Skip to content

fix(security): close procfs credential read + wire MCP/ToolSearch into the injection scan #1654

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
elhoim wants to merge 2 commits into from
Closed

fix(security): close procfs credential read + wire MCP/ToolSearch into the injection scan #1654

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
ec7b43b
fix(security): treat procfs secret reads as credential paths
elhoim Jul 26, 2026
90470fc
fix(security): route MCP and ToolSearch results through the injection…
elhoim Jul 26, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 4 additions & 1 deletion LifeOS/install/hooks/Safety.hook.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -296,7 +296,10 @@ function isAttackerWritableSource(toolName: string): boolean {
// ToolSchemaLoaded hook event) is an upstream Claude Code feature request.
if (toolName === "ToolSearch") return true;
if (!toolName.startsWith("mcp__")) return false;
return /gmail|mail|drive|calendar|inbox/i.test(toolName);
// dropbox joins the list for the same reason drive is on it: file content
// pulled from a sync service is third-party-authored text that a stranger
// can put there (shared folders, file requests).
return /gmail|mail|drive|calendar|inbox|dropbox/i.test(toolName);
}

function annotate(input: { tool_name?: string; tool_response?: unknown }): void {
Expand Down
12 changes: 1 addition & 11 deletions LifeOS/install/hooks/hooks.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -62,17 +62,7 @@
]
},
{
"matcher": "WebFetch",
"hooks": [
{
"type": "command",
"command": "$HOME/.claude/hooks/Safety.hook.ts",
"timeout": 5
}
]
},
{
"matcher": "WebSearch",
"matcher": "WebFetch|WebSearch|ToolSearch|mcp__.*([Mm]ail|[Dd]rive|[Cc]alendar|[Ii]nbox|[Dd]ropbox)",
"hooks": [
{
"type": "command",
Expand Down
7 changes: 7 additions & 0 deletions LifeOS/install/hooks/lib/safety-classifier.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -90,6 +90,13 @@ export const CREDENTIAL_PATHS: readonly RegExp[] = [
/\.aws\/credentials\b/,
/\.gnupg\/(private-keys|secring)/,
/(^|\s|=|@|"|')([~\$\{\}\/A-Za-z0-9._-]+\/)?\.env(\.[a-zA-Z0-9_-]+)?(\s|$|"|')/,
// procfs reaches the same secrets the entries above guard: `environ` is the
// process environment (API keys, tokens), `mem`/`maps` are its address space.
// `cat` is in SEARCH_TOOLS, so without this `cat /proc/self/environ` takes the
// read-only-command allow at classifyCommand() and prints every secret in the
// environment without a prompt. Covers literal pids, `self`, and the shell
// forms that reach the same file (`$$`, `$PID`, `${PID}`).
/\/proc\/(?:self|\d+|\$\$|\$\{?[A-Za-z_][A-Za-z0-9_]*\}?)\/(?:environ|mem|maps|cmdline)\b/,
];

export const READ_ONLY_COMMAND_PATTERNS: readonly RegExp[] = [
Expand Down