Every rule

Cordon 0.6.053 sections · 0 diagramsView this tutorial on GitHub

All 1,384 detection rules Cordon defines itself, grouped by what they watch, with the severity each reports at, and after them every Agent Threat Rule it carries. Rendered from the detectors and rule packs themselves. cordon-scanner rules show <id> prints one in full, with its remediation and references; rules test runs every rule's own samples.

   MALWARE.*       evidence of intent to harm: fails the build by default   SUSPECT.*       a behaviour or shape attackers use: worth a look   VULNERABLE.*    a known vulnerability in what you ship   SECRET.*        a credential in the code or its history   POLICY.*        a choice the project made about itself   OPERATIONAL.*   what the scan could not do, said out loud

Rule	Severity	What it catches
`MALWARE.AGENT.AUTORUN.001`	critical	A command an editor or agent runs on its own attacks the machine
`MALWARE.AGENT.HOOK_EXFIL.001`	critical	An agent hook that sends credentials away or opens a remote shell
`MALWARE.AGENT.HOOK_FETCH_EXEC.001`	critical	An agent hook that fetches and executes remote code
`POLICY.AGENT.AUTO_APPROVE.001`	high	Agent confirmations switched off in committed settings
`POLICY.AGENT.MCP_BROAD_SCOPE.001`	medium	A filesystem MCP server given the whole disk or home directory
`POLICY.AGENT.WIDE_DIRECTORY.001`	medium	Agent given the whole disk or home directory to work in
`POLICY.AGENT.WILDCARD_PERMISSION.001`	medium	Agent permissions allow any shell command
`SUSPECT.AGENT.API_REDIRECT.001`	high	Agent API traffic redirected to a host that is not the provider
`SUSPECT.AGENT.ATR.AGENT_MANIPULATION.001`	medium	Text that impersonates an agent or hijacks the agent's task
`SUSPECT.AGENT.ATR.CONTEXT_EXFILTRATION.001`	medium	Text that asks an agent to move secrets or context off the machine
`SUSPECT.AGENT.ATR.DATA_POISONING.001`	medium	Text that plants triggers or false facts for an agent
`SUSPECT.AGENT.ATR.EXCESSIVE_AUTONOMY.001`	medium	Text that asks an agent to act without the user's confirmation
`SUSPECT.AGENT.ATR.MODEL_ABUSE.001`	medium	Text that turns an agent toward abuse of the model
`SUSPECT.AGENT.ATR.MODEL_SECURITY.001`	medium	Text that targets the model's weights or safety
`SUSPECT.AGENT.ATR.PRIVILEGE_ESCALATION.001`	medium	Text that asks an agent to widen its own permissions
`SUSPECT.AGENT.ATR.PROMPT_INJECTION.001`	medium	Text that tries to override an agent's instructions
`SUSPECT.AGENT.ATR.SKILL_COMPROMISE.001`	medium	A skill or plugin shaped like a known compromise
`SUSPECT.AGENT.ATR.TOOL_POISONING.001`	medium	Text that turns a tool into a channel for steering the agent
`SUSPECT.AGENT.CI_PROMPT_INJECTION.001`	high	Untrusted event text passed straight into an agent's prompt
`SUSPECT.AGENT.CI_UNTRUSTED_TRIGGER.001`	high	An AI agent in CI reads text an outsider can write
`SUSPECT.AGENT.CREDENTIAL_EXFIL.001`	critical	Agent instructions that move credentials somewhere
`SUSPECT.AGENT.FETCH_EXEC.001`	high	Agent instructions that fetch and execute remote code
`SUSPECT.AGENT.HIDDEN_TEXT.001`	high	Hidden characters in an agent instruction file
`SUSPECT.AGENT.HOOK.001`	medium	An agent hook committed to the repository
`SUSPECT.AGENT.INJECTION_TEXT.001`	medium	Instruction-like text aimed at a coding agent
`SUSPECT.AGENT.INTENT.001`	high	Text that tells the agent to act against its user
`SUSPECT.AGENT.INTENT_CHAINED.001`	high	Agent instructions that send the agent to a file that acts against its user
`SUSPECT.AGENT.JUDGED.001`	medium	A language model judges agent-facing text to be subverting the agent
`SUSPECT.AGENT.PLUGIN_SOURCE.001`	high	Agent plugins installed from an unverified source
`SUSPECT.AGENT.REMOTE_INSTRUCTIONS.001`	medium	An agent instruction file tells the agent to fetch and follow remote text
`SUSPECT.AGENT.SENSITIVE_IMPORT.001`	high	An agent instruction file imports a credential file
`VULNERABLE.AGENT.ACTION_VERSION.001`	high	An AI agent action below its security fix

Rule	Severity	What it catches
`MALWARE.ANTI_ANALYSIS.001`	critical	Install-time code that checks whether it is being watched
`SUSPECT.ANTI_ANALYSIS.001`	high	Behaviour gated on whether it is being observed

Rule	Severity	What it catches
`SUSPECT.ARCHIVE.NESTING.001`	high	Archives nested past the depth the scan opens
`SUSPECT.ARCHIVE.PATH_ESCAPE.001`	high	Archive member named to write outside the archive
`SUSPECT.ARCHIVE.POLYGLOT.001`	high	Archive that is a tarball and a zip at once

Rule	Severity	What it catches
`POLICY.AZURE.DELETION_PROTECTION.KEYVAULT_VAULTS_ENABLEPURGEPROTECTION.001`	medium	Microsoft.KeyVault/vaults: a deleted vault can be purged immediately
`POLICY.AZURE.DELETION_PROTECTION.KEYVAULT_VAULTS_ENABLESOFTDELETE.001`	medium	Microsoft.KeyVault/vaults: a deleted secret is gone immediately
`POLICY.AZURE.RBAC.KEYVAULT_VAULTS_ENABLERBACAUTHORIZATION.001`	low	Microsoft.KeyVault/vaults: access is governed by vault access policies rather than RBAC
`POLICY.AZURE.SHARED_KEY_AUTH.ANY_DISABLELOCALAUTH.001`	medium	Microsoft.*: shared-key authentication is enabled
`POLICY.AZURE.SHARED_KEY_AUTH.STORAGE_STORAGEACCOUNTS_ALLOWSHAREDKEYACCESS.001`	medium	Microsoft.Storage/storageAccounts: the account key authenticates callers
`POLICY.AZURE.WEAK_TLS.STORAGE_STORAGEACCOUNTS_MINIMUMTLSVERSION.001`	medium	Microsoft.Storage/storageAccounts: an obsolete TLS version is accepted
`SUSPECT.AZURE.NETWORK_DEFAULT_ALLOW.ANY_DEFAULTACTION.001`	medium	Microsoft.*: the network rules default to allowing everything
`SUSPECT.AZURE.NO_AUTH.CONTAINERREGISTRY_REGISTRIES_ANONYMOUSPULLENABLED.001`	high	Microsoft.ContainerRegistry/registries: anyone may pull images from the registry
`SUSPECT.AZURE.OPEN_INGRESS.NETWORK_NETWORKSECURITYGROUPS_SOURCEADDRESSPREFIX.001`	high	Microsoft.Network/networkSecurityGroups: an administrative port is open to the whole internet
`SUSPECT.AZURE.PASSWORD_AUTH.COMPUTE_VIRTUALMACHINES_DISABLEPASSWORDAUTHENTICATION.001`	medium	Microsoft.Compute/virtualMachines: SSH password authentication is enabled
`SUSPECT.AZURE.PLAINTEXT.STORAGE_STORAGEACCOUNTS_SUPPORTSHTTPSTRAFFICONLY.001`	high	Microsoft.Storage/storageAccounts: the storage account accepts plain HTTP
`SUSPECT.AZURE.PLAINTEXT.WEB_SITES_FTPSSTATE.001`	medium	Microsoft.Web/sites: deployment over plain FTP is allowed
`SUSPECT.AZURE.PLAINTEXT.WEB_SITES_HTTPSONLY.001`	medium	Microsoft.Web/sites: the site answers plain HTTP
`SUSPECT.AZURE.PUBLIC_ACCESS.ANY_PUBLICNETWORKACCESS.001`	medium	Microsoft.*: the resource answers on a public endpoint
`SUSPECT.AZURE.PUBLIC_STORAGE.STORAGE_STORAGEACCOUNTS_ALLOWBLOBPUBLICACCESS.001`	high	Microsoft.Storage/storageAccounts: containers may be made public
`SUSPECT.AZURE.SHARED_KEY_AUTH.CONTAINERREGISTRY_REGISTRIES_ADMINUSERENABLED.001`	medium	Microsoft.ContainerRegistry/registries: the shared admin account is enabled

Rule	Severity	What it catches
`POLICY.BINARY.COMMITTED.001`	low	Executable committed to a source repository
`SUSPECT.BINARY.CREDENTIAL_THEFT.001`	high	Committed binary imports credential-store and network calls
`SUSPECT.BINARY.EXECUTABLE_PATH.001`	high	Executable committed where a lifecycle step will run it
`SUSPECT.BINARY.HIDDEN_IMPORTS.001`	medium	Committed binary resolves its imports at run time
`SUSPECT.BINARY.IMPLANT.001`	high	Committed binary imports download-and-run calls
`SUSPECT.BINARY.KEYLOGGER.001`	medium	Committed binary imports keyboard-capture and network calls
`SUSPECT.BINARY.NATIVE_IN_PURE_WHEEL.001`	high	A pure-Python wheel loads a native library it carries
`SUSPECT.BINARY.PACKED.001`	medium	Committed binary is packed
`SUSPECT.BINARY.PROCESS_INJECTION.001`	high	Committed binary imports process-injection calls
`SUSPECT.BINARY.STRINGS.001`	medium	Committed binary contains a URL, command or credential path

Rule	Severity	What it catches
`POLICY.BUILD.UNPINNED_DEPENDENCY.001`	medium	Build dependency resolves to whatever is newest, not a fixed version
`POLICY.BUILD.WRAPPER_UNVERIFIED.001`	low	Build wrapper downloads its tool without a checksum
`SUSPECT.BUILD.CMAKE_FETCH_UNVERIFIED.001`	medium	CMake fetches a URL with nothing verifying what it downloaded
`SUSPECT.BUILD.MAKE_FETCH_EXEC.001`	high	Makefile recipe fetches and executes remote content
`SUSPECT.BUILD.MSBUILD_FETCH_EXEC.001`	high	MSBuild target fetches and executes remote content

Rule	Severity	What it catches
`MALWARE.CI.SECRET_EXFIL.001`	critical	CI workflow serialises its secret context
`POLICY.CI.UNPINNED_ACTION.001`	medium	Action referenced by a mutable tag
`POLICY.CI.UNPINNED_REUSABLE_WORKFLOW.001`	medium	Reusable workflow called by a mutable ref
`POLICY.CI.WRITE_ALL_PERMISSIONS.001`	medium	Workflow token is granted every write scope
`SUSPECT.CI.ARTIFACT_POISONING.001`	high	Untrusted build uploads or restores a cache it can control
`SUSPECT.CI.AZURE_INJECTION.001`	high	Azure Pipelines script interpolates a contributor-controlled value
`SUSPECT.CI.BITBUCKET_INJECTION.001`	high	Bitbucket Pipelines step re-parses a contributor-controlled branch name
`SUSPECT.CI.BUILDKITE_INJECTION.001`	high	Buildkite pipeline interpolates a contributor-controlled value at upload
`SUSPECT.CI.CACHE_POISONING.001`	medium	A publishing workflow restores a cache an untrusted run can write
`SUSPECT.CI.CIRCLE_INJECTION.001`	high	CircleCI step interpolates a contributor-controlled pipeline value
`SUSPECT.CI.EXPRESSION_INJECTION.001`	high	Untrusted pipeline input interpolated into a shell command
`SUSPECT.CI.FETCH_EXEC.001`	high	CI step fetches and executes remote content
`SUSPECT.CI.GITLAB_INJECTION.001`	high	GitLab job interpolates a contributor-controlled variable into a script
`SUSPECT.CI.JENKINS_INJECTION.001`	high	Jenkins shell step interpolates a contributor-controlled value
`SUSPECT.CI.PR_TARGET.001`	high	Workflow uses pull_request_target and checks out the pull request head
`SUSPECT.CI.SECRET_EGRESS.001`	medium	Pipeline step reads a secret and sends data off the runner
`SUSPECT.CI.SECRET_OVERPROVISION.001`	high	CI workflow hands another workflow every secret it has
`SUSPECT.CI.SELF_HOSTED_FORK.001`	high	A fork's pull request runs on a self-hosted runner
`SUSPECT.CI.WORKFLOW_RUN_CHECKOUT.001`	high	workflow_run checks out the commit that triggered it

Rule	Severity	What it catches
`MALWARE.CLAMAV.SIGNATURE.001`	critical	ClamAV recognises the file as malware
`OPERATIONAL.CLAMAV.STATUS`	info	ClamAV examined the scan's files
`OPERATIONAL.CLAMAV.UNAVAILABLE`	info	ClamAV was asked for and could not be used

Rule	Severity	What it catches
`SUSPECT.COMPOSE.DANGEROUS_CAPABILITY.001`	high	Compose service: the service is granted a capability that defeats isolation
`SUSPECT.COMPOSE.HOST_NETWORK.001`	medium	Compose service: the service shares the host network namespace

Rule	Severity	What it catches
`POLICY.CONTAINER.UNPINNED_BASE.001`	low	Base image referenced by tag rather than digest
`POLICY.CONTAINER.UNPINNED_WORKLOAD_IMAGE.001`	low	Kubernetes workload runs an image by tag rather than digest
`POLICY.CONTAINER.UNSIGNED_IMAGE.001`	low	An image this project runs carries no signature or build attestation
`SUSPECT.CONTAINER.BUILD_SECRET.001`	high	Secret passed as a build argument
`SUSPECT.CONTAINER.FETCH_EXEC.001`	high	Image build fetches and executes remote content

Rule	Severity	What it catches
`POLICY.CFN.CMEK.AWS_AIOPS_INVESTIGATIONGROUP.001`	low	cfn:AWS::AIOps::InvestigationGroup: a customer-managed key
`POLICY.CFN.CMEK.AWS_AMAZONMQ_BROKER.001`	low	cfn:AWS::AmazonMQ::Broker: a customer-managed key
`POLICY.CFN.CMEK.AWS_APS_WORKSPACE.001`	low	cfn:AWS::APS::Workspace: a customer-managed key
`POLICY.CFN.CMEK.AWS_BACKUPGATEWAY_HYPERVISOR.001`	low	cfn:AWS::BackupGateway::Hypervisor: a customer-managed key
`POLICY.CFN.CMEK.AWS_BEDROCKAGENTCORE_CAPACITYPROVIDER.001`	low	cfn:AWS::BedrockAgentCore::CapacityProvider: a customer-managed key
`POLICY.CFN.CMEK.AWS_BEDROCKAGENTCORE_CONFIGURATIONBUNDLE.001`	low	cfn:AWS::BedrockAgentCore::ConfigurationBundle: a customer-managed key
`POLICY.CFN.CMEK.AWS_BEDROCKAGENTCORE_DATASET.001`	low	cfn:AWS::BedrockAgentCore::Dataset: a customer-managed key
`POLICY.CFN.CMEK.AWS_BEDROCKAGENTCORE_EVALUATOR.001`	low	cfn:AWS::BedrockAgentCore::Evaluator: a customer-managed key
`POLICY.CFN.CMEK.AWS_BEDROCKAGENTCORE_GATEWAY.001`	low	cfn:AWS::BedrockAgentCore::Gateway: a customer-managed key
`POLICY.CFN.CMEK.AWS_BEDROCK_AUTOMATEDREASONINGPOLICY.001`	low	cfn:AWS::Bedrock::AutomatedReasoningPolicy: a customer-managed key
`POLICY.CFN.CMEK.AWS_BEDROCK_BLUEPRINT.001`	low	cfn:AWS::Bedrock::Blueprint: a customer-managed key
`POLICY.CFN.CMEK.AWS_BEDROCK_DATAAUTOMATIONLIBRARY.001`	low	cfn:AWS::Bedrock::DataAutomationLibrary: a customer-managed key
`POLICY.CFN.CMEK.AWS_BEDROCK_DATAAUTOMATIONPROJECT.001`	low	cfn:AWS::Bedrock::DataAutomationProject: a customer-managed key
`POLICY.CFN.CMEK.AWS_BEDROCK_DATASOURCE.001`	low	cfn:AWS::Bedrock::DataSource: a customer-managed key
`POLICY.CFN.CMEK.AWS_BEDROCK_GUARDRAIL.001`	low	cfn:AWS::Bedrock::Guardrail: a customer-managed key
`POLICY.CFN.CMEK.AWS_BEDROCK_KNOWLEDGEBASE.001`	low	cfn:AWS::Bedrock::KnowledgeBase: a customer-managed key
`POLICY.CFN.CMEK.AWS_CLEANROOMSML_CONFIGUREDMODELALGORITHM.001`	low	cfn:AWS::CleanRoomsML::ConfiguredModelAlgorithm: a customer-managed key
`POLICY.CFN.CMEK.AWS_CLEANROOMS_IDMAPPINGTABLE.001`	low	cfn:AWS::CleanRooms::IdMappingTable: a customer-managed key
`POLICY.CFN.CMEK.AWS_CLEANROOMS_INTERMEDIATETABLE.001`	low	cfn:AWS::CleanRooms::IntermediateTable: a customer-managed key
`POLICY.CFN.CMEK.AWS_CLOUDTRAIL_EVENTDATASTORE.001`	low	cfn:AWS::CloudTrail::EventDataStore: a customer-managed key
`POLICY.CFN.CMEK.AWS_CODECOMMIT_REPOSITORY.001`	low	cfn:AWS::CodeCommit::Repository: a customer-managed key
`POLICY.CFN.CMEK.AWS_COGNITO_USERPOOL.001`	low	cfn:AWS::Cognito::UserPool: a customer-managed key
`POLICY.CFN.CMEK.AWS_COMPREHEND_DOCUMENTCLASSIFIER.001`	low	cfn:AWS::Comprehend::DocumentClassifier: a customer-managed key
`POLICY.CFN.CMEK.AWS_DATAEXCHANGE_EVENTACTION.001`	low	cfn:AWS::DataExchange::EventAction: a customer-managed key
`POLICY.CFN.CMEK.AWS_DATASYNC_LOCATIONAZUREBLOB.001`	low	cfn:AWS::DataSync::LocationAzureBlob: a customer-managed key
`POLICY.CFN.CMEK.AWS_DATASYNC_LOCATIONFSXONTAP.001`	low	cfn:AWS::DataSync::LocationFSxONTAP: a customer-managed key
`POLICY.CFN.CMEK.AWS_DATASYNC_LOCATIONFSXWINDOWS.001`	low	cfn:AWS::DataSync::LocationFSxWindows: a customer-managed key
`POLICY.CFN.CMEK.AWS_DATASYNC_LOCATIONHDFS.001`	low	cfn:AWS::DataSync::LocationHDFS: a customer-managed key
`POLICY.CFN.CMEK.AWS_DATASYNC_LOCATIONOBJECTSTORAGE.001`	low	cfn:AWS::DataSync::LocationObjectStorage: a customer-managed key
`POLICY.CFN.CMEK.AWS_DATASYNC_LOCATIONSMB.001`	low	cfn:AWS::DataSync::LocationSMB: a customer-managed key
`POLICY.CFN.CMEK.AWS_DEADLINE_FARM.001`	low	cfn:AWS::Deadline::Farm: a customer-managed key
`POLICY.CFN.CMEK.AWS_DEVOPSAGENT_AGENTSPACE.001`	low	cfn:AWS::DevOpsAgent::AgentSpace: a customer-managed key
`POLICY.CFN.CMEK.AWS_DEVOPSAGENT_SERVICE.001`	low	cfn:AWS::DevOpsAgent::Service: a customer-managed key
`POLICY.CFN.CMEK.AWS_DMS_ENDPOINT.001`	low	cfn:AWS::DMS::Endpoint: a customer-managed key
`POLICY.CFN.CMEK.AWS_DMS_INSTANCEPROFILE.001`	low	cfn:AWS::DMS::InstanceProfile: a customer-managed key
`POLICY.CFN.CMEK.AWS_DMS_REPLICATIONCONFIG.001`	low	cfn:AWS::DMS::ReplicationConfig: a customer-managed key
`POLICY.CFN.CMEK.AWS_DMS_REPLICATIONINSTANCE.001`	low	cfn:AWS::DMS::ReplicationInstance: a customer-managed key
`POLICY.CFN.CMEK.AWS_DOCDBELASTIC_CLUSTER.001`	low	cfn:AWS::DocDBElastic::Cluster: a customer-managed key
`POLICY.CFN.CMEK.AWS_DOCDB_DBCLUSTER.001`	low	cfn:AWS::DocDB::DBCluster: a customer-managed key
`POLICY.CFN.CMEK.AWS_EC2_VERIFIEDACCESSENDPOINT.001`	low	cfn:AWS::EC2::VerifiedAccessEndpoint: a customer-managed key

Rule	Severity	What it catches
`MALWARE.DEPENDENCY.KNOWN.001`	critical	Dependency is a known-malicious release
`POLICY.DEPENDENCY.ABANDONED.001`	medium	Dependency is abandoned by its maintainer
`POLICY.DEPENDENCY.CLEARTEXT_SOURCE.001`	medium	Package source over plain HTTP
`POLICY.DEPENDENCY.DEPRECATED.001`	medium	Dependency pins a version its publisher deprecated
`POLICY.DEPENDENCY.DOWNGRADE.001`	low	Dependency pins a version far behind the current release
`POLICY.DEPENDENCY.INTEGRITY.001`	medium	Dependency has no integrity hash
`POLICY.DEPENDENCY.MUTABLE_REF.001`	medium	Git dependency on a reference that can move
`POLICY.DEPENDENCY.SECURITY_PLACEHOLDER.001`	medium	Dependency pins npm's security placeholder
`POLICY.DEPENDENCY.SOURCE.001`	low	Dependency declared from a non-registry source
`POLICY.DEPENDENCY.UNMAINTAINED.001`	low	Dependency has had no release in five years
`SUSPECT.DEPENDENCY.CONFUSION.001`	high	Internal package name resolved from a public registry
`SUSPECT.DEPENDENCY.DEPRECATED_SECURITY.001`	high	Dependency pins a version its publisher deprecated for a security reason
`SUSPECT.DEPENDENCY.HALLUCINATED.001`	high	A dependency's name is a documented AI hallucination
`SUSPECT.DEPENDENCY.SOURCE.001`	medium	Dependency resolved from outside the registry
`SUSPECT.DEPENDENCY.SOURCE_PRIORITY.001`	medium	A private package index merged with a public one
`SUSPECT.DEPENDENCY.TYPOSQUAT.001`	high	Dependency name is one edit from a popular package
`SUSPECT.DEPENDENCY.UNREGISTERED.001`	high	A dependency does not exist on its public registry
`SUSPECT.DEPENDENCY.UNVETTED.001`	medium	A dependency is new, sourceless and unknown: the shape of a slopsquatted package
`SUSPECT.DEPENDENCY.YANKED.001`	high	Dependency pins a version its publisher withdrew
`VULNERABLE.DEPENDENCY.EXPLOITED.001`	critical	Dependency has a vulnerability that is exploited in the wild
`VULNERABLE.DEPENDENCY.KNOWN.001`	high	Dependency has a known vulnerability

Rule	Severity	What it catches
`SUSPECT.DOCUMENT.AUTO_EXEC.001`	high	A macro runs by itself on open and starts a program or fetches from the network
`SUSPECT.DOCUMENT.DDE.001`	high	A document contains a DDE field
`SUSPECT.DOCUMENT.MACRO.001`	medium	An office document carries macros
`SUSPECT.DOCUMENT.PDF_AUTO_ACTION.001`	high	A PDF runs JavaScript when it is opened
`SUSPECT.DOCUMENT.PDF_EMBEDDED_EXECUTABLE.001`	high	A PDF embeds a file with an executable name
`SUSPECT.DOCUMENT.PDF_JAVASCRIPT.001`	medium	A PDF carries JavaScript
`SUSPECT.DOCUMENT.PDF_LAUNCH.001`	high	A PDF asks the viewer to launch a program
`SUSPECT.DOCUMENT.PDF_RISKY_URI.001`	medium	A PDF link opens a script, a local file or a download that runs
`SUSPECT.DOCUMENT.REMOTE_OBJECT.001`	high	A document loads a template or object from elsewhere when opened
`SUSPECT.DOCUMENT.RTF_OBJECT.001`	high	An RTF document embeds an object that loads itself

Rule	Severity	What it catches
`MALWARE.EXTENSION.KNOWN.001`	critical	An editor extension is a recorded malicious release
`MALWARE.EXTENSION.REMOVED.001`	critical	A recommended or vendored editor extension was removed from the Marketplace as malware
`SUSPECT.EXTENSION.LOOKALIKE.001`	medium	A recommended editor extension imitates a popular one
`SUSPECT.EXTENSION.MALICIOUS_VERSIONS.001`	low	A named editor extension has had malicious releases
`SUSPECT.EXTENSION.REMOVED.001`	high	A recommended or vendored editor extension was removed from the Marketplace

Rule	Severity	What it catches
`MALWARE.CRYPTOMINER.001`	critical	Install-time cryptocurrency mining
`SUSPECT.CRYPTOMINER.001`	high	Cryptocurrency mining

Rule	Severity	What it catches
`POLICY.DOCKERFILE.NO_HEALTHCHECK.001`	low	Dockerfile: the image serves a port and declares no health check
`POLICY.DOCKERFILE.ROOT_USER.001`	medium	Dockerfile: the image runs as root
`POLICY.DOCKERFILE.SECRET_ARG_DECLARED.001`	medium	Dockerfile: a credential is passed as a build argument
`POLICY.DOCKERFILE.SUDO.001`	low	Dockerfile: the build uses sudo
`SUSPECT.DOCKERFILE.ADD_REMOTE.001`	medium	Dockerfile: the build downloads a URL with ADD
`SUSPECT.DOCKERFILE.SECRET_ARG.001`	high	Dockerfile: a credential is baked into the image

Rule	Severity	What it catches
`MALWARE.DROPPER.001`	critical	Install script fetches and executes remote content
`SUSPECT.DROPPER.001`	high	Content fetched from the network and executed

Rule	Severity	What it catches
`MALWARE.DYNAMIC_DISPATCH.001`	critical	Install-time code reaches a function by a computed name
`SUSPECT.DYNAMIC_DISPATCH.001`	high	A function is reached by a name computed at runtime

Rule	Severity	What it catches
`MALWARE.EXFIL.001`	critical	Install script reads credentials and transmits them
`MALWARE.EXFIL.BEACON.001`	critical	Install script reports the machine it is installing on
`MALWARE.EXFIL.CREDENTIAL_STORE.001`	critical	Install-time code reads a credential store and reaches the network
`MALWARE.EXFIL.DROP_POINT.001`	critical	Install-time code sends data to a drop point
`MALWARE.EXFIL.INSTALL_CALLBACK.001`	critical	Install script calls back to a drop point
`SUSPECT.EXFIL.001`	medium	Credential access combined with network egress and execution
`SUSPECT.EXFIL.BEACON.001`	high	Code reports the machine it runs on
`SUSPECT.EXFIL.CALLBACK.001`	high	Code calls an out-of-band interaction service
`SUSPECT.EXFIL.CREDENTIAL_STORE.001`	high	A credential store is read and the file reaches the network
`SUSPECT.EXFIL.DNS.001`	high	Credential access and a hostname assembled for resolution
`SUSPECT.EXFIL.DROP_POINT.001`	high	Credential or machine identity, and a request to a drop point
`SUSPECT.EXFIL.ENVIRONMENT.001`	high	Code sends the whole environment over the network
`SUSPECT.EXFIL.NAMED_SECRET.001`	high	Code sends a named credential to a host outside its service

Rule	Severity	What it catches
`OPERATIONAL.IMAGE.UNMATCHED`	info	An image's packages were not all matched against advisories
`VULNERABLE.IMAGE.EXPLOITED.001`	critical	An image's operating-system package has a vulnerability exploited in the wild
`VULNERABLE.IMAGE.PACKAGE.001`	high	An image's operating-system package has a known vulnerability

Rule	Severity	What it catches
`MALWARE.INSTALL.CONSUMER_CODE.001`	critical	Code that runs on every machine that installs this package
`MALWARE.INSTALL.DECODED_LAUNCH.001`	critical	An install script decodes content and starts a process
`MALWARE.INSTALL.FETCH_EXEC.001`	critical	Install script fetches and executes remote content
`MALWARE.INSTALL.HIDDEN_ACTION.001`	critical	An install script hides a process, request or credential read inside a string it executes
`MALWARE.INSTALL.PERSIST.001`	critical	Install script plants code that runs again later
`SUSPECT.INSTALL.SCRIPT.001`	high	Package declares an install-time lifecycle script
`SUSPECT.INSTALL.UNEXAMINED.001`	high	Install-time code too large or slow to examine

Rule	Severity	What it catches
`OPERATIONAL.JUDGE.BUDGET`	info	The judge's call budget ran out
`OPERATIONAL.JUDGE.STATUS`	info	A language model judged the scan's agent-facing text
`OPERATIONAL.JUDGE.UNAVAILABLE`	info	The judge was asked for and could not be used

Rule	Severity	What it catches
`POLICY.K8S.AUTOMOUNT_TOKEN.001`	low	Kubernetes workload: the service account token is mounted into the pod
`POLICY.K8S.DEFAULT_SERVICE_ACCOUNT.001`	low	Kubernetes workload: the workload uses the namespace's default service account
`POLICY.K8S.LATEST_TAG.001`	medium	Kubernetes workload: a container image is pinned to :latest
`POLICY.K8S.NET_ADMIN.001`	medium	Container adds network-administration capability
`POLICY.K8S.NO_RESOURCE_LIMITS.001`	low	Kubernetes workload: no resource limits are set
`POLICY.K8S.NO_RUN_AS_NON_ROOT.001`	low	Kubernetes workload: nothing requires the container to run as a non-root user
`POLICY.K8S.NO_SECCOMP.001`	low	Kubernetes workload: no seccomp profile is applied
`POLICY.K8S.SERVICE_ACCOUNT_TOKEN.001`	low	Service-account token mounted into a workload
`POLICY.K8S.WRITABLE_ROOT.001`	low	Kubernetes workload: the container's root filesystem is writable
`SUSPECT.K8S.CAPABILITIES.001`	high	Container adds a capability that escapes the sandbox
`SUSPECT.K8S.DANGEROUS_CAPABILITY.001`	high	Kubernetes workload: a container is granted a capability that defeats isolation
`SUSPECT.K8S.HOST_IPC.001`	medium	Kubernetes workload: the pod shares the node's IPC namespace
`SUSPECT.K8S.HOST_NETWORK.001`	high	Kubernetes workload: the pod shares the node's network namespace
`SUSPECT.K8S.HOST_PID.001`	high	Kubernetes workload: the pod shares the node's process namespace
`SUSPECT.K8S.HOST_PORT.001`	medium	Kubernetes workload: a container binds a port on the node
`SUSPECT.K8S.PRIVILEGE_ESCALATION.001`	medium	Kubernetes workload: a container may gain more privileges than it started with
`SUSPECT.K8S.RBAC_WILDCARD.001`	high	Role grants every verb or every resource
`SUSPECT.K8S.RUN_AS_ROOT.001`	medium	Kubernetes workload: a container runs as uid 0
`SUSPECT.K8S.SECRET_ENV_VALUE.001`	high	Kubernetes workload: a credential is written into the manifest

Rule	Severity	What it catches
`POLICY.LICENSE.COPYLEFT.001`	medium	Dependency is under a copyleft license
`POLICY.LICENSE.DENIED.001`	high	Dependency under a licence the policy denies
`POLICY.LICENSE.NETWORK_COPYLEFT.001`	medium	Dependency is under a network-copyleft license
`POLICY.LICENSE.NOT_ALLOWED.001`	medium	Dependency under a licence outside the allowed list
`POLICY.LICENSE.UNKNOWN.001`	low	Dependency whose licence could not be established
`POLICY.LICENSE.WEAK_COPYLEFT.001`	low	Dependency is under a weak-copyleft license

Rule	Severity	What it catches
`POLICY.LOCKFILE.INTEGRITY.001`	medium	Lockfile entry without an integrity hash
`SUSPECT.LOCKFILE.INTEGRITY_CONFLICT.001`	high	One package version locked with two different hashes
`SUSPECT.LOCKFILE.INTEGRITY_MALFORMED.001`	high	Lockfile integrity value is not a hash
`SUSPECT.LOCKFILE.SOURCE.001`	medium	Lockfile entry resolved from outside the registry

Rule	Severity	What it catches
`OPERATIONAL.MCP.LIVE_UNREAD.001`	info	A remote MCP server could not be read
`OPERATIONAL.MCP.UNRESOLVED`	info	An MCP server package was not examined
`SUSPECT.MCP.CONTAINER_HOST_ACCESS.001`	high	An MCP server's container is given the host
`SUSPECT.MCP.ENV_INJECTION.001`	high	An MCP server's environment loads code into it before it starts
`SUSPECT.MCP.INSECURE_TRANSPORT.001`	high	A remote MCP server over plain HTTP
`SUSPECT.MCP.LIVE_TOOL_DESCRIPTION.001`	high	A remote MCP server serves a tool description that steers the agent
`SUSPECT.MCP.LOOKALIKE.001`	high	An MCP server package named like a popular one
`SUSPECT.MCP.SHELL_LAUNCH.001`	high	An MCP server launched through a shell that fetches code
`SUSPECT.MCP.TOOLS_CHANGED.001`	medium	A remote MCP server's tools changed since they were approved
`SUSPECT.MCP.TOOL_DESCRIPTION.001`	high	A tool in this repository's MCP server instructs the agent
`SUSPECT.MCP.TOOL_POISONING.001`	high	An MCP server's tool description hides text or instructs the agent
`SUSPECT.MCP.UNPINNED.001`	medium	An MCP server launched from an unpinned package
`SUSPECT.MCP.UNTRUSTED_REMOTE.001`	high	A remote MCP server on a tunnel, paste or interaction host

Rule	Severity	What it catches
`SUSPECT.MEDIA.APPENDED_PAYLOAD.001`	high	An image has an archive, executable or script appended after its end
`SUSPECT.MEDIA.OPAQUE_TRAILER.001`	medium	A file carries a large, near-random block after its end
`SUSPECT.MEDIA.TRAILING_DATA.001`	low	An image has data after its end

Rule	Severity	What it catches
`MALWARE.MODEL.PICKLE_EXEC.001`	critical	A pickle that runs a command, reaches the network or evaluates code when loaded
`SUSPECT.MODEL.LOADED_ON_IMPORT.001`	high	The package deserialises a model file it ships, unsafely, when it is imported
`SUSPECT.MODEL.PICKLE_IMPORT.001`	medium	A pickle imports something ordinary model files do not
`SUSPECT.MODEL.REMOTE_CODE.001`	medium	Loads a model with trust_remote_code, running its repository's Python
`SUSPECT.MODEL.UNSAFE_LOAD_OPTION.001`	medium	Loads a model with the loader's safety switch turned off

Rule	Severity	What it catches
`SUSPECT.OBFUSCATION.BIDI.001`	high	Bidirectional or invisible Unicode in source
`SUSPECT.OBFUSCATION.ENCODED.001`	medium	Large encoded blob embedded in source
`SUSPECT.OBFUSCATION.LONGLINE.001`	low	Line far longer than any hand-written source
`SUSPECT.OBFUSCATION.PACKED.001`	medium	Packer or minifier signature in hand-written source
`SUSPECT.OBFUSCATION.TAG_SMUGGLING.001`	high	Invisible text written in Unicode Tag characters

Rule	Severity	What it catches
`MALWARE.PACKAGE.KNOWN.001`	critical	The scanned package is a recorded malicious release
`POLICY.PACKAGE.DENIED.001`	high	Dependency on a package the policy denies
`POLICY.PACKAGE.NOT_ALLOWED.001`	medium	Dependency outside the policy's allowed packages
`SUSPECT.PACKAGE.MANIFEST_CONFUSION.001`	high	The manifest npm serves is not the package.json in the tarball
`SUSPECT.PACKAGE.PROVENANCE.001`	medium	Version published without the provenance its package normally carries
`SUSPECT.PACKAGE.REPOSITORY.001`	medium	Package claims a source repository the registry does not record
`SUSPECT.PACKAGE.STARJACKING.001`	high	A new package claims a popular project's repository

Rule	Severity	What it catches
`OPERATIONAL.PROVENANCE.NOT_CHECKED.001`	low	Build provenance was not checked for part of the graph
`POLICY.PROVENANCE.UNVERIFIED.001`	low	Dependency advertises an attestation that could not be verified
`SUSPECT.PROVENANCE.MISMATCH.001`	critical	Lockfile hash disagrees with the registry
`VULNERABLE.PROVENANCE.INVALID.001`	critical	Dependency's build attestation fails verification

Rule	Severity	What it catches
`OPERATIONAL.REGISTRY.NOT_ASKED.001`	low	Dependencies past the query ceiling or time budget were never asked about
`OPERATIONAL.REGISTRY.NO_SOURCE.001`	low	No registry is configured for part of the dependency graph
`OPERATIONAL.REGISTRY.UNREACHABLE.001`	low	Registry could not be asked about a dependency
`SUSPECT.REGISTRY.SELF_PUBLISH.001`	high	Shipped code that publishes packages

Rule	Severity	What it catches
`POLICY.RELEASE.NO_PROVENANCE.001`	low	Release workflow publishes without build provenance
`SUSPECT.RELEASE.NEW_BINARY.001`	medium	This release adds compiled files
`SUSPECT.RELEASE.NEW_CAPABILITY.001`	high	This release's flagged code gains network, process or execution capability
`SUSPECT.RELEASE.NEW_INSTALL_HOOK.001`	high	This release runs code at install that the previous release did not
`SUSPECT.RELEASE.NEW_OBFUSCATION.001`	high	This release ships obfuscated code where the previous shipped none
`SUSPECT.RELEASE.NEW_PUBLISHER.001`	medium	This release was published by a different account than the previous one

Rule	Severity	What it catches
`OPERATIONAL.SBOM.UNREADABLE.001`	low	Bill of materials could not be read
`SUSPECT.SBOM.DRIFT.001`	medium	Bill of materials omits resolved dependencies
`VULNERABLE.SBOM.LISTED.001`	medium	A bill of materials lists a vulnerability in one of its components