/**
 * AgentSkillGuard
 *
 * Detects malicious agent plugins, tools, and skills before registration/execution.
 * Inspired by OpenClaw research which discovered 824 backdoored plugins across
 * npm, PyPI, and GitHub ecosystems.
 *
 * This is an ARCHITECTURAL guard — it prevents malicious tools from being
 * registered regardless of whether the agent itself was compromised.
 *
 * Threat Model:
 * - Backdoored tool definitions with hidden eval/exec calls
 * - Exfiltration patterns embedded in tool descriptions
 * - Privilege escalation chains across tool combinations
 * - Typosquatting / deceptive naming of trusted tools
 * - Hidden prompt injection in tool metadata
 * - Capability mismatch (read-only tools with write permissions)
 * - Overly broad or suspicious parameter definitions
 */
import { GuardLogger } from "../types";
export interface SkillDefinition {
    name: string;
    description: string;
    parameters?: Record<string, any>;
    permissions?: string[];
    source?: string;
    version?: string;
    author?: string;
}
export interface AgentSkillGuardConfig {
    /** Allowlist of known-good tool names */
    trustedTools?: string[];
    /** Additional regex patterns to block */
    blockedPatterns?: string[];
    /** Max description length before flagging (default: 2000) */
    maxDescriptionLength?: number;
    /** Detect data exfiltration patterns in descriptions (default: true) */
    detectExfiltration?: boolean;
    /** Detect hidden prompt injections in metadata (default: true) */
    detectHiddenInstructions?: boolean;
    /** Detect privilege escalation chains (default: true) */
    detectPrivilegeEscalation?: boolean;
    /** Detect typosquatting / deceptive naming (default: true) */
    detectDeceptiveNaming?: boolean;
    /** Logger */
    logger?: GuardLogger;
}
export interface SkillThreat {
    type: string;
    detail: string;
    severity: "low" | "medium" | "high" | "critical";
}
export interface AgentSkillGuardResult {
    allowed: boolean;
    reason?: string;
    violations: string[];
    riskScore: number;
    threats: SkillThreat[];
}
export declare class AgentSkillGuard {
    readonly guardName = "AgentSkillGuard";
    readonly guardLayer = "L-AGENT";
    private config;
    constructor(config?: AgentSkillGuardConfig);
    analyze(skill: SkillDefinition): AgentSkillGuardResult;
    /** Concatenate all inspectable text from the skill definition */
    private buildCorpus;
    private detectBackdoors;
    private detectExfiltrationPatterns;
    private detectHiddenInstructions;
    private detectCapabilityMismatch;
    private detectPrivilegeEscalation;
    private detectDeceptiveNaming;
    private detectSuspiciousParameters;
    private computeRiskScore;
    private buildReason;
    /** Levenshtein distance for typosquatting detection */
    private levenshteinDistance;
}