Repository navigation
A rule pack for Cisco's open-source Project Quarry (Apache-2.0, alpha; checked against Quarry 0.1.0 at eadc6e3), in quarry/:
- 21 single-surface rules translated from MoorAI agent detector patterns (credential formats, prompt-injection and exfiltration phrasing, injected tool results, reverse shells, credential file access, untrusted installs, destructive and security-setting commands, outbound messaging), each with description, severity, MITRE ATLAS id and moorai_threat.
- 3 flow rules for Quarry's engine (private read then network, the lethal trifecta order, poisoned tool descriptions) in quarry/rules/flow/.
- Positive and negative example conversations in Quarry's data layout. Quarry's own CLI validated all 24 rules, and its scan agreed with the expected verdicts on all 49 files.
- 9 rules carry moorai_mode and import into MoorAI policy through the console's Quarry import (console v0.102.0); the other 12 already run as built-in detectors on every MoorAI agent.
Also: README, NOTICE, corpora/README and the Hugging Face card now state the MoorAI agent's license correctly (MIT).