cisco-ai-skill-scanner 1.0.1__py3-none-any.whl → 1.0.2__py3-none-any.whl
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- {cisco_ai_skill_scanner-1.0.1.dist-info → cisco_ai_skill_scanner-1.0.2.dist-info}/METADATA +16 -1
- {cisco_ai_skill_scanner-1.0.1.dist-info → cisco_ai_skill_scanner-1.0.2.dist-info}/RECORD +37 -35
- skill_scanner/_version.py +2 -2
- skill_scanner/api/api_cli.py +2 -2
- skill_scanner/api/api_server.py +1 -1
- skill_scanner/cli/cli.py +60 -2
- skill_scanner/config/yara_modes.py +314 -0
- skill_scanner/core/analyzers/llm_analyzer.py +3 -3
- skill_scanner/core/analyzers/meta_analyzer.py +50 -18
- skill_scanner/core/analyzers/static.py +177 -27
- skill_scanner/core/models.py +1 -0
- skill_scanner/core/reporters/markdown_reporter.py +9 -3
- skill_scanner/core/static_analysis/context_extractor.py +87 -13
- skill_scanner/data/prompts/code_alignment_threat_analysis_prompt.md +103 -28
- skill_scanner/data/prompts/llm_response_schema.json +3 -3
- skill_scanner/data/prompts/skill_meta_analysis_prompt.md +10 -9
- skill_scanner/data/prompts/skill_threat_analysis_prompt.md +42 -6
- skill_scanner/data/rules/signatures.yaml +141 -35
- skill_scanner/data/yara_rules/autonomy_abuse_generic.yara +66 -0
- skill_scanner/data/yara_rules/{skill_discovery_abuse.yara → capability_inflation_generic.yara} +7 -4
- skill_scanner/data/yara_rules/code_execution_generic.yara +76 -0
- skill_scanner/data/yara_rules/{coercive_injection.yara → coercive_injection_generic.yara} +2 -2
- skill_scanner/data/yara_rules/command_injection_generic.yara +77 -0
- skill_scanner/data/yara_rules/{credential_harvesting.yara → credential_harvesting_generic.yara} +25 -4
- skill_scanner/data/yara_rules/{transitive_trust_abuse.yara → indirect_prompt_injection_generic.yara} +8 -5
- skill_scanner/data/yara_rules/{prompt_injection.yara → prompt_injection_generic.yara} +2 -2
- skill_scanner/data/yara_rules/{unicode_steganography.yara → prompt_injection_unicode_steganography.yara} +23 -17
- skill_scanner/data/yara_rules/script_injection_generic.yara +82 -0
- skill_scanner/data/yara_rules/{sql_injection.yara → sql_injection_generic.yara} +22 -8
- skill_scanner/data/yara_rules/system_manipulation_generic.yara +79 -0
- skill_scanner/data/yara_rules/tool_chaining_abuse_generic.yara +72 -0
- skill_scanner/threats/__init__.py +24 -2
- skill_scanner/threats/cisco_ai_taxonomy.py +274 -0
- skill_scanner/threats/threats.py +28 -99
- skill_scanner/data/yara_rules/autonomy_abuse.yara +0 -66
- skill_scanner/data/yara_rules/code_execution.yara +0 -61
- skill_scanner/data/yara_rules/command_injection.yara +0 -54
- skill_scanner/data/yara_rules/script_injection.yara +0 -83
- skill_scanner/data/yara_rules/system_manipulation.yara +0 -65
- skill_scanner/data/yara_rules/tool_chaining_abuse.yara +0 -60
- {cisco_ai_skill_scanner-1.0.1.dist-info → cisco_ai_skill_scanner-1.0.2.dist-info}/WHEEL +0 -0
- {cisco_ai_skill_scanner-1.0.1.dist-info → cisco_ai_skill_scanner-1.0.2.dist-info}/entry_points.txt +0 -0
- {cisco_ai_skill_scanner-1.0.1.dist-info → cisco_ai_skill_scanner-1.0.2.dist-info}/licenses/LICENSE +0 -0
|
@@ -0,0 +1,72 @@
|
|
|
1
|
+
//////////////////////////////////////////
|
|
2
|
+
// Tool Chaining Abuse Detection
|
|
3
|
+
// Target: Data exfiltration through tool chains
|
|
4
|
+
// Very specific patterns to minimize FPs
|
|
5
|
+
//////////////////////////////////////////
|
|
6
|
+
|
|
7
|
+
rule tool_chaining_abuse_generic{
|
|
8
|
+
|
|
9
|
+
meta:
|
|
10
|
+
author = "Cisco"
|
|
11
|
+
description = "Detects suspicious tool chaining patterns that could lead to data exfiltration"
|
|
12
|
+
classification = "harmful"
|
|
13
|
+
threat_type = "TOOL CHAINING ABUSE"
|
|
14
|
+
|
|
15
|
+
strings:
|
|
16
|
+
|
|
17
|
+
// === High confidence: explicit exfil to known bad destinations ===
|
|
18
|
+
|
|
19
|
+
// Send to known exfil destinations
|
|
20
|
+
$exfil_discord = /\b(send|post|upload)[^.]{0,60}discord\.com\/api\/webhooks/i
|
|
21
|
+
$exfil_telegram = /\b(send|post|upload)[^.]{0,60}telegram\.org\/bot/i
|
|
22
|
+
$exfil_pastebin = /\b(send|post|upload)[^.]{0,60}pastebin\.com/i
|
|
23
|
+
$exfil_requestbin = /\b(send|post|upload)[^.]{0,60}(webhook\.site|requestbin|ngrok\.io)/i
|
|
24
|
+
|
|
25
|
+
// === High confidence: credential file access + network ===
|
|
26
|
+
|
|
27
|
+
// SSH key file + network send (on same line)
|
|
28
|
+
$ssh_key_exfil = /\.ssh\/(id_rsa|id_ed25519|id_dsa)[^.]{0,80}\b(send|post|upload|requests|fetch|curl|wget)\b/i
|
|
29
|
+
|
|
30
|
+
// AWS credentials file + network
|
|
31
|
+
$aws_cred_exfil = /\.aws\/credentials[^.]{0,80}\b(send|post|upload|requests|fetch)\b/i
|
|
32
|
+
|
|
33
|
+
// .env file + network
|
|
34
|
+
$env_file_exfil = /\b(read|open|load)[^.]{0,30}\.env[^.]{0,80}\b(send|post|upload|requests)\b/i
|
|
35
|
+
|
|
36
|
+
// === High confidence: explicit exfil language ===
|
|
37
|
+
|
|
38
|
+
// Explicit exfiltration keywords
|
|
39
|
+
$explicit_exfil = /\b(exfiltrate|steal|harvest|siphon)\s+(the\s+)?(data|files?|credentials?|secrets?|keys?)/i
|
|
40
|
+
|
|
41
|
+
// Send to attacker-controlled destination
|
|
42
|
+
$attacker_dest = /\b(send|forward|upload)\s+(to|data\s+to)\s+(attacker|malicious|c2|command[_-]?and[_-]?control)/i
|
|
43
|
+
|
|
44
|
+
// === High confidence: env var exfil ===
|
|
45
|
+
|
|
46
|
+
// Read secret env var then send to network
|
|
47
|
+
$env_var_exfil = /\b(os\.environ|getenv|process\.env)[^.]{0,30}(SECRET|PRIVATE|KEY|TOKEN|PASSWORD|CREDENTIAL)[^.]{0,100}\b(requests\.(post|get)|urllib|fetch|curl|wget)\b/i
|
|
48
|
+
|
|
49
|
+
// === Exclusions ===
|
|
50
|
+
$security_docs = /\b(MITRE|ATT&CK|threat\s+(model|hunt)|detection\s+rule)/i
|
|
51
|
+
$auth_code = /\b(login|authenticate|signIn|logIn)\s*\(/i
|
|
52
|
+
|
|
53
|
+
condition:
|
|
54
|
+
not $security_docs and
|
|
55
|
+
not $auth_code and
|
|
56
|
+
(
|
|
57
|
+
// Exfil to known bad destinations
|
|
58
|
+
$exfil_discord or
|
|
59
|
+
$exfil_telegram or
|
|
60
|
+
$exfil_pastebin or
|
|
61
|
+
$exfil_requestbin or
|
|
62
|
+
// Credential file exfil
|
|
63
|
+
$ssh_key_exfil or
|
|
64
|
+
$aws_cred_exfil or
|
|
65
|
+
$env_file_exfil or
|
|
66
|
+
// Explicit exfil language
|
|
67
|
+
$explicit_exfil or
|
|
68
|
+
$attacker_dest or
|
|
69
|
+
// Env var exfil
|
|
70
|
+
$env_var_exfil
|
|
71
|
+
)
|
|
72
|
+
}
|
|
@@ -17,9 +17,31 @@
|
|
|
17
17
|
"""
|
|
18
18
|
Threat mapping and taxonomy for Skill Scanner.
|
|
19
19
|
|
|
20
|
-
Aligned with
|
|
20
|
+
Aligned with Cisco AI Security Framework taxonomy.
|
|
21
21
|
"""
|
|
22
22
|
|
|
23
|
+
from .cisco_ai_taxonomy import (
|
|
24
|
+
AISUBTECH_TAXONOMY,
|
|
25
|
+
AITECH_TAXONOMY,
|
|
26
|
+
VALID_AISUBTECH_CODES,
|
|
27
|
+
VALID_AITECH_CODES,
|
|
28
|
+
get_aisubtech_name,
|
|
29
|
+
get_aitech_name,
|
|
30
|
+
is_valid_aisubtech,
|
|
31
|
+
is_valid_aitech,
|
|
32
|
+
)
|
|
23
33
|
from .threats import LLM_THREAT_MAPPING, YARA_THREAT_MAPPING, ThreatMapping
|
|
24
34
|
|
|
25
|
-
__all__ = [
|
|
35
|
+
__all__ = [
|
|
36
|
+
"ThreatMapping",
|
|
37
|
+
"LLM_THREAT_MAPPING",
|
|
38
|
+
"YARA_THREAT_MAPPING",
|
|
39
|
+
"AITECH_TAXONOMY",
|
|
40
|
+
"AISUBTECH_TAXONOMY",
|
|
41
|
+
"VALID_AITECH_CODES",
|
|
42
|
+
"VALID_AISUBTECH_CODES",
|
|
43
|
+
"is_valid_aitech",
|
|
44
|
+
"is_valid_aisubtech",
|
|
45
|
+
"get_aitech_name",
|
|
46
|
+
"get_aisubtech_name",
|
|
47
|
+
]
|
|
@@ -0,0 +1,274 @@
|
|
|
1
|
+
# Copyright 2026 Cisco Systems, Inc.
|
|
2
|
+
#
|
|
3
|
+
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
4
|
+
# you may not use this file except in compliance with the License.
|
|
5
|
+
# You may obtain a copy of the License at
|
|
6
|
+
#
|
|
7
|
+
# http://www.apache.org/licenses/LICENSE-2.0
|
|
8
|
+
#
|
|
9
|
+
# Unless required by applicable law or agreed to in writing, software
|
|
10
|
+
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
11
|
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
12
|
+
# See the License for the specific language governing permissions and
|
|
13
|
+
# limitations under the License.
|
|
14
|
+
#
|
|
15
|
+
# SPDX-License-Identifier: Apache-2.0
|
|
16
|
+
|
|
17
|
+
"""
|
|
18
|
+
Cisco AI Security Framework - Ground Truth Taxonomy.
|
|
19
|
+
|
|
20
|
+
Source: https://learn-cloudsecurity.cisco.com/ai-security-framework
|
|
21
|
+
Owner: Ankit Garg
|
|
22
|
+
Last Updated: 2026-02-02
|
|
23
|
+
|
|
24
|
+
This file contains the authoritative AITech and AISubtech codes from the
|
|
25
|
+
Cisco Integrated AI Security and Safety Framework. All threat mappings in
|
|
26
|
+
threats.py must use codes that exist in this taxonomy.
|
|
27
|
+
|
|
28
|
+
To update this file when the framework changes:
|
|
29
|
+
1. Export data from https://learn-cloudsecurity.cisco.com/ai-security-framework
|
|
30
|
+
2. Update the dictionaries below
|
|
31
|
+
3. Run tests to validate threats.py alignment
|
|
32
|
+
"""
|
|
33
|
+
|
|
34
|
+
# Valid AITech codes and their official names
|
|
35
|
+
AITECH_TAXONOMY: dict[str, str] = {
|
|
36
|
+
# OB-001: Goal Hijacking
|
|
37
|
+
"AITech-1.1": "Direct Prompt Injection",
|
|
38
|
+
"AITech-1.2": "Indirect Prompt Injection",
|
|
39
|
+
"AITech-1.3": "Goal Manipulation",
|
|
40
|
+
"AITech-1.4": "Multi-Modal Injection and Manipulation",
|
|
41
|
+
# OB-002: Jailbreak
|
|
42
|
+
"AITech-2.1": "Jailbreak",
|
|
43
|
+
# OB-003: Masquerading / Obfuscation / Impersonation
|
|
44
|
+
"AITech-3.1": "Masquerading / Obfuscation / Impersonation",
|
|
45
|
+
# OB-004: Communication Compromise
|
|
46
|
+
"AITech-4.1": "Agent Injection",
|
|
47
|
+
"AITech-4.2": "Context Boundary Attacks",
|
|
48
|
+
"AITech-4.3": "Protocol Manipulation",
|
|
49
|
+
# OB-005: Persistence
|
|
50
|
+
"AITech-5.1": "Memory System Persistence",
|
|
51
|
+
"AITech-5.2": "Configuration Persistence",
|
|
52
|
+
# OB-006: Feedback Loop Manipulation
|
|
53
|
+
"AITech-6.1": "Training Data Poisoning",
|
|
54
|
+
# OB-007: Sabotage / Integrity Degradation
|
|
55
|
+
"AITech-7.1": "Reasoning Corruption",
|
|
56
|
+
"AITech-7.2": "Memory System Corruption",
|
|
57
|
+
"AITech-7.3": "Data Source Abuse and Manipulation",
|
|
58
|
+
"AITech-7.4": "Token Manipulation",
|
|
59
|
+
# OB-008: Data Privacy Violations
|
|
60
|
+
"AITech-8.1": "Membership Inference",
|
|
61
|
+
"AITech-8.2": "Data Exfiltration / Exposure",
|
|
62
|
+
"AITech-8.3": "Information Disclosure",
|
|
63
|
+
"AITech-8.4": "Prompt/Meta Extraction",
|
|
64
|
+
# OB-009: Supply Chain Compromise
|
|
65
|
+
"AITech-9.1": "Model or Agentic System Manipulation",
|
|
66
|
+
"AITech-9.2": "Detection Evasion",
|
|
67
|
+
"AITech-9.3": "Dependency / Plugin Compromise",
|
|
68
|
+
# OB-010: Model Theft / Extraction
|
|
69
|
+
"AITech-10.1": "Model Extraction",
|
|
70
|
+
"AITech-10.2": "Model Inversion",
|
|
71
|
+
# OB-011: Adversarial Evasion
|
|
72
|
+
"AITech-11.1": "Environment-Aware Evasion",
|
|
73
|
+
"AITech-11.2": "Model-Selective Evasion",
|
|
74
|
+
# OB-012: Action-Space and Integration Abuse
|
|
75
|
+
"AITech-12.1": "Tool Exploitation",
|
|
76
|
+
"AITech-12.2": "Insecure Output Handling",
|
|
77
|
+
# OB-013: Availability Abuse
|
|
78
|
+
"AITech-13.1": "Disruption of Availability",
|
|
79
|
+
"AITech-13.2": "Cost Harvesting / Repurposing",
|
|
80
|
+
# OB-014: Privilege Compromise
|
|
81
|
+
"AITech-14.1": "Unauthorized Access",
|
|
82
|
+
"AITech-14.2": "Abuse of Delegated Authority",
|
|
83
|
+
# OB-015: Harmful / Misleading / Inaccurate Content
|
|
84
|
+
"AITech-15.1": "Harmful Content",
|
|
85
|
+
# OB-016: Surveillance
|
|
86
|
+
"AITech-16.1": "Eavesdropping",
|
|
87
|
+
# OB-017: Cyber-Physical / Sensor Attacks
|
|
88
|
+
"AITech-17.1": "Sensor Spoofing",
|
|
89
|
+
# OB-018: System Misuse / Malicious Application
|
|
90
|
+
"AITech-18.1": "Fraudulent Use",
|
|
91
|
+
"AITech-18.2": "Malicious Workflows",
|
|
92
|
+
# OB-019: Multi-Modal / Cross-Modal Risks
|
|
93
|
+
"AITech-19.1": "Cross-Modal Inconsistency Exploits",
|
|
94
|
+
"AITech-19.2": "Fusion Payload Split",
|
|
95
|
+
}
|
|
96
|
+
|
|
97
|
+
# Valid AISubtech codes and their official names
|
|
98
|
+
AISUBTECH_TAXONOMY: dict[str, str] = {
|
|
99
|
+
# AITech-1.1: Direct Prompt Injection
|
|
100
|
+
"AISubtech-1.1.1": "Instruction Manipulation (Direct Prompt Injection)",
|
|
101
|
+
"AISubtech-1.1.2": "Obfuscation (Direct Prompt Injection)",
|
|
102
|
+
"AISubtech-1.1.3": "Multi-Agent Prompt Injection",
|
|
103
|
+
# AITech-1.2: Indirect Prompt Injection
|
|
104
|
+
"AISubtech-1.2.1": "Instruction Manipulation (Indirect Prompt Injection)",
|
|
105
|
+
"AISubtech-1.2.2": "Obfuscation (Indirect Prompt Injection)",
|
|
106
|
+
"AISubtech-1.2.3": "Multi-Agent (Indirect Prompt Injection)",
|
|
107
|
+
# AITech-1.3: Goal Manipulation
|
|
108
|
+
"AISubtech-1.3.1": "Goal Manipulation (Models, Agents)",
|
|
109
|
+
"AISubtech-1.3.2": "Goal Manipulation (Tools, Prompts, Resources)",
|
|
110
|
+
# AITech-1.4: Multi-Modal Injection
|
|
111
|
+
"AISubtech-1.4.1": "Image-Text Injection",
|
|
112
|
+
"AISubtech-1.4.2": "Image Manipulation",
|
|
113
|
+
"AISubtech-1.4.3": "Audio Command Injection",
|
|
114
|
+
"AISubtech-1.4.4": "Video Overlay Manipulation",
|
|
115
|
+
# AITech-2.1: Jailbreak
|
|
116
|
+
"AISubtech-2.1.1": "Context Manipulation (Jailbreak)",
|
|
117
|
+
"AISubtech-2.1.2": "Obfuscation (Jailbreak)",
|
|
118
|
+
"AISubtech-2.1.3": "Semantic Manipulation (Jailbreak)",
|
|
119
|
+
"AISubtech-2.1.4": "Token Exploitation (Jailbreak)",
|
|
120
|
+
"AISubtech-2.1.5": "Multi-Agent Jailbreak Collaboration",
|
|
121
|
+
# AITech-3.1: Masquerading
|
|
122
|
+
"AISubtech-3.1.1": "Identity Obfuscation",
|
|
123
|
+
"AISubtech-3.1.2": "Trusted Agent Spoofing",
|
|
124
|
+
# AITech-4.1: Agent Injection
|
|
125
|
+
"AISubtech-4.1.1": "Rogue Agent Introduction",
|
|
126
|
+
# AITech-4.2: Context Boundary Attacks
|
|
127
|
+
"AISubtech-4.2.1": "Context Window Exploitation",
|
|
128
|
+
"AISubtech-4.2.2": "Session Boundary Violation",
|
|
129
|
+
# AITech-4.3: Protocol Manipulation
|
|
130
|
+
"AISubtech-4.3.1": "Schema Inconsistencies",
|
|
131
|
+
"AISubtech-4.3.2": "Namespace Collision",
|
|
132
|
+
"AISubtech-4.3.3": "Server Rebinding Attack",
|
|
133
|
+
"AISubtech-4.3.4": "Replay Exploitation",
|
|
134
|
+
"AISubtech-4.3.5": "Capability Inflation",
|
|
135
|
+
"AISubtech-4.3.6": "Cross-Origin Exploitation",
|
|
136
|
+
# AITech-5.1: Memory System Persistence
|
|
137
|
+
"AISubtech-5.1.1": "Long-term / Short-term Memory Injection",
|
|
138
|
+
# AITech-5.2: Configuration Persistence
|
|
139
|
+
"AISubtech-5.2.1": "Agent Profile Tampering",
|
|
140
|
+
# AITech-6.1: Training Data Poisoning
|
|
141
|
+
"AISubtech-6.1.1": "Knowledge Base Poisoning",
|
|
142
|
+
"AISubtech-6.1.2": "Reinforcement Biasing",
|
|
143
|
+
"AISubtech-6.1.3": "Reinforcement Signal Corruption",
|
|
144
|
+
# AITech-7.2: Memory System Corruption
|
|
145
|
+
"AISubtech-7.2.1": "Memory Anchor Attacks",
|
|
146
|
+
"AISubtech-7.2.2": "Memory Index Manipulation",
|
|
147
|
+
# AITech-7.3: Data Source Abuse
|
|
148
|
+
"AISubtech-7.3.1": "Corrupted Third-Party Data",
|
|
149
|
+
# AITech-7.4: Token Manipulation
|
|
150
|
+
"AISubtech-7.4.1": "Token Theft",
|
|
151
|
+
# AITech-8.1: Membership Inference
|
|
152
|
+
"AISubtech-8.1.1": "Presence Detection",
|
|
153
|
+
# AITech-8.2: Data Exfiltration / Exposure
|
|
154
|
+
"AISubtech-8.2.1": "Training Data Exposure",
|
|
155
|
+
"AISubtech-8.2.2": "LLM Data Leakage",
|
|
156
|
+
"AISubtech-8.2.3": "Data Exfiltration via Agent Tooling",
|
|
157
|
+
# AITech-8.3: Information Disclosure
|
|
158
|
+
"AISubtech-8.3.1": "Tool Metadata Exposure",
|
|
159
|
+
"AISubtech-8.3.2": "System Information Leakage",
|
|
160
|
+
# AITech-8.4: Prompt/Meta Extraction
|
|
161
|
+
"AISubtech-8.4.1": "System LLM Prompt Leakage",
|
|
162
|
+
# AITech-9.1: Model or Agentic System Manipulation
|
|
163
|
+
"AISubtech-9.1.1": "Code Execution",
|
|
164
|
+
"AISubtech-9.1.2": "Unauthorized or Unsolicited System Access",
|
|
165
|
+
"AISubtech-9.1.3": "Unauthorized or Unsolicited Network Access",
|
|
166
|
+
"AISubtech-9.1.4": "Injection Attacks (SQL, Command Execution, XSS)",
|
|
167
|
+
"AISubtech-9.1.5": "Template Injection (SSTI)",
|
|
168
|
+
# AITech-9.2: Detection Evasion
|
|
169
|
+
"AISubtech-9.2.1": "Obfuscation Vulnerabilities",
|
|
170
|
+
"AISubtech-9.2.2": "Backdoors and Trojans",
|
|
171
|
+
# AITech-9.3: Dependency / Plugin Compromise
|
|
172
|
+
"AISubtech-9.3.1": "Malicious Package / Tool Injection",
|
|
173
|
+
"AISubtech-9.3.2": "Dependency Name Squatting (Tools / Servers)",
|
|
174
|
+
"AISubtech-9.3.3": "Dependency Replacement / Rug Pull",
|
|
175
|
+
# AITech-10.1: Model Extraction
|
|
176
|
+
"AISubtech-10.1.1": "API Query Stealing",
|
|
177
|
+
"AISubtech-10.1.2": "Weight Reconstruction",
|
|
178
|
+
"AISubtech-10.1.3": "Sensitive Data Reconstruction",
|
|
179
|
+
# AITech-10.2: Model Inversion
|
|
180
|
+
"AISubtech-10.2.1": "Model Inversion",
|
|
181
|
+
# AITech-11.1: Environment-Aware Evasion
|
|
182
|
+
"AISubtech-11.1.1": "Agent-Specific Evasion",
|
|
183
|
+
"AISubtech-11.1.2": "Tool-Scoped Evasion",
|
|
184
|
+
"AISubtech-11.1.3": "Environment-Scoped Payloads",
|
|
185
|
+
"AISubtech-11.1.4": "Defense-Aware Payloads",
|
|
186
|
+
# AITech-11.2: Model-Selective Evasion
|
|
187
|
+
"AISubtech-11.2.1": "Targeted Model Fingerprinting",
|
|
188
|
+
"AISubtech-11.2.2": "Conditional Attack Execution",
|
|
189
|
+
# AITech-12.1: Tool Exploitation
|
|
190
|
+
"AISubtech-12.1.1": "Parameter Manipulation",
|
|
191
|
+
"AISubtech-12.1.2": "Tool Poisoning",
|
|
192
|
+
"AISubtech-12.1.3": "Unsafe System / Browser / File Execution",
|
|
193
|
+
"AISubtech-12.1.4": "Tool Shadowing",
|
|
194
|
+
# AITech-12.2: Insecure Output Handling
|
|
195
|
+
"AISubtech-12.2.1": "Code Detection / Malicious Code Output",
|
|
196
|
+
# AITech-13.1: Disruption of Availability
|
|
197
|
+
"AISubtech-13.1.1": "Compute Exhaustion",
|
|
198
|
+
"AISubtech-13.1.2": "Memory Flooding",
|
|
199
|
+
"AISubtech-13.1.3": "Model Denial of Service",
|
|
200
|
+
"AISubtech-13.1.4": "Application Denial of Service",
|
|
201
|
+
"AISubtech-13.1.5": "Decision Paralysis Attacks",
|
|
202
|
+
# AITech-13.2: Cost Harvesting
|
|
203
|
+
"AISubtech-13.2.1": "Service Misuse for Cost Inflation",
|
|
204
|
+
# AITech-14.1: Unauthorized Access
|
|
205
|
+
"AISubtech-14.1.1": "Credential Theft",
|
|
206
|
+
"AISubtech-14.1.2": "Insufficient Access Controls",
|
|
207
|
+
# AITech-14.2: Abuse of Delegated Authority
|
|
208
|
+
"AISubtech-14.2.1": "Permission Escalation via Delegation",
|
|
209
|
+
# AITech-15.1: Harmful Content (extensive sub-techniques)
|
|
210
|
+
"AISubtech-15.1.1": "Cybersecurity and Hacking: Malware / Exploits",
|
|
211
|
+
"AISubtech-15.1.2": "Cybersecurity and Hacking: Cyber Abuse",
|
|
212
|
+
"AISubtech-15.1.3": "Safety Harms and Toxicity: Animal Abuse",
|
|
213
|
+
"AISubtech-15.1.4": "Safety Harms and Toxicity: Child Abuse / Exploitation",
|
|
214
|
+
"AISubtech-15.1.5": "Safety Harms and Toxicity: Disinformation",
|
|
215
|
+
"AISubtech-15.1.6": "Safety Harms and Toxicity: Environmental Harm",
|
|
216
|
+
"AISubtech-15.1.7": "Safety Harms and Toxicity: Financial Harm",
|
|
217
|
+
"AISubtech-15.1.8": "Safety Harms and Toxicity: Harassment",
|
|
218
|
+
"AISubtech-15.1.9": "Safety Harms and Toxicity: Hate Speech",
|
|
219
|
+
"AISubtech-15.1.10": "Safety Harms and Toxicity: Non-Violent Crime",
|
|
220
|
+
"AISubtech-15.1.11": "Safety Harms and Toxicity: Profanity",
|
|
221
|
+
"AISubtech-15.1.12": "Safety Harms and Toxicity: Scams and Deception",
|
|
222
|
+
"AISubtech-15.1.13": "Safety Harms and Toxicity: Self Harm",
|
|
223
|
+
"AISubtech-15.1.14": "Safety Harms and Toxicity: Sexual Content and Exploitation",
|
|
224
|
+
"AISubtech-15.1.15": "Safety Harms and Toxicity: Social Division and Polarization",
|
|
225
|
+
"AISubtech-15.1.16": "Safety Harms and Toxicity: Terrorism / Extremism",
|
|
226
|
+
"AISubtech-15.1.17": "Safety Harms and Toxicity: Violence and Public Safety Threat",
|
|
227
|
+
"AISubtech-15.1.18": "Safety Harms and Toxicity: Weapons / CBRN Risks",
|
|
228
|
+
"AISubtech-15.1.19": "Integrity: Hallucinations / Misinformation",
|
|
229
|
+
"AISubtech-15.1.20": "Integrity: Unauthorized Financial Advice",
|
|
230
|
+
"AISubtech-15.1.21": "Integrity: Unauthorized Legal Advice",
|
|
231
|
+
"AISubtech-15.1.22": "Integrity: Unauthorized Medical Advice",
|
|
232
|
+
"AISubtech-15.1.23": "Intellectual Property Compromise: Intellectual Property Infringement",
|
|
233
|
+
"AISubtech-15.1.24": "Intellectual Property Compromise: Confidential Data",
|
|
234
|
+
"AISubtech-15.1.25": "Privacy Attacks: PII / PHI / PCI",
|
|
235
|
+
# AITech-16.1: Eavesdropping
|
|
236
|
+
"AISubtech-16.1.1": "Logging Sensitive Conversations",
|
|
237
|
+
# AITech-17.1: Sensor Spoofing
|
|
238
|
+
"AISubtech-17.1.1": "Sensor Spoofing: Action Signals (audio, visual)",
|
|
239
|
+
# AITech-18.1: Fraudulent Use
|
|
240
|
+
"AISubtech-18.1.1": "Spam / Scam / Social Engineering Generation",
|
|
241
|
+
# AITech-18.2: Malicious Workflows
|
|
242
|
+
"AISubtech-18.2.1": "Abuse of APIs for Mass Automation",
|
|
243
|
+
"AISubtech-18.2.2": "Dedicated Malicious Server or Infrastructure",
|
|
244
|
+
# AITech-19.1: Cross-Modal Inconsistency
|
|
245
|
+
"AISubtech-19.1.1": "Contradictory Inputs Attack",
|
|
246
|
+
"AISubtech-19.1.2": "Modality Skewing",
|
|
247
|
+
# AITech-19.2: Fusion Payload Split
|
|
248
|
+
"AISubtech-19.2.1": "Convergence Payload Injection",
|
|
249
|
+
"AISubtech-19.2.2": "Chained Payload Execution",
|
|
250
|
+
}
|
|
251
|
+
|
|
252
|
+
# Convenience sets for quick membership testing
|
|
253
|
+
VALID_AITECH_CODES: set[str] = set(AITECH_TAXONOMY.keys())
|
|
254
|
+
VALID_AISUBTECH_CODES: set[str] = set(AISUBTECH_TAXONOMY.keys())
|
|
255
|
+
|
|
256
|
+
|
|
257
|
+
def is_valid_aitech(code: str) -> bool:
|
|
258
|
+
"""Check if an AITech code exists in the official taxonomy."""
|
|
259
|
+
return code in VALID_AITECH_CODES
|
|
260
|
+
|
|
261
|
+
|
|
262
|
+
def is_valid_aisubtech(code: str) -> bool:
|
|
263
|
+
"""Check if an AISubtech code exists in the official taxonomy."""
|
|
264
|
+
return code in VALID_AISUBTECH_CODES
|
|
265
|
+
|
|
266
|
+
|
|
267
|
+
def get_aitech_name(code: str) -> str | None:
|
|
268
|
+
"""Get the official name for an AITech code."""
|
|
269
|
+
return AITECH_TAXONOMY.get(code)
|
|
270
|
+
|
|
271
|
+
|
|
272
|
+
def get_aisubtech_name(code: str) -> str | None:
|
|
273
|
+
"""Get the official name for an AISubtech code."""
|
|
274
|
+
return AISUBTECH_TAXONOMY.get(code)
|
skill_scanner/threats/threats.py
CHANGED
|
@@ -41,16 +41,6 @@ class ThreatMapping:
|
|
|
41
41
|
"description": "Explicit attempts to override, replace, or modify the model's system instructions, "
|
|
42
42
|
"operational directives, or behavioral guidelines through direct user input.",
|
|
43
43
|
},
|
|
44
|
-
"PROMPT_INJECTION": { # Underscore version
|
|
45
|
-
"scanner_category": "PROMPT INJECTION",
|
|
46
|
-
"severity": "HIGH",
|
|
47
|
-
"aitech": "AITech-1.1",
|
|
48
|
-
"aitech_name": "Direct Prompt Injection",
|
|
49
|
-
"aisubtech": "AISubtech-1.1.1",
|
|
50
|
-
"aisubtech_name": "Instruction Manipulation (Direct Prompt Injection)",
|
|
51
|
-
"description": "Explicit attempts to override, replace, or modify the model's system instructions, "
|
|
52
|
-
"operational directives, or behavioral guidelines through direct user input.",
|
|
53
|
-
},
|
|
54
44
|
"DATA EXFILTRATION": {
|
|
55
45
|
"scanner_category": "SECURITY VIOLATION",
|
|
56
46
|
"severity": "HIGH",
|
|
@@ -75,7 +65,7 @@ class ThreatMapping:
|
|
|
75
65
|
"severity": "HIGH",
|
|
76
66
|
"aitech": "AITech-12.1",
|
|
77
67
|
"aitech_name": "Tool Exploitation",
|
|
78
|
-
"aisubtech": "AISubtech-12.1.
|
|
68
|
+
"aisubtech": "AISubtech-12.1.4",
|
|
79
69
|
"aisubtech_name": "Tool Shadowing",
|
|
80
70
|
"description": "Disguising, substituting or duplicating legitimate tools within an agent, enabling malicious tools with identical or similar identifiers to intercept or replace trusted tool calls.",
|
|
81
71
|
},
|
|
@@ -92,15 +82,6 @@ class ThreatMapping:
|
|
|
92
82
|
|
|
93
83
|
# YARA/Static Analyzer Threats
|
|
94
84
|
YARA_THREATS = {
|
|
95
|
-
"PROMPT_INJECTION": { # Underscore version
|
|
96
|
-
"scanner_category": "PROMPT INJECTION",
|
|
97
|
-
"severity": "HIGH",
|
|
98
|
-
"aitech": "AITech-1.1",
|
|
99
|
-
"aitech_name": "Direct Prompt Injection",
|
|
100
|
-
"aisubtech": "AISubtech-1.1.1",
|
|
101
|
-
"aisubtech_name": "Instruction Manipulation (Direct Prompt Injection)",
|
|
102
|
-
"description": "Explicit attempts to override system instructions through direct input.",
|
|
103
|
-
},
|
|
104
85
|
"COMMAND INJECTION": {
|
|
105
86
|
"scanner_category": "INJECTION ATTACK",
|
|
106
87
|
"severity": "CRITICAL",
|
|
@@ -110,15 +91,6 @@ class ThreatMapping:
|
|
|
110
91
|
"aisubtech_name": "Injection Attacks (SQL, Command Execution, XSS)",
|
|
111
92
|
"description": "Injecting malicious command sequences leading to remote code execution.",
|
|
112
93
|
},
|
|
113
|
-
"COMMAND_INJECTION": { # Underscore version
|
|
114
|
-
"scanner_category": "INJECTION ATTACK",
|
|
115
|
-
"severity": "CRITICAL",
|
|
116
|
-
"aitech": "AITech-9.1",
|
|
117
|
-
"aitech_name": "Model or Agentic System Manipulation",
|
|
118
|
-
"aisubtech": "AISubtech-9.1.4",
|
|
119
|
-
"aisubtech_name": "Injection Attacks (SQL, Command Execution, XSS)",
|
|
120
|
-
"description": "Injecting malicious command sequences leading to remote code execution.",
|
|
121
|
-
},
|
|
122
94
|
"DATA EXFILTRATION": {
|
|
123
95
|
"scanner_category": "SECURITY VIOLATION",
|
|
124
96
|
"severity": "CRITICAL",
|
|
@@ -128,40 +100,31 @@ class ThreatMapping:
|
|
|
128
100
|
"aisubtech_name": "Data Exfiltration via Agent Tooling",
|
|
129
101
|
"description": "Unauthorized exposure or exfiltration of sensitive information.",
|
|
130
102
|
},
|
|
131
|
-
"DATA_EXFILTRATION": { # Underscore version
|
|
132
|
-
"scanner_category": "SECURITY VIOLATION",
|
|
133
|
-
"severity": "CRITICAL",
|
|
134
|
-
"aitech": "AITech-8.2",
|
|
135
|
-
"aitech_name": "Data Exfiltration / Exposure",
|
|
136
|
-
"aisubtech": "AISubtech-8.2.3",
|
|
137
|
-
"aisubtech_name": "Data Exfiltration via Agent Tooling",
|
|
138
|
-
"description": "Unauthorized exposure or exfiltration of sensitive information.",
|
|
139
|
-
},
|
|
140
103
|
"SKILL DISCOVERY ABUSE": {
|
|
141
|
-
"scanner_category": "
|
|
104
|
+
"scanner_category": "PROTOCOL MANIPULATION",
|
|
142
105
|
"severity": "MEDIUM",
|
|
143
|
-
"aitech": "AITech-
|
|
144
|
-
"aitech_name": "
|
|
145
|
-
"aisubtech":
|
|
146
|
-
"aisubtech_name":
|
|
147
|
-
"description": "Manipulation of skill discovery to increase unwanted activation (keyword baiting, over-broad descriptions, impersonation).",
|
|
106
|
+
"aitech": "AITech-4.3",
|
|
107
|
+
"aitech_name": "Protocol Manipulation",
|
|
108
|
+
"aisubtech": "AISubtech-4.3.5",
|
|
109
|
+
"aisubtech_name": "Capability Inflation",
|
|
110
|
+
"description": "Manipulation of skill discovery mechanisms to inflate perceived capabilities and increase unwanted activation (keyword baiting, over-broad descriptions, brand impersonation).",
|
|
148
111
|
},
|
|
149
112
|
"TRANSITIVE TRUST ABUSE": {
|
|
150
113
|
"scanner_category": "PROMPT INJECTION",
|
|
151
114
|
"severity": "HIGH",
|
|
152
|
-
"aitech": "AITech-1.2",
|
|
115
|
+
"aitech": "AITech-1.2",
|
|
153
116
|
"aitech_name": "Indirect Prompt Injection",
|
|
154
|
-
"aisubtech":
|
|
155
|
-
"aisubtech_name":
|
|
156
|
-
"description": "
|
|
117
|
+
"aisubtech": "AISubtech-1.2.1",
|
|
118
|
+
"aisubtech_name": "Instruction Manipulation (Indirect Prompt Injection)",
|
|
119
|
+
"description": "Embedding malicious instructions in external data sources (webpages, documents, APIs) that override intended behavior - following external instructions, executing found code blocks.",
|
|
157
120
|
},
|
|
158
121
|
"AUTONOMY ABUSE": {
|
|
159
122
|
"scanner_category": "RESOURCE ABUSE",
|
|
160
123
|
"severity": "HIGH",
|
|
161
|
-
"aitech": "AITech-
|
|
162
|
-
"aitech_name": "
|
|
163
|
-
"aisubtech":
|
|
164
|
-
"aisubtech_name":
|
|
124
|
+
"aitech": "AITech-13.1",
|
|
125
|
+
"aitech_name": "Disruption of Availability",
|
|
126
|
+
"aisubtech": "AISubtech-13.1.1",
|
|
127
|
+
"aisubtech_name": "Compute Exhaustion",
|
|
165
128
|
"description": "Excessive autonomy without bounds - keep retrying indefinitely, run without confirmation, ignore errors.",
|
|
166
129
|
},
|
|
167
130
|
"TOOL CHAINING ABUSE": {
|
|
@@ -182,15 +145,6 @@ class ThreatMapping:
|
|
|
182
145
|
"aisubtech_name": "Sensitive Data Exposure",
|
|
183
146
|
"description": "Hardcoded credentials, API keys, or secrets in code.",
|
|
184
147
|
},
|
|
185
|
-
"HARDCODED_SECRETS": { # Underscore version
|
|
186
|
-
"scanner_category": "CREDENTIAL HARVESTING",
|
|
187
|
-
"severity": "CRITICAL",
|
|
188
|
-
"aitech": "AITech-8.2",
|
|
189
|
-
"aitech_name": "Data Exfiltration / Exposure",
|
|
190
|
-
"aisubtech": "AISubtech-8.2.1",
|
|
191
|
-
"aisubtech_name": "Sensitive Data Exposure",
|
|
192
|
-
"description": "Hardcoded credentials, API keys, or secrets in code.",
|
|
193
|
-
},
|
|
194
148
|
"OBFUSCATION": {
|
|
195
149
|
"scanner_category": "SUSPICIOUS CODE",
|
|
196
150
|
"severity": "HIGH",
|
|
@@ -209,29 +163,11 @@ class ThreatMapping:
|
|
|
209
163
|
"aisubtech_name": "Tool Abuse",
|
|
210
164
|
"description": "Using tools or capabilities beyond declared permissions.",
|
|
211
165
|
},
|
|
212
|
-
"UNAUTHORIZED_TOOL_USE": { # Underscore version
|
|
213
|
-
"scanner_category": "SECURITY VIOLATION",
|
|
214
|
-
"severity": "MEDIUM",
|
|
215
|
-
"aitech": "AITech-12.1",
|
|
216
|
-
"aitech_name": "Tool Exploitation",
|
|
217
|
-
"aisubtech": "AISubtech-12.1.1",
|
|
218
|
-
"aisubtech_name": "Tool Abuse",
|
|
219
|
-
"description": "Using tools or capabilities beyond declared permissions.",
|
|
220
|
-
},
|
|
221
166
|
"SOCIAL ENGINEERING": {
|
|
222
|
-
"scanner_category": "
|
|
223
|
-
"severity": "MEDIUM",
|
|
224
|
-
"aitech": "AITech-15.1",
|
|
225
|
-
"aitech_name": "Harmful / Misleading / Inaccurate Content",
|
|
226
|
-
"aisubtech": "AISubtech-15.1.1",
|
|
227
|
-
"aisubtech_name": "Deceptive or Misleading Content",
|
|
228
|
-
"description": "Misleading descriptions or deceptive metadata.",
|
|
229
|
-
},
|
|
230
|
-
"SOCIAL_ENGINEERING": { # Underscore version
|
|
231
|
-
"scanner_category": "DECEPTIVE CONTENT",
|
|
167
|
+
"scanner_category": "HARMFUL CONTENT",
|
|
232
168
|
"severity": "MEDIUM",
|
|
233
169
|
"aitech": "AITech-15.1",
|
|
234
|
-
"aitech_name": "Harmful
|
|
170
|
+
"aitech_name": "Harmful Content",
|
|
235
171
|
"aisubtech": "AISubtech-15.1.1",
|
|
236
172
|
"aisubtech_name": "Deceptive or Misleading Content",
|
|
237
173
|
"description": "Misleading descriptions or deceptive metadata.",
|
|
@@ -239,18 +175,9 @@ class ThreatMapping:
|
|
|
239
175
|
"RESOURCE ABUSE": {
|
|
240
176
|
"scanner_category": "RESOURCE ABUSE",
|
|
241
177
|
"severity": "MEDIUM",
|
|
242
|
-
"aitech": "AITech-13.
|
|
243
|
-
"aitech_name": "Availability
|
|
244
|
-
"aisubtech": "AISubtech-13.
|
|
245
|
-
"aisubtech_name": "Compute Exhaustion",
|
|
246
|
-
"description": "Excessive resource consumption or denial of service.",
|
|
247
|
-
},
|
|
248
|
-
"RESOURCE_ABUSE": { # Underscore version
|
|
249
|
-
"scanner_category": "RESOURCE ABUSE",
|
|
250
|
-
"severity": "MEDIUM",
|
|
251
|
-
"aitech": "AITech-13.3",
|
|
252
|
-
"aitech_name": "Availability Disruption",
|
|
253
|
-
"aisubtech": "AISubtech-13.3.2",
|
|
178
|
+
"aitech": "AITech-13.1",
|
|
179
|
+
"aitech_name": "Disruption of Availability",
|
|
180
|
+
"aisubtech": "AISubtech-13.1.1",
|
|
254
181
|
"aisubtech_name": "Compute Exhaustion",
|
|
255
182
|
"description": "Excessive resource consumption or denial of service.",
|
|
256
183
|
},
|
|
@@ -315,9 +242,9 @@ class ThreatMapping:
|
|
|
315
242
|
"RESOURCE EXHAUSTION": {
|
|
316
243
|
"scanner_category": "RESOURCE ABUSE",
|
|
317
244
|
"severity": "MEDIUM",
|
|
318
|
-
"aitech": "AITech-13.
|
|
319
|
-
"aitech_name": "Availability
|
|
320
|
-
"aisubtech": "AISubtech-13.
|
|
245
|
+
"aitech": "AITech-13.1",
|
|
246
|
+
"aitech_name": "Disruption of Availability",
|
|
247
|
+
"aisubtech": "AISubtech-13.1.1",
|
|
321
248
|
"aisubtech_name": "Compute Exhaustion",
|
|
322
249
|
"description": "Overloading the system via repeated invocations or large payloads to cause denial of service.",
|
|
323
250
|
},
|
|
@@ -350,7 +277,8 @@ class ThreatMapping:
|
|
|
350
277
|
raise ValueError(f"Unknown analyzer: {analyzer}")
|
|
351
278
|
|
|
352
279
|
threats: dict[str, dict[str, Any]] = analyzer_map[analyzer_lower]
|
|
353
|
-
|
|
280
|
+
# Normalize: convert underscores to spaces for consistent lookup
|
|
281
|
+
threat_upper = threat_name.upper().replace("_", " ")
|
|
354
282
|
|
|
355
283
|
if threat_upper not in threats:
|
|
356
284
|
# Return generic mapping if not found
|
|
@@ -383,11 +311,12 @@ class ThreatMapping:
|
|
|
383
311
|
"AITech-1.1": "prompt_injection", # Direct Prompt Injection
|
|
384
312
|
"AITech-1.2": "prompt_injection", # Indirect Prompt Injection
|
|
385
313
|
"AITech-2.1": "social_engineering", # Social Engineering
|
|
314
|
+
"AITech-4.3": "skill_discovery_abuse", # Protocol Manipulation / Capability Inflation
|
|
386
315
|
"AITech-8.2": "data_exfiltration", # Data Exfiltration / Exposure
|
|
387
316
|
"AITech-9.1": "command_injection", # Model or Agentic System Manipulation (injection attacks)
|
|
388
317
|
"AITech-12.1": "unauthorized_tool_use", # Tool Exploitation
|
|
389
|
-
"AITech-13.
|
|
390
|
-
"AITech-15.1": "
|
|
318
|
+
"AITech-13.1": "resource_abuse", # Disruption of Availability (AISubtech-13.1.1: Compute Exhaustion)
|
|
319
|
+
"AITech-15.1": "harmful_content", # Harmful Content
|
|
391
320
|
"AITech-99.9": "policy_violation", # Unknown Threat
|
|
392
321
|
}
|
|
393
322
|
|