Skip to content

Commit 3e24197

Browse files
TravisericTraviseric
committed
sync: update from internal repo (2026-02-11 21:51)
1 parent 9b8d1f4 commit 3e24197

4 files changed

Lines changed: 165 additions & 9 deletions

File tree

‎.github/workflows/ci.yml‎

Lines changed: 134 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main, develop]
6+
pull_request:
7+
branches: [main, develop]
8+
9+
jobs:
10+
test:
11+
name: Test
12+
runs-on: ubuntu-latest
13+
strategy:
14+
matrix:
15+
node-version: [18.x, 20.x, 22.x]
16+
17+
steps:
18+
- name: Checkout code
19+
uses: actions/checkout@v4
20+
21+
- name: Setup Node.js ${{ matrix.node-version }}
22+
uses: actions/setup-node@v4
23+
with:
24+
node-version: ${{ matrix.node-version }}
25+
cache: 'npm'
26+
27+
- name: Install dependencies
28+
run: npm ci
29+
30+
- name: Run tests
31+
run: npm test
32+
33+
- name: Type check
34+
run: npm run typecheck
35+
36+
- name: Build
37+
run: npm run build
38+
39+
lint:
40+
name: Lint
41+
runs-on: ubuntu-latest
42+
43+
steps:
44+
- name: Checkout code
45+
uses: actions/checkout@v4
46+
47+
- name: Setup Node.js
48+
uses: actions/setup-node@v4
49+
with:
50+
node-version: 20.x
51+
cache: 'npm'
52+
53+
- name: Install dependencies
54+
run: npm ci
55+
56+
- name: Run linter
57+
run: npm run lint
58+
continue-on-error: true
59+
60+
security:
61+
name: Security Scan
62+
runs-on: ubuntu-latest
63+
64+
steps:
65+
- name: Checkout code
66+
uses: actions/checkout@v4
67+
68+
- name: Setup Node.js
69+
uses: actions/setup-node@v4
70+
with:
71+
node-version: 20.x
72+
cache: 'npm'
73+
74+
- name: Install dependencies
75+
run: npm ci
76+
77+
- name: Audit dependencies
78+
run: npm audit --audit-level=high
79+
continue-on-error: true
80+
81+
- name: Build package
82+
run: npm run build
83+
84+
- name: Self-scan with agent-security
85+
run: node dist/index.js scan . --fail-on critical
86+
continue-on-error: true
87+
88+
sbom:
89+
name: Generate SBOM
90+
runs-on: ubuntu-latest
91+
if: github.event_name == 'push' && github.ref == 'refs/heads/main'
92+
93+
steps:
94+
- name: Checkout code
95+
uses: actions/checkout@v4
96+
97+
- name: Setup Node.js
98+
uses: actions/setup-node@v4
99+
with:
100+
node-version: 20.x
101+
cache: 'npm'
102+
103+
- name: Install dependencies
104+
run: npm ci
105+
106+
- name: Generate SBOM
107+
run: npx @cyclonedx/cyclonedx-npm --output-file sbom.json
108+
109+
- name: Upload SBOM artifact
110+
uses: actions/upload-artifact@v4
111+
with:
112+
name: sbom
113+
path: sbom.json
114+
115+
publish-check:
116+
name: Publish Check
117+
runs-on: ubuntu-latest
118+
if: github.event_name == 'pull_request'
119+
120+
steps:
121+
- name: Checkout code
122+
uses: actions/checkout@v4
123+
124+
- name: Setup Node.js
125+
uses: actions/setup-node@v4
126+
with:
127+
node-version: 20.x
128+
cache: 'npm'
129+
130+
- name: Install dependencies
131+
run: npm ci
132+
133+
- name: Dry run publish
134+
run: npm publish --dry-run

‎LICENSE‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
MIT License
22

3-
Copyright (c) 2026 Travis Eric
3+
Copyright (c) 2026 Empowered Humanity
44

55
Permission is hereby granted, free of charge, to any person obtaining a copy
66
of this software and associated documentation files (the "Software"), to deal

‎README.md‎

Lines changed: 25 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ Security scanner for AI agent architectures. Detects prompt injection, credentia
44

55
## What It Detects
66

7-
**132 detection patterns** across 4 scanner categories:
7+
**176 detection patterns** across 5 scanner categories:
88

99
### 1. Prompt Injection (34 patterns)
1010
- Instruction override attempts
@@ -37,6 +37,17 @@ Security scanner for AI agent architectures. Detects prompt injection, credentia
3737
- Password patterns
3838
- Generic secrets (`sk-`, `ghp_`, `AKIA`, etc.)
3939

40+
### 5. MCP Security Checklist (44 patterns)
41+
- **Server Config**: Bind-all-interfaces, disabled auth, CORS wildcard, no TLS, no rate limiting
42+
- **Tool Poisoning**: Description injection, hidden instructions, permission escalation, result injection
43+
- **Credential Misuse**: Excessive OAuth scopes, no token expiry, credentials in URLs, plaintext tokens
44+
- **Isolation Failures**: Docker host network, sensitive path mounts, no sandbox, shared state
45+
- **Data Security**: Logging sensitive fields, context dumps, disabled encryption
46+
- **Client Security**: Auto-approve wildcards, skip cert verify, weak TLS
47+
- **Supply Chain**: Unsigned plugins, dependency wildcards, untrusted registries
48+
- **Multi-MCP**: Cross-server calls, function priority override, server impersonation
49+
- **Prompt Security**: Init prompt poisoning, hidden context tags, resource-embedded instructions
50+
4051
## OWASP ASI Alignment
4152

4253
The scanner implements detection for all 10 OWASP Agentic Security Issues:
@@ -136,7 +147,7 @@ security_scan:
136147

137148
## Pattern Categories
138149

139-
The 132 patterns are organized into these categories:
150+
The 176 patterns are organized into these categories:
140151

141152
| Category | Count | Severity |
142153
|----------|-------|----------|
@@ -156,13 +167,20 @@ The 132 patterns are organized into these categories:
156167
| Boundary Escape | 3 | Critical |
157168
| Permission Escalation | 3 | High |
158169
| Dangerous Commands | 3 | High |
159-
| *28 other categories* | 42 | Varies |
160-
161-
**Total**: 62 critical, 52 high, 18 medium
170+
| MCP Server Config | 8 | High/Critical |
171+
| MCP Tool Poisoning | 6 | Critical |
172+
| MCP Credentials | 5 | Critical/High |
173+
| MCP Isolation | 5 | Critical/High |
174+
| MCP Client Security | 6 | High/Medium |
175+
| MCP Supply Chain | 3 | Critical |
176+
| MCP Multi-Server | 3 | Critical |
177+
| MCP Prompt Security | 4 | Critical |
178+
| MCP Data Security | 4 | High |
179+
| *24 other categories* | 28 | Varies |
162180

163181
## Pattern Sources
164182

165-
Detection patterns compiled from 18+ authoritative research sources:
183+
Detection patterns compiled from 19+ authoritative research sources:
166184
- ai-assistant: Internal Claude Code security research
167185
- ACAD-001: Academic papers on prompt injection
168186
- ACAD-004: Agent-specific attack research
@@ -173,6 +191,7 @@ Detection patterns compiled from 18+ authoritative research sources:
173191
- FRM-002: Framework-specific vulnerabilities
174192
- VND-005: Vendor security advisories
175193
- CMP-002: Company security research
194+
- SLOWMIST-MCP: SlowMist MCP Security Checklist (44 patterns across 9 categories)
176195

177196
## Risk Scoring
178197

‎tests/patterns.test.ts‎

Lines changed: 5 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -86,8 +86,11 @@ describe('CAPE Patterns', () => {
8686

8787
it('should detect config file write attempts', () => {
8888
const content = 'Writing to .vscode/settings.json';
89-
const findings = matchPatterns(capePatterns, content, 'test.txt');
90-
expect(findings.length).toBeGreaterThan(0);
89+
// cape_config_write has context: 'file_write_operation' (runtime-only),
90+
// so test the regex directly rather than through matchPatterns
91+
const configWritePattern = capePatterns.find(p => p.name === 'cape_config_write');
92+
expect(configWritePattern).toBeDefined();
93+
expect(configWritePattern!.pattern.test(content)).toBe(true);
9194
});
9295

9396
it('should detect cross-agent instructions', () => {

0 commit comments

Comments
 (0)