{
  "ml": {
    "v": "7",
    "id": 1933,
    "lvl": -1,
    "conf": 0,
    "prob": 0.0002597173152025789,
    "type": "python",
    "version": "v18.18",
    "analyzed_at": "2026-09-23T20:43:21Z"
  },
  "path": "changed-files@v29.0.2",
  "raw": {
    "rev": "a041b",
    "files": [
      {
        "id": 2497,
        "mol": "O₄(AsEuIS)H₄(Cm₃Db₂F₂Po₄)Md₂(Bk₅)",
        "pid": 29,
        "rel": "fetched",
        "sha": "466db966c7749d85efa7c1374a2966f33e5246d8ff1431e8a18b7344ae159dcd",
        "via": "https://codeload.github.com/tj-actions/changed-files/tar.gz/v29.0.2",
        "path": "pkg:github/tj-actions/changed-files@v29.0.2",
        "risk": 14,
        "size": 37233,
        "type": "gz",
        "depth": 2,
        "facts": {
          "metrics": {
            "file": {
              "size": 37233,
              "entropy": 7.99
            },
            "binary": {
              "peak_region_bytes": 36864,
              "peak_region_entropy": 7.82
            }
          }
        },
        "traits": [
          {
            "id": "metadata/file/policy/identity::socket-scanner-package-rules-block",
            "conf": 0.9,
            "crit": 3,
            "desc": "Socket.dev config declares per-package rules",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/build/ci/secret::step-token-input-secret-reference",
            "conf": 0.95,
            "crit": 3,
            "desc": "Step token input references an Actions secret"
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-3",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"that\"",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "metadata/file/string/cicd::github-workflow-file-path",
            "conf": 0.98,
            "crit": 3,
            "desc": "GitHub Actions workflow file path",
            "from": [
              {
                "file": 12
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-4",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"have\"",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/search::grep-keyword",
            "conf": 0.7,
            "crit": 1,
            "desc": "Contains the grep command keyword",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::test-directory-path",
            "conf": 1.0,
            "crit": 2,
            "desc": "File is in common test directory",
            "from": [
              {
                "file": 90
              }
            ]
          },
          {
            "id": "metadata/file/line::file-has-30-plus-lines",
            "conf": 0.9,
            "crit": 2,
            "desc": "File has 30 or more lines",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/local-exec::execute-quoted-var",
            "atk": "T1059.004",
            "conf": 0.88,
            "crit": 3,
            "desc": "Executes a quoted shell-variable path",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/file/extension/identity::shell-a",
            "conf": 1.0,
            "crit": 2,
            "desc": "POSIX shell script extension",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "objectives/exfiltration/http/agent::repo2skill-github-token-marker",
            "atk": "T1041,T1552.001",
            "conf": 0.99,
            "crit": 3,
            "desc": "GitHub token marker",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url",
            "conf": 0.9,
            "crit": 3,
            "desc": "References a public code-forge URL",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/search::locate-token",
            "conf": 1.0,
            "crit": 3,
            "desc": "locate file-search command token",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/build/ci/secret::step-environment-secret-reference",
            "conf": 0.95,
            "crit": 3,
            "desc": "Step environment references an Actions secret"
          },
          {
            "id": "micro-behaviors/fs/directory/chdir::shell-change-directory",
            "conf": 0.95,
            "crit": 3,
            "desc": "Shell changes working directory",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/build/ci/gate::dependabot-actor-gate",
            "conf": 0.95,
            "crit": 3,
            "desc": "PR target job restricted to Dependabot"
          },
          {
            "id": "micro-behaviors/communications/http/url/query::ai-prompt-query-encoded-url-value",
            "conf": 0.95,
            "crit": 3,
            "desc": "Query value contains an encoded remote URL",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "metadata/build/ci/github-actions::workflow-definition-path",
            "conf": 0.99,
            "crit": 3,
            "desc": "GitHub Actions workflow definition path",
            "from": [
              {
                "file": 12
              }
            ]
          },
          {
            "id": "objectives/anti-static/obfuscation/encoding/shell::shell-awk-gsub-call",
            "atk": "T1027,T1059.004,T1140",
            "mbc": "B0032",
            "conf": 0.9,
            "crit": 3,
            "desc": "Awk calls gsub",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/message::http-url-literal",
            "conf": 0.75,
            "crit": 2,
            "desc": "HTTP URL string literal",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/build/ci/step::composite-action-type",
            "conf": 1.0,
            "crit": 3,
            "desc": "GitHub Actions composite action definition"
          },
          {
            "id": "metadata/build/ci/secret::github-token-secret",
            "conf": 0.88,
            "crit": 3,
            "desc": "References Actions-provided GITHUB_TOKEN",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-6",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"with\"",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "from": [
              {
                "file": 90
              }
            ]
          },
          {
            "id": "objectives/supply-chain/hidden-payload/ci::gha-action-yml-manifest",
            "atk": "T1195.002",
            "conf": 0.98,
            "crit": 3,
            "desc": "GitHub Action action.yml manifest",
            "from": [
              {
                "file": 4
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/assembly::zero-padded-integer-format",
            "conf": 0.9,
            "crit": 3,
            "desc": "Code formats a zero-padded integer",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/build/ci/secret::action-secret-input",
            "conf": 0.95,
            "crit": 3,
            "desc": "Action input references workflow secret"
          },
          {
            "id": "objectives/impact/ransom/encrypt/runtime-generated::destructive-action-b",
            "atk": "T1486",
            "conf": 0.94,
            "crit": 3,
            "desc": "Destructive or exfiltration verb with target",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/file/data-blob::script-peak-region-over-1k",
            "conf": 0.8,
            "crit": 2,
            "desc": "Peak-entropy source region exceeds 1KB",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/workers::xargs-cmd",
            "conf": 0.6,
            "crit": 3,
            "desc": "xargs command usage",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/build/ci/step::mutable-version-action-ref",
            "conf": 0.9,
            "crit": 3,
            "desc": "Workflow action uses mutable version tag"
          },
          {
            "id": "metadata/build/ci/trigger::scheduled-workflow-trigger",
            "conf": 0.9,
            "crit": 3,
            "desc": "GitHub scheduled workflow trigger"
          },
          {
            "id": "micro-behaviors/process/enumerate/grep::bracketed-grep-generic",
            "atk": "T1057",
            "mbc": "C0003",
            "conf": 0.85,
            "crit": 3,
            "desc": "Bracketed grep for proc listing evasion",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/path::image-file-url",
            "conf": 0.85,
            "crit": 3,
            "desc": "HTTP URL targets an image file",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/format/html::markdown-remote-image-source",
            "conf": 0.9,
            "crit": 3,
            "desc": "Markdown references a remote image",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "metadata/build/ci/step::composite-action-step-script",
            "conf": 1.0,
            "crit": 3,
            "desc": "Composite action step script body",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/data/string/assembly::sh-template-opening-delimiter",
            "conf": 0.85,
            "crit": 3,
            "desc": "Shell contains a template delimiter",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "metadata/file/data-blob::low-overall-entropy-source",
            "conf": 0.9,
            "crit": 2,
            "desc": "Source file has low overall entropy",
            "from": [
              {
                "file": 6
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/eval::shell-variable-file-exec",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell runs variable command file",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/script/file::shell-script-execution",
            "atk": "T1059.004",
            "conf": 0.7,
            "crit": 3,
            "desc": "Executes a shell script file (.sh)",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/path::test-path-basename",
            "conf": 1.0,
            "crit": 2,
            "desc": "Test path basename",
            "from": [
              {
                "file": 25
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::test-directory",
            "conf": 1.0,
            "crit": 2,
            "desc": "File identified as a test by path or name",
            "from": [
              {
                "file": 25
              }
            ],
            "uses": [
              6
            ]
          },
          {
            "id": "metadata/package/testing/harness/runtime::is-test",
            "conf": 0.9,
            "crit": 2,
            "desc": "Test, spec, or fixture file",
            "from": [
              {
                "file": 25
              }
            ],
            "uses": [
              44
            ]
          },
          {
            "id": "micro-behaviors/communications/url/encoded::encoded-url-benign-context",
            "atk": "T1027",
            "mbc": "B0032",
            "conf": 0.95,
            "crit": 1,
            "desc": "Encoded URL benign documentation or test context",
            "from": [
              {
                "file": 25
              }
            ],
            "uses": [
              44
            ]
          }
        ]
      }
    ]
  }
}