Skip to content

v0.10.0 - secret scan window

Choose a tag to compare

View all tags
@AGGIB AGGIB released this 08 Sep 07:59
· 6 commits to main since this release
v0.10.0
1b5506b

Stroq 0.10.0 — secret scan window

Closes a padding bypass of the secret egress guard that affected every adapter: the guard scanned only the first 256 KiB of a tool input, so an agent could exfiltrate a known secret by padding the arguments of an allowed network command, fetch or MCP call. Found by the MCP proxy review; fixed in core for hooks and proxy alike.

Changed

  • The secret egress guard scans the whole tool input in 256 KiB windows (4 KiB overlap) up to 2 MiB, with a per-window candidate cap that never decides what is looked up.
  • New action class secret.unscannable and default rule deny-secret-unscannable: an egress-shaped action whose input exceeds 2 MiB is denied, not partially scanned. Custom policy.yaml files should carry the rule; stroq attack fails without it.
  • stroq attack gains scenario 13, 13-padded-secret-exfil: 13 scenarios, 9 blocked, 4 asked, 0 passed through.
  • The MCP proxy refuses tools/call arguments above 2 MiB (was 256 KiB), in front of the engine's own deny.

Limits

Inline payloads above 2 MiB in an egress action are refused; use a file path instead. WebFetch scans url and prompt only. Tool results keep their own 200 000-character scan clip.

Install

npm install -g @stroq/cli@0.10.0   # once npm's review clears; until then:
npm install -g https://github.com/AGGIB/Stroq/releases/download/v0.10.0/stroq-cli-0.10.0.tgz

stroq-cli-0.10.0.tgz sha256: e19868334d72ee301f2b9e1058847649bb19bcf0166fe1a6860bcd9453172d6d

stroq attack: 13 scenarios, 9 blocked, 4 asked, 0 passed through.

Assets 3
Loading