Kjell Tore Guttormsen e6a7aec971 test(av-surface): probe (e) — payload literals in session-loaded files, red ... New probe (e) over agents/**, commands/** and hooks/** — what a Claude Code session loads at the user's end, where a quarantine breaks the installed plugin, not just a clone. It fails on a contiguous literal matching the SIG reverse-shell/webshell/miner rules, a download piped into a shell, or a base64 decode piped into a shell. Raw text, comments included, per line, so every hit names file:line. knowledge/** is measured by the same rule and reported in the diagnostic as its own number, not gated in S3. Measured red before any change (v8.1.0 S3, 2026-09-22): e = 8 hits in 6 of 36 files; knowledge = 17 hits of 22 files. No SIG rule hit anywhere in the four directories; validated against built known positives (all three families match). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-09-22 14:10:33 +02:00
..
e2e	test(llm-security): build poisoned fixtures at test time, never on disk	2026-09-22 13:07:38 +02:00
fixtures	test(llm-security): build poisoned fixtures at test time, never on disk	2026-09-22 13:07:38 +02:00
golden	refactor(llm-security): build the SIG ruleset from vendored commons (malware-signatures 0.1.0)	2026-08-13 21:28:14 +02:00
helpers	test(llm-security): store the poisoned-claude-md fixture encoded	2026-09-22 13:22:10 +02:00
hooks	refactor(llm-security): build the secret table from vendored commons (secret-egress 0.3.0)	2026-08-13 21:10:14 +02:00
lib	fix(llm-security): compileRules coerces a non-string pattern instead of dropping the rule	2026-08-13 21:51:10 +02:00
scanners	docs(llm-security): describe the base64 exfil payloads instead of showing them	2026-09-22 13:23:24 +02:00
av-surface.test.mjs	test(av-surface): probe (e) — payload literals in session-loaded files, red	2026-09-22 14:10:33 +02:00