{
  "ml": {
    "v": "7",
    "id": 413,
    "lvl": -1,
    "conf": 0,
    "prob": 0.00003053744512726553,
    "type": "go",
    "version": "v18.18",
    "analyzed_at": "2026-09-22T21:35:02Z"
  },
  "path": "go-sandbox@v0.2.1",
  "raw": {
    "rev": "a041b",
    "files": [
      {
        "id": 556,
        "mol": "K(Mc)O₃(AlCS)H₅(Cm₂Db₆F₁₀Os₄Po₇)Md₃(In₆Pa₃)",
        "pid": 83,
        "rel": "fetched",
        "sha": "3b7670baf0fd1da52359d8f51ea5769ddd3f7394ab7c27b713df7c6e97b6fc9d",
        "via": "https://proxy.golang.org/github.com/hollis-labs/go-sandbox/@v/v0.2.1.zip",
        "path": "pkg:golang/github.com/hollis-labs/go-sandbox@v0.2.1",
        "risk": 29,
        "size": 36002,
        "type": "zip",
        "depth": 2,
        "facts": {
          "metrics": {
            "file": {
              "size": 36002,
              "entropy": 7.88
            },
            "binary": {
              "peak_region_bytes": 32768,
              "peak_region_entropy": 7.82
            },
            "archive": {
              "file_count": 21,
              "member_count": 21,
              "script_count": 0,
              "zip_bomb_ratio": 4.23,
              "compressed_size": 31370,
              "directory_count": 0,
              "executable_count": 0,
              "extra_field_size": 0,
              "noise_file_count": 0,
              "compression.ratio": 0.35,
              "hidden_file_count": 1,
              "uncompressed_size": 88711,
              "crc_collision_count": 0,
              "entry_comment_count": 0,
              "max_filename_length": 94,
              "rtlo_filename_count": 0,
              "format.regular_count": 21,
              "nested_archive_count": 0,
              "path_traversal_count": 0,
              "symlink_escape_count": 0,
              "security.setgid_count": 0,
              "security.setuid_count": 0,
              "security.sticky_count": 0,
              "double_extension_count": 0,
              "duplicate_member_count": 0,
              "security.symlink_count": 0,
              "unicode_filename_count": 0,
              "homoglyph_filename_count": 0,
              "security.encrypted_count": 0,
              "misplaced_executable_count": 0,
              "timing.mtime_dominant_count": 21,
              "timing.sentinel_mtime_count": 21,
              "security.world_writable_count": 0,
              "timing.mtime_dominant_fraction": 1,
              "compression.method_counts.deflate": 21
            }
          }
        },
        "ident": {
          "name": {
            "value": "v0",
            "source": "file.basename",
            "verified": false
          },
          "trust": "unsigned",
          "version": {
            "value": "2.1",
            "source": "file.basename",
            "verified": false
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/data/embedded/script::embedded-php-command-exec-call",
            "conf": 0.96,
            "crit": 3,
            "desc": "Embedded PHP command execution call",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "micro-behaviors/os/security/sandbox::macos-sandbox-exec-reference",
            "conf": 0.9,
            "crit": 3,
            "desc": "References the macOS sandbox-exec wrapper",
            "from": [
              {
                "file": 11
              }
            ]
          },
          {
            "id": "metadata/import/go/strconv::strconv",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports strconv",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "metadata/import/go/net::net",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports net",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "well-known/malware/rat/overlord/agent::overlord-linux-input-buildtag",
            "atk": "T1071.001",
            "mbc": "B0030",
            "conf": 0.98,
            "crit": 3,
            "desc": "Overlord Linux-only input build constraint",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "metadata/import/go/net/http::net/http",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports net/http",
            "from": [
              {
                "file": 17
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/listen::accept-go",
            "atk": "T1071",
            "mbc": "C0001",
            "conf": 0.92,
            "crit": 3,
            "desc": "Go zero-argument Accept method call"
          },
          {
            "id": "metadata/import/go/github/com/hollis-labs/go-sandbox/sandbox::github/com/hollis-labs/go-sandbox/sandbox",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports github.com/hollis-labs/go-sandbox/sandbox",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/import/go/context::context",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports context",
            "from": [
              {
                "file": 17
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::go-command-output-capture",
            "atk": "T1059.003",
            "conf": 0.9,
            "crit": 3,
            "desc": "Go command output capture",
            "from": [
              {
                "file": 17
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::go-test-file",
            "conf": 0.7,
            "crit": 2,
            "desc": "Go test file suffix",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/read/file/full::os-readfile",
            "conf": 0.9,
            "crit": 2,
            "desc": "Read file contents via os.ReadFile",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/lang::stdio-redirect",
            "conf": 0.6,
            "crit": 3,
            "desc": "Configures child-process standard I/O"
          },
          {
            "id": "metadata/import/go/sync::sync",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports sync",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/unsafe::go-unsafe-package-import",
            "conf": 0.95,
            "crit": 3,
            "desc": "Imports Go's unsafe package",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "metadata/import/go/flag::flag",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports flag",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/read/directory::readdir-call",
            "atk": "T1083",
            "mbc": "E1083",
            "conf": 0.6,
            "crit": 2,
            "desc": "os.ReadDir directory listing",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/split::go-context-with-timeout",
            "conf": 0.4,
            "crit": 3,
            "desc": "context.WithTimeout call",
            "from": [
              {
                "file": 17
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/device/ioctl::go-syscall-ioctl",
            "conf": 0.98,
            "crit": 3,
            "desc": "Go invokes ioctl through syscall.Syscall"
          },
          {
            "id": "micro-behaviors/fs/proc/info/listing::go-proc-dir-literal",
            "conf": 0.8,
            "crit": 3,
            "desc": "Go /proc directory literal",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/eval::go-interpreter-process-call",
            "atk": "T1059",
            "conf": 0.94,
            "crit": 3,
            "desc": "Go launches a child interpreter",
            "from": [
              {
                "file": 14
              }
            ]
          },
          {
            "id": "micro-behaviors/data/source/unsafe::go-unsafe-pointer-conversion",
            "conf": 0.92,
            "crit": 3,
            "desc": "Converts a Go pointer through unsafe.Pointer",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-3",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"that\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::exec-command",
            "atk": "T1059.003",
            "conf": 0.95,
            "crit": 3,
            "desc": "Creates a child process with Go exec.Command",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/unit::go-func-test",
            "conf": 0.8,
            "crit": 2,
            "desc": "Go test function name",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/full::go-os-writefile",
            "conf": 0.9,
            "crit": 3,
            "desc": "Go writes data with os.WriteFile",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/delete/file/library::os-Remove",
            "atk": "T1070.004",
            "mbc": "C0047",
            "conf": 0.9,
            "crit": 3,
            "desc": "Delete file (os.Remove)",
            "from": [
              {
                "file": 11
              }
            ]
          },
          {
            "id": "metadata/import/go/log::log",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports log",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/socket/listen::listen-go",
            "atk": "T1071",
            "mbc": "C0001",
            "conf": 0.9,
            "crit": 3,
            "desc": "Go net.Listen call",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/read/directory::directory-enumeration",
            "atk": "T1083",
            "mbc": "E1083",
            "conf": 0.7,
            "crit": 3,
            "desc": "Directory enumeration capability",
            "from": [
              {
                "file": 575
              }
            ],
            "uses": [
              16,
              81
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/full::os-write-file",
            "conf": 0.8,
            "crit": 3,
            "desc": "Write file via os.WriteFile",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/stat::go-os-stat-missing-check",
            "conf": 0.9,
            "crit": 3,
            "desc": "Go tests missing path with os.Stat",
            "from": [
              {
                "file": 17
              }
            ]
          },
          {
            "id": "metadata/file/string/file::tmp",
            "conf": 0.2,
            "crit": 1,
            "desc": "tmp keyword",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/temp::tmp-path-content",
            "conf": 1.0,
            "crit": 2,
            "desc": "Contains a /tmp/ or /var/tmp/ path",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/server/listener::http-server-type",
            "atk": "T1071.001",
            "mbc": "C0002",
            "conf": 0.7,
            "crit": 3,
            "desc": "References Go's http.Server type",
            "from": [
              {
                "file": 17
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/direct::syscall-exec",
            "atk": "T1106",
            "conf": 0.98,
            "crit": 3,
            "desc": "Direct execution via syscall.Exec",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/exec::go-exec-command-call",
            "atk": "T1059",
            "conf": 0.85,
            "crit": 3,
            "desc": "Creates a child process with Go exec.Command",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/import/go/syscall::syscall",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports syscall",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "metadata/import/go/strings::strings",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports strings",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/temp::go-temp-path-ref",
            "conf": 0.8,
            "crit": 3,
            "desc": "Go temp path reference",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/import/go/unsafe::unsafe",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports unsafe",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/loop::block-unbounded-loop-header",
            "conf": 1.0,
            "crit": 3,
            "desc": "Contains an unbounded block loop",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/process/info/selfpath::os-executable",
            "conf": 0.7,
            "crit": 3,
            "desc": "Go queries own executable path",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "metadata/import/go/io/fs::io/fs",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports io/fs",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::tests-path-filename",
            "conf": 0.85,
            "crit": 2,
            "desc": "File path or name indicates test code",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/unit::go-t-fatal",
            "conf": 0.75,
            "crit": 2,
            "desc": "Go test t.Fatal method",
            "from": [
              {
                "off": 458,
                "file": 566,
                "line": 26
              },
              {
                "off": 703,
                "file": 568,
                "line": 19
              },
              {
                "off": 4506,
                "file": 570,
                "line": 135
              },
              {
                "file": 573
              },
              {
                "file": 576
              }
            ],
            "uses": [
              49,
              57
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/yaml::go-yaml-parser",
            "conf": 0.92,
            "crit": 3,
            "desc": "Go source parses YAML data",
            "from": [
              {
                "off": 2070,
                "file": 575,
                "line": 55
              },
              {
                "off": 122,
                "file": 576,
                "line": 10
              }
            ],
            "uses": [
              66,
              68
            ]
          },
          {
            "id": "metadata/import/go/os/exec::os/exec",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports os/exec",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/unit::go-testing-t",
            "conf": 0.7,
            "crit": 2,
            "desc": "Go test uses a testing.T parameter",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "micro-behaviors/data/buffer/transfer::go-io-copy",
            "conf": 0.9,
            "crit": 3,
            "desc": "Copies data with Go io.Copy",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/split::go-strings-fields",
            "conf": 0.4,
            "crit": 3,
            "desc": "strings.Fields tokenizer",
            "from": [
              {
                "file": 17
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-6",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"with\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/thread::go-goroutine-launch-call",
            "conf": 0.75,
            "crit": 3,
            "desc": "Go goroutine launch call",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "metadata/import/go/gopkg/in/yaml/v3::gopkg/in/yaml/v3",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports gopkg.in/yaml.v3",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "metadata/import/go/testing::testing",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports testing",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "metadata/import/go/io::io",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports io",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/unit::go-t-fatal-call",
            "conf": 0.7,
            "crit": 3,
            "desc": "Go test stops with t.Fatal",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "objectives/command-and-control/remote-command/shell::go-goos-switch",
            "atk": "T1059",
            "conf": 0.85,
            "crit": 3,
            "desc": "runtime.GOOS OS dispatch switch in Go",
            "from": [
              {
                "file": 17
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::go-bin-sh-path",
            "conf": 0.65,
            "crit": 3,
            "desc": "/bin/sh shell path in Go code",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/os/syscall/invoke::go-syscall-wrapper-call",
            "atk": "T1106",
            "conf": 0.95,
            "crit": 3,
            "desc": "Go syscall wrapper call",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "metadata/import/go/slices::slices",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports slices",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "metadata/import/go/fmt::fmt",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports fmt",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/mkdir::os-mkdirall",
            "conf": 0.9,
            "crit": 3,
            "desc": "Creates a directory tree with Go os.MkdirAll",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "metadata/import/go/errors::errors",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports errors",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/yaml::yaml-unmarshal",
            "conf": 0.9,
            "crit": 3,
            "desc": "Unmarshals YAML data in Go",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "objectives/anti-analysis/debugger-detect/combined-checks::go-syscall-ptrace",
            "atk": "T1622",
            "mbc": "B0001.m01",
            "conf": 0.9,
            "crit": 3,
            "desc": "Go raw ptrace syscall",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "micro-behaviors/data/serialize/yaml::yaml-v3-import",
            "conf": 0.9,
            "crit": 3,
            "desc": "Imports the Go YAML v3 parser",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "micro-behaviors/process/lifecycle/auto-exec::go-package-initializer",
            "conf": 0.98,
            "crit": 3,
            "desc": "Defines Go package startup initialization"
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/testing/harness/unit::go-t-error-call",
            "conf": 0.7,
            "crit": 3,
            "desc": "Go test reports an error with t.Error",
            "from": [
              {
                "file": 17
              }
            ]
          },
          {
            "id": "objectives/supply-chain/impersonation/core-module::exec-command-sh",
            "atk": "T1195.002",
            "conf": 0.8,
            "crit": 3,
            "desc": "exec.Command with /bin/sh",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/import/go/runtime::runtime",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports runtime",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/delete/directory::os-RemoveAll",
            "atk": "T1070.004",
            "mbc": "C0047",
            "conf": 0.9,
            "crit": 3,
            "desc": "Recursive directory deletion",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "micro-behaviors/os/env/enumeration::os-environ",
            "atk": "T1082",
            "conf": 0.85,
            "crit": 3,
            "desc": "os.Environ() enumerates the entire environment",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "micro-behaviors/os/network/interface::net-interfaces",
            "atk": "T1016",
            "mbc": "E1016",
            "conf": 0.75,
            "crit": 3,
            "desc": "Go network interface enumeration",
            "from": [
              {
                "file": 17
              }
            ]
          },
          {
            "id": "metadata/import/go/os::os",
            "conf": 0.95,
            "crit": 3,
            "desc": "imports os",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "metadata/import/go/time::time",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports time",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/data/control-flow/loop::go-unbounded-for-loop",
            "conf": 0.9,
            "crit": 3,
            "desc": "Go source contains an unbounded loop",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/read/directory::file-readdir",
            "atk": "T1083",
            "mbc": "E1083",
            "conf": 0.6,
            "crit": 2,
            "desc": "Go filesystem directory listing method",
            "from": [
              {
                "file": 19
              }
            ]
          },
          {
            "id": "metadata/import/go/path/filepath::path/filepath",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports path/filepath",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/write/file/full::go-write-file-method-call",
            "conf": 0.6,
            "crit": 3,
            "desc": "Go WriteFile method call",
            "from": [
              {
                "file": 10
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/conversion::go-strconv-atoi-call",
            "conf": 0.75,
            "crit": 3,
            "desc": "Go strconv.Atoi call",
            "from": [
              {
                "file": 18
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/path/application/prefix::container-app-root-path",
            "conf": 0.9,
            "crit": 3,
            "desc": "Absolute container application root path",
            "from": [
              {
                "file": 14
              }
            ]
          },
          {
            "id": "metadata/file/archive::archive-at-least-10-members",
            "conf": 0.9,
            "crit": 3,
            "desc": "Archive contains at least ten members"
          },
          {
            "id": "metadata/package/files/included::archive-go-mod-entry",
            "conf": 0.98,
            "crit": 3,
            "desc": "Archive contains go.mod"
          },
          {
            "id": "metadata/package/manager::go-module-source-archive",
            "conf": 0.99,
            "crit": 3,
            "desc": "Go module source archive layout"
          }
        ]
      }
    ]
  }
}