Extend tachi detection coverage for GhostCommit primitives (encoded exfil, convention-file trust, committed-file dormancy)

[davidmatousek]

Idea

Extend tachi's detection-pattern coverage to model the three GhostCommit primitives it currently misses: scanner-evading encoded exfiltration, convention files as a trusted-instruction surface, and dormant payloads carried in statically-committed repo files. tachi already covers the multimodal-injection face of the attack well; these are the novel primitives with weak-to-absent ownership.

User Story

As a security engineer using tachi to threat-model an AI coding agent, I want tachi to flag encoded-secret exfiltration, convention-file instruction-poisoning, and dormant payloads committed to the repo, so that GhostCommit-class attacks appear in my threat model instead of slipping past as uncovered primitives.

Detail

Trigger: CSA "GhostCommit" disclosure (2026-07-11). Coverage mapping of tachi's detection-patterns.md skill files against the four GhostCommit sub-techniques found strong coverage of image-borne injection and gaps on the two most novel primitives.

What tachi covers today (no action needed):

• Image-borne / multimodal injection — COVERED. .claude/skills/tachi-prompt-injection/references/detection-patterns.md:106,133,142 explicitly names "image-based OCR payloads (text rendered as pixels)" and the image-carried-instruction variant. Fires when the architecture describes an LLM/agent Process that ingests images. Maps to OWASP LLM01:2025 + MITRE ATLAS AML.T0051/T0054.

Gaps to close:

• Gap 1 — Encoded-secret exfiltration to evade secret scanners (NOT COVERED — cleanest miss). No agent owns "encode a secret as an integer tuple / base64 / chunked-numeric on the way OUT to defeat a credential-shaped-string scanner." tachi's encoding-evasion patterns are input-side only (smuggling payloads in past a content filter — tachi-prompt-injection/.../detection-patterns.md:125), and info-disclosure treats secret scanners only as a mitigation (gitleaks/trufflehog, info-disclosure/.../detection-patterns.md:168), never as a control an attacker deliberately evades. Same vocabulary, opposite direction, different evaded control. Home: new pattern in tachi-info-disclosure (and/or tachi-tool-abuse).
• Gap 2 — Convention/config files as a trusted-instruction surface (PARTIAL). Generic indirect-injection covers RAG/retrieved content ("retrieved content … treated as trusted instructions", tachi-prompt-injection/.../detection-patterns.md:108,118) but never names AGENTS.md / CLAUDE.md / .cursorrules / .github/copilot-instructions.md / README as the specific trust-elevated surface GhostCommit abuses. An analyst must make that mapping themselves. Home: extend prompt-injection Pattern Category 7 (Indirect Injection via Poisoned External Sources).
• Gap 3 — Dormant payload in a statically-committed repo file (PARTIAL). The dormancy concept is well-developed (MAESTRO "Temporal Attacks" / sleeper agents, .claude/skills/tachi-shared/references/maestro-agentic-patterns-shared.md:60-74; data-poisoning backdoor triggers, tachi-data-poisoning/.../detection-patterns.md:94-96,116) but every instantiation binds it to a model-weights / agent-memory / MCP-tool substrate. A markdown/PNG/config file merged into version control and triggered in a later coding session is not a recognized dormancy substrate; it falls between the data-poisoning, agent-autonomy/MAESTRO, and tool-abuse categories. Home: extend the temporal/dormancy substrate list to include committed repo files.

Proposed Scope (acceptance criteria)

1. Add an encoded-exfiltration-to-evade-scanners detection pattern (integer-tuple / base64 / chunked-numeric secret encoding on egress) to tachi-info-disclosure (and cross-reference from tachi-tool-abuse), with OWASP + CWE mapping.
2. Name convention/config files (AGENTS.md, CLAUDE.md, .cursorrules, .github/copilot-instructions.md, README) as a trusted-instruction surface in prompt-injection Pattern Category 7.
3. Extend the temporal/dormancy substrate list to include statically-committed repo files (markdown / image / config) as a deferred-trigger carrier.
4. Add fixtures / tests for each new pattern and regenerate affected coverage baselines — mind the byte-identity suite + coverage-% pin ripple that framework/pattern changes have caused historically.
5. Cite the CSA GhostCommit disclosure and its MAESTRO mapping in the new pattern references (the paper name-checks MAESTRO as the correct lens — reinforces tachi's source-of-truth positioning).

ICE Score

Impact: 7, Confidence: 7, Effort: 6 = 20

Evidence

Team Observation: coverage mapping of tachi's detection-pattern skill files against the CSA GhostCommit attack class (independent Explore pass, file:line-grounded). Image-borne injection is covered; encoded-secret exfiltration has no owner, convention-file trust is only generically covered, and committed-file dormancy binds only to model/memory/MCP substrates.

Metadata

• Source: Brainstorm
• Priority: P1 (High)
• Date: 2026-07-13
• Status: Validated (PM: APPROVED_WITH_CONCERNS)

[davidmatousek]

PM Validation — APPROVED_WITH_CONCERNS (product-manager, 2026-07-13)

Rationale: Strong vision/scope fit — GhostCommit's cross-session dormant-payload + encoded-egress + convention-file-instruction primitives are exactly the logic-level, AI-reasoning threats tachi claims to catch where SAST cannot; the work extends the same detection-pattern-catalog surface as precedent F-292/F-260. Evidence is high quality and intellectually honest: it correctly credits what tachi already covers (multimodal/OCR injection) and names three verifiable gaps; cited files and the dormancy substrate binding were confirmed. ICE 20 (P1) is defensible. Natural BLP-07 coverage candidate.

Concerns to carry into spec (non-blocking):

1. Surface an explicit user-facing "so that" benefit when this becomes a story (now addressed in the User Story above).
2. Hold scope to pattern-catalog enrichment (no net-new agent); let the architect rule on encoded-exfil ownership placement in tachi-info-disclosure.
3. Preserve the honest "three primitives, not whole-class GhostCommit coverage" framing in docs to avoid overclaiming against the OWASP 50/50 positioning.