Changelog

​

[0.7.0] — March 5, 2026

​

Added

​

Remediation Guidance — 173/173 Rules

{
  "rule_id": "PROMPT_INJECTION_001",
  "remediation": "Remove instruction override text. If this is documentation, wrap it in a code block."
}

​

Docker Distribution

• Multi-stage Dockerfile (golang:1.25-alpine → alpine:3.21)
• GHCR publish workflow: ghcr.io/garagon/aguara with semver tags
• Run directly without installation:

docker run --rm -v "$(pwd)":/scan ghcr.io/garagon/aguara scan /scan

​

Homebrew Tap

brew install garagon/tap/aguara

​

Inline Ignore Comments

​

GitHub Action for CI Scanning

- uses: garagon/aguara@v1
  with:
    path: ./mcp-server/
    severity: medium
    fail-on: high

​

Config Shorthand

disable_rules:
  - CRED_004
  - EXFIL_005

​

Pattern Matcher Deduplication

​

Improved

• Test coverage: 76.3% → 80.0% global (NLP 69.1% → 93.2%, cmd 57.9% → 63.2%)
• 447 test functions across 28 test files
• NLP and scanner E2E benchmarks added
• README: new “How It Works” section, output formats table, Docker/CI docs

​

Fixed

• Regex pattern length limit: Patterns exceeding 4096 chars rejected at compile time
• Community docs: Improved CODE_OF_CONDUCT.md and PR template

​

Summary

​

[0.5.0] — March 3, 2026

​

Added

​

20 New Detection Rules

• INDIRECT_011: Database/cache query driving agent behavior (HIGH)
• INDIRECT_012: Webhook/callback registration with external service (HIGH)
• INDIRECT_013: Git clone and execute fetched code (HIGH)
• INDIRECT_014: Environment variable injection from external source (MEDIUM)

• THIRDPARTY_003: JavaScript eval/Function with external data (HIGH)
• THIRDPARTY_007: Unsafe deserialization from untrusted source (HIGH)
• THIRDPARTY_008: Script/asset without integrity check (MEDIUM)
• THIRDPARTY_009: HTTP downgrade from HTTPS (MEDIUM)
• THIRDPARTY_010: Unsigned plugin/extension loading (HIGH)

• UNI_008: Zero-width character sequences (MEDIUM)
• UNI_009: Unicode normalization inconsistency (MEDIUM)
• UNI_010: Mixed-script confusable in identifiers (MEDIUM)

• MCPCFG_010: Docker capabilities escalation (--cap-add) (HIGH)
• MCPCFG_011: Unrestricted container network access (--network host) (MEDIUM)

• MCP_015: Auth-before-body parsing (slow-body DoS) (MEDIUM)
• MCP_016: Canonicalization bypass (double-encoding) (HIGH)

• SUPPLY_017: Symlink/hardlink to sensitive path outside workspace (HIGH)
• SUPPLY_018: Sandbox escape via process spawn (CRITICAL)

• PROMPT_INJECTION_018: Runtime events as user-role prompt (HIGH)
• CREDLEAK_019: HMAC/signing secret in source (HIGH)

​

Confidence Scoring System

• Base confidence by analyzer: Pattern match_mode=all → 0.95, pattern match_mode=any → 0.85, decoded content → 0.90, NLP → 0.70, ToxicFlow → 0.90, Rug-Pull → 0.95
• Post-processing adjustments: Code block matches → ×0.6 downgrade; correlated findings → ×1.1 boost (capped at 1.0)
• Output: confidence field in JSON/SARIF; [85%] badge in --verbose terminal mode; SARIF rank property

​

Configurable Max File Size

• New --max-file-size CLI flag (e.g. --max-file-size 100MB)
• Range: 1 MB–500 MB, default 50 MB
• New max_file_size field in .aguara.yml config
• New WithMaxFileSize(bytes) library option

​

Fixed

• Atomic state file writes: State persistence (~/.aguara/state.json) now uses tmp+rename pattern to prevent corruption

​

Summary

​

[0.4.0] — February 28, 2026

​

Added

• 5 new detection rules from OpenClaw security analysis:
  • CREDLEAK_018: Hardcoded credentials in environment mappings (MEDIUM)
  • MCPATTACK_012: MCP tool name shadowing / override attack (HIGH)
  • MCPATTACK_013: Permissive MCP tool auto-approval patterns (HIGH)
  • SSRF_009: SSRF via server-controlled redirect following (HIGH)
  • SUPPLY_015: Executable download disguised as data file (HIGH)
• Install script (install.sh): curl | bash installer for binary distribution
• PATH hint: One-time hint after go install when ~/go/bin is not in PATH

​

Fixed

• Security hardening: File-size guardrails (10 MB limit), symlink protection, stricter input validation
• .gitignore: Added sandbox/ and coverage.out

​

Summary

​

[0.2.3] — February 23, 2026

​

Added

• exclude_patterns for rules: Rules can now define patterns that cancel a match when the matched line (or up to 3 lines before it) matches an exclude pattern
• Applied exclude_patterns to 4 high-FP rules: EXTDL_004, EXTDL_009, EXTDL_011, CMDEXEC_009

​

Changed

• Documented exclude_patterns in README and AGENTS.md custom rules schema

​

[0.2.2] — February 21, 2026

​

Changed

• Reduced cyclomatic complexity across multiple packages (gocyclo clean)
• Applied gofmt -s simplifications project-wide

​

[0.2.1] — February 21, 2026

​

Added

import "github.com/garagon/aguara"

// Scan a directory
result, err := aguara.Scan(ctx, "./skills/")

// Scan inline content (no disk I/O)
result, err := aguara.ScanContent(ctx, content, "skill.md")

// List detection rules
rules := aguara.ListRules()

// Explain a rule by ID
detail, err := aguara.ExplainRule("PROMPT_INJECTION_001")

​

[0.2.0] — February 18, 2026

​

Added

​

New Rule Categories

• Command Execution (13 rules): Shell subprocess, eval, Python/Node.js execution, PowerShell
• Indirect Injection (7 rules): Fetch-and-follow, remote config, email-as-instructions
• Third-Party Content (4 rules): Unpinned URLs, mutable GitHub content, unvalidated API responses
• MCP Config Security (8 rules): Unpinned npx, hardcoded secrets, shell metacharacters

​

Expanded Rule Files

• credential-leak.yaml (+6 rules): Stripe/Anthropic API keys, SSH private keys, Docker credentials
• exfiltration.yaml (+4 rules): Sensitive file reads, env var leaks, screenshot capture
• external-download.yaml (+8 rules): pip/go/brew/apt installs, curl-to-shell, Docker pull+run
• supply-chain.yaml (+3 rules): Git clone-and-execute, unpinned GitHub Actions

​

New Analyzers

• Tracks file content SHA-256 hashes across scan runs
• Detects tool description changes (rug-pull attacks)
• Persistent state at ~/.aguara/state.json
• Rule: RUGPULL_001 (CRITICAL)

• Detects dangerous capability combinations
• TOXIC_001: Private data read + public output (HIGH)
• TOXIC_002: Private data read + code execution (HIGH)
• TOXIC_003: Destructive actions + code execution (HIGH)

​

Fixed

​

Summary

​

[0.1.0] — January 15, 2026

​

Added

• 85 built-in rules across 8 YAML files
• 2 analyzers: pattern matcher + NLP injection detector
• Categories: prompt-injection, exfiltration, credential-leak, mcp-attack, ssrf-cloud, supply-chain, unicode-attack, external-download
• Output formats: terminal (ANSI), JSON, SARIF, Markdown
• CLI commands: aguara scan, aguara init, aguara version
• Flags: --severity, --format, --fail-on, --ci, --changed, --verbose, --rules, --disable-rule, --workers, --output, --no-color
• Config file: .aguara.yml with ignore patterns, severity overrides, rule disabling
• SARIF output for GitHub Code Scanning integration