Ë ÿ`gj”Hãóš—dZddlmZdZdZdZdZdZdZd d „ddœd d„ddgdddœddgddœdd„dddœddgddœd d!gd"dœd#d$d%gd&dœd'd(„d)edœd*d+„d,d-gd.d/œd0d1d2d3œd4d5d6d3œd7d8ed3œd9d:d;d3œdd3œd?d@dAd3œdBdCed3œdDdEed3œdFdGdHd3œdIdJed3œdKdLdMgdNdœdOdPgdQdœdRdSdTd3œdUdVed3œdWdXed3œdYdZed3œgZ Gd[„d\e«Z id e j“d e j“de j“de j“de j“d e j “d#e j"“d'e j$“d*e j&“d0e j(“d4e j*“d7e j,“d9e j.“de j@e jBe jDe jFd]œ¥Z$e%e$«e Dchc]}|d^’Œ c}k(s9Jd_e%d`„e D««e%e$«z ›dae%e$«e%db„e D««z ›«‚dc„Z&ydcc}w)euÞ Regex-based security pattern definitions for the security-guidance plugin. Pure data + one pure helper. No env-var reads, no I/O â€” kept side-effect-free so it can be imported in isolation. Forked verbatim from Anthropic's claude-plugins-official repository (plugins/security-guidance/hooks/patterns.py) under the Apache License 2.0: https://github.com/anthropics/claude-plugins-official Copyright (c) Anthropic, PBC. and the security-guidance contributors Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at http://www.apache.org/licenses/LICENSE-2.0 Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License. Modifications by NousResearch for the Hermes Agent plugin port: - none to the pattern data itself; this file is byte-for-byte the upstream patterns.py at commit 0bde168 (2026-05-26). Hermes-side wiring lives in __init__.py. é)ÚIntEnum) z.jsz.jsxz.tsz.tsxz.mjsz.cjsz.mtsz.ctsz.vuez.svelte)z.pyz.pyiz.ipynb)z.mdz.mdxz.txtz.rstz.jsonú.yamlú.ymluíâš ï¸ Security Warning: Loading pickle data (or equivalents: cPickle, cloudpickle, dill, marshal, shelve, joblib, pandas.read_pickle, numpy with allow_pickle=True) from untrusted sources allows arbitrary code execution. For simple data, prefer JSON or msgspec. For typed objects, prefer a schema-validated deserializer (msgspec.Struct, pydantic, marshmallow) that constructs only declared types. If this is safe or is explicitly needed, briefly document that in a comment before continuing.uŽâš ï¸ Security Warning: yaml.load() / yaml.unsafe_load() execute arbitrary Python via !!python/object tags. Use yaml.safe_load() if the file only contains simple data structures (dicts, lists, strings, numbers). If you need typed objects, parse with safe_load and validate the result against a schema (pydantic, msgspec, marshmallow) â€” never use a custom Loader that constructs arbitrary types.uâš ï¸ Security Warning: torch.load() defaults to weights_only=False, which unpickles arbitrary Python objects and allows arbitrary code execution. If the file only contains tensors and simple data structures, pass weights_only=True (or set TORCH_FORCE_WEIGHTS_ONLY_LOAD=1).Úgithub_actions_workflowcóV—d|vxr$|jd«xs|jd«S)Nz.github/workflows/rr)Úendswith)Úpaths úU/root/.hermes/venv/lib/python3.12/site-packages/plugins/security-guidance/patterns.pyúr8s.€Ð#7¸4Ð#?ò$>Ø ]‰]˜6Ó "Ò < d§m¡m°GÓ&<ðóuJâš ï¸ Security Warning: You are editing a GitHub Actions workflow file. Be aware of these security risks: 1. **Command Injection**: Never use untrusted input (like issue titles, PR descriptions, commit messages) directly in run: commands without proper escaping 2. **Use environment variables**: Instead of ${{ github.event.issue.title }}, use env: with proper quoting 3. **Review the guide**: https://github.blog/security/vulnerability-research/how-to-catch-github-actions-workflow-injections-before-attackers-do/ Example of UNSAFE pattern to avoid: run: echo "${{ github.event.issue.title }}" Example of SAFE pattern: env: TITLE: ${{ github.event.issue.title }} run: echo "$TITLE" Other risky inputs to be careful with: - github.event.issue.body - github.event.pull_request.title - github.event.pull_request.body - github.event.comment.body - github.event.review.body - github.event.review_comment.body - github.event.pages.*.page_name - github.event.commits.*.message - github.event.head_commit.message - github.event.head_commit.author.email - github.event.head_commit.author.name - github.event.commits.*.author.email - github.event.commits.*.author.name - github.event.pull_request.head.ref - github.event.pull_request.head.label - github.event.pull_request.head.repo.default_branch - github.event.client_payload.* (repository_dispatch events â€” attacker can set any field) 4. **Ref injection**: Never use untrusted input in `ref:` parameters of `actions/checkout`. For `client_payload.pr_number`, validate it matches `^[0-9]+$` before using in `ref: refs/pull/${{ ... }}/head` - github.head_ref)ÚruleNameÚ path_checkÚreminderÚchild_process_execcó,—|jt«S©N)rÚ_JS_EXTS©Úps r rrbó€ §¡¬HÓ!5€rzchild_process.execz execSync(z(? o[k], root); for computation use a safe expression parser. NEVER interpolate untrusted strings into new Function() bodies.)r rrÚeval_injectioncó.—|jt«Sr)rÚ _DOC_EXTSrs r rrs€ Q§Z¡Z´ Ó%:Ð!:€rz(?]{0,400}integrity\s*=)[^>]{0,200}src\s*=\s*[\x22\x27](?:https?:)?//[^\x22\x27]{1,300}[\x22\x27][^>]{0,100}>u±âš ï¸ Security Warning: Add integrity="sha384-..." crossorigin="anonymous" to external script tags. Loading scripts without Subresource Integrity exposes you to CDN compromise.Útorch_unsafe_loadzK(?:\btorch\.load|\.torch_load)\s*\((?![^)\n]{0,200}weights_only\s*=\s*True)Úyaml_unsafe_load_variantsz/(?:\byaml\.unsafe_load|\.yaml_unsafe_load)\s*\(Úpickle_wrapper_loadz‹\bjoblib\.load\s*\(|\b(?:pd|pandas)\.read_pickle\s*\(|\.cloudpickle_load\s*\(|\b(?:np|numpy)\.load\s*\([^)\n]{0,200}allow_pickle\s*=\s*Truecót—eZdZdZdZdZdZdZdZdZ dZ d Zd ZdZ dZd ZdZdZdZdZdZdZdZdZdZdZdZdZdZy)ÚRuleIdaf Stable numeric IDs for SECURITY_PATTERNS rules, emitted via the PostToolUse metrics field so telemetry can attribute pattern-warning events to specific checks. The metrics schema only allows bool|number values (no strings), so rule names can't be sent directly. Values are frozen: do not renumber existing entries. Append new ones. ééééééééé é ééé ééééééééééééN)Ú__name__Ú __module__Ú__qualname__Ú__doc__ÚGITHUB_ACTIONS_WORKFLOWÚCHILD_PROCESS_EXECÚNEW_FUNCTION_INJECTIONÚEVAL_INJECTIONÚREACT_DANGEROUSLY_SET_HTMLÚDOCUMENT_WRITE_XSSÚ INNERHTML_XSSÚPICKLE_DESERIALIZATIONÚOS_SYSTEM_INJECTIONÚPYTHON_SUBPROCESS_SHELLÚGO_EXEC_SHELL_INJECTIONÚUNSAFE_YAML_LOADÚNODE_CREATECIPHER_NO_IVÚAES_ECB_MODEÚTLS_VERIFICATION_DISABLEDÚ MARSHAL_LOADSÚSHELVE_OPENÚXML_UNSAFE_PARSEÚPICKLE_VARIANTS_LOADÚ OUTERHTML_XSSÚINSERTADJACENTHTML_XSSÚSCRIPT_SRC_WITHOUT_SRIÚTORCH_UNSAFE_LOADÚYAML_UNSAFE_LOAD_VARIANTSÚPICKLE_WRAPPER_LOAD©rr r9r9s™„ñð ÐØÐØÐØ€NØ!"ÐØÐØ€MØÐØÐØ ÐØ ÐØÐØ ÐØ€LØ "ÐØ€MØ€KØÐØÐØ€MØÐØÐØÐØ "ÐØÑrr9)r0r1r2r3r4r5r6r7r z8RuleId enum out of sync with SECURITY_PATTERNS: missing=c#ó&K—|] }|d–—Œyw©r Nrp©Ú.0rs r ú rucsèø€Ò< Q1Z•=Ñ<ùó‚z, extra=c#ó&K—|] }|d–—Œywrrrprss r rurudsèø€Ò(R¸1¨¨:Ñ(RùrvcóH—d}|D]}|tvsŒ|dt|zz}Œ|S)zÁPack a set of rule names into a bitmask. Bit N set means RuleId(N) matched. User-defined patterns (rule_name starting with "user:") have no static RuleId and are excluded from the mask.rr:)Ú_RULE_NAME_TO_ID)Ú rule_namesÚmaskÚnames r Úrule_names_to_maskr}hs=€ð €DØò0ˆØÔ#Ò#ØAÔ)¨$Ñ/Ñ/Ñ/‰Dð0ð€KrN)'rVÚenumrrr%rÚ _UNSAFE_DESERIALIZATION_REMINDERÚ_UNSAFE_YAML_LOAD_REMINDERÚ_UNSAFE_TORCH_LOAD_REMINDERÚSECURITY_PATTERNSr9rWrXrYrZr[r\r]r^r_r`rarbrcrdrerfrgrhrirjrkrlrmrnroryÚsetr}rs0r úr„sgðñõ:ð]€Ø$€ØE€ ð$bÐ ðdÐðBÐð.ñ>ð"ñ 'ðR)ñ6Ø+¨[Ð9Ø-ðañð2-Ø%Ð&ðeñð%ñ;Ø-ðkñ ð1Ø0Ð1ðzñð)Ø'Ð(ðJñð$Ø% }Ð5ðTñð-ñ6Ø]Ø4ñð*Ù5Ø%Ø.Ð/ðDñð.Ø^ð }ñð&.àEð2ñ ð,'Ø;Ø.ñð.Ø=ð|ñð#ØWðhñð0ðSðBñð$Ø*Ø4ñð"Ø'Ø4ñð'ðbðvñð+ØCØ4ñð$Ø% }Ð5ðXñð-Ø-Ð.ðGñð-ð ð Hñð(ð`Ø/ñð0ðDØ.ñð*ð`Ø4ñðAgÐôT!ˆWô!ðHØ˜v×=Ñ=ðà˜&×3Ñ3ðð˜f×;Ñ;ððf×+Ñ+ð ð ! &×"CÑ"Cðð˜&×3Ñ3ð ðV×)Ñ)ðð˜f×;Ñ;ðð˜6×5Ñ5ðð˜v×=Ñ=ðð˜v×=Ñ=ðð˜×/Ñ/ðð˜v×=Ñ=ððF×'Ñ'ðð ×!AÑ!Aðð V×)Ñ)ð!ð"6×%Ñ%ð#ð$×/Ñ/Ø"×7Ñ7Ø×)Ñ)Ø$×;Ñ;Ø$×;Ñ;Ø×1Ñ1Ø!'×!AÑ!AØ!×5Ñ5ò3Ðñ<ÐÓÐ8IÖ J°1 :£Ò JÒJððÙÑ<Ð*;Ô<Ó<¹sÐCSÓ?TÑTÐUðV Ù Ð!Ó "¡SÑ(RÐ@QÔ(RÓ%RÑ RÐSðUóÐJóùò!KsÇ:I