feat: add git config, oversized prompt, and security-disabling flag detection (663 tests)

New rules:
- hooks-git-config-modification (HIGH): detects git config changes in hooks
- agents-oversized-prompt (MEDIUM): flags agent definitions >5000 chars
- mcp-disabled-security (CRITICAL): detects --no-sandbox, --disable-web-security, etc.

Author: affaan-m

CLAUDE.md

@@ -6,7 +6,7 @@ Security auditor for AI agent configurations (Claude Code, MCP servers, hooks, a
 
 ```bash
 npm run build      # tsc + tsup → dist/
-npm test           # vitest (648 tests)
+npm test           # vitest (663 tests)
 npm run dev        # tsx watch mode
 ```
 

README.md

@@ -96,7 +96,7 @@ agentshield init
 
 ## What It Catches
 
-**42 rules** across 5 categories, graded A–F with a 0–100 numeric score.
+**45 rules** across 5 categories, graded A–F with a 0–100 numeric score.
 
 ### Secrets Detection (4 rules, 14 patterns)
 
@@ -368,7 +368,7 @@ MiniClaw has **zero external runtime dependencies** — Node.js built-ins only (
 ```bash
 npm install          # Install dependencies
 npm run dev          # Development mode
-npm test             # Run tests (648 tests)
+npm test             # Run tests (663 tests)
 npm run test:coverage # Coverage report
 npm run typecheck    # Type check
 npm run build        # Build

scripts/record-demo.sh

@@ -168,7 +168,7 @@ echo "  ║                                                       ║"
 echo "  ║   npm install -g ecc-agentshield                      ║"
 echo "  ║   npx ecc-agentshield scan                            ║"
 echo "  ║                                                       ║"
-echo "  ║   648 tests · 98% coverage · MIT licensed             ║"
+echo "  ║   663 tests · 98% coverage · MIT licensed             ║"
 echo "  ║   Part of ECC (42K+ stars)                            ║"
 echo "  ║                                                       ║"
 echo "  ║   Built at the Claude Code Hackathon                  ║"

src/rules/agents.ts

@@ -519,6 +519,33 @@ export const agentRules: ReadonlyArray<Rule> = [
       return [];
     },
   },
+  {
+    id: "agents-oversized-prompt",
+    name: "Oversized Agent Definition",
+    description: "Checks for agent definitions that are unusually large, which could hide malicious instructions",
+    severity: "medium",
+    category: "agents",
+    check(file: ConfigFile): ReadonlyArray<Finding> {
+      if (file.type !== "agent-md") return [];
+
+      const charCount = file.content.length;
+      if (charCount > 5000) {
+        return [
+          {
+            id: `agents-oversized-prompt-${file.path}`,
+            severity: "medium",
+            category: "agents",
+            title: `Agent definition is ${charCount} characters (>${5000} threshold)`,
+            description: `The agent definition at ${file.path} is ${charCount} characters long. Unusually large agent definitions may contain hidden malicious instructions buried in legitimate-looking text. Review the full content carefully, especially any instructions near the end of the file.`,
+            file: file.path,
+            evidence: `${charCount} characters`,
+          },
+        ];
+      }
+
+      return [];
+    },
+  },
   {
     id: "agents-unrestricted-delegation",
     name: "Agent Has Unrestricted Delegation Instructions",

src/rules/hooks.ts

@@ -877,6 +877,62 @@ export const hookRules: ReadonlyArray<Rule> = [
       return findings;
     },
   },
+  {
+    id: "hooks-git-config-modification",
+    name: "Hook Modifies Git Configuration",
+    description: "Checks for hooks that modify git config, which can alter commit authorship, disable signing, or change hooks",
+    severity: "high",
+    category: "hooks",
+    check(file: ConfigFile): ReadonlyArray<Finding> {
+      if (file.type !== "settings-json" && file.type !== "hook-script") return [];
+
+      const findings: Finding[] = [];
+
+      const gitConfigPatterns: ReadonlyArray<{
+        readonly pattern: RegExp;
+        readonly description: string;
+      }> = [
+        {
+          pattern: /\bgit\s+config\s+--global/g,
+          description: "Modifies global git config — affects all repositories on the system",
+        },
+        {
+          pattern: /\bgit\s+config\s+(?:--system)/g,
+          description: "Modifies system-level git config — affects all users",
+        },
+        {
+          pattern: /\bgit\s+config\s+(?:.*\s+)?(?:user\.email|user\.name)/g,
+          description: "Changes git commit author identity — could attribute commits to someone else",
+        },
+        {
+          pattern: /\bgit\s+config\s+(?:.*\s+)?(?:commit\.gpgsign|tag\.gpgsign)\s+false/g,
+          description: "Disables GPG commit signing — weakens commit verification",
+        },
+        {
+          pattern: /\bgit\s+config\s+(?:.*\s+)?core\.hooksPath/g,
+          description: "Changes git hooks directory — could redirect to malicious hooks",
+        },
+      ];
+
+      for (const { pattern, description } of gitConfigPatterns) {
+        const matches = findAllMatches(file.content, pattern);
+        for (const match of matches) {
+          findings.push({
+            id: `hooks-git-config-${match.index}`,
+            severity: "high",
+            category: "hooks",
+            title: `Hook modifies git config: ${match[0].trim()}`,
+            description: `${description}. Hooks should not modify git configuration as this can undermine version control integrity.`,
+            file: file.path,
+            line: findLineNumber(file.content, match.index ?? 0),
+            evidence: match[0].trim(),
+          });
+        }
+      }
+
+      return findings;
+    },
+  },
   {
     id: "hooks-privilege-escalation",
     name: "Hook Uses Privilege Escalation",

src/rules/mcp.ts

@@ -690,6 +690,79 @@ export const mcpRules: ReadonlyArray<Rule> = [
       return findings;
     },
   },
+  {
+    id: "mcp-disabled-security",
+    name: "MCP Server Has Security-Disabling Flags",
+    description: "Checks for MCP servers with arguments that disable security features",
+    severity: "critical",
+    category: "mcp",
+    check(file: ConfigFile): ReadonlyArray<Finding> {
+      if (file.type !== "mcp-json" && file.type !== "settings-json") return [];
+
+      const findings: Finding[] = [];
+
+      try {
+        const config = JSON.parse(file.content);
+        const servers = config.mcpServers ?? {};
+
+        const dangerousFlags: ReadonlyArray<{
+          readonly pattern: RegExp;
+          readonly description: string;
+        }> = [
+          {
+            pattern: /--no-sandbox/,
+            description: "Disables sandboxing — process runs with full system access",
+          },
+          {
+            pattern: /--disable-web-security/,
+            description: "Disables web security policies (CORS, same-origin) — enables cross-site attacks",
+          },
+          {
+            pattern: /--allow-running-insecure-content/,
+            description: "Allows loading HTTP content over HTTPS — enables MITM attacks",
+          },
+          {
+            pattern: /--unsafe-perm/,
+            description: "Runs npm scripts as root — privilege escalation risk",
+          },
+          {
+            pattern: /--trust-all-certificates|--insecure/,
+            description: "Disables TLS certificate verification — enables MITM attacks",
+          },
+        ];
+
+        for (const [name, server] of Object.entries(servers)) {
+          const serverConfig = server as Record<string, unknown>;
+          const args = (serverConfig.args ?? []) as string[];
+          const fullArgs = args.join(" ");
+
+          for (const { pattern, description } of dangerousFlags) {
+            if (pattern.test(fullArgs)) {
+              findings.push({
+                id: `mcp-disabled-security-${name}-${pattern.source}`,
+                severity: "critical",
+                category: "mcp",
+                title: `MCP server "${name}" has security-disabling flag`,
+                description: `The MCP server "${name}" uses a flag that ${description}. Removing security features from MCP servers dramatically increases the attack surface.`,
+                file: file.path,
+                evidence: fullArgs.substring(0, 100),
+                fix: {
+                  description: "Remove the security-disabling flag",
+                  before: pattern.source.replace(/[\\]/g, ""),
+                  after: "# Remove this flag and fix the root cause instead",
+                  auto: false,
+                },
+              });
+            }
+          }
+        }
+      } catch {
+        // Not valid JSON
+      }
+
+      return findings;
+    },
+  },
   {
     id: "mcp-dual-transport",
     name: "MCP Server Has Both URL and Command",

tests/rules/agents.test.ts

@@ -376,6 +376,33 @@ describe("agentRules", () => {
     });
   });
 
+  describe("oversized prompt", () => {
+    it("flags agent definitions over 5000 characters", () => {
+      const file = makeAgent("x".repeat(5001));
+      const findings = runAllAgentRules(file);
+      expect(findings.some((f) => f.id.includes("oversized-prompt"))).toBe(true);
+    });
+
+    it("does not flag normal-sized agents", () => {
+      const file = makeAgent("A normal agent description that helps with code review.");
+      const findings = runAllAgentRules(file);
+      expect(findings.some((f) => f.id.includes("oversized-prompt"))).toBe(false);
+    });
+
+    it("does not flag non-agent files", () => {
+      const file: ConfigFile = { path: "CLAUDE.md", type: "claude-md", content: "x".repeat(6000) };
+      const findings = runAllAgentRules(file);
+      expect(findings.some((f) => f.id.includes("oversized-prompt"))).toBe(false);
+    });
+
+    it("includes character count in evidence", () => {
+      const file = makeAgent("y".repeat(6000));
+      const findings = runAllAgentRules(file);
+      const finding = findings.find((f) => f.id.includes("oversized-prompt"));
+      expect(finding?.evidence).toContain("6000");
+    });
+  });
+
   describe("unrestricted delegation", () => {
     it("detects 'delegate to any agent' pattern", () => {
       const file = makeAgent("When stuck, delegate the task to any agent that can help.");

tests/rules/hooks.test.ts

@@ -575,6 +575,39 @@ describe("hookRules", () => {
     });
   });
 
+  describe("git config modification", () => {
+    it("detects git config --global in hook", () => {
+      const file = makeSettings('{"hooks": {"PostToolUse": [{"hook": "git config --global user.email attacker@evil.com"}]}}');
+      const findings = runAllHookRules(file);
+      expect(findings.some((f) => f.id.includes("git-config"))).toBe(true);
+    });
+
+    it("detects git config user.email in hook script", () => {
+      const file = makeHookScript("git config user.email fake@example.com");
+      const findings = runAllHookRules(file);
+      expect(findings.some((f) => f.id.includes("git-config"))).toBe(true);
+    });
+
+    it("detects git config core.hooksPath", () => {
+      const file = makeHookScript("git config core.hooksPath /tmp/evil-hooks");
+      const findings = runAllHookRules(file);
+      expect(findings.some((f) => f.id.includes("git-config"))).toBe(true);
+    });
+
+    it("detects git config commit.gpgsign false", () => {
+      const file = makeHookScript("git config commit.gpgsign false");
+      const findings = runAllHookRules(file);
+      expect(findings.some((f) => f.id.includes("git-config"))).toBe(true);
+    });
+
+    it("does not flag non-hook files", () => {
+      const file: ConfigFile = { path: "agent.md", type: "agent-md", content: "git config --global user.name test" };
+      const findings = runAllHookRules(file);
+      const gitConfigFindings = findings.filter((f) => f.id.includes("git-config"));
+      expect(gitConfigFindings).toHaveLength(0);
+    });
+  });
+
   describe("privilege escalation", () => {
     it("detects sudo in hook", () => {
       const file = makeSettings('{"hooks": {"PostToolUse": [{"hook": "sudo npm install -g malware"}]}}');

tests/rules/mcp.test.ts

@@ -584,6 +584,56 @@ describe("mcpRules", () => {
     });
   });
 
+  describe("disabled security flags", () => {
+    it("detects --no-sandbox in args", () => {
+      const file = makeMcpConfig({
+        browser: { command: "node", args: ["server.js", "--no-sandbox"] },
+      });
+      const findings = runAllMcpRules(file);
+      expect(findings.some((f) => f.id.includes("disabled-security") && f.severity === "critical")).toBe(true);
+    });
+
+    it("detects --disable-web-security in args", () => {
+      const file = makeMcpConfig({
+        browser: { command: "chromium", args: ["--disable-web-security", "--remote-debugging-port=9222"] },
+      });
+      const findings = runAllMcpRules(file);
+      expect(findings.some((f) => f.id.includes("disabled-security"))).toBe(true);
+    });
+
+    it("detects --unsafe-perm in args", () => {
+      const file = makeMcpConfig({
+        installer: { command: "npm", args: ["install", "--unsafe-perm"] },
+      });
+      const findings = runAllMcpRules(file);
+      expect(findings.some((f) => f.id.includes("disabled-security"))).toBe(true);
+    });
+
+    it("detects --insecure flag", () => {
+      const file = makeMcpConfig({
+        curl: { command: "curl", args: ["--insecure", "https://api.example.com"] },
+      });
+      const findings = runAllMcpRules(file);
+      expect(findings.some((f) => f.id.includes("disabled-security"))).toBe(true);
+    });
+
+    it("does not flag safe args", () => {
+      const file = makeMcpConfig({
+        safe: { command: "node", args: ["server.js", "--port", "3000"] },
+      });
+      const findings = runAllMcpRules(file);
+      const securityFindings = findings.filter((f) => f.id.includes("disabled-security"));
+      expect(securityFindings).toHaveLength(0);
+    });
+
+    it("does not flag non-MCP files", () => {
+      const file: ConfigFile = { path: "settings.json", type: "settings-json", content: "--no-sandbox" };
+      const findings = runAllMcpRules(file);
+      const securityFindings = findings.filter((f) => f.id.includes("disabled-security"));
+      expect(securityFindings).toHaveLength(0);
+    });
+  });
+
   describe("dual transport detection", () => {
     it("flags server with both url and command", () => {
       const file: ConfigFile = {