agentshield/rules/builtin/
mod.rs

1mod arbitrary_file_access;
2mod archive_traversal;
3mod capability_mismatch;
4mod command_injection;
5mod composite_toxic_flow;
6mod credential_exfil;
7mod cross_session_state_bleed;
8mod download_exec;
9mod dynamic_exec;
10mod dynamic_tool_registration;
11mod excessive_permissions;
12mod hardcoded_secrets;
13mod insecure_agent_checkpoint;
14mod insecure_bind;
15mod insecure_mcp_resource;
16mod insecure_prompt_concat;
17mod insecure_subagent_delegation;
18mod insecure_temp_file;
19pub(crate) mod metadata_ssrf;
20mod no_lockfile;
21mod overbroad_fs;
22mod prompt_injection;
23mod runtime_install;
24mod secret_leakage;
25mod self_modification;
26mod sensitive_schema_reflection;
27mod sql_injection;
28mod ssrf;
29mod system_prompt_tampering;
30mod tool_description_injection;
31mod tool_response_injection;
32mod typosquat;
33mod unauthenticated_mcp_sse;
34mod unpinned_deps;
35mod unsafe_deser;
36mod unsafe_deser_patterns;
37mod webhook_file_exfil;
38
39use super::{ContextDetector, Detector};
40
41/// Returns all built-in target-only detectors (SHIELD-001..019, SHIELD-021..036).
42pub fn all_detectors() -> Vec<Box<dyn Detector>> {
43    vec![
44        Box::new(command_injection::CommandInjectionDetector),
45        Box::new(credential_exfil::CredentialExfilDetector),
46        Box::new(ssrf::SsrfDetector),
47        Box::new(arbitrary_file_access::ArbitraryFileAccessDetector),
48        Box::new(runtime_install::RuntimeInstallDetector),
49        Box::new(self_modification::SelfModificationDetector),
50        Box::new(prompt_injection::PromptInjectionDetector),
51        Box::new(excessive_permissions::ExcessivePermissionsDetector),
52        Box::new(unpinned_deps::UnpinnedDepsDetector),
53        Box::new(typosquat::TyposquatDetector),
54        Box::new(dynamic_exec::DynamicExecDetector),
55        Box::new(no_lockfile::NoLockfileDetector),
56        Box::new(metadata_ssrf::MetadataSsrfDetector),
57        Box::new(download_exec::DownloadExecDetector),
58        Box::new(overbroad_fs::OverbroadFsDetector),
59        Box::new(unsafe_deser::UnsafeDeserDetector),
60        Box::new(archive_traversal::ArchiveTraversalDetector),
61        Box::new(secret_leakage::SecretLeakageDetector),
62        Box::new(capability_mismatch::CapabilityMismatchDetector),
63        Box::new(sql_injection::SqlInjectionDetector),
64        Box::new(webhook_file_exfil::WebhookFileExfilDetector),
65        Box::new(system_prompt_tampering::SystemPromptTamperingDetector),
66        Box::new(insecure_bind::InsecureBindDetector),
67        Box::new(insecure_temp_file::InsecureTempFileDetector),
68        Box::new(insecure_prompt_concat::InsecurePromptConcatDetector),
69        Box::new(hardcoded_secrets::HardcodedSecretsDetector),
70        Box::new(dynamic_tool_registration::DynamicToolRegistrationDetector),
71        Box::new(cross_session_state_bleed::CrossSessionStateBleedDetector),
72        Box::new(tool_description_injection::ToolDescriptionInjectionDetector),
73        Box::new(insecure_subagent_delegation::InsecureSubagentDelegationDetector),
74        Box::new(insecure_mcp_resource::InsecureMcpResourceDetector),
75        Box::new(sensitive_schema_reflection::SensitiveSchemaReflectionDetector),
76        Box::new(insecure_agent_checkpoint::InsecureAgentCheckpointDetector),
77        Box::new(unauthenticated_mcp_sse::UnauthenticatedMcpSseDetector),
78        Box::new(tool_response_injection::ToolResponseInjectionDetector),
79    ]
80}
81
82/// Returns all built-in contextual scanners (not target-only).
83pub(crate) fn all_context_detectors() -> Vec<Box<dyn ContextDetector>> {
84    vec![Box::new(
85        composite_toxic_flow::ArbitraryReadExfiltrationDetector,
86    )]
87}
agentshield/rules/builtin/mod.rs

agentshield/rules/builtin/
mod.rs
