cc-audit 3.6.0

Security auditor for Claude Code skills, hooks, and MCP servers
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337

use crate::rules::types::{Category, Confidence, Rule, Severity};
use regex::Regex;

pub fn rules() -> Vec<Rule> {
    vec![
        op_001(),
        op_002(),
        op_003(),
        op_004(),
        op_005(),
        op_006(),
        op_007(),
        op_008(),
        op_009(),
    ]
}

fn op_001() -> Rule {
    Rule {
        id: "OP-001",
        name: "Wildcard tool permission",
        description: "Detects allowed-tools: * which grants access to all tools",
        severity: Severity::High,
        category: Category::Overpermission,
        confidence: Confidence::Certain,
        patterns: vec![
            Regex::new(r"allowed-tools:\s*\*").expect("OP-001: invalid regex"),
            Regex::new(r#"allowed-tools:\s*["']\*["']"#).expect("OP-001: invalid regex"),
            Regex::new(r#""allowed-tools"\s*:\s*"\*""#).expect("OP-001: invalid regex"),
        ],
        exclusions: vec![],
        message: "Overpermission: wildcard tool access grants unrestricted capabilities",
        recommendation: "Specify only required tools (e.g., \"Read, Write, Bash\")",
        fix_hint: Some(
            "Replace 'allowed-tools: *' with specific tools: 'allowed-tools: Read, Write'",
        ),
        cwe_ids: &["CWE-250"],
    }
}

fn op_002() -> Rule {
    Rule {
        id: "OP-002",
        name: "Unrestricted file system access",
        description: "Detects patterns allowing access to entire file system or sensitive paths",
        severity: Severity::Critical,
        category: Category::Overpermission,
        confidence: Confidence::Firm,
        patterns: vec![
            // Root directory access
            Regex::new(r#"path[s]?\s*[=:]\s*["']/["']"#).expect("OP-002: invalid regex"),
            Regex::new(r#"allowed-paths:\s*/\s*$"#).expect("OP-002: invalid regex"),
            // Home directory access without restriction
            Regex::new(r#"path[s]?\s*[=:]\s*["']~/["']"#).expect("OP-002: invalid regex"),
            // Sensitive system paths
            Regex::new(r#"path[s]?\s*[=:]\s*["']/etc["']"#).expect("OP-002: invalid regex"),
            Regex::new(r#"path[s]?\s*[=:]\s*["']/var["']"#).expect("OP-002: invalid regex"),
        ],
        exclusions: vec![],
        message: "Unrestricted file system access detected. May allow reading/writing sensitive files.",
        recommendation: "Restrict file access to specific directories needed for the task.",
        fix_hint: Some("Use specific paths: allowed-paths: ./src, ./config"),
        cwe_ids: &["CWE-732", "CWE-250"],
    }
}

fn op_003() -> Rule {
    Rule {
        id: "OP-003",
        name: "Network permission without restriction",
        description: "Detects unrestricted network permissions that may allow data exfiltration",
        severity: Severity::High,
        category: Category::Overpermission,
        confidence: Confidence::Firm,
        patterns: vec![
            // Unrestricted network access
            Regex::new(r#"network[_-]?access\s*[=:]\s*["']?\*["']?"#)
                .expect("OP-003: invalid regex"),
            Regex::new(r#"allow[_-]?network\s*[=:]\s*(true|yes|\*)"#)
                .expect("OP-003: invalid regex"),
            // Bash with curl/wget without domain restriction
            Regex::new(r#"Bash\(curl:\*\)|Bash\(wget:\*\)"#).expect("OP-003: invalid regex"),
        ],
        exclusions: vec![
            // Schema/type definitions (describing structure, not granting permissions)
            Regex::new(r"(?i)schema|interface|type\s+\w+|typedef").expect("OP-003: invalid regex"),
            // JSON Schema format
            Regex::new(r#""type"\s*:\s*"(string|boolean|object|array)""#)
                .expect("OP-003: invalid regex"),
            // Comments
            Regex::new(r"^\s*(#|//|/\*|\*)").expect("OP-003: invalid regex"),
            // Example/documentation context
            Regex::new(r"(?i)example|documentation|readme|docs/").expect("OP-003: invalid regex"),
            // Test context
            Regex::new(r"(?i)test|spec|mock").expect("OP-003: invalid regex"),
        ],
        message: "Unrestricted network permission detected. May allow data exfiltration.",
        recommendation: "Restrict network access to specific domains or disable if not needed.",
        fix_hint: Some("Use domain restrictions: Bash(curl:api.github.com)"),
        cwe_ids: &["CWE-250", "CWE-200"],
    }
}

fn op_004() -> Rule {
    Rule {
        id: "OP-004",
        name: "Shell execution without command restriction",
        description: "Detects unrestricted shell execution permissions",
        severity: Severity::Critical,
        category: Category::Overpermission,
        confidence: Confidence::Firm,
        patterns: vec![
            Regex::new(r#"Bash\s*[=:]\s*\*"#).expect("OP-004: invalid regex"),
            Regex::new(r#"allowed-tools:.*Bash\s*[^(]"#).expect("OP-004: invalid regex"),
            Regex::new(r#"shell[_-]?access\s*[=:]\s*(true|yes|\*)"#)
                .expect("OP-004: invalid regex"),
        ],
        exclusions: vec![
            // Restricted Bash is OK
            Regex::new(r"Bash\([^)]+\)").expect("OP-004: invalid regex"),
            // Schema/type definitions
            Regex::new(r"(?i)schema|interface|type\s+\w+|typedef").expect("OP-004: invalid regex"),
            // Comments
            Regex::new(r"^\s*(#|//|/\*|\*)").expect("OP-004: invalid regex"),
            // Documentation context
            Regex::new(r"(?i)example|documentation|readme|docs/").expect("OP-004: invalid regex"),
            // Test context
            Regex::new(r"(?i)test|spec|mock").expect("OP-004: invalid regex"),
            // Description of permission (not actual grant)
            Regex::new(r"(?i)requires?|needs?|wants?\s+.*(bash|shell)")
                .expect("OP-004: invalid regex"),
        ],
        message: "Unrestricted shell execution detected. Allows running arbitrary commands.",
        recommendation: "Restrict shell commands to specific allowed patterns.",
        fix_hint: Some("Use pattern restrictions: Bash(npm:*), Bash(git:*)"),
        cwe_ids: &["CWE-78", "CWE-250"],
    }
}

fn op_005() -> Rule {
    Rule {
        id: "OP-005",
        name: "Sudo/admin permission",
        description: "Detects requests for elevated privileges or sudo access",
        severity: Severity::Critical,
        category: Category::Overpermission,
        confidence: Confidence::Certain,
        patterns: vec![
            Regex::new(r"\bsudo\s").expect("OP-005: invalid regex"),
            Regex::new(r"runas\s+/user:administrator").expect("OP-005: invalid regex"),
            Regex::new(r#"privilege[sd]?\s*[=:]\s*["']?(admin|root|elevated)"#)
                .expect("OP-005: invalid regex"),
            Regex::new(r"chmod\s+[0-7]*7[0-7]*\s").expect("OP-005: invalid regex"), // world-writable
        ],
        exclusions: vec![Regex::new(r"test|mock|example").expect("OP-005: invalid regex")],
        message: "Elevated privilege request detected. May allow system-wide changes.",
        recommendation: "Avoid using sudo or elevated privileges in automated tools.",
        fix_hint: Some("Remove sudo/admin privileges and run with minimal permissions"),
        cwe_ids: &["CWE-250", "CWE-269"],
    }
}

fn op_006() -> Rule {
    Rule {
        id: "OP-006",
        name: "Environment variable access",
        description: "Detects access to all environment variables which may leak secrets",
        severity: Severity::Medium,
        category: Category::Overpermission,
        confidence: Confidence::Tentative,
        patterns: vec![
            // Full env object access (not specific property)
            Regex::new(r"JSON\.stringify\s*\(\s*process\.env\s*\)").expect("OP-006: invalid regex"),
            Regex::new(r"console\.log\s*\(\s*process\.env\s*\)").expect("OP-006: invalid regex"),
            Regex::new(r"Object\.keys\s*\(\s*process\.env\s*\)").expect("OP-006: invalid regex"),
            // Commands to dump all env vars
            Regex::new(r"\bprintenv\s*$").expect("OP-006: invalid regex"),
            Regex::new(r"\bexport\s+-p\s*$").expect("OP-006: invalid regex"),
            Regex::new(r"\benv\s*\|\s*").expect("OP-006: invalid regex"),
            Regex::new(r"\bset\s*\|\s*grep").expect("OP-006: invalid regex"),
        ],
        exclusions: vec![],
        message: "Full environment variable access detected. May expose secrets.",
        recommendation: "Access only specific required environment variables.",
        fix_hint: Some("Use specific env vars: process.env.API_KEY instead of process.env"),
        cwe_ids: &["CWE-200", "CWE-532"],
    }
}

fn op_007() -> Rule {
    Rule {
        id: "OP-007",
        name: "Subagent excessive permission delegation",
        description: "Detects subagent definitions with overly permissive tool access",
        severity: Severity::High,
        category: Category::Overpermission,
        confidence: Confidence::Firm,
        patterns: vec![
            // Subagent with all tools
            Regex::new(r#"subagent_type.*allowed-tools:\s*\*"#).expect("OP-007: invalid regex"),
            Regex::new(r#""subagent"[^}]*"allowed-tools"\s*:\s*"\*""#)
                .expect("OP-007: invalid regex"),
            // Agent definition with wildcard tools
            Regex::new(r#"\.claude/agents/.*allowed-tools:\s*\*"#).expect("OP-007: invalid regex"),
            // Task tool with full access
            Regex::new(r#"Task\s*\([^)]*tools\s*=\s*\*"#).expect("OP-007: invalid regex"),
            // Subagent with Bash access
            Regex::new(r#"subagent.*allowed-tools:.*Bash[^(]"#).expect("OP-007: invalid regex"),
            // Agent spawning with inherited permissions
            Regex::new(r#"spawn_agent.*inherit_permissions\s*[:=]\s*(true|True)"#)
                .expect("OP-007: invalid regex"),
            // Subagent with unrestricted Write
            Regex::new(r#"subagent.*allowed-tools:.*Write[^(]"#).expect("OP-007: invalid regex"),
        ],
        exclusions: vec![
            Regex::new(r"^\s*#").expect("OP-007: invalid regex"),
            Regex::new(r"Bash\([^)]+\)").expect("OP-007: invalid regex"), // Restricted Bash is OK
            Regex::new(r"Write\([^)]+\)").expect("OP-007: invalid regex"), // Restricted Write is OK
        ],
        message: "Excessive permission delegation to subagent detected. Subagents should have minimal required permissions.",
        recommendation: "Restrict subagent permissions to only required tools with specific patterns.",
        fix_hint: Some(
            "Use specific tool permissions: allowed-tools: Read, Grep instead of wildcard",
        ),
        cwe_ids: &["CWE-250", "CWE-269"],
    }
}

fn op_008() -> Rule {
    Rule {
        id: "OP-008",
        name: "MCP tool unrestricted access",
        description: "Detects MCP server configurations with unrestricted tool access",
        severity: Severity::Critical,
        category: Category::Overpermission,
        confidence: Confidence::Certain,
        patterns: vec![
            // MCP server with all tools auto-approved
            Regex::new(r#""mcpServers"[^}]*"autoApprove"\s*:\s*\[\s*"\*"\s*\]"#)
                .expect("OP-008: invalid regex"),
            Regex::new(r#""mcpServers"[^}]*"autoApproveTools"\s*:\s*true"#)
                .expect("OP-008: invalid regex"),
            // Trust all tools from server
            Regex::new(r#""trustTools"\s*:\s*(true|\[\s*"\*"\s*\])"#)
                .expect("OP-008: invalid regex"),
            // Allow all MCP capabilities
            Regex::new(r#""capabilities"\s*:\s*\[\s*"\*"\s*\]"#).expect("OP-008: invalid regex"),
            // Unrestricted MCP tool patterns
            Regex::new(r#"mcp.*tool.*permission.*\*"#).expect("OP-008: invalid regex"),
            // MCP server running with elevated privileges
            Regex::new(r#""command"\s*:\s*"sudo"#).expect("OP-008: invalid regex"),
            // No sandbox for MCP
            Regex::new(r#""sandbox"\s*:\s*false"#).expect("OP-008: invalid regex"),
            Regex::new(r#""disableSandbox"\s*:\s*true"#).expect("OP-008: invalid regex"),
        ],
        exclusions: vec![
            Regex::new(r"^\s*#").expect("OP-008: invalid regex"),
            Regex::new(r"^\s*//").expect("OP-008: invalid regex"),
        ],
        message: "MCP server with unrestricted tool access detected. This allows the server to execute any tool without approval.",
        recommendation: "Explicitly list allowed tools and require approval for sensitive operations.",
        fix_hint: Some(
            "Remove autoApprove: ['*'] and specify individual tools that can be auto-approved",
        ),
        cwe_ids: &["CWE-250", "CWE-269"],
    }
}

fn op_009() -> Rule {
    Rule {
        id: "OP-009",
        name: "Bash wildcard permission",
        description: "Detects Bash permissions with overly broad wildcard patterns",
        severity: Severity::High,
        category: Category::Overpermission,
        confidence: Confidence::Firm,
        patterns: vec![
            // Bash with single wildcard (too broad)
            Regex::new(r"Bash\s*\(\s*\*\s*\)").expect("OP-009: invalid regex"),
            Regex::new(r#"Bash\s*\(\s*["']\*["']\s*\)"#).expect("OP-009: invalid regex"),
            // Bash with trailing wildcard on dangerous commands
            Regex::new(r"Bash\s*\(\s*(curl|wget|nc|netcat|ssh|scp)\s*:\s*\*\s*\)")
                .expect("OP-009: invalid regex"),
            // Bash with leading wildcard
            Regex::new(r"Bash\s*\(\s*\*\s*:").expect("OP-009: invalid regex"),
            // Permission string with overly broad Bash
            Regex::new(r#"permissions.*Bash\s*\(\s*[^)]{0,5}\*[^)]{0,5}\s*\)"#)
                .expect("OP-009: invalid regex"),
            // Shell commands with wildcards
            Regex::new(r"Bash\s*\(\s*(sh|bash|zsh)\s*:\s*\*\s*\)").expect("OP-009: invalid regex"),
            // Package managers with wildcards (can install anything)
            Regex::new(r"Bash\s*\(\s*(npm|pip|cargo|apt|brew|yum)\s+install\s*:\s*\*\s*\)")
                .expect("OP-009: invalid regex"),
        ],
        exclusions: vec![
            // Specific command with wildcard arguments is safer
            Regex::new(r"Bash\s*\(\s*[a-z]+\s+[a-z]+\s*:\s*\*\s*\)")
                .expect("OP-009: invalid regex"),
        ],
        message: "Bash wildcard permission detected. This allows execution of a broad range of commands.",
        recommendation: "Use specific command patterns instead of wildcards.",
        fix_hint: Some("Replace Bash(*) with specific patterns: Bash(npm test:*), Bash(git:*)"),
        cwe_ids: &["CWE-78", "CWE-250"],
    }
}

#[cfg(test)]
mod tests {
    use super::*;

    #[test]
    fn test_op_001_detects_wildcard_tools() {
        let rule = op_001();
        let test_cases = vec![
            ("allowed-tools: *", true),
            ("allowed-tools: \"*\"", true),
            ("allowed-tools: '*'", true),
            (r#""allowed-tools": "*""#, true),
            ("allowed-tools: Read, Write, Bash", false),
            ("allowed-tools: Bash", false),
        ];

        for (input, should_match) in test_cases {
            let matched = rule.patterns.iter().any(|p| p.is_match(input));
            assert_eq!(matched, should_match, "Failed for input: {}", input);
        }
    }

    // Snapshot tests
    #[test]
    fn snapshot_op_001() {
        let rule = op_001();
        let content = include_str!("../../../tests/fixtures/rules/op_001.txt");
        let findings = crate::rules::snapshot_test::scan_with_rule(&rule, content);
        crate::assert_rule_snapshot!("op_001", findings);
    }
}