feat(rules): add AI600-AI900 security rules for agents, RAG, API keys, and output handling

[mmustafasenoglu]

Summary

Adds 18 new AI/LLM security rules covering understimated attack surfaces: unsafe agent behavior, RAG pipeline security, hardcoded API keys, and unsafe output handling.

Motivation

Closes #91

The existing ruleset covers prompt injection and model deserialization well, but modern LLM applications have expanded attack surfaces that weren't being caught. This adds coverage for:

Changes

AI600 - Unsafe Agent Behavior & Tool Poisoning

• AI601: Unrestricted web browsing in agents (SSRF risk)
• AI602: Subprocess execution via agent tools (arbitrary command execution)
• AI603: Unrestricted file write capability in agents
• AI604: Indirect prompt injection via unsanitized tool output
• AI605: Verbose agent logging exposing sensitive data
• AI606: Disabled parsing error handling leaking internal state

AI700 - RAG Security

• AI701: Unvalidated document ingestion (embedding poisoning)
• AI702: Low similarity threshold retrieving adversarial content
• AI703: Context injection without size limits (DoS)
• AI704: Embedding models from untrusted sources

AI800 - API Key & Credential Management

• AI801: Hardcoded OpenAI API keys
• AI802: Hardcoded Anthropic API keys
• AI803: API keys in URL query parameters
• AI804: Hardcoded Cohere API keys

AI900 - Output Handling & DoS

• AI901: Unsafe YAML parsing of LLM output (RCE via yaml.load)
• AI902: JSON parsing without size limits (memory exhaustion)
• AI903: exec/eval of LLM-generated code
• AI904: Unsanitized LLM output rendered as HTML (XSS)

Also adds 4 new taint sources/sinks (AITS11-12, AISK11-12) for RAG vector store retrieval and agent web tool flows.

Testing

• All new rules have TOML metadata validation
• Pattern matching tests for each rule category
• Exclude pattern tests for safe alternatives (e.g., yaml.safe_load)
• TOML file validates successfully (44 total rules, 12 taint sources, 12 sinks)

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.