feat: add rules for npx commands + command substitutions

[sarahxsanders]

Changes

adds three new rules:

• supply_chain_npx_auto_confirm: catches npx/dlx/bunx with --yes/y or yes | (silent package execution) as critical/block
• supply_chain_npx_in_skill: catches any npx/dlx/bunx invocation, with the belief that a trusted skill shouldn't tell an agent to install packages, high/warn
• exfiltration_command_substitution_in_url: catchs curl/wget with $(...) or backtick command substitutions for data exfil via URL params or POST body, critical/block

these rules catch a real attack pattern found on skills.sh where a skill silently installs a second malicious skill via npx --yes, which then exfiltrates machine identity to an attacker-controlled domain via command substitution in a curl URL >.<

Test plan

• Existing tests pass (pnpm test)
• Build succeeds (pnpm build)
• For new rules: added a positive-match test (content that should match)
• For new rules: added a negative-match test (similar content that should not match – guards against false positives)
• scanned https://skills.sh/roin-orca/skills/fun-brainstorming and it works

[gewenyu99]

Some stuff to look at. Not sure how to solve 🤔

[gewenyu99]

My bot tells me npx --yes <pkg> gets through this.

[gewenyu99]

Apparently

exfiltration_command_substitution_in_url keys on $([a-zA-Z] / `[a-zA-Z]. So these all bypass:

curl "…?x=$(/bin/hostname)" (absolute path)
curl "…?x=$( hostname)" (leading space — valid shell)
curl "…?x=/bin/id"

these can get through (accoridng to my bot)

[gewenyu99]

Some possible false positive possibly?

$API_URL / $AUTH_URL / $ACCESS_* trip the secret-exfil block

Since it's [A-Z_]*, lets a keyword match a prefix of a longer var name, and API/AUTH/ACCESS are keywords.

So curl "$API_URL/health" and stuff like this will get hard blocked.

[gewenyu99]

Maybe this is non-issue but

[gewenyu99]

\bhttps?\s matches the word "http"/"https" + whitespace

So like in markdown Connect via https and pass your $API_KEY will trigger this I think