{
  "ml": {
    "v": "7",
    "eng": "2.0.1-rc.1",
    "lvl": -1,
    "conf": 0,
    "mods": [
      {
        "cls": 0,
        "raw": 0.000008632739,
        "rte": "az",
        "prob": 0.000008632739
      },
      {
        "cls": 0,
        "raw": 0.000008493662,
        "rte": "az/scripts",
        "prob": 0.000008493662
      },
      {
        "cls": 0,
        "raw": 0.008870144,
        "rte": "az/shell",
        "prob": 0.008870144
      }
    ],
    "prob": 0.000008632739,
    "files": [
      {
        "id": 0,
        "lvl": -1,
        "conf": 0,
        "prob": 0.000008632739081804175,
        "type": "shell"
      }
    ],
    "version": "v18.18",
    "analyzed_at": "2026-06-15T06:12:16Z"
  },
  "path": "get_files",
  "raw": {
    "v": "7",
    "tv": "061e3",
    "files": [
      {
        "id": 0,
        "ctx": [
          {
            "a": 0,
            "b": "boXZHx(kOkvrl8",
            "l": 1,
            "n": [
              {
                "c": 2,
                "d": "shell code embedded in string",
                "i": "metadata/lang/embedded::shell",
                "o": 0,
                "z": 220
              }
            ]
          },
          {
            "a": 12,
            "b": "A+#{JA+lCax(4v4",
            "l": 2,
            "n": [
              {
                "c": 2,
                "d": "Shell deletion operation",
                "i": "micro-behaviors/fs/directory/traverse::delete-shell",
                "o": 12,
                "z": 6
              }
            ]
          },
          {
            "a": 25,
            "b": "zeiV@AV!$dy?mU",
            "l": 3
          },
          {
            "a": 37,
            "b": "vrVGfcWPMtasFG)auQ=8fFB{#DVj1tzGE0DiEMr6azbt7wPJ8sD)0Gwwfrmvfi*a-tRoS5y?kmMcM)^",
            "l": 4
          },
          {
            "a": 164,
            "b": "33Q5%y?j-fwNP9(mOVlzmf",
            "l": 8
          },
          {
            "a": 182,
            "b": "31N@",
            "l": 9
          },
          {
            "a": 186,
            "b": "2)\u003e9Xat4KPatm[DAXzJKA4-Fapc?Pyazbt7wPE",
            "l": 10,
            "n": [
              {
                "c": 2,
                "d": "Unix /tmp/ path reference",
                "i": "micro-behaviors/fs/path/temp::unix-temp",
                "o": 199,
                "z": 5
              }
            ]
          },
          {
            "a": 217,
            "b": "31N%(wD",
            "l": 11
          },
          {
            "a": 223,
            "b": "wn=u%",
            "l": 12
          }
        ],
        "sha": "4e5e348c2ee877eb011712a5ca749b52f4ecb2f9ea1dc6edb87bc45d992858e1",
        "fact": {
          "id": "shell",
          "imp": [
            [
              "",
              "rm"
            ],
            [
              "",
              "rm"
            ],
            [
              "",
              "mkdir"
            ],
            [
              "",
              "mkdir"
            ],
            [
              "",
              "awk"
            ],
            [
              "",
              "awk"
            ],
            [
              "",
              "sed"
            ],
            [
              "",
              "sed"
            ],
            [
              "",
              "read"
            ],
            [
              "",
              "read"
            ],
            [
              "",
              "grep"
            ],
            [
              "",
              "grep"
            ],
            [
              "",
              "awk"
            ],
            [
              "",
              "awk"
            ],
            [
              "",
              "read"
            ],
            [
              "",
              "read"
            ],
            [
              "",
              "cp"
            ],
            [
              "",
              "cp"
            ]
          ],
          "met": {
            "ast": {
              "max_depth": 10.0,
              "call_count": 9.0,
              "node_count": 65.0,
              "identifier_count": 14.0,
              "string_literal_count": 3.0
            },
            "file": {
              "size": 228.0,
              "entropy": 5.12,
              "size_bytes": 228.0
            },
            "text": {
              "tab_count": 6.0,
              "digit_ratio": 0.05,
              "space_count": 29.0,
              "total_lines": 12.0,
              "char_entropy": 5.12,
              "unique_chars": 51.0,
              "string_density": 0.25,
              "avg_line_length": 18.0,
              "max_line_length": 63.0,
              "last_line_length": 4.0,
              "whitespace_ratio": 0.21,
              "most_common_ratio": 0.06,
              "identifier_density": 2.5,
              "line_length_stddev": 17.51,
              "normalized_string_count": 0.87,
              "most_common_char_is_null": 0.0,
              "max_inline_whitespace_run": 2.0,
              "most_common_char_codepoint": 101.0,
              "normalized_unique_identifiers": 3.91
            },
            "calls": {
              "count": 9.0
            },
            "binary": {
              "overall_entropy": 5.12
            },
            "strings": {
              "total": 3.0,
              "avg_length": 16.33,
              "max_length": 26.0,
              "avg_entropy": 3.41,
              "total_bytes": 49.0,
              "entropy_stddev": 0.35
            },
            "comments": {
              "chars": 10.0,
              "lines": 1.0,
              "total": 1.0,
              "to_code_ratio": 0.09
            },
            "identifiers": {
              "count": 14.0,
              "total": 30.0,
              "avg_length": 4.21,
              "max_length": 9.0,
              "min_length": 2.0,
              "avg_entropy": 1.9,
              "reuse_ratio": 0.47,
              "unique_count": 14.0,
              "length_stddev": 1.9,
              "all_lowercase_ratio": 0.64,
              "all_uppercase_ratio": 0.14
            }
          },
          "str": [
            [
              41,
              "u8",
              "{if ($5 \u003c 600) {print $9}}"
            ],
            [
              83,
              "u8",
              "s/\\.0\\.file//"
            ],
            [
              149,
              "u8",
              "{print $9}"
            ]
          ],
          "tgt": [
            "awk",
            "cp",
            "grep",
            "mkdir",
            "read",
            "rm",
            "sed"
          ],
          "val": {
            "file.stem": "get_files",
            "file.basename": "get_files",
            "source.shebang": "/bin/bash",
            "source.language": "bash",
            "source.imports[0]": "awk",
            "source.imports[1]": "cp",
            "source.imports[2]": "grep",
            "source.imports[3]": "mkdir",
            "source.imports[4]": "read",
            "source.imports[5]": "rm",
            "source.imports[6]": "sed",
            "source.strings[0]": "s/\\.0\\.file//",
            "source.strings[1]": "{if ($5 \u003c 600) {print $9}}",
            "source.strings[2]": "{print $9}",
            "source.has_imports": true
          }
        },
        "find": [
          {
            "id": "metadata/lang/shebang::bash",
            "conf": 1.0,
            "crit": 2,
            "desc": "Bash shell shebang line"
          },
          {
            "id": "micro-behaviors/fs/directory/traverse::rm-rf-cmd",
            "conf": 0.6000000238418579,
            "crit": 2,
            "desc": "rm -rf command"
          },
          {
            "id": "micro-behaviors/fs/directory/traverse::delete-shell",
            "conf": 0.8500000238418579,
            "crit": 2,
            "desc": "Shell deletion operation"
          },
          {
            "id": "metadata/lang/embedded::shell",
            "conf": 1.0,
            "crit": 2,
            "desc": "shell code embedded in string"
          }
        ],
        "path": "get_files",
        "risk": 1,
        "size": 228,
        "type": "shell"
      }
    ]
  }
}