open/llm-security
1
0
Fork 0
Code Issues Releases Activity

feat(llm-security): wire AST scanner into orchestrator and policy

Browse source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3s6WnubSSrFjAQTLQdVbG
This commit is contained in:
Kjell Tore Guttormsen 2026-06-20 09:41:32 +02:00
commit b50313e461
4 changed files with 62 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scanners/lib/policy-loader.mjs
View file

@ -89,6 +89,12 @@ const DEFAULT_POLICY = Object.freeze({
enabled_families: ['webshell', 'reverse_shell', 'cryptominer', 'hacktool'],
custom_rules_path: null,
},
// AST — Python AST taint scanner (shells out to a parse-only python3 helper).
ast: {
enabled: true,
python_path: 'python3',
timeout_ms: 5000,
},
});
// Cache loaded policy per project root

4
scanners/lib/severity.mjs
View file

@ -145,6 +145,7 @@ export const OWASP_MAP = Object.freeze({
WFL: ['LLM02', 'LLM06'],
TRG: ['LLM06'],
SIG: ['LLM03', 'LLM02'],
AST: ['LLM01', 'LLM02'],
});
/**
@ -166,6 +167,7 @@ export const OWASP_AGENTIC_MAP = Object.freeze({
WFL: ['ASI04'],
TRG: [],
SIG: ['ASI04'],
AST: [],
});
/**
@ -187,6 +189,7 @@ export const OWASP_SKILLS_MAP = Object.freeze({
WFL: [],
TRG: ['AST04'],
SIG: [],
AST: ['AST02'],
});
/**
@ -208,6 +211,7 @@ export const OWASP_MCP_MAP = Object.freeze({
WFL: [],
TRG: [],
SIG: [],
AST: [],
});
/**

2
scanners/scan-orchestrator.mjs
View file

@ -111,6 +111,7 @@ import { scan as workflowScan } from './workflow-scanner.mjs';
import { scan as tfaScan } from './toxic-flow-analyzer.mjs';
import { scan as trgScan } from './trigger-scanner.mjs';
import { scan as sigScan } from './signature-scanner.mjs';
import { scan as astScan } from './ast-taint-scanner.mjs';
const SCANNERS = [
{ name: 'unicode', fn: unicodeScan },
@ -125,6 +126,7 @@ const SCANNERS = [
{ name: 'workflow', fn: workflowScan },
{ name: 'trg', fn: trgScan },
{ name: 'sig', fn: sigScan },
{ name: 'ast', fn: astScan },
{ name: 'toxic-flow', fn: tfaScan, requiresPriorResults: true },
];