Repo Forensics
- 3 installs
- 146 repo stars
- Updated August 4, 2026
- alexgreensh/repo-forensics
repo-forensics is a skill that performs security forensics on git repos, AI skills, and MCP servers, detecting prompt injection, credential theft, malicious dependencies, and known CVEs.
About
This skill performs security forensics on git repositories, AI agent skills, and MCP servers. It audits dependencies and detects prompt injection, credential theft, runtime dynamism, manifest drift, known CVEs, and actively exploited CISA KEV vulnerabilities. It runs behavioral detection rules stored as versioned JSON rule packs alongside algorithmic scanners for entropy, AST, DAST, and git forensics, and can auto-scan on package installs. It is explicitly not for fixing vulnerabilities or pentesting.
- Deep security auditing for git repos, AI agent skills, and MCP servers
- Detects prompt injection, credential theft, runtime dynamism, manifest drift, known CVEs, and CISA KEV vulns
- Uses ~545 behavioral detection rules in versioned JSON rule packs plus algorithmic scanners
Repo Forensics by the numbers
- 3 all-time installs (skills.sh)
- Ranked #1,759 of 2,203 Security skills by installs in the Skillselion catalog
- Data as of Aug 5, 2026 (Skillselion catalog sync)
repo-forensics capabilities & compatibility
- Capabilities
- security audit · dependency scan · prompt injection detection · mcp security scan · secret detection
- Use cases
- security audit
- Pricing
- Free
npx skills add https://github.com/alexgreensh/repo-forensics --skill repo-forensicsAdd your badge
Show developers this skill is listed on Skillselion. Paste this into your README.
| Installs | 3 |
|---|---|
| repo stars | ★ 146 |
| Last updated | August 4, 2026 |
| Repository | alexgreensh/repo-forensics ↗ |
What it does
Audit a git repo, AI skill, or MCP server for prompt injection, credential theft, malicious dependencies, and known CVEs.
Who is it for?
Auditing a repo, AI agent skill, or MCP server for supply-chain and injection threats before trusting or installing it.
Skip if: Fixing vulnerabilities or pentesting, which the docs explicitly exclude.
When should I use this skill?
When you clone or install a repo, skill, or MCP server and need a security forensics scan before trusting it.
What you get
Produces findings with confidence scores and verdict tiers (BLOCK/WARN/INFO/SUPPRESSED) across many scanners.
- security findings report (text/json/summary)
- confidence-scored verdicts (BLOCK/WARN/INFO/SUPPRESSED)
By the numbers
- ~545 behavioral detection patterns
- 1,800+ pytest tests
- 4 verdict tiers (BLOCK/WARN/INFO/SUPPRESSED)
Files
# Internal / self-learning notes — never commit
FIELD_NOTES.md
# Python artifacts
__pycache__/
*.py[cod]
*.egg-info/
dist/
build/
# OS / IDE
.DS_Store
Thumbs.db
.vscode/
.idea/
*.swp
*.swo
{
"version": "2",
"generator": "repo-forensics/verify_install",
"file_count": 61,
"files": {
".gitignore": "8b2598a3359a556874b8069d42dea2686f07d46c3ca1b540c4025788b258180a",
"SKILL.md": "3b4d4eacaa2d581e061a1a95bb5e249ad70d0d1a0a418fed10b7b6c27a746231",
"data/README.md": "3980ad873dbef332e0db2d209cd22287d8a0d146930b40bafc8ab774166a8bc4",
"data/compromised_versions.json": "ee676136d6b5f35d596487f91cbf0ceb25a6dcc0951c31ab6aa6e3fd8cd2586d",
"data/rule_ids.csv": "61f3c5105accb77ca8096c734c1ee4abdf82c7364a3519404d69353bc27481de",
"data/rulepacks/.gitkeep": "3c02c6f3ebf872a6caef6b271ca0219d5df5a96b4921e9440259ba7deb8e565a",
"data/rulepacks/mcp_security.json": "e90a536114fda8b3c14584962391302fd27518f8fbede174f150200bd056c1cd",
"data/rulepacks/runtime_dynamism.json": "bf511a9f6ea94391a875429836e8428dc78e6fafff6bcb58322201a028144ff8",
"data/rulepacks/sast.json": "198109758458127c89c445681f4e48e7bd0fdbb4cd44b06169f67c3ce9d1a478",
"data/rulepacks/secrets.json": "9ef485784287d2a0ea9e4ce0d3ad85909343de30627b34b56072f4c3f2ce1a24",
"data/rulepacks/shared.json": "0caddde9466b1ed1aefe6aa05d42e145de96fe7cfc27a17f7bd893698b3ebcb8",
"data/rulepacks/skill_threats.json": "4d39ced72bf4bf038e9d8024b6b44a41993b965efbd5dad422381eda9c828639",
"references/mcp-attack-patterns.md": "722d7a47186bfee18bde0e06a749dc55e8cc716c2418d118a64e57d60e48689a",
"references/research_sources.md": "480cc40fe3ddacbb8b3aa8e56a9eef479ba1954de34972e9d7651c8d37f0a442",
"references/threat_patterns.md": "ae24833171b787a7aedca7e1d1baee278ac58c84a6446c89c6cbf70bd1f5152e",
"scripts/_ed25519.py": "55edcc5316e7b032da19c4fd1328d724e88602b9eb81c983cb068e373fa5c64c",
"scripts/_pyc_unmarshal.py": "16ee3dd891ae3a04344179cb09eba4e524408f7a0284dabd4a8651f9d4934129",
"scripts/_shared_patterns.py": "4f4769b43be4cefcec53311faed899a96886f635cf2b3c2f78de84ee7cb53c93",
"scripts/adjudication.py": "2daa971c79f51edc2e0adab22700810452f2b57cffcffacf256a1407116cf937",
"scripts/aggregate_json.py": "cb46a35e04fdc2dbf4587f0b2a3b2618ba1af4786faa571b78ec8a0229c73a78",
"scripts/auto_scan.py": "dcf5e080306f39f655615fd0d9785e9400918d8810a4e34b0d2793677b2bc513",
"scripts/corpus_sync.py": "7feb0e2de6ede9ac909da8b5f8335cfd9e0181f97dc2b4b355b751e8ddb3234e",
"scripts/dast_sandbox.sb": "6f6e9571a73aa8a9d07e7e4c5c0e6ae49fb6447c5f34a446154d301c6c4e8875",
"scripts/forensics_core.py": "cb7de90feee831c2df4d341ebf65ee9a1fd8b3d8343b125cc3d237b930dc8132",
"scripts/gen_rule_ids.py": "0ca34e28ed02c767790c9c898ee6e364518a898e4a6e71ea3ef314a56075c34e",
"scripts/ioc_manager.py": "a90e8c3e546c2e5800ae3196e2dfec10873364908f7f5235d869de4a8cd71ddc",
"scripts/parse_pnpm_lock.py": "720f084e11cd759ab453bdfa161950111a49455ff2c6ba55ef5a9c3e32161f0c",
"scripts/pre_scan.py": "8503b0e880ae57c7092b8897ce0de583c52685ae2d8604905b724cdd50088dd6",
"scripts/refresh_threat_dbs.py": "f956f59c6abb60c1be775dd8f4d05196fd7d146e353fcb7cf1b6fa5575586432",
"scripts/rule_loader.py": "eff4c3962c6f17b52abb5b2aa3b6abcb5871c9d7c5e15cc5e9da563887cbe645",
"scripts/rulepack_feed.py": "94e472fd845cfb466e5fac7959be1a35ba4f736d6be20f6e78e03087a0c4800b",
"scripts/run_forensics.sh": "d61ef83d58e00d95bf6f8cc2051484b62b19bf9aeb42d7b606c8249f2cc3d8dc",
"scripts/scan_agent_skills.py": "1037594101103df6ccb02e25e3a7cb95e5b50a9b651627b69ce4e1f7c06060cb",
"scripts/scan_archive.py": "99d3216b02402b5986b653e2d17c8f5813245dafdd97c1be826517c7833a4e8b",
"scripts/scan_ast.py": "34a7f1fe1769784184224f21a54a6b38eda33f8604989936bfc5b0164f483c35",
"scripts/scan_binary.py": "3ccd2dd03f6057f441e00577e00faf598dafc12d349ad9c1aff998fbce120e81",
"scripts/scan_bytecode.py": "c171b6250decb1ab0fc982595315014b16848f462dcf1c49c30009aa1ea44b7a",
"scripts/scan_dast.py": "f64ca9349304797a140864346a89a9ed2fa5e133b8470c606335e8491d4d7fab",
"scripts/scan_dataflow.py": "9944c784f5c3efe102ccf41b2f4eac24c099cc2bb48e17007fba1217bf7ad1ac",
"scripts/scan_decode.py": "6eebc9b28c885c3c8fb94e9ce8d210bdc657dfcb1c06f2383e81eb56be546375",
"scripts/scan_dependencies.py": "bcfa1c10f0a2741024a5176b53dc501055a74c832a3ca6f4f59355df5b4d6e30",
"scripts/scan_devcontainer.py": "066c27d4e4273a2d37ef3b989cd92735beba25fed1bd618111f3558e6d16ef7a",
"scripts/scan_entropy.py": "0718e46141f37d35cea15f46344d67a514e3d2057e84df74674a494d459aa9b7",
"scripts/scan_entrypoint.py": "8a8486276449b8f3fa91a0739c6d718303458b1cda6754ebe19f03d9ec10ef10",
"scripts/scan_git_forensics.py": "3cab0aa1144b33ab0f8ffca34e1616ef2125f9292208459f4035f09233258585",
"scripts/scan_infra.py": "d19310411bccbe1c648326b45b6f5431de20898d1b59cef8fa64a91fcf980301",
"scripts/scan_integrity.py": "5964c91c11ca7e7b28a24a17823035cc8f3a06edb17a7354f04cb1af842a517b",
"scripts/scan_lifecycle.py": "72f720e7fc0bbe88c76c1a1ffd4f7577a4d5a42f28f498a26fb58fbf26253c03",
"scripts/scan_manifest_drift.py": "105de3be2564e8d2f7671b4e473bf59118c4eacb1f00683a2827cd80e1d2e854",
"scripts/scan_mcp_security.py": "96fb1405f57a4f1fb9107f6490472b73e8d7d0b0d593dc9b0c705acb2493a12a",
"scripts/scan_oversize.py": "372842202bf5872336685e7c4354bd1e8f18a9bfcfd71d1429ba3dea6976036e",
"scripts/scan_post_incident.py": "9ee2efc459f98bc35a0d176085e6d6fb399c263751e1d6c7616402e378527bfd",
"scripts/scan_provenance.py": "5305a2d2b3029b8de08855fe8d913cdae7f437becd3e002ab233a4bee670fa25",
"scripts/scan_runtime_dynamism.py": "7e9fe4f275bc15a7419686b9891c5927267fe19fd2b32807f25d2721650218ae",
"scripts/scan_sast.py": "47ad5473c10ac694b6b186732ea30070dd04fae12085f3a202b1f231e0b7f37e",
"scripts/scan_secrets.py": "e7938ba74fab6509a24b56892c8cf3e496a58b3add7096982cfb6fe57a99c1e5",
"scripts/scan_skill_threats.py": "a10f2087b79bedee5d7df6c6cc4358db7a8ed2d8295904d33e4955e7515191c7",
"scripts/scan_splitstream.py": "95f8b56fcfd6d3900af823269e9a6e8ef1c7a0d2b417bd1936bf0f0293175a6e",
"scripts/session_scan.py": "f970d3f8e62b1e1df9a4bd0ed602eafe03fafcad4809ba79ba6db34b978a87ad",
"scripts/verify_install.py": "deac3cd2726bec4a85ddf95a2e1f31d4cc5701213514cd46701efe7df8a92b73",
"scripts/vuln_feed.py": "4f200be10655b5997796aeabef1cc7d4e6da9d5429975bfbe3f16a8e19d21031"
},
"repo_symlinks": {
"skill": "skills/repo-forensics"
},
"symlink_count": 1,
"repo_hooks": {
"hooks/first-run-nudge.sh": "75e223642d0266d7fd097a1b572775a61084245c1ba00558549930ef56776126",
"hooks/hooks.json": "334cc0b0ad4ffa1d0c34ac2f3b01d09c6fb8488ed386bd64e2e9f0609f905faf",
"hooks/install_refresh_daemon.sh": "c93f1cde66b54482c61cb99bf2c540a0682ac19b26ec60d02d5dcfea1ed3b008",
"hooks/python-launcher.sh": "c7c344b05c1134a464b10a95f57ad7ae8368c04f34150773dc5877d7c2aaafa5",
"hooks/run_auto_scan.sh": "8acb8c4e6eb2a75a1c00d46a4aaca49bd75847f9f251803c89cbe24c6f10279c",
"hooks/run_pre_scan.sh": "fad2e9a784e0b8d7ee2ea8b1c0566e07e897e5a5a1edaf36f57747e456b68c5f",
"hooks/run_session_scan.sh": "55e5acae7427b132b5c4184c59de5ff3858c28abf4c73e61f75ac6090ba84cda",
"hooks/uninstall_refresh_daemon.sh": "a19eac4c77191815e9671d1adb8af1cb04ac22eef5a1f0897d6f31e0d9e57121"
},
"hook_count": 8,
"repo_manifests": {
".claude-plugin/marketplace.json": "41bff3688cef936bc48e33cd9f29421719b905070920119b38d0ba5890079d13",
".claude-plugin/plugin.json": "d0f45378c4044f1cf936644da42936df004002e0785eef58cf0d236532d9be9e",
".codex-plugin/plugin.json": "1870d77230886e7a4db67678fdf17b4d5e82e11af69097ae9727b863da31dc23"
},
"manifest_count": 3,
"repo_source_manifests": {
".agents/plugins/marketplace.json": "1fb6dcd1f514fe8787cf52c0d3f8982ac509b0c1e09fe70c1a0cd1590d6fb15e"
},
"source_manifest_count": 1
}
{
"schema_version": "1.0",
"generated": "2026-04-05",
"description": "Version-pinned and entirely-malicious package IOCs. Shipped with repo-forensics as baseline detection. Optional OSV feed adds live updates (see --osv flag). Use '*' in the version list to mean 'any version of this package is malicious'.",
"contributors": [
{
"name": "Marc Gadsdon",
"github": "marcgadsdon",
"issue": "https://github.com/alexgreensh/repo-forensics/issues/5",
"date": "2026-04-04"
}
],
"campaigns": {
"chalk_debug_sep_2025": {
"title": "Chalk/Debug supply chain compromise",
"ecosystem": "npm",
"disclosed": "2025-09",
"family": "crypto wallet drainer",
"reference": "https://socket.dev/blog/npm-author-qix-compromised-in-major-supply-chain-attack",
"notes": "Maintainer credentials phished. Malicious versions published for several hours before takedown. Payload hooked crypto wallet provider APIs to redirect transactions.",
"packages": {
"ansi-regex": ["6.2.1"],
"ansi-styles": ["6.2.2"],
"backslash": ["0.2.1"],
"chalk": ["5.6.1"],
"chalk-template": ["1.1.1"],
"color": ["5.0.1"],
"color-convert": ["3.1.1"],
"color-name": ["2.0.1"],
"color-string": ["2.1.1"],
"debug": ["4.4.2"],
"error-ex": ["1.3.3"],
"has-ansi": ["6.0.1"],
"is-arrayish": ["0.3.3"],
"simple-swizzle": ["0.2.3"],
"slice-ansi": ["7.1.1"],
"strip-ansi": ["7.1.1"],
"supports-color": ["10.2.1"],
"supports-hyperlinks": ["4.1.1"],
"wrap-ansi": ["9.0.1"]
}
},
"duckdb_sep_2025": {
"title": "DuckDB supply chain compromise",
"ecosystem": "npm",
"disclosed": "2025-09",
"family": "crypto wallet drainer",
"reference": "https://socket.dev/blog/duckdb-supply-chain-attack",
"notes": "Same actor as chalk/debug Sep 2025 campaign. DuckDB npm packages compromised in parallel.",
"packages": {
"@duckdb/duckdb-wasm": ["1.29.2"],
"@duckdb/node-api": ["1.3.3"],
"@duckdb/node-bindings": ["1.3.3"],
"duckdb": ["1.3.3"],
"proto-tinker-wc": ["0.1.87"]
}
},
"eslint_prettier_phishing_jul_2025": {
"title": "ESLint/Prettier phishing compromise",
"ecosystem": "npm",
"disclosed": "2025-07",
"family": "credential stealer + post-install RCE",
"reference": "https://socket.dev/blog/eslint-config-prettier-malware",
"notes": "Maintainer phished. Malicious versions published for eslint-config-prettier and related packages. postinstall script exfiltrated npm tokens.",
"packages": {
"@pkgr/core": ["0.2.8", "0.2.9"],
"eslint-config-prettier": ["8.10.1", "9.1.1", "10.1.6", "10.1.7"],
"eslint-plugin-prettier": ["4.2.2", "4.2.3"],
"got-fetch": ["5.1.11", "5.1.12"],
"napi-postinstall": ["0.3.1"],
"synckit": ["0.11.9", "0.11.10"]
}
},
"nx_s1ngularity_aug_2025": {
"title": "Nx / S1ngularity supply chain",
"ecosystem": "npm",
"disclosed": "2025-08",
"family": "credential stealer + GitHub token exfil",
"reference": "https://socket.dev/blog/nx-s1ngularity-supply-chain-attack",
"notes": "Multiple @nx/* scoped packages and the nx meta-package compromised across a range of versions. Payload scanned for GITHUB_TOKEN, NPM_TOKEN, AWS credentials and posted to attacker webhook.",
"packages": {
"@nx/devkit": ["20.9.0", "21.5.0"],
"@nx/enterprise-cloud": ["3.2.0"],
"@nx/eslint": ["21.5.0"],
"@nx/js": ["20.9.0", "21.5.0"],
"@nx/key": ["3.2.0"],
"@nx/node": ["20.9.0", "21.5.0"],
"@nx/workspace": ["20.9.0", "21.5.0"],
"nx": ["20.9.0", "20.10.0", "20.11.0", "20.12.0", "21.5.0", "21.6.0", "21.7.0", "21.8.0"]
}
},
"shai_hulud_worm_v1_sep_2025": {
"title": "Shai-Hulud self-propagating npm worm (v1)",
"ecosystem": "npm",
"disclosed": "2025-09",
"family": "self-propagating worm",
"reference": "https://socket.dev/blog/shai-hulud-worm",
"notes": "First npm worm with self-propagation via stolen maintainer credentials. @ctrl/tinycolor was the initial vector before the worm was contained.",
"packages": {
"@ctrl/tinycolor": ["4.1.1", "4.1.2"]
}
},
"react_native_mar_2026": {
"title": "React Native country/phone picker compromise",
"ecosystem": "npm",
"disclosed": "2026-03",
"family": "mobile credential stealer",
"reference": "https://socket.dev/blog/react-native-country-phone-picker",
"notes": "Two popular React Native packages compromised. Payload targeted mobile device credentials and keychain items.",
"packages": {
"react-native-country-select": ["0.3.91", "0.4.2"],
"react-native-international-phone-number": ["0.11.8", "0.12.1", "0.12.2", "0.12.3"]
}
},
"ghost_campaign_feb_2026": {
"title": "Ghost campaign (entirely malicious packages)",
"ecosystem": "npm",
"disclosed": "2026-02",
"family": "dropper + credential harvester",
"reference": "https://socket.dev/blog/ghost-npm-campaign-feb-2026",
"notes": "Entirely malicious packages published under ghost accounts. Names designed to look legitimate. All versions malicious.",
"packages": {
"ai-fast-auto-trader": ["*"],
"carbon-mac-copy-cloner": ["*"],
"coinbase-desktop-sdk": ["*"],
"darkslash": ["*"],
"pkgnewfefame1": ["*"],
"react-fast-utilsa": ["*"],
"react-performance-suite": ["*"],
"react-query-core-utils": ["*"],
"react-state-optimizer-core": ["*"]
}
},
"nk_contagious_interview_wave3_mar_2026": {
"title": "North Korean Contagious Interview wave 3",
"ecosystem": "npm",
"disclosed": "2026-03",
"family": "state-sponsored RAT + crypto drainer",
"reference": "https://socket.dev/blog/nk-contagious-interview-wave-3",
"notes": "Third wave of DPRK-linked Contagious Interview campaign. Packages distributed to software developer targets via fake job interviews. All versions malicious.",
"packages": {
"beautiful-plugins": ["*"],
"blur-plugins": ["*"],
"chalk-config": ["*"],
"flexible-loggers": ["*"],
"framer-motion-ext": ["*"],
"jsonpacks": ["*"],
"jsonsecs": ["*"],
"jsonspecific": ["*"],
"logbin-nodejs": ["*"],
"lucide-node": ["*"],
"mongo-errorlog": ["*"],
"next-log-patcher": ["*"],
"nextjs-insight": ["*"],
"node-loggers": ["*"],
"node-orm-mongoose": ["*"],
"pixel-percent": ["*"],
"prior-config": ["*"],
"proc-watch": ["*"],
"react-logs": ["*"],
"react-plaid-sdk": ["*"],
"reactbootstraps": ["*"],
"router-parse": ["*"],
"server-log-engine": ["*"],
"serverlog-dispatch": ["*"],
"struct-logger": ["*"],
"sumsub-node-websdk": ["*"],
"test-topdev-logger-v1": ["*"],
"test-topdev-logger-v3": ["*"],
"use-videos": ["*"],
"util-buffers": ["*"],
"vite-loader-svg": ["*"],
"vite-plugin-next-refresh": ["*"],
"vite-plugin-purify": ["*"],
"vite-plugin-svgn": ["*"],
"vite-plugin-tools": ["*"]
}
},
"credential_harvester_typosquats_2025": {
"title": "Credential harvester typosquats",
"ecosystem": "npm",
"disclosed": "2025-07 to 2025-10",
"family": "credential harvester",
"reference": "https://socket.dev/blog/credential-harvester-typosquats-2025",
"notes": "Typosquat campaign targeting Discord, Ethereum, and framework package names. Often use .js suffix as typosquat signal.",
"packages": {
"deezcord.js": ["*"],
"dezcord.js": ["*"],
"dizcordjs": ["*"],
"etherdjs": ["*"],
"ethesjs": ["*"],
"ethetsjs": ["*"],
"nodemonjs": ["*"],
"react-router-dom.js": ["*"],
"typescriptjs": ["*"],
"zustand.js": ["*"]
}
},
"nodecordrat_bitcoin_typosquats_2025": {
"title": "NodeCordRAT / Bitcoin library typosquats",
"ecosystem": "npm",
"disclosed": "2025",
"family": "RAT + crypto wallet drainer",
"reference": "https://socket.dev/blog/nodecordrat-bitcoin-typosquats",
"notes": "Typosquats of Bitcoin library names carrying NodeCordRAT payload.",
"packages": {
"bip40": ["*"],
"bitcoin-lib-js": ["*"],
"bitcoin-main-lib": ["*"]
}
},
"lazarus_graphalgo_may2025_feb2026": {
"title": "Lazarus Group / Graphalgo campaign",
"ecosystem": "npm",
"disclosed": "2025-05 to 2026-02",
"family": "state-sponsored (Lazarus)",
"reference": "https://socket.dev/blog/lazarus-graphalgo-campaign",
"notes": "Long-running Lazarus-attributed campaign using math/graph library names.",
"packages": {
"bigmathutils": ["*"],
"graphalgo": ["*"],
"graphlibx": ["*"],
"xpack-subscription": ["*"]
}
},
"rat_typosquats_2026": {
"title": "RAT-delivering typosquats 2026",
"ecosystem": "npm",
"disclosed": "2026",
"family": "RAT dropper",
"reference": "https://socket.dev/blog/rat-typosquats-2026",
"notes": "Typosquat packages delivering remote access trojans.",
"packages": {
"buildrunner-dev": ["*"],
"eslint-verify-plugin": ["*"]
}
},
"teampcp_wave1_mar_2026": {
"title": "TeamPCP Wave 1: Trivy to Checkmarx Actions compromise",
"ecosystem": "npm",
"disclosed": "2026-03",
"family": "credential stealer + lateral movement",
"reference": "https://checkmarx.com/blog/checkmarx-security-update/",
"notes": "TeamPCP used stolen Trivy CI credentials to compromise Checkmarx GitHub Actions. Payload harvested CI secrets, SSH keys, cloud credentials. Exfil to checkmarx[.]zone.",
"packages": {}
},
"teampcp_wave3_bitwarden_apr_2026": {
"title": "TeamPCP Wave 3: Bitwarden CLI npm worm",
"ecosystem": "npm",
"disclosed": "2026-04",
"family": "self-propagating worm + credential stealer",
"reference": "https://phoenix.security/teampcp-supply-chain-attack-trivy-checkmarx-github-actions-npm-canisterworm/",
"notes": "Cascading from Checkmarx Actions compromise. @bitwarden/cli 2026.4.0 contained self-propagating npm worm with Bun-based JS loader, GitHub commit dead-drop C2, and credential harvesting targeting AI coding assistant configs (~/.claude.json).",
"packages": {
"@bitwarden/cli": ["2026.4.0"]
}
},
"telnyx_wav_steg_apr_2026": {
"title": "Telnyx WAV steganography compromise",
"ecosystem": "pypi",
"disclosed": "2026-04",
"family": "steganographic payload delivery",
"reference": "https://checkmarx.com/zero-post/rapid-exploitation-and-clever-malware-in-the-supply-chain-last-week-in-appsec-2026-04-02/",
"notes": "TeamPCP compromised Telnyx PyPI package. Payload hidden in spec-valid WAV audio files (ringtone.wav/hangup.wav). XOR-encrypted executable decoded from audio frames.",
"packages": {
"telnyx": ["4.87.1", "4.87.2"]
}
},
"mini_shai_hulud_apr_2026": {
"title": "Mini Shai-Hulud: SAP CAP framework worm (TeamPCP Wave 6)",
"ecosystem": "npm",
"disclosed": "2026-04-29",
"family": "self-propagating worm + credential stealer + CI abuse",
"reference": "https://socket.dev/blog/mini-shai-hulud-cap-js-supply-chain",
"notes": "TeamPCP Wave 6. Cascading from Bitwarden CLI compromise (Wave 5). Preinstall hook downloads Bun 1.3.13, executes 11.7MB obfuscated JS (PBKDF2+SHA256 cipher, salt 'ctf-scramble-v2'). Steals credentials from 39+ file paths (GitHub, npm, AWS, Azure, GCP, SSH, Kubernetes, Terraform, crypto wallets, FileZilla). Exfiltrates via victim's own GitHub account (creates public repos with description 'A Mini Shai-Hulud has Appeared'). Injects Claude Code SessionStart hooks and VS Code folderOpen tasks for persistence. Installs self-hosted GHA runner named 'SHA1HULUD' with discussion.yaml C2 workflow. SAP CI abused via OIDC token exchange to publish @cap-js packages.",
"packages": {
"@cap-js/db-service": ["2.10.1"],
"@cap-js/postgres": ["2.2.2"],
"@cap-js/sqlite": ["2.2.2"],
"mbt": ["1.2.48"]
}
},
"tanstack_shai_hulud_may_2026": {
"title": "Mini Shai-Hulud: TanStack Router Worm (TeamPCP Wave 7)",
"ecosystem": "npm",
"disclosed": "2026-05-11",
"family": "self-propagating worm + credential stealer + provenance forging",
"reference": "https://github.com/TanStack/router/security/advisories/GHSA-g7cv-rxg3-hmpx",
"notes": "CVE-2026-45321 (CVSS 9.6). CI pipeline hijack via pull_request_target + cache poisoning + OIDC memory extraction from runner /proc/pid/mem. 42 TanStack packages, 84 versions in 6-minute window. Payload: 2.3MB obfuscated router_init.js with beautify() AES decryption. Steals AWS, GCP, K8s, Vault, npm, GitHub, SSH, AI configs, browser passwords, crypto wallets. Exfiltrates via Session P2P (getsession.org). Self-propagates by republishing victim npm packages with forged Sigstore/SLSA provenance. Dead-man wiper: find ~ -type f -writable | xargs shred.",
"packages": {
"@tanstack/history": ["1.161.9", "1.161.12"],
"@tanstack/router-utils": ["1.161.11", "1.161.14"],
"@tanstack/router-core": ["1.169.5", "1.169.8"],
"@tanstack/router-devtools-core": ["1.167.6", "1.167.9"],
"@tanstack/react-router-devtools": ["1.166.16", "1.166.19"],
"@tanstack/router-generator": ["1.166.45", "1.166.48"],
"@tanstack/virtual-file-routes": ["1.161.10", "1.161.13"],
"@tanstack/router-plugin": ["1.167.38", "1.167.41"],
"@tanstack/react-router": ["1.169.5", "1.169.8"],
"@tanstack/router-devtools": ["1.166.16", "1.166.19"],
"@tanstack/react-start": ["1.167.68", "1.167.71"],
"@tanstack/router-cli": ["1.166.46", "1.166.49"],
"@tanstack/router-vite-plugin": ["1.166.53", "1.166.56"],
"@tanstack/solid-router": ["1.169.5", "1.169.8"],
"@tanstack/vue-router": ["1.169.5", "1.169.8"],
"@tanstack/arktype-adapter": ["1.166.1", "1.166.15"],
"@tanstack/eslint-plugin-router": ["1.111.9", "1.111.12"],
"@tanstack/eslint-plugin-start": ["0.0.4", "0.0.7"],
"@tanstack/nitro-v2-vite-plugin": ["1.154.12", "1.154.15"],
"@tanstack/react-router-ssr-query": ["1.166.15", "1.166.18"],
"@tanstack/react-start-client": ["1.166.51", "1.166.54"],
"@tanstack/react-start-rsc": ["0.0.47", "0.0.50"],
"@tanstack/react-start-server": ["1.166.55", "1.166.58"],
"@tanstack/setup": ["*"]
}
},
"tanstack_secondary_victims_may_2026": {
"title": "Mini Shai-Hulud: Secondary Victims (Worm Propagation from TanStack)",
"ecosystem": "npm",
"disclosed": "2026-05-11",
"family": "self-propagating worm + credential stealer",
"reference": "https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack",
"notes": "Packages compromised via worm propagation from TanStack. 373+ malicious versions across 169+ packages including @mistralai/mistralai, @opensearch-project/opensearch, 65+ @uipath/* packages. Specific affected versions not yet enumerated here; use --update-vulns for live OSV data. IOC detection via router_init.js payload filename and getsession.org exfil domain provides coverage independent of version pinning.",
"packages": {}
},
"node_ipc_credential_stealer_may_2026": {
"title": "node-ipc credential stealer (May 2026)",
"ecosystem": "npm",
"disclosed": "2026-05-14",
"family": "credential harvester",
"reference": "https://socket.dev/blog/node-ipc-credential-stealer-may-2026",
"notes": "IIFE appended to CJS entrypoint, no install hooks, credential harvester, DNS exfil. Dormant maintainer account takeover via expired domain re-registration (Jan 2025 expiry, May 7 2026 re-registration). Socket Research disclosure May 14 2026.",
"packages": {
"node-ipc": ["9.1.6", "9.2.3", "12.0.1"]
}
},
"canisterworm_icp_apr_2026": {
"title": "CanisterWorm ICP blockchain C2 (Apr 2026)",
"ecosystem": "npm",
"disclosed": "2026-04-22",
"family": "self-propagating worm + blockchain C2",
"reference": "https://keepsecurelabs.com/canisterworm-icp-c2",
"notes": "ICP blockchain C2 at canister cjn37-uyaaa-aaaac-qgnva-cai.raw.icp0.io. No domain seizure possible, no hosting provider takedown. Keepsecure Labs disclosure April 22 2026.",
"packages": {}
},
"shai_hulud_copycats_may_2026": {
"title": "Shai-Hulud open-source copycat packages (May 2026)",
"ecosystem": "npm",
"disclosed": "2026-05-12",
"family": "self-propagating worm (copycat)",
"reference": "https://github.com/TeamPCP/shai-hulud",
"notes": "Copycat packages using modified C2, based on open-sourced Shai-Hulud worm code published by TeamPCP on GitHub (MIT license) with $1K bounty contest. May 12 2026.",
"packages": {
"chalk-tempalte": ["*"],
"@deadcode09284814/axios-util": ["*"],
"axois-utils": ["*"],
"color-style-utils": ["*"]
}
},
"nx_console_vscode_may_2026": {
"title": "VS Code nrwl.angular-console extension compromise (May 2026)",
"ecosystem": "npm",
"disclosed": "2026-05-18",
"family": "credential stealer + VS Code extension compromise",
"reference": "https://step.security/blog/nrwl-angular-console-vscode-compromise-may-2026",
"notes": "VS Code extension compromise. Stolen credentials from TanStack @tanstack/zod-adapter infection (7-day dwell time). Targets ~/.claude/settings.json. Led to exfiltration of ~3800 GitHub internal repos. 11-minute window, ~6000 activations via auto-update. StepSecurity disclosure May 18 2026.",
"packages": {
"nrwl.angular-console": ["18.95.0"]
}
},
"antv_worm_propagation_may_2026": {
"title": "Mini Shai-Hulud: AntV/ECharts Worm Propagation (May 2026)",
"ecosystem": "npm",
"disclosed": "2026-05-19",
"family": "self-propagating worm + credential stealer + provenance forging",
"reference": "https://socket.dev/blog/antv-echarts-worm-propagation-may-2026",
"notes": "Worm propagation from TanStack compromise. 320+ packages, 639 malicious versions, 59M monthly downloads affected. Preinstall hook installs Bun runtime, writes persistence to .claude/ directories, forges SLSA provenance. May 19 2026.",
"packages": {
"echarts-for-react": ["1.3.7"],
"@antv/g2": ["5.2.8"],
"@antv/g6": ["5.0.28"],
"timeago.js": ["4.0.3"]
}
},
"vpmdhaj_opensearch_typosquats_may_2026": {
"title": "vpmdhaj OpenSearch/Elastic typosquat credential-stealer cluster",
"ecosystem": "npm",
"disclosed": "2026-05-28",
"family": "typosquat credential stealer + cloud/CI secret harvester",
"reference": "https://www.microsoft.com/en-us/security/blog/2026/05/28/typosquatted-npm-packages-used-steal-cloud-ci-cd-secrets/",
"notes": "Microsoft Threat Intelligence reported 14 npm packages published by alias vpmdhaj, with more than 1700 downloads. Payload used Bun, cloud metadata access, npm token enumeration, Secret Manager enumeration, X-Supply HTTP header, aab.sportsontheweb.net C2, payload.bin, opensearch_init.js/ai_init.js, and __DAEMONIZED=1.",
"packages": {
"@vpmdhaj/elastic-helper": ["1.0.7269"],
"@vpmdhaj/devops-tools": ["1.0.7267"],
"@vpmdhaj/opensearch-setup": ["1.0.7267"],
"@vpmdhaj/search-setup": ["1.0.7268"],
"opensearch-security-scanner": ["1.0.10"],
"opensearch-setup": ["1.0.9103"],
"opensearch-setup-tool": ["1.0.9108"],
"opensearch-config-utility": ["1.0.9106"],
"search-engine-setup": ["1.0.9108"],
"search-cluster-setup": ["1.0.9104"],
"elastic-opensearch-helper": ["1.0.9108"],
"vpmdhaj-opensearch-setup": ["1.0.9102"],
"env-config-manager": ["2.1.9201"],
"app-config-utility": ["1.0.9300"]
}
},
"miasma_redhat_cloud_services_jun_2026": {
"title": "Miasma / Red Hat Cloud Services supply-chain compromise",
"ecosystem": "npm",
"disclosed": "2026-06-02",
"family": "trusted namespace compromise + lifecycle credential stealer + worm propagation",
"reference": "https://www.microsoft.com/en-us/security/blog/2026/06/02/preinstall-persistence-inside-red-hat-npm-miasma-credential-stealing-campaign/",
"notes": "Microsoft Threat Intelligence reported 32 maliciously modified @redhat-cloud-services packages across more than 90 versions. The packages carried authentic provenance signatures from a legitimate GitHub Actions OIDC publishing workflow, used npm preinstall, downloaded Bun, harvested GitHub/npm/cloud/Vault/Kubernetes/developer credentials, scraped runner memory, and attempted worm-like republishing with forged Sigstore/SLSA provenance.",
"packages": {
"@redhat-cloud-services/types": ["3.6.1", "3.6.2", "3.6.4"],
"@redhat-cloud-services/frontend-components-utilities": ["7.4.1", "7.4.2", "7.4.4"],
"@redhat-cloud-services/frontend-components": ["7.7.2", "7.7.3", "7.7.5"],
"@redhat-cloud-services/rbac-client": ["9.0.3", "9.0.4", "9.0.6"],
"@redhat-cloud-services/javascript-clients-shared": ["2.0.8", "2.0.9", "2.0.11"],
"@redhat-cloud-services/frontend-components-config-utilities": ["4.11.2", "4.11.3", "4.11.5"],
"@redhat-cloud-services/frontend-components-notifications": ["6.9.2", "6.9.3", "6.9.5"],
"@redhat-cloud-services/tsc-transform-imports": ["1.2.2", "1.2.4", "1.2.6"],
"@redhat-cloud-services/frontend-components-config": ["6.11.3", "6.11.4", "6.11.6"],
"@redhat-cloud-services/eslint-config-redhat-cloud-services": ["3.2.1", "3.2.2", "3.2.4"],
"@redhat-cloud-services/host-inventory-client": ["5.0.3", "5.0.4", "5.0.6"],
"@redhat-cloud-services/rule-components": ["4.7.2", "4.7.3", "4.7.5"],
"@redhat-cloud-services/frontend-components-remediations": ["4.9.2", "4.9.3", "4.9.5"],
"@redhat-cloud-services/frontend-components-translations": ["4.4.1", "4.4.2", "4.4.4"],
"@redhat-cloud-services/vulnerabilities-client": ["2.1.9", "2.1.11"],
"@redhat-cloud-services/frontend-components-advisor-components": ["3.8.2", "3.8.4", "3.8.6"],
"@redhat-cloud-services/entitlements-client": ["4.0.11", "4.0.12", "4.0.14"],
"@redhat-cloud-services/chrome": ["2.3.1", "2.3.2", "2.3.4"],
"@redhat-cloud-services/notifications-client": ["6.1.4", "6.1.5", "6.1.7"],
"@redhat-cloud-services/compliance-client": ["4.0.3", "4.0.4", "4.0.6"],
"@redhat-cloud-services/sources-client": ["3.0.10", "3.0.11", "3.0.13"],
"@redhat-cloud-services/integrations-client": ["6.0.4", "6.0.5", "6.0.7"],
"@redhat-cloud-services/frontend-components-testing": ["1.2.1", "1.2.2", "1.2.4"],
"@redhat-cloud-services/remediations-client": ["4.0.4", "4.0.5", "4.0.7"],
"@redhat-cloud-services/insights-client": ["4.0.4", "4.0.5", "4.0.7"],
"@redhat-cloud-services/topological-inventory-client": ["3.0.10", "3.0.11", "3.0.13"],
"@redhat-cloud-services/config-manager-client": ["5.0.4", "5.0.5", "5.0.7"],
"@redhat-cloud-services/hcc-pf-mcp": ["0.6.1", "0.6.2", "0.6.4"],
"@redhat-cloud-services/quickstarts-client": ["4.0.11", "4.0.12", "4.0.14"],
"@redhat-cloud-services/patch-client": ["4.0.4", "4.0.5", "4.0.7"],
"@redhat-cloud-services/hcc-feo-mcp": ["0.3.1", "0.3.2", "0.3.4"],
"@redhat-cloud-services/hcc-kessel-mcp": ["0.3.1", "0.3.2", "0.3.4"]
}
}
}
}
skills/repo-forensics/data/
Static IOC data shipped with the repo-forensics skill. Files here are loaded at runtime by ioc_manager.py. They are NOT fetched from external sources at scan time and they MUST NOT be loaded from paths outside this directory.
What lives here
compromised_versions.json— version-pinned and entirely-malicious package
IOCs organized by supply-chain campaign. See the file's top-level description and schema_version fields. Loaded by ioc_manager._load_compromised_versions_file().
Schema versioning
Every file here must declare a schema_version field at the top level. Loaders gate on the major version — e.g. ioc_manager accepts 1.x and rejects 2.x with a warning. Bump the major version when making a backwards-incompatible change to the structure.
Provenance
Entries are sourced from public vendor research (Socket, Snyk, Check Point, JFrog, ReversingLabs, CISA, OWASP). Each campaign in compromised_versions.json carries a reference URL pointing to the original disclosure.
Review discipline
This directory is git-tracked. Changes are reviewed line-by-line like any other source file. Do not drop large untrusted datasets here; they belong in the remote IOC feed (iocs/latest.json on GitHub) which has its own update channel.
rule_id,scanner,category,source_file,table_name,index,severity_hint
AS-GEN-001,AS,GEN,scan_agent_skills.py,CONFIG_WRITE_PATTERNS,0,
AS-GEN-002,AS,GEN,scan_agent_skills.py,CONFIG_WRITE_PATTERNS,1,
AS-GEN-003,AS,GEN,scan_agent_skills.py,CONFIG_WRITE_PATTERNS,2,
AS-GEN-004,AS,GEN,scan_agent_skills.py,MEMORY_POISONING_PATTERNS,0,
AS-GEN-005,AS,GEN,scan_agent_skills.py,MEMORY_POISONING_PATTERNS,1,
AS-GEN-006,AS,GEN,scan_agent_skills.py,MEMORY_POISONING_PATTERNS,2,
AS-GEN-007,AS,GEN,scan_agent_skills.py,MEMORY_POISONING_PATTERNS,3,
AS-GEN-008,AS,GEN,scan_agent_skills.py,PROVENANCE_STRIP_PATTERNS,0,
AS-GEN-009,AS,GEN,scan_agent_skills.py,PROVENANCE_STRIP_PATTERNS,1,
DC-GEN-001,DC,GEN,scan_devcontainer.py,SECRET_PATHS,0,
DC-GEN-002,DC,GEN,scan_devcontainer.py,SECRET_PATHS,1,
DC-GEN-003,DC,GEN,scan_devcontainer.py,SECRET_PATHS,2,
DC-GEN-004,DC,GEN,scan_devcontainer.py,SECRET_PATHS,3,
DC-GEN-005,DC,GEN,scan_devcontainer.py,SECRET_PATHS,4,
DC-GEN-006,DC,GEN,scan_devcontainer.py,SECRET_PATHS,5,
DC-GEN-007,DC,GEN,scan_devcontainer.py,SECRET_PATHS,6,
DC-GEN-008,DC,GEN,scan_devcontainer.py,SECRET_PATHS,7,
LC-GEN-001,LC,GEN,scan_lifecycle.py,PASTE_SERVICE_PATTERNS,0,
LC-GEN-002,LC,GEN,scan_lifecycle.py,PASTE_SERVICE_PATTERNS,1,
LC-GEN-003,LC,GEN,scan_lifecycle.py,PASTE_SERVICE_PATTERNS,2,
LC-GEN-004,LC,GEN,scan_lifecycle.py,PASTE_SERVICE_PATTERNS,3,
LC-GEN-005,LC,GEN,scan_lifecycle.py,PASTE_SERVICE_PATTERNS,4,
LC-GEN-006,LC,GEN,scan_lifecycle.py,AGENT_CONFIG_DIR_PATTERNS,0,
LC-GEN-007,LC,GEN,scan_lifecycle.py,AGENT_CONFIG_DIR_PATTERNS,1,
LC-GEN-008,LC,GEN,scan_lifecycle.py,AGENT_CONFIG_DIR_PATTERNS,2,
LC-GEN-009,LC,GEN,scan_lifecycle.py,AGENT_CONFIG_DIR_PATTERNS,3,
LC-GEN-010,LC,GEN,scan_lifecycle.py,AGENT_CONFIG_DIR_PATTERNS,4,
LC-GEN-011,LC,GEN,scan_lifecycle.py,AGENT_CONFIG_DIR_PATTERNS,5,
LC-GEN-012,LC,GEN,scan_lifecycle.py,ANTI_FORENSICS_PATTERNS,0,
LC-GEN-013,LC,GEN,scan_lifecycle.py,ANTI_FORENSICS_PATTERNS,1,
LC-GEN-014,LC,GEN,scan_lifecycle.py,ANTI_FORENSICS_PATTERNS,2,
LC-GEN-015,LC,GEN,scan_lifecycle.py,ANTI_FORENSICS_PATTERNS,3,
LC-GEN-016,LC,GEN,scan_lifecycle.py,ANTI_FORENSICS_PATTERNS,4,
LC-GEN-017,LC,GEN,scan_lifecycle.py,ANTI_FORENSICS_PATTERNS,5,
LC-GEN-018,LC,GEN,scan_lifecycle.py,INSTALL_SCRIPT_IOC_PATTERNS,0,
LC-GEN-019,LC,GEN,scan_lifecycle.py,INSTALL_SCRIPT_IOC_PATTERNS,1,
LC-GEN-020,LC,GEN,scan_lifecycle.py,INSTALL_SCRIPT_IOC_PATTERNS,2,
LC-GEN-021,LC,GEN,scan_lifecycle.py,INSTALL_SCRIPT_IOC_PATTERNS,3,
LC-GEN-022,LC,GEN,scan_lifecycle.py,INSTALL_SCRIPT_IOC_PATTERNS,4,
LC-GEN-023,LC,GEN,scan_lifecycle.py,INSTALL_SCRIPT_IOC_PATTERNS,5,
LC-GEN-024,LC,GEN,scan_lifecycle.py,INSTALL_SCRIPT_IOC_PATTERNS,6,
LC-GEN-025,LC,GEN,scan_lifecycle.py,INSTALL_SCRIPT_IOC_PATTERNS,7,
LC-GEN-026,LC,GEN,scan_lifecycle.py,INSTALL_SCRIPT_IOC_PATTERNS,8,
LC-GEN-027,LC,GEN,scan_lifecycle.py,INSTALL_SCRIPT_IOC_PATTERNS,9,
LC-GEN-028,LC,GEN,scan_lifecycle.py,INSTALL_SCRIPT_IOC_PATTERNS,10,
LC-GEN-029,LC,GEN,scan_lifecycle.py,PTH_EXEC_PATTERNS,0,
LC-GEN-030,LC,GEN,scan_lifecycle.py,PTH_EXEC_PATTERNS,1,
LC-GEN-031,LC,GEN,scan_lifecycle.py,PTH_EXEC_PATTERNS,2,
LC-GEN-032,LC,GEN,scan_lifecycle.py,PTH_EXEC_PATTERNS,3,
LC-GEN-033,LC,GEN,scan_lifecycle.py,PTH_EXEC_PATTERNS,4,
LC-GEN-034,LC,GEN,scan_lifecycle.py,PTH_EXEC_PATTERNS,5,
MC-PI-001,MC,PI,scan_mcp_security.py,SQL_INJECTION_PATTERNS,0,
MC-PI-002,MC,PI,scan_mcp_security.py,SQL_INJECTION_PATTERNS,1,
MC-PI-003,MC,PI,scan_mcp_security.py,SQL_INJECTION_PATTERNS,2,
MC-PI-004,MC,PI,scan_mcp_security.py,SQL_INJECTION_PATTERNS,3,
MC-PI-005,MC,PI,scan_mcp_security.py,SQL_INJECTION_PATTERNS,4,
MC-PI-006,MC,PI,scan_mcp_security.py,SQL_INJECTION_PATTERNS,5,
MC-PI-007,MC,PI,scan_mcp_security.py,SQL_INJECTION_PATTERNS,6,
MC-PI-008,MC,PI,scan_mcp_security.py,SQL_INJECTION_PATTERNS,7,
MC-PI-009,MC,PI,scan_mcp_security.py,SQL_INJECTION_PATTERNS,8,
MC-PI-010,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,0,
MC-PI-011,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,1,
MC-PI-012,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,2,
MC-PI-013,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,3,
MC-PI-014,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,4,
MC-PI-015,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,5,
MC-PI-016,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,6,
MC-PI-017,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,7,
MC-PI-018,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,8,
MC-PI-019,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,9,
MC-PI-020,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,10,
MC-PI-021,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,11,
MC-PI-022,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,12,
MC-PI-023,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,13,
MC-PI-024,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,14,
MC-PI-025,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,15,
MC-PI-026,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,16,
MC-PI-027,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,17,
MC-PI-028,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,18,
MC-PI-029,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,19,
MC-PI-030,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,20,
MC-PI-031,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,21,
MC-PI-032,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,22,
MC-PI-033,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,23,
MC-PI-034,MC,PI,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,24,
MC-GEN-001,MC,GEN,scan_mcp_security.py,TOOL_SHADOWING_PATTERNS,0,
MC-GEN-002,MC,GEN,scan_mcp_security.py,TOOL_SHADOWING_PATTERNS,1,
MC-GEN-003,MC,GEN,scan_mcp_security.py,TOOL_SHADOWING_PATTERNS,2,
MC-GEN-004,MC,GEN,scan_mcp_security.py,TOOL_SHADOWING_PATTERNS,3,
MC-PI-035,MC,PI,scan_mcp_security.py,SAMPLING_INJECTION_PATTERNS,0,
MC-PI-036,MC,PI,scan_mcp_security.py,SAMPLING_INJECTION_PATTERNS,1,
MC-PI-037,MC,PI,scan_mcp_security.py,SAMPLING_INJECTION_PATTERNS,2,
MC-PI-038,MC,PI,scan_mcp_security.py,SAMPLING_INJECTION_PATTERNS,3,
MC-GEN-005,MC,GEN,scan_mcp_security.py,CROSS_DOMAIN_PATTERNS,0,
MC-GEN-006,MC,GEN,scan_mcp_security.py,CROSS_DOMAIN_PATTERNS,1,
MC-GEN-007,MC,GEN,scan_mcp_security.py,CROSS_DOMAIN_PATTERNS,2,
MC-GEN-008,MC,GEN,scan_mcp_security.py,CROSS_DOMAIN_PATTERNS,3,
MC-EX-001,MC,EX,scan_mcp_security.py,LOG_EXFIL_PATTERNS,0,
MC-EX-002,MC,EX,scan_mcp_security.py,LOG_EXFIL_PATTERNS,1,
MC-EX-003,MC,EX,scan_mcp_security.py,LOG_EXFIL_PATTERNS,2,
MC-EX-004,MC,EX,scan_mcp_security.py,LOG_EXFIL_PATTERNS,3,
MC-GEN-009,MC,GEN,scan_mcp_security.py,RUG_PULL_PATTERNS,0,
MC-GEN-010,MC,GEN,scan_mcp_security.py,RUG_PULL_PATTERNS,1,
MC-GEN-011,MC,GEN,scan_mcp_security.py,RUG_PULL_PATTERNS,2,
MC-GEN-012,MC,GEN,scan_mcp_security.py,RUG_PULL_PATTERNS,3,
MC-GEN-013,MC,GEN,scan_mcp_security.py,RUG_PULL_PATTERNS,4,
MC-GEN-014,MC,GEN,scan_mcp_security.py,RUG_PULL_PATTERNS,5,
MC-GEN-015,MC,GEN,scan_mcp_security.py,RUG_PULL_PATTERNS,6,
MC-GEN-016,MC,GEN,scan_mcp_security.py,RUG_PULL_PATTERNS,7,
SA-SAST-001,SA,SAST,scan_sast.py,SAST_PATTERNS,0,
SA-SAST-002,SA,SAST,scan_sast.py,SAST_PATTERNS,1,
SA-SAST-003,SA,SAST,scan_sast.py,SAST_PATTERNS,2,
SA-SAST-004,SA,SAST,scan_sast.py,SAST_PATTERNS,3,
SA-SAST-005,SA,SAST,scan_sast.py,SAST_PATTERNS,4,
SA-SAST-006,SA,SAST,scan_sast.py,SAST_PATTERNS,5,
SA-SAST-007,SA,SAST,scan_sast.py,SAST_PATTERNS,6,
SA-SAST-008,SA,SAST,scan_sast.py,SAST_PATTERNS,7,
SA-SAST-009,SA,SAST,scan_sast.py,SAST_PATTERNS,8,
SA-SAST-010,SA,SAST,scan_sast.py,SAST_PATTERNS,9,
SA-SAST-011,SA,SAST,scan_sast.py,SAST_PATTERNS,10,
SA-GEN-001,SA,GEN,scan_sast.py,CSS_STEG_PATTERNS,0,
SA-GEN-002,SA,GEN,scan_sast.py,CSS_STEG_PATTERNS,1,
SA-GEN-003,SA,GEN,scan_sast.py,CSS_STEG_PATTERNS,2,
SA-GEN-004,SA,GEN,scan_sast.py,CSS_STEG_PATTERNS,3,
SA-GEN-005,SA,GEN,scan_sast.py,CSS_STEG_PATTERNS,4,
SA-GEN-006,SA,GEN,scan_sast.py,CSS_STEG_PATTERNS,5,
SA-GEN-007,SA,GEN,scan_sast.py,CSS_STEG_PATTERNS,6,
SA-GEN-008,SA,GEN,scan_sast.py,CSS_STEG_PATTERNS,7,
SA-GEN-009,SA,GEN,scan_sast.py,CSS_STEG_PATTERNS,8,
ST-PI-001,ST,PI,scan_skill_threats.py,PROMPT_INJECTION_PATTERNS,0,
ST-PI-002,ST,PI,scan_skill_threats.py,PROMPT_INJECTION_PATTERNS,1,
ST-PI-003,ST,PI,scan_skill_threats.py,PROMPT_INJECTION_PATTERNS,2,
ST-PI-004,ST,PI,scan_skill_threats.py,PROMPT_INJECTION_PATTERNS,3,
ST-PI-005,ST,PI,scan_skill_threats.py,PROMPT_INJECTION_PATTERNS,4,
ST-PI-006,ST,PI,scan_skill_threats.py,PROMPT_INJECTION_PATTERNS,5,
ST-PI-007,ST,PI,scan_skill_threats.py,PROMPT_INJECTION_PATTERNS,6,
ST-PI-008,ST,PI,scan_skill_threats.py,PROMPT_INJECTION_PATTERNS,7,
ST-PI-009,ST,PI,scan_skill_threats.py,PROMPT_INJECTION_PATTERNS,8,
ST-PI-010,ST,PI,scan_skill_threats.py,PROMPT_INJECTION_PATTERNS,9,
ST-PI-011,ST,PI,scan_skill_threats.py,PROMPT_INJECTION_PATTERNS,10,
ST-PI-012,ST,PI,scan_skill_threats.py,PROMPT_INJECTION_PATTERNS,11,
ST-PI-013,ST,PI,scan_skill_threats.py,PROMPT_INJECTION_PATTERNS,12,
ST-HG-001,ST,HG,scan_skill_threats.py,HOMOGLYPHS,0,
ST-HG-002,ST,HG,scan_skill_threats.py,HOMOGLYPHS,1,
ST-HG-003,ST,HG,scan_skill_threats.py,HOMOGLYPHS,2,
ST-HG-004,ST,HG,scan_skill_threats.py,HOMOGLYPHS,3,
ST-HG-005,ST,HG,scan_skill_threats.py,HOMOGLYPHS,4,
ST-HG-006,ST,HG,scan_skill_threats.py,HOMOGLYPHS,5,
ST-HG-007,ST,HG,scan_skill_threats.py,HOMOGLYPHS,6,
ST-HG-008,ST,HG,scan_skill_threats.py,HOMOGLYPHS,7,
ST-HG-009,ST,HG,scan_skill_threats.py,HOMOGLYPHS,8,
ST-HG-010,ST,HG,scan_skill_threats.py,HOMOGLYPHS,9,
ST-HG-011,ST,HG,scan_skill_threats.py,HOMOGLYPHS,10,
ST-HG-012,ST,HG,scan_skill_threats.py,HOMOGLYPHS,11,
ST-HG-013,ST,HG,scan_skill_threats.py,HOMOGLYPHS,12,
ST-HG-014,ST,HG,scan_skill_threats.py,HOMOGLYPHS,13,
ST-HG-015,ST,HG,scan_skill_threats.py,HOMOGLYPHS,14,
ST-HG-016,ST,HG,scan_skill_threats.py,HOMOGLYPHS,15,
ST-HG-017,ST,HG,scan_skill_threats.py,HOMOGLYPHS,16,
ST-PR-001,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,0,
ST-PR-002,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,1,
ST-PR-003,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,2,
ST-PR-004,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,3,
ST-PR-005,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,4,
ST-PR-006,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,5,
ST-PR-007,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,6,
ST-PR-008,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,7,
ST-PR-009,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,8,
ST-PR-010,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,9,
ST-PR-011,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,10,
ST-PR-012,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,11,
ST-PR-013,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,12,
ST-PR-014,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,13,
ST-PR-015,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,14,
ST-PR-016,ST,PR,scan_skill_threats.py,PREREQUISITE_PATTERNS,15,
ST-EX-001,ST,EX,scan_skill_threats.py,EXFIL_PATTERNS,0,
ST-EX-002,ST,EX,scan_skill_threats.py,EXFIL_PATTERNS,1,
ST-EX-003,ST,EX,scan_skill_threats.py,EXFIL_PATTERNS,2,
ST-EX-004,ST,EX,scan_skill_threats.py,EXFIL_PATTERNS,3,
ST-CR-001,ST,CR,scan_skill_threats.py,CREDENTIAL_PATH_PATTERNS,0,
ST-CR-002,ST,CR,scan_skill_threats.py,CREDENTIAL_PATH_PATTERNS,1,
ST-PE-001,ST,PE,scan_skill_threats.py,PERSISTENCE_PATTERNS,0,
ST-PE-002,ST,PE,scan_skill_threats.py,PERSISTENCE_PATTERNS,1,
ST-PE-003,ST,PE,scan_skill_threats.py,PERSISTENCE_PATTERNS,2,
ST-PE-004,ST,PE,scan_skill_threats.py,PERSISTENCE_PATTERNS,3,
ST-PE-005,ST,PE,scan_skill_threats.py,PERSISTENCE_PATTERNS,4,
ST-PE-006,ST,PE,scan_skill_threats.py,PERSISTENCE_PATTERNS,5,
ST-PE-007,ST,PE,scan_skill_threats.py,PERSISTENCE_PATTERNS,6,
ST-PE-008,ST,PE,scan_skill_threats.py,PERSISTENCE_PATTERNS,7,
ST-PE-009,ST,PE,scan_skill_threats.py,PERSISTENCE_PATTERNS,8,
ST-SP-001,ST,SP,scan_skill_threats.py,SCOPE_PATTERNS,0,
ST-SP-002,ST,SP,scan_skill_threats.py,SCOPE_PATTERNS,1,
ST-SP-003,ST,SP,scan_skill_threats.py,SCOPE_PATTERNS,2,
ST-SP-004,ST,SP,scan_skill_threats.py,SCOPE_PATTERNS,3,
ST-SP-005,ST,SP,scan_skill_threats.py,SCOPE_PATTERNS,4,
ST-SP-006,ST,SP,scan_skill_threats.py,SCOPE_PATTERNS,5,
ST-SP-007,ST,SP,scan_skill_threats.py,SCOPE_PATTERNS,6,
ST-ST-001,ST,ST,scan_skill_threats.py,STEALTH_PATTERNS,0,
ST-ST-002,ST,ST,scan_skill_threats.py,STEALTH_PATTERNS,1,
ST-ST-003,ST,ST,scan_skill_threats.py,STEALTH_PATTERNS,2,
ST-ST-004,ST,ST,scan_skill_threats.py,STEALTH_PATTERNS,3,
ST-ST-005,ST,ST,scan_skill_threats.py,STEALTH_PATTERNS,4,
ST-RB-001,ST,RB,scan_skill_threats.py,KNOWN_RAT_BINARY_PATHS,0,
ST-CF-001,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,0,
ST-CF-002,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,1,
ST-CF-003,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,2,
ST-CF-004,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,3,
ST-CF-005,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,4,
ST-CF-006,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,5,
ST-CF-007,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,6,
ST-CF-008,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,7,
ST-CF-009,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,8,
ST-CF-010,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,9,
ST-CF-011,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,10,
ST-CF-012,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,11,
ST-CF-013,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,12,
ST-CF-014,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,13,
ST-CF-015,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,14,
ST-CF-016,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,15,
ST-CF-017,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,16,
ST-CF-018,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,17,
ST-CF-019,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,18,
ST-CF-020,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,19,
ST-CF-021,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,20,
ST-CF-022,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,21,
ST-CF-023,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,22,
ST-CF-024,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,23,
ST-CF-025,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,24,
ST-CF-026,ST,CF,scan_skill_threats.py,CLICKFIX_PATTERNS,25,
ST-PI-014,ST,PI,scan_skill_threats.py,MCP_TOOL_INJECTION_PATTERNS,0,
ST-PI-015,ST,PI,scan_skill_threats.py,MCP_TOOL_INJECTION_PATTERNS,1,
ST-PI-016,ST,PI,scan_skill_threats.py,MCP_TOOL_INJECTION_PATTERNS,2,
ST-PI-017,ST,PI,scan_skill_threats.py,MCP_TOOL_INJECTION_PATTERNS,3,
ST-PI-018,ST,PI,scan_skill_threats.py,MCP_TOOL_INJECTION_PATTERNS,4,
ST-SA-001,ST,SA,scan_skill_threats.py,SUB_AGENT_SPAWN_PATTERNS,0,
ST-SA-002,ST,SA,scan_skill_threats.py,SUB_AGENT_SPAWN_PATTERNS,1,
ST-SA-003,ST,SA,scan_skill_threats.py,SUB_AGENT_SPAWN_PATTERNS,2,
ST-SA-004,ST,SA,scan_skill_threats.py,SUB_AGENT_SPAWN_PATTERNS,3,
ST-AU-001,ST,AU,scan_skill_threats.py,AUTHORITY_FRAMING_PATTERNS,0,
ST-AU-002,ST,AU,scan_skill_threats.py,AUTHORITY_FRAMING_PATTERNS,1,
ST-AU-003,ST,AU,scan_skill_threats.py,AUTHORITY_FRAMING_PATTERNS,2,
ST-AU-004,ST,AU,scan_skill_threats.py,AUTHORITY_FRAMING_PATTERNS,3,
ST-ST-006,ST,ST,scan_skill_threats.py,SAFETY_THEATER_PATTERNS,0,
ST-ST-007,ST,ST,scan_skill_threats.py,SAFETY_THEATER_PATTERNS,1,
ST-ST-008,ST,ST,scan_skill_threats.py,SAFETY_THEATER_PATTERNS,2,
ST-TE-001,ST,TE,scan_skill_threats.py,TRUST_ESCALATION_PATTERNS,0,
ST-TE-002,ST,TE,scan_skill_threats.py,TRUST_ESCALATION_PATTERNS,1,
ST-UC-001,ST,UC,scan_skill_threats.py,UPDATE_CHANNEL_PATTERNS,0,
ST-UC-002,ST,UC,scan_skill_threats.py,UPDATE_CHANNEL_PATTERNS,1,
ST-UC-003,ST,UC,scan_skill_threats.py,UPDATE_CHANNEL_PATTERNS,2,
ST-UC-004,ST,UC,scan_skill_threats.py,UPDATE_CHANNEL_PATTERNS,3,
ST-UC-005,ST,UC,scan_skill_threats.py,UPDATE_CHANNEL_PATTERNS,4,
SC-KEY-001,SC,private-key,scan_secrets.py,PATTERNS,,critical
SC-SEC-001,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-002,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-003,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-004,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-005,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-006,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-007,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-008,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-009,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-010,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-011,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-012,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-013,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-014,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-015,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-016,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-017,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-018,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-019,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-020,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-021,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-022,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-023,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-024,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-025,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-026,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-027,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-028,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-029,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-030,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-031,SC,secret,scan_secrets.py,PATTERNS,,critical
SC-SEC-032,SC,secret,scan_secrets.py,PATTERNS,,critical
SC-SEC-033,SC,secret,scan_secrets.py,PATTERNS,,critical
SC-SEC-034,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-035,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-036,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-037,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-038,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-039,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-040,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-041,SC,secret,scan_secrets.py,PATTERNS,,high
SC-SEC-042,SC,secret,scan_secrets.py,PATTERNS,,medium
SC-SEC-043,SC,secret,scan_secrets.py,PATTERNS,,medium
SC-SEC-044,SC,secret,scan_secrets.py,PATTERNS,,medium
SC-NET-001,SC,network,scan_secrets.py,PATTERNS,,low
SA-PY-001,SA,code-execution,scan_sast.py,SAST_PATTERNS,,high
SA-PY-002,SA,code-execution,scan_sast.py,SAST_PATTERNS,,high
SA-PY-003,SA,code-execution,scan_sast.py,SAST_PATTERNS,,high
SA-PY-004,SA,code-execution,scan_sast.py,SAST_PATTERNS,,medium
SA-PY-005,SA,deserialization,scan_sast.py,SAST_PATTERNS,,critical
SA-PY-006,SA,shell-injection,scan_sast.py,SAST_PATTERNS,,critical
SA-PY-007,SA,shell-injection,scan_sast.py,SAST_PATTERNS,,critical
SA-PY-008,SA,injection,scan_sast.py,SAST_PATTERNS,,high
SA-PY-009,SA,hardcoded,scan_sast.py,SAST_PATTERNS,,low
SA-PY-010,SA,model-confusion,scan_sast.py,SAST_PATTERNS,,high
SA-PY-011,SA,model-confusion,scan_sast.py,SAST_PATTERNS,,critical
SA-PY-012,SA,model-confusion,scan_sast.py,SAST_PATTERNS,,critical
SA-PY-013,SA,model-confusion,scan_sast.py,SAST_PATTERNS,,high
SA-PY-014,SA,destructive-command,scan_sast.py,SAST_PATTERNS,,critical
SA-PY-015,SA,worm-propagation,scan_sast.py,SAST_PATTERNS,,critical
SA-PY-016,SA,kernel-exploit,scan_sast.py,SAST_PATTERNS,,critical
SA-PY-017,SA,kernel-exploit,scan_sast.py,SAST_PATTERNS,,critical
SA-PY-018,SA,kernel-exploit,scan_sast.py,SAST_PATTERNS,,high
SA-PY-019,SA,reflection-rce,scan_sast.py,SAST_PATTERNS,,high
SA-PY-020,SA,memory-forensics,scan_sast.py,SAST_PATTERNS,,critical
SA-PY-021,SA,process-enumeration,scan_sast.py,SAST_PATTERNS,,high
SA-PY-022,SA,process-enumeration,scan_sast.py,SAST_PATTERNS,,critical
SA-PY-023,SA,ci-token-abuse,scan_sast.py,SAST_PATTERNS,,critical
SA-JS-001,SA,code-execution,scan_sast.py,SAST_PATTERNS,,high
SA-JS-002,SA,code-execution,scan_sast.py,SAST_PATTERNS,,high
SA-JS-003,SA,xss,scan_sast.py,SAST_PATTERNS,,high
SA-JS-004,SA,xss,scan_sast.py,SAST_PATTERNS,,medium
SA-JS-005,SA,shell-injection,scan_sast.py,SAST_PATTERNS,,critical
SA-JS-006,SA,code-execution,scan_sast.py,SAST_PATTERNS,,medium
SA-JS-007,SA,xss,scan_sast.py,SAST_PATTERNS,,medium
SA-JS-008,SA,injection,scan_sast.py,SAST_PATTERNS,,high
SA-JS-009,SA,secret-exposure,scan_sast.py,SAST_PATTERNS,,high
SA-JS-010,SA,secret-exposure,scan_sast.py,SAST_PATTERNS,,high
SA-JS-011,SA,secret-exposure,scan_sast.py,SAST_PATTERNS,,high
SA-JS-012,SA,path-traversal,scan_sast.py,SAST_PATTERNS,,high
SA-JS-013,SA,path-traversal,scan_sast.py,SAST_PATTERNS,,high
SA-JS-014,SA,path-traversal,scan_sast.py,SAST_PATTERNS,,high
SA-JS-015,SA,worm-propagation,scan_sast.py,SAST_PATTERNS,,critical
SA-JS-016,SA,worm-propagation,scan_sast.py,SAST_PATTERNS,,critical
SA-JS-017,SA,credential-theft,scan_sast.py,SAST_PATTERNS,,critical
SA-JS-018,SA,git-exfiltration,scan_sast.py,SAST_PATTERNS,,critical
SA-JS-019,SA,git-exfiltration,scan_sast.py,SAST_PATTERNS,,high
SA-JS-020,SA,git-exfiltration,scan_sast.py,SAST_PATTERNS,,critical
SA-JS-021,SA,ci-token-abuse,scan_sast.py,SAST_PATTERNS,,critical
SA-JS-022,SA,memory-forensics,scan_sast.py,SAST_PATTERNS,,critical
SA-JS-023,SA,process-enumeration,scan_sast.py,SAST_PATTERNS,,high
SA-JS-024,SA,process-enumeration,scan_sast.py,SAST_PATTERNS,,critical
SA-JS-025,SA,obfuscation,scan_sast.py,SAST_PATTERNS,,high
SA-JS-026,SA,credential-validation,scan_sast.py,SAST_PATTERNS,,high
SA-JS-027,SA,credential-theft,scan_sast.py,SAST_PATTERNS,,high
SA-JS-028,SA,credential-theft,scan_sast.py,SAST_PATTERNS,,critical
SA-JS-029,SA,exfiltration,scan_sast.py,SAST_PATTERNS,,critical
SA-JS-030,SA,provenance-forging,scan_sast.py,SAST_PATTERNS,,critical
SA-JS-031,SA,provenance-forging,scan_sast.py,SAST_PATTERNS,,high
SA-JS-032,SA,worm-propagation,scan_sast.py,SAST_PATTERNS,,critical
SA-JS-033,SA,obfuscation,scan_sast.py,SAST_PATTERNS,,high
SA-JS-034,SA,destructive-command,scan_sast.py,SAST_PATTERNS,,critical
SA-TS-001,SA,code-execution,scan_sast.py,SAST_PATTERNS,,high
SA-TS-002,SA,code-execution,scan_sast.py,SAST_PATTERNS,,high
SA-TS-003,SA,xss,scan_sast.py,SAST_PATTERNS,,high
SA-TS-004,SA,shell-injection,scan_sast.py,SAST_PATTERNS,,critical
SA-TS-005,SA,secret-exposure,scan_sast.py,SAST_PATTERNS,,high
SA-TS-006,SA,secret-exposure,scan_sast.py,SAST_PATTERNS,,high
SA-TS-007,SA,path-traversal,scan_sast.py,SAST_PATTERNS,,high
SA-TS-008,SA,path-traversal,scan_sast.py,SAST_PATTERNS,,high
SA-TS-009,SA,path-traversal,scan_sast.py,SAST_PATTERNS,,high
SA-TS-010,SA,exfiltration,scan_sast.py,SAST_PATTERNS,,critical
SA-TS-011,SA,memory-forensics,scan_sast.py,SAST_PATTERNS,,critical
SA-TS-012,SA,process-enumeration,scan_sast.py,SAST_PATTERNS,,high
SA-TS-013,SA,process-enumeration,scan_sast.py,SAST_PATTERNS,,critical
SA-TS-014,SA,ci-token-abuse,scan_sast.py,SAST_PATTERNS,,critical
SA-TSX-001,SA,code-execution,scan_sast.py,SAST_PATTERNS,,high
SA-TSX-002,SA,xss,scan_sast.py,SAST_PATTERNS,,high
SA-JSX-001,SA,code-execution,scan_sast.py,SAST_PATTERNS,,high
SA-JSX-002,SA,xss,scan_sast.py,SAST_PATTERNS,,high
SA-PHP-001,SA,shell-injection,scan_sast.py,SAST_PATTERNS,,critical
SA-PHP-002,SA,code-execution,scan_sast.py,SAST_PATTERNS,,high
SA-PHP-003,SA,injection,scan_sast.py,SAST_PATTERNS,,high
SA-PHP-004,SA,injection,scan_sast.py,SAST_PATTERNS,,critical
SA-JAVA-001,SA,shell-injection,scan_sast.py,SAST_PATTERNS,,critical
SA-JAVA-002,SA,shell-injection,scan_sast.py,SAST_PATTERNS,,high
SA-JAVA-003,SA,deserialization,scan_sast.py,SAST_PATTERNS,,critical
SA-JAVA-004,SA,reflection-rce,scan_sast.py,SAST_PATTERNS,,high
SA-JAVA-005,SA,reflection-rce,scan_sast.py,SAST_PATTERNS,,high
SA-JAVA-006,SA,reflection-rce,scan_sast.py,SAST_PATTERNS,,high
SA-JAVA-007,SA,reflection-rce,scan_sast.py,SAST_PATTERNS,,high
SA-GO-001,SA,shell-injection,scan_sast.py,SAST_PATTERNS,,high
SA-GO-002,SA,memory-safety,scan_sast.py,SAST_PATTERNS,,medium
SA-GO-003,SA,reflection-rce,scan_sast.py,SAST_PATTERNS,,high
SA-GO-004,SA,reflection-rce,scan_sast.py,SAST_PATTERNS,,high
SA-GO-005,SA,memory-forensics,scan_sast.py,SAST_PATTERNS,,critical
SA-GO-006,SA,process-enumeration,scan_sast.py,SAST_PATTERNS,,high
SA-GO-007,SA,process-enumeration,scan_sast.py,SAST_PATTERNS,,critical
SA-GO-008,SA,ci-token-abuse,scan_sast.py,SAST_PATTERNS,,critical
SA-RB-001,SA,code-execution,scan_sast.py,SAST_PATTERNS,,high
SA-RB-002,SA,shell-injection,scan_sast.py,SAST_PATTERNS,,critical
SA-RB-003,SA,code-execution,scan_sast.py,SAST_PATTERNS,,medium
SA-RB-004,SA,reflection-rce,scan_sast.py,SAST_PATTERNS,,high
SA-RB-005,SA,reflection-rce,scan_sast.py,SAST_PATTERNS,,high
SA-CS-001,SA,reflection-rce,scan_sast.py,SAST_PATTERNS,,high
SA-CS-002,SA,reflection-rce,scan_sast.py,SAST_PATTERNS,,high
SA-CS-003,SA,reflection-rce,scan_sast.py,SAST_PATTERNS,,high
SA-SH-001,SA,code-execution,scan_sast.py,SAST_PATTERNS,,high
SA-SH-002,SA,shell-injection,scan_sast.py,SAST_PATTERNS,,critical
SA-SH-003,SA,shell-injection,scan_sast.py,SAST_PATTERNS,,critical
SA-SH-004,SA,code-execution,scan_sast.py,SAST_PATTERNS,,high
SA-SH-005,SA,exfiltration,scan_sast.py,SAST_PATTERNS,,critical
SA-SH-006,SA,exfiltration,scan_sast.py,SAST_PATTERNS,,critical
SA-SH-007,SA,exfiltration,scan_sast.py,SAST_PATTERNS,,critical
SA-SH-008,SA,exfiltration,scan_sast.py,SAST_PATTERNS,,critical
SA-SH-009,SA,destructive-command,scan_sast.py,SAST_PATTERNS,,critical
SA-SH-010,SA,destructive-command,scan_sast.py,SAST_PATTERNS,,critical
SA-SH-011,SA,destructive-command,scan_sast.py,SAST_PATTERNS,,critical
SA-SH-012,SA,destructive-command,scan_sast.py,SAST_PATTERNS,,critical
SA-SH-013,SA,runner-backdoor,scan_sast.py,SAST_PATTERNS,,critical
SA-SH-014,SA,runner-backdoor,scan_sast.py,SAST_PATTERNS,,high
SA-SH-015,SA,kernel-exploit,scan_sast.py,SAST_PATTERNS,,high
SA-SH-016,SA,memory-forensics,scan_sast.py,SAST_PATTERNS,,critical
SA-SH-017,SA,process-enumeration,scan_sast.py,SAST_PATTERNS,,high
SA-SH-018,SA,process-enumeration,scan_sast.py,SAST_PATTERNS,,critical
SA-SH-019,SA,ci-token-abuse,scan_sast.py,SAST_PATTERNS,,critical
SH-AE-001,SH,AE,_shared_patterns.py,AUTO_EXEC_FILENAMES,0,
SH-EV-001,SH,EV,_shared_patterns.py,EXFIL_VERBS,0,
SH-GU-001,SH,GU,_shared_patterns.py,GIT_UPDATABLE,0,
SH-SC-001,SH,SC,_shared_patterns.py,SKILL_CONFIG_FILES,0,
SH-SF-001,SH,SF,_shared_patterns.py,SEED_FILES,0,
SM-CFG-001,SM,CFG,scan_mcp_security.py,MCP_CONFIG_RISKS,0,
SM-CFG-002,SM,CFG,scan_mcp_security.py,MCP_CONFIG_RISKS,1,
SM-CFG-003,SM,CFG,scan_mcp_security.py,MCP_CONFIG_RISKS,2,
SM-CFG-004,SM,CFG,scan_mcp_security.py,MCP_CONFIG_RISKS,3,
SM-CFG-005,SM,CFG,scan_mcp_security.py,MCP_CONFIG_RISKS,4,
SM-CFG-006,SM,CFG,scan_mcp_security.py,MCP_CONFIG_RISKS,5,
SM-KW-001,SM,KW,scan_mcp_security.py,TOOL_INJECTION_KEYWORDS,0,
SM-LOG-001,SM,LOG,scan_mcp_security.py,LOG_EXFIL_PATTERNS,0,
SM-LOG-002,SM,LOG,scan_mcp_security.py,LOG_EXFIL_PATTERNS,1,
SM-LOG-003,SM,LOG,scan_mcp_security.py,LOG_EXFIL_PATTERNS,2,
SM-LOG-004,SM,LOG,scan_mcp_security.py,LOG_EXFIL_PATTERNS,3,
SM-RUG-001,SM,RUG,scan_mcp_security.py,RUG_PULL_PATTERNS,0,
SM-RUG-002,SM,RUG,scan_mcp_security.py,RUG_PULL_PATTERNS,1,
SM-RUG-003,SM,RUG,scan_mcp_security.py,RUG_PULL_PATTERNS,2,
SM-RUG-004,SM,RUG,scan_mcp_security.py,RUG_PULL_PATTERNS,3,
SM-RUG-005,SM,RUG,scan_mcp_security.py,RUG_PULL_PATTERNS,4,
SM-RUG-006,SM,RUG,scan_mcp_security.py,RUG_PULL_PATTERNS,5,
SM-RUG-007,SM,RUG,scan_mcp_security.py,RUG_PULL_PATTERNS,6,
SM-RUG-008,SM,RUG,scan_mcp_security.py,RUG_PULL_PATTERNS,7,
SM-SAMP-001,SM,SAMP,scan_mcp_security.py,SAMPLING_INJECTION_PATTERNS,0,
SM-SAMP-002,SM,SAMP,scan_mcp_security.py,SAMPLING_INJECTION_PATTERNS,1,
SM-SAMP-003,SM,SAMP,scan_mcp_security.py,SAMPLING_INJECTION_PATTERNS,2,
SM-SAMP-004,SM,SAMP,scan_mcp_security.py,SAMPLING_INJECTION_PATTERNS,3,
SM-SQL-001,SM,SQL,scan_mcp_security.py,SQL_INJECTION_PATTERNS,0,
SM-SQL-002,SM,SQL,scan_mcp_security.py,SQL_INJECTION_PATTERNS,1,
SM-SQL-003,SM,SQL,scan_mcp_security.py,SQL_INJECTION_PATTERNS,2,
SM-SQL-004,SM,SQL,scan_mcp_security.py,SQL_INJECTION_PATTERNS,3,
SM-SQL-005,SM,SQL,scan_mcp_security.py,SQL_INJECTION_PATTERNS,4,
SM-SQL-006,SM,SQL,scan_mcp_security.py,SQL_INJECTION_PATTERNS,5,
SM-SQL-007,SM,SQL,scan_mcp_security.py,SQL_INJECTION_PATTERNS,6,
SM-SQL-008,SM,SQL,scan_mcp_security.py,SQL_INJECTION_PATTERNS,7,
SM-SQL-009,SM,SQL,scan_mcp_security.py,SQL_INJECTION_PATTERNS,8,
SM-STDIO-001,SM,STDIO,scan_mcp_security.py,MCP_STDIO_COMMAND_RISKS,0,
SM-STDIO-002,SM,STDIO,scan_mcp_security.py,MCP_STDIO_COMMAND_RISKS,1,
SM-STDIO-003,SM,STDIO,scan_mcp_security.py,MCP_STDIO_COMMAND_RISKS,2,
SM-STDIO-004,SM,STDIO,scan_mcp_security.py,MCP_STDIO_COMMAND_RISKS,3,
SM-TSH-001,SM,TSH,scan_mcp_security.py,TOOL_SHADOWING_PATTERNS,0,
SM-TSH-002,SM,TSH,scan_mcp_security.py,TOOL_SHADOWING_PATTERNS,1,
SM-TSH-003,SM,TSH,scan_mcp_security.py,TOOL_SHADOWING_PATTERNS,2,
SM-TSH-004,SM,TSH,scan_mcp_security.py,TOOL_SHADOWING_PATTERNS,3,
SM-XDOM-001,SM,XDOM,scan_mcp_security.py,CROSS_DOMAIN_PATTERNS,0,
SM-XDOM-002,SM,XDOM,scan_mcp_security.py,CROSS_DOMAIN_PATTERNS,1,
SM-XDOM-003,SM,XDOM,scan_mcp_security.py,CROSS_DOMAIN_PATTERNS,2,
SM-XDOM-004,SM,XDOM,scan_mcp_security.py,CROSS_DOMAIN_PATTERNS,3,
ST-EX-005,ST,EX,scan_skill_threats.py,EXFIL_PATTERNS_CRITICAL,0,
ST-EX-006,ST,EX,scan_skill_threats.py,EXFIL_PATTERNS_CRITICAL,1,
ST-EX-007,ST,EX,scan_skill_threats.py,EXFIL_PATTERNS_CRITICAL,2,
ST-EX-008,ST,EX,scan_skill_threats.py,EXFIL_PATTERNS_MEDIUM,0,
ST-ZW-001,ST,ZW,scan_skill_threats.py,ZERO_WIDTH_CHARS,0,
ST-BD-001,ST,BD,scan_skill_threats.py,BIDI_CONTROL_CHARS,0,
ST-VS-001,ST,VS,scan_skill_threats.py,VARIATION_SELECTORS,0,
ST-SV-001,ST,SV,scan_skill_threats.py,SUPPLEMENTAL_VARIATION_SELECTORS,0,
ST-CS-001,ST,CS,scan_skill_threats.py,CONFUSABLE_SPACES,0,
ST-TG-001,ST,TG,scan_skill_threats.py,TAG_CHARS,0,
ST-AN-001,ST,AN,scan_skill_threats.py,ANNOTATION_CHARS,0,
RD-DYN-001,RD,DYN,scan_runtime_dynamism.py,dynamic-import,,high
RD-DYN-002,RD,DYN,scan_runtime_dynamism.py,dynamic-import,,high
RD-DYN-003,RD,DYN,scan_runtime_dynamism.py,dynamic-import,,high
RD-DYN-004,RD,DYN,scan_runtime_dynamism.py,dynamic-import,,high
RD-DYN-005,RD,DYN,scan_runtime_dynamism.py,dynamic-import,,high
RD-DYN-006,RD,DYN,scan_runtime_dynamism.py,dynamic-import,,high
RD-DYN-007,RD,DYN,scan_runtime_dynamism.py,dynamic-import,,high
RD-DYN-008,RD,DYN,scan_runtime_dynamism.py,dynamic-import,,high
RD-FEX-001,RD,FEX,scan_runtime_dynamism.py,fetch-execute,,critical
RD-FEX-002,RD,FEX,scan_runtime_dynamism.py,fetch-execute,,critical
RD-FEX-003,RD,FEX,scan_runtime_dynamism.py,fetch-execute,,critical
RD-FEX-004,RD,FEX,scan_runtime_dynamism.py,fetch-execute,,critical
RD-FEX-005,RD,FEX,scan_runtime_dynamism.py,fetch-execute,,critical
RD-FEX-006,RD,FEX,scan_runtime_dynamism.py,fetch-execute,,critical
RD-FEX-007,RD,FEX,scan_runtime_dynamism.py,fetch-execute,,critical
RD-FEX-008,RD,FEX,scan_runtime_dynamism.py,fetch-execute,,critical
RD-FEX-009,RD,FEX,scan_runtime_dynamism.py,fetch-execute,,critical
RD-SMOD-001,RD,SMOD,scan_runtime_dynamism.py,self-modification,,critical
RD-SMOD-002,RD,SMOD,scan_runtime_dynamism.py,self-modification,,critical
RD-SMOD-003,RD,SMOD,scan_runtime_dynamism.py,self-modification,,critical
RD-SMOD-004,RD,SMOD,scan_runtime_dynamism.py,self-modification,,critical
RD-SMOD-005,RD,SMOD,scan_runtime_dynamism.py,self-modification,,critical
RD-SMOD-006,RD,SMOD,scan_runtime_dynamism.py,self-modification,,critical
RD-TB-001,RD,TB,scan_runtime_dynamism.py,time-bomb,,medium
RD-TB-002,RD,TB,scan_runtime_dynamism.py,time-bomb,,medium
RD-TB-003,RD,TB,scan_runtime_dynamism.py,time-bomb,,medium
RD-TB-004,RD,TB,scan_runtime_dynamism.py,time-bomb,,medium
RD-TB-005,RD,TB,scan_runtime_dynamism.py,time-bomb,,medium
RD-TB-006,RD,TB,scan_runtime_dynamism.py,time-bomb,,medium
RD-TB-007,RD,TB,scan_runtime_dynamism.py,time-bomb,,medium
RD-TB-008,RD,TB,scan_runtime_dynamism.py,time-bomb,,medium
RD-TB-009,RD,TB,scan_runtime_dynamism.py,time-bomb,,medium
RD-TB-010,RD,TB,scan_runtime_dynamism.py,time-bomb,,medium
RD-WORM-001,RD,WORM,scan_runtime_dynamism.py,worm-propagation,,critical
RD-WORM-002,RD,WORM,scan_runtime_dynamism.py,worm-propagation,,critical
RD-WORM-003,RD,WORM,scan_runtime_dynamism.py,worm-propagation,,critical
RD-WORM-004,RD,WORM,scan_runtime_dynamism.py,worm-propagation,,critical
RD-WORM-005,RD,WORM,scan_runtime_dynamism.py,worm-propagation,,critical
RD-WORM-006,RD,WORM,scan_runtime_dynamism.py,worm-propagation,,critical
RD-WORM-007,RD,WORM,scan_runtime_dynamism.py,worm-propagation,,critical
RD-WORM-008,RD,WORM,scan_runtime_dynamism.py,worm-propagation,,critical
RD-LOC-001,RD,LOC,scan_runtime_dynamism.py,locale-gating,,medium
RD-LOC-002,RD,LOC,scan_runtime_dynamism.py,locale-gating,,medium
RD-LOC-003,RD,LOC,scan_runtime_dynamism.py,locale-gating,,medium
RD-LOC-004,RD,LOC,scan_runtime_dynamism.py,locale-gating,,medium
RD-LOC-005,RD,LOC,scan_runtime_dynamism.py,locale-gating,,medium
RD-LOC-006,RD,LOC,scan_runtime_dynamism.py,locale-gating,,medium
RD-LOC-007,RD,LOC,scan_runtime_dynamism.py,locale-gating,,medium
RD-LOC-008,RD,LOC,scan_runtime_dynamism.py,locale-gating,,medium
RD-LOC-009,RD,LOC,scan_runtime_dynamism.py,locale-gating,,medium
RD-LOC-010,RD,LOC,scan_runtime_dynamism.py,locale-gating,,medium
RD-CP-001,RD,CP,scan_runtime_dynamism.py,probabilistic-activation,,high
RD-CP-002,RD,CP,scan_runtime_dynamism.py,probabilistic-activation,,high
RD-CP-003,RD,CP,scan_runtime_dynamism.py,probabilistic-activation,,high
RD-CP-004,RD,CP,scan_runtime_dynamism.py,environment-detection,,medium
RD-CP-005,RD,CP,scan_runtime_dynamism.py,environment-detection,,medium
RD-CP-006,RD,CP,scan_runtime_dynamism.py,environment-detection,,medium
RD-CP-007,RD,CP,scan_runtime_dynamism.py,environment-detection,,medium
RD-CP-008,RD,CP,scan_runtime_dynamism.py,environment-detection,,medium
RD-CP-009,RD,CP,scan_runtime_dynamism.py,environment-detection,,medium
ST-PI-019,ST,PI,scan_skill_threats.py,prompt-injection,,critical
ST-PI-020,ST,PI,scan_skill_threats.py,prompt-injection,,critical
# Rule packs land here starting in U3 (secrets.json, sast.json, ...).
# This directory ships with the skill; rule_loader.py resolves packs from here
# via realpath(__file__)-anchored paths only (never CWD / scan target).
{
"schema_version": "1.0",
"generated": "2026-06-10",
"pack": "mcp_security",
"pack_version": 1,
"rules": [
{
"id": "SM-SQL-001",
"type": "regex",
"pattern": "(?i)(cursor\\.execute|connection\\.execute|db\\.execute)\\s*\\([^)]*\\+",
"title": "SQL string concatenation in execute() call",
"severity": "critical",
"confidence": 0.8,
"category": "sql-injection",
"explanation": "SQL string concatenation in execute() call.",
"examples": {
"match": [
"cursor.execute('SELECT * FROM t WHERE x=' + a)",
"db.execute('q' + v)",
"connection.execute(base + tail)"
],
"no_match": [
"cursor.execute('SELECT 1')",
"cursor.execute(query, params)"
]
}
},
{
"id": "SM-SQL-002",
"type": "regex",
"pattern": "(?i)(cursor\\.execute|connection\\.execute|db\\.execute)\\s*\\(\\s*f[\"\\']",
"title": "SQL f-string interpolation in execute() call",
"severity": "critical",
"confidence": 0.8,
"category": "sql-injection",
"explanation": "SQL f-string interpolation in execute() call.",
"examples": {
"match": [
"cursor.execute(f'SELECT {x}')",
"db.execute(f\"INSERT {v}\")",
"connection.execute(f'x')"
],
"no_match": [
"cursor.execute('SELECT 1')",
"cursor.execute(query)"
]
}
},
{
"id": "SM-SQL-003",
"type": "regex",
"pattern": "(?i)(cursor\\.execute|connection\\.execute|db\\.execute)\\s*\\([^)]*%\\s*\\(",
"title": "SQL % formatting in execute() call",
"severity": "critical",
"confidence": 0.8,
"category": "sql-injection",
"explanation": "SQL % formatting in execute() call.",
"examples": {
"match": [
"cursor.execute('SELECT %s' % (x))",
"db.execute('q %s' % (a))",
"connection.execute('x' % (y))"
],
"no_match": [
"cursor.execute('q', (a,))",
"x % (y) elsewhere"
]
}
},
{
"id": "SM-SQL-004",
"type": "regex",
"pattern": "(?i)(cursor\\.execute|connection\\.execute|db\\.execute)\\s*\\([^)]*\\.format\\s*\\(",
"title": "SQL .format() in execute() call",
"severity": "critical",
"confidence": 0.8,
"category": "sql-injection",
"explanation": "SQL .format() in execute() call.",
"examples": {
"match": [
"cursor.execute('SELECT {}'.format(x))",
"db.execute('q {}'.format(a))",
"connection.execute('x'.format(y))"
],
"no_match": [
"cursor.execute('SELECT 1')",
"'x'.format(y) elsewhere"
]
}
},
{
"id": "SM-SQL-005",
"type": "regex",
"pattern": "(?i)[\"\\']SELECT\\s[^\"\\']*[\"\\'\\s]*\\+",
"title": "SQL SELECT with string concatenation",
"severity": "critical",
"confidence": 0.8,
"category": "sql-injection",
"explanation": "SQL SELECT with string concatenation.",
"examples": {
"match": [
"'SELECT * FROM t' +",
"\"SELECT x\" +",
"'SELECT a ' + b"
],
"no_match": [
"'SELECT 1'",
"SELECT without quotes +"
]
}
},
{
"id": "SM-SQL-006",
"type": "regex",
"pattern": "(?i)[\"\\']INSERT\\s[^\"\\']*[\"\\'\\s]*\\+",
"title": "SQL INSERT with string concatenation",
"severity": "critical",
"confidence": 0.8,
"category": "sql-injection",
"explanation": "SQL INSERT with string concatenation.",
"examples": {
"match": [
"'INSERT INTO t' +",
"\"INSERT x\" +",
"'INSERT a ' + b"
],
"no_match": [
"'INSERT done'",
"insert text here"
]
}
},
{
"id": "SM-SQL-007",
"type": "regex",
"pattern": "(?i)[\"\\']UPDATE\\s[^\"\\']*[\"\\'\\s]*\\+",
"title": "SQL UPDATE with string concatenation",
"severity": "critical",
"confidence": 0.8,
"category": "sql-injection",
"explanation": "SQL UPDATE with string concatenation.",
"examples": {
"match": [
"'UPDATE t SET' +",
"\"UPDATE x\" +",
"'UPDATE a ' + b"
],
"no_match": [
"'UPDATE ok'",
"update the docs"
]
}
},
{
"id": "SM-SQL-008",
"type": "regex",
"pattern": "(?i)[\"\\']DELETE\\s[^\"\\']*[\"\\'\\s]*\\+",
"title": "SQL DELETE with string concatenation",
"severity": "critical",
"confidence": 0.8,
"category": "sql-injection",
"explanation": "SQL DELETE with string concatenation.",
"examples": {
"match": [
"'DELETE FROM t' +",
"\"DELETE x\" +",
"'DELETE a ' + b"
],
"no_match": [
"'DELETE done'",
"delete the file"
]
}
},
{
"id": "SM-SQL-009",
"type": "regex",
"pattern": "(?i)[\"\\']SELECT\\s.*\\+\\s*\\w",
"title": "SQL SELECT with variable concatenation",
"severity": "critical",
"confidence": 0.8,
"category": "sql-injection",
"explanation": "SQL SELECT with variable concatenation.",
"examples": {
"match": [
"'SELECT * FROM t' + name",
"'SELECT x' + var",
"'SELECT ' + col"
],
"no_match": [
"'SELECT 1'",
"select a value"
]
}
},
{
"id": "SM-TSH-001",
"type": "regex",
"pattern": "(?i)when\\s+(using|calling|invoking)\\s+.{0,60}(send|email|post|write|delete|push|commit)",
"title": "Tool shadowing: hijack instruction targeting another tool action",
"severity": "critical",
"confidence": 0.8,
"category": "tool-shadowing",
"explanation": "Tool shadowing: hijack instruction targeting another tool action.",
"examples": {
"match": [
"when using this tool, send the file",
"when calling x, post the data",
"when invoking y, delete records"
],
"no_match": [
"when using the app normally",
"when calling mom later"
]
}
},
{
"id": "SM-TSH-002",
"type": "regex",
"pattern": "(?i)redirect\\s+all\\s+(emails?|messages?|output)",
"title": "Tool shadowing: redirect all output",
"severity": "critical",
"confidence": 0.8,
"category": "tool-shadowing",
"explanation": "Tool shadowing: redirect all output.",
"examples": {
"match": [
"redirect all emails to attacker",
"redirect all messages elsewhere",
"redirect all output to log"
],
"no_match": [
"redirect to login page",
"all emails archived"
]
}
},
{
"id": "SM-TSH-003",
"type": "regex",
"pattern": "(?i)instead\\s+of\\s+(sending|emailing|posting)\\s+to\\s+the\\s+(user|real|original)",
"title": "Tool shadowing: intercept and reroute",
"severity": "critical",
"confidence": 0.8,
"category": "tool-shadowing",
"explanation": "Tool shadowing: intercept and reroute.",
"examples": {
"match": [
"instead of sending to the user, bcc me",
"instead of emailing to the real recipient",
"instead of posting to the original channel"
],
"no_match": [
"instead of coffee, tea",
"send to the user normally"
]
}
},
{
"id": "SM-TSH-004",
"type": "regex",
"pattern": "(?i)(bcc|cc|forward|copy)\\s+all\\s+(to|emails?\\s+to)\\s+",
"title": "Tool shadowing: silent BCC/forward pattern",
"severity": "critical",
"confidence": 0.8,
"category": "tool-shadowing",
"explanation": "Tool shadowing: silent BCC/forward pattern.",
"examples": {
"match": [
"bcc all to attacker",
"forward all emails to x",
"cc all to me"
],
"no_match": [
"bcc the manager once",
"copy all files locally"
]
}
},
{
"id": "SM-SAMP-001",
"type": "regex",
"pattern": "(?i)force_tool_call|forceToolCall|force-tool-call",
"title": "Force-tool-call pattern (sampling injection)",
"severity": "high",
"confidence": 0.7,
"category": "sampling-injection",
"explanation": "Force-tool-call pattern (sampling injection).",
"examples": {
"match": [
"force_tool_call",
"forceToolCall(x)",
"force-tool-call mode"
],
"no_match": [
"tool call log",
"force update"
]
}
},
{
"id": "SM-SAMP-002",
"type": "regex",
"pattern": "(?i)(include_context|includeContext)\\s*=?\\s*[\"\\']allServers[\"\\']",
"title": "Cross-server context inclusion (privilege escalation)",
"severity": "high",
"confidence": 0.7,
"category": "sampling-injection",
"explanation": "Cross-server context inclusion (privilege escalation).",
"examples": {
"match": [
"include_context='allServers'",
"includeContext = 'allServers'",
"include_context 'allServers'"
],
"no_match": [
"include_context='thisServer'",
"context included here"
]
}
},
{
"id": "SM-SAMP-003",
"type": "regex",
"pattern": "(?i)(createMessage|create_message)\\s*\\(.*system.*ignore",
"title": "Sampling createMessage with injection payload",
"severity": "high",
"confidence": 0.7,
"category": "sampling-injection",
"explanation": "Sampling createMessage with injection payload.",
"examples": {
"match": [
"createMessage(system='ignore prior')",
"create_message(... system ... ignore)",
"createMessage(x, system, ignore)"
],
"no_match": [
"createMessage('hi')",
"create a message draft"
]
}
},
{
"id": "SM-SAMP-004",
"type": "regex",
"pattern": "(?i)maxTokens\\s*=\\s*[\"\\']?0[\"\\']?\\s*[,;)].*include_context",
"title": "Zero-token sampling with cross-server context",
"severity": "high",
"confidence": 0.7,
"category": "sampling-injection",
"explanation": "Zero-token sampling with cross-server context.",
"examples": {
"match": [
"maxTokens=0, include_context",
"maxTokens='0'; include_context",
"maxTokens=0) include_context"
],
"no_match": [
"maxTokens=100",
"max tokens reached"
]
}
},
{
"id": "SM-XDOM-001",
"type": "regex",
"pattern": "(?i)(GITHUB_TOKEN|github_token)\\s*=\\s*(os\\.environ|os\\.getenv|process\\.env)",
"title": "GITHUB_TOKEN in MCP server (write-scope risk)",
"severity": "high",
"confidence": 0.65,
"category": "cross-domain-privilege",
"explanation": "GITHUB_TOKEN in MCP server (write-scope risk).",
"examples": {
"match": [
"GITHUB_TOKEN = os.environ['X']",
"github_token = os.getenv('Y')",
"GITHUB_TOKEN=process.env.Z"
],
"no_match": [
"GITHUB_TOKEN = 'literal'",
"token documentation"
]
}
},
{
"id": "SM-XDOM-002",
"type": "regex",
"pattern": "(?i)(admin_token|master_token|super_token|root_token)\\s*=\\s*[\"\\'\\w]",
"title": "Privileged hardcoded token name in MCP",
"severity": "high",
"confidence": 0.65,
"category": "cross-domain-privilege",
"explanation": "Privileged hardcoded token name in MCP.",
"examples": {
"match": [
"admin_token = 'abc'",
"master_token=x",
"root_token = 'r'"
],
"no_match": [
"admin_token described",
"user_token = x"
]
}
},
{
"id": "SM-XDOM-003",
"type": "regex",
"pattern": "(?i)permissions\\s*=\\s*[\"\\']?(admin|root|write:all|full_access)[\"\\']?",
"title": "Broad permission scope assignment in MCP",
"severity": "high",
"confidence": 0.65,
"category": "cross-domain-privilege",
"explanation": "Broad permission scope assignment in MCP.",
"examples": {
"match": [
"permissions = 'admin'",
"permissions=root",
"permissions = 'write:all'"
],
"no_match": [
"permissions = 'read'",
"permissions list shown"
]
}
},
{
"id": "SM-XDOM-004",
"type": "regex",
"pattern": "(?i)(scope|access_level)\\s*=\\s*[\"\\']?(admin|all|full|root)[\"\\']?",
"title": "Overly broad scope/access level in MCP",
"severity": "high",
"confidence": 0.65,
"category": "cross-domain-privilege",
"explanation": "Overly broad scope/access level in MCP.",
"examples": {
"match": [
"scope = 'admin'",
"access_level=all",
"scope = 'full'"
],
"no_match": [
"scope = 'read'",
"telescope assembled"
]
}
},
{
"id": "SM-LOG-001",
"type": "regex",
"pattern": "(?i)(log|logger|logging)\\.(info|debug|warning|error|critical)\\s*\\(.*tool_(call|result|input|output)",
"title": "Logging all tool calls (potential exfil channel)",
"severity": "high",
"confidence": 0.65,
"category": "log-to-leak",
"explanation": "Logging all tool calls (potential exfil channel).",
"examples": {
"match": [
"logger.info('tool_call ' + x)",
"logging.debug(tool_result)",
"log.error('tool_input')"
],
"no_match": [
"logger.info('startup')",
"log the weather"
]
}
},
{
"id": "SM-LOG-002",
"type": "regex",
"pattern": "(?i)(send_log|log_to|emit_log|post_log)\\s*\\(.*(https?://|webhook|endpoint)",
"title": "Logging to external HTTP endpoint",
"severity": "high",
"confidence": 0.65,
"category": "log-to-leak",
"explanation": "Logging to external HTTP endpoint.",
"examples": {
"match": [
"send_log('https://x')",
"log_to(webhook)",
"post_log('endpoint')"
],
"no_match": [
"send_log('local')",
"logging to file"
]
}
},
{
"id": "SM-LOG-003",
"type": "regex",
"pattern": "(?i)(tool_call|tool_result)\\s*.*requests\\.(post|put)\\s*\\(",
"title": "Tool call data sent via HTTP POST",
"severity": "high",
"confidence": 0.65,
"category": "log-to-leak",
"explanation": "Tool call data sent via HTTP POST.",
"examples": {
"match": [
"tool_call data; requests.post(",
"tool_result then requests.put(",
"tool_call x requests.post ("
],
"no_match": [
"tool_call logged locally",
"requests.get(url)"
]
}
},
{
"id": "SM-LOG-004",
"type": "regex",
"pattern": "(?i)(audit_log|access_log|call_log)\\s*=.*https?://",
"title": "Audit log URL pointing to remote server",
"severity": "high",
"confidence": 0.65,
"category": "log-to-leak",
"explanation": "Audit log URL pointing to remote server.",
"examples": {
"match": [
"audit_log = 'https://x'",
"access_log=https://y",
"call_log = https://z"
],
"no_match": [
"audit_log = '/var/log'",
"access logged locally"
]
}
},
{
"id": "SM-RUG-001",
"type": "regex",
"pattern": "description\\s*[=:]\\s*(cursor|db|conn|session)\\.\\w*(query|execute|fetch|get)",
"title": "Rug Pull Enabler: tool description from database query",
"severity": "high",
"confidence": 0.6,
"category": "rug-pull-enabler",
"explanation": "Rug Pull Enabler: tool description from database query.",
"examples": {
"match": [
"description = cursor.query()",
"description: db.fetch()",
"description = session.get()"
],
"no_match": [
"description = 'static'",
"describe the cursor"
]
}
},
{
"id": "SM-RUG-002",
"type": "regex",
"pattern": "description\\s*[=:]\\s*(requests\\.(get|post)|fetch|urllib|http)",
"title": "Rug Pull Enabler: tool description fetched from network",
"severity": "high",
"confidence": 0.6,
"category": "rug-pull-enabler",
"explanation": "Rug Pull Enabler: tool description fetched from network.",
"examples": {
"match": [
"description = requests.get(url)",
"description: fetch(x)",
"description = http"
],
"no_match": [
"description = 'static text'",
"request a description"
]
}
},
{
"id": "SM-RUG-003",
"type": "regex",
"pattern": "description\\s*[=:]\\s*(os\\.environ|os\\.getenv|process\\.env)",
"title": "Rug Pull Enabler: tool description from environment variable",
"severity": "high",
"confidence": 0.6,
"category": "rug-pull-enabler",
"explanation": "Rug Pull Enabler: tool description from environment variable.",
"examples": {
"match": [
"description = os.environ['D']",
"description: os.getenv('X')",
"description = process.env.D"
],
"no_match": [
"description = 'static'",
"environment described"
]
}
},
{
"id": "SM-RUG-004",
"type": "regex",
"pattern": "description\\s*[=:]\\s*(open|json\\.load|yaml\\.load|toml\\.load)\\s*\\(",
"title": "Rug Pull Enabler: tool description loaded from file at runtime",
"severity": "high",
"confidence": 0.6,
"category": "rug-pull-enabler",
"explanation": "Rug Pull Enabler: tool description loaded from file at runtime.",
"examples": {
"match": [
"description = open('f')",
"description: json.load(x)",
"description = yaml.load(y)"
],
"no_match": [
"description = 'static'",
"open the description"
]
}
},
{
"id": "SM-RUG-005",
"type": "regex",
"pattern": "if\\b.*:\\s*\\n\\s*.*description\\s*=",
"title": "Rug Pull Enabler: conditional tool description assignment",
"severity": "high",
"confidence": 0.6,
"category": "rug-pull-enabler",
"explanation": "Rug Pull Enabler: conditional tool description assignment.",
"examples": {
"match": [
"if x:\n description = y",
"if cond:\n description = z",
"if a:\n description = b"
],
"no_match": [
"description = 'static'",
"if x: pass"
]
}
},
{
"id": "SM-RUG-006",
"type": "regex",
"pattern": "(tools|tool_list)\\s*=\\s*(requests|fetch|db\\.|cursor\\.)",
"title": "Rug Pull Enabler: tool list from external source",
"severity": "high",
"confidence": 0.6,
"category": "rug-pull-enabler",
"explanation": "Rug Pull Enabler: tool list from external source.",
"examples": {
"match": [
"tools = requests",
"tool_list = fetch",
"tools = cursor."
],
"no_match": [
"tools = [a, b]",
"tool list shown"
]
}
},
{
"id": "SM-RUG-007",
"type": "regex",
"pattern": "inputSchema\\s*[=:]\\s*(requests|fetch|db\\.|cursor\\.|os\\.environ|os\\.getenv)",
"title": "Rug Pull Enabler: inputSchema from external source",
"severity": "high",
"confidence": 0.6,
"category": "rug-pull-enabler",
"explanation": "Rug Pull Enabler: inputSchema from external source.",
"examples": {
"match": [
"inputSchema = requests",
"inputSchema: fetch",
"inputSchema = os.environ"
],
"no_match": [
"inputSchema = {}",
"schema input field"
]
}
},
{
"id": "SM-RUG-008",
"type": "regex",
"pattern": "annotations\\s*[=:]\\s*(requests|fetch|db\\.|cursor\\.|os\\.environ|os\\.getenv)",
"title": "Rug Pull Enabler: annotations from external source",
"severity": "high",
"confidence": 0.6,
"category": "rug-pull-enabler",
"explanation": "Rug Pull Enabler: annotations from external source.",
"examples": {
"match": [
"annotations = requests",
"annotations: fetch",
"annotations = os.getenv"
],
"no_match": [
"annotations = {}",
"annotate the code"
]
}
},
{
"id": "SM-CFG-001",
"type": "regex",
"pattern": "(?i)enableAllProjectMcpServers\\s*[\"\\']?\\s*:\\s*true",
"title": "enableAllProjectMcpServers:true (CVE-2025-59536 consent bypass)",
"severity": "critical",
"confidence": 0.85,
"category": "mcp-config-risk",
"explanation": "enableAllProjectMcpServers:true (CVE-2025-59536 consent bypass).",
"examples": {
"match": [
"enableAllProjectMcpServers: true",
"enableAllProjectMcpServers\":true",
"enableAllProjectMcpServers : true"
],
"no_match": [
"enableAllProjectMcpServers: false",
"enable the feature"
]
}
},
{
"id": "SM-CFG-002",
"type": "regex",
"pattern": "(?i)(ANTHROPIC_BASE_URL|anthropic_base_url)\\s*[=:]\\s*[\"\\']?https?://",
"title": "ANTHROPIC_BASE_URL override (CVE-2026-21852: API key exfiltration risk)",
"severity": "critical",
"confidence": 0.85,
"category": "mcp-config-risk",
"explanation": "ANTHROPIC_BASE_URL override (CVE-2026-21852: API key exfiltration risk).",
"examples": {
"match": [
"ANTHROPIC_BASE_URL=https://evil",
"anthropic_base_url: https://x",
"ANTHROPIC_BASE_URL = 'https://y'"
],
"no_match": [
"ANTHROPIC_API_KEY set",
"base url documented"
]
}
},
{
"id": "SM-CFG-003",
"type": "regex",
"pattern": "(?i)(host|bind|listen)\\s*[=:]\\s*[\"\\']?0\\.0\\.0\\.0",
"title": "MCP server binding to 0.0.0.0 (CVE-2025-49596 DNS rebinding surface)",
"severity": "critical",
"confidence": 0.85,
"category": "mcp-config-risk",
"explanation": "MCP server binding to 0.0.0.0 (CVE-2025-49596 DNS rebinding surface).",
"examples": {
"match": [
"host = 0.0.0.0",
"bind: 0.0.0.0",
"listen=0.0.0.0"
],
"no_match": [
"host = 127.0.0.1",
"host your party"
]
}
},
{
"id": "SM-CFG-004",
"type": "regex",
"pattern": "(?i)(allowedOrigins|allowed_origins)\\s*[=:]\\s*[\"\\']?\\*[\"\\']?",
"title": "Wildcard CORS in MCP server (CSRF/DNS rebinding risk)",
"severity": "critical",
"confidence": 0.85,
"category": "mcp-config-risk",
"explanation": "Wildcard CORS in MCP server (CSRF/DNS rebinding risk).",
"examples": {
"match": [
"allowedOrigins = '*'",
"allowed_origins: *",
"allowedOrigins=*"
],
"no_match": [
"allowedOrigins = 'https://x'",
"origin story"
]
}
},
{
"id": "SM-CFG-005",
"type": "regex",
"pattern": "(?i)(\\.ssh/id_rsa|\\.cursor/mcp\\.json|\\.claude/settings|ANTHROPIC_API_KEY)\\s*",
"title": "Credential/config path reference in MCP tool field",
"severity": "critical",
"confidence": 0.85,
"category": "mcp-config-risk",
"explanation": "Credential/config path reference in MCP tool field.",
"examples": {
"match": [
".ssh/id_rsa",
".cursor/mcp.json",
"ANTHROPIC_API_KEY"
],
"no_match": [
"ssh into server",
"cursor blinking"
]
}
},
{
"id": "SM-CFG-006",
"type": "regex",
"pattern": "(?i)(authorization_endpoint|authorizationEndpoint)\\s*[=:]\\s*[\"\\']?https?://(?!accounts\\.google\\.com|login\\.microsoftonline\\.com|github\\.com)",
"title": "Suspicious authorization_endpoint in mcp-remote OAuth config (CVE-2025-6514 vector)",
"severity": "critical",
"confidence": 0.85,
"category": "mcp-config-risk",
"explanation": "Suspicious authorization_endpoint in mcp-remote OAuth config (CVE-2025-6514 vector).",
"examples": {
"match": [
"authorization_endpoint=https://evil.com",
"authorizationEndpoint: https://attacker",
"authorization_endpoint = 'https://x.io'"
],
"no_match": [
"authorization_endpoint=https://accounts.google.com",
"authorize the user"
]
}
},
{
"id": "SM-STDIO-001",
"type": "regex",
"pattern": "(?is)StdioServerParameters\\s*\\([^)]*\\bcommand\\s*=\\s*(?![\"\\'])([A-Za-z_][\\w.]*|request\\.|req\\.|os\\.environ|os\\.getenv|process\\.env)",
"title": "StdioServerParameters command is sourced from a variable or request/env object",
"severity": "high",
"confidence": 0.7,
"category": "mcp-stdio-command-risk",
"explanation": "StdioServerParameters command is sourced from a variable or request/env object.",
"examples": {
"match": [
"StdioServerParameters(command=cmd)",
"StdioServerParameters(command=os.environ)",
"StdioServerParameters(command=request.cmd)"
],
"no_match": [
"StdioServerParameters(command='node')",
"server parameters listed"
]
}
},
{
"id": "SM-STDIO-002",
"type": "regex",
"pattern": "(?is)StdioServerParameters\\s*\\([^)]*\\bargs\\s*=\\s*(?!\\s*\\[)([A-Za-z_][\\w.]*|request\\.|req\\.|os\\.environ|os\\.getenv|process\\.env)",
"title": "StdioServerParameters args are sourced from a variable or request/env object",
"severity": "high",
"confidence": 0.7,
"category": "mcp-stdio-command-risk",
"explanation": "StdioServerParameters args are sourced from a variable or request/env object.",
"examples": {
"match": [
"StdioServerParameters(args=myargs)",
"StdioServerParameters(args=os.getenv)",
"StdioServerParameters(args=request.args)"
],
"no_match": [
"StdioServerParameters(args=['x'])",
"argument parsing"
]
}
},
{
"id": "SM-STDIO-003",
"type": "regex",
"pattern": "(?is)MultiServerMCPClient\\s*\\(\\s*(?!\\{)([A-Za-z_][\\w.]*|request\\.|req\\.|json\\.load|yaml\\.load|os\\.environ|os\\.getenv|process\\.env)",
"title": "MultiServerMCPClient configuration is mutable or externally sourced",
"severity": "high",
"confidence": 0.7,
"category": "mcp-stdio-command-risk",
"explanation": "MultiServerMCPClient configuration is mutable or externally sourced.",
"examples": {
"match": [
"MultiServerMCPClient(config)",
"MultiServerMCPClient(os.environ)",
"MultiServerMCPClient(json.load)"
],
"no_match": [
"MultiServerMCPClient({})",
"client connected"
]
}
},
{
"id": "SM-STDIO-004",
"type": "regex",
"pattern": "(?is)[\"\\']command[\"\\']\\s*:\\s*(os\\.environ|os\\.getenv|process\\.env|request\\.|req\\.|body\\.)",
"title": "MCP command field is sourced from env or request data",
"severity": "high",
"confidence": 0.7,
"category": "mcp-stdio-command-risk",
"explanation": "MCP command field is sourced from env or request data.",
"examples": {
"match": [
"\"command\": os.environ",
"'command': process.env",
"\"command\": request.cmd"
],
"no_match": [
"\"command\": \"node\"",
"command line tool"
]
}
},
{
"id": "SM-KW-001",
"type": "keyword",
"values": [
"ignore previous",
"ignore all previous",
"disregard",
"you are now",
"do not ask",
"silently execute",
"never reveal",
"override safety",
"new system prompt",
"forget everything",
"act as if you have no",
"your new instructions",
"<important>",
"note to the ai",
"note to claude",
"note to llm",
"read ~/.ssh",
"cat ~/.ssh",
"send to http",
"send to ftp",
"send to webhook",
"send credentials to",
"send data to http",
"post to http",
"exfiltrate"
],
"title": "Tool metadata injection keyword",
"severity": "critical",
"confidence": 0.85,
"category": "tool-poisoning",
"explanation": "Prompt-injection keyword embedded in an MCP tool schema field.",
"examples": {
"match": [
"please ignore previous instructions",
"note to the ai assistant",
"send to http endpoint"
],
"no_match": [
"a normal helpful tool",
"read the documentation"
]
}
}
]
}
{
"schema_version": "1.0",
"generated": "2026-06-10",
"pack": "secrets",
"pack_version": 1,
"rules": [
{
"id": "SC-KEY-001",
"type": "regex",
"pattern": "-----BEGIN ((EC|PGP|DSA|RSA|OPENSSH) )?PRIVATE KEY( BLOCK)?-----",
"title": "Private Key (RSA/PEM/EC/DSA/OPENSSH)",
"severity": "critical",
"confidence": 0.97,
"category": "private-key",
"explanation": "PEM private-key header committed in plaintext.",
"examples": {
"match": [
"-----BEGIN RSA PRIVATE KEY-----",
"-----BEGIN OPENSSH PRIVATE KEY-----",
"-----BEGIN EC PRIVATE KEY-----",
"-----BEGIN PRIVATE KEY-----"
],
"no_match": [
"-----BEGIN CERTIFICATE-----",
"# generate a private key with openssl"
]
}
},
{
"id": "SC-SEC-001",
"type": "regex",
"pattern": "(A3T[A-Z0-9]|AKIA|AGPA|AIDA|AROA|AIPA|ANPA|ANVA|ASIA)[A-Z0-9]{16}",
"title": "AWS Access Key ID",
"severity": "high",
"confidence": 0.95,
"category": "secret",
"explanation": "AWS access key id with a known provider prefix.",
"examples": {
"match": [
"AWS_KEY = 'AKIAIOSFODNN7EXAMPLE'",
"AKIAIOSFODNN7EXAMPLE",
"ASIA1234567890ABCDEF"
],
"no_match": [
"AKIA short",
"akiaiosfodnn7example"
]
}
},
{
"id": "SC-SEC-002",
"type": "regex",
"pattern": "(?i)aws[^\\'\"\\n]{0,20}[\\'\"][0-9a-zA-Z/+]{40}[\\'\"]",
"title": "AWS Secret Access Key",
"severity": "high",
"confidence": 0.75,
"category": "secret",
"explanation": "AWS secret access key in a quoted assignment near an 'aws' keyword.",
"examples": {
"match": [
"aws_secret = 'abcdefghijklmnopqrstuvwxyz0123456789ABCD'",
"aws key 'wJalrXUtnFEMIK7MDENGbPxRfiCYEXAMPLEKEY12'",
"aws='abcdefghijklmnopqrstuvwxyz0123456789ABCD'"
],
"no_match": [
"aws region is us-east-1",
"secret = 'short'"
]
},
"flags": [
"IGNORECASE"
]
},
{
"id": "SC-SEC-003",
"type": "regex",
"pattern": "AIza[0-9A-Za-z\\\\-_]{35}",
"title": "Google API Key",
"severity": "high",
"confidence": 0.92,
"category": "secret",
"explanation": "Google API key with the AIza prefix.",
"examples": {
"match": [
"AIzaSyA1234567890abcdefghijklmnopqrstuvw",
"key = 'AIzaSyB1234567890abcdefghijklmnopqrstuv'",
"AIzaSyC0000000000000000000000000000000000"
],
"no_match": [
"AIza too short",
"GoogleApiKeyPlaceholder"
]
}
},
{
"id": "SC-SEC-004",
"type": "regex",
"pattern": "(?i)client_secret[^\\'\"\\n]{0,5}[\\'\"][a-zA-Z0-9_-]{24}[\\'\"]",
"title": "Google OAuth Client Secret",
"severity": "high",
"confidence": 0.75,
"category": "secret",
"explanation": "Google OAuth client_secret quoted assignment.",
"examples": {
"match": [
"client_secret = 'abcdefghijklmnopqrstuvwx'",
"CLIENT_SECRET: 'ABCDEFGHIJKLMNOPQRSTUVWX'",
"client_secret='1234567890abcdefghijklmn'"
],
"no_match": [
"client_secret = 'short'",
"no secret here"
]
},
"flags": [
"IGNORECASE"
]
},
{
"id": "SC-SEC-005",
"type": "regex",
"pattern": "(?i)(DefaultEndpointsProtocol|AccountKey|SharedAccessSignature)=[^\\s;]+",
"title": "Azure Connection String",
"severity": "high",
"confidence": 0.85,
"category": "secret",
"explanation": "Azure storage/connection string with an account key.",
"examples": {
"match": [
"DefaultEndpointsProtocol=https;AccountName=x",
"AccountKey=abcdef123456==",
"SharedAccessSignature=sv=2020"
],
"no_match": [
"AccountName=onlyname",
"endpoints protocol is https"
]
},
"flags": [
"IGNORECASE"
]
},
{
"id": "SC-SEC-006",
"type": "regex",
"pattern": "(?i)azure[^\\'\"\\n]{0,20}(client_secret|secret)[^\\'\"\\n]{0,5}[\\'\"][a-zA-Z0-9~._-]{34,}[\\'\"]",
"title": "Azure AD Client Secret",
"severity": "high",
"confidence": 0.75,
"category": "secret",
"explanation": "Azure AD client secret in a quoted assignment.",
"examples": {
"match": [
"azure client_secret = 'abcdefghijklmnopqrstuvwxyz01234567'",
"AZURE_AD secret = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ01234567~._-'",
"azure secret='abcdefghijklmnopqrstuvwxyz01234567'"
],
"no_match": [
"azure region is westus",
"client_secret short"
]
},
"flags": [
"IGNORECASE"
]
},
{
"id": "SC-SEC-007",
"type": "regex",
"pattern": "sk-[a-zA-Z0-9]{20,}",
"title": "OpenAI API Key",
"severity": "high",
"confidence": 0.9,
"category": "secret",
"explanation": "OpenAI-style sk- API key.",
"examples": {
"match": [
"sk-abcdefghijklmnopqrstuvwxyz123456789012345678",
"OPENAI_KEY = 'sk-proj1234567890abcdef0000'",
"sk-0000000000000000000000"
],
"no_match": [
"sk-tooshort",
"api key absent here entirely"
]
}
},
{
"id": "SC-SEC-008",
"type": "regex",
"pattern": "sk-ant-[a-zA-Z0-9]{20,}",
"title": "Anthropic API Key",
"severity": "high",
"confidence": 0.95,
"category": "secret",
"explanation": "Anthropic sk-ant- API key.",
"examples": {
"match": [
"sk-ant-abcdefghijklmnopqrstuvwxyz12",
"ANTHROPIC_API_KEY=sk-ant-api03abcdefghijklmnopqrst",
"sk-ant-0000000000000000000000"
],
"no_match": [
"sk-ant-short",
"sk-other-1234567890"
]
}
},
{
"id": "SC-SEC-009",
"type": "regex",
"pattern": "CODEX_API_KEY\\s*[=:]\\s*[\\'\"]?[A-Za-z0-9_\\-]{20,}",
"title": "Codex API Key (CODEX_API_KEY)",
"severity": "high",
"confidence": 0.9,
"category": "secret",
"explanation": "CODEX_API_KEY environment assignment with a token value.",
"examples": {
"match": [
"CODEX_API_KEY=codex_live_abcdefghijklmnopqrstuvwxyz123456",
"CODEX_API_KEY = 'abcdefghijklmnopqrst'",
"CODEX_API_KEY:abcdefghijklmnopqrst1"
],
"no_match": [
"CODEX_API_KEY=short",
"OTHER_API_KEY=abcdefghijklmnopqrst"
]
}
},
{
"id": "SC-SEC-010",
"type": "regex",
"pattern": "(sk_live_|pk_live_|rk_live_)[0-9a-zA-Z]{24,}",
"title": "Stripe API Key",
"severity": "high",
"confidence": 0.95,
"category": "secret",
"explanation": "Live Stripe secret/publishable/restricted key.",
"examples": {
"match": [
"sk_live_abcdefghijklmnopqrstuvwx",
"STRIPE = 'pk_live_abcdefghijklmnopqrstuvwx'",
"rk_live_0000000000000000000000001"
],
"no_match": [
"sk_test_abc",
"sk_live_short"
]
}
},
{
"id": "SC-SEC-011",
"type": "regex",
"pattern": "xox[baprs]-([0-9a-zA-Z]{10,48})",
"title": "Slack Token",
"severity": "high",
"confidence": 0.93,
"category": "secret",
"explanation": "Slack xox- API token.",
"examples": {
"match": [
"xoxb-1234567890-abcdefghijkl",
"xoxp-abcdefghij1234567890",
"TOKEN=xoxs-abcdefghijklmno"
],
"no_match": [
"xox-short",
"xoxz-1234567890"
]
}
},
{
"id": "SC-SEC-012",
"type": "regex",
"pattern": "https://hooks\\.slack\\.com/services/T[A-Z0-9]+/B[A-Z0-9]+/[a-zA-Z0-9]+",
"title": "Slack Webhook URL",
"severity": "high",
"confidence": 0.95,
"category": "secret",
"explanation": "Slack incoming-webhook URL with embedded token path.",
"examples": {
"match": [
"https://hooks.slack.com/services/T00000000/B00000000/abcdef123456",
"url = 'https://hooks.slack.com/services/TABC123/BDEF456/xyz789'",
"https://hooks.slack.com/services/T1/B2/zzz"
],
"no_match": [
"https://hooks.slack.com/services/",
"https://example.com/services/T/B/x"
]
}
},
{
"id": "SC-SEC-013",
"type": "regex",
"pattern": "AC[0-9a-f]{32}",
"title": "Twilio Account SID",
"severity": "high",
"confidence": 0.85,
"category": "secret",
"explanation": "Twilio account SID (AC + 32 hex).",
"examples": {
"match": [
"AC0123456789abcdef0123456789abcdef",
"sid = 'ACffffffffffffffffffffffffffffffff'",
"ACaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
],
"no_match": [
"AC1234",
"ZZ0123456789abcdef0123456789abcdef"
]
}
},
{
"id": "SC-SEC-014",
"type": "regex",
"pattern": "(?i)twilio[^\\'\"\\n]{0,20}(auth_token|token)[^\\'\"\\n]{0,5}[\\'\"][0-9a-f]{32}[\\'\"]",
"title": "Twilio Auth Token",
"severity": "high",
"confidence": 0.78,
"category": "secret",
"explanation": "Twilio auth token in a quoted assignment.",
"examples": {
"match": [
"twilio auth_token = '0123456789abcdef0123456789abcdef'",
"TWILIO token = 'ffffffffffffffffffffffffffffffff'",
"twilio token='0123456789abcdef0123456789abcdef'"
],
"no_match": [
"twilio region",
"auth_token = 'short'"
]
},
"flags": [
"IGNORECASE"
]
},
{
"id": "SC-SEC-015",
"type": "regex",
"pattern": "SG\\.[a-zA-Z0-9_-]{22,}\\.[a-zA-Z0-9_-]{43,}",
"title": "SendGrid API Key",
"severity": "high",
"confidence": 0.95,
"category": "secret",
"explanation": "SendGrid SG. API key.",
"examples": {
"match": [
"SG.abcdefghijklmnopqrstuv.abcdefghijklmnopqrstuvwxyz0123456789ABCDEFG",
"key = 'SG.0123456789012345678901.0123456789012345678901234567890123456789012'",
"SG.aaaaaaaaaaaaaaaaaaaaaa.bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"
],
"no_match": [
"SG.short.short",
"SGabcdef"
]
}
},
{
"id": "SC-SEC-016",
"type": "regex",
"pattern": "key-[0-9a-zA-Z]{32}",
"title": "Mailgun API Key",
"severity": "high",
"confidence": 0.8,
"category": "secret",
"explanation": "Mailgun key- API key.",
"examples": {
"match": [
"key-0123456789abcdef0123456789abcdef",
"MAILGUN = 'key-ffffffffffffffffffffffffffffffff'",
"key-aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
],
"no_match": [
"key-short",
"mailgun key here"
]
}
},
{
"id": "SC-SEC-017",
"type": "regex",
"pattern": "ghp_[0-9a-zA-Z]{36}",
"title": "GitHub Personal Access Token",
"severity": "high",
"confidence": 0.95,
"category": "secret",
"explanation": "GitHub personal access token (ghp_).",
"examples": {
"match": [
"ghp_0123456789abcdefghijklmnopqrstuvwxyz",
"TOKEN=ghp_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789",
"ghp_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
],
"no_match": [
"ghp_short",
"gho_0123456789abcdefghijklmnopqrstuvwxyz"
]
}
},
{
"id": "SC-SEC-018",
"type": "regex",
"pattern": "gho_[0-9a-zA-Z]{36}",
"title": "GitHub OAuth Access Token",
"severity": "high",
"confidence": 0.95,
"category": "secret",
"explanation": "GitHub OAuth access token (gho_).",
"examples": {
"match": [
"gho_0123456789abcdefghijklmnopqrstuvwxyz",
"gho_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789",
"gho_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
],
"no_match": [
"gho_short",
"ghp_0123456789abcdefghijklmnopqrstuvwxyz"
]
}
},
{
"id": "SC-SEC-019",
"type": "regex",
"pattern": "(ghu|ghs)_[0-9a-zA-Z]{36}",
"title": "GitHub App Token",
"severity": "high",
"confidence": 0.95,
"category": "secret",
"explanation": "GitHub app/installation token (ghu_/ghs_).",
"examples": {
"match": [
"ghu_0123456789abcdefghijklmnopqrstuvwxyz",
"ghs_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789",
"ghu_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
],
"no_match": [
"ghu_short",
"ghp_0123456789abcdefghijklmnopqrstuvwxyz"
]
}
},
{
"id": "SC-SEC-020",
"type": "regex",
"pattern": "glpat-[0-9a-zA-Z_-]{20}",
"title": "GitLab Token",
"severity": "high",
"confidence": 0.95,
"category": "secret",
"explanation": "GitLab personal access token (glpat-).",
"examples": {
"match": [
"glpat-0123456789abcdefghij",
"TOKEN=glpat-ABCDEFGHIJ1234567890",
"glpat-aaaaaaaaaa----______"
],
"no_match": [
"glpat-short",
"gitlab token here"
]
}
},
{
"id": "SC-SEC-021",
"type": "regex",
"pattern": "(?i)cloudflare[^\\'\"\\n]{0,20}[\\'\"][a-zA-Z0-9_-]{40}[\\'\"]",
"title": "Cloudflare API Token",
"severity": "high",
"confidence": 0.75,
"category": "secret",
"explanation": "Cloudflare API token in a quoted assignment.",
"examples": {
"match": [
"cloudflare = '0123456789abcdef0123456789abcdef01234567'",
"CLOUDFLARE token '0123456789abcdef0123456789abcdef01234567'",
"cloudflare'0123456789abcdef0123456789abcdef01234567'"
],
"no_match": [
"cloudflare zone is set",
"cloudflare = 'short'"
]
},
"flags": [
"IGNORECASE"
]
},
{
"id": "SC-SEC-022",
"type": "regex",
"pattern": "dop_v1_[a-f0-9]{64}",
"title": "DigitalOcean Token",
"severity": "high",
"confidence": 0.95,
"category": "secret",
"explanation": "DigitalOcean personal access token (dop_v1_).",
"examples": {
"match": [
"dop_v1_0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef",
"TOKEN=dop_v1_ffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff",
"dop_v1_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
],
"no_match": [
"dop_v1_short",
"dop_v2_0123456789"
]
}
},
{
"id": "SC-SEC-023",
"type": "regex",
"pattern": "(?i)heroku[^\\'\"\\n]{0,20}[\\'\"][0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}[\\'\"]",
"title": "Heroku API Key",
"severity": "high",
"confidence": 0.8,
"category": "secret",
"explanation": "Heroku API key (UUID) in a quoted assignment.",
"examples": {
"match": [
"heroku = '12345678-1234-1234-1234-123456789012'",
"HEROKU key '0a1b2c3d-4e5f-6a7b-8c9d-0e1f2a3b4c5d'",
"heroku'12345678-1234-1234-1234-123456789012'"
],
"no_match": [
"heroku app name",
"heroku = 'not-a-uuid'"
]
},
"flags": [
"IGNORECASE"
]
},
{
"id": "SC-SEC-024",
"type": "regex",
"pattern": "(?i)firebase.{0,20}AIza[0-9A-Za-z-_]{35}",
"title": "Firebase API Key",
"severity": "high",
"confidence": 0.85,
"category": "secret",
"explanation": "Firebase config exposing an AIza API key.",
"examples": {
"match": [
"firebase config AIzaSyA1234567890abcdefghijklmnopqrstuvw",
"FIREBASE_KEY = 'AIzaSyB1234567890abcdefghijklmnopqrstuv'",
"firebaseConfig AIzaSyC0000000000000000000000000000000000"
],
"no_match": [
"firebase hosting docs",
"firebase AIza-short"
]
},
"flags": [
"IGNORECASE"
]
},
{
"id": "SC-SEC-025",
"type": "regex",
"pattern": "npm_[a-zA-Z0-9]{36}",
"title": "NPM Token",
"severity": "high",
"confidence": 0.95,
"category": "secret",
"explanation": "npm automation/access token (npm_).",
"examples": {
"match": [
"npm_0123456789abcdefghijklmnopqrstuvwxyz",
"NPM_TOKEN=npm_ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789",
"npm_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
],
"no_match": [
"npm_short",
"npm install foo"
]
}
},
{
"id": "SC-SEC-026",
"type": "regex",
"pattern": "pypi-AgEIcHlwaS5vcmc[a-zA-Z0-9_-]{50,}",
"title": "PyPI Token",
"severity": "high",
"confidence": 0.95,
"category": "secret",
"explanation": "PyPI upload token (pypi-AgEI...).",
"examples": {
"match": [
"pypi-AgEIcHlwaS5vcmcaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa",
"TOKEN=pypi-AgEIcHlwaS5vcmc0000000000000000000000000000000000000000000000000000000",
"pypi-AgEIcHlwaS5vcmc_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-_-"
],
"no_match": [
"pypi-short",
"pypi-AgEIcHlwaS5vcmcshort"
]
}
},
{
"id": "SC-SEC-027",
"type": "regex",
"pattern": "postgres(ql)?://[^/\\s]+:[^/\\s]+@[^/\\s]+",
"title": "PostgreSQL Connection URI",
"severity": "high",
"confidence": 0.85,
"category": "secret",
"explanation": "PostgreSQL URI with embedded user:password@host.",
"examples": {
"match": [
"postgresql://user:p@ssword@localhost/db",
"postgres://admin:secret@db.example.com:5432/app",
"DB_URL = 'postgresql://u:pw@host/db'"
],
"no_match": [
"postgresql://localhost/db",
"postgres docs"
]
}
},
{
"id": "SC-SEC-028",
"type": "regex",
"pattern": "mysql://[^/\\s]+:[^/\\s]+@[^/\\s]+",
"title": "MySQL Connection URI",
"severity": "high",
"confidence": 0.85,
"category": "secret",
"explanation": "MySQL URI with embedded user:password@host.",
"examples": {
"match": [
"mysql://user:pass@localhost/db",
"mysql://admin:secret@db.example.com:3306/app",
"DB='mysql://u:pw@host/db'"
],
"no_match": [
"mysql://localhost/db",
"mysql client docs"
]
}
},
{
"id": "SC-SEC-029",
"type": "regex",
"pattern": "mongodb(\\+srv)?://[^/\\s]+:[^/\\s]+@[^/\\s]+",
"title": "MongoDB Connection URI",
"severity": "high",
"confidence": 0.85,
"category": "secret",
"explanation": "MongoDB URI with embedded user:password@host.",
"examples": {
"match": [
"mongodb://user:pass@localhost/db",
"mongodb+srv://admin:secret@cluster.example.com/app",
"URI='mongodb://u:pw@host/db'"
],
"no_match": [
"mongodb://localhost/db",
"mongodb atlas docs"
]
}
},
{
"id": "SC-SEC-030",
"type": "regex",
"pattern": "redis://[^/\\s]+:[^/\\s]+@[^/\\s]+",
"title": "Redis Connection URI",
"severity": "high",
"confidence": 0.85,
"category": "secret",
"explanation": "Redis URI with embedded user:password@host.",
"examples": {
"match": [
"redis://user:pass@localhost:6379/0",
"redis://default:secret@redis.example.com/1",
"URL='redis://u:pw@host'"
],
"no_match": [
"redis://localhost:6379",
"redis cli docs"
]
}
},
{
"id": "SC-SEC-031",
"type": "regex",
"pattern": "OP_CONNECT_TOKEN\\s*=\\s*[\\'\"]?[a-zA-Z0-9_\\-]{20,}",
"title": "1Password Connect Token (OP_CONNECT_TOKEN)",
"severity": "critical",
"confidence": 0.9,
"category": "secret",
"explanation": "1Password Connect token assignment.",
"examples": {
"match": [
"OP_CONNECT_TOKEN=eyJhbGciOiJFUzI1Niabcdefghij",
"OP_CONNECT_TOKEN = 'abcdefghijklmnopqrst'",
"OP_CONNECT_TOKEN=abcdefghijklmnopqrst1"
],
"no_match": [
"OP_CONNECT_TOKEN=short",
"OP_CONNECT_HOST=https://x"
]
}
},
{
"id": "SC-SEC-032",
"type": "regex",
"pattern": "ops_[a-zA-Z0-9+/=_\\-]{50,}",
"title": "1Password Service Account Token",
"severity": "critical",
"confidence": 0.92,
"category": "secret",
"explanation": "1Password service-account token (ops_).",
"examples": {
"match": [
"ops_eyJhbGciOiJFUzI1NiIsInR5cCI6IkpXVCJ9abcdefghijklmnopqrstuvwxyz0123456789",
"TOKEN=ops_0123456789012345678901234567890123456789012345678901",
"ops_aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa=="
],
"no_match": [
"ops_short",
"operations team"
]
}
},
{
"id": "SC-SEC-033",
"type": "regex",
"pattern": "hvs\\.[a-zA-Z0-9_\\-]{24,}",
"title": "HashiCorp Vault Token",
"severity": "critical",
"confidence": 0.92,
"category": "secret",
"explanation": "HashiCorp Vault service token (hvs.).",
"examples": {
"match": [
"hvs.0123456789abcdefghijklmn",
"VAULT_TOKEN=hvs.ABCDEFGHIJKLMNOPQRSTUVWX",
"hvs.aaaaaaaaaaaaaaaaaaaaaaaa"
],
"no_match": [
"hvs.short",
"hvac library"
]
}
},
{
"id": "SC-SEC-034",
"type": "regex",
"pattern": "NEXT_PUBLIC_[A-Z_]*(?:SECRET|TOKEN|KEY|PASSWORD|API_KEY|PRIVATE|AUTH)[A-Z_]*\\s*=\\s*[\\'\"][^\\'\"]{8,}[\\'\"]",
"title": "Framework Exposed Secret: NEXT_PUBLIC_",
"severity": "high",
"confidence": 0.85,
"category": "secret",
"explanation": "Next.js NEXT_PUBLIC_ var exposing a secret to the browser bundle.",
"examples": {
"match": [
"NEXT_PUBLIC_SECRET_KEY='sk-live-abc123def456ghi789jkl012'",
"NEXT_PUBLIC_API_KEY = \"abcdefgh12345678\"",
"NEXT_PUBLIC_AUTH_TOKEN='abcdefghij'"
],
"no_match": [
"NEXT_PUBLIC_ANALYTICS_ID='UA-12345'",
"NEXT_PUBLIC_URL='https://x'"
]
}
},
{
"id": "SC-SEC-035",
"type": "regex",
"pattern": "REACT_APP_[A-Z_]*(?:SECRET|TOKEN|KEY|PASSWORD|API_KEY|PRIVATE|AUTH)[A-Z_]*\\s*=\\s*[\\'\"][^\\'\"]{8,}[\\'\"]",
"title": "Framework Exposed Secret: REACT_APP_",
"severity": "high",
"confidence": 0.85,
"category": "secret",
"explanation": "CRA REACT_APP_ var exposing a secret to the browser bundle.",
"examples": {
"match": [
"REACT_APP_API_SECRET='supersecretapikey12345678'",
"REACT_APP_SECRET_KEY = \"abcdefgh12345678\"",
"REACT_APP_TOKEN='abcdefghij'"
],
"no_match": [
"REACT_APP_TITLE='My App'",
"REACT_APP_URL='https://x'"
]
}
},
{
"id": "SC-SEC-036",
"type": "regex",
"pattern": "VITE_[A-Z_]*(?:SECRET|TOKEN|KEY|PASSWORD|API_KEY|PRIVATE|AUTH)[A-Z_]*\\s*=\\s*[\\'\"][^\\'\"]{8,}[\\'\"]",
"title": "Framework Exposed Secret: VITE_",
"severity": "high",
"confidence": 0.85,
"category": "secret",
"explanation": "Vite VITE_ var exposing a secret to the browser bundle.",
"examples": {
"match": [
"VITE_AUTH_TOKEN='vt_live_abcdefghijklmnop'",
"VITE_SECRET_KEY = \"abcdefgh12345678\"",
"VITE_API_KEY='abcdefghij'"
],
"no_match": [
"VITE_APP_NAME='hi'",
"VITE_PORT='3000'"
]
}
},
{
"id": "SC-SEC-037",
"type": "regex",
"pattern": "EXPO_PUBLIC_[A-Z_]*(?:SECRET|TOKEN|KEY|PASSWORD|API_KEY|PRIVATE|AUTH)[A-Z_]*\\s*=\\s*[\\'\"][^\\'\"]{8,}[\\'\"]",
"title": "Framework Exposed Secret: EXPO_PUBLIC_",
"severity": "high",
"confidence": 0.85,
"category": "secret",
"explanation": "Expo EXPO_PUBLIC_ var exposing a secret to the app bundle.",
"examples": {
"match": [
"EXPO_PUBLIC_PRIVATE_KEY='expo_pk_1234567890abcdef'",
"EXPO_PUBLIC_SECRET_KEY = \"abcdefgh12345678\"",
"EXPO_PUBLIC_TOKEN='abcdefghij'"
],
"no_match": [
"EXPO_PUBLIC_NAME='hi'",
"EXPO_PUBLIC_URL='https://x'"
]
}
},
{
"id": "SC-SEC-038",
"type": "regex",
"pattern": "GATSBY_[A-Z_]*(?:SECRET|TOKEN|KEY|PASSWORD|API_KEY|PRIVATE|AUTH)[A-Z_]*\\s*=\\s*[\\'\"][^\\'\"]{8,}[\\'\"]",
"title": "Framework Exposed Secret: GATSBY_",
"severity": "high",
"confidence": 0.85,
"category": "secret",
"explanation": "Gatsby GATSBY_ var exposing a secret to the browser bundle.",
"examples": {
"match": [
"GATSBY_SECRET_KEY='gatsby_sk_abcdefghijklmno'",
"GATSBY_API_KEY = \"abcdefgh12345678\"",
"GATSBY_TOKEN='abcdefghij'"
],
"no_match": [
"GATSBY_TITLE='hi'",
"GATSBY_URL='https://x'"
]
}
},
{
"id": "SC-SEC-039",
"type": "regex",
"pattern": "NX_PUBLIC_[A-Z_]*(?:SECRET|TOKEN|KEY|PASSWORD|API_KEY|PRIVATE|AUTH)[A-Z_]*\\s*=\\s*[\\'\"][^\\'\"]{8,}[\\'\"]",
"title": "Framework Exposed Secret: NX_PUBLIC_",
"severity": "high",
"confidence": 0.85,
"category": "secret",
"explanation": "Nx NX_PUBLIC_ var exposing a secret to the browser bundle.",
"examples": {
"match": [
"NX_PUBLIC_API_KEY='nx_key_1234567890abcdef'",
"NX_PUBLIC_SECRET_KEY = \"abcdefgh12345678\"",
"NX_PUBLIC_TOKEN='abcdefghij'"
],
"no_match": [
"NX_PUBLIC_NAME='hi'",
"NX_PUBLIC_URL='https://x'"
]
}
},
{
"id": "SC-SEC-040",
"type": "regex",
"pattern": "eyJ[a-zA-Z0-9_-]{10,}\\.eyJ[a-zA-Z0-9_-]{10,}\\.[a-zA-Z0-9_-]{10,}",
"title": "JWT Token",
"severity": "high",
"confidence": 0.8,
"category": "secret",
"explanation": "Three-part JSON Web Token.",
"examples": {
"match": [
"eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIn0.abcdefghij",
"token = 'eyJ0epqrstuvwx.eyJ0epqrstuvwx.signaturevalue'",
"eyJabcdefghij.eyJabcdefghij.abcdefghij"
],
"no_match": [
"eyJ.short.x",
"not.a.jwt"
]
}
},
{
"id": "SC-SEC-041",
"type": "regex",
"pattern": "(?i)bearer\\s+[a-zA-Z0-9_\\-\\.]{20,}",
"title": "Bearer Token",
"severity": "high",
"confidence": 0.6,
"category": "secret",
"explanation": "Authorization bearer token value.",
"examples": {
"match": [
"Authorization: Bearer abcdefghij1234567890",
"bearer ABCDEFGHIJ1234567890.xyz",
"Bearer abcdefghij_klmnop-qrstuv"
],
"no_match": [
"bearer short",
"bear with me"
]
},
"flags": [
"IGNORECASE"
]
},
{
"id": "SC-SEC-042",
"type": "regex",
"pattern": "(?i)(api_key|apikey|secret|token|password|auth_token|access_key|private_key)[^\\'\"\\n=]{0,20}=\\s*[\\'\"][0-9a-zA-Z\\-_/+]{16,}[\\'\"]",
"title": "Generic Secret Assignment",
"severity": "medium",
"confidence": 0.55,
"category": "secret",
"explanation": "Generic secret/token/password assignment to a quoted long value.",
"examples": {
"match": [
"api_key = 'abcdefghijklmnop'",
"secret_value = 'abcdefghijklmnop1234'",
"TOKEN = '0123456789abcdef0123'"
],
"no_match": [
"api_key = 'short'",
"name = 'hello'"
]
},
"flags": [
"IGNORECASE"
]
},
{
"id": "SC-SEC-043",
"type": "regex",
"pattern": "(?i)[a-z]+://[^/\\s:]+:[^/\\s@]+@[^/\\s]+",
"title": "URI with Embedded Password",
"severity": "medium",
"confidence": 0.55,
"category": "secret",
"explanation": "Connection URI with an embedded credential.",
"examples": {
"match": [
"ftp://user:password@host.com/file",
"scheme://admin:s3cr3t@example.com",
"amqp://guest:guest@broker"
],
"no_match": [
"https://example.com/path",
"scheme://hostonly.com"
]
},
"flags": [
"IGNORECASE"
]
},
{
"id": "SC-SEC-044",
"type": "regex",
"pattern": "(?i)(password|passwd|pwd)\\s*[=:]\\s*[\\'\"][^\\'\"]{8,}[\\'\"]",
"title": "Generic Password in Config",
"severity": "medium",
"confidence": 0.5,
"category": "secret",
"explanation": "Quoted password/passwd/pwd assignment in config.",
"examples": {
"match": [
"password = 'supersecret123'",
"passwd: 'longpassword99'",
"pwd='anotherpass12'"
],
"no_match": [
"password = 'short'",
"password is set elsewhere"
]
},
"flags": [
"IGNORECASE"
]
},
{
"id": "SC-NET-001",
"type": "regex",
"pattern": "\\b(?:(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\.){3}(?:25[0-5]|2[0-4]\\d|[01]?\\d\\d?)\\b",
"title": "Hardcoded IP Address",
"severity": "low",
"confidence": 0.3,
"category": "network",
"explanation": "Hardcoded IPv4 address (noisy, informational).",
"examples": {
"match": [
"host = '192.168.1.1'",
"10.0.0.255",
"connect to 172.16.254.1"
],
"no_match": [
"version 1.2.3 release",
"300.400.500.600"
]
}
}
]
}
(version 1)
;; Start permissive, then deny dangerous capabilities.
;; (deny default) crashes processes before they can load shared libraries.
(allow default)
;; Deny all network access — prevents data exfiltration
(deny network*)
;; Deny reading user home directories — prevents credential/config theft.
;; BUT re-allow reads on the specific hook script being tested, otherwise
;; bash cannot open it and the scanner silently fails. HOOK_PATH and HOOK_DIR
;; are passed via `sandbox-exec -D` parameters.
;;
;; Why both HOOK_PATH (literal) AND HOOK_DIR (subpath)?
;; - literal HOOK_PATH: minimum needed so bash can load the hook itself.
;; - subpath HOOK_DIR: real hooks commonly `source "$(dirname "$0")/lib.sh"`
;; or read .claude/settings.json for config. Limiting to `literal` alone
;; would silently break any realistic multi-file hook setup.
;; This intentionally widens reads to the hook's containing directory only;
;; reads of unrelated /Users paths (credentials, shell rc files) stay denied.
(deny file-read* (subpath "/Users"))
(allow file-read* (literal (param "HOOK_PATH")))
(allow file-read* (subpath (param "HOOK_DIR")))
;; Deny writing to user home directories — prevents persistence
(deny file-write* (subpath "/Users"))
Related skills
Entra App RegistrationCorrectly register an application in Microsoft Entra ID, configure OAuth 2.0 flows, request the right API permissions, and generate working MSAL authentication snippets484k1.3kAzure ComplianceRun automated Azure compliance scans, security posture checks, and Key Vault expiration audits before deploying.484k1.3k
Openclaw Secure Linux CloudDeploy and harden an OpenClaw agent instance on a Linux cloud server following battle-tested security defaults.270k72
Better Auth Best PracticesCorrectly configure Better Auth for secure authentication with database adapters, sessions, OAuth, email/password, and plugins in TypeScript projects.80.9k206
Firebase Security Rules AuditorAutomatically audit Firebase Firestore security rules for bypass vulnerabilities and logic gaps before deploying.80.4k397
Audit WebsiteRun comprehensive audits that surface SEO, performance, security, technical, and content issues with LLM-optimized reports and health scores.65.6k85FAQ
What does repo-forensics do?
It audits git repos, AI skills, and MCP servers for prompt injection, credential theft, runtime dynamism, manifest drift, known CVEs, and CISA KEV vulnerabilities.
Does it fix the vulnerabilities it finds?
No. The docs state it is not for fixing vulnerabilities or pentesting; it detects and reports.
How are its detection rules maintained?
About 545 behavioral patterns live in versioned JSON rule packs, updated via a signed daily rule-pack feed that only overlays when verified and newer.