argentos-security-audit

name	argentos-security-audit
description	Security audit procedures for ArgentOS marketplace packages. Use when scanning packages, reviewing submissions, auditing for prompt injection, checking VirusTotal results, approving marketplace submissions, or when anyone mentions "security scan", "VT scan", "prompt injection", "audit package", "review submission", or "marketplace security".

ArgentOS Security Audit

Three-layer security model for every marketplace package.

The Three Layers

Layer	Tool	What It Checks
1. VirusTotal	70+ antivirus engines	Malware, trojans, viruses, PUPs
2. ArgentOS AI Safety	Custom regex scanner	Prompt injection, secrets, dangerous code
3. Manual Review	Human (admin panel)	Quality, usefulness, correctness

Layer 1: VirusTotal

API: https://www.virustotal.com/api/v3 Rate limit: 4 uploads/min, 500/day (free tier) Key: stored in Railway env as VIRUSTOTAL_API_KEY

How it works

1. Package file uploaded to VT /files endpoint
2. Poll /analyses/{id} every 15s until complete
3. Check stats.malicious and stats.suspicious
4. Store permalink: https://www.virustotal.com/gui/file/{sha256}

Interpreting results

• 0 malicious, 0 suspicious → Clean (badge: "VT Scanned")
• Any malicious or suspicious → Flagged (hold for manual review)
• Timeout → Error (re-scan later)

Every package's VT badge links to the actual scan report. Not a claim — a verifiable link.

Bulk scanning all packages

cd /Users/sem/code/argent-marketplace
DATABASE_URL="..." bun scripts/scan-all-packages.ts

Rate-limited at 1 per 16s. ~30 min for 54 packages.

Layer 2: ArgentOS AI Safety Scanner

Location: apps/api/src/scanner/custom-scan.ts

Checks performed

SKILL.md validation:

• File exists (skip macOS ._ resource forks)
• YAML frontmatter present (--- delimiters)
• name field in frontmatter
• description field in frontmatter

Prompt injection detection (25 patterns):

Instruction override:

• Ignore/override/disregard previous instructions
• New instructions claims

Role hijacking:

• DAN jailbreak, persona switch, unrestricted mode
• Identity override, role reassignment

System prompt extraction:

• Print/show/reveal prompt attempts
• "What are your instructions" patterns

Hidden instructions:

• HTML comment injection
• Zero-width characters (3+ consecutive)
• Base64 encoded instructions
• Unicode escape obfuscation

Data exfiltration:

• URLs in send/post/upload/transmit context
• Webhook injection (fetch/curl to non-allowlisted domains)
• Credential harvesting language

Privilege escalation:

• Admin/root grant attempts
• Auth bypass language

Destructive operations:

• rm -rf / delete all patterns
• System command injection

Social engineering:

• User impersonation ("pretend the user said")
• Trust exploitation ("user already approved")
• Urgency manipulation ("emergency override")

Secret detection:

• AWS Access Keys (AKIA...)
• AWS Secret Keys
• GitHub tokens (ghp_, gho_, ghu_, ghs_, ghr_)
• Anthropic API keys (sk-ant-)
• OpenAI API keys (sk-)
• Slack tokens (xox[bpras]-)
• Private keys (-----BEGIN PRIVATE KEY-----)
• Generic API key patterns

Dangerous code:

• eval() usage
• new Function() constructor
• exec() shell commands
• child_process imports
• Large base64 atob() calls

File size: Max 5MB total content.

Archive extraction

The scanner decompresses .tar.gz files before scanning:

1. zlib.gunzip() to decompress
2. Parse tar headers (512-byte blocks)
3. Extract each file's content
4. Filter out macOS ._ resource forks
5. Scan extracted text files

Layer 3: Manual Review

Admin panel: https://marketplace.argentos.ai/admin → Submissions

Review checklist

• VT scan clean (click permalink to verify)
• Custom scan passed (check individual check results)
• SKILL.md has valid frontmatter with name + description
• Description accurately describes what the skill does
• No obvious quality issues
• Category is correct
• Author GitHub profile exists

Approve

Click Approve → creates package in marketplace with VT permalink + argentos_scan_status.

Reject

Click Reject → enter reason → submitter sees the reason on their submission page.

Admin Notifications

When a submission scan completes, an email is sent to ADMIN_EMAIL (default: [e-mail]) with:

• Package name and author
• VT status (clean/flagged)
• Custom scan status (passed/flagged)
• "Review in Admin" button

Submission Flow (User Perspective)

1. Log in with GitHub at marketplace.argentos.ai
2. Click Submit a Skill → upload .tar.gz + metadata
3. Status: scanning → VT + custom scans run async
4. Status: review (if passed) or stays scanning (if VT slow)
5. Admin reviews and approves/rejects
6. If approved: package appears in catalog with badges
7. If rejected: reason shown, resubmit button available

Resubmit Flow

Submissions in review/rejected/scanning can be resubmitted:

1. Go to submission detail page
2. Upload new .tar.gz
3. All scan results reset
4. Scans run again from scratch