feat: host audit and clipboard exfil detection (am-i-compromised 1.2.0)

.gitignore

@@ -17,6 +17,10 @@ coverage/
 */package-lock.json
 *test/.bats/run-logs/
 
+# python
+__pycache__/
+*.pyc
+
 # scratch file that should never be committed
 */test.bats
 */test2/

README.md

@@ -23,6 +23,7 @@ Dev-time security tools for detecting compromised code, dependencies, and supply
 | Package | Description |
 | --- | --- |
 | [`am-i-compromised`](apps/am-i-compromised/README.md) | Compromise scanner - checks for malicious code and compromised files. Publishes to npm. |
+| [`am-i-being-recorded`](apps/am-i-being-recorded/README.md) | Local capture-surface audit - names the browser extension behind a screen-recording indicator. |
 | [`secure-semgrep`](apps/secure-semgrep/README.md) | Bundled Semgrep rules + loadout packs for AI-agent, bash & web security scans. Publishes to npm. |
 
 ## Requirements
@@ -72,6 +73,8 @@ commit.
 - `apps/am-i-compromised/` — the npm package (see its [README](apps/am-i-compromised/README.md))
 - `apps/am-i-compromised/test/__security_gate_fixtures__/` — quarantined malware samples used to
   test the scanner (**never execute or import these**)
+- `apps/am-i-being-recorded/` — local capture-surface audit (see its
+  [README](apps/am-i-being-recorded/README.md))
 - `.github/workflows/` — CI: checks + security gate + gitleaks secret scan + dependency review
   + CodeAnt AI scan (opt-in via repository variable)
 - `mise.toml` — tool versions and tasks, shared by local dev and CI

apps/am-i-being-recorded/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Isaac Bell
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

apps/am-i-being-recorded/README.md

@@ -0,0 +1,116 @@
+# am-i-being-recorded
+
+[![License: MIT](https://img.shields.io/badge/License-MIT-yellow.svg)](LICENSE)
+[![CI](https://github.com/IsaacBell/secure-devtools/actions/workflows/ci.yml/badge.svg)](https://github.com/IsaacBell/secure-devtools/actions/workflows/ci.yml)
+
+Find out **which browser extension is recording your screen** — and what else on
+the machine can capture you.
+
+The sibling of [`am-i-compromised`](https://www.npmjs.com/package/am-i-compromised):
+that one audits your *code*, this one audits your *machine*.
+
+macOS attributes an active capture to the *application*, never the tab or
+extension responsible. A purple indicator that says "Brave Browser is recording
+your screen" is accurate but not actionable. This tool turns that attribution
+back into a name.
+
+## What it checks
+
+**Browser extensions (macOS and Linux).** Reads Chromium-family profile
+directories (Brave, Chrome, Chromium, Edge, Vivaldi) and flags extensions whose
+permissions allow display capture, tab capture, or deep browser control:
+
+| Permission | Severity | Why it matters |
+| --- | --- | --- |
+| `desktopCapture` | CRITICAL | Can record the entire display |
+| `tabCapture` | HIGH | Can record the active tab's audio/video |
+| `debugger` | HIGH | Full tab control over the DevTools protocol |
+| `nativeMessaging` | MEDIUM | Can launch a native helper process |
+| `userScripts` | MEDIUM | Can inject arbitrary scripts into pages |
+| `management` | LOW | Can enable or disable other extensions |
+
+Two combinations escalate:
+
+- `desktopCapture` + access to every site (`<all_urls>`) — recordings can
+  include any page you visit.
+- any capture permission + `offscreen` — the stream can outlive the tab or
+  window that requested it, which is the shape of a "stuck" indicator.
+
+Only the newest installed version of an extension is reported once per profile;
+Chromium leaves older version directories behind, and they are not loaded.
+
+**Live context (not findings).** On macOS: whether `screensharingd` and
+`replayd` are running, and which apps hold camera/microphone/screen-recording
+grants in the TCC privacy database. On Linux: which process holds a camera
+device. These lines are context for a human; findings come only from extension
+capabilities, so there is no "known good app" allowlist to maintain.
+
+## Requirements
+
+| Dependency | Needed for | Install |
+| --- | --- | --- |
+| `bash` 4+ | running the tool | preinstalled on macOS/Linux |
+| `jq` | reading extension manifests | `brew install jq` / `apt-get install jq` |
+| `sqlite3` | macOS TCC grants (optional) | preinstalled on macOS |
+| `lsof` | Linux camera holders (optional) | preinstalled on most distros |
+
+## Usage
+
+```sh
+# Audit every detected browser profile on this machine
+am-i-being-recorded
+
+# Only the loud stuff
+am-i-being-recorded --min-severity HIGH
+
+# Gate mode: non-zero exit when anything at or above the floor is found
+am-i-being-recorded --strict
+
+# Scan a fixture tree instead of the live profiles (used by the tests)
+am-i-being-recorded --root ./fixtures --no-live
+```
+
+Findings are severity-tagged and printed highest first. The default mode is
+**evidence**: findings are reported and the exit status stays `0`. `--strict`
+turns any reported finding into exit status `1`.
+
+## Reading the output
+
+A stuck capture is usually an extension holding a display stream. The finding
+that explains the indicator names the extension, its ID, its version, and the
+profile it lives in:
+
+```text
+  CRITICAL Awesome Screen Recorder & Screenshot (nlipoenfbbikpbjkfpfillcgkoblgpmj) v4.4.44
+           BraveSoftware/Brave-Browser/Default - Can capture the entire display (screen recording)
+  HIGH     Awesome Screen Recorder & Screenshot (nlipoenfbbikpbjkfpfillcgkoblgpmj) v4.4.44
+           BraveSoftware/Brave-Browser/Default - Capture permission plus an offscreen document can outlive the visible tab
+```
+
+To stop the capture, disable or remove that extension in `brave://extensions`
+(or `chrome://extensions`), then restart the browser so the indicator clears.
+An extension installed in several profiles shows up once per profile.
+
+## Limitations
+
+- The extension pass reports *capability*, not proof of an active stream. A
+  screen recorder you installed and use on purpose will (correctly) be flagged.
+- Live context is best-effort. macOS Screen Recording grants need root or Full
+  Disk Access to read; the TCC schema is undocumented and may change. The tool
+  says so instead of guessing.
+- Detection covers Chromium-family extensions. Safari and Firefox extensions,
+  standalone recorder apps, and a page's own `getDisplayMedia` prompt are out of
+  scope.
+- This is not a malware scanner. Treat it as triage that names a suspect.
+
+## Development
+
+```sh
+pnpm test          # bats test suite
+pnpm lint          # shellcheck
+pnpm format:check  # shfmt
+pnpm check         # all of the above
+```
+
+The test suite drives the filesystem pass against synthetic profile trees, so
+it runs without touching the host's real browser data and passes on Linux CI.