(?:https?|api|endpoint|server|webhook|url))/i,
+    description: "Skill instructs the agent to send location data to an external endpoint. This is a location exfiltration pattern.",
+    recommendation: "CRITICAL: Do NOT install. This skill attempts to exfiltrate physical location data \u2014 a severe privacy violation."
+  },
+  {
+    id: "SK-063",
+    category: "location-privacy",
+    severity: "medium",
+    title: "IP-based geolocation lookup",
+    pattern: /(?:ip-api\.com|ipinfo\.io|ipgeolocation|ip2location|geoip|maxmind|freegeoip|geolite|ip\s*(?:to|2)\s*(?:geo|location))|(?:(?:get|fetch|lookup|resolve)\s+(?:the\s+)?(?:user(?:'s)?\s+)?(?:location|city|country|region|timezone)\s+(?:from|via|using)\s+(?:ip|IP))/i,
+    description: "Skill performs IP-based geolocation to approximate the user's physical location without explicit GPS access.",
+    recommendation: "IP geolocation bypasses browser permission prompts. Verify this skill needs approximate location and isn't using it to fingerprint or track users."
+  },
+  {
+    id: "SK-064",
+    category: "location-privacy",
+    severity: "medium",
+    title: "Geofencing or location boundary check",
+    pattern: /(?:geofenc(?:e|ing)|location\s*(?:boundary|fence|perimeter|zone|radius|range)|within\s+(?:\d+\s*)?(?:meters?|miles?|km|kilometers?)\s+of|haversine|vincenty|h3\s*(?:cell|index|resolution|boundary)|(?:enter|exit|cross)(?:ing|ed)?\s+(?:the\s+)?(?:geo)?fence)/i,
+    description: "Skill implements geofencing or location boundary detection, which requires continuous location monitoring.",
+    recommendation: "Geofencing requires persistent location tracking. Review whether the boundary checks are appropriate and data isn't being logged or exfiltrated."
+  }
+];
 var ALL_SKILL_PATTERNS = [
   ...INSTRUCTION_INJECTION_PATTERNS,
   ...MALWARE_DELIVERY_PATTERNS,
   ...STEALTH_PATTERNS,
   ...SAFETY_BYPASS_PATTERNS,
   ...PERSISTENCE_PATTERNS,
-  ...SKILL_EXFILTRATION_PATTERNS
+  ...SKILL_EXFILTRATION_PATTERNS,
+  ...LOCATION_PATTERNS
 ];
 
 // src/scanner/skill-scanner.ts
@@ -2435,8 +2483,8 @@ function printSentinelUpgrade() {
   console.log(import_chalk.default.yellow(`  \u26A1 Sentinel is a Pro feature. Upgrade to unlock runtime monitoring:`));
   console.log(import_chalk.default.cyan(`     https://vigile.dev/pricing`));
   console.log("");
-  console.log(import_chalk.default.gray(`  Pro ($9.99/mo)     \u2014 5-min sessions, 3 servers, behavioral detection`));
-  console.log(import_chalk.default.gray(`  Pro+ ($29.99/mo)   \u2014 30-min sessions, 10 servers, DNS tunneling & C2 detection`));
+  console.log(import_chalk.default.gray(`  Pro ($29/mo)        \u2014 5-min sessions, 3 servers, behavioral detection`));
+  console.log(import_chalk.default.gray(`  Pro+ ($99/mo)      \u2014 30-min sessions, 10 servers, DNS tunneling & C2 detection`));
   console.log("");
 }
 function printAuthStatus(info) {