open/llm-security
1
0
Fork 0
Code Issues Releases 6 Activity

docs(readme): self-scan counts after the README's own new text (383 / 441)

Browse source 
The AV section added two suppressed findings to README.md itself; the
remaining 58 (WARNING 61/100) did not move. Re-measured on a fresh clone.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
Kjell Tore Guttormsen 2026-09-22 14:24:41 +02:00
commit d3d0cba917
Signed by: ktg
SSH key fingerprint: SHA256:JakMjO6FTBBzN0Bhfj9saOoEjaFxlSdYuZQQpM/lF9Q
2 changed files with 4 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

6
.llm-security-ignore
View file

@ -1,6 +1,6 @@
# .llm-security-ignore — Suppress expected findings when scanning this plugin
#
# Why 381 suppressed findings? A security plugin that documents attack patterns,
# Why 383 suppressed findings? A security plugin that documents attack patterns,
# ships a malicious demo fixture, and tests against deliberately evil code will
# trigger its own scanners. This is the "scanning the scanner" paradox:
#
@ -10,8 +10,8 @@
# - hooks/ and scanners/ contain high-entropy regex for secret detection
#
# Every suppression below is explained. Run without this file to see all of them.
# Measured 2026-09-22 (v8.1.0) on a fresh clone: 439 findings without this file,
# 58 with it (381 suppressed).
# Measured 2026-09-22 (v8.1.0) on a fresh clone: 441 findings without this file,
# 58 with it (383 suppressed).
#
# Format: SCANNER:glob or just glob (applies to all scanners)
# Scanners: UNI, ENT, PRM, DEP, TNT, GIT, NET, MEM, SCR, WFL, TRG, SIG, AST, TFA

2
README.md
View file

@ -661,7 +661,7 @@ you start:
npm test # node --test 'tests/**/*.test.mjs'
```
Running `node scanners/scan-orchestrator.mjs .` on a fresh clone produces **WARNING 61/100 with 58 findings** (0 critical, 5 high, 15 medium, 2 low, 36 info; measured 2026-09-22), after `.llm-security-ignore` suppresses 381. Without the ignore file the same run reports BLOCK 95/100 with 439 findings. A security plugin that documents attack patterns, ships a malicious demo, and tests against deliberately evil code triggers its own scanners; every suppression is explained in the file. What is left is reported on purpose: high-entropy strings in docs and the HTML report renderer, example and research domains in docs, three CLI tools that write to a path given on the command line, and memory findings on `CLAUDE.md` — it documents the hooks, but it is the file a poisoning would target, so it is not suppressed. Remove the ignore file and re-run to see the unsuppressed picture.
Running `node scanners/scan-orchestrator.mjs .` on a fresh clone produces **WARNING 61/100 with 58 findings** (0 critical, 5 high, 15 medium, 2 low, 36 info; measured 2026-09-22), after `.llm-security-ignore` suppresses 383. Without the ignore file the same run reports BLOCK 95/100 with 441 findings. A security plugin that documents attack patterns, ships a malicious demo, and tests against deliberately evil code triggers its own scanners; every suppression is explained in the file. What is left is reported on purpose: high-entropy strings in docs and the HTML report renderer, example and research domains in docs, three CLI tools that write to a path given on the command line, and memory findings on `CLAUDE.md` — it documents the hooks, but it is the file a poisoning would target, so it is not suppressed. Remove the ignore file and re-run to see the unsuppressed picture.
The `examples/malicious-skill-demo/` directory contains a deliberately malicious "Project Health Dashboard" plugin and a [full security assessment](examples/malicious-skill-demo/security-assessment.md). The combined LLM + deterministic pipeline produced **85 findings** (24 critical, 24 high, 20 medium, 6 low, 11 info) and verdict **BLOCK 100/100** — both layers independently maxed the risk score. A human reviewing the plugin's `README.md` and `SKILL.md` would likely miss most of them; the Unicode Tag steganography is literally invisible.