SunWeb3Sec/llm-sast-scanner

Why it got this result

The artifact's declared purpose (SKILL.md frontmatter, README.md) is unambiguously DEFENSIVE/DETECTIVE: 'General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis... find security bugs... audit source code' -- it instructs an LLM agent to locate, verify (via a Judge false-positive-elimination step), and REPORT vulnerabilities with remediation guidance in a THIRD-PARTY target codebase. This matches the rule's negative indicator for a clearly-defensive/detective artifact (malware-analysis / detection-engineering / security-teaching helper) with no offensive-production capability. Two YARA 'webshell' raw_artifacts matches (Zeus_Webshell_Command_Parameter, confidence 88) fire on references/php_security.md:22-38 and references/expression_language_injection.md:160-168 because those files contain PHP/Python command-execution code blocks -- but in context these are explicitly labeled teaching examples under 'VULN' / 'VULNERABLE' headings inside a vulnerability-detection reference, instructing the scanning LLM what pattern to FLAG when found in someone else's code, not operational attack tooling the skill itself runs or directs the agent to build for an attacker. There is no instruction anywhere in SKILL.md directing the agent to GENERATE malware/ransomware/credential-stealers/C2/droppers by request, no hardcoded C2 endpoints or exfil sinks, and no instruction to evade oversight, suppress logging, or operate covertly -- the workflow is openly auditable (writes a markdown sast_report.md, Judge review step, cites evidence). This is the clean SECURE end: defensive/educational security-analysis tooling that documents attacker techniques purely to detect and remediate them.

Why it matters

An artifact whose purpose is to weaponize the agent -- to produce malware, steal credentials, evade defenses, or run attacks at scale -- is dangerous regardless of how securely it is built; posture controls (auth, input validation, least privilege) cannot make a weapon safe, which is why a confirmed weaponization finding caps the trust verdict to `blocked` rather than being averaged against a good posture score. Catching malicious PURPOSE is a distinct safety control, and it must be conservative because offensive capability is dual-use: legitimate pentest, CTF, defensive, and research work must abstain (UNKNOWN), never block -- unless the artifact itself hides from the people who install, run or audit it.

Evidence

## PHP Dangerous Function Sinks

### Code/Command Execution Sinks

```php
// CRITICAL: any user input reaching these functions
eval($_GET['code']);
eval('$var = ' . $_POST['value'] . ';');
assert($_GET['assertion']);                    // PHP < 8: assert() can execute code strings
preg_replace('/' . $_GET['pattern'] . '/e', $_GET['replacement'], $subject);  // /e modifier (PHP < 7)

exec($_GET['cmd'], $output);
system($_GET['cmd']);
passthru($_GET['cmd']);
…

## PHP/Python/Node.js EL-Equivalent Patterns

### PHP

```php
// VULNERABLE: eval() with user input
eval($_GET['code']);
eval('$result = ' . $_POST['expr'] . ';');

// VULNERABLE: create_function() (deprecated but still present)
$fn = create_function('', $_GET['body']);
$fn();

// VULNERABLE: preg_replace with /e modifier (PHP < 7.0)
…

---
name: llm-sast-scanner
description: >
  General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.
  Trigger when the user asks to: "analyze code for vulnerabilities", "review code security", "find security bugs",
  "do a SAST scan", "check for [vulnerability type] in code", "audit source code", or requests a security
  code review of any language or framework. Covers 34 vulnerability classes across web, API, auth, mobile, and logic layers.
metadata:
  version: "1.4.0"
  domain: application-security
  references: 34 vulnerability knowledge bases
---

Why it got this result

Gitleaks flagged 6 hits (3 unique, duplicated across llm-sast-scanner/references/*.md and references/*.md identical copies from two different commits in history) for generic-api-key patterns. All three are illustrative placeholder values inside markdown documentation teaching an LLM how to recognize hardcoded-credential anti-patterns in THIRD-PARTY code, not real secrets belonging to this project: (1) references/default_credentials.md:35 'DJANGO_SECRET_KEY = "[REDACTED]"' is explicitly listed under a '## Python Source Detection Rules' / '- **VULN**:' heading as an example of what a scanner should flag; (2) references/insecure_deserialization.md:29 'CVE-2017-18349' is a CVE identifier, not a secret, misclassified by gitleaks' entropy heuristic; (3) references/mobile_security.md:647 'let key = "MySecretKey12345"' is explicitly labeled '**VULN**:' as a hardcoded-encryption-key teaching example for Swift code. None of these values are used anywhere in this repo's own runtime (there is no runtime) to authenticate, sign, or encrypt anything -- they exist solely as documentation of what the scanning skill should detect elsewhere. No .env, config, or credential file with a real secret value is committed.

Why it matters

Plaintext secrets are easily exfiltrated.

Evidence

## Python Source Detection Rules

### Direct assignment
- **VULN**: `password = "admin"` — literal credential assigned to password variable
- **VULN**: `SECRET_KEY = "changeme"` — Flask/Django secret key hardcoded
- **VULN**: `app.secret_key = 'hardcoded_secret'` — Flask session signing key
[REDACTED]
- **VULN**: `API_KEY = "[REDACTED]"` — hardcoded API key

#### Hardcoded Encryption Key

**VULN**:
```swift
[REDACTED]
let keyData = key.data(using: .utf8)!
CCCrypt(kCCEncrypt, kCCAlgorithmAES, kCCOptionPKCS7Padding,
        (keyData as NSData).bytes, keyData.count, iv, ...)
```

**Fastjson (com.alibaba.fastjson)**
- `JSON.parseObject(input)` / `JSON.parse(input)` — auto-type can instantiate arbitrary classes
- `@type` field in JSON enables polymorphic deserialization leading to RCE
- AutoType enabled by default in older versions; bypass gadgets exist in many versions < 1.2.83
[REDACTED]

+6 more locations in the finding JSON

Why it got this result

This rule's applicability is scoped to shipped application_runtime code and explicitly excludes build/test/developer tooling. This repo ships zero executable code -- only SKILL.md and markdown reference docs. The exec()/system()/eval() patterns present (e.g. llm-sast-scanner/references/php_security.md:22-38, expression_language_injection.md:52-69) are illustrative VULNERABLE/SAFE teaching snippets inside fenced code blocks that document what a scanning LLM should detect in THIRD-PARTY target codebases -- they are never parsed or executed by this repository itself. There is no runtime entry point, server, or interpreter shipped here for an attacker-controlled input to reach.

Why it matters

Unsanitized command construction in shipped runtime code can give a remote attacker arbitrary code execution with the application's privileges.

Why it got this result

The repository contains no application code at all -- it is a documentation-only Claude/Codex 'skill' package (one SKILL.md plus 34 markdown reference files under llm-sast-scanner/references/) that teaches an LLM agent how to perform SAST taint analysis on OTHER codebases. There is no HTTP client, fetch wrapper, or network call of any kind shipped in this repo, so the SSRF threat model (arbitrary user-supplied URL reaching an HTTP client) cannot apply to this artifact's architecture.

Why it matters

Enables internal pivoting and data exfiltration.

Why it got this result

No dependency manifest (package.json, requirements.txt, go.mod, Cargo.toml, etc.) or lockfile exists in the repository -- it ships zero code dependencies, only markdown documentation. Trivy fs scan likewise found no SBOM-relevant artifacts to analyze.

Why it matters

Prevents typosquat and malicious update compromise.

Why it got this result

No HTTP/JSON-RPC handler, request parser, or any code accepting external structured input exists in this repo. The artifact is static instructional markdown consumed directly by a host LLM agent's existing file-reading tools (Read/Grep); it defines no API surface of its own that would need schema validation.

Why it matters

Frontline control to prevent multiple classes of vulns.

Why it got this result

No deserialization code (pickle/yaml.load/unserialize/ObjectInputStream) is shipped or executed by this repo. References/insecure_deserialization.md and references/php_security.md contain illustrative VULNERABLE unserialize()/pickle.loads() snippets purely as teaching examples for the scanning LLM to recognize in THIRD-PARTY codebases -- they are never invoked by this artifact itself.

Why it matters

Can lead to arbitrary code execution.

Why it got this result

This repo ships no filesystem-tool implementation (no fs.readFile/open/path-resolution code of its own). It relies entirely on the HOST agent's pre-existing Read/Grep/Glob tools to read a target codebase; it defines no MCP tool handler or HTTP route that accepts a caller-supplied path argument. The path-traversal threat model (a shipped tool resolving a caller-controlled path without containment) does not map onto an artifact that implements no tools of its own.

Why it matters

Traversal exposes arbitrary host files; can lead to code execution.

Why it got this result

This artifact implements no tool handler of its own (no fetch/scrape/web-read code is shipped; there is zero executable code in the repo at all -- only SKILL.md and 34 markdown reference files). The skill is consumed by a HOST agent's pre-existing file-reading tools (Read/Grep/Glob), which are entirely outside this artifact's control and already subject to the host's own tool-output handling. Because the repo declares and implements no tool whose return value is injected into LLM context, the envelope/sanitization/untrustedReturn threat model this rule targets has no component here to attach to.

Why it matters

Tool outputs are a primary prompt-injection vector. Third-party content (web pages, files, API responses) may contain text crafted to override instructions or impersonate system/tool messages. Without a host-enforced envelope, sanitization, and an explicit untrusted-return signal, the model can be coerced into executing attacker-controlled directives, leaking secrets, or chaining further tool calls on behalf of the adversary.

Why it got this result

No .github/workflows, .gitlab-ci.yml, Jenkinsfile, or any CI/CD configuration exists anywhere in the repository (verified by directory listing -- repo contains only README.md and llm-sast-scanner/{SKILL.md,references/*.md}). There is no CI/CD execution context to evaluate.

Why it matters

CI/CD script injection can execute attacker-controlled commands with workflow tokens, repository secrets, trusted-runner access, artifact or cache authority, and release or deployment privileges.

Why it got this result

No server, HTTP endpoint, or streaming handler is shipped in this repo -- it is static documentation (SKILL.md + references/*.md) with no runtime process to exhaust. The DoS-protection threat model (missing timeouts/body-size limits/rate limiting in a running service) does not apply to a markdown instruction artifact.

Why it matters

Resource exhaustion can crash or stall MCP.

Why it got this result

No logging code exists in this repo. The artifact is a set of instructions telling an LLM agent how to write a markdown report (sast_report.md) of findings in another target codebase; there are no logger calls, log files, or audit-trail mechanisms shipped here for secrets/PII to leak through.

Why it matters

Prevents sensitive data leakage; enables forensics.

Why it got this result

No Dockerfile, docker-compose, Helm chart, or Kubernetes manifest exists anywhere in the repository (verified via find for Dockerfile*/docker-compose*/*.yaml patterns -- none found; trivy config scan also returned no IaC results). This artifact is not containerized or deployed as a service, so container/runtime hardening does not apply.

Why it matters

Reduces blast radius of exploits.

Why it got this result

No HTML/terminal rendering code exists in this repo; it produces no user-facing web UI or templated output of its own. The artifact only instructs an LLM to write a markdown report file -- there is no output-encoding sink shipped here to evaluate.

Why it matters

Prevents UI-level injection and operator compromise.

Why it got this result

No billable external API integration (paid model calls, cloud service invocations) is shipped or orchestrated by this repo beyond the host LLM's own normal inference loop, which is outside this artifact's control. There is no tool-invocation pathway defined here that could be abused for unbounded paid-API calls.

Why it matters

Prevents cost-based disruption.