Spaces:
Paused
Paused
File size: 3,332 Bytes
7d4338a | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 | {
"ratings": {
"pass": { "icon": "🟢", "label": "Pass" },
"warning": { "icon": "🟡", "label": "Warning" },
"fail": { "icon": "🔴", "label": "Fail" }
},
"checks": {
"structure": {
"label": "Structure & Purpose Match",
"detail": "Verify that the files/folders present match what the plugin claims to do.\nCheck for code that accesses files or data unrelated to the plugin's stated functionality.",
"criteria": {
"pass": "All components align with declared purpose",
"warning": "Minor extras exist but appear benign",
"fail": "Components clearly unrelated to purpose (e.g. UI plugin with backend secret access)"
}
},
"codeReview": {
"label": "Static Code Review",
"detail": "Look for vulnerabilities — SQL injection, path traversal, unsafe deserialization,\neval/exec, shell injection, hardcoded credentials, insecure file permissions.\nFlag execution of concatenated strings, dynamic commands, or remote code fetched at runtime.",
"criteria": {
"pass": "No unsafe patterns found",
"warning": "Potentially unsafe patterns that may be justified",
"fail": "Clear vulnerability or exploit vector"
}
},
"agentManipulation": {
"label": "Agent Manipulation Detection",
"detail": "Search for prompt injection in comments/strings/filenames, instructions telling\nagents to ignore security, social engineering text, hidden instructions in base64, zero-width\ncharacters, Unicode tricks.",
"criteria": {
"pass": "No manipulation attempts found",
"warning": "Ambiguous text that could be coincidental",
"fail": "Deliberate prompt injection or agent manipulation"
}
},
"remoteComms": {
"label": "Remote Communication",
"detail": "Identify ANY code that communicates with external servers — HTTP requests, fetch,\nWebSocket, DNS lookups, subprocess calls to curl/wget, etc.",
"criteria": {
"pass": "No network calls whatsoever",
"warning": "Network calls exist but endpoints appear legitimate for the plugin's purpose",
"fail": "Undisclosed, suspicious, or data-exfiltration endpoints"
}
},
"secrets": {
"label": "Secrets & Sensitive Data Access",
"detail": "Check if code accesses environment variables, .env files, API keys, tokens,\ncredentials, cookies, session data, or sensitive system files.",
"criteria": {
"pass": "No access to any secrets or sensitive data",
"warning": "Accesses secrets but justified by plugin's stated purpose",
"fail": "Accesses secrets unrelated to purpose or handles them unsafely"
}
},
"obfuscation": {
"label": "Obfuscation & Hidden Code",
"detail": "Look for obfuscated code — minified source with no build step, encoded payloads\n(base64, hex, rot13), string concatenation building names at runtime, dynamic imports from\ncomputed paths, eval of constructed strings, suspiciously long single-line expressions.",
"criteria": {
"pass": "All code is readable and straightforward",
"warning": "Minor minification or encoding with clear purpose",
"fail": "Deliberate obfuscation or hidden payloads"
}
}
}
}
|