{ "version": "1.0.0", "updated": "2026-07-01", "source_inspiration": "patterns adapted from publicly documented MCP/agent-config attack classes (github.com/affaan-m/agentshield v1.4.0, MIT); no code or exploit text copied verbatim -- see .planning/seeds/SEED-016", "_note": "The ONE external, versioned rules source the generalized AgentShield engine (199-03) reads via require(); no private pattern copy anywhere. Each regex rule carries a pattern (regex source, no delimiters), flags, severity, and a plain-English description. Updates land via PR like any other plugin artifact.", "surfaces": { "mcp_tool_description": [ { "id": "AS-CVE-001", "pattern": "ignore\\s+(all\\s+)?previous\\s+instructions", "flags": "i", "severity": "high", "description": "MCP tool description carries an ignore-previous-instructions override marker (prompt injection against any downstream LLM consumer)." }, { "id": "AS-CVE-002", "pattern": "\\bsystem\\s*:\\s*(you\\s+are|disable|enable|act|comply|ignore|override)", "flags": "i", "severity": "high", "description": "System-role impersonation: a system: prefix followed by an imperative that tries to reset the model's role." }, { "id": "AS-CVE-003", "pattern": "[\\u200B\\u200C\\u200D\\u2060\\uFEFF]", "flags": "", "severity": "medium", "description": "Zero-width or invisible-unicode steganography marker hidden inside the tool description." }, { "id": "AS-CVE-004", "pattern": "[A-Za-z0-9+/]{40,}={0,2}", "flags": "", "severity": "medium", "description": "Suspiciously long base64-looking blob embedded in a tool description (possible obfuscated payload)." } ], "hook_scope": [ { "id": "AS-CVE-005", "pattern": "\\b(curl|wget)\\b(?![^\\n]*\\b(localhost|127\\.0\\.0\\.1|::1)\\b)[^\\n]*https?://", "flags": "i", "severity": "high", "description": "Hook command performs an outbound curl/wget to a non-localhost host (possible exfiltration channel)." }, { "id": "AS-CVE-006", "pattern": "rm\\s+-rf\\s+(/(\\s|--|$)|--no-preserve-root)", "flags": "i", "severity": "high", "description": "Hook command runs a destructive rm -rf sweep from the filesystem/repo root." }, { "id": "AS-CVE-007", "pattern": "\\b(eval\\(|new\\s+Function\\()", "flags": "", "severity": "high", "description": "Hook command performs dynamic code execution via eval( or new Function(." }, { "id": "AS-CVE-008", "pattern": "(nc\\s+-e|/dev/tcp/)", "flags": "i", "severity": "high", "description": "Hook command contains a reverse-shell idiom (nc -e or /dev/tcp/)." } ], "skill_injection": [ { "id": "AS-CVE-001", "see": "AS-CVE-001", "severity": "high", "description": "Reuses the ignore-previous-instructions override marker (AS-CVE-001, defined under mcp_tool_description) applied to a SKILL.md body; no duplicate regex string is kept here -- the engine resolves the pattern via the see reference." }, { "id": "AS-CVE-009", "pattern": "disregard\\s+(your\\s+|the\\s+)?system\\s+prompt", "flags": "i", "severity": "high", "description": "Skill body instructs the model to disregard its system prompt." }, { "id": "AS-CVE-010", "pattern": "allowed-tools\\s*:\\s*(\\[\\s*['\"]?\\*['\"]?\\s*\\]|['\"]?\\*['\"]?)", "flags": "i", "severity": "high", "description": "SKILL.md frontmatter declares a wildcard allowed-tools grant (unscoped tool access)." }, { "id": "AS-CVE-014", "pattern": "ignore\\s+(your\\s+|the\\s+)?system\\s+prompt", "flags": "i", "severity": "high", "description": "Skill body instructs the model to ignore its system prompt (injection variant of the AS-CVE-009 disregard marker)." } ], "claudemd_permission": [ { "id": "AS-CVE-011", "pattern": "Bash\\(\\s*\\*\\s*\\)", "flags": "", "severity": "high", "description": "Unscoped Bash(*) permission grant (allows any shell command)." }, { "id": "AS-CVE-012", "pattern": "--dangerously-skip-permissions", "flags": "", "severity": "high", "description": "A committed file recommends running with --dangerously-skip-permissions (bypasses the permission gate)." }, { "id": "AS-CVE-013", "pattern": "Bash\\(\\s*rm\\s+-rf\\b[^)]*\\)", "flags": "i", "severity": "high", "description": "Permission grant scoped to a destructive Bash(rm -rf ...) command." }, { "id": "AS-CVE-015", "pattern": "auto-approve\\s+all\\b", "flags": "i", "severity": "high", "description": "A committed file recommends auto-approving all commands (blanket permission-gate bypass)." } ], "supply_chain": { "_note": "Structured heuristic input (not regex). known_bad_packages is an empty seed array -- a living list updated via PR the moment a real malicious package is identified. typosquat_watchlist maps each legitimate package to close-miss names an attacker might publish. allowlist echoes the GSD Package Legitimacy Gate vocabulary (ASSUMED/SUS/SLOP/VETTED) in the disposition field, so any FUTURE new dependency defaults to a state other than VETTED until a human reviews it.", "known_bad_packages": [ "left-pad-typosquat" ], "typosquat_watchlist": [ { "legit": "lodash", "watch": [ "lodahs", "lodash-es-typo" ] }, { "legit": "express", "watch": [ "expres", "expresss" ] }, { "legit": "chalk", "watch": [ "chalk-cli-fake" ] } ], "allowlist": [ { "name": "@huggingface/transformers", "disposition": "VETTED", "note": "e5 local embedding runtime (multilingual-e5-large). Apache-2.0, canonical upstream huggingface/transformers.js, v4.2.0, NO install/postinstall scripts. Already shipping in released versions. Reviewed 2026-08-09 on the first run of this scan that did not crash." }, { "name": "@ig3/markdown-it-wikilinks", "disposition": "VETTED" }, { "name": "@modelcontextprotocol/ext-apps", "disposition": "VETTED" }, { "name": "@modelcontextprotocol/sdk", "disposition": "VETTED" }, { "name": "ajv", "disposition": "VETTED", "note": "JSON Schema validator, required directly by lib/core/brain-client.cjs for Phase 110 typed-packet enforcement. MIT, canonical upstream ajv-validator/ajv, v8.18.0, NO install scripts. Was already on disk as a transitive dep of the VETTED @modelcontextprotocol/sdk at the IDENTICAL version, so declaring it adds no new code -- it only makes an existing direct require honest. Reviewed 2026-08-09." }, { "name": "asciichart", "disposition": "VETTED" }, { "name": "chokidar", "disposition": "VETTED" }, { "name": "chrono-node", "disposition": "VETTED" }, { "name": "express", "disposition": "VETTED" }, { "name": "flexsearch", "disposition": "VETTED" }, { "name": "gray-matter", "disposition": "VETTED" }, { "name": "markdown-it", "disposition": "VETTED" }, { "name": "semver", "disposition": "VETTED" }, { "name": "sqlite-vec", "disposition": "VETTED", "note": "SQLite vector extension for local room.db vector search. MIT OR Apache, canonical upstream asg017/sqlite-vec, v0.1.9, ZERO transitive deps, NO install scripts. Already shipping in released versions. Reviewed 2026-08-09 on the first run of this scan that did not crash." }, { "name": "zod", "disposition": "VETTED" } ] } } }