agentshield/rules/builtin/
mod.rs

1mod agent_memory_poisoning;
2mod arbitrary_file_access;
3mod archive_traversal;
4mod capability_mismatch;
5mod command_injection;
6mod composite_toxic_flow;
7mod credential_exfil;
8mod cross_session_state_bleed;
9mod download_exec;
10mod dynamic_exec;
11mod dynamic_tool_registration;
12mod excessive_permissions;
13mod hardcoded_secrets;
14mod insecure_agent_checkpoint;
15mod insecure_bind;
16mod insecure_mcp_resource;
17mod insecure_prompt_concat;
18mod insecure_subagent_delegation;
19mod insecure_temp_file;
20pub(crate) mod metadata_ssrf;
21mod no_lockfile;
22mod overbroad_fs;
23mod prompt_injection;
24mod runtime_install;
25mod secret_leakage;
26mod self_modification;
27mod sensitive_schema_reflection;
28mod sql_injection;
29mod ssrf;
30mod system_prompt_tampering;
31mod tool_description_injection;
32mod tool_response_injection;
33mod typosquat;
34mod unauthenticated_mcp_sse;
35mod unpinned_deps;
36mod unsafe_deser;
37mod unsafe_deser_patterns;
38mod webhook_file_exfil;
39
40#[cfg(test)]
41pub(crate) mod test_helpers;
42
43use super::{ContextDetector, Detector};
44
45/// Returns all built-in target-only detectors (SHIELD-001..019, SHIELD-021..037).
46pub fn all_detectors() -> Vec<Box<dyn Detector>> {
47    vec![
48        Box::new(command_injection::CommandInjectionDetector),
49        Box::new(credential_exfil::CredentialExfilDetector),
50        Box::new(ssrf::SsrfDetector),
51        Box::new(arbitrary_file_access::ArbitraryFileAccessDetector),
52        Box::new(runtime_install::RuntimeInstallDetector),
53        Box::new(self_modification::SelfModificationDetector),
54        Box::new(prompt_injection::PromptInjectionDetector),
55        Box::new(excessive_permissions::ExcessivePermissionsDetector),
56        Box::new(unpinned_deps::UnpinnedDepsDetector),
57        Box::new(typosquat::TyposquatDetector),
58        Box::new(dynamic_exec::DynamicExecDetector),
59        Box::new(no_lockfile::NoLockfileDetector),
60        Box::new(metadata_ssrf::MetadataSsrfDetector),
61        Box::new(download_exec::DownloadExecDetector),
62        Box::new(overbroad_fs::OverbroadFsDetector),
63        Box::new(unsafe_deser::UnsafeDeserDetector),
64        Box::new(archive_traversal::ArchiveTraversalDetector),
65        Box::new(secret_leakage::SecretLeakageDetector),
66        Box::new(capability_mismatch::CapabilityMismatchDetector),
67        Box::new(sql_injection::SqlInjectionDetector),
68        Box::new(webhook_file_exfil::WebhookFileExfilDetector),
69        Box::new(system_prompt_tampering::SystemPromptTamperingDetector),
70        Box::new(insecure_bind::InsecureBindDetector),
71        Box::new(insecure_temp_file::InsecureTempFileDetector),
72        Box::new(insecure_prompt_concat::InsecurePromptConcatDetector),
73        Box::new(hardcoded_secrets::HardcodedSecretsDetector),
74        Box::new(dynamic_tool_registration::DynamicToolRegistrationDetector),
75        Box::new(cross_session_state_bleed::CrossSessionStateBleedDetector),
76        Box::new(tool_description_injection::ToolDescriptionInjectionDetector),
77        Box::new(insecure_subagent_delegation::InsecureSubagentDelegationDetector),
78        Box::new(insecure_mcp_resource::InsecureMcpResourceDetector),
79        Box::new(sensitive_schema_reflection::SensitiveSchemaReflectionDetector),
80        Box::new(insecure_agent_checkpoint::InsecureAgentCheckpointDetector),
81        Box::new(unauthenticated_mcp_sse::UnauthenticatedMcpSseDetector),
82        Box::new(tool_response_injection::ToolResponseInjectionDetector),
83        Box::new(agent_memory_poisoning::AgentMemoryPoisoningDetector),
84    ]
85}
86
87/// Returns all built-in contextual scanners (not target-only).
88pub(crate) fn all_context_detectors() -> Vec<Box<dyn ContextDetector>> {
89    vec![Box::new(
90        composite_toxic_flow::ArbitraryReadExfiltrationDetector,
91    )]
92}
agentshield/rules/builtin/mod.rs

agentshield/rules/builtin/
mod.rs
