{
  "skill_name": "microsoft-foundry",
  "skill_path": "/Users/brianlevine/claude-projects/skill-scanner-test/skills/microsoft-azure-skills/skills/microsoft-foundry",
  "is_safe": false,
  "max_severity": "CRITICAL",
  "findings_count": 29,
  "findings": [
    {
      "id": "CROSSFILE_ENV_VAR_EXFILTRATION_73e68c8ae1",
      "rule_id": "BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Cross-file env var exfiltration: 11 files",
      "description": "Environment variable access with network calls in finetuning/scripts/check_training.py, finetuning/scripts/evaluate_model.py, finetuning/scripts/submit_training.py, finetuning/scripts/monitor_training.py, finetuning/scripts/calibrate_grader.py, finetuning/scripts/generate_distillation_data.py, finetuning/scripts/score_dataset.py, finetuning/scripts/cleanup.py, finetuning/scripts/common.py, finetuning/scripts/convert_dataset.py",
      "file_path": null,
      "line_number": null,
      "snippet": null,
      "remediation": "Review data flow across files: finetuning/scripts/cleanup.py, finetuning/scripts/score_dataset.py, finetuning/scripts/deploy_model.py, finetuning/scripts/generate_distillation_data.py, finetuning/scripts/check_training.py, finetuning/scripts/submit_training.py, finetuning/scripts/convert_dataset.py, finetuning/scripts/calibrate_grader.py, finetuning/scripts/monitor_training.py, finetuning/scripts/evaluate_model.py, finetuning/scripts/common.py",
      "analyzer": "behavioral",
      "metadata": {
        "aisubtech": "AISubtech-8.2.3",
        "files_involved": [
          "finetuning/scripts/cleanup.py",
          "finetuning/scripts/score_dataset.py",
          "finetuning/scripts/deploy_model.py",
          "finetuning/scripts/generate_distillation_data.py",
          "finetuning/scripts/check_training.py",
          "finetuning/scripts/submit_training.py",
          "finetuning/scripts/convert_dataset.py",
          "finetuning/scripts/calibrate_grader.py",
          "finetuning/scripts/monitor_training.py",
          "finetuning/scripts/evaluate_model.py",
          "finetuning/scripts/common.py"
        ],
        "threat_type": "env_var_exfiltration",
        "evidence": {
          "env_var_files": [
            "finetuning/scripts/check_training.py",
            "finetuning/scripts/evaluate_model.py",
            "finetuning/scripts/submit_training.py",
            "finetuning/scripts/monitor_training.py",
            "finetuning/scripts/calibrate_grader.py",
            "finetuning/scripts/generate_distillation_data.py",
            "finetuning/scripts/score_dataset.py",
            "finetuning/scripts/cleanup.py",
            "finetuning/scripts/common.py",
            "finetuning/scripts/convert_dataset.py"
          ],
          "network_files": [
            "finetuning/scripts/submit_training.py",
            "finetuning/scripts/deploy_model.py",
            "finetuning/scripts/common.py"
          ]
        },
        "rule_contract": {
          "status": "invalid",
          "schema_version": 2,
          "errors": [
            {
              "code": "UNKNOWN_BUNDLED_PYTHON_RULE",
              "rule_id": "BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION",
              "expected": "declared core schema-v2 Python rule",
              "actual": "missing"
            }
          ]
        },
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "finding"
      }
    },
    {
      "id": "CROSSFILE_EXFILTRATION_CHAIN_cb6f54176b",
      "rule_id": "BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Cross-file exfiltration chain: 11 files",
      "description": "Multi-file exfiltration chain detected: finetuning/scripts/check_training.py, finetuning/scripts/evaluate_model.py, finetuning/scripts/submit_training.py, finetuning/scripts/monitor_training.py, finetuning/scripts/calibrate_grader.py, finetuning/scripts/generate_distillation_data.py, finetuning/scripts/score_dataset.py, finetuning/scripts/cleanup.py, finetuning/scripts/common.py, finetuning/scripts/convert_dataset.py collect data \u2192 encode \u2192 finetuning/scripts/submit_training.py, finetuning/scripts/deploy_model.py, finetuning/scripts/common.py transmit to network",
      "file_path": null,
      "line_number": null,
      "snippet": null,
      "remediation": "Review data flow across files: finetuning/scripts/cleanup.py, finetuning/scripts/score_dataset.py, finetuning/scripts/deploy_model.py, finetuning/scripts/generate_distillation_data.py, finetuning/scripts/check_training.py, finetuning/scripts/submit_training.py, finetuning/scripts/convert_dataset.py, finetuning/scripts/calibrate_grader.py, finetuning/scripts/monitor_training.py, finetuning/scripts/evaluate_model.py, finetuning/scripts/common.py",
      "analyzer": "behavioral",
      "metadata": {
        "aisubtech": "AISubtech-8.2.3",
        "files_involved": [
          "finetuning/scripts/cleanup.py",
          "finetuning/scripts/score_dataset.py",
          "finetuning/scripts/deploy_model.py",
          "finetuning/scripts/generate_distillation_data.py",
          "finetuning/scripts/check_training.py",
          "finetuning/scripts/submit_training.py",
          "finetuning/scripts/convert_dataset.py",
          "finetuning/scripts/calibrate_grader.py",
          "finetuning/scripts/monitor_training.py",
          "finetuning/scripts/evaluate_model.py",
          "finetuning/scripts/common.py"
        ],
        "threat_type": "exfiltration_chain",
        "evidence": {
          "collection_files": [
            "finetuning/scripts/check_training.py",
            "finetuning/scripts/evaluate_model.py",
            "finetuning/scripts/submit_training.py",
            "finetuning/scripts/monitor_training.py",
            "finetuning/scripts/calibrate_grader.py",
            "finetuning/scripts/generate_distillation_data.py",
            "finetuning/scripts/score_dataset.py",
            "finetuning/scripts/cleanup.py",
            "finetuning/scripts/common.py",
            "finetuning/scripts/convert_dataset.py"
          ],
          "encoding_files": [],
          "network_files": [
            "finetuning/scripts/submit_training.py",
            "finetuning/scripts/deploy_model.py",
            "finetuning/scripts/common.py"
          ]
        },
        "rule_contract": {
          "status": "invalid",
          "schema_version": 2,
          "errors": [
            {
              "code": "UNKNOWN_BUNDLED_PYTHON_RULE",
              "rule_id": "BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN",
              "expected": "declared core schema-v2 Python rule",
              "actual": "missing"
            }
          ]
        },
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "finding"
      }
    },
    {
      "id": "EXCESSIVE_FILE_COUNT_82ab6ef588",
      "rule_id": "EXCESSIVE_FILE_COUNT",
      "category": "policy_violation",
      "severity": "LOW",
      "title": "Skill package contains many files",
      "description": "Skill package contains 209 files. Large file counts increase attack surface and may indicate bundled dependencies or unnecessary content.",
      "file_path": ".",
      "line_number": null,
      "snippet": null,
      "remediation": "Review file inventory and remove unnecessary files.",
      "analyzer": "static",
      "metadata": {
        "file_count": 209,
        "type_breakdown": {
          "other": 14,
          "markdown": 171,
          "bash": 8,
          "python": 16
        },
        "aitech": null,
        "aitech_name": null,
        "aisubtech": null,
        "aisubtech_name": null,
        "aitech_mappings": [],
        "aisubtech_mappings": [],
        "framework_mappings": [],
        "taxonomy_status": "not_applicable",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "ENV_VAR_EXFILTRATION_cd13bb94bf",
      "rule_id": "BEHAVIOR_ENV_VAR_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Environment variable access with network calls detected",
      "description": "Script accesses environment variables and makes network calls in /Users/brianlevine/claude-projects/skill-scanner-test/skills/microsoft-azure-skills/skills/microsoft-foundry/finetuning/scripts/common.py",
      "file_path": "/Users/brianlevine/claude-projects/skill-scanner-test/skills/microsoft-azure-skills/skills/microsoft-foundry/finetuning/scripts/common.py",
      "line_number": null,
      "snippet": null,
      "remediation": "Remove environment variable harvesting or network transmission",
      "analyzer": "behavioral",
      "metadata": {
        "has_network": true,
        "has_env_access": true,
        "suspicious_urls": [],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "ENV_VAR_EXFILTRATION_71bfed6499",
      "rule_id": "BEHAVIOR_ENV_VAR_EXFILTRATION",
      "category": "data_exfiltration",
      "severity": "CRITICAL",
      "title": "Environment variable access with network calls detected",
      "description": "Script accesses environment variables and makes network calls in /Users/brianlevine/claude-projects/skill-scanner-test/skills/microsoft-azure-skills/skills/microsoft-foundry/finetuning/scripts/submit_training.py",
      "file_path": "/Users/brianlevine/claude-projects/skill-scanner-test/skills/microsoft-azure-skills/skills/microsoft-foundry/finetuning/scripts/submit_training.py",
      "line_number": null,
      "snippet": null,
      "remediation": "Remove environment variable harvesting or network transmission",
      "analyzer": "behavioral",
      "metadata": {
        "has_network": true,
        "has_env_access": true,
        "suspicious_urls": [],
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "TOOL_MISMATCH_NETWORK_7a717fc990",
      "rule_id": "TOOL_ABUSE_UNDECLARED_NETWORK",
      "category": "unauthorized_tool_use",
      "severity": "MEDIUM",
      "title": "Undeclared network usage",
      "description": "Skill code uses network libraries but doesn't declare network requirement",
      "file_path": "SKILL.md",
      "line_number": null,
      "snippet": null,
      "remediation": "Declare network usage in compatibility field or remove network calls",
      "analyzer": "static",
      "metadata": {
        "semantic_facts": {
          "evidence_kind": "capability_mismatch",
          "context_kind": "manifest",
          "signals": [
            {
              "rule_id": "TOOL_ABUSE_UNDECLARED_NETWORK",
              "kind": "undeclared_network",
              "file_path": "SKILL.md",
              "value_class": "external_network"
            }
          ],
          "candidate_flow": {
            "source_class": "skill_code",
            "sink_class": "external_network",
            "transforms": [],
            "cross_file": false,
            "source_path": "finetuning/scripts/submit_training.py",
            "sink_path": "finetuning/scripts/submit_training.py"
          },
          "flows": [
            {
              "source_class": "skill_code",
              "sink_class": "external_network",
              "transforms": [],
              "cross_file": false,
              "source_path": "finetuning/scripts/submit_training.py",
              "sink_path": "finetuning/scripts/submit_training.py"
            }
          ]
        },
        "aitech": "AITech-2.1",
        "aitech_name": "Excessive Agency",
        "aisubtech": "AISubtech-2.1.2",
        "aisubtech_name": "Capability and Permission Overreach",
        "aitech_mappings": [
          "OWASP: LLM03:2026: Excessive Agency",
          "OWASP: ASI10: Rogue Agents",
          "MITRE ATLAS: N/A",
          "NIST AML: N/A"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM03:2026: Excessive Agency",
          "OWASP: ASI10: Rogue Agents",
          "MITRE ATLAS: N/A",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM03:2026: Excessive Agency",
          "OWASP: ASI10: Rogue Agents",
          "MITRE ATLAS: N/A",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "COMMAND_INJECTION_EVAL_b1b0efbc71",
      "rule_id": "COMMAND_INJECTION_EVAL",
      "category": "command_injection",
      "severity": "CRITICAL",
      "title": "Dangerous code execution functions that can execute arbitrary code",
      "description": "Pattern detected: exec(",
      "file_path": "finetuning/scripts/calibrate_grader.py",
      "line_number": 54,
      "snippet": "exec(compile(source, grader_path, \"exec\"), namespace)",
      "remediation": "Avoid eval(), exec(), and compile(). Use safer alternatives like ast.literal_eval() or operator module",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "(?<!['\\\"\\.])\\bexec\\s*\\(",
        "matched_text": "exec(",
        "signature_pattern_index": 1,
        "signature_match_start": 0,
        "signature_match_end": 5,
        "signature_pattern_sha256": "6a39f8973c64f233f1186cc082332fbd67f9556cf70a62a40d294db5bd46a30b",
        "scanner_category": "INJECTION ATTACK",
        "signature_context": "code",
        "signature_polarity": "active",
        "source_category": "command_injection",
        "category_normalization": "native",
        "semantic_facts": {
          "evidence_kind": "signature_pattern",
          "context_kind": "code",
          "signals": [
            {
              "rule_id": "COMMAND_INJECTION_EVAL",
              "kind": "signature_polarity",
              "file_path": "finetuning/scripts/calibrate_grader.py",
              "value_class": "active"
            },
            {
              "rule_id": "COMMAND_INJECTION_EVAL",
              "kind": "unreferenced_executable",
              "file_path": "finetuning/scripts/calibrate_grader.py",
              "value_class": "python"
            }
          ]
        },
        "aitech": "AITech-9.1",
        "aitech_name": "Model or Agentic System Manipulation",
        "aisubtech": "AISubtech-9.1.4",
        "aisubtech_name": "Injection Attacks (e.g., SQL, Command Execution, XSS)",
        "aitech_mappings": [
          "OWASP: LLM04:2026: Supply Chain",
          "OWASP: ASI04: Agentic Supply Chain Vulnerabilities",
          "OWASP: ASI05: Unexpected Code Execution (RCE)",
          "MITRE ATLAS: AML.T0050: Command and Scripting Interpreter",
          "NIST AML: NISTAML.023: Backdoor Poisoning",
          "Cisco AI MDL Code: MDL-006",
          "Cisco AI MDL Code: MDL-007",
          "Cisco AI MDL Code: MDL-005",
          "Cisco AI MDL Code: MDL-010",
          "Cisco AI MDL Code: MDL-012",
          "Cisco AI MDL Code: MDL-014",
          "Cisco AI MDL Code: MDL-015",
          "Cisco AI MDL Code: MDL-019"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: LLM10:2026: Improper Output Handling",
          "OWASP: LLM03:2026: Excessive Agency",
          "OWASP: ASI04: Agentic Supply Chain Vulnerabilities",
          "OWASP: ASI05: Unexpected Code Execution (RCE)",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0050: Command and Scripting Interpreter",
          "MITRE ATLAS: AML.T0067: LLM Trusted Output Component Manipulation",
          "MITRE ATT&CK: T1588.007: Obtain AI Capabilities",
          "NIST AML: NISTAML.024: Targeted Poisoning"
        ],
        "framework_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: LLM10:2026: Improper Output Handling",
          "OWASP: LLM03:2026: Excessive Agency",
          "OWASP: ASI04: Agentic Supply Chain Vulnerabilities",
          "OWASP: ASI05: Unexpected Code Execution (RCE)",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0050: Command and Scripting Interpreter",
          "MITRE ATLAS: AML.T0067: LLM Trusted Output Component Manipulation",
          "MITRE ATT&CK: T1588.007: Obtain AI Capabilities",
          "NIST AML: NISTAML.024: Targeted Poisoning"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_987b8f12a1",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Outbound network request primitives that can transmit data externally",
      "description": "Pattern detected: requests.put(",
      "file_path": "finetuning/scripts/deploy_model.py",
      "line_number": 120,
      "snippet": "resp = requests.put(url, headers={",
      "remediation": "Ensure network operations are necessary and document allowed destinations",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "requests\\.(?:get|post|put|delete|patch|request)\\s*\\(",
        "matched_text": "requests.put(",
        "signature_pattern_index": 0,
        "signature_match_start": 7,
        "signature_match_end": 20,
        "signature_pattern_sha256": "cacd60a0c4b378765820016ec26f039b156d34fcbf13f99d9c0cc464990279b6",
        "scanner_category": "SECURITY VIOLATION",
        "signature_context": "code",
        "signature_polarity": "active",
        "source_category": "data_exfiltration",
        "category_normalization": "native",
        "semantic_facts": {
          "evidence_kind": "signature_pattern",
          "context_kind": "code",
          "signals": [
            {
              "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
              "kind": "signature_polarity",
              "file_path": "finetuning/scripts/deploy_model.py",
              "value_class": "active"
            },
            {
              "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
              "kind": "unreferenced_executable",
              "file_path": "finetuning/scripts/deploy_model.py",
              "value_class": "python"
            }
          ]
        },
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_b9e8ba8a4b",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Outbound network request primitives that can transmit data externally",
      "description": "Pattern detected: requests.get(",
      "file_path": "finetuning/scripts/deploy_model.py",
      "line_number": 141,
      "snippet": "resp = requests.get(url, headers={\"Authorization\": f\"Bearer {token}\"}, timeout=(10, 60))",
      "remediation": "Ensure network operations are necessary and document allowed destinations",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "requests\\.(?:get|post|put|delete|patch|request)\\s*\\(",
        "matched_text": "requests.get(",
        "signature_pattern_index": 0,
        "signature_match_start": 7,
        "signature_match_end": 20,
        "signature_pattern_sha256": "cacd60a0c4b378765820016ec26f039b156d34fcbf13f99d9c0cc464990279b6",
        "scanner_category": "SECURITY VIOLATION",
        "signature_context": "code",
        "signature_polarity": "active",
        "source_category": "data_exfiltration",
        "category_normalization": "native",
        "semantic_facts": {
          "evidence_kind": "signature_pattern",
          "context_kind": "code",
          "signals": [
            {
              "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
              "kind": "signature_polarity",
              "file_path": "finetuning/scripts/deploy_model.py",
              "value_class": "active"
            },
            {
              "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
              "kind": "unreferenced_executable",
              "file_path": "finetuning/scripts/deploy_model.py",
              "value_class": "python"
            }
          ]
        },
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_c90d2af442",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Outbound network request primitives that can transmit data externally",
      "description": "Pattern detected: requests.delete(",
      "file_path": "finetuning/scripts/deploy_model.py",
      "line_number": 167,
      "snippet": "resp = requests.delete(url, headers={\"Authorization\": f\"Bearer {token}\"}, timeout=(10, 60))",
      "remediation": "Ensure network operations are necessary and document allowed destinations",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "requests\\.(?:get|post|put|delete|patch|request)\\s*\\(",
        "matched_text": "requests.delete(",
        "signature_pattern_index": 0,
        "signature_match_start": 7,
        "signature_match_end": 23,
        "signature_pattern_sha256": "cacd60a0c4b378765820016ec26f039b156d34fcbf13f99d9c0cc464990279b6",
        "scanner_category": "SECURITY VIOLATION",
        "signature_context": "code",
        "signature_polarity": "active",
        "source_category": "data_exfiltration",
        "category_normalization": "native",
        "semantic_facts": {
          "evidence_kind": "signature_pattern",
          "context_kind": "code",
          "signals": [
            {
              "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
              "kind": "signature_polarity",
              "file_path": "finetuning/scripts/deploy_model.py",
              "value_class": "active"
            },
            {
              "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
              "kind": "unreferenced_executable",
              "file_path": "finetuning/scripts/deploy_model.py",
              "value_class": "python"
            }
          ]
        },
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_8070af9537",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Outbound network request primitives that can transmit data externally",
      "description": "Pattern detected: requests.get(",
      "file_path": "finetuning/scripts/deploy_model.py",
      "line_number": 178,
      "snippet": "resp = requests.get(url, headers={\"Authorization\": f\"Bearer {token}\"}, timeout=(10, 60))",
      "remediation": "Ensure network operations are necessary and document allowed destinations",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "requests\\.(?:get|post|put|delete|patch|request)\\s*\\(",
        "matched_text": "requests.get(",
        "signature_pattern_index": 0,
        "signature_match_start": 7,
        "signature_match_end": 20,
        "signature_pattern_sha256": "cacd60a0c4b378765820016ec26f039b156d34fcbf13f99d9c0cc464990279b6",
        "scanner_category": "SECURITY VIOLATION",
        "signature_context": "code",
        "signature_polarity": "active",
        "source_category": "data_exfiltration",
        "category_normalization": "native",
        "semantic_facts": {
          "evidence_kind": "signature_pattern",
          "context_kind": "code",
          "signals": [
            {
              "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
              "kind": "signature_polarity",
              "file_path": "finetuning/scripts/deploy_model.py",
              "value_class": "active"
            },
            {
              "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
              "kind": "unreferenced_executable",
              "file_path": "finetuning/scripts/deploy_model.py",
              "value_class": "python"
            }
          ]
        },
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "DATA_EXFIL_NETWORK_REQUESTS_57a4977750",
      "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Outbound network request primitives that can transmit data externally",
      "description": "Pattern detected: requests.post(",
      "file_path": "finetuning/scripts/submit_training.py",
      "line_number": 84,
      "snippet": "resp = requests.post(url, headers={",
      "remediation": "Ensure network operations are necessary and document allowed destinations",
      "analyzer": "static",
      "metadata": {
        "matched_pattern": "requests\\.(?:get|post|put|delete|patch|request)\\s*\\(",
        "matched_text": "requests.post(",
        "signature_pattern_index": 0,
        "signature_match_start": 7,
        "signature_match_end": 21,
        "signature_pattern_sha256": "cacd60a0c4b378765820016ec26f039b156d34fcbf13f99d9c0cc464990279b6",
        "scanner_category": "SECURITY VIOLATION",
        "signature_context": "code",
        "signature_polarity": "active",
        "source_category": "data_exfiltration",
        "category_normalization": "native",
        "semantic_facts": {
          "evidence_kind": "signature_pattern",
          "context_kind": "code",
          "signals": [
            {
              "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
              "kind": "signature_polarity",
              "file_path": "finetuning/scripts/submit_training.py",
              "value_class": "active"
            },
            {
              "rule_id": "DATA_EXFIL_NETWORK_REQUESTS",
              "kind": "unreferenced_executable",
              "file_path": "finetuning/scripts/submit_training.py",
              "value_class": "python"
            }
          ]
        },
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "YARA_jailbreak_generic_b2255484d2",
      "rule_id": "YARA_jailbreak_generic",
      "category": "prompt_injection",
      "severity": "HIGH",
      "title": "JAILBREAK detected by YARA",
      "description": "Jailbreak attempt patterns: references",
      "file_path": "foundry-agent/toolbox/references/tool-azure-ai-search.md",
      "line_number": 11,
      "snippet": "The toolbox tool references an existing index (behind a `CognitiveSearch` connection created in Section A). If you already have a populated index, skip to Section A. Otherwise set it up once:",
      "remediation": "Review and remove jailbreak pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "jailbreak_generic",
        "yara_namespace": "jailbreak_generic",
        "matched_string": "$academic_paper",
        "threat_type": "JAILBREAK",
        "aitech": "AITech-1.1",
        "aitech_name": "Direct Prompt Injection and Jailbreak (Prompt-based Manipulation)",
        "aisubtech": "AISubtech-1.1.5",
        "aisubtech_name": "Context Manipulation",
        "aitech_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: ASI01: Agent Goal Hijack",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0054: LLM Jailbreak",
          "MITRE ATLAS: AML.T0093: Prompt Infiltration via Public-Facing Application",
          "NIST AML: NISTAML.018: Prompt Injection"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: ASI01: Agent Goal Hijack",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0054: LLM Jailbreak",
          "MITRE ATLAS: AML.T0093: Prompt Infiltration via Public-Facing Application",
          "NIST AML: NISTAML.018: Prompt Injection"
        ],
        "framework_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: ASI01: Agent Goal Hijack",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0054: LLM Jailbreak",
          "MITRE ATLAS: AML.T0093: Prompt Infiltration via Public-Facing Application",
          "NIST AML: NISTAML.018: Prompt Injection"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "YARA_jailbreak_generic_29aef0cde4",
      "rule_id": "YARA_jailbreak_generic",
      "category": "prompt_injection",
      "severity": "HIGH",
      "title": "JAILBREAK detected by YARA",
      "description": "Jailbreak attempt patterns: admin key for the next steps:",
      "file_path": "foundry-agent/toolbox/references/tool-azure-ai-search.md",
      "line_number": 23,
      "snippet": "Grab the endpoint + admin key for the next steps:",
      "remediation": "Review and remove jailbreak pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "jailbreak_generic",
        "yara_namespace": "jailbreak_generic",
        "matched_string": "$override_code",
        "threat_type": "JAILBREAK",
        "aitech": "AITech-1.1",
        "aitech_name": "Direct Prompt Injection and Jailbreak (Prompt-based Manipulation)",
        "aisubtech": "AISubtech-1.1.5",
        "aisubtech_name": "Context Manipulation",
        "aitech_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: ASI01: Agent Goal Hijack",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0054: LLM Jailbreak",
          "MITRE ATLAS: AML.T0093: Prompt Infiltration via Public-Facing Application",
          "NIST AML: NISTAML.018: Prompt Injection"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: ASI01: Agent Goal Hijack",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0054: LLM Jailbreak",
          "MITRE ATLAS: AML.T0093: Prompt Infiltration via Public-Facing Application",
          "NIST AML: NISTAML.018: Prompt Injection"
        ],
        "framework_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: ASI01: Agent Goal Hijack",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0054: LLM Jailbreak",
          "MITRE ATLAS: AML.T0093: Prompt Infiltration via Public-Facing Application",
          "NIST AML: NISTAML.018: Prompt Injection"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "YARA_jailbreak_generic_47d2ce9215",
      "rule_id": "YARA_jailbreak_generic",
      "category": "prompt_injection",
      "severity": "HIGH",
      "title": "JAILBREAK detected by YARA",
      "description": "Jailbreak attempt patterns: references",
      "file_path": "foundry-agent/toolbox/references/tool-azure-ai-search.md",
      "line_number": 60,
      "snippet": "**Create the `CognitiveSearch` connection** \u2014 the tool references the index by this connection, which must exist first:",
      "remediation": "Review and remove jailbreak pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "jailbreak_generic",
        "yara_namespace": "jailbreak_generic",
        "matched_string": "$academic_paper",
        "threat_type": "JAILBREAK",
        "aitech": "AITech-1.1",
        "aitech_name": "Direct Prompt Injection and Jailbreak (Prompt-based Manipulation)",
        "aisubtech": "AISubtech-1.1.5",
        "aisubtech_name": "Context Manipulation",
        "aitech_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: ASI01: Agent Goal Hijack",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0054: LLM Jailbreak",
          "MITRE ATLAS: AML.T0093: Prompt Infiltration via Public-Facing Application",
          "NIST AML: NISTAML.018: Prompt Injection"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: ASI01: Agent Goal Hijack",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0054: LLM Jailbreak",
          "MITRE ATLAS: AML.T0093: Prompt Infiltration via Public-Facing Application",
          "NIST AML: NISTAML.018: Prompt Injection"
        ],
        "framework_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: ASI01: Agent Goal Hijack",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0054: LLM Jailbreak",
          "MITRE ATLAS: AML.T0093: Prompt Infiltration via Public-Facing Application",
          "NIST AML: NISTAML.018: Prompt Injection"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "BASH_TAINT_58579f84eb",
      "rule_id": "BEHAVIOR_BASH_TAINT_FLOW",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Bash: tainted data flows to dangerous sink",
      "description": "Variable $TOK (line 1) flows to `curl` at line 3.",
      "file_path": "foundry-agent/toolbox/references/tool-azure-ai-search.md",
      "line_number": 160,
      "snippet": "curl -s -X POST \"$URL\" -H \"Authorization: Bearer $TOK\" -H \"Content-Type: application/json\" \\",
      "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.",
      "analyzer": "behavioral",
      "metadata": {
        "source_var": "TOK",
        "source_line": 1,
        "sink_command": "curl",
        "taints": [
          "COMMAND_OUTPUT"
        ],
        "behavior_category": "command_injection",
        "from_code_block": true,
        "block_language": "bash",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "YARA_jailbreak_generic_4fe92c9944",
      "rule_id": "YARA_jailbreak_generic",
      "category": "prompt_injection",
      "severity": "HIGH",
      "title": "JAILBREAK detected by YARA",
      "description": "Jailbreak attempt patterns: citation",
      "file_path": "foundry-agent/toolbox/references/tool-azure-ai-search.md",
      "line_number": 164,
      "snippet": "Citations come back under `result.structuredContent.documents[]` (each doc = one citation with `title` / `id` / `score`; add a `url` field to your index to populate it) \u2014 see [use-toolbox-in-hosted-agent.md \u00a7 Azure AI Search Citation Pattern](../../create/references/use-toolbox-in-hosted-agent.md#azure-ai-search-citation-pattern).",
      "remediation": "Review and remove jailbreak pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "jailbreak_generic",
        "yara_namespace": "jailbreak_generic",
        "matched_string": "$academic_paper",
        "threat_type": "JAILBREAK",
        "aitech": "AITech-1.1",
        "aitech_name": "Direct Prompt Injection and Jailbreak (Prompt-based Manipulation)",
        "aisubtech": "AISubtech-1.1.5",
        "aisubtech_name": "Context Manipulation",
        "aitech_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: ASI01: Agent Goal Hijack",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0054: LLM Jailbreak",
          "MITRE ATLAS: AML.T0093: Prompt Infiltration via Public-Facing Application",
          "NIST AML: NISTAML.018: Prompt Injection"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: ASI01: Agent Goal Hijack",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0054: LLM Jailbreak",
          "MITRE ATLAS: AML.T0093: Prompt Infiltration via Public-Facing Application",
          "NIST AML: NISTAML.018: Prompt Injection"
        ],
        "framework_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: ASI01: Agent Goal Hijack",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0054: LLM Jailbreak",
          "MITRE ATLAS: AML.T0093: Prompt Infiltration via Public-Facing Application",
          "NIST AML: NISTAML.018: Prompt Injection"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "YARA_jailbreak_generic_ddad2e953e",
      "rule_id": "YARA_jailbreak_generic",
      "category": "prompt_injection",
      "severity": "HIGH",
      "title": "JAILBREAK detected by YARA",
      "description": "Jailbreak attempt patterns: References",
      "file_path": "foundry-agent/toolbox/references/tool-azure-ai-search.md",
      "line_number": 168,
      "snippet": "## References",
      "remediation": "Review and remove jailbreak pattern",
      "analyzer": "static",
      "metadata": {
        "yara_rule": "jailbreak_generic",
        "yara_namespace": "jailbreak_generic",
        "matched_string": "$academic_paper",
        "threat_type": "JAILBREAK",
        "aitech": "AITech-1.1",
        "aitech_name": "Direct Prompt Injection and Jailbreak (Prompt-based Manipulation)",
        "aisubtech": "AISubtech-1.1.5",
        "aisubtech_name": "Context Manipulation",
        "aitech_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: ASI01: Agent Goal Hijack",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0054: LLM Jailbreak",
          "MITRE ATLAS: AML.T0093: Prompt Infiltration via Public-Facing Application",
          "NIST AML: NISTAML.018: Prompt Injection"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: ASI01: Agent Goal Hijack",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0054: LLM Jailbreak",
          "MITRE ATLAS: AML.T0093: Prompt Infiltration via Public-Facing Application",
          "NIST AML: NISTAML.018: Prompt Injection"
        ],
        "framework_mappings": [
          "OWASP: LLM01:2026: Prompt Injection",
          "OWASP: ASI01: Agent Goal Hijack",
          "MITRE ATLAS: AML.T0051: LLM Prompt Injection",
          "MITRE ATLAS: AML.T0054: LLM Jailbreak",
          "MITRE ATLAS: AML.T0093: Prompt Infiltration via Public-Facing Application",
          "NIST AML: NISTAML.018: Prompt Injection"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "BASH_TAINT_7317da433e",
      "rule_id": "BEHAVIOR_BASH_TAINT_FLOW",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Bash: tainted data flows to dangerous sink",
      "description": "Variable $TOK (line 1) flows to `curl` at line 3.",
      "file_path": "foundry-agent/toolbox/references/tool-code-interpreter.md",
      "line_number": 84,
      "snippet": "curl -s -X POST \"$URL\" -H \"Authorization: Bearer $TOK\" -H \"Content-Type: application/json\" \\",
      "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.",
      "analyzer": "behavioral",
      "metadata": {
        "source_var": "TOK",
        "source_line": 1,
        "sink_command": "curl",
        "taints": [
          "COMMAND_OUTPUT"
        ],
        "behavior_category": "command_injection",
        "from_code_block": true,
        "block_language": "bash",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "BASH_TAINT_3876ffc7ef",
      "rule_id": "BEHAVIOR_BASH_TAINT_FLOW",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Bash: tainted data flows to dangerous sink",
      "description": "Variable $TOKEN (line 2) flows to `curl` at line 5.",
      "file_path": "foundry-agent/toolbox/references/tool-file-search.md",
      "line_number": 18,
      "snippet": "FILE_ID=$(curl -sS -X POST \"$PROJ/openai/v1/files\" -H \"Authorization: Bearer $TOKEN\" \\",
      "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.",
      "analyzer": "behavioral",
      "metadata": {
        "source_var": "TOKEN",
        "source_line": 2,
        "sink_command": "curl",
        "taints": [
          "COMMAND_OUTPUT"
        ],
        "behavior_category": "command_injection",
        "from_code_block": true,
        "block_language": "bash",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "BASH_TAINT_c6a2b3ab4a",
      "rule_id": "BEHAVIOR_BASH_TAINT_FLOW",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Bash: tainted data flows to dangerous sink",
      "description": "Variable $TOKEN (line 2) flows to `curl` at line 9.",
      "file_path": "foundry-agent/toolbox/references/tool-file-search.md",
      "line_number": 22,
      "snippet": "VS_ID=$(curl -sS -X POST \"$PROJ/openai/v1/vector_stores\" -H \"Authorization: Bearer $TOKEN\" \\",
      "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.",
      "analyzer": "behavioral",
      "metadata": {
        "source_var": "TOKEN",
        "source_line": 2,
        "sink_command": "curl",
        "taints": [
          "COMMAND_OUTPUT"
        ],
        "behavior_category": "command_injection",
        "from_code_block": true,
        "block_language": "bash",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "BASH_TAINT_25822672d6",
      "rule_id": "BEHAVIOR_BASH_TAINT_FLOW",
      "category": "data_exfiltration",
      "severity": "HIGH",
      "title": "Bash: tainted data flows to dangerous sink",
      "description": "Variable $VS_ID (line 9) flows to `curl` at line 13.",
      "file_path": "foundry-agent/toolbox/references/tool-file-search.md",
      "line_number": 26,
      "snippet": "curl -sS \"$PROJ/openai/v1/vector_stores/$VS_ID\" -H \"Authorization: Bearer $TOKEN\" | jq '.status, .file_counts'",
      "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.",
      "analyzer": "behavioral",
      "metadata": {
        "source_var": "VS_ID",
        "source_line": 9,
        "sink_command": "curl",
        "taints": [
          "COMMAND_OUTPUT",
          "ENV_VAR"
        ],
        "behavior_category": "command_injection",
        "from_code_block": true,
        "block_language": "bash",
        "deduped_count": 1,
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "BASH_TAINT_9a1fb0f402",
      "rule_id": "BEHAVIOR_BASH_TAINT_FLOW",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Bash: tainted data flows to dangerous sink",
      "description": "Variable $TOKEN (line 3) flows to `curl` at line 5.",
      "file_path": "foundry-agent/toolbox/references/tool-openapi.md",
      "line_number": 145,
      "snippet": "curl -sS -X POST \"$ENDPOINT\" -H \"Authorization: Bearer $TOKEN\" -H \"Content-Type: application/json\" \\",
      "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.",
      "analyzer": "behavioral",
      "metadata": {
        "source_var": "TOKEN",
        "source_line": 3,
        "sink_command": "curl",
        "taints": [
          "COMMAND_OUTPUT"
        ],
        "behavior_category": "command_injection",
        "from_code_block": true,
        "block_language": "bash",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "BASH_TAINT_6abb3bfb94",
      "rule_id": "BEHAVIOR_BASH_TAINT_FLOW",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Bash: tainted data flows to dangerous sink",
      "description": "Variable $TOKEN (line 3) flows to `curl` at line 6.",
      "file_path": "foundry-agent/toolbox/references/tool-work-iq.md",
      "line_number": 137,
      "snippet": "curl -sS -X POST \"$ENDPOINT\" -H \"Authorization: Bearer $TOKEN\" -H \"Content-Type: application/json\" \\",
      "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.",
      "analyzer": "behavioral",
      "metadata": {
        "source_var": "TOKEN",
        "source_line": 3,
        "sink_command": "curl",
        "taints": [
          "COMMAND_OUTPUT"
        ],
        "behavior_category": "command_injection",
        "from_code_block": true,
        "block_language": "bash",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "CORRELATED_SENSITIVE_NETWORK_FLOW_d8e06ee5969e",
      "rule_id": "CORRELATED_SENSITIVE_NETWORK_FLOW",
      "category": "data_exfiltration",
      "severity": "HIGH",
      "title": "Sensitive source reaches a network sink",
      "description": "Correlated sensitive_environment \u2192 network behavior across foundry-agent/toolbox/scripts/get-catalog-inputs.sh.",
      "file_path": "foundry-agent/toolbox/scripts/get-catalog-inputs.sh",
      "line_number": 81,
      "snippet": null,
      "remediation": "Remove the transmission or constrain it to explicitly declared, trusted destinations.",
      "analyzer": "correlation",
      "metadata": {
        "files_involved": [
          "foundry-agent/toolbox/scripts/get-catalog-inputs.sh"
        ],
        "semantic_facts": {
          "evidence_kind": "correlated_behavior",
          "context_kind": "code",
          "commands": [
            {
              "executable": "curl",
              "argument_classes": [
                "request_method",
                "credential_authentication",
                "destination_external"
              ],
              "downloads": false,
              "executes": false,
              "destructive": false,
              "privilege_change": false,
              "source_class": "",
              "sink_class": "network",
              "file_path": "foundry-agent/toolbox/scripts/get-catalog-inputs.sh"
            }
          ],
          "urls": [
            {
              "url": "https://eastus.api.azureml.ms/asset-gallery/v1.0/tools",
              "scheme": "https",
              "host": "eastus.api.azureml.ms",
              "domain_class": "external",
              "trusted_installer": false,
              "method": "post",
              "direction": "outbound",
              "file_path": "foundry-agent/toolbox/scripts/get-catalog-inputs.sh"
            }
          ],
          "flows": [
            {
              "source_class": "sensitive_environment",
              "sink_class": "network",
              "transforms": [],
              "cross_file": false,
              "source_path": "foundry-agent/toolbox/scripts/get-catalog-inputs.sh",
              "sink_path": "foundry-agent/toolbox/scripts/get-catalog-inputs.sh"
            }
          ],
          "reference_edges": [],
          "signals": [
            {
              "rule_id": "CORRELATION_SIGNAL",
              "kind": "correlated_behavior",
              "file_path": "foundry-agent/toolbox/scripts/get-catalog-inputs.sh",
              "value_class": "sensitive_source"
            }
          ],
          "candidate_flow": {
            "source_class": "sensitive_environment",
            "sink_class": "network",
            "transforms": [],
            "cross_file": false,
            "source_path": "foundry-agent/toolbox/scripts/get-catalog-inputs.sh",
            "sink_path": "foundry-agent/toolbox/scripts/get-catalog-inputs.sh"
          }
        },
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "BASH_TAINT_01e920302b",
      "rule_id": "BEHAVIOR_BASH_TAINT_FLOW",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Bash: tainted data flows to dangerous sink",
      "description": "Variable $TOKEN (line 67) flows to `curl` at line 81.",
      "file_path": "foundry-agent/toolbox/scripts/get-catalog-inputs.sh",
      "line_number": 81,
      "snippet": "curl -sS -X POST \"$GALLERY\" -H \"Authorization: Bearer $TOKEN\" -H \"Content-Type: application/json\" -d \"$body\"",
      "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.",
      "analyzer": "behavioral",
      "metadata": {
        "source_var": "TOKEN",
        "source_line": 67,
        "sink_command": "curl",
        "taints": [
          "COMMAND_OUTPUT"
        ],
        "behavior_category": "command_injection",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "BASH_TAINT_434b5ae1d8",
      "rule_id": "BEHAVIOR_BASH_TAINT_FLOW",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Bash: tainted data flows to dangerous sink",
      "description": "Variable $RESOURCE_GROUP (line 5) flows to `source` at line 17.",
      "file_path": "models/deploy-model/preset/references/preset-workflow.md",
      "line_number": 70,
      "snippet": "echo \"  Resource Group: $RESOURCE_GROUP\"",
      "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.",
      "analyzer": "behavioral",
      "metadata": {
        "source_var": "RESOURCE_GROUP",
        "source_line": 5,
        "sink_command": "source",
        "taints": [
          "COMMAND_OUTPUT"
        ],
        "behavior_category": "command_injection",
        "from_code_block": true,
        "block_language": "bash",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "BASH_TAINT_06e91825ce",
      "rule_id": "BEHAVIOR_BASH_TAINT_FLOW",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Bash: tainted data flows to dangerous sink",
      "description": "Variable $PRINCIPAL_ID (line 2) flows to `source` at line 5.",
      "file_path": "rbac/rbac.md",
      "line_number": 95,
      "snippet": "az role assignment create --role \"<role-name>\" --assignee \"$PRINCIPAL_ID\" --scope \"<resource-scope>\"",
      "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.",
      "analyzer": "behavioral",
      "metadata": {
        "source_var": "PRINCIPAL_ID",
        "source_line": 2,
        "sink_command": "source",
        "taints": [
          "COMMAND_OUTPUT"
        ],
        "behavior_category": "command_injection",
        "from_code_block": true,
        "block_language": "bash",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    },
    {
      "id": "BASH_TAINT_097ae76342",
      "rule_id": "BEHAVIOR_BASH_TAINT_FLOW",
      "category": "data_exfiltration",
      "severity": "MEDIUM",
      "title": "Bash: tainted data flows to dangerous sink",
      "description": "Variable $SP_APP_ID (line 9) flows to `source` at line 10.",
      "file_path": "rbac/rbac.md",
      "line_number": 121,
      "snippet": "az role assignment create --role \"Contributor\" --assignee \"$SP_APP_ID\" --scope \"/subscriptions/<subscription-id>/resourceGroups/<resource-group>\"",
      "remediation": "Review the data flow from source to sink. Avoid sending sensitive or untrusted data to network or execution commands.",
      "analyzer": "behavioral",
      "metadata": {
        "source_var": "SP_APP_ID",
        "source_line": 9,
        "sink_command": "source",
        "taints": [
          "COMMAND_OUTPUT"
        ],
        "behavior_category": "command_injection",
        "from_code_block": true,
        "block_language": "bash",
        "aitech": "AITech-8.2",
        "aitech_name": "Data Exfiltration / Exposure",
        "aisubtech": "AISubtech-8.2.3",
        "aisubtech_name": "Data Exfiltration via Agent Tooling",
        "aitech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership",
          "MITRE ATLAS: AML.T0035: AI Artifact Collection",
          "MITRE ATLAS: AML.T0037: Data From Local System",
          "MITRE ATLAS: AML.T0057: LLM Data Leakage",
          "NIST AML: NISTAML.037: Training Data Attacks"
        ],
        "aisubtech_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "framework_mappings": [
          "OWASP: LLM02:2026: Sensitive Information Disclosure",
          "OWASP: ASI02: Tool Misuse & Exploitation",
          "OWASP: ASI09: Human-Agent Trust Exploitation",
          "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation",
          "NIST AML: N/A"
        ],
        "taxonomy_status": "mapped",
        "taxonomy_source": "rule"
      }
    }
  ],
  "scan_duration_seconds": 1.5833830833435059,
  "duration_ms": 1583,
  "analyzers_used": [
    "static_analyzer",
    "bytecode",
    "pipeline",
    "correlation",
    "behavioral_analyzer",
    "trigger_analyzer"
  ],
  "timestamp": "2026-10-22T04:36:03.066021+00:00",
  "scan_metadata": {
    "policy_name": "default",
    "policy_version": "1.0",
    "policy_preset_base": "balanced",
    "policy_fingerprint_sha256": "3f48e661bfbc54597f97bbf3dcf2c1cbae2f596ddc79c0b44784efea326b3d1d",
    "cel": {
      "mode": "shadow",
      "runtime": "cel-go",
      "runtime_version": "v0.32.0;helper=2.3.1",
      "fact_schema": "v1",
      "expression_set_hash": "f26459b8f4a46a974d7ab0aaae34127b5b6a40d693e266e12fca03a69a6d26aa",
      "evaluated": 0,
      "retained": 30,
      "would_suppress": 0,
      "suppressed": 0,
      "fallbacks": 0,
      "projection_incomplete": 0,
      "elapsed_ms": 0.0,
      "projection_ms": 0.0,
      "evaluation_ms": 0.0,
      "errors": [],
      "per_rule": {},
      "suppressed_candidates": []
    },
    "rule_contract": {
      "status": "failed",
      "schema_version": 2,
      "checked": 19,
      "invalid_findings": 2,
      "errors": [
        {
          "code": "UNKNOWN_BUNDLED_PYTHON_RULE",
          "rule_id": "BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN",
          "expected": "declared core schema-v2 Python rule",
          "actual": "missing"
        },
        {
          "code": "UNKNOWN_BUNDLED_PYTHON_RULE",
          "rule_id": "BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION",
          "expected": "declared core schema-v2 Python rule",
          "actual": "missing"
        }
      ]
    },
    "taxonomy": {
      "source": "builtin",
      "version": "2.0.0",
      "name": "Cisco AI Security and Safety Taxonomy",
      "revision": "655a343ac943a51b6f61f86e47156e7752c15dc6",
      "snapshot_sha256": "413e8ce9081e6d91b78aaa0d0b1c06cdc15d0406ad319e23e9f9f4f80735c441",
      "findings": {
        "mapped": 28,
        "not_applicable": 1,
        "unmapped": 0
      }
    }
  },
  "analyzers_failed": [
    {
      "analyzer": "behavioral",
      "error": "FindingContract:BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN:UNKNOWN_BUNDLED_PYTHON_RULE"
    },
    {
      "analyzer": "behavioral",
      "error": "FindingContract:BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION:UNKNOWN_BUNDLED_PYTHON_RULE"
    }
  ],
  "scanner_version": "2.3.1",
  "source": "microsoft",
  "repo_url": "https://github.com/microsoft/azure-skills"
}