Add absolute-path, PII, and external-URL detection to injection gate (#47) (#49)

* Add absolute-path, PII, and external-URL detection to injection gate (#47)

個人環境・個人情報の混入を gate で検知する。
- absolute-path (例 /Users/<name>, /home/<name>, /root) は asset 種別によらず high。
- email address (PII) は asset 種別によらず high。
- external URL は検知のみ low (現状 gate を通す)。artifact_kind 別 policy
  (instruction=strict で high に昇格、skill/workflow は公開 URL 許容) は後続の
  artifact kind 対応で resolver と共に導入する。

low-risk のみの場合の summary 出力を追加し、self-test に absolute-path / pii /
external-url の 3 case を追加。docs/prompt-injection-check.md も更新。

Closes #47

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* Detect Windows user-specific paths in absolute-path check (#47 review)

Codex PR review (must): /Users, /home, /root のみ対象で Windows の
C:\Users\<name>\... を取りこぼしていた。Windows パターンを追加し、
self-test に Windows path の high case を追加。docs の例も更新。

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: kosako <kosako@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: kosako

docs/prompt-injection-check.md

@@ -24,6 +24,14 @@ static checks はすべての asset で必須です。少なくとも以下を
 - tool permission または approval policy の bypass attempts。
 - external exfiltration、network tunnel、production access requests。
 - tool-managed、company-managed、auth、cache、session、runtime state を変更する指示。
+- user-specific な absolute path (例 `/Users/<name>` `/home/<name>` `C:\Users\<name>`) の混入。
+- email address など PII の混入。
+- external URL の混入。
+
+absolute path と email は asset 種別によらず high とします。
+external URL は現状 low (検知のみで gate は通す) です。artifact kind 別の policy
+(instruction は strict にして high に昇格、skill / workflow は公開 URL を許容) は、
+artifact kind 対応で resolver を導入する後続作業で適用します。
 
 ## LLM Review
 

scripts/lib/check_injection.rb

@@ -67,6 +67,24 @@ module CheckInjection
     Pattern.new("runtime-state", "medium",
                 /(?:modify|write\s+to|edit|delete)\b.{0,50}\b(?:tool-managed|company-managed|auth|session|runtime\s+state)/i,
                 "instructs modification of managed or runtime state"),
+
+    # public repository に出してはいけない個人環境・個人情報の混入。
+    # absolute path と email は asset 種別によらず high。
+    Pattern.new("absolute-path", "high",
+                %r{(?:/Users|/home)/[A-Za-z0-9._-]+|/root(?![A-Za-z0-9_])},
+                "contains a user-specific absolute path"),
+    # Windows の user-specific path (例 C:\Users\<name>\...) も検知する。
+    Pattern.new("absolute-path", "high",
+                /[A-Za-z]:\\Users\\[^\\\r\n]+/,
+                "contains a user-specific absolute path"),
+    Pattern.new("pii", "high",
+                /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/,
+                "contains an email address (possible PII)"),
+    # external URL は検知するが現状 low (gate を通す)。artifact_kind 別 policy
+    # (instruction=strict で high に昇格) は後続の artifact kind 対応で導入する。
+    Pattern.new("external-url", "low",
+                %r{https?://[^\s)>"'\]]+}i,
+                "contains an external URL"),
   ].freeze
 
   RISK_ORDER = { "high" => 2, "medium" => 1, "low" => 0 }.freeze
@@ -156,9 +174,12 @@ def self.main(argv)
     elsif highest >= RISK_ORDER.fetch("medium")
       warn "warn: medium risk findings present (human review required)"
       3
-    else
+    elsif findings.empty?
       puts "ok: #{count} file(s) scanned, no findings" unless quiet
       0
+    else
+      puts "ok: #{count} file(s) scanned, #{findings.size} low-risk finding(s)" unless quiet
+      0
     end
   end
 

scripts/tests/check-injection-test.sh

@@ -70,4 +70,57 @@ repo_root=$(CDPATH= cd -- "$script_dir/../.." && pwd)
 "$check" --root "$repo_root" --quiet > "$tmp/out-repo" 2>&1 \
   || fail "repository shared assets should pass: $(cat "$tmp/out-repo")"
 
+# --- case 5: user-specific absolute path は high (exit 1) ---
+mkdir -p "$tmp/abspath/shared/workflows"
+cat > "$tmp/abspath/shared/workflows/personal-abspath.md" <<'EOF'
+# workflow
+See /Users/alice/.config/app for the local setup.
+EOF
+
+status=0
+"$check" --root "$tmp/abspath" > "$tmp/out-abspath" 2>&1 || status=$?
+[ "$status" -eq 1 ] || fail "absolute-path fixture should exit 1, got $status: $(cat "$tmp/out-abspath")"
+grep -q "\[high\] absolute-path: contains a user-specific absolute path" "$tmp/out-abspath" \
+  || fail "missing absolute-path finding in: $(cat "$tmp/out-abspath")"
+
+# --- case 6: email address は high (exit 1) ---
+mkdir -p "$tmp/pii/shared/workflows"
+cat > "$tmp/pii/shared/workflows/personal-pii.md" <<'EOF'
+# workflow
+Questions? Email alice@example.com for help.
+EOF
+
+status=0
+"$check" --root "$tmp/pii" > "$tmp/out-pii" 2>&1 || status=$?
+[ "$status" -eq 1 ] || fail "pii fixture should exit 1, got $status: $(cat "$tmp/out-pii")"
+grep -q "\[high\] pii: contains an email address" "$tmp/out-pii" \
+  || fail "missing pii finding in: $(cat "$tmp/out-pii")"
+
+# --- case 7: external URL は low (検知のみ、exit 0 で pass) ---
+mkdir -p "$tmp/url/shared/workflows"
+cat > "$tmp/url/shared/workflows/personal-url.md" <<'EOF'
+# workflow
+Reference: https://example.com/docs for background.
+EOF
+
+"$check" --root "$tmp/url" > "$tmp/out-url" 2>&1 \
+  || fail "external-url fixture should pass (low only): $(cat "$tmp/out-url")"
+grep -q "\[low\] external-url: contains an external URL" "$tmp/out-url" \
+  || fail "missing external-url finding in: $(cat "$tmp/out-url")"
+grep -q "low-risk finding" "$tmp/out-url" \
+  || fail "missing low-risk summary in: $(cat "$tmp/out-url")"
+
+# --- case 8: Windows の user-specific path も high (exit 1) ---
+mkdir -p "$tmp/winpath/shared/workflows"
+cat > "$tmp/winpath/shared/workflows/personal-winpath.md" <<'EOF'
+# workflow
+Open C:\Users\alice\AppData\Roaming\app for config.
+EOF
+
+status=0
+"$check" --root "$tmp/winpath" > "$tmp/out-winpath" 2>&1 || status=$?
+[ "$status" -eq 1 ] || fail "windows path fixture should exit 1, got $status: $(cat "$tmp/out-winpath")"
+grep -q "\[high\] absolute-path: contains a user-specific absolute path" "$tmp/out-winpath" \
+  || fail "missing windows absolute-path finding in: $(cat "$tmp/out-winpath")"
+
 echo "ok: check-injection self-test passed"