95 lines
4.3 KiB
Markdown
95 lines
4.3 KiB
Markdown
---
|
|
name: llm-security:red-team
|
|
description: Attack simulation — test hook defenses with crafted payloads
|
|
allowed-tools: Bash, Read
|
|
model: sonnet
|
|
---
|
|
|
|
# Red Team — Attack Simulation
|
|
|
|
Run crafted attack payloads against the plugin's own hooks to verify defenses.
|
|
|
|
## What was requested
|
|
|
|
The user ran `/security red-team` to test their hook defenses.
|
|
|
|
## Arguments
|
|
|
|
Parse `$ARGUMENTS` for:
|
|
- `--category <name>` — filter: secrets, destructive, supply-chain, prompt-injection, pathguard, mcp-output, session-trifecta, hybrid, unicode-evasion, bash-evasion, hitl-traps, long-horizon, all
|
|
- `--json` — raw JSON output
|
|
- `--adaptive` — mutation-based evasion testing (5 mutation rounds per passing scenario)
|
|
|
|
Default: all categories, fixed mode.
|
|
|
|
## Steps
|
|
|
|
1. **Run the attack simulator:**
|
|
|
|
```
|
|
node scanners/attack-simulator.mjs [--category <name>] [--verbose] [--adaptive]
|
|
```
|
|
|
|
The simulator runs 64 attack scenarios across 12 categories against the plugin's hooks. Each scenario sends a crafted payload and verifies the hook blocks or detects it.
|
|
|
|
In **adaptive mode** (`--adaptive`), for each scenario that passes (attack blocked), the simulator applies 5 mutation rounds:
|
|
1. Homoglyph substitution (Latin chars replaced with Cyrillic lookalikes)
|
|
2. Encoding wrapping (URL-encoded keywords)
|
|
3. Zero-width character injection (ZW chars inserted between keyword letters)
|
|
4. Case alternation (aLtErNaTiNg case)
|
|
5. Synonym substitution (keyword replacement from synonym table)
|
|
|
|
Bypasses are reported as findings but not auto-fixed.
|
|
|
|
2. **Present the results as a narrative report:**
|
|
|
|
For each category, explain:
|
|
- What was tested (the attack type)
|
|
- How many attacks were blocked
|
|
- Whether defenses are adequate
|
|
|
|
If any scenarios fail, explain the gap and what hook needs attention.
|
|
|
|
In adaptive mode, also explain:
|
|
- How many mutations were tested
|
|
- Which mutations found bypasses
|
|
- That bypasses are expected for synonym and encoding mutations (deterministic hooks cannot catch all evasions)
|
|
|
|
3. **Defense Score interpretation:**
|
|
- **100%** — All hooks functioning correctly. No defense gaps.
|
|
- **90-99%** — Minor gaps. Review failed scenarios.
|
|
- **Below 90%** — Significant gaps. Hooks may be misconfigured or missing.
|
|
|
|
## Categories
|
|
|
|
| Category | Hook Tested | Scenarios |
|
|
|----------|------------|-----------|
|
|
| secrets | pre-edit-secrets.mjs | 7 secret types (AWS, GitHub, PEM, DB, Bearer, Azure, Slack) |
|
|
| destructive | pre-bash-destructive.mjs | 8 commands (rm -rf, chmod 777, curl\|bash, fork bomb, mkfs, dd, eval) |
|
|
| supply-chain | pre-install-supply-chain.mjs | 4 managers (npm, pip, cargo, gem) |
|
|
| prompt-injection | pre-prompt-inject-scan.mjs | 6 patterns (override, spoofed headers, identity, evasion) |
|
|
| pathguard | pre-write-pathguard.mjs | 6 paths (.env, .ssh, .aws, .npmrc, /etc, hooks) |
|
|
| mcp-output | post-mcp-verify.mjs | 4 threats (injection, secrets, HTML traps, MCP injection) |
|
|
| session-trifecta | post-session-guard.mjs | 3 patterns (classic trifecta, MCP-concentrated, volume) |
|
|
| hybrid | post-mcp-verify.mjs | 8 patterns (P2SQL, recursive injection, XSS variants) |
|
|
| unicode-evasion | pre-prompt-inject-scan.mjs | 6 patterns (Unicode Tags, ZW chars, homoglyphs, BIDI, HTML entities, multi-lang) |
|
|
| bash-evasion | pre-bash-destructive.mjs | 5 patterns (empty quotes, dollar expansion, backslash splitting, supply chain) |
|
|
| hitl-traps | post-mcp-verify.mjs | 4 patterns (approval urgency, summary suppression, scope minimization, cognitive load) |
|
|
| long-horizon | post-session-guard.mjs | 3 patterns (delegation-after-input, sensitive path, MCP-concentrated trifecta) |
|
|
|
|
## Mutation Types (Adaptive Mode)
|
|
|
|
| Mutation | Technique | Expected Bypass Rate |
|
|
|----------|-----------|---------------------|
|
|
| homoglyph | Cyrillic/Latin lookalike substitution | Low (MEDIUM patterns detect) |
|
|
| encoding | URL-encode keywords | High (hooks normalize some, not all) |
|
|
| zero_width | Insert zero-width chars in keywords | Low (normalizer strips these) |
|
|
| case_alternation | aLtErNaTiNg case | Low (regex uses /i flag) |
|
|
| synonym | Replace with semantic equivalents | Medium (novel synonyms evade patterns) |
|
|
|
|
## Important
|
|
|
|
- This tests the plugin's OWN hooks — it does not perform real exploits
|
|
- No network calls, no file modifications, no LLM invocations
|
|
- Safe to run repeatedly — all state is cleaned up after each run
|
|
- Adaptive mode bypasses are **expected** — they document evasion resistance limits
|