{ "skill_name": "autoskill", "skill_path": "/home/runner/work/skill-scanner-test/skill-scanner-test/scripts/../skills/K-Dense-AI-scientific-agent-skills/skills/autoskill", "is_safe": false, "max_severity": "CRITICAL", "findings_count": 11, "findings": [ { "id": "CROSSFILE_ENV_VAR_EXFILTRATION_b714bffde5", "rule_id": "BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION", "category": "data_exfiltration", "severity": "CRITICAL", "title": "Cross-file env var exfiltration: 3 files", "description": "Environment variable access with network calls in scripts/backends.py, scripts/doctor.py, scripts/run.py", "file_path": null, "line_number": null, "snippet": null, "remediation": "Review data flow across files: scripts/doctor.py, scripts/backends.py, scripts/run.py", "analyzer": "behavioral", "metadata": { "aisubtech": "AISubtech-8.2.3", "files_involved": [ "scripts/doctor.py", "scripts/backends.py", "scripts/run.py" ], "threat_type": "env_var_exfiltration", "evidence": { "env_var_files": [ "scripts/backends.py", "scripts/doctor.py", "scripts/run.py" ], "network_files": [ "scripts/backends.py", "scripts/doctor.py", "scripts/run.py" ] }, "rule_contract": { "status": "invalid", "schema_version": 2, "errors": [ { "code": "UNKNOWN_BUNDLED_PYTHON_RULE", "rule_id": "BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION", "expected": "declared core schema-v2 Python rule", "actual": "missing" } ] }, "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "finding" } }, { "id": "CROSSFILE_EXFILTRATION_CHAIN_c3467bc7ca", "rule_id": "BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN", "category": "data_exfiltration", "severity": "CRITICAL", "title": "Cross-file exfiltration chain: 3 files", "description": "Multi-file exfiltration chain detected: scripts/backends.py, scripts/doctor.py, scripts/run.py collect data \u2192 scripts/run.py \u2192 scripts/backends.py, scripts/doctor.py, scripts/run.py transmit to network", "file_path": null, "line_number": null, "snippet": null, "remediation": "Review data flow across files: scripts/doctor.py, scripts/backends.py, scripts/run.py", "analyzer": "behavioral", "metadata": { "aisubtech": "AISubtech-8.2.3", "files_involved": [ "scripts/doctor.py", "scripts/backends.py", "scripts/run.py" ], "threat_type": "exfiltration_chain", "evidence": { "collection_files": [ "scripts/backends.py", "scripts/doctor.py", "scripts/run.py" ], "encoding_files": [ "scripts/run.py" ], "network_files": [ "scripts/backends.py", "scripts/doctor.py", "scripts/run.py" ] }, "rule_contract": { "status": "invalid", "schema_version": 2, "errors": [ { "code": "UNKNOWN_BUNDLED_PYTHON_RULE", "rule_id": "BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN", "expected": "declared core schema-v2 Python rule", "actual": "missing" } ] }, "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "finding" } }, { "id": "ENV_VAR_EXFILTRATION_87f9a8d4d4", "rule_id": "BEHAVIOR_ENV_VAR_EXFILTRATION", "category": "data_exfiltration", "severity": "CRITICAL", "title": "Environment variable access with network calls detected", "description": "Script accesses environment variables and makes network calls in /home/runner/work/skill-scanner-test/skill-scanner-test/skills/K-Dense-AI-scientific-agent-skills/skills/autoskill/scripts/backends.py", "file_path": "/home/runner/work/skill-scanner-test/skill-scanner-test/skills/K-Dense-AI-scientific-agent-skills/skills/autoskill/scripts/backends.py", "line_number": null, "snippet": null, "remediation": "Remove environment variable harvesting or network transmission", "analyzer": "behavioral", "metadata": { "has_network": true, "has_env_access": true, "suspicious_urls": [], "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "ENV_VAR_EXFILTRATION_37640eb48d", "rule_id": "BEHAVIOR_ENV_VAR_EXFILTRATION", "category": "data_exfiltration", "severity": "CRITICAL", "title": "Environment variable access with network calls detected", "description": "Script accesses environment variables and makes network calls in /home/runner/work/skill-scanner-test/skill-scanner-test/skills/K-Dense-AI-scientific-agent-skills/skills/autoskill/scripts/doctor.py", "file_path": "/home/runner/work/skill-scanner-test/skill-scanner-test/skills/K-Dense-AI-scientific-agent-skills/skills/autoskill/scripts/doctor.py", "line_number": null, "snippet": null, "remediation": "Remove environment variable harvesting or network transmission", "analyzer": "behavioral", "metadata": { "has_network": true, "has_env_access": true, "suspicious_urls": [], "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "ENV_VAR_EXFILTRATION_48548d5660", "rule_id": "BEHAVIOR_ENV_VAR_EXFILTRATION", "category": "data_exfiltration", "severity": "CRITICAL", "title": "Environment variable access with network calls detected", "description": "Script accesses environment variables and makes network calls in /home/runner/work/skill-scanner-test/skill-scanner-test/skills/K-Dense-AI-scientific-agent-skills/skills/autoskill/scripts/run.py", "file_path": "/home/runner/work/skill-scanner-test/skill-scanner-test/skills/K-Dense-AI-scientific-agent-skills/skills/autoskill/scripts/run.py", "line_number": null, "snippet": null, "remediation": "Remove environment variable harvesting or network transmission", "analyzer": "behavioral", "metadata": { "has_network": true, "has_env_access": true, "suspicious_urls": [], "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "ALLOWED_TOOLS_NETWORK_USAGE_9c65302de4", "rule_id": "ALLOWED_TOOLS_NETWORK_USAGE", "category": "unauthorized_tool_use", "severity": "MEDIUM", "title": "Code makes network requests", "description": "Skill code makes network requests. While not controlled by allowed-tools, network access should be documented and justified in the skill description.", "file_path": "SKILL.md", "line_number": null, "snippet": null, "remediation": "Document network usage in skill description or remove network operations if not needed", "analyzer": "static", "metadata": { "semantic_facts": { "evidence_kind": "capability_mismatch", "context_kind": "manifest", "signals": [ { "rule_id": "ALLOWED_TOOLS_NETWORK_USAGE", "kind": "undocumented_network", "file_path": "SKILL.md", "value_class": "external_network" } ], "candidate_flow": { "source_class": "skill_code", "sink_class": "external_network", "transforms": [], "cross_file": false, "source_path": "scripts/backends.py", "sink_path": "scripts/backends.py" }, "flows": [ { "source_class": "skill_code", "sink_class": "external_network", "transforms": [], "cross_file": false, "source_path": "scripts/backends.py", "sink_path": "scripts/backends.py" } ] }, "cel": { "decision": "would_suppress", "reason": "shadow_or_rule_rollout", "fact_schema": "v1", "expression_hash": "0b8ef9fa27b8e3797a476f560bb6e6af6243c9e03a7d09a3fd0756d96b57affe", "pack": "core", "rollout": "shadow" }, "aitech": "AITech-2.1", "aitech_name": "Excessive Agency", "aisubtech": "AISubtech-2.1.2", "aisubtech_name": "Capability and Permission Overreach", "aitech_mappings": [ "OWASP: LLM03:2026: Excessive Agency", "OWASP: ASI10: Rogue Agents", "MITRE ATLAS: N/A", "NIST AML: N/A" ], "aisubtech_mappings": [ "OWASP: LLM03:2026: Excessive Agency", "OWASP: ASI10: Rogue Agents", "MITRE ATLAS: N/A", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM03:2026: Excessive Agency", "OWASP: ASI10: Rogue Agents", "MITRE ATLAS: N/A", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "ALLOWED_TOOLS_GLOB_VIOLATION_7cb680e013", "rule_id": "ALLOWED_TOOLS_GLOB_VIOLATION", "category": "unauthorized_tool_use", "severity": "LOW", "title": "Code uses glob/file patterns but Glob tool not in allowed-tools", "description": "Skill restricts tools to ['Read', 'Write', 'Edit', 'Bash'] but code uses glob patterns", "file_path": "SKILL.md", "line_number": null, "snippet": null, "remediation": "Add 'Glob' to allowed-tools or remove glob operations", "analyzer": "static", "metadata": { "semantic_facts": { "evidence_kind": "capability_mismatch", "context_kind": "manifest", "signals": [ { "rule_id": "ALLOWED_TOOLS_GLOB_VIOLATION", "kind": "undeclared_tool", "file_path": "SKILL.md", "value_class": "glob" } ], "candidate_command": { "executable": "Glob", "argument_classes": [], "downloads": false, "executes": false, "destructive": false, "privilege_change": false, "source_class": "skill_code", "sink_class": "filesystem_enumeration", "file_path": "" }, "commands": [ { "executable": "Glob", "argument_classes": [], "downloads": false, "executes": false, "destructive": false, "privilege_change": false, "source_class": "skill_code", "sink_class": "filesystem_enumeration", "file_path": "" } ] }, "aitech": "AITech-2.1", "aitech_name": "Excessive Agency", "aisubtech": "AISubtech-2.1.2", "aisubtech_name": "Capability and Permission Overreach", "aitech_mappings": [ "OWASP: LLM03:2026: Excessive Agency", "OWASP: ASI10: Rogue Agents", "MITRE ATLAS: N/A", "NIST AML: N/A" ], "aisubtech_mappings": [ "OWASP: LLM03:2026: Excessive Agency", "OWASP: ASI10: Rogue Agents", "MITRE ATLAS: N/A", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM03:2026: Excessive Agency", "OWASP: ASI10: Rogue Agents", "MITRE ATLAS: N/A", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "ALLOWED_TOOLS_GREP_VIOLATION_0399b9cb65", "rule_id": "ALLOWED_TOOLS_GREP_VIOLATION", "category": "unauthorized_tool_use", "severity": "LOW", "title": "Code uses search/grep patterns but Grep tool not in allowed-tools", "description": "Skill restricts tools to ['Read', 'Write', 'Edit', 'Bash'] but code uses regex search patterns", "file_path": "SKILL.md", "line_number": null, "snippet": null, "remediation": "Add 'Grep' to allowed-tools or remove regex search operations", "analyzer": "static", "metadata": { "semantic_facts": { "evidence_kind": "capability_mismatch", "context_kind": "manifest", "signals": [ { "rule_id": "ALLOWED_TOOLS_GREP_VIOLATION", "kind": "undeclared_tool", "file_path": "SKILL.md", "value_class": "grep" } ], "candidate_command": { "executable": "Grep", "argument_classes": [], "downloads": false, "executes": false, "destructive": false, "privilege_change": false, "source_class": "skill_code", "sink_class": "content_search", "file_path": "" }, "commands": [ { "executable": "Grep", "argument_classes": [], "downloads": false, "executes": false, "destructive": false, "privilege_change": false, "source_class": "skill_code", "sink_class": "content_search", "file_path": "" } ] }, "aitech": "AITech-2.1", "aitech_name": "Excessive Agency", "aisubtech": "AISubtech-2.1.2", "aisubtech_name": "Capability and Permission Overreach", "aitech_mappings": [ "OWASP: LLM03:2026: Excessive Agency", "OWASP: ASI10: Rogue Agents", "MITRE ATLAS: N/A", "NIST AML: N/A" ], "aisubtech_mappings": [ "OWASP: LLM03:2026: Excessive Agency", "OWASP: ASI10: Rogue Agents", "MITRE ATLAS: N/A", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM03:2026: Excessive Agency", "OWASP: ASI10: Rogue Agents", "MITRE ATLAS: N/A", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "CORRELATED_SENSITIVE_NETWORK_FLOW_028061874398", "rule_id": "CORRELATED_SENSITIVE_NETWORK_FLOW", "category": "data_exfiltration", "severity": "HIGH", "title": "Sensitive source reaches a network sink", "description": "Correlated sensitive_environment \u2192 network behavior across scripts/doctor.py.", "file_path": "scripts/doctor.py", "line_number": 22, "snippet": null, "remediation": "Remove the transmission or constrain it to explicitly declared, trusted destinations.", "analyzer": "correlation", "metadata": { "files_involved": [ "scripts/doctor.py" ], "semantic_facts": { "evidence_kind": "correlated_behavior", "context_kind": "code", "commands": [ { "executable": "httpx", "argument_classes": [ "request_method", "credential_payload", "destination_dynamic" ], "downloads": true, "executes": false, "destructive": false, "privilege_change": false, "source_class": "network", "sink_class": "network", "file_path": "scripts/doctor.py" } ], "urls": [], "flows": [ { "source_class": "sensitive_environment", "sink_class": "network", "transforms": [], "cross_file": false, "source_path": "scripts/doctor.py", "sink_path": "scripts/doctor.py" } ], "reference_edges": [ { "source_path": "scripts/doctor.py", "target_path": "scripts/backends.py", "kind": "package_reference" } ], "signals": [ { "rule_id": "CORRELATION_SIGNAL", "kind": "correlated_behavior", "file_path": "scripts/doctor.py", "value_class": "sensitive_source" } ], "candidate_flow": { "source_class": "sensitive_environment", "sink_class": "network", "transforms": [], "cross_file": false, "source_path": "scripts/doctor.py", "sink_path": "scripts/doctor.py" } }, "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "DATA_EXFIL_NETWORK_REQUESTS_188fe9440b", "rule_id": "DATA_EXFIL_NETWORK_REQUESTS", "category": "data_exfiltration", "severity": "MEDIUM", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: httpx.get(", "file_path": "scripts/doctor.py", "line_number": 22, "snippet": "r = httpx.get(f\"{url.rstrip('/')}/health\", headers=headers, timeout=5.0)", "remediation": "Ensure network operations are necessary and document allowed destinations", "analyzer": "static", "metadata": { "matched_pattern": "httpx\\.(?:get|post|put|delete|patch|request)\\s*\\(", "matched_text": "httpx.get(", "signature_pattern_index": 1, "signature_match_start": 4, "signature_match_end": 14, "signature_pattern_sha256": "cd3536d9067c798681c889eb8c7459a4a51bcd9df88f02ecd4373440d8b4b403", "scanner_category": "SECURITY VIOLATION", "signature_context": "code", "signature_polarity": "active", "source_category": "data_exfiltration", "category_normalization": "native", "semantic_facts": { "evidence_kind": "signature_pattern", "context_kind": "code", "signals": [ { "rule_id": "DATA_EXFIL_NETWORK_REQUESTS", "kind": "signature_polarity", "file_path": "scripts/doctor.py", "value_class": "active" }, { "rule_id": "DATA_EXFIL_NETWORK_REQUESTS", "kind": "unreferenced_executable", "file_path": "scripts/doctor.py", "value_class": "python" } ] }, "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } }, { "id": "DATA_EXFIL_NETWORK_REQUESTS_96fc697e00", "rule_id": "DATA_EXFIL_NETWORK_REQUESTS", "category": "data_exfiltration", "severity": "MEDIUM", "title": "Outbound network request primitives that can transmit data externally", "description": "Pattern detected: httpx.get(", "file_path": "scripts/doctor.py", "line_number": 38, "snippet": "r = httpx.get(f\"{endpoint.rstrip('/')}/models\", headers=headers, timeout=5.0)", "remediation": "Ensure network operations are necessary and document allowed destinations", "analyzer": "static", "metadata": { "matched_pattern": "httpx\\.(?:get|post|put|delete|patch|request)\\s*\\(", "matched_text": "httpx.get(", "signature_pattern_index": 1, "signature_match_start": 4, "signature_match_end": 14, "signature_pattern_sha256": "cd3536d9067c798681c889eb8c7459a4a51bcd9df88f02ecd4373440d8b4b403", "scanner_category": "SECURITY VIOLATION", "signature_context": "code", "signature_polarity": "active", "source_category": "data_exfiltration", "category_normalization": "native", "semantic_facts": { "evidence_kind": "signature_pattern", "context_kind": "code", "signals": [ { "rule_id": "DATA_EXFIL_NETWORK_REQUESTS", "kind": "signature_polarity", "file_path": "scripts/doctor.py", "value_class": "active" }, { "rule_id": "DATA_EXFIL_NETWORK_REQUESTS", "kind": "unreferenced_executable", "file_path": "scripts/doctor.py", "value_class": "python" } ] }, "aitech": "AITech-8.2", "aitech_name": "Data Exfiltration / Exposure", "aisubtech": "AISubtech-8.2.3", "aisubtech_name": "Data Exfiltration via Agent Tooling", "aitech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0024.000: Exfiltration via AI Inference API: Infer Training Data Membership", "MITRE ATLAS: AML.T0035: AI Artifact Collection", "MITRE ATLAS: AML.T0037: Data From Local System", "MITRE ATLAS: AML.T0057: LLM Data Leakage", "NIST AML: NISTAML.037: Training Data Attacks" ], "aisubtech_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "framework_mappings": [ "OWASP: LLM02:2026: Sensitive Information Disclosure", "OWASP: ASI02: Tool Misuse & Exploitation", "OWASP: ASI09: Human-Agent Trust Exploitation", "MITRE ATLAS: AML.T0086: Exfiltration via AI Agent Tool Invocation", "NIST AML: N/A" ], "taxonomy_status": "mapped", "taxonomy_source": "rule" } } ], "scan_duration_seconds": 0.514920711517334, "duration_ms": 514, "analyzers_used": [ "static_analyzer", "bytecode", "pipeline", "correlation", "behavioral_analyzer", "trigger_analyzer" ], "timestamp": "2026-10-21T21:37:00.126566+00:00", "scan_metadata": { "policy_name": "default", "policy_version": "1.0", "policy_preset_base": "balanced", "policy_fingerprint_sha256": "3f48e661bfbc54597f97bbf3dcf2c1cbae2f596ddc79c0b44784efea326b3d1d", "cel": { "mode": "shadow", "runtime": "cel-go", "runtime_version": "v0.32.0;helper=2.3.1", "fact_schema": "v1", "expression_set_hash": "f26459b8f4a46a974d7ab0aaae34127b5b6a40d693e266e12fca03a69a6d26aa", "evaluated": 1, "retained": 11, "would_suppress": 1, "suppressed": 0, "fallbacks": 0, "projection_incomplete": 0, "elapsed_ms": 1.207, "projection_ms": 0.417, "evaluation_ms": 0.671, "errors": [], "per_rule": { "ALLOWED_TOOLS_NETWORK_USAGE": { "keep": 0, "would_suppress": 1, "fallback": 0, "suppressed": 0, "expression_hash": "0b8ef9fa27b8e3797a476f560bb6e6af6243c9e03a7d09a3fd0756d96b57affe", "pack": "core", "rollout": "shadow" } }, "suppressed_candidates": [] }, "rule_contract": { "status": "failed", "schema_version": 2, "checked": 9, "invalid_findings": 2, "errors": [ { "code": "UNKNOWN_BUNDLED_PYTHON_RULE", "rule_id": "BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN", "expected": "declared core schema-v2 Python rule", "actual": "missing" }, { "code": "UNKNOWN_BUNDLED_PYTHON_RULE", "rule_id": "BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION", "expected": "declared core schema-v2 Python rule", "actual": "missing" } ] }, "taxonomy": { "source": "builtin", "version": "2.0.0", "name": "Cisco AI Security and Safety Taxonomy", "revision": "655a343ac943a51b6f61f86e47156e7752c15dc6", "snapshot_sha256": "413e8ce9081e6d91b78aaa0d0b1c06cdc15d0406ad319e23e9f9f4f80735c441", "findings": { "mapped": 11, "not_applicable": 0, "unmapped": 0 } } }, "analyzers_failed": [ { "analyzer": "behavioral", "error": "FindingContract:BEHAVIOR_CROSSFILE_EXFILTRATION_CHAIN:UNKNOWN_BUNDLED_PYTHON_RULE" }, { "analyzer": "behavioral", "error": "FindingContract:BEHAVIOR_CROSSFILE_ENV_VAR_EXFILTRATION:UNKNOWN_BUNDLED_PYTHON_RULE" } ], "scanner_version": "2.3.1", "source": "K-Dense-AI", "repo_url": "https://github.com/K-Dense-AI/scientific-agent-skills" }