Build a deterministic bounded scanner for contextual repository risk #28

Goal

Build a deterministic, read-only, bounded scanner that flags contextual risk (prompt-injection heuristics, not a guarantee) across scripts, hooks, actions, invisible unicode, and encoded payloads.

Observations

• Baseline gitleaks already covers secret keys; B06 adds contextual risk analysis, not a duplicate scanner.
• Prompt-injection heuristics reduce risk but cannot guarantee detection.
• The scanner must be read-only and bounded in time and output.

Decision gate

Approve scope, bounds, and confidence reporting before implementing detection rules.

Acceptance criteria

• The scanner is read-only and bounded by explicit time and size limits.
• Checks cover scripts, hooks, actions, invisible unicode, and encoded payloads with context.
• Findings carry path and confidence, never a bare pass/fail.

Verification

• Scan of a benign tree -> exit 0 with no findings.
• Scan with a known encoded-payload fixture -> a finding with path and confidence.

Release checkpoint

Remaining risk: heuristics have false negatives; tests must not claim 100% malware detection or an unconditional LLM pass/fail.

Tracking

Roadmap item: B06-01. All acceptance criteria remain pending; publication does not grant approval or release authority.

Dependencies

• Depends on Pin CI tools and workflows to verified immutable SHAs with least privilege #13 (B01-01).