fix(rules): detect current ngrok tunnel domains and add bore.pub/serveo.net/localtunnel.me by federicoroncallo-hub · Pull Request #132 · cisco-ai-defense/skill-scanner

federicoroncallo-hub · 2026-07-02T13:24:00Z

Summary

The suspicious-domain lists and tunnel-service YARA rules only recognized the legacy ngrok.io host and a couple of others. Modern ngrok deployments use ngrok-free.dev, ngrok-free.app, and ngrok.app, and several other tunnel/reverse-proxy services (bore.pub, serveo.net, localtunnel.me) were not covered at all — so a skill exfiltrating data through those endpoints would go undetected.

This PR expands the tunnel/proxy coverage consistently across all the places these hosts are matched:

core/static_analysis/context_extractor.py — SUSPICIOUS_DOMAINS
core/analyzers/cross_skill_scanner.py — EXFIL_PATTERNS
data/packs/core/yara/tool_chaining_abuse_generic.yara — $exfil_requestbin
data/packs/core/yara/command_injection_generic.yara — $data_exfiltration_known_dest

Test plan

New regression tests in tests/static_analysis/test_suspicious_url_domains.py assert the new tunnel hosts are flagged and legitimate API hosts are not.
New parametrized YARA true-positive tests in tests/test_yara_true_positives.py.
uv run pytest tests/ passes.
uv run pre-commit run --all-files passes.
uv run python evals/runners/benchmark_runner.py — 100% precision/recall, no regression.

Made with Cursor

Summary by CodeRabbit

Bug Fixes
- Improved detection of suspicious tunneling and relay domains, including newer variants and additional public relay services.
- Expanded identification of data-exfiltration patterns in command and tool-chaining activity.
- Reduced missed detections for modern tunnel and proxy destinations while preserving legitimate URL handling.
Tests
- Added regression and true-positive coverage for current tunnel domains and accurate URL classification.

…et/localtunnel.me ngrok migrated off ngrok.io to ngrok-free.dev / ngrok.app, so exfil to a current ngrok endpoint slipped past the suspicious-domain checks. Add the modern ngrok domains plus bore.pub, serveo.net and localtunnel.me to: - ContextExtractor.SUSPICIOUS_DOMAINS (Python string-literal URL classification) - tool_chaining_abuse_generic.yara / command_injection_generic.yara exfil dests - cross_skill_scanner exfil pattern list Add regression tests for the new domains (YARA true-positives + ContextExtractor). Co-authored-by: Cursor <cursoragent@cursor.com>

coderabbitai · 2026-07-02T13:24:24Z

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: dcfec32b-2df1-4676-90be-9391a974f43d

📥 Commits

Reviewing files that changed from the base of the PR and between ecc0720 and 9fabcfe.

📒 Files selected for processing (2)

skill_scanner/core/static_analysis/context_extractor.py
tests/static_analysis/test_suspicious_url_domains.py

📝 Walkthrough

Walkthrough

This PR expands tunnel and exfiltration detection. It adds normalized URL hostname matching, new suspicious tunnel domains, broader CrossSkillScanner and YARA patterns, and regression tests for tunnel and curl-based exfiltration cases.

Changes

Tunnel domain detection expansion

Layer / File(s)	Summary
Normalized suspicious URL matching `skill_scanner/core/static_analysis/context_extractor.py`, `tests/static_analysis/test_suspicious_url_domains.py`	`ContextExtractor` now parses and normalizes URL hostnames, supports subdomain matching, validates HTTP(S) schemes, and identifies additional tunneling domains. Tests cover suspicious hosts, legitimate URLs, path-domain masking, uppercase schemes, and invalid schemes.
Cross-analyzer and YARA detection updates `skill_scanner/core/analyzers/cross_skill_scanner.py`, `skill_scanner/data/packs/core/yara/*.yara`	CrossSkillScanner and YARA patterns now include additional ngrok, `bore.pub`, `serveo.net`, and `localtunnel` destinations.
YARA true-positive coverage `tests/test_yara_true_positives.py`	Parametrized tests verify detection of current tunnel domains in content and curl exfiltration commands.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Possibly related PRs

cisco-ai-defense/skill-scanner#134: Expands the same tunnel-domain detection patterns and related test coverage.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: detection of current ngrok tunnel domains and additional relay services.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

Create PR with unit tests

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🧹 Nitpick comments (1)

tests/test_yara_true_positives.py (1)
182-182: 📐 Maintainability & Code Quality | 🔵 Trivial | 💤 Low value

Duplicate tunnel-host lists across two parametrized tests.

Both lists overlap almost entirely and could drift if new hosts are added to one but not the other. Consider extracting a shared TUNNEL_HOSTS constant.

Also applies to: 235-235
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/test_yara_true_positives.py` at line 182, The parametrized tunnel-host
values are duplicated across the true-positive tests and can drift over time.
Extract the shared host list into a single constant such as TUNNEL_HOSTS, then
reuse it in both parametrized tests that reference the overlap so there is one
source of truth.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@skill_scanner/core/static_analysis/context_extractor.py`:
- Around line 188-196: The tunnel-domain detection in context_extractor.py is
shadowed by the broad legitimate-domain substring check, so localhost.run can
never reach the suspicious-domain branch. Update the logic around the domain
matching in the extractor method to avoid raw substring containment for
LEGITIMATE_DOMAINS and suspicious domains, using exact or suffix-based host
matching instead. Make sure the check order and matching rules in the relevant
domain-scanning function still allow localhost.run and similar tunnel hosts to
be classified as suspicious.

---

Nitpick comments:
In `@tests/test_yara_true_positives.py`:
- Line 182: The parametrized tunnel-host values are duplicated across the
true-positive tests and can drift over time. Extract the shared host list into a
single constant such as TUNNEL_HOSTS, then reuse it in both parametrized tests
that reference the overlap so there is one source of truth.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 31fbda83-1376-4440-b03b-ff1a64dffa86

📥 Commits

Reviewing files that changed from the base of the PR and between 41fec4a and 3051348.

📒 Files selected for processing (6)

skill_scanner/core/analyzers/cross_skill_scanner.py
skill_scanner/core/static_analysis/context_extractor.py
skill_scanner/data/packs/core/yara/command_injection_generic.yara
skill_scanner/data/packs/core/yara/tool_chaining_abuse_generic.yara
tests/static_analysis/test_suspicious_url_domains.py
tests/test_yara_true_positives.py

ProviderConfig.validate() required a truthy credential for every provider except Bedrock and Ollama, and the only credential source it checked for Vertex was GOOGLE_APPLICATION_CREDENTIALS. This blocked ambient auth via a GCE/Cloud Run attached service account or Workload Identity, even though LiteLLM/google-auth already fall back to it automatically when no explicit credential is passed -- the same pattern already supported for Bedrock's IAM role. Excludes is_vertex from the check, mirroring the Bedrock/Ollama precedent, and documents the fallback.

codecov-commenter · 2026-07-24T21:32:07Z

⚠️ Please install the to ensure uploads and comments are reliably processed by Codecov.

Codecov Report

❌ Patch coverage is 84.21053% with 3 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
..._scanner/core/static_analysis/context_extractor.py	88.23%	2 Missing ⚠️
...kill_scanner/core/analyzers/llm_provider_config.py	50.00%	1 Missing ⚠️

📢 Thoughts on this report? Let us know!

- _resolve_api_key() now returns None for Vertex instead of the GOOGLE_APPLICATION_CREDENTIALS path, since vertex_ai/gemini-* models set both is_vertex and is_gemini, which was causing the file path to be written into GEMINI_API_KEY. - Regenerated configuration-reference.md via generate_reference_docs.py instead of hand-editing, and updated the underlying descriptions so the doc doesn't drift on next regeneration. Addresses CodeRabbit review feedbak on cisco-ai-defense#144.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@skill_scanner/core/static_analysis/context_extractor.py`:
- Around line 376-385: Update the URL filtering logic in the context extraction
flow around hostname parsing to parse each URL first and continue unless
parsed.scheme.lower() is exactly "http" or "https"; this must accept uppercase
HTTPS and reject schemes such as httpx before suspicious-domain matching. Add
regression coverage for https://abc.ngrok.app/... and httpx://abc.ngrok.app/...
preserving the expected suspicious-domain behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: fa261ef0-7eb7-4de1-bf18-ac120353a89f

📥 Commits

Reviewing files that changed from the base of the PR and between 3051348 and ecc0720.

📒 Files selected for processing (2)

skill_scanner/core/static_analysis/context_extractor.py
tests/static_analysis/test_suspicious_url_domains.py

federicoroncallo-hub mentioned this pull request Jul 2, 2026

feat(static): classify suspicious URLs in configuration files #134

Merged

4 tasks

coderabbitai Bot reviewed Jul 2, 2026

View reviewed changes

Comment thread skill_scanner/core/static_analysis/context_extractor.py

gyrospectre and others added 4 commits July 25, 2026 19:44

Bumps to resolve security findings

cbf9fce

revert unrelated cli-command-reference.md regeneration

48ba248

fix(static): classify suspicious URLs by hostname

ecc0720

coderabbitai Bot reviewed Aug 3, 2026

View reviewed changes

Comment thread skill_scanner/core/static_analysis/context_extractor.py

vineethsai7 added 4 commits August 3, 2026 14:41

Merge remote-tracking branch 'origin/main' into HEAD

a419477

Merge commit 'a4194779' into HEAD

4c5c18c

fix(static): validate suspicious URL schemes

961588c

Merge branch 'main' into feat/pr1-tunnel-domains

9fabcfe

vineethsai7 merged commit d8890dd into cisco-ai-defense:main Aug 3, 2026
1 check was pending

Navigation Menu

Uh oh!

fix(rules): detect current ngrok tunnel domains and add bore.pub/serveo.net/localtunnel.me - #132

fix(rules): detect current ngrok tunnel domains and add bore.pub/serveo.net/localtunnel.me#132
vineethsai7 merged 10 commits into
cisco-ai-defense:mainfrom
federicoroncallo-hub:feat/pr1-tunnel-domains

federicoroncallo-hub commented Jul 2, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Jul 2, 2026 •

edited

Loading

Review failed

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

codecov-commenter commented Jul 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Conversation

federicoroncallo-hub commented Jul 2, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Test plan

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Jul 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review failed

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

codecov-commenter commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

federicoroncallo-hub commented Jul 2, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Jul 2, 2026 •

edited

Loading

codecov-commenter commented Jul 24, 2026 •

edited

Loading