agent-shield 0.8.0

Security scanner for AI agent extensions — offline-first, multi-framework, SARIF output
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71

use crate::ir::{ArgumentSource, ScanTarget};
use crate::rules::{
    AttackCategory, Confidence, Detector, Evidence, Finding, RuleMetadata, Severity,
};

/// SHIELD-004: Arbitrary File Access
///
/// Flags file read/write/delete where path comes from untrusted argument
/// source and no canonicalization/allowlist guard detected.
pub struct ArbitraryFileAccessDetector;

impl Detector for ArbitraryFileAccessDetector {
    fn metadata(&self) -> RuleMetadata {
        RuleMetadata {
            id: "SHIELD-004".into(),
            name: "Arbitrary File Access".into(),
            description: "File read/write with path from untrusted input".into(),
            default_severity: Severity::High,
            attack_category: AttackCategory::ArbitraryFileAccess,
            cwe_id: Some("CWE-22".into()),
        }
    }

    fn run(&self, target: &ScanTarget) -> Vec<Finding> {
        let mut findings = Vec::new();

        for file_op in &target.execution.file_operations {
            if file_op.path_arg.is_tainted() {
                let source_desc = match &file_op.path_arg {
                    ArgumentSource::Parameter { name } => format!("parameter '{name}'"),
                    ArgumentSource::Interpolated => "interpolated string".into(),
                    ArgumentSource::Unknown => "unknown source".into(),
                    ArgumentSource::EnvVar { name } => format!("env var '{name}'"),
                    ArgumentSource::Literal(_) | ArgumentSource::Sanitized { .. } => continue,
                };

                let confidence = match &file_op.path_arg {
                    ArgumentSource::Parameter { .. } => Confidence::High,
                    _ => Confidence::Medium,
                };

                findings.push(Finding {
                    rule_id: "SHIELD-004".into(),
                    rule_name: "Arbitrary File Access".into(),
                    severity: Severity::High,
                    confidence,
                    attack_category: AttackCategory::ArbitraryFileAccess,
                    message: format!(
                        "File {:?} with path from {}",
                        file_op.operation, source_desc
                    ),
                    location: Some(file_op.location.clone()),
                    evidence: vec![Evidence {
                        description: format!("{} flows into file path", source_desc),
                        location: Some(file_op.location.clone()),
                        snippet: None,
                    }],
                    taint_path: None,
                    remediation: Some(
                        "Canonicalize paths and validate against an allowlist of \
                         permitted directories. Reject paths with '..' traversal."
                            .into(),
                    ),
                    cwe_id: Some("CWE-22".into()),
                });
            }
        }

        findings
    }
}