{ "skill_name": "lark-slides", "skill_path": "/Users/brianlevine/claude-projects/skill-scanner-test/skills/site-open.feishu.cn/lark-slides", "is_safe": true, "max_severity": "MEDIUM", "findings_count": 53, "findings": [ { "id": "HIDDEN_DATA_FILE_9199294001", "rule_id": "HIDDEN_DATA_FILE", "category": "obfuscation", "severity": "LOW", "title": "Hidden data file detected", "description": "Hidden file found: .wellknown-origin.json. Hidden files may contain concealed configuration or data that should be reviewed.", "file_path": ".wellknown-origin.json", "line_number": null, "snippet": null, "remediation": "Move file to a visible location or document its purpose.", "analyzer": "static", "metadata": { "semantic_facts": { "evidence_kind": "file_inventory", "context_kind": "package", "signals": [ { "rule_id": "HIDDEN_DATA_FILE", "kind": "hidden_file", "file_path": ".wellknown-origin.json", "value_class": "other" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_6324effa0e", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'SKILL.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "SKILL.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "SKILL.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "TRIGGER_SHORT_61904263", "rule_id": "TRIGGER_DESCRIPTION_TOO_SHORT", "category": "social_engineering", "severity": "LOW", "title": "Skill description is too short", "description": "Description has only 3 words. Short descriptions may not provide enough context for the agent to determine when this skill should be used.", "file_path": "SKILL.md", "line_number": null, "snippet": null, "remediation": "Expand the description to at least 10-20 words explaining the skill's purpose, capabilities, and appropriate use cases.", "analyzer": "trigger", "metadata": { "aitech": null, "aitech_name": null, "aisubtech": null, "aisubtech_name": null, "aitech_mappings": [], "aisubtech_mappings": [], "framework_mappings": [], "taxonomy_status": "not_applicable", "taxonomy_source": "rule" } }, { "id": "SKILL_LOAD_FALLBACK_USED", "rule_id": "SKILL_LOAD_FALLBACK_USED", "category": "policy_violation", "severity": "INFO", "title": "Strict manifest load failed; inert fallback scan used", "description": "SkillLoadError rejected malformed or missing manifest metadata. The bounded package body was still scanned as inert content; manifest capabilities were not trusted.", "file_path": "SKILL.md", "line_number": null, "snippet": null, "remediation": "Repair the YAML frontmatter and provide the required manifest fields.", "analyzer": "skill_loader", "metadata": { "fallback_used": true, "fallback_mode": "bounded_inert_raw_body", "strict_error_type": "SkillLoadError", "strict_error_code": "MISSING_REQUIRED_MANIFEST_FIELD", "manifest_complete": false, "capability_facts_trusted": false, "projection_complete": false, "projection_error_code": "MANIFEST_METADATA_INCOMPLETE", "aitech": null, "aitech_name": null, "aisubtech": null, "aisubtech_name": null, "aitech_mappings": [], "aisubtech_mappings": [], "framework_mappings": [], "taxonomy_status": "not_applicable", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_f34aeba3fb", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'asset-planning.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/asset-planning.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/asset-planning.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_9bb42b1074", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-add-slide.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/cli/lark-slides-add-slide.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/cli/lark-slides-add-slide.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_29b35337df", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-create.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/cli/lark-slides-create.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/cli/lark-slides-create.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_98b37fa581", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-delete-slide.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/cli/lark-slides-delete-slide.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/cli/lark-slides-delete-slide.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_d9bf654df8", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-history.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/cli/lark-slides-history.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/cli/lark-slides-history.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_2ff2174b40", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-media-upload.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/cli/lark-slides-media-upload.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/cli/lark-slides-media-upload.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_44c81df070", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-replace-slide.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/cli/lark-slides-replace-slide.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/cli/lark-slides-replace-slide.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_52e4fde1ee", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-screenshot.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/cli/lark-slides-screenshot.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/cli/lark-slides-screenshot.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_eb97b95655", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-update-slide.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/cli/lark-slides-update-slide.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/cli/lark-slides-update-slide.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_b22362400e", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-xml-presentation-slide-get.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/cli/lark-slides-xml-presentation-slide-get.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/cli/lark-slides-xml-presentation-slide-get.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_c6444c8d7f", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-xml-presentation-slide-replace.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/cli/lark-slides-xml-presentation-slide-replace.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/cli/lark-slides-xml-presentation-slide-replace.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_1e38160c35", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-xml-presentations-get.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/cli/lark-slides-xml-presentations-get.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/cli/lark-slides-xml-presentations-get.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_7275afaea7", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "MEDIUM", "title": "File extension does not match actual content type", "description": "File 'iconpark-index.json' extension (.json) suggests one format but Magika detected a different text format: HTML document (html). This may indicate content obfuscation or a misnamed file.", "file_path": "references/iconpark-index.json", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".json", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/iconpark-index.json", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_ffbca46048", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'iconpark.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/iconpark.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/iconpark.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_1c686ce39f", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-add-slide.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/lark-slides-add-slide.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/lark-slides-add-slide.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_0fe628e8ea", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-create.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/lark-slides-create.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/lark-slides-create.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_de1b2fcd6f", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-delete-slide.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/lark-slides-delete-slide.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/lark-slides-delete-slide.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_d43039aa8e", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-edit-workflows.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/lark-slides-edit-workflows.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/lark-slides-edit-workflows.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_cc81fc0f49", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-history.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/lark-slides-history.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/lark-slides-history.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_dac41db468", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-media-upload.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/lark-slides-media-upload.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/lark-slides-media-upload.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_aea19b188f", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-pptx-template-workflows.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/lark-slides-pptx-template-workflows.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/lark-slides-pptx-template-workflows.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_aac2360ba9", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-replace-slide.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/lark-slides-replace-slide.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/lark-slides-replace-slide.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_bdc8e5ddcd", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-screenshot.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/lark-slides-screenshot.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/lark-slides-screenshot.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_c329cf4a48", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-xml-presentation-slide-get.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/lark-slides-xml-presentation-slide-get.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/lark-slides-xml-presentation-slide-get.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_66b7feeb3b", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-xml-presentation-slide-replace.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/lark-slides-xml-presentation-slide-replace.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/lark-slides-xml-presentation-slide-replace.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_836fb05ceb", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'lark-slides-xml-presentations-get.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/lark-slides-xml-presentations-get.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/lark-slides-xml-presentations-get.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_de552f0d0f", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'planning-layer.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/planning-layer.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/planning-layer.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_01510731af", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "MEDIUM", "title": "File extension does not match actual content type", "description": "File 'slides_chart_demo.xml' extension (.xml) suggests one format but Magika detected a different text format: HTML document (html). This may indicate content obfuscation or a misnamed file.", "file_path": "references/slides_chart_demo.xml", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".xml", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/slides_chart_demo.xml", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_a444016157", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "MEDIUM", "title": "File extension does not match actual content type", "description": "File 'slides_xml_schema_definition.xml' extension (.xml) suggests one format but Magika detected a different text format: HTML document (html). This may indicate content obfuscation or a misnamed file.", "file_path": "references/slides_xml_schema_definition.xml", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".xml", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/slides_xml_schema_definition.xml", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_f46d999809", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'troubleshooting.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/troubleshooting.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/troubleshooting.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_2182efbd1b", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'validation-checklist.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/validation-checklist.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/validation-checklist.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_3d7371dde2", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'visual-planning.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/visual-planning.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/visual-planning.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_97cfd412be", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'error-handling.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/workflow/error-handling.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/workflow/error-handling.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_8dcc4db7ee", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'slides-editing.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/workflow/slides-editing.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/workflow/slides-editing.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_b1398b6299", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'template-editing.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/workflow/template-editing.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/workflow/template-editing.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_7710ea6cef", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'validation-xml.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/workflow/validation-xml.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/workflow/validation-xml.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_551fc1f5b7", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'xml-schema-quick-ref.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/xml-schema-quick-ref.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/xml-schema-quick-ref.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_a793b85939", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "MEDIUM", "title": "File extension does not match actual content type", "description": "File 'iconpark-index.json' extension (.json) suggests one format but Magika detected a different text format: HTML document (html). This may indicate content obfuscation or a misnamed file.", "file_path": "references/xml/iconpark-index.json", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".json", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/xml/iconpark-index.json", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_bbf12b170e", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'iconpark.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/xml/iconpark.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/xml/iconpark.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_59fccfb707", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "MEDIUM", "title": "File extension does not match actual content type", "description": "File 'slides_chart_demo.xml' extension (.xml) suggests one format but Magika detected a different text format: HTML document (html). This may indicate content obfuscation or a misnamed file.", "file_path": "references/xml/slides_chart_demo.xml", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".xml", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/xml/slides_chart_demo.xml", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_402277db37", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "MEDIUM", "title": "File extension does not match actual content type", "description": "File 'slides_xml_schema_definition.xml' extension (.xml) suggests one format but Magika detected a different text format: HTML document (html). This may indicate content obfuscation or a misnamed file.", "file_path": "references/xml/slides_xml_schema_definition.xml", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".xml", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/xml/slides_xml_schema_definition.xml", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_d63a0557b1", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "LOW", "title": "File extension does not match actual content type", "description": "Markdown file 'xml-schema-quick-ref.md' reads mostly as HTML document (html). Markdown commonly embeds code, so this is reported for visibility rather than as obfuscation.", "file_path": "references/xml/xml-schema-quick-ref.md", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".md", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "references/xml/xml-schema-quick-ref.md", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_c6ac67a3a7", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "MEDIUM", "title": "File extension does not match actual content type", "description": "File 'iconpark_tool.py' extension (.py) suggests one format but Magika detected a different text format: HTML document (html). This may indicate content obfuscation or a misnamed file.", "file_path": "scripts/iconpark_tool.py", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".py", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "scripts/iconpark_tool.py", "value_class": "binary" }, { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "unreferenced_executable", "file_path": "scripts/iconpark_tool.py", "value_class": "python" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_324eb20b5b", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "MEDIUM", "title": "File extension does not match actual content type", "description": "File 'iconpark_tool_test.py' extension (.py) suggests one format but Magika detected a different text format: HTML document (html). This may indicate content obfuscation or a misnamed file.", "file_path": "scripts/iconpark_tool_test.py", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".py", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "scripts/iconpark_tool_test.py", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_196e993fc0", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "MEDIUM", "title": "File extension does not match actual content type", "description": "File 'sxsd_validator.py' extension (.py) suggests one format but Magika detected a different text format: HTML document (html). This may indicate content obfuscation or a misnamed file.", "file_path": "scripts/sxsd_validator.py", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".py", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "scripts/sxsd_validator.py", "value_class": "binary" }, { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "unreferenced_executable", "file_path": "scripts/sxsd_validator.py", "value_class": "python" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_5c681ce65d", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "MEDIUM", "title": "File extension does not match actual content type", "description": "File 'xml_lint.py' extension (.py) suggests one format but Magika detected a different text format: HTML document (html). This may indicate content obfuscation or a misnamed file.", "file_path": "scripts/xml_lint.py", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".py", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "scripts/xml_lint.py", "value_class": "binary" }, { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "unreferenced_executable", "file_path": "scripts/xml_lint.py", "value_class": "python" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_f7ba597d29", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "MEDIUM", "title": "File extension does not match actual content type", "description": "File 'xml_lint_test.py' extension (.py) suggests one format but Magika detected a different text format: HTML document (html). This may indicate content obfuscation or a misnamed file.", "file_path": "scripts/xml_lint_test.py", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".py", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "scripts/xml_lint_test.py", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_21331123a3", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "MEDIUM", "title": "File extension does not match actual content type", "description": "File 'xml_text_overlap_lint.py' extension (.py) suggests one format but Magika detected a different text format: HTML document (html). This may indicate content obfuscation or a misnamed file.", "file_path": "scripts/xml_text_overlap_lint.py", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".py", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "scripts/xml_text_overlap_lint.py", "value_class": "binary" }, { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "unreferenced_executable", "file_path": "scripts/xml_text_overlap_lint.py", "value_class": "python" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "FILE_MAGIC_MISMATCH_e2828f15b5", "rule_id": "FILE_MAGIC_MISMATCH", "category": "obfuscation", "severity": "MEDIUM", "title": "File extension does not match actual content type", "description": "File 'xml_text_overlap_lint_test.py' extension (.py) suggests one format but Magika detected a different text format: HTML document (html). This may indicate content obfuscation or a misnamed file.", "file_path": "scripts/xml_text_overlap_lint_test.py", "line_number": null, "snippet": null, "remediation": "Rename the file to match its actual content type, or remove it if it appears malicious.", "analyzer": "static", "metadata": { "actual_type": "code/html", "actual_family": "code", "claimed_extension": ".py", "confidence_score": 0.9649904370307922, "semantic_facts": { "evidence_kind": "file_magic", "context_kind": "binary", "signals": [ { "rule_id": "FILE_MAGIC_MISMATCH", "kind": "file_magic_mismatch", "file_path": "scripts/xml_text_overlap_lint_test.py", "value_class": "binary" } ] }, "aitech": "AITech-9.2", "aitech_name": "Detection Evasion", "aisubtech": "AISubtech-9.2.1", "aisubtech_name": "Obfuscation Vulnerabilities", "aitech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "MITRE ATLAS: AML.T0107: Exploitation for Defense Evasion", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "aisubtech_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "framework_mappings": [ "OWASP: LLM09:2026: Vector and Embedding Weaknesses", "OWASP: ASI04: Agentic Supply Chain Vulnerabilities", "MITRE ATLAS: AML.T0074: Masquerading", "MITRE ATLAS: AML.T0068: LLM Prompt Obfuscation", "NIST AML: N/A", "Cisco AI MDL Code: MDL-001", "Cisco AI MDL Code: MDL-003", "Cisco AI MDL Code: MDL-009", "Cisco AI MDL Code: MDL-011", "Cisco AI MDL Code: MDL-016", "Cisco AI MDL Code: MDL-017", "Cisco AI MDL Code: MDL-019" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } } ], "scan_duration_seconds": 0.4170699119567871, "duration_ms": 417, "analyzers_used": [ "static_analyzer", "bytecode", "pipeline", "correlation", "behavioral_analyzer", "trigger_analyzer" ], "timestamp": "2026-10-22T04:36:14.278323+00:00", "scan_metadata": { "policy_name": "default", "policy_version": "1.0", "policy_preset_base": "balanced", "policy_fingerprint_sha256": "3f48e661bfbc54597f97bbf3dcf2c1cbae2f596ddc79c0b44784efea326b3d1d", "cel": { "mode": "shadow", "runtime": "cel-go", "runtime_version": "v0.32.0;helper=2.3.1", "fact_schema": "v1", "expression_set_hash": "f26459b8f4a46a974d7ab0aaae34127b5b6a40d693e266e12fca03a69a6d26aa", "evaluated": 0, "retained": 53, "would_suppress": 0, "suppressed": 0, "fallbacks": 0, "projection_incomplete": 0, "elapsed_ms": 0.0, "projection_ms": 0.0, "evaluation_ms": 0.0, "errors": [], "per_rule": {}, "suppressed_candidates": [] }, "rule_contract": { "status": "passed", "schema_version": 2, "checked": 53, "invalid_findings": 0, "errors": [] }, "loader": { "fallback_used": true, "fallback_mode": "bounded_inert_raw_body", "strict_error_type": "SkillLoadError", "strict_error_code": "MISSING_REQUIRED_MANIFEST_FIELD", "manifest_complete": false, "capability_facts_trusted": false, "projection_complete": false, "projection_error_code": "MANIFEST_METADATA_INCOMPLETE" }, "taxonomy": { "source": "builtin", "version": "2.0.0", "name": "Cisco AI Security and Safety Taxonomy", "revision": "655a343ac943a51b6f61f86e47156e7752c15dc6", "snapshot_sha256": "413e8ce9081e6d91b78aaa0d0b1c06cdc15d0406ad319e23e9f9f4f80735c441", "findings": { "mapped": 51, "not_applicable": 2, "unmapped": 0 } } }, "analyzers_failed": [ { "analyzer": "skill_loader", "error": "SkillLoadError:MISSING_REQUIRED_MANIFEST_FIELD" } ], "scanner_version": "2.3.1", "source": "open.feishu.cn", "repo_url": "https://open.feishu.cn/.well-known/skills/index.json" }