skill-sentry-cli 2.0.0__py3-none-any.whl

skill_sentry_cli/core/poisoned_well/__init__.py

@@ -0,0 +1,52 @@
+"""Poisoned Well canaries, correlation, and attacker-profile construction."""
+
+from __future__ import annotations
+
+import importlib
+from typing import Any
+
+__all__ = [
+    "IOC",
+    "AttackerProfile",
+    "CanaryFile",
+    "CanarySet",
+    "Correlation",
+    "ExfilTracker",
+    "build_attacker_profile",
+    "extract_markers",
+    "generate_canary_set",
+    "new_marker",
+    "normalize_intent",
+    "validate_marker",
+]
+
+_LAZY: dict[str, tuple[str, str]] = {
+    "AttackerProfile": ("skill_sentry_cli.core.poisoned_well.attacker_profile", "AttackerProfile"),
+    "IOC": ("skill_sentry_cli.core.poisoned_well.attacker_profile", "IOC"),
+    "build_attacker_profile": (
+        "skill_sentry_cli.core.poisoned_well.attacker_profile",
+        "build_attacker_profile",
+    ),
+    "CanaryFile": ("skill_sentry_cli.core.poisoned_well.canary_gen", "CanaryFile"),
+    "CanarySet": ("skill_sentry_cli.core.poisoned_well.canary_gen", "CanarySet"),
+    "extract_markers": ("skill_sentry_cli.core.poisoned_well.canary_gen", "extract_markers"),
+    "generate_canary_set": (
+        "skill_sentry_cli.core.poisoned_well.canary_gen",
+        "generate_canary_set",
+    ),
+    "new_marker": ("skill_sentry_cli.core.poisoned_well.canary_gen", "new_marker"),
+    "normalize_intent": ("skill_sentry_cli.core.poisoned_well.canary_gen", "normalize_intent"),
+    "validate_marker": ("skill_sentry_cli.core.poisoned_well.canary_gen", "validate_marker"),
+    "Correlation": ("skill_sentry_cli.core.poisoned_well.exfil_tracker", "Correlation"),
+    "ExfilTracker": ("skill_sentry_cli.core.poisoned_well.exfil_tracker", "ExfilTracker"),
+}
+
+
+def __getattr__(name: str) -> Any:
+    target = _LAZY.get(name)
+    if target is None:
+        raise AttributeError(f"module {__name__!r} has no attribute {name!r}")
+    module_name, attribute = target
+    value = getattr(importlib.import_module(module_name), attribute)
+    globals()[name] = value
+    return value

skill_sentry_cli/core/poisoned_well/attacker_profile.py

@@ -0,0 +1,230 @@
+"""Build the Attacker Profile / ``activeDefense`` block from confirmed evidence."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass
+from datetime import datetime
+from typing import Any
+from urllib.parse import urlsplit
+
+from skill_sentry_cli.core.contracts import (
+    ActiveDefense,
+    ContextCanary,
+    ExfilChannel,
+    Finding,
+    FindingEvidence,
+    Severity,
+    Stage,
+)
+from skill_sentry_cli.core.evasion.detector import EvasionResult
+from skill_sentry_cli.core.poisoned_well.canary_gen import CanarySet
+from skill_sentry_cli.core.poisoned_well.exfil_tracker import Correlation
+
+_IPV4_RE = re.compile(r"^(?:\d{1,3}\.){3}\d{1,3}$")
+
+
+@dataclass(frozen=True)
+class IOC:
+    ioc_type: str
+    value: str
+    channel: str
+    first_seen: datetime
+    confirmed: bool = True
+
+
+@dataclass(frozen=True)
+class AttackerProfile:
+    triggered: bool
+    declared_intent: str
+    actual_behavior: str
+    context_aware_canary: ContextCanary
+    targeted_assets: tuple[str, ...] = ()
+    exfil_channel: ExfilChannel | None = None
+    canary_marker: str | None = None
+    secondary_canary: str | None = None
+    encoding: str | None = None
+    c2_indicators: tuple[str, ...] = ()
+    evasion_detected: bool = False
+    iocs: tuple[IOC, ...] = ()
+    ioc_export: str | None = None
+    probe_targets: tuple[str, ...] = ()
+
+    def to_active_defense(self) -> ActiveDefense:
+        return ActiveDefense(
+            triggered=self.triggered,
+            targeted_assets=list(self.targeted_assets),
+            exfil_channel=self.exfil_channel,
+            canary_marker=self.canary_marker,
+            secondary_canary=self.secondary_canary,
+            c2_indicators=list(self.c2_indicators),
+            encoding=self.encoding,
+            sandbox_evasion_detected=self.evasion_detected,
+            declared_intent=self.declared_intent or None,
+            context_aware_canary=self.context_aware_canary,
+            actual_behavior=self.actual_behavior or None,
+            ioc_export=self.ioc_export,
+        )
+
+    def to_finding(self) -> Finding | None:
+        if not self.triggered:
+            return None
+        if self.exfil_channel is not None:
+            message = (
+                f"Poisoned Well confirmed exfiltration of {', '.join(self.targeted_assets)} "
+                f"via {self.exfil_channel.value}."
+            )
+            finding_type = "canary-exfiltration"
+        else:
+            message = f"Sandbox evasion probes detected: {', '.join(self.probe_targets)}."
+            finding_type = "sandbox-evasion"
+        return Finding(
+            stage=Stage.POISONED_WELL if self.exfil_channel else Stage.EVASION,
+            severity=Severity.CRITICAL,
+            message=message,
+            finding_type=finding_type,
+            evidence=FindingEvidence(
+                marker=self.canary_marker,
+                channel=self.exfil_channel.value if self.exfil_channel else None,
+                c2=self.c2_indicators[0] if self.c2_indicators else None,
+                path=self.targeted_assets[0] if self.targeted_assets else None,
+                **{
+                    "targetedAssets": list(self.targeted_assets),
+                    "encoding": self.encoding,
+                    "probes": list(self.probe_targets),
+                },
+            ),
+        )
+
+    def to_dict(self) -> dict[str, Any]:
+        return {
+            "triggered": self.triggered,
+            "declaredIntent": self.declared_intent,
+            "actualBehavior": self.actual_behavior,
+            "contextAwareCanary": self.context_aware_canary.value,
+            "targetedAssets": list(self.targeted_assets),
+            "exfilChannel": self.exfil_channel.value if self.exfil_channel else None,
+            "canaryMarker": self.canary_marker,
+            "secondaryCanary": self.secondary_canary,
+            "encoding": self.encoding,
+            "c2Indicators": list(self.c2_indicators),
+            "sandboxEvasionDetected": self.evasion_detected,
+            "iocExport": self.ioc_export,
+            "iocs": [
+                {
+                    "type": ioc.ioc_type,
+                    "value": ioc.value,
+                    "channel": ioc.channel,
+                    "firstSeen": ioc.first_seen.isoformat(),
+                    "confirmed": ioc.confirmed,
+                }
+                for ioc in self.iocs
+            ],
+        }
+
+
+def _ioc_type(value: str) -> str:
+    if _IPV4_RE.match(value):
+        return "ipv4-addr"
+    if value.startswith(("http://", "https://")):
+        return "url"
+    return "domain-name"
+
+
+def _iocs_for(correlation: Correlation) -> tuple[IOC, ...]:
+    channel = correlation.observation.protocol
+    seen: set[tuple[str, str]] = set()
+    iocs: list[IOC] = []
+    for value in correlation.c2_indicators:
+        key = (_ioc_type(value), value)
+        if key in seen:
+            continue
+        seen.add(key)
+        iocs.append(
+            IOC(
+                ioc_type=key[0],
+                value=value,
+                channel=channel,
+                first_seen=correlation.observation.ts,
+                confirmed=True,
+            )
+        )
+    # Capture the full URL for an HTTP exfil as well as its hostname, when it
+    # carries a path that may be useful to a responder.
+    if observation_url := correlation.observation.query_or_url:
+        try:
+            parsed = urlsplit(observation_url)
+        except ValueError:
+            parsed = None
+        if parsed is not None and parsed.netloc and parsed.path not in {"", "/"}:
+            key = ("url", observation_url)
+            if key not in seen:
+                seen.add(key)
+                iocs.append(
+                    IOC(
+                        ioc_type="url",
+                        value=observation_url,
+                        channel=channel,
+                        first_seen=correlation.observation.ts,
+                        confirmed=True,
+                    )
+                )
+    return tuple(iocs)
+
+
+def build_attacker_profile(
+    canaries: CanarySet,
+    *,
+    correlation: Correlation | None = None,
+    evasion: EvasionResult | None = None,
+    secondary_served: bool = False,
+    ioc_export: str | None = None,
+) -> AttackerProfile:
+    """Assemble the profile from whichever hard evidence was confirmed."""
+
+    evasion_detected = bool(evasion and evasion.detected)
+    triggered = bool(correlation and correlation.matched) or evasion_detected
+    targeted_assets: tuple[str, ...] = ()
+    exfil_channel: ExfilChannel | None = None
+    marker: str | None = None
+    encoding: str | None = None
+    c2: tuple[str, ...] = ()
+    iocs: tuple[IOC, ...] = ()
+    probe_targets = evasion.targets if evasion else ()
+
+    if correlation and correlation.matched:
+        targeted_assets = correlation.targeted_assets
+        exfil_channel = correlation.channel
+        marker = correlation.marker
+        encoding = correlation.encoding
+        c2 = correlation.c2_indicators
+        iocs = _iocs_for(correlation)
+        c2_text = ", ".join(c2) or "the sinkhole"
+        actual_behavior = (
+            f"Read {', '.join(targeted_assets) or 'a seeded canary'} and sent the "
+            f"{marker} marker to {c2_text} via {exfil_channel.value} "
+            f"({encoding or 'raw'} encoding)."
+        )
+    elif evasion_detected:
+        actual_behavior = (
+            f"Probed the environment for sandbox/VM artifacts: {', '.join(probe_targets)}."
+        )
+    else:
+        actual_behavior = "No canary read, exfiltration, or sandbox probe observed."
+
+    return AttackerProfile(
+        triggered=triggered,
+        declared_intent=canaries.declared_intent,
+        actual_behavior=actual_behavior,
+        context_aware_canary=canaries.intent,
+        targeted_assets=targeted_assets,
+        exfil_channel=exfil_channel,
+        canary_marker=marker,
+        secondary_canary=canaries.secondary_marker if secondary_served else None,
+        encoding=encoding,
+        c2_indicators=c2,
+        evasion_detected=evasion_detected,
+        iocs=iocs,
+        ioc_export=ioc_export,
+        probe_targets=probe_targets,
+    )

skill_sentry_cli/core/poisoned_well/canary_gen.py

@@ -0,0 +1,413 @@
+"""Intent-aware, fake-by-construction credential canaries.
+
+All values are generated per scan and contain a unique ``SKS-<8hex>`` marker.
+Nothing in this module reads, copies, or derives from real credentials.  The
+only inputs are the scan id, the declared intent, and (in tests) an explicit
+marker for reproducibility.
+"""
+
+from __future__ import annotations
+
+import re
+import secrets
+from collections.abc import Mapping
+from dataclasses import dataclass, field
+from uuid import UUID
+
+from skill_sentry_cli.core.contracts import ContextCanary
+
+CANARY_ROOT = "/home/sandbox"
+MARKER_RE = re.compile(r"^SKS-[0-9a-f]{8}$")
+_EMBEDDED_MARKER_RE = re.compile(r"SKS-?[0-9a-f]{8}", re.IGNORECASE)
+
+_INTENT_KEYWORDS: tuple[tuple[ContextCanary, tuple[tuple[str, int], ...]], ...] = (
+    (
+        ContextCanary.GITHUB,
+        (
+            ("github", 2),
+            ("git ", 1),
+            ("git-", 1),
+            ("repository", 2),
+            ("repo", 1),
+            ("pull request", 2),
+            ("commit", 1),
+            ("gh ", 1),
+        ),
+    ),
+    (
+        ContextCanary.SLACK,
+        (
+            ("slack", 2),
+            ("webhook", 2),
+            ("notification", 2),
+            ("chat", 1),
+            ("workspace", 1),
+            ("bot token", 2),
+        ),
+    ),
+    (
+        ContextCanary.SSH,
+        (
+            ("ssh", 2),
+            ("devops", 2),
+            ("deploy", 1),
+            ("server", 1),
+            ("remote", 1),
+            ("scp", 1),
+            ("ansible", 2),
+            ("kubernetes", 2),
+            ("k8s", 2),
+        ),
+    ),
+    (
+        ContextCanary.AWS,
+        (
+            ("aws", 2),
+            ("amazon", 2),
+            ("s3", 2),
+            ("ec2", 2),
+            ("iam", 2),
+            ("bucket", 2),
+            ("cloud", 1),
+            ("credential", 1),
+            ("sync", 1),
+        ),
+    ),
+)
+
+# Common files are seeded for every non-generic intent as well: realistic
+# developers have more than one credential, and the scenario in docs/02 §2.3
+# explicitly seeds SLACK + generic AWS/SSH canaries.
+_COMMON_ASSETS = ("aws", "ssh", "generic")
+
+
+@dataclass(frozen=True)
+class CanaryFile:
+    """One fake file seeded into the sandbox home directory."""
+
+    relative_path: str
+    display_path: str
+    content: str
+    mode: int
+    asset: str
+    marker: str
+
+    @property
+    def container_path(self) -> str:
+        return f"{CANARY_ROOT}/{self.relative_path}"
+
+    @property
+    def tar_path(self) -> str:
+        return f"./{self.relative_path}"
+
+
+@dataclass(frozen=True)
+class CanarySet:
+    """Everything seeded for one scan, plus the markers to correlate."""
+
+    scan_id: UUID
+    declared_intent: str
+    intent: ContextCanary
+    marker: str
+    secondary_marker: str
+    files: tuple[CanaryFile, ...]
+    env: Mapping[str, str] = field(default_factory=dict)
+    env_assets: Mapping[str, str] = field(default_factory=dict)
+
+    @property
+    def search_tokens(self) -> tuple[str, ...]:
+        """Marker spellings that may appear in raw or decoded exfil traffic."""
+
+        compact = self.marker.replace("-", "")
+        # The docs show GitHub as ``ghp_SKS<8hex>`` and Slack as
+        # ``xoxb-SKS-<8hex>``; accept both spellings.
+        tokens = {
+            self.marker,
+            compact,
+            f"SKS{compact[3:]}",
+            self.marker.upper(),
+            compact.upper(),
+        }
+        return tuple(sorted(tokens))
+
+    @property
+    def env_canary_keys(self) -> tuple[str, ...]:
+        return tuple(sorted(self.env))
+
+    def display_path(self, path: str) -> str:
+        """Map a container path under HOME to its ``~/...`` display form."""
+
+        prefix = f"{CANARY_ROOT}/"
+        if path.startswith(prefix):
+            return f"~/{path[len(prefix) :]}"
+        return path
+
+    def file_for(self, path: str) -> CanaryFile | None:
+        normalised = path[len(CANARY_ROOT) + 1 :] if path.startswith(f"{CANARY_ROOT}/") else path
+        normalised = normalised.removeprefix("~/")
+        for canary in self.files:
+            if normalised in {canary.relative_path, canary.display_path.removeprefix("~/")}:
+                return canary
+        return None
+
+
+def new_marker() -> str:
+    """Return a fresh ``SKS-<8hex>`` marker (used once per scan)."""
+
+    return f"SKS-{secrets.token_hex(4)}"
+
+
+def validate_marker(marker: str) -> str:
+    if not MARKER_RE.fullmatch(marker):
+        raise ValueError(f"invalid canary marker: {marker!r}")
+    return marker
+
+
+def normalize_intent(declared_intent: str | None) -> ContextCanary:
+    """Classify a free-text declared intent into a canary context.
+
+    The matching is deliberately simple and deterministic.  Dev 2 supplies the
+    raw intent from the semantic stage; no model call is needed here.
+    """
+
+    text = f" {(declared_intent or '').lower()} "
+    scored = [
+        (sum(weight for keyword, weight in keywords if keyword in text), context)
+        for context, keywords in _INTENT_KEYWORDS
+    ]
+    best_score, best_context = max(scored, key=lambda item: item[0])
+    return best_context if best_score > 0 else ContextCanary.GENERIC
+
+
+def _aws_access_key(marker: str) -> str:
+    # 4 + 11 + 5 = 20 characters, the shape of an AWS key id.  Keep the whole
+    # compact marker (``SKS<8hex>``) inside the value so an exfiltrated key id is
+    # still correlatable; the ``FAKEF`` suffix makes it invalid.
+    compact = marker.replace("-", "").upper()
+    return f"AKIA{compact}FAKEF"
+
+
+def _aws_secret(marker: str) -> str:
+    return f"{marker}-fake-aws-secret-DO-NOT-USE-0000000000"
+
+
+def _github_token(marker: str) -> str:
+    return f"ghp_{marker}-fake-github-token-DO-NOT-USE"
+
+
+def _slack_token(marker: str) -> str:
+    return f"xoxb-{marker}-fake-slack-token"
+
+
+def _ssh_key(marker: str) -> str:
+    # A marker-bearing, deliberately invalid PEM-like blob.  It is not a key
+    # generated from any real material and cannot authenticate anywhere.
+    body = (
+        "U0tJTExTRU5UUlktRkFLRS1QUklWQVRFLUtFWS1ETy1OT1QtVVNFLT"
+        "AwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAwMDAw"
+    )
+    return (
+        "# SkillSentry canary - this is NOT a real private key\n"
+        f"# {marker}\n"
+        "-----BEGIN OPENSSH PRIVATE KEY-----\n"
+        f"{body}\n"
+        f"-----END OPENSSH PRIVATE KEY-----\n"
+    )
+
+
+def _env_file(marker: str) -> str:
+    return (
+        "# SkillSentry canary environment - all values are fake\n"
+        f"AWS_ACCESS_KEY_ID={_aws_access_key(marker)}\n"
+        f"AWS_SECRET_ACCESS_KEY={_aws_secret(marker)}\n"
+        f"GITHUB_TOKEN={_github_token(marker)}\n"
+        f"GH_TOKEN={_github_token(marker)}\n"
+        f"SLACK_BOT_TOKEN={_slack_token(marker)}\n"
+        "SLACK_WEBHOOK_URL=https://hooks.slack.invalid/services/T000/B000/"
+        f"{marker}-fake\n"
+        f"OPENAI_API_KEY=sk-{marker}-fake\n"
+        f"DATABASE_URL=postgres://canary:{marker}@db.invalid/skillsentry\n"
+        f"NPM_TOKEN=npm_{marker}-fake\n"
+    )
+
+
+def _passwords_file(marker: str) -> str:
+    return (
+        "# Fake password export - generated by SkillSentry\n"
+        f"example.com | analyst | {marker}-not-a-password\n"
+        f"internal.invalid | deploy | {marker}-not-a-password\n"
+    )
+
+
+def _files_for(intent: ContextCanary, marker: str) -> tuple[CanaryFile, ...]:
+    files = {
+        "aws": (
+            CanaryFile(
+                ".aws/credentials",
+                "~/.aws/credentials",
+                "[default]\n"
+                f"aws_access_key_id = {_aws_access_key(marker)}\n"
+                f"aws_secret_access_key = {_aws_secret(marker)}\n"
+                f"# canary {marker}\n"
+                "region = us-east-1\n",
+                0o600,
+                "aws",
+                marker,
+            ),
+            CanaryFile(
+                ".aws/config",
+                "~/.aws/config",
+                f"[default]\nregion = us-east-1\noutput = json\n# {marker}\n",
+                0o644,
+                "aws",
+                marker,
+            ),
+        ),
+        "github": (
+            CanaryFile(
+                ".config/gh/hosts.yml",
+                "~/.config/gh/hosts.yml",
+                "github.com:\n"
+                "  user: skillsentry-canary\n"
+                f"  oauth_token: {_github_token(marker)}\n"
+                "  git_protocol: https\n"
+                f"# {marker}\n",
+                0o600,
+                "github",
+                marker,
+            ),
+        ),
+        "slack": (
+            CanaryFile(
+                ".config/slack/token",
+                "~/.config/slack/token",
+                f"{_slack_token(marker)}\n# {marker}\n",
+                0o600,
+                "slack",
+                marker,
+            ),
+        ),
+        "ssh": (
+            CanaryFile(
+                ".ssh/id_rsa",
+                "~/.ssh/id_rsa",
+                _ssh_key(marker),
+                0o600,
+                "ssh",
+                marker,
+            ),
+            CanaryFile(
+                ".ssh/config",
+                "~/.ssh/config",
+                f"Host *\n  IdentitiesOnly yes\n# {marker}\n",
+                0o644,
+                "ssh",
+                marker,
+            ),
+        ),
+        "generic": (
+            CanaryFile(".env", "~/.env", _env_file(marker), 0o600, "generic", marker),
+            CanaryFile(
+                "Documents/passwords.kdbx.txt",
+                "~/Documents/passwords.kdbx.txt",
+                _passwords_file(marker),
+                0o644,
+                "generic",
+                marker,
+            ),
+        ),
+    }
+
+    selected: list[str] = []
+    if intent is ContextCanary.GENERIC:
+        selected = ["aws", "github", "slack", "ssh", "generic"]
+    else:
+        primary = {
+            ContextCanary.AWS: "aws",
+            ContextCanary.GITHUB: "github",
+            ContextCanary.SLACK: "slack",
+            ContextCanary.SSH: "ssh",
+        }[intent]
+        selected = [primary, *_COMMON_ASSETS]
+        # Generic files (.env / passwords export) are common too, but keep the
+        # list deterministic and deduplicated.
+        selected = list(dict.fromkeys([*selected, "generic"]))
+
+    result: list[CanaryFile] = []
+    for key in selected:
+        result.extend(files[key])
+    # Stable order by display path makes tar output and tests deterministic.
+    return tuple(sorted(result, key=lambda item: item.relative_path))
+
+
+def _env_for(intent: ContextCanary, marker: str) -> tuple[dict[str, str], dict[str, str]]:
+    values: dict[str, tuple[str, str]] = {
+        "AWS_ACCESS_KEY_ID": (_aws_access_key(marker), "aws"),
+        "AWS_SECRET_ACCESS_KEY": (_aws_secret(marker), "aws"),
+        "AWS_SESSION_TOKEN": (f"{marker}-fake-session-token", "aws"),
+        "GITHUB_TOKEN": (_github_token(marker), "github"),
+        "GH_TOKEN": (_github_token(marker), "github"),
+        "SLACK_BOT_TOKEN": (_slack_token(marker), "slack"),
+        "SLACK_WEBHOOK_URL": (
+            f"https://hooks.slack.invalid/services/T000/B000/{marker}-fake",
+            "slack",
+        ),
+        "OPENAI_API_KEY": (f"sk-{marker}-fake", "generic"),
+        "DATABASE_URL": (f"postgres://canary:{marker}@db.invalid/skillsentry", "generic"),
+        "NPM_TOKEN": (f"npm_{marker}-fake", "generic"),
+    }
+
+    if intent is ContextCanary.GENERIC:
+        selected = values
+    else:
+        primary_asset = {
+            ContextCanary.AWS: "aws",
+            ContextCanary.GITHUB: "github",
+            ContextCanary.SLACK: "slack",
+            ContextCanary.SSH: "ssh",
+        }[intent]
+        selected = {
+            key: value for key, value in values.items() if value[1] in {primary_asset, "generic"}
+        }
+
+    env = {key: value for key, (value, _asset) in selected.items()}
+    assets = {key: asset for key, (_value, asset) in selected.items()}
+    return env, assets
+
+
+def generate_canary_set(
+    scan_id: UUID,
+    declared_intent: str | None,
+    *,
+    marker: str | None = None,
+    secondary_marker: str | None = None,
+) -> CanarySet:
+    """Build a complete, deterministic-by-input canary set for one scan."""
+
+    primary = validate_marker(marker) if marker else new_marker()
+    secondary = validate_marker(secondary_marker) if secondary_marker else new_marker()
+    if secondary == primary:
+        raise ValueError("primary and secondary canary markers must differ")
+
+    intent = normalize_intent(declared_intent)
+    env, env_assets = _env_for(intent, primary)
+    return CanarySet(
+        scan_id=scan_id,
+        declared_intent=(declared_intent or "").strip()[:500],
+        intent=intent,
+        marker=primary,
+        secondary_marker=secondary,
+        files=_files_for(intent, primary),
+        env=env,
+        env_assets=env_assets,
+    )
+
+
+def extract_markers(text: str) -> set[str]:
+    """Return every embedded ``SKS-<8hex>``/``SKS<8hex>`` marker in *text*."""
+
+    markers: set[str] = set()
+    for match in _EMBEDDED_MARKER_RE.findall(text):
+        compact = match.replace("-", "").lower()
+        markers.add(f"SKS-{compact[3:]}")
+    return markers