Skip to main content

agentshield/analysis/
capability.rs

1//! Capability escalation heuristics.
2//!
3//! Analyzes whether an extension requests more capabilities than it uses,
4//! or combines capabilities in dangerous ways.
5
6use crate::ir::ScanTarget;
7
8/// Compute a capability escalation score (0.0–1.0).
9///
10/// Higher values indicate more suspicious capability combinations.
11/// Currently a stub — full implementation in a future release.
12pub fn escalation_score(target: &ScanTarget) -> f64 {
13    let has_network = !target.execution.network_operations.is_empty();
14    let has_exec =
15        !target.execution.commands.is_empty() || !target.execution.dynamic_exec.is_empty();
16    let has_file = !target.execution.file_operations.is_empty();
17    let has_env = !target.execution.env_accesses.is_empty();
18
19    let capabilities = [has_network, has_exec, has_file, has_env];
20    let count = capabilities.iter().filter(|&&c| c).count();
21
22    match count {
23        0 | 1 => 0.0,
24        2 => 0.3,
25        3 => 0.6,
26        _ => 0.9,
27    }
28}