{"repo_url":"https://github.com/SunWeb3Sec/llm-sast-scanner","overall_status":"completed","scanned_at":"2026-10-14T23:10:28.372Z","scan_summary":{"total_components":1,"worst_case_severity":"HIGH","repo_trust_score":{"score":85,"tier":"high","capability_band":"moderate","score_confidence":"medium","score_interval":{"low":69,"high":100},"factors":["ATR-P0008 HIGH"]}},"components":[{"artifact_version":"2.0","component":{"component_type":"skill","component_name":"skills-plugins/llm-sast-scanner","component_path":"llm-sast-scanner","metadata":{"manifest":"llm-sast-scanner/SKILL.md","version":"1.4.0"}},"scan_provenance":{"scanned_at":"2026-10-14T23:10:28.372Z","resolved_ref":"fedaf6a57a023ea5dc2a4bb8868ab02d0b243d52","resolved_ver":null},"repo_context":{"repo_url":"https://github.com/SunWeb3Sec/llm-sast-scanner","languages":["Markdown"],"transports_detected":[],"deployment_artifacts":[],"provenance":{"publisher":"SunWeb3Sec","publisher_verified":false,"signed_build":false,"dependency_cve_count":null,"maintenance_active":true,"declared_policy":false}},"component_findings":[{"rule_id":"ATR-P0001","rule_version":"1.0.0","rule_name":"Capability Transparency: Declared Purpose vs. Actual Behavior (Shadow Features)","finding":"SECURE","severity":"CRITICAL","realized_severity":null,"confidence":"high","rationale":"llm-sast-scanner is a pure prompt/instruction skill (SKILL.md frontmatter + 34 markdown reference files). It ships zero executable code -- no scripts, no bundled binaries, no package.json, no subprocess/network/filesystem-access code of its own. The declared purpose (static code-vulnerability analysis via taint tracing, producing a markdown report) matches the entirety of its content: the body only instructs the host model to read/search the TARGET repo's source files (via whatever Read/Grep/Bash tools the host already grants) and write a report file -- behavior fully implied by a 'SAST scanner' skill. No hidden network egress, no credential reads, no undisclosed exec capability was found anywhere in the artifact.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Install-time trust is granted from the artifact's self-description, so any bundled capability the description does not disclose -- network egress, credential reads, or subprocess execution -- runs as an unconsented backdoor with the host agent's full privileges.","context_note":null,"within_declared_contract":true,"transport_gated":false,"mitigation_present":null,"evidence":[{"path":"llm-sast-scanner/SKILL.md","start_line":62,"end_line":62,"snippet":"---\nname: llm-sast-scanner\ndescription: >\n  General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.\n  Trigger when the user asks to: \"analyze code for vulnerabilities\", \"review code security\", \"find security bugs\",\n  \"do a SAST scan\", \"check for [vulnerability type] in code\", \"audit source code\", or requests a security\n  code review of any language or framework. Covers 34 vulnerability classes across web, API, auth, mobile, and logic layers.\nmetadata:\n  version: \"1.4.0\"\n  domain: application-security\n  references: 34 vulnerability knowledge bases\n---\n\n# SAST Vulnerability Analysis\n\n## Purpose\n\nSystematically analyze source code for security vulnerabilities using structured Source→Sink taint tracking,\npattern matching, and vulnerability-class-specific detection heuristics.","vulnerability":{}}],"affected_tools":null,"component_name":"skills-plugins/llm-sast-scanner"},{"rule_id":"ATR-P0002","rule_version":"1.0.0","rule_name":"Consent Suppression and Guardrail / Human-in-the-Loop Subversion via Trusted Instructions","finding":"SECURE","severity":"CRITICAL","realized_severity":null,"confidence":"high","rationale":"Searched SKILL.md and all reference files for consent-bypass / disclosure-suppression imperatives directed at the host model (never ask, auto-approve, do not tell the user, override system prompt, autonomous mode, bypass confirmation). The only hits are unrelated uses of 'silently' and 'bypass confirmation' describing TARGET APPLICATION vulnerability patterns the skill is instructed to DETECT (e.g., CSRF/clickjacking bypassing a dialog in scanned code, or a Judge verdict table noting 'Drop silently' for a dropped FALSE POSITIVE finding from the report -- an internal QA step, not suppression of a privileged action from the user). No directive asks the host agent to skip its own consent/HITL gate or hide a privileged action it performs.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Because a skill/plugin instruction body is ingested as trusted first-party context, consent- or oversight-suppressing prose inherits the host's full authority and turns a passive package into a self-authorizing backdoor that strips the human-in-the-loop control from every action it can reach.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[{"path":"llm-sast-scanner/references/csrf.md","start_line":142,"end_line":153,"snippet":"- Deep links and embedded WebViews may silently forward cookies; trigger state changes via crafted intents or deep links\n...\n- CSRF + Clickjacking: steer user interactions to bypass confirmation dialogs in the UI"},{"path":"llm-sast-scanner/SKILL.md","start_line":62,"end_line":238,"snippet":"| Verdict | Meaning | Action |\n|---------|---------|--------|\n| **CONFIRMED** | All reachability/sanitization/exploitability checks pass | Include in report |\n| **LIKELY** | Most checks pass; one uncertainty remains | Include in report, flag uncertainty |\n| **NEEDS CONTEXT** | Cannot determine without runtime behavior / config / additional files | Note as \"unverifiable without X\" |\n| **FALSE POSITIVE** | Positive evidence of protection found — cite the exact file+line of the sanitization, allowlist check, guard, or framework-level auto-protection that makes the sink safe | Drop silently |\n\n**Only CONFIRMED and LIKELY findings are reported.**","vulnerability":{}}],"affected_tools":null,"component_name":"skills-plugins/llm-sast-scanner"},{"rule_id":"ATR-P0003","rule_version":"1.2.0","rule_name":"Host-Credential and Conversation-Context Harvesting and Exfiltration","finding":"NOT_APPLICABLE","severity":"CRITICAL","realized_severity":null,"confidence":"high","rationale":"The skill's instruction body (SKILL.md) and its 34 reference files contain no directive to read host credential stores (env vars, ~/.ssh, ~/.aws, .env, keychains, cloud metadata) and no directive to dump the model's system prompt, conversation history, or persistent memory files. The only 'reads' the skill performs are of the TARGET repository's own source files, which is its declared function. Per the rule's SCOPE guidance, since no harvest step (of host credentials or conversation/memory context) exists at all, the harvest+exfil pair this rule tests for cannot be constructed, so the correct verdict is NOT_APPLICABLE rather than SECURE.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"A skill or plugin that couples a host-credential or live-conversation read with an outbound channel turns an ostensibly benign helper into an autonomous exfiltration agent, leaking long-lived secrets, session tokens, and confidential prompt context to an attacker on every invocation across every tool the artifact serves.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[{"path":"llm-sast-scanner/SKILL.md","start_line":62,"end_line":405,"snippet":"```markdown\n# SAST Security Report — <target>\nDate: <date>\nAnalyzer: llm-sast-scanner v1.4\n\n## Executive Summary\n<2-3 sentences: total findings by severity, most critical issue>\n\n## Coverage — Sink Inventory (Pass A)\n<Total sinks found per class, and the disposition of each: TAINTED / CONSTANT / UNREACHED.\nA report without this section is incomplete, not clean.>\n```","vulnerability":{}}],"affected_tools":null,"component_name":"skills-plugins/llm-sast-scanner"},{"rule_id":"ATR-P0004","rule_version":"1.1.0","rule_name":"Format-Native Out-of-Band Execution and Host Control-Plane Persistence","finding":"NOT_APPLICABLE","severity":"CRITICAL","realized_severity":null,"confidence":"high","rationale":"The repo ships ONLY markdown (SKILL.md + references/*.md) and a README -- confirmed via filesystem walk (no .py/.js/.sh/.ts files, no package.json, no hooks directory, no settings.json, no git hooks, no env-var assignment blocks). There is no bundled script, lifecycle/event hook (no PreToolUse/PostToolUse, no ADK callback, no activationEvents), no entry-point code, no dotenv, and no exec-enabling or LLM-endpoint-substituting env assignment anywhere in the artifact. Per the rule's SCOPE guidance, a bundle shipping NONE of the format-native execution/control-plane primitives has no surface for this rule to evaluate -- verdict is NOT_APPLICABLE, not SECURE.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Format-native execution and control-plane writes bypass the model's reasoning loop, converting a single install approval into durable, self-reinjecting code execution that can MITM the host agent's own model endpoint and silently subvert every subsequent tool call.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[{"path":"llm-sast-scanner","start_line":1,"end_line":1,"snippet":"find . -name \"*.py\" -o -name \"*.js\" -o -name \"*.sh\" -o -name \"*.ts\" | grep -v .git\n(no output -- repo contains only SKILL.md + 34 references/*.md + README.md, no executable artifacts, no hooks, no settings.json, no package.json)"}],"affected_tools":null,"component_name":"skills-plugins/llm-sast-scanner"},{"rule_id":"ATR-P0005","rule_version":"1.0.0","rule_name":"Over-Declared / Over-Privileged Artifact Manifest Scope","finding":"SECURE","severity":"HIGH","realized_severity":null,"confidence":"high","rationale":"SKILL.md frontmatter declares only `name`, `description`, and a `metadata` block (version/domain/references count) -- it does NOT declare an `allowed-tools` list, OAuth scope, or any wildcard/catch-all capability grant at all. There is no package.json/bin/postinstall, no lifecycle hook, and no bundled executable, so there is no undisclosed install-time execution reach hidden inside a passive-looking artifact. The skill's prose does direct the host to use its already-available Read/Grep tools to inspect the target repo and a Write-capable tool to produce `sast_report.md`, both of which are intrinsic to a SAST-scanning skill's stated function and not a capability-class escalation beyond it.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"An artifact that self-declares host privilege far beyond its stated function -- or hides executable reach inside a passive-looking package -- gives a single install a blast radius the operator never scoped, so any later mistake, compromise, or misconfiguration detonates across resources the artifact never needed.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[{"path":"llm-sast-scanner/SKILL.md","start_line":62,"end_line":62,"snippet":"---\nname: llm-sast-scanner\ndescription: >\n  General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.\n  ...\nmetadata:\n  version: \"1.4.0\"\n  domain: application-security\n  references: 34 vulnerability knowledge bases\n---","vulnerability":{}}],"affected_tools":null,"component_name":"skills-plugins/llm-sast-scanner"},{"rule_id":"ATR-P0006","rule_version":"1.1.0","rule_name":"Injection and Concealed Directives in Skill/Plugin Manifest and Instruction Text","finding":"SECURE","severity":"HIGH","realized_severity":null,"confidence":"high","rationale":"Codepoint-scanned SKILL.md (and spot-checked references/*.md) for zero-width/bidi-override/Tag-block characters: none found (only ordinary em/en-dashes U+2013/2014 and arrow glyphs U+2190/2192 appear, all mid-sentence typographic marks, not concealment codepoints). Searched for forged chat-template tokens (<|im_start|>, [INST], <start_of_turn>, ### System:) and ANSI/OSC escape bytes (\\x1b): none present anywhere in the artifact. HTML comments found in references/jndi_injection.md and rce.md are fenced-code illustrative XML (pom.xml dependency examples) describing a TARGET application's vulnerable Log4j version, not hidden host-directed instructions. No mixed-script homoglyph substitution was found in any carrier (SKILL.md is 100% ASCII aside from the typographic marks noted). All instruction text is purely descriptive of the skill's own scanning workflow.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"A skill or plugin's always-loaded manifest and instruction carriers (frontmatter/body, `description_for_model`, Gemini `FunctionDeclaration.description` / Vertex AI extension `manifest` / ADK agent `instruction`, tool docstrings, JSON-Schema descriptions) are concatenated into the host agent prompt at operator privilege, so a directive that is hidden with non-printing codepoints, disguised with a homoglyph, forged with role-control tokens, or masked from the rendered view silently commandeers model behavior toward attacker-chosen actions across every tool the artifact serves -- with no code execution required and nothing visible to a reviewer reading the rendered text.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[{"path":"llm-sast-scanner/SKILL.md","start_line":62,"end_line":62,"snippet":"---\nname: llm-sast-scanner\ndescription: >\n  General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.\n  Trigger when the user asks to: \"analyze code for vulnerabilities\", \"review code security\", \"find security bugs\",\n  \"do a SAST scan\", \"check for [vulnerability type] in code\", \"audit source code\", or requests a security\n  code review of any language or framework. Covers 34 vulnerability classes across web, API, auth, mobile, and logic layers.\nmetadata:\n  version: \"1.4.0\"\n  domain: application-security\n  references: 34 vulnerability knowledge bases\n---","vulnerability":{}},{"path":"llm-sast-scanner/references/jndi_injection.md","start_line":119,"end_line":125,"snippet":"<!-- pom.xml — VULNERABLE versions -->\n<dependency>\n    <groupId>org.apache.logging.log4j</groupId>\n    <artifactId>log4j-core</artifactId>\n    <version>2.14.1</version>  <!-- CVE-2021-44228 -->\n</dependency>\n<!-- Any version < 2.17.0 is potentially vulnerable to some Log4Shell variant -->"}],"affected_tools":null,"component_name":"skills-plugins/llm-sast-scanner"},{"rule_id":"ATR-P0007","rule_version":"1.0.0","rule_name":"Skill/Plugin Package Provenance, Integrity, and Post-Approval Mutation (Rug-Pull)","finding":"SECURE","severity":"HIGH","realized_severity":null,"confidence":"high","rationale":"The skill's entire model-facing trust surface (SKILL.md frontmatter/body + 34 references/*.md) ships INSIDE the pinned git repository/commit; there is no runtime fetch of the skill's own instructions, no self-updater, no auto-update/hot-reload code, and no code that rewrites its own on-disk manifest after install (confirmed: repo contains only static markdown files, no scripts of any kind). Per the installation instructions in README.md, a user clones/copies the repo content once into ~/.claude/skills/ or ~/.codex/skills/; any content change requires a fresh git pull/clone that the user initiates, which functions as an implicit re-approval step rather than a silent post-approval mutation.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"A skill/plugin reviewed once and then trusted indefinitely becomes a rug-pull vector when its OWN model-facing instruction body, declared scope, or manifest can be live-swapped or silently mutated after approval -- without an approval-time digest that is re-compared on load and re-consent on any change, a publisher (or an attacker who compromises the distribution channel) can rewrite the artifact's trusted instructions or widen its tool scope under authority the host already granted, turning an approved package into an exfiltration or unauthorized-action backdoor.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[{"path":"llm-sast-scanner/SKILL.md","start_line":62,"end_line":62,"snippet":"---\nname: llm-sast-scanner\ndescription: >\n  General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.\n  ...\nmetadata:\n  version: \"1.4.0\"\n  domain: application-security\n  references: 34 vulnerability knowledge bases\n---","vulnerability":{}},{"path":"README.md","start_line":21,"end_line":33,"snippet":"### Git (recommended)\n\n```bash\n# Claude Code\ngit clone https://github.com/anthropic-lab/llm-sast-scanner.git\ncp -r llm-sast-scanner/llm-sast-scanner/ ~/.claude/skills/\n\n# OpenAI Codex\ngit clone https://github.com/anthropic-lab/llm-sast-scanner.git\ncp -r llm-sast-scanner/llm-sast-scanner/ ~/.codex/skills/\n```"}],"affected_tools":null,"component_name":"skills-plugins/llm-sast-scanner"},{"rule_id":"ATR-P0008","rule_version":"1.0.0","rule_name":"Skill/Plugin Impersonation, Typosquatting & Publisher Spoofing","finding":"VULNERABLE","severity":"HIGH","realized_severity":"HIGH","confidence":"medium","rationale":"The skill's own frontmatter slug (`name: llm-sast-scanner`) is generic and matches the real repository name, but the README's installation section twice directs users -- for both Claude Code and OpenAI Codex -- to clone from `github.com/anthropic-lab/llm-sast-scanner.git`. That organization is a trust-implying lookalike of the Anthropic brand; the artifact's actual, verified provenance is `SunWeb3Sec/llm-sast-scanner`. Directing installers to a different, brand-adjacent publisher than the artifact's real origin is install-instruction impersonation, which is in scope for this rule alongside manifest-slug impersonation.","vulnerability_details":null,"fix_guidance":"Correct the README install commands to clone from the verified publisher origin (github.com/SunWeb3Sec/llm-sast-scanner) in place of the `anthropic-lab` organization, and remove any wording that could imply Anthropic is the publisher or distributor of this skill.","why_this_matters":"Impersonation is the entry point of the agentic supply chain (OWASP LLM ASI04 / MITRE ATT&CK T1195): a skill or plugin installed on the strength of a familiar name inherits the host agent's execution context before any payload runs. The deception front-runs trust, so catching the identity lie breaks the chain at the cheapest point -- and it is independent of whether the current code is benign, because the same trusted-looking name can ship a payload in the next version.","context_note":"[capability_by_design|relief:none|ineligible:within_declared_contract] within_declared_contract is ineligible for relief on ATR-P0008 because the rule declares that signal orthogonal to its risk (discount_ineligible_signals); the reported behaviour is within the tool's declared capability, and that does not reduce this finding's severity. No context relief applies; realized severity equals HIGH.","within_declared_contract":null,"transport_gated":null,"mitigation_present":null,"evidence":[{"path":"llm-sast-scanner/SKILL.md","start_line":1,"end_line":11,"snippet":"---\nname: llm-sast-scanner\ndescription: >\n  General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.\n  Trigger when the user asks to: \"analyze code for vulnerabilities\", \"review code security\", \"find security bugs\",\n  \"do a SAST scan\", \"check for [vulnerability type] in code\", \"audit source code\", or requests a security\n  code review of any language or framework. Covers 34 vulnerability classes across web, API, auth, mobile, and logic layers.\nmetadata:\n  version: \"1.4.0\"\n  domain: application-security\n  references: 34 vulnerability knowledge bases"},{"path":"README.md","start_line":21,"end_line":33,"snippet":"## Installation\n\n### Git (recommended)\n\n```bash\n# Claude Code\ngit clone https://github.com/anthropic-lab/llm-sast-scanner.git\ncp -r llm-sast-scanner/llm-sast-scanner/ ~/.claude/skills/\n\n# OpenAI Codex\ngit clone https://github.com/anthropic-lab/llm-sast-scanner.git\ncp -r llm-sast-scanner/llm-sast-scanner/ ~/.codex/skills/\n```"},{"path":"llm-sast-scanner/SKILL.md","start_line":62,"end_line":62,"snippet":"---\nname: llm-sast-scanner\ndescription: >\n  General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.\n  Trigger when the user asks to: \"analyze code for vulnerabilities\", \"review code security\", \"find security bugs\",\n  \"do a SAST scan\", \"check for [vulnerability type] in code\", \"audit source code\", or requests a security\n  code review of any language or framework. Covers 34 vulnerability classes across web, API, auth, mobile, and logic layers.\nmetadata:\n  version: \"1.4.0\"\n  domain: application-security\n  references: 34 vulnerability knowledge bases\n---","vulnerability":{}}],"affected_tools":null,"component_name":"skills-plugins/llm-sast-scanner"}],"repo_findings_inherited":[{"rule_id":"ATR-C0001","rule_version":"1.2.0","rule_name":"Unrestricted Network Fetch / SSRF","finding":"NOT_APPLICABLE","severity":"HIGH","realized_severity":null,"confidence":"high","rationale":"The repository contains no application code at all -- it is a documentation-only Claude/Codex 'skill' package (one SKILL.md plus 34 markdown reference files under llm-sast-scanner/references/) that teaches an LLM agent how to perform SAST taint analysis on OTHER codebases. There is no HTTP client, fetch wrapper, or network call of any kind shipped in this repo, so the SSRF threat model (arbitrary user-supplied URL reaching an HTTP client) cannot apply to this artifact's architecture.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Enables internal pivoting and data exfiltration.","context_note":null,"within_declared_contract":null,"transport_gated":null,"mitigation_present":null,"evidence":[],"affected_tools":null,"component_name":null},{"rule_id":"ATR-C0002","rule_version":"1.3.2","rule_name":"Static Secrets","finding":"SECURE","severity":"HIGH","realized_severity":null,"confidence":"high","rationale":"Gitleaks flagged 6 hits (3 unique, duplicated across llm-sast-scanner/references/*.md and references/*.md identical copies from two different commits in history) for generic-api-key patterns. All three are illustrative placeholder values inside markdown documentation teaching an LLM how to recognize hardcoded-credential anti-patterns in THIRD-PARTY code, not real secrets belonging to this project: (1) references/default_credentials.md:35 'DJANGO_SECRET_KEY = \"[REDACTED]\"' is explicitly listed under a '## Python Source Detection Rules' / '- **VULN**:' heading as an example of what a scanner should flag; (2) references/insecure_deserialization.md:29 'CVE-2017-18349' is a CVE identifier, not a secret, misclassified by gitleaks' entropy heuristic; (3) references/mobile_security.md:647 'let key = \"MySecretKey12345\"' is explicitly labeled '**VULN**:' as a hardcoded-encryption-key teaching example for Swift code. None of these values are used anywhere in this repo's own runtime (there is no runtime) to authenticate, sign, or encrypt anything -- they exist solely as documentation of what the scanning skill should detect elsewhere. No .env, config, or credential file with a real secret value is committed.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Plaintext secrets are easily exfiltrated.","context_note":null,"within_declared_contract":true,"transport_gated":false,"mitigation_present":true,"evidence":[{"path":"llm-sast-scanner/references/default_credentials.md","start_line":29,"end_line":36,"snippet":"## Python Source Detection Rules\n\n### Direct assignment\n- **VULN**: `password = \"admin\"` — literal credential assigned to password variable\n- **VULN**: `SECRET_KEY = \"changeme\"` — Flask/Django secret key hardcoded\n- **VULN**: `app.secret_key = 'hardcoded_secret'` — Flask session signing key\n[REDACTED]\n- **VULN**: `API_KEY = \"[REDACTED]\"` — hardcoded API key"},{"path":"llm-sast-scanner/references/mobile_security.md","start_line":643,"end_line":651,"snippet":"#### Hardcoded Encryption Key\n\n**VULN**:\n```swift\n[REDACTED]\nlet keyData = key.data(using: .utf8)!\nCCCrypt(kCCEncrypt, kCCAlgorithmAES, kCCOptionPKCS7Padding,\n        (keyData as NSData).bytes, keyData.count, iv, ...)\n```"},{"path":"llm-sast-scanner/references/insecure_deserialization.md","start_line":25,"end_line":30,"snippet":"**Fastjson (com.alibaba.fastjson)**\n- `JSON.parseObject(input)` / `JSON.parse(input)` — auto-type can instantiate arbitrary classes\n- `@type` field in JSON enables polymorphic deserialization leading to RCE\n- AutoType enabled by default in older versions; bypass gadgets exist in many versions < 1.2.83\n[REDACTED]"},{"path":"llm-sast-scanner/references/default_credentials.md","start_line":35,"end_line":35,"snippet":null,"vulnerability":{}},{"path":"llm-sast-scanner/references/insecure_deserialization.md","start_line":29,"end_line":29,"snippet":null,"vulnerability":{}},{"path":"references/default_credentials.md","start_line":35,"end_line":35,"snippet":null,"vulnerability":{}},{"path":"references/insecure_deserialization.md","start_line":29,"end_line":29,"snippet":null,"vulnerability":{}},{"path":"references/mobile_security.md","start_line":647,"end_line":647,"snippet":null,"vulnerability":{}},{"path":"llm-sast-scanner/references/mobile_security.md","start_line":647,"end_line":647,"snippet":null,"vulnerability":{}}],"affected_tools":null,"component_name":null},{"rule_id":"ATR-C0003","rule_version":"1.3.0","rule_name":"Runtime Command Injection via Process Execution","finding":"NOT_APPLICABLE","severity":"CRITICAL","realized_severity":null,"confidence":"high","rationale":"This rule's applicability is scoped to shipped application_runtime code and explicitly excludes build/test/developer tooling. This repo ships zero executable code -- only SKILL.md and markdown reference docs. The exec()/system()/eval() patterns present (e.g. llm-sast-scanner/references/php_security.md:22-38, expression_language_injection.md:52-69) are illustrative VULNERABLE/SAFE teaching snippets inside fenced code blocks that document what a scanning LLM should detect in THIRD-PARTY target codebases -- they are never parsed or executed by this repository itself. There is no runtime entry point, server, or interpreter shipped here for an attacker-controlled input to reach.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Unsanitized command construction in shipped runtime code can give a remote attacker arbitrary code execution with the application's privileges.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[],"affected_tools":null,"component_name":null},{"rule_id":"ATR-C0004","rule_version":"1.2.0","rule_name":"DoS Protections: Timeouts, Concurrency, Streaming Limits","finding":"NOT_APPLICABLE","severity":"MEDIUM","realized_severity":null,"confidence":"high","rationale":"No server, HTTP endpoint, or streaming handler is shipped in this repo -- it is static documentation (SKILL.md + references/*.md) with no runtime process to exhaust. The DoS-protection threat model (missing timeouts/body-size limits/rate limiting in a running service) does not apply to a markdown instruction artifact.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Resource exhaustion can crash or stall MCP.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[],"affected_tools":null,"component_name":null},{"rule_id":"ATR-C0005","rule_version":"1.2.0","rule_name":"Logging Hygiene (No Secrets/PII/Tokens) & Audit Trail","finding":"NOT_APPLICABLE","severity":"MEDIUM","realized_severity":null,"confidence":"high","rationale":"No logging code exists in this repo. The artifact is a set of instructions telling an LLM agent how to write a markdown report (sast_report.md) of findings in another target codebase; there are no logger calls, log files, or audit-trail mechanisms shipped here for secrets/PII to leak through.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Prevents sensitive data leakage; enables forensics.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[],"affected_tools":null,"component_name":null},{"rule_id":"ATR-C0006","rule_version":"1.2.0","rule_name":"Container/Runtime Hardening","finding":"NOT_APPLICABLE","severity":"MEDIUM","realized_severity":null,"confidence":"high","rationale":"No Dockerfile, docker-compose, Helm chart, or Kubernetes manifest exists anywhere in the repository (verified via find for Dockerfile*/docker-compose*/*.yaml patterns -- none found; trivy config scan also returned no IaC results). This artifact is not containerized or deployed as a service, so container/runtime hardening does not apply.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Reduces blast radius of exploits.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[],"affected_tools":null,"component_name":null},{"rule_id":"ATR-C0007","rule_version":"1.2.0","rule_name":"Dependency Risk & Supply Chain","finding":"NOT_APPLICABLE","severity":"HIGH","realized_severity":null,"confidence":"high","rationale":"No dependency manifest (package.json, requirements.txt, go.mod, Cargo.toml, etc.) or lockfile exists in the repository -- it ships zero code dependencies, only markdown documentation. Trivy fs scan likewise found no SBOM-relevant artifacts to analyze.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Prevents typosquat and malicious update compromise.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[],"affected_tools":null,"component_name":null},{"rule_id":"ATR-C0008","rule_version":"1.2.0","rule_name":"Missing or Inadequate Input Validation","finding":"NOT_APPLICABLE","severity":"HIGH","realized_severity":null,"confidence":"high","rationale":"No HTTP/JSON-RPC handler, request parser, or any code accepting external structured input exists in this repo. The artifact is static instructional markdown consumed directly by a host LLM agent's existing file-reading tools (Read/Grep); it defines no API surface of its own that would need schema validation.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Frontline control to prevent multiple classes of vulns.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[],"affected_tools":null,"component_name":null},{"rule_id":"ATR-C0009","rule_version":"1.2.0","rule_name":"Insecure Deserialization","finding":"NOT_APPLICABLE","severity":"HIGH","realized_severity":null,"confidence":"high","rationale":"No deserialization code (pickle/yaml.load/unserialize/ObjectInputStream) is shipped or executed by this repo. References/insecure_deserialization.md and references/php_security.md contain illustrative VULNERABLE unserialize()/pickle.loads() snippets purely as teaching examples for the scanning LLM to recognize in THIRD-PARTY codebases -- they are never invoked by this artifact itself.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Can lead to arbitrary code execution.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[],"affected_tools":null,"component_name":null},{"rule_id":"ATR-C0010","rule_version":"1.2.0","rule_name":"Lack of Output Encoding/Sanitization","finding":"NOT_APPLICABLE","severity":"MEDIUM","realized_severity":null,"confidence":"high","rationale":"No HTML/terminal rendering code exists in this repo; it produces no user-facing web UI or templated output of its own. The artifact only instructs an LLM to write a markdown report file -- there is no output-encoding sink shipped here to evaluate.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Prevents UI-level injection and operator compromise.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[],"affected_tools":null,"component_name":null},{"rule_id":"ATR-C0011","rule_version":"1.4.0","rule_name":"Path Traversal & Symlink Bypass (Filesystem Tools)","finding":"NOT_APPLICABLE","severity":"HIGH","realized_severity":null,"confidence":"high","rationale":"This repo ships no filesystem-tool implementation (no fs.readFile/open/path-resolution code of its own). It relies entirely on the HOST agent's pre-existing Read/Grep/Glob tools to read a target codebase; it defines no MCP tool handler or HTTP route that accepts a caller-supplied path argument. The path-traversal threat model (a shipped tool resolving a caller-controlled path without containment) does not map onto an artifact that implements no tools of its own.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Traversal exposes arbitrary host files; can lead to code execution.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[],"affected_tools":null,"component_name":null},{"rule_id":"ATR-C0012","rule_version":"1.2.0","rule_name":"Denial of Wallet / Cost Controls","finding":"NOT_APPLICABLE","severity":"MEDIUM","realized_severity":null,"confidence":"high","rationale":"No billable external API integration (paid model calls, cloud service invocations) is shipped or orchestrated by this repo beyond the host LLM's own normal inference loop, which is outside this artifact's control. There is no tool-invocation pathway defined here that could be abused for unbounded paid-API calls.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Prevents cost-based disruption.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[],"affected_tools":null,"component_name":null},{"rule_id":"ATR-C0013","rule_version":"1.1.0","rule_name":"Tool Output Sanitization & Injection Containment","finding":"NOT_APPLICABLE","severity":"HIGH","realized_severity":null,"confidence":"high","rationale":"This artifact implements no tool handler of its own (no fetch/scrape/web-read code is shipped; there is zero executable code in the repo at all -- only SKILL.md and 34 markdown reference files). The skill is consumed by a HOST agent's pre-existing file-reading tools (Read/Grep/Glob), which are entirely outside this artifact's control and already subject to the host's own tool-output handling. Because the repo declares and implements no tool whose return value is injected into LLM context, the envelope/sanitization/untrustedReturn threat model this rule targets has no component here to attach to.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"Tool outputs are a primary prompt-injection vector. Third-party content (web pages, files, API responses) may contain text crafted to override instructions or impersonate system/tool messages. Without a host-enforced envelope, sanitization, and an explicit untrusted-return signal, the model can be coerced into executing attacker-controlled directives, leaking secrets, or chaining further tool calls on behalf of the adversary.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[],"affected_tools":null,"component_name":null},{"rule_id":"ATR-C0014","rule_version":"1.2.0","rule_name":"CI/CD Workflow Script Injection","finding":"NOT_APPLICABLE","severity":"HIGH","realized_severity":null,"confidence":"high","rationale":"No .github/workflows, .gitlab-ci.yml, Jenkinsfile, or any CI/CD configuration exists anywhere in the repository (verified by directory listing -- repo contains only README.md and llm-sast-scanner/{SKILL.md,references/*.md}). There is no CI/CD execution context to evaluate.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"CI/CD script injection can execute attacker-controlled commands with workflow tokens, repository secrets, trusted-runner access, artifact or cache authority, and release or deployment privileges.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[],"affected_tools":null,"component_name":null},{"rule_id":"ATR-R0001","rule_version":"1.3.0","rule_name":"Weaponization: Malicious-Purpose Artifact (Offensive Capability by Design)","finding":"SECURE","severity":"CRITICAL","realized_severity":null,"confidence":"high","rationale":"The artifact's declared purpose (SKILL.md frontmatter, README.md) is unambiguously DEFENSIVE/DETECTIVE: 'General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis... find security bugs... audit source code' -- it instructs an LLM agent to locate, verify (via a Judge false-positive-elimination step), and REPORT vulnerabilities with remediation guidance in a THIRD-PARTY target codebase. This matches the rule's negative indicator for a clearly-defensive/detective artifact (malware-analysis / detection-engineering / security-teaching helper) with no offensive-production capability. Two YARA 'webshell' raw_artifacts matches (Zeus_Webshell_Command_Parameter, confidence 88) fire on references/php_security.md:22-38 and references/expression_language_injection.md:160-168 because those files contain PHP/Python command-execution code blocks -- but in context these are explicitly labeled teaching examples under 'VULN' / 'VULNERABLE' headings inside a vulnerability-detection reference, instructing the scanning LLM what pattern to FLAG when found in someone else's code, not operational attack tooling the skill itself runs or directs the agent to build for an attacker. There is no instruction anywhere in SKILL.md directing the agent to GENERATE malware/ransomware/credential-stealers/C2/droppers by request, no hardcoded C2 endpoints or exfil sinks, and no instruction to evade oversight, suppress logging, or operate covertly -- the workflow is openly auditable (writes a markdown sast_report.md, Judge review step, cites evidence). This is the clean SECURE end: defensive/educational security-analysis tooling that documents attacker techniques purely to detect and remediate them.","vulnerability_details":null,"fix_guidance":null,"why_this_matters":"An artifact whose purpose is to weaponize the agent -- to produce malware, steal credentials, evade defenses, or run attacks at scale -- is dangerous regardless of how securely it is built; posture controls (auth, input validation, least privilege) cannot make a weapon safe, which is why a confirmed weaponization finding caps the trust verdict to `blocked` rather than being averaged against a good posture score. Catching malicious PURPOSE is a distinct safety control, and it must be conservative because offensive capability is dual-use: legitimate pentest, CTF, defensive, and research work must abstain (UNKNOWN), never block -- unless the artifact itself hides from the people who install, run or audit it.","context_note":null,"within_declared_contract":null,"transport_gated":false,"mitigation_present":null,"evidence":[{"path":"llm-sast-scanner/references/php_security.md","start_line":18,"end_line":38,"snippet":"## PHP Dangerous Function Sinks\n\n### Code/Command Execution Sinks\n\n```php\n// CRITICAL: any user input reaching these functions\neval($_GET['code']);\neval('$var = ' . $_POST['value'] . ';');\nassert($_GET['assertion']);                    // PHP < 8: assert() can execute code strings\npreg_replace('/' . $_GET['pattern'] . '/e', $_GET['replacement'], $subject);  // /e modifier (PHP < 7)\n\nexec($_GET['cmd'], $output);\nsystem($_GET['cmd']);\npassthru($_GET['cmd']);\nshell_exec($_GET['cmd']);\n`{$_GET['cmd']}`;                             // backtick operator\npopen($_GET['cmd'], 'r');\nproc_open($_GET['cmd'], $desc, $pipes);\n\n// VULN indicator: user-controlled variable reaching any of the above\n```","vulnerability":{}},{"path":"llm-sast-scanner/references/expression_language_injection.md","start_line":146,"end_line":168,"snippet":"## PHP/Python/Node.js EL-Equivalent Patterns\n\n### PHP\n\n```php\n// VULNERABLE: eval() with user input\neval($_GET['code']);\neval('$result = ' . $_POST['expr'] . ';');\n\n// VULNERABLE: create_function() (deprecated but still present)\n$fn = create_function('', $_GET['body']);\n$fn();\n\n// VULNERABLE: preg_replace with /e modifier (PHP < 7.0)\npreg_replace('/' . $_GET['pattern'] . '/e', $_GET['replacement'], $subject);\n```\n\n### Python\n\n```python\n# VULNERABLE: eval/exec with user input\nresult = eval(request.args['expr'])\nexec(request.form['code'])\n```","vulnerability":{}},{"path":"llm-sast-scanner/SKILL.md","start_line":62,"end_line":62,"snippet":"---\nname: llm-sast-scanner\ndescription: >\n  General-purpose Static Application Security Testing (SAST) skill for code vulnerability analysis.\n  Trigger when the user asks to: \"analyze code for vulnerabilities\", \"review code security\", \"find security bugs\",\n  \"do a SAST scan\", \"check for [vulnerability type] in code\", \"audit source code\", or requests a security\n  code review of any language or framework. Covers 34 vulnerability classes across web, API, auth, mobile, and logic layers.\nmetadata:\n  version: \"1.4.0\"\n  domain: application-security\n  references: 34 vulnerability knowledge bases\n---","vulnerability":{}}],"affected_tools":null,"component_name":null}],"component_tools":[{"tool_name":"sast_taint_scan_workflow","tool_description":"The skill's core directed workflow: instructs the host model to read/grep target repository source files, perform bidirectional source/sink taint analysis across 34 vulnerability classes, and write a markdown security report (sast_report.md) via the host's already-granted Read/Grep/Write capabilities. Not a separately registered MCP tool -- it is prose directing use of the host's existing file tools.","types":["read-only","write"],"status":"IMPLEMENTED","component_name":"skills-plugins/llm-sast-scanner"}],"summary":{"high_level_risks":["README.md install instructions direct users to clone from `github.com/anthropic-lab/llm-sast-scanner.git`, an org name implying Anthropic authorship that does not match the real, verifiable publisher (SunWeb3Sec) -- a human-facing distribution-channel impersonation risk.","Gitleaks flagged 3 unique 'secret' values (my-secret-key-12345, MySecretKey12345, and a misclassified CVE identifier) inside explicitly-labeled teaching examples in '**VULN**' documentation sections -- all are illustrative anti-patterns, none are live secrets, adjudicated SECURE.","Two YARA 'webshell' signature hits (Zeus_Webshell_Command_Parameter, confidence 88) fired on php_security.md and expression_language_injection.md due to documented PHP/Python command-execution sinks (eval/exec/system) used as defensive/educational SAST reference material -- adjudicated SECURE for ATR-R0001 (Weaponization).","No .bluerock.yaml/bluerock.yaml policy file present in the repo -- default full-scope scan with no overrides applied."],"top_remediations":["Fix README.md install commands to clone from the real repository (github.com/SunWeb3Sec/llm-sast-scanner) instead of the look-alike `anthropic-lab` org to eliminate impersonation risk for users.","Consider adding a brief disclaimer note near the webshell-pattern teaching examples (php_security.md, expression_language_injection.md) clarifying they are detection reference material, to reduce false-positive noise from automated malware scanners run by downstream consumers.","Continue avoiding real-looking secret values in future reference-file examples; replacing current placeholder tokens with even more obviously-fake values (e.g., 'EXAMPLE_KEY_DO_NOT_USE') would further reduce scanner false positives.","If the project ever ships executable tooling (e.g., a script that invokes the SAST workflow programmatically or a web UI), perform a full ATR-C re-evaluation at that time covering network/SSRF, command injection, dependency risk, and related controls.","Consider adding a documented approval/versioning note (e.g., a changelog) so future scope changes to allowed-tools or instruction content are surfaced to re-installing users, pre-empting any future ATR-P0007 concern if the artifact later adds executable components."]},"rollup":{"component_findings_count":{"vulnerable":1,"secure":5,"not_applicable":2},"repo_findings_inherited_count":{"vulnerable":0,"secure":2,"not_applicable":13},"component_tools_count":{"read_only":1,"write":1},"worst_case_severity":"HIGH"},"trust_scores":{"repo_level":{"score":85,"tier":"high","capability_band":"moderate","score_confidence":"medium","score_interval":{"low":69,"high":100},"factors":["ATR-P0008 HIGH"]},"component_level":{"score":85,"tier":"high","capability_band":"moderate","score_confidence":"medium","score_interval":{"low":69,"high":100},"factors":["ATR-P0008 HIGH"]}}}]}