feat: add OWASP ASI gap-fill rules AGT-008 to AGT-011 (v1.9 agentic)

- AGT-008 (critical): ASI03 — agent calls assumeRole/grantAccess/setPermissions
  with LLM output value; privilege escalation via prompt injection
- AGT-009 (high): ASI04 — agent loads tool/plugin at runtime from variable path
  or dynamic import; supply chain substitution vector
- AGT-010 (high): ASI07 — raw agent output forwarded to another agent via
  send/route/dispatch without HMAC, JWT, or schema validation
- AGT-011 (high): ASI08 — agent plan step error silently swallowed in catch
  block; downstream steps proceed on incomplete or corrupted state

- 24 new tests (453 total), all passing
- Rule count: 91 → 95
- README: expand AGT section with ASI mapping

Author: IulianVOStrut

README.md

@@ -39,7 +39,7 @@ It fits into your existing workflow as a CLI command, an `npm` script, or a GitH
 
 | | |
 |---|---|
-| **91 security rules** | Across 14 categories: injection, exfiltration, jailbreak, unsafe tool use, command injection, RAG poisoning, encoding, output handling, multimodal, skills marketplace, agentic, MCP, supply chain, DoS |
+| **95 security rules** | Across 14 categories: injection, exfiltration, jailbreak, unsafe tool use, command injection, RAG poisoning, encoding, output handling, multimodal, skills marketplace, agentic, MCP, supply chain, DoS |
 | **Numeric risk score (0-100)** | Normalized repo-level score with low, medium, high and critical thresholds |
 | **Mitigation detection** | Explicit safety language in your prompts reduces your score |
 | **7 output formats** | Console, JSON, SARIF, GitHub Annotations, Markdown, JSONL streaming, and interactive HTML |
@@ -107,7 +107,7 @@ hound scan --format markdown --out report
 # Stream findings as JSONL (one JSON object per line)
 hound scan --format jsonl | jq '.severity'
 
-# List all 91 rules
+# List all 95 rules
 hound scan --list-rules
 
 # Interactive HTML report (self-contained, open in browser)
@@ -449,9 +449,9 @@ Targets OpenClaw `SKILL.md` files and any markdown files inside `skills/` direct
 
 > **Scanning OpenClaw skills:** Run `npx hound scan --dir ./skills` or add `**/skills/**/*.md` and `**/SKILL.md` to your `include` config. ContextHound automatically emits skill files as `code-block` for multi-line rule analysis.
 
-### K. Agentic (AGT) — v1.3
+### K. Agentic (AGT) — v1.3 / v1.9
 
-Targets risks specific to multi-step agentic systems: unbounded execution loops, unvalidated memory writes, user input leaking into agent planning, and inter-agent trust boundary violations.
+Targets risks specific to multi-step agentic systems: unbounded execution loops, unvalidated memory writes, user input leaking into agent planning, inter-agent trust boundary violations, and OWASP Agentic AI Security Issues (ASI) gaps.
 
 | ID | Severity | Description |
 |----|----------|-------------|
@@ -462,6 +462,10 @@ Targets risks specific to multi-step agentic systems: unbounded execution loops,
 | AGT-005 | Critical | Agent trusts claimed identity without cryptographic verification — trust decision based on `agentId`, `sender`, `source`, or `from_agent` field without HMAC, JWT, or shared-secret verification |
 | AGT-006 | High | Raw agent output chained as input to another agent without validation — `.run()`, `.invoke()`, or `.generate()` called with another agent's `.output`/`.content`/`.result` directly as the argument |
 | AGT-007 | Critical | Agent self-modification — agent rewrites its own `system_prompt`, `instructions`, or `tools` list with LLM-generated content at runtime |
+| AGT-008 | Critical | ASI03 — Agent calls `assumeRole`, `grantAccess`, or `setPermissions` with a value derived from LLM output; privilege escalation via prompt injection |
+| AGT-009 | High | ASI04 — Agent loads a tool or plugin at runtime from a variable path or dynamic import, enabling supply chain substitution |
+| AGT-010 | High | ASI07 — Raw agent output forwarded to another agent via `send`/`route`/`dispatch` without HMAC, JWT signing, or schema validation |
+| AGT-011 | High | ASI08 — Agent plan step error caught silently (no rethrow, no error-state flag); downstream steps proceed on bad or incomplete state |
 
 ### L. MCP Security (MCP) — v1.7 / v1.8
 

src/rules/agentic.ts

@@ -171,4 +171,101 @@ export const agenticRules: Rule[] = [
       return results;
     },
   },
+  {
+    id: 'AGT-008',
+    title: 'Agent assumes IAM role or grants permissions based on LLM output (ASI03)',
+    severity: 'critical',
+    confidence: 'medium',
+    category: 'agentic',
+    remediation:
+      'Never call IAM, RBAC, or credential-assignment functions with values derived from LLM output. A prompt injection or jailbreak can escalate the agent\'s own privileges by inducing it to call assumeRole, grantAccess, or setPermissions with an attacker-chosen role ARN or permission set. Resolve permitted roles from a static allowlist in your application code, never from model responses.',
+    check(prompt: ExtractedPrompt): RuleMatch[] {
+      if (prompt.kind !== 'code-block') return [];
+
+      const results: RuleMatch[] = [];
+      const lines = prompt.text.split('\n');
+
+      const iamPattern =
+        /(?:assumeRole|putRolePolicy|attachRolePolicy|createRole|grantAccess|setPermissions?|addPermissions?|elevatePrivilege|setCredentials?|assignRole)\s*[.(]/i;
+      const llmOutputPattern =
+        /\b(?:response|output|result|completion|llm_?output|model_?output|answer|generated|content|choices)\b/i;
+
+      lines.forEach((line, i) => {
+        if (iamPattern.test(line) && llmOutputPattern.test(line)) {
+          results.push({
+            evidence: line.trim(),
+            lineStart: prompt.lineStart + i,
+            lineEnd: prompt.lineStart + i,
+          });
+        }
+      });
+
+      return results;
+    },
+  },
+  {
+    id: 'AGT-009',
+    title: 'Agent loads tool or plugin from variable path or external URL at runtime (ASI04)',
+    severity: 'high',
+    confidence: 'medium',
+    category: 'agentic',
+    remediation:
+      'Never load tools, plugins, or modules at runtime from user-controlled values, LLM-generated paths, or dynamic imports without an explicit allowlist. An attacker who can influence the loaded path or URL can substitute a malicious binary or script for a legitimate tool. Resolve tool implementations from a trusted, static registry at startup.',
+    check(prompt: ExtractedPrompt): RuleMatch[] {
+      if (prompt.kind !== 'code-block') return [];
+
+      // Detect: agent.loadTool/addTool/loadPlugin(variable) or dynamic import(variableNamedWithTool/Plugin/Url)
+      const pattern =
+        /(?:agent|executor|planner|runner)\s*\.(?:loadTool|addTool|registerTool|loadPlugin|importTool)\s*\(\s*(?!['"`])[a-z_$]|(?:await\s+)?import\s*\(\s*[a-z_$][a-z0-9_$.]*(?:Url|Path|Plugin|Tool|Module)\b/i;
+      return matchPattern(prompt, pattern);
+    },
+  },
+  {
+    id: 'AGT-010',
+    title: 'Raw agent output forwarded to another agent without trust boundary validation (ASI07)',
+    severity: 'high',
+    confidence: 'medium',
+    category: 'agentic',
+    remediation:
+      'Never pass one agent\'s raw output directly as the instruction payload to another agent or message bus without signing or schema validation. In multi-agent pipelines, a compromised upstream agent can inject instructions into every downstream agent that receives its output. Validate, sanitise, and schema-check inter-agent messages at each hop.',
+    check(prompt: ExtractedPrompt): RuleMatch[] {
+      if (prompt.kind !== 'code-block') return [];
+      const text = prompt.text;
+
+      // Suppress if message signing / cryptographic verification is present
+      const signingGuard = /hmac|sign(?:ature)?|jwt|verify|bearer\s+token|shared.?secret/i;
+      if (signingGuard.test(text)) return [];
+
+      // Detect: agent/broker send/forward/route/dispatch called with another agent's output
+      const pattern =
+        /(?:agent|broker|orchestrator|router|hub|bus)\w*\s*\.(?:send|forward|route|dispatch|relay|publish|invoke|call|run)\s*\(\s*(?:await\s+)?\w+\.(?:output|result|message|response|content|lastMessage|text)\b/i;
+      return matchPattern(prompt, pattern);
+    },
+  },
+  {
+    id: 'AGT-011',
+    title: 'Agent step error silently swallowed — downstream steps proceed on bad state (ASI08)',
+    severity: 'high',
+    confidence: 'medium',
+    category: 'agentic',
+    remediation:
+      'Never swallow exceptions from agent plan steps without halting or flagging the run. Silently catching errors allows subsequent steps to execute against incomplete or corrupted state, which can compound failures or be exploited to skip safety checks. Re-throw, reject the promise, or set an explicit error/aborted state that downstream steps check before proceeding.',
+    check(prompt: ExtractedPrompt): RuleMatch[] {
+      if (prompt.kind !== 'code-block') return [];
+      const text = prompt.text;
+
+      // Only fire in agent step/plan execution context
+      if (!/agent\.(?:run|execute|invoke|step)\s*\(|executeStep\b|runPlan\b|AgentExecutor\b|planStep\b|chain\.(?:run|invoke|call)\s*\(/i.test(text)) return [];
+
+      // Must have a try/catch to be relevant
+      if (!/try\s*\{/.test(text)) return [];
+
+      // Suppress if errors are properly propagated or the run is aborted
+      if (/\bthrow\b|\breject\s*\(|\berrorState\b|\berror\s*=\s*(?!null|false)|failed\s*=\s*true|status\s*=\s*['"`](?:error|fail|abort)/i.test(text)) return [];
+
+      // Flag the catch line as evidence
+      const pattern = /\bcatch\s*\([^)]*\)\s*\{/i;
+      return matchPattern(prompt, pattern);
+    },
+  },
 ];

tests/rules.test.ts

@@ -2532,3 +2532,181 @@ describe('AGT-007: Agent modifies its own system prompt, instructions, or tool l
     expect(rule.check(makePrompt(code, 1, 'raw'), 'agent.py')).toHaveLength(0);
   });
 });
+
+// ── AGT-008–011 ───────────────────────────────────────────────────────────────
+
+describe('AGT-008: Agent assumes IAM role from LLM output (ASI03)', () => {
+  const rule = agenticRules.find(r => r.id === 'AGT-008')!;
+
+  it('flags assumeRole called with LLM result', () => {
+    const code = [
+      'const result = await llm.complete(prompt);',
+      'await iam.assumeRole({ RoleArn: result.content });',
+    ].join('\n');
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'agent.ts')).toHaveLength(1);
+  });
+
+  it('flags grantAccess called with response value', () => {
+    const code = 'grantAccess(response.role);';
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'agent.ts')).toHaveLength(1);
+  });
+
+  it('flags setPermissions called with LLM output', () => {
+    const code = 'agent.setPermissions(output.permissions);';
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'agent.ts')).toHaveLength(1);
+  });
+
+  it('does not flag assumeRole with a static string ARN', () => {
+    const code = 'await iam.assumeRole({ RoleArn: "arn:aws:iam::123456789012:role/MyRole" });';
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'agent.ts')).toHaveLength(0);
+  });
+
+  it('does not flag grantAccess without LLM output variable', () => {
+    const code = 'grantAccess(config.defaultRole);';
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'agent.ts')).toHaveLength(0);
+  });
+
+  it('does not fire on raw kind', () => {
+    const code = 'iam.assumeRole(result.role)';
+    expect(rule.check(makePrompt(code, 1, 'raw'), 'agent.ts')).toHaveLength(0);
+  });
+});
+
+describe('AGT-009: Agent loads tool from variable path at runtime (ASI04)', () => {
+  const rule = agenticRules.find(r => r.id === 'AGT-009')!;
+
+  it('flags agent.loadTool with a variable argument', () => {
+    const code = 'agent.loadTool(userConfig.toolPath);';
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'agent.ts')).toHaveLength(1);
+  });
+
+  it('flags agent.addTool with a variable argument', () => {
+    const code = 'executor.addTool(dynamicTool);';
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'agent.ts')).toHaveLength(1);
+  });
+
+  it('flags dynamic import with variable named pluginUrl', () => {
+    const code = 'const plugin = await import(pluginUrl);';
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'agent.ts')).toHaveLength(1);
+  });
+
+  it('flags dynamic import with variable named toolModule', () => {
+    const code = 'const t = await import(toolModule);';
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'agent.ts')).toHaveLength(1);
+  });
+
+  it('does not flag agent.addTool with a string literal', () => {
+    const code = 'agent.addTool("search");';
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'agent.ts')).toHaveLength(0);
+  });
+
+  it('does not fire on raw kind', () => {
+    const code = 'agent.loadTool(pluginUrl)';
+    expect(rule.check(makePrompt(code, 1, 'raw'), 'agent.ts')).toHaveLength(0);
+  });
+});
+
+describe('AGT-010: Raw agent output forwarded to another agent without trust validation (ASI07)', () => {
+  const rule = agenticRules.find(r => r.id === 'AGT-010')!;
+
+  it('flags broker.send with agent output', () => {
+    const code = 'broker.send(agentA.output);';
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'pipeline.ts')).toHaveLength(1);
+  });
+
+  it('flags router.forward with agent result', () => {
+    const code = 'router.forward(upstreamAgent.result);';
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'pipeline.ts')).toHaveLength(1);
+  });
+
+  it('flags orchestrator.dispatch with agent message', () => {
+    const code = 'orchestrator.dispatch(agentOne.message);';
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'pipeline.ts')).toHaveLength(1);
+  });
+
+  it('does not flag when HMAC signing is present', () => {
+    const code = [
+      'const sig = hmac(agentA.output, secret);',
+      'broker.send(agentA.output);',
+    ].join('\n');
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'pipeline.ts')).toHaveLength(0);
+  });
+
+  it('does not flag when JWT verification is present', () => {
+    const code = [
+      'const verified = jwt.verify(token, secret);',
+      'router.forward(agentA.result);',
+    ].join('\n');
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'pipeline.ts')).toHaveLength(0);
+  });
+
+  it('does not fire on raw kind', () => {
+    const code = 'broker.send(agentA.output)';
+    expect(rule.check(makePrompt(code, 1, 'raw'), 'pipeline.ts')).toHaveLength(0);
+  });
+});
+
+describe('AGT-011: Agent step error silently swallowed (ASI08)', () => {
+  const rule = agenticRules.find(r => r.id === 'AGT-011')!;
+
+  it('flags empty catch in agent.run context', () => {
+    const code = [
+      'try {',
+      '  await agent.run(plan);',
+      '} catch (e) {',
+      '  console.log(e);',
+      '}',
+      'continueWithNextStep();',
+    ].join('\n');
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'runner.ts')).toHaveLength(1);
+  });
+
+  it('flags swallowed catch in AgentExecutor context', () => {
+    const code = [
+      'try {',
+      '  result = await AgentExecutor.invoke(input);',
+      '} catch (err) {',
+      '  console.error(err);',
+      '}',
+    ].join('\n');
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'runner.ts')).toHaveLength(1);
+  });
+
+  it('does not flag when error is re-thrown', () => {
+    const code = [
+      'try {',
+      '  await agent.run(plan);',
+      '} catch (e) {',
+      '  throw e;',
+      '}',
+    ].join('\n');
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'runner.ts')).toHaveLength(0);
+  });
+
+  it('does not flag when error state is set', () => {
+    const code = [
+      'try {',
+      '  await executeStep(step);',
+      '} catch (e) {',
+      '  failed = true;',
+      '}',
+    ].join('\n');
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'runner.ts')).toHaveLength(0);
+  });
+
+  it('does not fire without agent execution context', () => {
+    const code = [
+      'try {',
+      '  await fetchData();',
+      '} catch (e) {',
+      '  console.log(e);',
+      '}',
+    ].join('\n');
+    expect(rule.check(makePrompt(code, 1, 'code-block'), 'runner.ts')).toHaveLength(0);
+  });
+
+  it('does not fire on raw kind', () => {
+    const code = 'try { agent.run(plan); } catch(e) {}';
+    expect(rule.check(makePrompt(code, 1, 'raw'), 'runner.ts')).toHaveLength(0);
+  });
+});