{
  "skill_name": "finetuning",
  "skill_path": "/Users/brianlevine/claude-projects/skill-scanner-test/skills/microsoft-azure-skills/skills/microsoft-foundry/finetuning",
  "is_safe": false,
  "max_severity": "CRITICAL",
  "findings_count": 11,
  "findings": [
    {
      "id": "CROSSFILE_ENV_VAR_EXFILTRATION_263250f261",
      "rule_id": "BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Cross-file env var exfiltration: 11 files",
      "description": "Environment variable access with network calls in scripts/check_training.py, scripts/evaluate_model.py, scripts/submit_training.py, scripts/monitor_training.py, scripts/calibrate_grader.py, scripts/generate_distillation_data.py, scripts/score_dataset.py, scripts/cleanup.py, scripts/common.py, scripts/convert_dataset.py",
      "file_path": null,
      "line_number": null,
      "snippet": null,
      "remediation": "Review data flow across files: scripts/calibrate_grader.py, scripts/generate_distillation_data.py, scripts/convert_dataset.py, scripts/evaluate_model.py, scripts/submit_training.py, scripts/common.py, scripts/cleanup.py, scripts/check_training.py, scripts/deploy_model.py, scripts/monitor_training.py, scripts/score_dataset.py",
      "analyzer": "behavioral",
      "metadata": {
        "aisubtech": "AISubtech-8.2.3",
        "files_involved": [
          "scripts/calibrate_grader.py",
          "scripts/generate_distillation_data.py",
          "scripts/convert_dataset.py",
          "scripts/evaluate_model.py",
          "scripts/submit_training.py",
          "scripts/common.py",
          "scripts/cleanup.py",
          "scripts/check_training.py",
          "scripts/deploy_model.py",
          "scripts/monitor_training.py",
          "scripts/score_dataset.py"
        ],
        "threat_type": "env_var_exfiltration",
        "evidence": {
          "env_var_files": [
            "scripts/check_training.py",
            "scripts/evaluate_model.py",
            "scripts/submit_training.py",
            "scripts/monitor_training.py",
            "scripts/calibrate_grader.py",
            "scripts/generate_distillation_data.py",
            "scripts/score_dataset.py",
            "scripts/cleanup.py",
            "scripts/common.py",
            "scripts/convert_dataset.py"
          ],
          "network_files": [
            "scripts/submit_training.py",
            "scripts/deploy_model.py",
            "scripts/common.py"
          ]
        },
        "rule_contract": {
          "status": "invalid",
          "schema_version": 2,
          "errors": [
            {
              "code": "UNKNOWN_BUNDLED_PYTHON_RULE",
              "rule_id": "BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION",
              "expected": "declared core schema-v2 Python rule",
              "actual": "missing"
            }
          ]
        },
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "finding"
      }
    },
    {
      "id": "CROSSFILE_EXFILTRATION_CHAIN_35b8c836e2",
      "rule_id": "BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Cross-file exfiltration chain: 11 files",
      "description": "Multi-file exfiltration chain detected: scripts/check_training.py, scripts/evaluate_model.py, scripts/submit_training.py, scripts/monitor_training.py, scripts/calibrate_grader.py, scripts/generate_distillation_data.py, scripts/score_dataset.py, scripts/cleanup.py, scripts/common.py, scripts/convert_dataset.py collect data \u2192 encode \u2192 scripts/submit_training.py, scripts/deploy_model.py, scripts/common.py transmit to network",
      "file_path": null,
      "line_number": null,
      "snippet": null,
      "remediation": "Review data flow across files: scripts/calibrate_grader.py, scripts/generate_distillation_data.py, scripts/convert_dataset.py, scripts/evaluate_model.py, scripts/submit_training.py, scripts/common.py, scripts/cleanup.py, scripts/check_training.py, scripts/deploy_model.py, scripts/monitor_training.py, scripts/score_dataset.py",
      "analyzer": "behavioral",
      "metadata": {
        "aisubtech": "AISubtech-8.2.3",
        "files_involved": [
          "scripts/calibrate_grader.py",
          "scripts/generate_distillation_data.py",
          "scripts/convert_dataset.py",
          "scripts/evaluate_model.py",
          "scripts/submit_training.py",
          "scripts/common.py",
          "scripts/cleanup.py",
          "scripts/check_training.py",
          "scripts/deploy_model.py",
          "scripts/monitor_training.py",
          "scripts/score_dataset.py"
        ],
        "threat_type": "exfiltration_chain",
        "evidence": {
          "collection_files": [
            "scripts/check_training.py",
            "scripts/evaluate_model.py",
            "scripts/submit_training.py",
            "scripts/monitor_training.py",
            "scripts/calibrate_grader.py",
            "scripts/generate_distillation_data.py",
            "scripts/score_dataset.py",
            "scripts/cleanup.py",
            "scripts/common.py",
            "scripts/convert_dataset.py"
          ],
          "encoding_files": [],
          "network_files": [
            "scripts/submit_training.py",
            "scripts/deploy_model.py",
            "scripts/common.py"
          ]
        },
        "rule_contract": {
          "status": "invalid",
          "schema_version": 2,
          "errors": [
            {
              "code": "UNKNOWN_BUNDLED_PYTHON_RULE",
              "rule_id": "BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN",
              "expected": "declared core schema-v2 Python rule",
              "actual": "missing"
            }
          ]
        },
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "finding"
      }
    },
    {
      "id": "ENV_VAR_EXFILTRATION_cd13bb94bf",
      "rule_id": "BEHAVIOR_ENV_VAR_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Environment variable access with network calls detected",
      "description": "Script accesses environment variables and makes network calls in /Users/brianlevine/claude-projects/skill-scanner-test/skills/microsoft-azure-skills/skills/microsoft-foundry/finetuning/scripts/common.py",
      "file_path": "/Users/brianlevine/claude-projects/skill-scanner-test/skills/microsoft-azure-skills/skills/microsoft-foundry/finetuning/scripts/common.py",
      "line_number": null,
      "snippet": null,
      "remediation": "Remove environment variable harvesting or network transmission",
      "analyzer": "behavioral",
      "metadata": {
        "has_network": true,
        "has_env_access": true,
        "suspicious_urls": [],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "ENV_VAR_EXFILTRATION_71bfed6499",
      "rule_id": "BEHAVIOR_ENV_VAR_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Environment variable access with network calls detected",
      "description": "Script accesses environment variables and makes network calls in /Users/brianlevine/claude-projects/skill-scanner-test/skills/microsoft-azure-skills/skills/microsoft-foundry/finetuning/scripts/submit_training.py",
      "file_path": "/Users/brianlevine/claude-projects/skill-scanner-test/skills/microsoft-azure-skills/skills/microsoft-foundry/finetuning/scripts/submit_training.py",
      "line_number": null,
      "snippet": null,
      "remediation": "Remove environment variable harvesting or network transmission",
      "analyzer": "behavioral",
      "metadata": {
        "has_network": true,
        "has_env_access": true,
        "suspicious_urls": [],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "TOOL_MISMATCH_NETWORK_6e371b90c6",
      "rule_id": "TOOL_ABUSE_UNDECLARED_NETWORK",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Undeclared network usage",
      "description": "Skill code uses network libraries but doesn't declare network requirement",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": null,
      "remediation": "Declare network usage in compatibility field or remove network calls",
      "analyzer": "static",
      "metadata": {
        "semantic_facts": {
          "evidence_kind": "capability_mismatch",
          "context_kind": "manifest",
          "signals": [
            {
              "rule_id": "TOOL_ABUSE_UNDECLARED_NETWORK",
              "kind": "undeclared_network",
              "file_path": "SKILL.md",
              "value_class": "external_network"
            }
          ],
          "candidate_flow": {
            "source_class": "skill_code",
            "sink_class": "external_network",
            "transforms": [],
            "cross_file": false,
            "source_path": "scripts/submit_training.py",
            "sink_path": "scripts/submit_training.py"
          },
          "flows": [
            {
              "source_class": "skill_code",
              "sink_class": "external_network",
              "transforms": [],
              "cross_file": false,
              "source_path": "scripts/submit_training.py",
              "sink_path": "scripts/submit_training.py"
            }
          ]
        },
        "aitech": "AITech-2.1",
        "aitech_name": "Excessive Agency",
        "aisubtech": "AISubtech-2.1.2",
        "aisubtech_name": "Capability and Permission Overreach",
        "aitech_mappings": [
          "OWASP: LLM03:2026: Excessive Agency",
          "OWASP: ASI10: Rogue Agents",
          "MITRE ATLAS: N/A",
          "NIST AML: N/A"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM03:2026: Excessive Agency",
          "OWASP: ASI10: Rogue Agents",
          "MITRE ATLAS: N/A",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM03:2026: Excessive Agency",
          "OWASP: ASI10: Rogue Agents",
          "MITRE ATLAS: N/A",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "COMMAND_INJECTION_EVAL_4914c75e08",
      "rule_id": "COMMAND_INJECTION_EVAL",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "Dangerous code execution functions that can execute arbitrary code",
      "description": "Pattern detected: exec(",
      "file_path": "scripts/calibrate_grader.py",
      "line_number": 54,
      "snippet": "exec(compile(source, grader_path, \"exec\"), namespace)",
      "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "(?<!['\\\"\\.])\\bexec\\s*\\(",
        "matched_text": "exec(",
        "signature_pattern_index": 1,
        "signature_match_start": 0,
        "signature_match_end": 5,
        "signature_pattern_sha256": "6a39f8973c64f233f1186cc082332fbd67f9556cf70a62a40d294db5bd46a30b",
        "scanner_category": "INJECTION ATTACK",
        "signature_context": "code",
        "signature_polarity": "active",
        "source_category": "command_injection",
        "category_normalization": "native",
        "semantic_facts": {
          "evidence_kind": "signature_pattern",
          "context_kind": "code",
          "signals": [
            {
              "rule_id": "COMMAND_INJECTION_EVAL",
              "kind": "signature_polarity",
              "file_path": "scripts/calibrate_grader.py",
              "value_class": "active"
            }
          ]
        },
        "aitech": "AITech-9.1",
        "aitech_name": "Model or Agentic System Manipulation",
        "aisubtech": "AISubtech-9.1.4",
        "aisubtech_name": "Injection Attacks (e.g., SQL, Command Execution, XSS)",
        "aitech_mappings": [
          "OWASP: LLM04:2026: Supply Chain",
          "OWASP: ASI04: Agentic Supply Chain Vulnerabilities",
          "OWASP: ASI05: Unexpected Code Execution (RCE)",
          "MITRE ATLAS: AML.T0050: Command and Scripting Interpreter",
          "NIST AML: NISTAML.023: Backdoor Poisoning",
          "Cisco AI MDL Code: MDL-006",
          "Cisco AI MDL Code: MDL-007",
          "Cisco AI MDL Code: MDL-005",
          "Cisco AI MDL Code: MDL-010",
          "Cisco AI MDL Code: MDL-012",
          "Cisco AI MDL Code: MDL-014",
          "Cisco AI MDL Code: MDL-015",
          "Cisco AI MDL Code: MDL-019"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: LLM10:2026: Improper Output Handling",
          "OWASP: LLM03:2026: Excessive Agency",
          "OWASP: ASI04: Agentic Supply Chain Vulnerabilities",
          "OWASP: ASI05: Unexpected Code Execution (RCE)",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0050: Command and Scripting Interpreter",
          "MITRE ATLAS: AML.T0067: LLM Trusted Output Component Manipulation",
          "MITRE ATT&CK: T1588.007: Obtain AI Capabilities",
          "NIST AML: NISTAML.024: Targeted Poisoning"
        ],
        "framework_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: LLM10:2026: Improper Output Handling",
          "OWASP: LLM03:2026: Excessive Agency",
          "OWASP: ASI04: Agentic Supply Chain Vulnerabilities",
          "OWASP: ASI05: Unexpected Code Execution (RCE)",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0050: Command and Scripting Interpreter",
          "MITRE ATLAS: AML.T0067: LLM Trusted Output Component Manipulation",
          "MITRE ATT&CK: T1588.007: Obtain AI Capabilities",
          "NIST AML: NISTAML.024: Targeted Poisoning"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_59b969c0d5",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Outbound network request primitives that can transmit data externally",
      "description": "Pattern detected: requests.put(",
      "file_path": "scripts/deploy_model.py",
      "line_number": 120,
      "snippet": "resp = requests.put(url, headers={",
      "remediation": "Ensure network operations are necessary and document allowed destinations",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "requests\\.(?:get|post|put|delete|patch|request)\\s*\\(",
        "matched_text": "requests.put(",
        "signature_pattern_index": 0,
        "signature_match_start": 7,
        "signature_match_end": 20,
        "signature_pattern_sha256": "cacd60a0c4b378765820016ec26f039b156d34fcbf13f99d9c0cc464990279b6",
        "scanner_category": "SECURITY VIOLATION",
        "signature_context": "code",
        "signature_polarity": "active",
        "source_category": "data_exfiltration",
        "category_normalization": "native",
        "semantic_facts": {
          "evidence_kind": "signature_pattern",
          "context_kind": "code",
          "signals": [
            {
              "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
              "kind": "signature_polarity",
              "file_path": "scripts/deploy_model.py",
              "value_class": "active"
            }
          ]
        },
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_ed38167a1e",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Outbound network request primitives that can transmit data externally",
      "description": "Pattern detected: requests.get(",
      "file_path": "scripts/deploy_model.py",
      "line_number": 141,
      "snippet": "resp = requests.get(url, headers={\"Authorization\": f\"Bearer {token}\"}, timeout=(10, 60))",
      "remediation": "Ensure network operations are necessary and document allowed destinations",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "requests\\.(?:get|post|put|delete|patch|request)\\s*\\(",
        "matched_text": "requests.get(",
        "signature_pattern_index": 0,
        "signature_match_start": 7,
        "signature_match_end": 20,
        "signature_pattern_sha256": "cacd60a0c4b378765820016ec26f039b156d34fcbf13f99d9c0cc464990279b6",
        "scanner_category": "SECURITY VIOLATION",
        "signature_context": "code",
        "signature_polarity": "active",
        "source_category": "data_exfiltration",
        "category_normalization": "native",
        "semantic_facts": {
          "evidence_kind": "signature_pattern",
          "context_kind": "code",
          "signals": [
            {
              "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
              "kind": "signature_polarity",
              "file_path": "scripts/deploy_model.py",
              "value_class": "active"
            }
          ]
        },
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_0a246b8ce4",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Outbound network request primitives that can transmit data externally",
      "description": "Pattern detected: requests.delete(",
      "file_path": "scripts/deploy_model.py",
      "line_number": 167,
      "snippet": "resp = requests.delete(url, headers={\"Authorization\": f\"Bearer {token}\"}, timeout=(10, 60))",
      "remediation": "Ensure network operations are necessary and document allowed destinations",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "requests\\.(?:get|post|put|delete|patch|request)\\s*\\(",
        "matched_text": "requests.delete(",
        "signature_pattern_index": 0,
        "signature_match_start": 7,
        "signature_match_end": 23,
        "signature_pattern_sha256": "cacd60a0c4b378765820016ec26f039b156d34fcbf13f99d9c0cc464990279b6",
        "scanner_category": "SECURITY VIOLATION",
        "signature_context": "code",
        "signature_polarity": "active",
        "source_category": "data_exfiltration",
        "category_normalization": "native",
        "semantic_facts": {
          "evidence_kind": "signature_pattern",
          "context_kind": "code",
          "signals": [
            {
              "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
              "kind": "signature_polarity",
              "file_path": "scripts/deploy_model.py",
              "value_class": "active"
            }
          ]
        },
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_8059c9c218",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Outbound network request primitives that can transmit data externally",
      "description": "Pattern detected: requests.get(",
      "file_path": "scripts/deploy_model.py",
      "line_number": 178,
      "snippet": "resp = requests.get(url, headers={\"Authorization\": f\"Bearer {token}\"}, timeout=(10, 60))",
      "remediation": "Ensure network operations are necessary and document allowed destinations",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "requests\\.(?:get|post|put|delete|patch|request)\\s*\\(",
        "matched_text": "requests.get(",
        "signature_pattern_index": 0,
        "signature_match_start": 7,
        "signature_match_end": 20,
        "signature_pattern_sha256": "cacd60a0c4b378765820016ec26f039b156d34fcbf13f99d9c0cc464990279b6",
        "scanner_category": "SECURITY VIOLATION",
        "signature_context": "code",
        "signature_polarity": "active",
        "source_category": "data_exfiltration",
        "category_normalization": "native",
        "semantic_facts": {
          "evidence_kind": "signature_pattern",
          "context_kind": "code",
          "signals": [
            {
              "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
              "kind": "signature_polarity",
              "file_path": "scripts/deploy_model.py",
              "value_class": "active"
            }
          ]
        },
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_e648ac1361",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Outbound network request primitives that can transmit data externally",
      "description": "Pattern detected: requests.post(",
      "file_path": "scripts/submit_training.py",
      "line_number": 84,
      "snippet": "resp = requests.post(url, headers={",
      "remediation": "Ensure network operations are necessary and document allowed destinations",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "requests\\.(?:get|post|put|delete|patch|request)\\s*\\(",
        "matched_text": "requests.post(",
        "signature_pattern_index": 0,
        "signature_match_start": 7,
        "signature_match_end": 21,
        "signature_pattern_sha256": "cacd60a0c4b378765820016ec26f039b156d34fcbf13f99d9c0cc464990279b6",
        "scanner_category": "SECURITY VIOLATION",
        "signature_context": "code",
        "signature_polarity": "active",
        "source_category": "data_exfiltration",
        "category_normalization": "native",
        "semantic_facts": {
          "evidence_kind": "signature_pattern",
          "context_kind": "code",
          "signals": [
            {
              "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
              "kind": "signature_polarity",
              "file_path": "scripts/submit_training.py",
              "value_class": "active"
            }
          ]
        },
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    }
  ],
  "scan_duration_seconds": 0.8416988849639893,
  "duration_ms": 841,
  "analyzers_used": [
    "static_analyzer",
    "bytecode",
    "pipeline",
    "correlation",
    "behavioral_analyzer",
    "trigger_analyzer"
  ],
  "timestamp": "2026-10-22T04:36:04.102937+00:00",
  "scan_metadata": {
    "policy_name": "default",
    "policy_version": "1.0",
    "policy_preset_base": "balanced",
    "policy_fingerprint_sha256": "3f48e661bfbc54597f97bbf3dcf2c1cbae2f596ddc79c0b44784efea326b3d1d",
    "cel": {
      "mode": "shadow",
      "runtime": "cel-go",
      "runtime_version": "v0.32.0;helper=2.3.1",
      "fact_schema": "v1",
      "expression_set_hash": "f26459b8f4a46a974d7ab0aaae34127b5b6a40d693e266e12fca03a69a6d26aa",
      "evaluated": 0,
      "retained": 11,
      "would_suppress": 0,
      "suppressed": 0,
      "fallbacks": 0,
      "projection_incomplete": 0,
      "elapsed_ms": 0.0,
      "projection_ms": 0.0,
      "evaluation_ms": 0.0,
      "errors": [],
      "per_rule": {},
      "suppressed_candidates": []
    },
    "rule_contract": {
      "status": "failed",
      "schema_version": 2,
      "checked": 5,
      "invalid_findings": 2,
      "errors": [
        {
          "code": "UNKNOWN_BUNDLED_PYTHON_RULE",
          "rule_id": "BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN",
          "expected": "declared core schema-v2 Python rule",
          "actual": "missing"
        },
        {
          "code": "UNKNOWN_BUNDLED_PYTHON_RULE",
          "rule_id": "BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION",
          "expected": "declared core schema-v2 Python rule",
          "actual": "missing"
        }
      ]
    },
    "taxonomy": {
      "source": "builtin",
      "version": "2.0.0",
      "name": "Cisco AI Security and Safety Taxonomy",
      "revision": "655a343ac943a51b6f61f86e47156e7752c15dc6",
      "snapshot_sha256": "413e8ce9081e6d91b78aaa0d0b1c06cdc15d0406ad319e23e9f9f4f80735c441",
      "findings": {
        "mapped": 11,
        "not_applicable": 0,
        "unmapped": 0
      }
    }
  },
  "analyzers_failed": [
    {
      "analyzer": "behavioral",
      "error": "FindingContract:BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN:UNKNOWN_BUNDLED_PYTHON_RULE"
    },
    {
      "analyzer": "behavioral",
      "error": "FindingContract:BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION:UNKNOWN_BUNDLED_PYTHON_RULE"
    }
  ],
  "scanner_version": "2.3.1",
  "source": "microsoft",
  "repo_url": "https://github.com/microsoft/azure-skills"
}