We Turned a Dependency Audit Into New ClawMoat Detections

We ran a dependency vulnerability scan on one of our repos and found the usual suspects — tar, minimatch, PyJWT, axios, urllib3. Most teams patch and move on. We did something different: turned every CVE into a ClawMoat detection pattern. The logic is simple. If a real dependency shipped this vulnerability, real attackers know about it. If an AI agent processes untrusted content, that content might contain these attack patterns. ClawMoat should catch them. Here's what we added: 1. Prototype Pollution (__proto__ injection) CVE family: axios mergeConfig, lodash merge An attacker sends JSON like {"__proto__": {"admin": true}} to a vulnerable library. If an AI agent is told to process or forward such content, it could corrupt the prototype chain of the host application. ClawMoat now detects: {"__proto__": {"isAdmin": true}} {"constructor": {"prototype": {"role": "admin"}}} 2. ReDoS via Nested Extglobs CVE family: minimatch GHSA-952p-6rrq-rcjv, GHSA-f8q6-p94x-37v3 The minimatch library cata