当攻击者开始使用 AI Agent：企业防线要从“拦截提示词”升级到控制执行链

#!/usr/bin/env python3
import argparse
import re
from pathlib import Path

WATCH_DIRS = {".claude", ".cursor", ".vscode", ".github", ".openclaw", "memory"}
SKIP_DIRS = {".git", "node_modules", ".venv", "dist", "build"}
TEXT_EXTENSIONS = {
    ".json", ".yaml", ".yml", ".toml", ".md", ".js", ".mjs",
    ".cjs", ".ts", ".py", ".sh", ".ps1", ".txt"
}

RULES = [
    ("HIGH", "下载内容直接交给 shell", re.compile(r"(?:curl|wget)[^\n|;]*(?:\||;)\s*(?:sh|bash)\b", re.I)),
    ("HIGH", "Node.js 启动外部进程", re.compile(r"(?:child_process|execSync|spawnSync)\s*[.(]", re.I)),
    ("HIGH", "GitHub Actions 使用 write-all", re.compile(r"permissions\s*:\s*write-all", re.I)),
    ("HIGH", "尝试删除工作流或执行日志", re.compile(r"delete.{0,40}(?:workflow|run|execution).{0,20}log", re.I)),
    ("MEDIUM", "疑似提示注入指令", re.compile(r"(?:ignore previous instructions|system override|unrestricted mode)", re.I)),
    ("MEDIUM", "工作区自动执行钩子", re.compile(r'"(?:onOpen|postinstall|startup|setupCommand)"\s*:', re.I)),
]


def candidate_files(root: Path):
    for path in root.rglob("*"):
        if not path.is_file() or any(part in SKIP_DIRS for part in path.parts):
            continue
        watched = any(part in WATCH_DIRS for part in path.relative_to(root).parts)
        if watched and path.suffix.lower() in TEXT_EXTENSIONS and path.stat().st_size <= 1_000_000:
            yield path


def main():
    parser = argparse.ArgumentParser(description="Scan AI workspace and CI configuration files")
    parser.add_argument("root", nargs="?", default=".", help="repository root")
    args = parser.parse_args()

    root = Path(args.root).resolve()
    findings = []

    for path in candidate_files(root):
        try:
            text = path.read_text(encoding="utf-8", errors="replace")
        except OSError as exc:
            print(f"WARN cannot read {path}: {exc}")
            continue

        for line_number, line in enumerate(text.splitlines(), start=1):
            for severity, message, pattern in RULES:
                if pattern.search(line):
                    findings.append((severity, path, line_number, message, line.strip()[:180]))

    for severity, path, line_number, message, excerpt in findings:
        relative = path.relative_to(root)
        print(f"{severity} {relative}:{line_number} {message}\n  {excerpt}")

    high_count = sum(item[0] == "HIGH" for item in findings)
    print(f"Scanned {root}; findings={len(findings)}, high={high_count}")
    raise SystemExit(1 if high_count else 0)


if __name__ == "__main__":
    main()

chmod +x tools/scan_ai_workspace.py
python3 tools/scan_ai_workspace.py .

name: AI workspace security check

on:
  pull_request:
  push:
    branches: [main]

permissions:
  contents: read

jobs:
  scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          persist-credentials: false
      - name: Scan AI and IDE workspace configuration
        run: python3 tools/scan_ai_workspace.py .