mirror of
https://github.com/CyberSecurityUP/NeuroSploit.git
synced 2026-10-05 07:27:18 +02:00
CyberSecurityUPandClaude Opus 4.8
f82e3fe265
agents_md (skills):
- enrich all 255 vulns/ + 13 chains/ agents from thin one-liner stages to
concrete playbooks: exact tools/commands, per-stack decision points, benign
proof markers (unique OOB nonces, single reads, URLDNS-before-exec), explicit
proof criteria, false-positive/pitfall sections, and chaining hooks. Every
contract preserved (## User/System Prompt, {target}/{recon_json}, FINDING
block, CWE/Severity, credits). avg 37->53 lines; loader parses all 449.
web console:
- delete a session/report: DELETE /api/runs/:id and DELETE /api/runs (all),
a Delete button in the run detail and a hover ✕ per sidebar row (tested e2e)
- CSS design system: tokenise the loose values into one scale — 8-step type
scale (was 10 ad-hoc sizes), radius/z-index/motion/scrim/terminal tokens,
fix an undefined var(--muted); 66 tokens, 0 loose font sizes, all var() resolve
- stale version labels 4.0.0/4.2.0 -> 4.2.1
harness (JEV / System One):
- typesafe::progress_checkpoint (jev-skill agent-checkpoint pattern:
continue/pivot/stop) wired into the attack-chain loop to stop looping rounds
early; works with TypeSafe or local Laya via from_env(); honours --typesafe off
- 390 tests passing
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
56 lines
3.3 KiB
Markdown
56 lines
3.3 KiB
Markdown
# LLM Plugin/MCP Supply-Chain Specialist Agent
|
|
|
|
## User Prompt
|
|
You are testing **{target}** for Insecure LLM plugins / MCP tools (OWASP LLM03).
|
|
|
|
**Recon Context:**
|
|
{recon_json}
|
|
|
|
**METHODOLOGY — a finding is a demonstrated end-to-end abuse THROUGH a plugin, not merely its presence:**
|
|
|
|
### 1. Enumerate plugins / tools
|
|
- List connected plugins, MCP servers, and their declared scopes/manifests (`.well-known/ai-plugin.json`, MCP `tools/list`, an in-app "connected apps" view).
|
|
- For each: transport (hosted URL vs. local MCP), auth model (OAuth scope, shared API key, none), and declared vs. actual permissions.
|
|
- Note versions/sources from any manifest or lockfile recon surfaced — pin points for the version→known-issue argument.
|
|
|
|
### 2. Assess trust boundaries
|
|
- Over-permissioning: a "read calendar" plugin that also holds write/email scope; a broad OAuth grant.
|
|
- Unsigned / unpinned / mutable source: plugin loaded from a URL that can change server-side, no integrity check.
|
|
- Auto-invocation: does the agent call the tool without user confirmation on model whim (indirect-prompt-injection reachable)?
|
|
- Confused deputy: the plugin acts with ITS credentials on behalf of whoever asks — so A can make it act on B's data.
|
|
|
|
### 3. Confirm — one concrete abuse path, end to end
|
|
- Pick the strongest gap and prove a real effect:
|
|
- Confused deputy: as low-priv user, get a plugin to read/return data or perform an action using its elevated creds → verify out-of-band (the data returned, the action landed).
|
|
- Indirect injection → auto-invoke: plant a benign trigger (in a doc/email/webpage the plugin ingests) that makes the tool fire; confirm it fired with a nonce.
|
|
- Over-scoped token: use the plugin to touch a resource outside its stated scope; show the response.
|
|
- Keep effects benign: marker record, attacker-owned inbox, OOB callback with a per-attempt nonce — never destructive.
|
|
|
|
### 4. False positives / pitfalls
|
|
- "This plugin exists and looks risky" is NOT a finding — you must demonstrate the abuse path.
|
|
- A confirmation prompt the user must approve before the sensitive action = mitigating control; note it and reduce severity.
|
|
- The model *saying* it used the plugin without a real tool call = hallucination; require the tool's own receipt.
|
|
|
|
### 5. Chaining hooks
|
|
- Confused-deputy read → cross-tenant PII / IDOR chain.
|
|
- Auto-invoked tool via injected content → stitches RAG-poisoning / prompt-injection into real actions.
|
|
- Over-scoped OAuth token → cloud / SaaS lateral movement.
|
|
|
|
### 6. Report Format
|
|
For each CONFIRMED finding:
|
|
```
|
|
FINDING:
|
|
- Title: LLM Plugin/MCP Supply-Chain Specialist at [endpoint]
|
|
- Severity: High
|
|
- CWE: CWE-829
|
|
- Endpoint: [full URL]
|
|
- Vector: [parameter/header/flow]
|
|
- Payload: [exact payload/command]
|
|
- Evidence: [proof of exploitation]
|
|
- Impact: Malicious or over-trusted plugin/tool compromises the agent and its data
|
|
- Remediation: Vet/sign plugins, scope permissions, sandbox tool execution, pin versions
|
|
```
|
|
|
|
## System Prompt
|
|
You are an LLM supply-chain specialist. Report only concrete, demonstrated abuse paths through a plugin/tool — verified out-of-band with a nonce — not the mere presence of plugins or a risky-looking manifest. Provide the end-to-end evidence. Keep every effect benign; note any user-confirmation control that mitigates the path.
|