docs(readme): document AS1-AS3 agent snooping patterns - #476
Conversation
The static_patterns_agent_snooping analyzer (PR NVIDIA#96) added AS1 (Agent Config Directory Access), AS2 (MCP Config File Access), and AS3 (Skill Enumeration) but the README's Vulnerability Patterns section and pattern/category totals were never updated to reflect them. Signed-off-by: Evgeny Talaevsky <evgeny.talaevsky@residenthome.com>
rng1995
left a comment
rng1995
left a comment
There was a problem hiding this comment.
[SkillSpector Review]
Reviewed current head 2e058eca3a8a2b40022400676f9f602835183a5a.
Changes requested: README.md:27 and line 357 change the advertised inventory to 74 patterns, but the tables below already contain 75 ID rows. They are also incomplete relative to the current detectors: RULE_ID_TO_CATEGORY maps 77 static IDs, including omitted E5, TM4, SC7, TT6, SSRF1-SSRF3, and DS1-DS4, while the README separately lists nine AST IDs. Please recompute the total using a clearly defined source of truth, reconcile the missing rows or explicitly document exclusions, and make the final “all detected patterns” claim accurate.
The hosted required checks pass. The branch is behind main, so it would still require an update and revalidation after the documentation is corrected.
Total is 87 patterns (77 static IDs in RULE_ID_TO_CATEGORY + 10 AST IDs in behavioral_ast.py) across 20 categories. Adds missing E5, SC7, TM4, TT6, and AST10 rows to their existing tables, and adds new Server-Side Request Forgery (SSRF1-3) and Insecure Deserialization (DS1-4) sections that had no README coverage. Signed-off-by: Evgeny Talaevsky <evgeny.talaevsky@residenthome.com>
c2e8faa to
713b589
Compare
|
@rng1995 pushed a fix for the pattern/category count reconciliation you flagged (now 87 patterns / 20 categories, verified against |
2 participants
Problem
PR #96 (closing #75) added the
static_patterns_agent_snoopinganalyzer with three new rule IDs - AS1 (Agent Config Directory Access), AS2 (MCP Config File Access), AS3 (Skill Enumeration) - but the README's Vulnerability Patterns section was never updated. The pattern/category counts still read "71 vulnerability patterns across 17 categories" and there is no "Agent Snooping" table, so users reading the README have no way to discover these three checks.Change
pattern_defaults.py: HIGH, HIGH, MEDIUM) placed after "Rogue Agent", matching the analyzer's registration order.No code changes - documentation only.