Detect Docker host-control exposure in agent configs

README.md

@@ -107,7 +107,7 @@ Full methodology, source attribution, and raw output are in [`research/FINDINGS.
 ## Trust signals
 
 - **4.0 MB** release binary
-- **267/267 tests passing**
+- **273/273 tests passing**
 - **0 clippy warnings** with `-D warnings`
 - **0 known Rust dependency vulnerabilities** (`cargo audit`)
 
@@ -198,7 +198,7 @@ Reports also include a remediation priority section. It groups findings into fix
 
 ## Detection Rules
 
-12 built-in rules, covering misconfigurations, known CVEs, and supply chain risks:
+13 built-in rules, covering misconfigurations, known CVEs, host-control exposure, and supply chain risks:
 
 | ID | Rule | Severity |
 |----|------|----------|
@@ -214,6 +214,7 @@ Reports also include a remediation priority section. It groups findings into fix
 | AW-010 | Prompt injection surface | Medium |
 | AW-011 | Supply chain risk signals | High/Medium |
 | AW-012 | Deep dependency chain (deps.dev) | High/Medium |
+| AW-013 | Docker socket or privileged host controls | Critical/High |
 
 ## Live Mode
 

src/baseline.rs

@@ -256,8 +256,11 @@ mod tests {
     use super::*;
     use crate::rules::Severity;
     use chrono::Duration;
+    use std::sync::atomic::{AtomicU64, Ordering};
     use std::time::{SystemTime, UNIX_EPOCH};
 
+    static TEMP_COUNTER: AtomicU64 = AtomicU64::new(0);
+
     fn finding(rule_id: &str, server_name: &str) -> Finding {
         Finding {
             rule_id: rule_id.to_string(),
@@ -278,7 +281,13 @@ mod tests {
             .duration_since(UNIX_EPOCH)
             .unwrap()
             .as_nanos();
-        let dir = std::env::temp_dir().join(format!("agentwise-baseline-test-{}", nanos));
+        let unique = TEMP_COUNTER.fetch_add(1, Ordering::Relaxed);
+        let dir = std::env::temp_dir().join(format!(
+            "agentwise-baseline-test-{}-{}-{}",
+            std::process::id(),
+            nanos,
+            unique
+        ));
         std::fs::create_dir_all(&dir).unwrap();
         dir
     }