open/llm-security
1
0
Fork 0
Code Issues Releases 6 Activity

docs: knowledge-file count from source, no offline claim for the CLI

Browse source 
PLAN § v8.1.3 tillegg b and c.
- b: scanner-reference.md said Knowledge Files (20); knowledge/ holds
  22. Added typosquat-allowlist.json and workflow-injection-patterns.md;
  the test pins header and table to the directory.
- c: ci-cd-guide.md claimed zero network calls, OSV opt-in and "no
  cross-border data transfer". Measured in the code: dep runs npm audit
  (package.json) and pip-audit (requirements.txt, if installed), network
  resolves found domains over DNS, supply-chain queries OSV.dev, none
  with a switch. The guide now says so. scanner-reference.md carried the
  same claim plus a `--online` flag that does not exist (0 hits in
  scanners/); fixed in the same commit because the same gate covers it
  (chosen over leaving a known-false line in a file already edited here).
  That extra check was red on fd7de23's text, verified.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-23 11:37:58 +02:00
commit b4d9f83521
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
3 changed files with 33 additions and 14 deletions
Download patch file Download diff file Expand all files Collapse all files

18
docs/ci-cd-guide.md
View file

@ -1,19 +1,25 @@
# CI/CD Integration Guide
Integrate llm-security into your CI/CD pipeline for automated security scanning of AI/LLM projects. The standalone CLI runs 14 deterministic Node.js scanners — no AI models, no external API calls, no data leaves your pipeline environment.
Integrate llm-security into your CI/CD pipeline for automated security scanning of AI/LLM projects. The standalone CLI runs 14 deterministic Node.js scanners — no AI models and no Anthropic API. It is not air-gapped: three scanners reach the network (see Data Sovereignty).
## Data Sovereignty
**The standalone CLI makes zero network calls by default.** All 14 scanners operate locally on your source code using Shannon entropy analysis, regex pattern matching, AST traversal, and git log parsing. No data is transmitted to any external service.
**The standalone CLI is not offline.** The scanners analyze your source code locally (Shannon entropy, regex patterns, AST traversal, git log parsing) and do not upload it. Three of them reach the network whenever their input is present, and there is no switch to turn any of them off:
**Exception: supply-chain-recheck** — When scanning lockfiles for known vulnerabilities, this scanner optionally queries the [OSV.dev](https://osv.dev/) batch API. This sends only package names and versions (not source code) over HTTPS. There is no kill-switch for this call today; block the host at the network layer if the run must be air-gapped.
- **dep** runs `npm audit` when the target has a `package.json` and `pip-audit` (if installed) when it has a `requirements.txt`. Both send package names and versions to their registry's advisory service (npm registry, PyPI).
- **network** resolves the domains it finds in the code over DNS, so those names reach your configured resolver.
- **supply-chain** queries the [OSV.dev](https://osv.dev/) batch API with package names and versions from the lockfiles, over HTTPS.
Block egress at the network layer if the run must be air-gapped.
**What about Claude Code integration?** The Claude Code plugin (hooks, agents, commands) uses AI models and sends data to Anthropic. These components are **not included** in the standalone CLI. When you run `npx llm-security scan`, only deterministic scanners execute.
### Schrems II / NSM Compliance
- Standalone CLI: **fully compliant** — no cross-border data transfer
- OSV.dev queries (opt-in): sends package metadata to Google-operated API — evaluate per your organization's data classification
- Standalone CLI: source code stays in the run, but package metadata and domain names leave it (above) — evaluate per your organization's data classification
- OSV.dev queries (always on when lockfiles are present): package names and versions to a Google-operated API
- `npm audit` / `pip-audit` (always on when `package.json` / `requirements.txt` is present): package names and versions to the npm registry and PyPI
- DNS lookups (always on when the code names a domain): domain names found in the code, to your resolver
- Claude Code plugin: sends code context to Anthropic (US) — requires data processing agreement for regulated environments
### Norwegian Regulatory Context
@ -152,7 +158,7 @@ The 14 deterministic scanners cover:
| Git forensics | Force pushes, sensitive file history, author anomalies |
| Network | Suspicious URLs, exfiltration endpoints, C2 patterns |
| Memory poisoning | Injection patterns in CLAUDE.md, memory files, rules |
| Supply chain | Lockfile audit, blocklists, OSV.dev (opt-in) |
| Supply chain | Lockfile audit, blocklists, OSV.dev (always on) |
| Workflow | CI/CD workflow injection — untrusted triggers, unpinned actions, spoofed bots |
| Trigger abuse | Activation-surface abuse in command/agent/skill frontmatter — shadowing, baiting, overly broad triggers |
| Signature | Known-malware identity match (webshells, reverse shells, cryptominers, hacktools) |

6
docs/scanner-reference.md
View file

@ -78,9 +78,9 @@ Subcommands: `scan`, `deep-scan`, `posture`, `audit-bom`, `benchmark`. Dispatche
Pipeline templates in `ci/`: `github-action.yml`, `azure-pipelines.yml`, `gitlab-ci.yml`. Documentation: `docs/ci-cd-guide.md`.
All templates use `--fail-on high --format sarif --output-file results.sarif` with SARIF upload per platform.
Standalone CLI makes zero network calls in default mode. Schrems II compatible in default offline mode. Optional OSV.dev enrichment (`supply-chain-recheck --online`) transmits package identifiers to a Google-operated API and is a separate compliance consideration.
The standalone CLI is not offline: `npm audit`/`pip-audit` (dep), DNS lookups (network) and OSV.dev queries (supply-chain) reach the network whenever their input is present, with no switch to turn them off. Source code is not uploaded; package names, versions and domain names are. See `docs/ci-cd-guide.md` § Data Sovereignty.
## Knowledge Files (20)
## Knowledge Files (22)
| File | Content |
|------|---------|
@ -92,6 +92,7 @@ Standalone CLI makes zero network calls in default mode. Schrems II compatible i
| `owasp-skills-top10.md` | OWASP Skills Top 10 (AST01-AST10) — skill-specific threats |
| `mitigation-matrix.md` | Threat-to-control mappings |
| `top-packages.json` | Known package lists for supply chain checks |
| `typosquat-allowlist.json` | Legitimate packages that would otherwise trip typosquat detection, plus official npm scopes |
| `skill-registry.json` | Seed data for skill signature registry |
| `prompt-injection-research-2025-2026.md` | 7 research papers (2025-2026) with implications for hook defenses |
| `deepmind-agent-traps.md` | DeepMind AI Agent Traps — 6 categories, 43 techniques, coverage matrix |
@ -104,6 +105,7 @@ Standalone CLI makes zero network calls in default mode. Schrems II compatible i
| `top-jetbrains-plugins.json` | Top JetBrains plugin IDs (typosquat seed) + blocklist entries (v6.6.0) |
| `marketplace-api-notes.md` | VS Code Marketplace + OpenVSX API endpoints used by `lib/vsix-fetch.mjs` (v6.4.0) |
| `jetbrains-marketplace-api-notes.md` | JetBrains Marketplace API endpoints used by `fetchJetBrainsPlugin` (v6.6.0) |
| `workflow-injection-patterns.md` | GitHub/Forgejo Actions `${{ }}` injection sinks for `workflow-scanner.mjs` (E11) |
## Reports