vigile-scan 2.1.0 → 3.0.0

package/dist/index.js

@@ -31,7 +31,7 @@ var require_package = __commonJS({
   "package.json"(exports2, module2) {
     module2.exports = {
       name: "vigile-scan",
-      version: "2.1.0",
+      version: "3.0.0",
       description: "Security scanner for AI agent tools \u2014 detect tool poisoning, permission abuse, and supply chain attacks in MCP servers and agent skills",
       main: "dist/index.js",
       bin: {
@@ -1277,13 +1277,61 @@ var SKILL_EXFILTRATION_PATTERNS = [
     recommendation: "Review why this skill needs access to all environment variables."
   }
 ];
+var LOCATION_PATTERNS = [
+  {
+    id: "SK-060",
+    category: "location-privacy",
+    severity: "high",
+    title: "Browser geolocation access",
+    pattern: /(?:navigator\s*\.\s*geolocation|getCurrentPosition|watchPosition|GeolocationPosition|geolocation\s*\.\s*(?:get|watch|clear))/i,
+    description: "Skill accesses browser geolocation API, which reveals the user's precise physical location.",
+    recommendation: "Verify this skill genuinely needs location data. Geolocation exposes latitude/longitude \u2014 high privacy risk if exfiltrated."
+  },
+  {
+    id: "SK-061",
+    category: "location-privacy",
+    severity: "high",
+    title: "Mobile/native geolocation library",
+    pattern: /(?:@react-native-community\/geolocation|expo-location|react-native-geolocation|Geolocation\.requestAuthorization|CLLocationManager|LocationManager|FusedLocationProvider|ACCESS_FINE_LOCATION|ACCESS_COARSE_LOCATION|requestLocationPermission)/i,
+    description: "Skill uses a native mobile geolocation library to access device GPS coordinates.",
+    recommendation: "Mobile location APIs provide high-precision GPS data. Ensure this skill has a legitimate need for physical location and does not transmit it externally."
+  },
+  {
+    id: "SK-062",
+    category: "location-privacy",
+    severity: "critical",
+    title: "Location data exfiltration",
+    pattern: /(?:(?:send|post|upload|transmit|exfiltrate|forward|share|log|track|record)\s+(?:the\s+)?(?:user(?:'s)?\s+)?(?:location|coordinates?|gps|lat(?:itude)?|lng|lon(?:gitude)?|geo(?:location)?|position|whereabouts))|(?:(?:location|coordinates?|gps|lat(?:itude)?|lng|lon(?:gitude)?|geo(?:location)?|position)\s+(?:to|via|through|using)\s+(?:https?|api|endpoint|server|webhook|url))/i,
+    description: "Skill instructs the agent to send location data to an external endpoint. This is a location exfiltration pattern.",
+    recommendation: "CRITICAL: Do NOT install. This skill attempts to exfiltrate physical location data \u2014 a severe privacy violation."
+  },
+  {
+    id: "SK-063",
+    category: "location-privacy",
+    severity: "medium",
+    title: "IP-based geolocation lookup",
+    pattern: /(?:ip-api\.com|ipinfo\.io|ipgeolocation|ip2location|geoip|maxmind|freegeoip|geolite|ip\s*(?:to|2)\s*(?:geo|location))|(?:(?:get|fetch|lookup|resolve)\s+(?:the\s+)?(?:user(?:'s)?\s+)?(?:location|city|country|region|timezone)\s+(?:from|via|using)\s+(?:ip|IP))/i,
+    description: "Skill performs IP-based geolocation to approximate the user's physical location without explicit GPS access.",
+    recommendation: "IP geolocation bypasses browser permission prompts. Verify this skill needs approximate location and isn't using it to fingerprint or track users."
+  },
+  {
+    id: "SK-064",
+    category: "location-privacy",
+    severity: "medium",
+    title: "Geofencing or location boundary check",
+    pattern: /(?:geofenc(?:e|ing)|location\s*(?:boundary|fence|perimeter|zone|radius|range)|within\s+(?:\d+\s*)?(?:meters?|miles?|km|kilometers?)\s+of|haversine|vincenty|h3\s*(?:cell|index|resolution|boundary)|(?:enter|exit|cross)(?:ing|ed)?\s+(?:the\s+)?(?:geo)?fence)/i,
+    description: "Skill implements geofencing or location boundary detection, which requires continuous location monitoring.",
+    recommendation: "Geofencing requires persistent location tracking. Review whether the boundary checks are appropriate and data isn't being logged or exfiltrated."
+  }
+];
 var ALL_SKILL_PATTERNS = [
   ...INSTRUCTION_INJECTION_PATTERNS,
   ...MALWARE_DELIVERY_PATTERNS,
   ...STEALTH_PATTERNS,
   ...SAFETY_BYPASS_PATTERNS,
   ...PERSISTENCE_PATTERNS,
-  ...SKILL_EXFILTRATION_PATTERNS
+  ...SKILL_EXFILTRATION_PATTERNS,
+  ...LOCATION_PATTERNS
 ];
 
 // src/scanner/skill-scanner.ts