Skip to content

Fix #112: recover 328 replacement characters in the registries, and guard the data files #114

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
emmanuelgjr merged 2 commits into from
Sep 18, 2026
Merged

Fix #112: recover 328 replacement characters in the registries, and guard the data files #114

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
22b3a48
Fix #112: recover 328 replacement characters in the registries, and g…
emmanuelgjr Sep 18, 2026
7dc6359
Merge remote-tracking branch 'origin/main' into fix/registry-encoding
emmanuelgjr Sep 18, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
50 changes: 25 additions & 25 deletions data/frameworks/cis-controls.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,7 +13,7 @@
{
"control_id": "2.1",
"title": "Establish and maintain software inventory",
"description": "ML SBOM as software asset inventory � all agent components (tools, MCP servers, models, libraries)",
"description": "ML SBOM as software asset inventory — all agent components (tools, MCP servers, models, libraries)",
"kind": "control",
"parent": "CIS-2"
},
Expand Down Expand Up @@ -55,14 +55,14 @@
{
"control_id": "3.10",
"title": "Encrypt sensitive data in transit",
"description": "All A2A messages encrypted in transit � no cleartext inter-agent communication",
"description": "All A2A messages encrypted in transit — no cleartext inter-agent communication",
"kind": "control",
"parent": "CIS-3"
},
{
"control_id": "3.11",
"title": "Encrypt sensitive data at rest",
"description": "Agent credentials encrypted at rest � secret manager, no cleartext storage; Agent memory stores encrypted at rest � embeddings, long-term memory, operational knowledge; Embeddings, training data, and RAG caches containing sensitive data encrypted",
"description": "Agent credentials encrypted at rest — secret manager, no cleartext storage; Agent memory stores encrypted at rest — embeddings, long-term memory, operational knowledge; Embeddings, training data, and RAG caches containing sensitive data encrypted",
"kind": "control",
"parent": "CIS-3"
},
Expand All @@ -76,7 +76,7 @@
{
"control_id": "4.1",
"title": "Establish secure configuration process",
"description": "Secure configuration includes code execution sandbox � no defaults permitting unrestricted execution; Secure configuration includes circuit breakers and rate limits � cascade prevention as configuration requirement; Secure configuration for LLM deployments � system prompts not in cleartext config",
"description": "Secure configuration includes code execution sandbox — no defaults permitting unrestricted execution; Secure configuration includes circuit breakers and rate limits — cascade prevention as configuration requirement; Secure configuration for LLM deployments — system prompts not in cleartext config",
"kind": "control",
"parent": "CIS-4"
},
Expand All @@ -97,21 +97,21 @@
{
"control_id": "5.4",
"title": "Restrict administrator privileges",
"description": "Agent tool access managed as privileged access � minimum scope, regular review; Agent credentials managed as privileged accounts � minimum scope, regular review, JIT issuance; Approval flows independent of agent interface � sensitive approvals cannot be completed via agent chat",
"description": "Agent tool access managed as privileged access — minimum scope, regular review; Agent credentials managed as privileged accounts — minimum scope, regular review, JIT issuance; Approval flows independent of agent interface — sensitive approvals cannot be completed via agent chat",
"kind": "control",
"parent": "CIS-5"
},
{
"control_id": "6.1",
"title": "Establish access granting process",
"description": "Formal process for granting agent tool access � documented justification per tool; Formal process for granting LLM tool access � documented justification required",
"description": "Formal process for granting agent tool access — documented justification per tool; Formal process for granting LLM tool access — documented justification required",
"kind": "control",
"parent": "CIS-6"
},
{
"control_id": "6.2",
"title": "Establish an access revoking process",
"description": "Agent credential revocation process � immediate revocation on detection, decommission procedure",
"description": "Agent credential revocation process — immediate revocation on detection, decommission procedure",
"kind": "control",
"parent": "CIS-6"
},
Expand All @@ -138,21 +138,21 @@
{
"control_id": "7.1",
"title": "Establish vulnerability management process",
"description": "Agent component CVEs in vulnerability management � urgent patching for code execution risks; Vulnerability management process covers LLM component CVEs and dependency risks",
"description": "Agent component CVEs in vulnerability management — urgent patching for code execution risks; Vulnerability management process covers LLM component CVEs and dependency risks",
"kind": "control",
"parent": "CIS-7"
},
{
"control_id": "7.5",
"title": "Perform automated vulnerability scanning",
"description": "Automated scanning of training pipeline components � vulnerabilities in data processing libraries",
"description": "Automated scanning of training pipeline components — vulnerabilities in data processing libraries",
"kind": "control",
"parent": "CIS-7"
},
{
"control_id": "8.2",
"title": "Collect audit logs",
"description": "All agent inputs logged � injection attempts detectable through log analysis; Memory write operations logged � who or what wrote, when, content hash; Comprehensive audit logging of all agent actions � no production deployment without full observability",
"description": "All agent inputs logged — injection attempts detectable through log analysis; Memory write operations logged — who or what wrote, when, content hash; Comprehensive audit logging of all agent actions — no production deployment without full observability",
"kind": "control",
"parent": "CIS-8"
},
Expand All @@ -166,14 +166,14 @@
{
"control_id": "8.5",
"title": "Collect detailed audit logs",
"description": "All tool invocations logged � tool identity, parameters, agent identity, timestamp; All credential operations logged � issuance, use, anomalous patterns detectable; All A2A messages logged � sender identity, content hash, timestamp, schema validation results",
"description": "All tool invocations logged — tool identity, parameters, agent identity, timestamp; All credential operations logged — issuance, use, anomalous patterns detectable; All A2A messages logged — sender identity, content hash, timestamp, schema validation results",
"kind": "control",
"parent": "CIS-8"
},
{
"control_id": "8.6",
"title": "Collect DNS query audit logs",
"description": "Agent traffic monitored � cascade indicators detected before physical impact",
"description": "Agent traffic monitored — cascade indicators detected before physical impact",
"kind": "control",
"parent": "CIS-8"
},
Expand Down Expand Up @@ -213,7 +213,7 @@
{
"control_id": "12.4",
"title": "Establish and maintain architecture diagram",
"description": "A2A communication channels mapped in network architecture � authentication method, encryption status",
"description": "A2A communication channels mapped in network architecture — authentication method, encryption status",
"kind": "control",
"parent": "CIS-12"
},
Expand All @@ -233,14 +233,14 @@
{
"control_id": "13.1",
"title": "Centralise security event alerting",
"description": "Agent behavioural anomalies centralised and alerted � rogue agent patterns detected through SIEM",
"description": "Agent behavioural anomalies centralised and alerted — rogue agent patterns detected through SIEM",
"kind": "control",
"parent": "CIS-13"
},
{
"control_id": "13.3",
"title": "Deploy a network-based intrusion detection system",
"description": "Memory store access monitored � bulk read, anomalous write patterns detected",
"description": "Memory store access monitored — bulk read, anomalous write patterns detected",
"kind": "control",
"parent": "CIS-13"
},
Expand All @@ -260,7 +260,7 @@
{
"control_id": "14.1",
"title": "Establish security awareness programme",
"description": "All users of agentic tools trained on AI limitations � verification requirements, how to identify manipulation; User training on LLM data handling � what data should not be shared with LLMs; User training on LLM output limitations � verification requirements and critical evaluation",
"description": "All users of agentic tools trained on AI limitations — verification requirements, how to identify manipulation; User training on LLM data handling — what data should not be shared with LLMs; User training on LLM output limitations — verification requirements and critical evaluation",
"kind": "control",
"parent": "CIS-14"
},
Expand All @@ -280,35 +280,35 @@
{
"control_id": "15.1",
"title": "Establish service provider management process",
"description": "Agent tool and MCP providers managed as service providers � security assessment before onboarding",
"description": "Agent tool and MCP providers managed as service providers — security assessment before onboarding",
"kind": "control",
"parent": "CIS-15"
},
{
"control_id": "16.1",
"title": "Establish secure application development standards",
"description": "Secure development standards covering agentic integrations � input validation, goal-state verification; Secure development standards covering LLM integration � input validation, context separation",
"description": "Secure development standards covering agentic integrations — input validation, goal-state verification; Secure development standards covering LLM integration — input validation, context separation",
"kind": "control",
"parent": "CIS-16"
},
{
"control_id": "16.2",
"title": "Implement code review",
"description": "Code review for all LLM integration code � prompt injection patterns reviewed",
"description": "Code review for all LLM integration code — prompt injection patterns reviewed",
"kind": "control",
"parent": "CIS-16"
},
{
"control_id": "16.6",
"title": "Use only up-to-date and trusted third-party components",
"description": "Approved component list � only sourced from approved vendors, signatures verified; Only approved, verified LLM components used in production � unsigned components rejected",
"description": "Approved component list — only sourced from approved vendors, signatures verified; Only approved, verified LLM components used in production — unsigned components rejected",
"kind": "control",
"parent": "CIS-16"
},
{
"control_id": "16.7",
"title": "Use standard hardening configuration templates",
"description": "Hardened training pipeline configurations � immutable infrastructure, locked data sources",
"description": "Hardened training pipeline configurations — immutable infrastructure, locked data sources",
"kind": "control",
"parent": "CIS-16"
},
Expand All @@ -328,28 +328,28 @@
{
"control_id": "17.1",
"title": "Designate personnel for incident response",
"description": "Defined response for cascade events � kill switch activation, process control fallback, operations notification; Defined response for trust exploitation incidents � operator retraining, pattern audit, interface redesign; Defined response for LLM misinformation incidents � correction, notification, root cause",
"description": "Defined response for cascade events — kill switch activation, process control fallback, operations notification; Defined response for trust exploitation incidents — operator retraining, pattern audit, interface redesign; Defined response for LLM misinformation incidents — correction, notification, root cause",
"kind": "control",
"parent": "CIS-17"
},
{
"control_id": "17.2",
"title": "Establish incident response procedures",
"description": "Rogue agent containment as incident response procedure � kill switch, audit, state validation, forensic",
"description": "Rogue agent containment as incident response procedure — kill switch, audit, state validation, forensic",
"kind": "control",
"parent": "CIS-17"
},
{
"control_id": "18.1",
"title": "Establish penetration testing programme",
"description": "Adversarial testing covering goal hijack � direct, indirect, multi-turn injection scenarios; Adversarial testing programme covering prompt injection scenarios",
"description": "Adversarial testing covering goal hijack — direct, indirect, multi-turn injection scenarios; Adversarial testing programme covering prompt injection scenarios",
"kind": "control",
"parent": "CIS-18"
},
{
"control_id": "18.3",
"title": "Remediate penetration testing findings",
"description": "Poisoning scenarios in penetration testing � verify data integrity controls hold under attack",
"description": "Poisoning scenarios in penetration testing — verify data integrity controls hold under attack",
"kind": "control",
"parent": "CIS-18"
},
Expand Down
22 changes: 11 additions & 11 deletions data/frameworks/cwe-cve.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -14,7 +14,7 @@
"control_id": "CWE-20",
"title": "CWE-20",
"kind": "weakness",
"description": "Root cause � agent inputs not validated before entering model context; indirect injection content not treated as untrusted; Tool parameters generated by LLM not validated against safe ranges before execution; Content entering agent memory not validated before write"
"description": "Root cause — agent inputs not validated before entering model context; indirect injection content not treated as untrusted; Tool parameters generated by LLM not validated against safe ranges before execution; Content entering agent memory not validated before write"
},
{
"control_id": "CWE-74",
Expand Down Expand Up @@ -74,7 +74,7 @@
"control_id": "CWE-200",
"title": "CWE-200",
"kind": "weakness",
"description": "System prompt and agent configuration not protected � extraction enables targeted trust exploitation"
"description": "System prompt and agent configuration not protected — extraction enables targeted trust exploitation"
},
{
"control_id": "CWE-201",
Expand Down Expand Up @@ -111,15 +111,15 @@
{
"control_id": "CWE-276",
"title": "CWE-276",
"description": "Agent deployed with broader permissions than needed � amplifies rogue blast radius",
"description": "Agent deployed with broader permissions than needed — amplifies rogue blast radius",
"kind": "weakness",
"parent": null
},
{
"control_id": "CWE-284",
"title": "CWE-284",
"kind": "weakness",
"description": "Agent can invoke tools it should not have access to; tool parameters not range-validated; Vector store and memory databases with insufficient access controls permitting unauthorised writes; Rogue agent exceeds its permitted access scope � no scope enforcement"
"description": "Agent can invoke tools it should not have access to; tool parameters not range-validated; Vector store and memory databases with insufficient access controls permitting unauthorised writes; Rogue agent exceeds its permitted access scope — no scope enforcement"
},
{
"control_id": "CWE-285",
Expand All @@ -129,7 +129,7 @@
{
"control_id": "CWE-287",
"title": "CWE-287",
"description": "A2A channels without mutual authentication � agents accept messages from any sender",
"description": "A2A channels without mutual authentication — agents accept messages from any sender",
"kind": "weakness",
"parent": null
},
Expand Down Expand Up @@ -173,7 +173,7 @@
"control_id": "CWE-346",
"title": "CWE-346",
"kind": "weakness",
"description": "Agent does not verify that A2A messages originate from the claimed sender; User cannot determine whether advice originates from AI or human � no origin verification"
"description": "Agent does not verify that A2A messages originate from the claimed sender; User cannot determine whether advice originates from AI or human — no origin verification"
},
{
"control_id": "CWE-349",
Expand All @@ -191,7 +191,7 @@
"control_id": "CWE-400",
"title": "CWE-400",
"kind": "weakness",
"description": "Agent resource consumption not bounded � enables exhaustion propagation across cluster"
"description": "Agent resource consumption not bounded — enables exhaustion propagation across cluster"
},
{
"control_id": "CWE-434",
Expand Down Expand Up @@ -258,7 +258,7 @@
{
"control_id": "CWE-613",
"title": "CWE-613",
"description": "Long-lived agent credentials without expiry or rotation � NHI-7",
"description": "Long-lived agent credentials without expiry or rotation — NHI-7",
"kind": "weakness",
"parent": null
},
Expand Down Expand Up @@ -291,7 +291,7 @@
{
"control_id": "CWE-703",
"title": "CWE-703",
"description": "Agent failures not caught and handled � exception propagates to downstream agents",
"description": "Agent failures not caught and handled — exception propagates to downstream agents",
"kind": "weakness",
"parent": null
},
Expand Down Expand Up @@ -348,7 +348,7 @@
{
"control_id": "CWE-913",
"title": "CWE-913",
"description": "MCP descriptors and tool specifications are dynamically loaded code resources � modification not controlled",
"description": "MCP descriptors and tool specifications are dynamically loaded code resources — modification not controlled",
"kind": "weakness",
"parent": null
},
Expand All @@ -374,7 +374,7 @@
{
"control_id": "CWE-1341",
"title": "CWE-1341",
"description": "Memory TTL not enforced � entries persist beyond intended lifetime",
"description": "Memory TTL not enforced — entries persist beyond intended lifetime",
"kind": "weakness",
"parent": null
},
Expand Down
2 changes: 1 addition & 1 deletion data/frameworks/eu-ai-act.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -164,7 +164,7 @@
{
"control_id": "Art. 53(1)(a)",
"title": "GPAI documentation",
"description": "Data governance for training data � sources, quality, privacy measures � is a GPAI documentation obligation; Data governance for GPAI training data is a binding documentation obligation from Aug 2025",
"description": "Data governance for training data — sources, quality, privacy measures — is a GPAI documentation obligation; Data governance for GPAI training data is a binding documentation obligation from Aug 2025",
"kind": "control",
"parent": null
},
Expand Down
Loading
Loading