open/llm-security
1
0
Fork 0
Code Issues Releases 1 Activity

feat(llm-security): wire SIG scanner into orchestrator and policy

Browse source 
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01V3s6WnubSSrFjAQTLQdVbG
This commit is contained in:
Kjell Tore Guttormsen 2026-06-20 09:32:23 +02:00
commit e46bf12b86
4 changed files with 64 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
scanners/lib/policy-loader.mjs
View file

@ -83,6 +83,12 @@ const DEFAULT_POLICY = Object.freeze({
'run', 'do', 'go', 'help', 'fix', 'use', 'get', 'set', 'all', 'any', 'it', 'this', 'that',
],
},
// SIG — known-bad-identity signature engine. Toggle families or point at a
// custom ruleset via policy.json.
sig: {
enabled_families: ['webshell', 'reverse_shell', 'cryptominer', 'hacktool'],
custom_rules_path: null,
},
});
// Cache loaded policy per project root

4
scanners/lib/severity.mjs
View file

@ -144,6 +144,7 @@ export const OWASP_MAP = Object.freeze({
PST: ['LLM01', 'LLM06'],
WFL: ['LLM02', 'LLM06'],
TRG: ['LLM06'],
SIG: ['LLM03', 'LLM02'],
});
/**
@ -164,6 +165,7 @@ export const OWASP_AGENTIC_MAP = Object.freeze({
PST: ['ASI02', 'ASI03', 'ASI04', 'ASI05'],
WFL: ['ASI04'],
TRG: [],
SIG: ['ASI04'],
});
/**
@ -184,6 +186,7 @@ export const OWASP_SKILLS_MAP = Object.freeze({
PST: ['AST01', 'AST03'],
WFL: [],
TRG: ['AST04'],
SIG: [],
});
/**
@ -204,6 +207,7 @@ export const OWASP_MCP_MAP = Object.freeze({
PST: ['MCP02', 'MCP07'],
WFL: [],
TRG: [],
SIG: [],
});
/**

2
scanners/scan-orchestrator.mjs
View file

@ -110,6 +110,7 @@ import { scan as supplyChainScan } from './supply-chain-recheck.mjs';
import { scan as workflowScan } from './workflow-scanner.mjs';
import { scan as tfaScan } from './toxic-flow-analyzer.mjs';
import { scan as trgScan } from './trigger-scanner.mjs';
import { scan as sigScan } from './signature-scanner.mjs';
const SCANNERS = [
{ name: 'unicode', fn: unicodeScan },
@ -123,6 +124,7 @@ const SCANNERS = [
{ name: 'supply-chain', fn: supplyChainScan },
{ name: 'workflow', fn: workflowScan },
{ name: 'trg', fn: trgScan },
{ name: 'sig', fn: sigScan },
{ name: 'toxic-flow', fn: tfaScan, requiresPriorResults: true },
];