Rule reference

Nineteen static detection rules across two exclusive profiles. Every rule ships with a bad fixture that must trigger and a good fixture that must not.

Profiles. core (default) covers agent context files with agent-specific rules. extended swaps in generic rules and widens discovery to source files (.py, .js, .ts) and dependency files (requirements*, package.json, pyproject.toml, setup.py, setup.cfg). One profile runs per scan.

ID	Scope	Severity	Detects
HUC001	all files	high/medium/low	Invisible and bidirectional Unicode control characters (Trojan Source class)
PIN001	JSON description fields, SKILL.md frontmatter	high	Prompt-injection phrases in tool and skill descriptions
REM001	SKILL.md, files under skills/	high/medium	Pipe-to-shell downloads, base64 payloads, remote fetches
MCP001	MCP JSON configs	high	Auto-approve or permission-skipping flags
MCP002	MCP JSON configs	medium	Filesystem server mounted at a filesystem root
MCP003	MCP JSON configs	medium	Unpinned dangerous command (npx, uvx, docker, kubectl, and similar)
MCP004	MCP JSON configs	high	Sensitive environment variables passed to a server
UNP001	MCP JSON configs	medium	npx, uvx, or bunx packages without a version pin
SEC001	all files	high/medium	Embedded credentials with Shannon entropy validation
SHC001	code and config files	high/medium	Shell command execution: eval, exec, os.system, subprocess with metacharacters
NET001	code and config files	high/medium	Data exfiltration: cloud metadata endpoints, pastebins, tunnels, encoded URL payloads
FSY001	code and config files	high/medium	Path traversal, sensitive file access, unsafe archive extraction
ENV001	code and config files	high/medium	Credential dumping through environment iteration or serialization
PRI001	code and config files	high/medium	Privilege escalation, container escape, process injection
OBF001	code and config files	high/medium/low	Encoding and obfuscation: compressed payloads, homoglyphs, long encoded literals
SUP001	dependency files	high/medium/low	Supply chain risks: unpinned dependencies, install scripts, custom indexes
CFG001	config and template files	high/medium	Template injection, unsafe YAML tags, hardcoded secrets in config
TOO001	tool and function definitions	high/medium	Injection risks in tool and function calling schemas
CRY001	code and config files	high/medium/low	Weak hashes and ciphers, insecure randomness, disabled certificate checks

HUC001 — hidden Unicode

Zero-width characters and bidirectional controls can make rendered text differ from what a parser or an agent reads. Bidirectional controls score high because they enable Trojan Source style tricks. A UTF-8 BOM at byte zero is not flagged.

PIN001 — prompt injection

Matches injection phrases such as "ignore previous instructions" or "reveal the system prompt" inside tool and skill description fields only. Scoping to descriptions keeps the false-positive rate manageable.

REM001 — remote downloads in skills

Covers curl or wget piped into a shell or interpreter, PowerShell Invoke-Expression chains, base64 decode into a shell, certutil downloads, long base64 literals, and remote git or pip sources inside skill files.

MCP001 — auto-approve flags

Flags autoApprove: true and permission-skipping flags such as --dangerously-skip-permissions, --yolo, and --no-auth in MCP server definitions.

MCP002 — filesystem root mounts

A filesystem server given /, ~, or a drive root can read anything the process can. Repo-relative mounts are fine.

MCP003 — infrastructure commands as servers

Flags shell and infrastructure commands (bash, sh, powershell, curl, wget, docker, podman, kubectl, helm) used as the MCP server executable, regardless of arguments. Package runners belong to UNP001, so one issue yields one finding.

MCP004 — sensitive env vars

Flags server definitions that receive environment variables with credential-like prefixes: cloud keys, database URLs, tokens, certificates.

UNP001 — unpinned packages

Package runners (npx, uvx, bunx, pnpm, yarn, pipx) execute whatever the registry serves today. A pin such as pkg@1.2.3 or pkg==1.2.3 satisfies the rule; @latest does not. Subcommands like dlx are skipped so the package name is the one reported.

SEC001 — embedded credentials

Provider formats (OpenAI, GitHub, Slack, AWS, Google, Bearer) score high. Generic assignments require a Shannon entropy above 3.5 so placeholders such as "changeme" do not fire.

SHC001 — shell command execution

String-form eval, exec, and compile, os.system, subprocess calls with shell metacharacters or string formatting, and deprecated command modules.

NET001 — exfiltration channels

Cloud metadata addresses, pastebin and webhook endpoints, tunneling services, raw sockets, DNS resolution, HTTP calls carrying data payloads, and long encoded fragments in URL paths.

FSY001 — filesystem access

Traversal sequences, writes and deletes, SSH keys and certificates, env and secrets files, and archive extraction with zip-slip risk.

ENV001 — credential access

Iteration, serialization, printing, or logging of the whole environment, direct reads of cloud and database variables, and shell expansions of long uppercase variables.

PRI001 — escalation and injection

Docker and Kubernetes privileged modes, host namespace sharing, docker socket access, LD_PRELOAD, ptrace attach, Windows registry run keys, scheduled tasks, and encoded PowerShell.

OBF001 — obfuscation

Base64 round trips combined with compression, PowerShell encoded commands, XOR ciphers, long encoded literals, and Cyrillic, Greek, or fullwidth homoglyphs.

SUP001 — supply chain

Unpinned installs, wildcard versions, git-sourced dependencies, custom package indexes, and install-time scripts in package definitions.

CFG001 — config and template injection

Template delimiters, unsafe YAML python tags, dunder references in config, and connection strings with inline credentials. Runs on structured config files only, not markdown, where template prose would false-positive. Credential assignments belong to SEC001.

TOO001 — tool calling

Tools named shell, exec, or similar; descriptions that advertise arbitrary execution; autonomous agent frameworks; disabled strict mode.

CRY001 — cryptography

MD5 and SHA1, DES and RC4, AES-ECB, RSA keys at 1024 bits or below, the random module for security purposes, disabled certificate verification, and hardcoded keys or IVs.