fetchguard

{
  "name": "fetchguard",
  "version": "0.1.2",
  "description": "v0.1.2: DISCLOSES A PROTECTION GAP — doc-only, no logic change, and the gap is NOT closed by this version. Through 0.1.1 this crate was explicitly one half of a pair: it scans WHAT web-tool output says, and `taintguard` tracked WHERE content came from, downgrading write-class tools for the rest of a turn that had read something external. taintguard was removed from the repository on 2026-08-24 by user ruling. Its half is gone and was not reassigned, so: external-file `Read` (a path outside the project) now produces NO provenance signal and NO content scan, and nothing restricts the turn afterwards; and this crate's own enforcement is only an `additionalContext` warning — it downgrades and denies nothing. The prose that said the Read surface was \"deferred to taintguard's provenance gate\" (`gate.rs`'s fail-closed contract and `WEB_TOOLS`'s docstring) said the surface was covered elsewhere, which is now false; both, plus README.ja.md and the `scan`/`main` module docs, now state the surface is covered by nothing. Recorded as an open gap so it is visible rather than silently inherited. Runtime content-level injection scanner: a PostToolUse hook (matcher WebFetch|WebSearch) that scans the tool_response text for planted prompt-injection phrasings (concealment / verification-bypass / instruction-override / egress) and, on a hit or an undecidable response, injects additionalContext telling the model the flagged span is untrusted DATA whose embedded directives must NOT be followed.",
  "author": {
    "name": "yukineko"
  },
  "keywords": [
    "security",
    "hooks",
    "prompt-injection",
    "rust"
  ]
}