{ "skill_name": "building-inferencesh-apps", "skill_path": "/Users/brianlevine/claude-projects/skill-scanner-test/skills/magentosh-superpowers/sdk/building-apps", "is_safe": false, "max_severity": "HIGH", "findings_count": 8, "findings": [ { "id": "MANIFEST_MISSING_LICENSE_c5ae9be793", "rule_id": "MANIFEST_MISSING_LICENSE", "category": "policy_violation", "severity": "INFO", "title": "Skill does not specify a license", "description": "Skill manifest does not include a 'license' field. Specifying a license helps users understand usage terms.", "file_path": "SKILL.md", "line_number": null, "snippet": null, "remediation": "Add 'license' field to SKILL.md frontmatter (e.g., MIT, Apache-2.0)", "analyzer": "static", "metadata": { "aitech": null, "aitech_name": null, "aisubtech": null, "aisubtech_name": null, "aitech_mappings": [], "aisubtech_mappings": [], "framework_mappings": [], "taxonomy_status": "not_applicable", "taxonomy_source": "rule" } }, { "id": "PIPELINE_TAINT_3c8f394f95", "rule_id": "PIPELINE_TAINT_FLOW", "category": "data_exfiltration", "severity": "HIGH", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://cli.inference.sh | sh`. This is a remote code execution pattern.", "file_path": "SKILL.md", "line_number": 1, "snippet": "curl -fsSL https://cli.inference.sh | sh", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution.", "analyzer": "pipeline", "metadata": { "pipeline": "curl -fsSL https://cli.inference.sh | sh", "source_taints": [ "NETWORK_DATA" ], "sink_command": "sh", "chain_length": 2, "in_documentation": false, "behavior_category": "command_injection", "semantic_facts": { "evidence_kind": "command_pipeline", "evidence_value_class": "untrusted_fetch_execute", "evidence_count": 2, "context_kind": "instruction", "signal_kind": "taint_flow", "commands": [ { "executable": "curl", "argument_classes": [ "script_path", "url" ], "downloads": true, "executes": false, "destructive": false, "privilege_change": false, "source_class": "network", "sink_class": "", "file_path": "SKILL.md" }, { "executable": "sh", "argument_classes": [], "downloads": false, "executes": true, "destructive": false, "privilege_change": false, "source_class": "", "sink_class": "execution", "file_path": "SKILL.md" } ], "urls": [ { "scheme": "https", "host": "cli.inference.sh", "domain_class": "public", "trusted_installer": false, "method": "GET", "direction": "inbound", "file_path": "SKILL.md" } ], "flows": [ { "source_class": "network", "sink_class": "execution", "transforms": [], "cross_file": false, "source_path": "SKILL.md", "sink_path": "SKILL.md" } ], "candidate_command": { "executable": "sh", "argument_classes": [], "downloads": false, "executes": true, "destructive": false, "privilege_change": false, "source_class": "", "sink_class": "execution", "file_path": "SKILL.md" }, "candidate_flow": { "source_class": "network", "sink_class": "execution", "transforms": [], "cross_file": false, "source_path": "SKILL.md", "sink_path": "SKILL.md" }, "candidate_url": { "scheme": "https", "host": "cli.inference.sh", "domain_class": "public", "trusted_installer": false, "method": "GET", "direction": "inbound", "file_path": "SKILL.md" } }, "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "CORRELATED_NETWORK_EXECUTION_FLOW_0d8957b69e5c", "rule_id": "CORRELATED_NETWORK_EXECUTION_FLOW", "category": "command_injection", "severity": "MEDIUM", "title": "Network-derived content reaches code execution", "description": "Correlated network \u2192 code_execution behavior across SKILL.md.", "file_path": "SKILL.md", "line_number": 24, "snippet": null, "remediation": "Verify downloaded content cryptographically and never pass network data to a dynamic interpreter.", "analyzer": "correlation", "metadata": { "files_involved": [ "SKILL.md" ], "semantic_facts": { "evidence_kind": "fenced_code_flow", "context_kind": "code", "commands": [ { "executable": "curl", "argument_classes": [ "request_method", "destination_declared_service" ], "downloads": true, "executes": false, "destructive": false, "privilege_change": false, "source_class": "network", "sink_class": "network", "file_path": "SKILL.md" }, { "executable": "sh", "argument_classes": [ "literal" ], "downloads": false, "executes": true, "destructive": false, "privilege_change": false, "source_class": "", "sink_class": "code_execution", "file_path": "SKILL.md" } ], "urls": [ { "url": "https://cli.inference.sh", "scheme": "https", "host": "cli.inference.sh", "domain_class": "external", "trusted_installer": false, "method": "get", "direction": "inbound", "file_path": "SKILL.md" } ], "flows": [ { "source_class": "network", "sink_class": "code_execution", "transforms": [], "cross_file": false, "source_path": "SKILL.md", "sink_path": "SKILL.md" } ], "reference_edges": [], "signals": [ { "rule_id": "CORRELATION_SIGNAL", "kind": "correlated_behavior", "file_path": "SKILL.md", "value_class": "network" }, { "rule_id": "CORRELATION_SIGNAL", "kind": "fenced_code_language", "file_path": "SKILL.md", "value_class": "bash" }, { "rule_id": "CORRELATION_SIGNAL", "kind": "file_role", "file_path": "SKILL.md", "value_class": "documented_installer" } ], "candidate_flow": { "source_class": "network", "sink_class": "code_execution", "transforms": [], "cross_file": false, "source_path": "SKILL.md", "sink_path": "SKILL.md" } }, "aitech": "AITech-9.1", "aitech_name": "Model or Agentic System Manipulation", "aisubtech": "AISubtech-9.1.1", "aisubtech_name": "Code Execution", "aitech_mappings": [ "OWASP: LLM04:2026: Supply Chain", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "OWASP: ASI05: Unexpected Code Execution (RCE)", "MITRE ATLAS: AML.T0050: Command and Scripting Interpreter", "NIST AML: NISTAML.023: Backdoor Poisoning", "Cisco AI MDL Code: MDL-006", "Cisco AI MDL Code: MDL-007", "Cisco AI MDL Code: MDL-005", "Cisco AI MDL Code: MDL-010", "Cisco AI MDL Code: MDL-012", "Cisco AI MDL Code: MDL-014", "Cisco AI MDL Code: MDL-015", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM04:2026: Supply Chain", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "OWASP: ASI05: Unexpected Code Execution (RCE)", "MITRE ATLAS: AML.T0050: Command and Scripting Interpreter", "NIST AML: NISTAML.023: Backdoor Poisoning" ], "framework_mappings": [ "OWASP: LLM04:2026: Supply Chain", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "OWASP: ASI05: Unexpected Code Execution (RCE)", "MITRE ATLAS: AML.T0050: Command and Scripting Interpreter", "NIST AML: NISTAML.023: Backdoor Poisoning" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "PIPELINE_TAINT_934cd3801e", "rule_id": "PIPELINE_TAINT_FLOW", "category": "data_exfiltration", "severity": "LOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://cli.inference.sh | sh`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "file_path": "references/cli.md", "line_number": 1, "snippet": "curl -fsSL https://cli.inference.sh | sh", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution.", "analyzer": "pipeline", "metadata": { "pipeline": "curl -fsSL https://cli.inference.sh | sh", "source_taints": [ "NETWORK_DATA" ], "sink_command": "sh", "chain_length": 2, "in_documentation": true, "behavior_category": "command_injection", "semantic_facts": { "evidence_kind": "command_pipeline", "evidence_value_class": "untrusted_fetch_execute", "evidence_count": 2, "context_kind": "documentation", "signal_kind": "taint_flow", "commands": [ { "executable": "curl", "argument_classes": [ "script_path", "url" ], "downloads": true, "executes": false, "destructive": false, "privilege_change": false, "source_class": "network", "sink_class": "", "file_path": "references/cli.md" }, { "executable": "sh", "argument_classes": [], "downloads": false, "executes": true, "destructive": false, "privilege_change": false, "source_class": "", "sink_class": "execution", "file_path": "references/cli.md" } ], "urls": [ { "scheme": "https", "host": "cli.inference.sh", "domain_class": "public", "trusted_installer": false, "method": "GET", "direction": "inbound", "file_path": "references/cli.md" } ], "flows": [ { "source_class": "network", "sink_class": "execution", "transforms": [], "cross_file": false, "source_path": "references/cli.md", "sink_path": "references/cli.md" } ], "candidate_command": { "executable": "sh", "argument_classes": [], "downloads": false, "executes": true, "destructive": false, "privilege_change": false, "source_class": "", "sink_class": "execution", "file_path": "references/cli.md" }, "candidate_flow": { "source_class": "network", "sink_class": "execution", "transforms": [], "cross_file": false, "source_path": "references/cli.md", "sink_path": "references/cli.md" }, "candidate_url": { "scheme": "https", "host": "cli.inference.sh", "domain_class": "public", "trusted_installer": false, "method": "GET", "direction": "inbound", "file_path": "references/cli.md" } }, "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "PIPELINE_TAINT_bbf74e5162", "rule_id": "PIPELINE_TAINT_FLOW", "category": "data_exfiltration", "severity": "HIGH", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -LsSf https://astral.sh/uv/install.sh | sh`. This is a remote code execution pattern. (Note: source host is listed as an installer endpoint, but artifact integrity was not verified.)", "file_path": "references/cli.md", "line_number": 2, "snippet": "curl -LsSf https://astral.sh/uv/install.sh | sh", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution.", "analyzer": "pipeline", "metadata": { "pipeline": "curl -LsSf https://astral.sh/uv/install.sh | sh", "source_taints": [ "NETWORK_DATA" ], "sink_command": "sh", "chain_length": 2, "in_documentation": true, "behavior_category": "command_injection", "semantic_facts": { "evidence_kind": "command_pipeline", "evidence_value_class": "untrusted_fetch_execute", "evidence_count": 2, "context_kind": "documentation", "signal_kind": "taint_flow", "commands": [ { "executable": "curl", "argument_classes": [ "script_path", "url" ], "downloads": true, "executes": false, "destructive": false, "privilege_change": false, "source_class": "network", "sink_class": "", "file_path": "references/cli.md" }, { "executable": "sh", "argument_classes": [], "downloads": false, "executes": true, "destructive": false, "privilege_change": false, "source_class": "", "sink_class": "execution", "file_path": "references/cli.md" } ], "urls": [ { "scheme": "https", "host": "astral.sh", "domain_class": "known_installer", "trusted_installer": true, "method": "GET", "direction": "inbound", "file_path": "references/cli.md" } ], "flows": [ { "source_class": "network", "sink_class": "execution", "transforms": [], "cross_file": false, "source_path": "references/cli.md", "sink_path": "references/cli.md" } ], "candidate_command": { "executable": "sh", "argument_classes": [], "downloads": false, "executes": true, "destructive": false, "privilege_change": false, "source_class": "", "sink_class": "execution", "file_path": "references/cli.md" }, "candidate_flow": { "source_class": "network", "sink_class": "execution", "transforms": [], "cross_file": false, "source_path": "references/cli.md", "sink_path": "references/cli.md" }, "candidate_url": { "scheme": "https", "host": "astral.sh", "domain_class": "known_installer", "trusted_installer": true, "method": "GET", "direction": "inbound", "file_path": "references/cli.md" } }, "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "PIPELINE_TAINT_bbf74e5162", "rule_id": "PIPELINE_TAINT_FLOW", "category": "data_exfiltration", "severity": "LOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -fsSL https://fnm.vercel.app/install | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "file_path": "references/cli.md", "line_number": 2, "snippet": "curl -fsSL https://fnm.vercel.app/install | bash", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution.", "analyzer": "pipeline", "metadata": { "pipeline": "curl -fsSL https://fnm.vercel.app/install | bash", "source_taints": [ "NETWORK_DATA" ], "sink_command": "bash", "chain_length": 2, "in_documentation": true, "behavior_category": "command_injection", "semantic_facts": { "evidence_kind": "command_pipeline", "evidence_value_class": "untrusted_fetch_execute", "evidence_count": 2, "context_kind": "documentation", "signal_kind": "taint_flow", "commands": [ { "executable": "curl", "argument_classes": [ "url" ], "downloads": true, "executes": false, "destructive": false, "privilege_change": false, "source_class": "network", "sink_class": "", "file_path": "references/cli.md" }, { "executable": "bash", "argument_classes": [], "downloads": false, "executes": true, "destructive": false, "privilege_change": false, "source_class": "", "sink_class": "execution", "file_path": "references/cli.md" } ], "urls": [ { "scheme": "https", "host": "fnm.vercel.app", "domain_class": "public", "trusted_installer": false, "method": "GET", "direction": "inbound", "file_path": "references/cli.md" } ], "flows": [ { "source_class": "network", "sink_class": "execution", "transforms": [], "cross_file": false, "source_path": "references/cli.md", "sink_path": "references/cli.md" } ], "candidate_command": { "executable": "bash", "argument_classes": [], "downloads": false, "executes": true, "destructive": false, "privilege_change": false, "source_class": "", "sink_class": "execution", "file_path": "references/cli.md" }, "candidate_flow": { "source_class": "network", "sink_class": "execution", "transforms": [], "cross_file": false, "source_path": "references/cli.md", "sink_path": "references/cli.md" }, "candidate_url": { "scheme": "https", "host": "fnm.vercel.app", "domain_class": "public", "trusted_installer": false, "method": "GET", "direction": "inbound", "file_path": "references/cli.md" } }, "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "PIPELINE_TAINT_bb3baa302a", "rule_id": "PIPELINE_TAINT_FLOW", "category": "data_exfiltration", "severity": "LOW", "title": "Dangerous data flow in command pipeline", "description": "Pipeline downloads data from the network and executes it: `curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash`. This is a remote code execution pattern. (Note: found in documentation file - may be instructional rather than executable.)", "file_path": "references/cli.md", "line_number": 6, "snippet": "curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash", "remediation": "Review the command pipeline. Avoid piping sensitive data to network commands or shell execution.", "analyzer": "pipeline", "metadata": { "pipeline": "curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.0/install.sh | bash", "source_taints": [ "NETWORK_DATA" ], "sink_command": "bash", "chain_length": 2, "in_documentation": true, "behavior_category": "command_injection", "semantic_facts": { "evidence_kind": "command_pipeline", "evidence_value_class": "untrusted_fetch_execute", "evidence_count": 2, "context_kind": "documentation", "signal_kind": "taint_flow", "commands": [ { "executable": "curl", "argument_classes": [ "script_path", "url" ], "downloads": true, "executes": false, "destructive": false, "privilege_change": false, "source_class": "network", "sink_class": "", "file_path": "references/cli.md" }, { "executable": "bash", "argument_classes": [], "downloads": false, "executes": true, "destructive": false, "privilege_change": false, "source_class": "", "sink_class": "execution", "file_path": "references/cli.md" } ], "urls": [ { "scheme": "https", "host": "raw.githubusercontent.com", "domain_class": "known_installer", "trusted_installer": true, "method": "GET", "direction": "inbound", "file_path": "references/cli.md" } ], "flows": [ { "source_class": "network", "sink_class": "execution", "transforms": [], "cross_file": false, "source_path": "references/cli.md", "sink_path": "references/cli.md" } ], "candidate_command": { "executable": "bash", "argument_classes": [], "downloads": false, "executes": true, "destructive": false, "privilege_change": false, "source_class": "", "sink_class": "execution", "file_path": "references/cli.md" }, "candidate_flow": { "source_class": "network", "sink_class": "execution", "transforms": [], "cross_file": false, "source_path": "references/cli.md", "sink_path": "references/cli.md" } }, "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "COMPOUND_FETCH_EXECUTE_6d3cf64691", "rule_id": "COMPOUND_FETCH_EXECUTE", "category": "command_injection", "severity": "MEDIUM", "title": "Remote fetch followed by execution", "description": "Content is downloaded from the network and subsequently executed. This is a classic remote code execution attack pattern. (found in documentation \u2014 may be instructional) (installer endpoint configured; artifact integrity not verified)", "file_path": "references/cli.md", "line_number": 8, "snippet": "# macOS / Linux\ncurl -LsSf https://astral.sh/uv/install.sh | sh\n\n# Windows\npowershell -ExecutionPolicy ByPass -c \"irm https://astral.sh/uv/install.ps1 | iex\"\n", "remediation": "Review the command sequence for potential multi-step attacks. Ensure all steps are necessary and safe.", "analyzer": "pipeline", "metadata": { "pattern": "COMPOUND_FETCH_EXECUTE", "matched_lines": [ 1, 4 ], "in_documentation": true, "semantic_facts": { "evidence_kind": "command_sequence", "context_kind": "documentation", "signal_kind": "compound_flow", "commands": [ { "executable": "curl", "argument_classes": [ "script_path", "url" ], "downloads": true, "executes": false, "destructive": false, "privilege_change": false, "source_class": "network", "sink_class": "", "file_path": "references/cli.md" }, { "executable": "powershell", "argument_classes": [ "url" ], "downloads": false, "executes": false, "destructive": false, "privilege_change": false, "source_class": "", "sink_class": "", "file_path": "references/cli.md" } ], "urls": [ { "scheme": "https", "host": "astral.sh", "domain_class": "known_installer", "trusted_installer": true, "method": "GET", "direction": "inbound", "file_path": "references/cli.md" }, { "scheme": "https", "host": "astral.sh", "domain_class": "known_installer", "trusted_installer": true, "method": "", "direction": "reference", "file_path": "references/cli.md" } ], "flows": [ { "source_class": "network", "sink_class": "execution", "transforms": [], "cross_file": false, "source_path": "references/cli.md", "sink_path": "references/cli.md" } ], "candidate_flow": { "source_class": "network", "sink_class": "execution", "transforms": [], "cross_file": false, "source_path": "references/cli.md", "sink_path": "references/cli.md" }, "evidence_value_class": "untrusted_fetch_execute", "evidence_count": 2, "candidate_command": { "executable": "powershell", "argument_classes": [ "url" ], "downloads": false, "executes": false, "destructive": false, "privilege_change": false, "source_class": "", "sink_class": "", "file_path": "references/cli.md" }, "candidate_url": { "scheme": "https", "host": "astral.sh", "domain_class": "known_installer", "trusted_installer": true, "method": "GET", "direction": "inbound", "file_path": "references/cli.md" } }, "aitech": "AITech-9.1", "aitech_name": "Model or Agentic System Manipulation", "aisubtech": "AISubtech-9.1.1", "aisubtech_name": "Code Execution", "aitech_mappings": [ "OWASP: LLM04:2026: Supply Chain", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "OWASP: ASI05: Unexpected Code Execution (RCE)", "MITRE ATLAS: AML.T0050: Command and Scripting Interpreter", "NIST AML: NISTAML.023: Backdoor Poisoning", "Cisco AI MDL Code: MDL-006", "Cisco AI MDL Code: MDL-007", "Cisco AI MDL Code: MDL-005", "Cisco AI MDL Code: MDL-010", "Cisco AI MDL Code: MDL-012", "Cisco AI MDL Code: MDL-014", "Cisco AI MDL Code: MDL-015", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM04:2026: Supply Chain", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "OWASP: ASI05: Unexpected Code Execution (RCE)", "MITRE ATLAS: AML.T0050: Command and Scripting Interpreter", "NIST AML: NISTAML.023: Backdoor Poisoning" ], "framework_mappings": [ "OWASP: LLM04:2026: Supply Chain", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "OWASP: ASI05: Unexpected Code Execution (RCE)", "MITRE ATLAS: AML.T0050: Command and Scripting Interpreter", "NIST AML: NISTAML.023: Backdoor Poisoning" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } } ], "scan_duration_seconds": 0.06967496871948242, "duration_ms": 69, "analyzers_used": [ "static_analyzer", "bytecode", "pipeline", "correlation", "behavioral_analyzer", "trigger_analyzer" ], "timestamp": "2026-10-22T04:35:39.603873+00:00", "scan_metadata": { "policy_name": "default", "policy_version": "1.0", "policy_preset_base": "balanced", "policy_fingerprint_sha256": "3f48e661bfbc54597f97bbf3dcf2c1cbae2f596ddc79c0b44784efea326b3d1d", "cel": { "mode": "shadow", "runtime": "cel-go", "runtime_version": "v0.32.0;helper=2.3.1", "fact_schema": "v1", "expression_set_hash": "f26459b8f4a46a974d7ab0aaae34127b5b6a40d693e266e12fca03a69a6d26aa", "evaluated": 0, "retained": 8, "would_suppress": 0, "suppressed": 0, "fallbacks": 0, "projection_incomplete": 0, "elapsed_ms": 0.0, "projection_ms": 0.0, "evaluation_ms": 0.0, "errors": [], "per_rule": {}, "suppressed_candidates": [] }, "rule_contract": { "status": "passed", "schema_version": 2, "checked": 8, "invalid_findings": 0, "errors": [] }, "taxonomy": { "source": "builtin", "version": "2.0.0", "name": "Cisco AI Security and Safety Taxonomy", "revision": "655a343ac943a51b6f61f86e47156e7752c15dc6", "snapshot_sha256": "413e8ce9081e6d91b78aaa0d0b1c06cdc15d0406ad319e23e9f9f4f80735c441", "findings": { "mapped": 7, "not_applicable": 1, "unmapped": 0 } } }, "scanner_version": "2.3.1", "source": "magentosh", "repo_url": "https://github.com/magentosh/superpowers" }