{
  "ml": {
    "v": "7",
    "id": 34,
    "lvl": -1,
    "conf": 0,
    "prob": 0.0000073909759521484375,
    "type": "",
    "version": "v18.18",
    "analyzed_at": "2026-09-22T17:40:34Z"
  },
  "path": "shell-linter@develop",
  "raw": {
    "rev": "a041b",
    "files": [
      {
        "id": 36,
        "mol": "O₂(CS)H₄(Cm₅F₃Os₃Po₆)Md₃(ArBk₃)",
        "pid": 2,
        "rel": "fetched",
        "sha": "b836713d1cb9295dd85f18f79b325df9cd9d397289ef45063067f57546ed3710",
        "via": "https://codeload.github.com/megastep/shell-linter/tar.gz/develop",
        "path": "pkg:github/megastep/shell-linter@develop",
        "risk": 14,
        "size": 164098,
        "type": "gz",
        "depth": 2,
        "facts": {
          "metrics": {
            "file": {
              "size": 164098,
              "entropy": 8
            },
            "binary": {
              "peak_region_bytes": 163840,
              "peak_region_entropy": 7.85
            }
          }
        },
        "traits": [
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-exec",
            "atk": "T1059",
            "conf": 0.5,
            "crit": 3,
            "desc": "Uses shell exec to replace process",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/cloud::gcs-url",
            "conf": 0.9,
            "crit": 3,
            "desc": "Google Cloud Storage URL",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-execution-comp",
            "atk": "T1059",
            "mbc": "E1059",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell command execution capability",
            "from": [
              {
                "file": 39
              },
              {
                "file": 48
              },
              {
                "file": 49
              }
            ],
            "uses": [
              0,
              50
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/string::multi-arch-runtime-wordlist--x86-or-mips",
            "atk": "T1082",
            "mbc": "E1082",
            "conf": 0.85,
            "crit": 1,
            "desc": "Shell x86 or MIPS architecture selector",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "metadata/import/shell/debug::debug",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports --debug",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/file/string/cicd::github-workflow-file-path",
            "conf": 0.98,
            "crit": 3,
            "desc": "GitHub Actions workflow file path",
            "from": [
              {
                "file": 11
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-2",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"and\"",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/traverse::find-type-file",
            "atk": "T1083",
            "mbc": "E1083",
            "conf": 0.82,
            "crit": 3,
            "desc": "Runs find to enumerate regular files",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "metadata/file/string/file::tmp",
            "conf": 0.2,
            "crit": 1,
            "desc": "tmp keyword",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/build/ci/secret::github-token-secret",
            "conf": 0.88,
            "crit": 3,
            "desc": "References Actions-provided GITHUB_TOKEN",
            "from": [
              {
                "file": 11
              }
            ]
          },
          {
            "id": "micro-behaviors/process/interpreter/eval/direct::shell-eval",
            "atk": "T1059",
            "conf": 0.5,
            "crit": 3,
            "desc": "Evaluates a shell command string",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/data/decode/command::od-decode-command",
            "conf": 0.6,
            "crit": 3,
            "desc": "od command invoked with option flags",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/file/extension/identity::shell-a",
            "conf": 1.0,
            "crit": 2,
            "desc": "POSIX shell script extension",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/build/ci/github-actions::workflow-definition-path",
            "conf": 0.99,
            "crit": 3,
            "desc": "GitHub Actions workflow definition path",
            "from": [
              {
                "file": 11
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-3",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"that\"",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/arch/iot::payload-name-x86",
            "conf": 0.9,
            "crit": 3,
            "desc": "x86-suffixed payload filename",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "objectives/command-and-control/dropper/delivery/http::suspicious-cloud-image-object--rx-1",
            "atk": "T1105",
            "mbc": "B0024",
            "conf": 0.86,
            "crit": 3,
            "desc": "Google Cloud Storage domain reference",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::test-directory-path",
            "conf": 1.0,
            "crit": 2,
            "desc": "File is in common test directory",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/search::grep-keyword",
            "conf": 0.7,
            "crit": 1,
            "desc": "Contains the grep command keyword",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/cli::wget-command-call",
            "atk": "T1105",
            "conf": 0.96,
            "crit": 3,
            "desc": "Shell invokes the wget command",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "metadata/build/ci/secret::step-token-input-secret-reference",
            "conf": 0.95,
            "crit": 3,
            "desc": "Step token input references an Actions secret"
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/string::multi-arch-runtime-wordlist",
            "atk": "T1082",
            "mbc": "E1082",
            "conf": 0.85,
            "crit": 3,
            "desc": "Shell lists architecture selector names",
            "from": [
              {
                "file": 43
              }
            ],
            "uses": [
              3
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-4",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"have\"",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/build/ci/step::mutable-version-action-ref",
            "conf": 0.9,
            "crit": 3,
            "desc": "Workflow action uses mutable version tag"
          },
          {
            "id": "micro-behaviors/process/exit/handler::shell-exit-trap",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell registers a process-exit trap",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/eval::shell-eval-variable",
            "mbc": "E1059.004",
            "conf": 0.8,
            "crit": 3,
            "desc": "Eval of shell variable content",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/harness::test-directory",
            "conf": 1.0,
            "crit": 2,
            "desc": "File identified as a test by path or name",
            "from": [
              {
                "file": 37
              },
              {
                "file": 38
              },
              {
                "file": 39
              },
              {
                "file": 40
              }
            ],
            "uses": [
              17
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/eval::shell-evaluates-variable-command",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell evaluates variable command",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/os/privilege/elevation::sudo-command",
            "conf": 0.9,
            "crit": 3,
            "desc": "Shell command invokes sudo",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "metadata/import/shell/relative/1/entrypoint/sh::relative/1/entrypoint/sh",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./entrypoint.sh",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/package/testing/presence/path::tests-path-basename",
            "conf": 1.0,
            "crit": 2,
            "desc": "Tests path basename",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-5",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"for\"",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/url/forge::public-code-forge-url",
            "conf": 0.9,
            "crit": 3,
            "desc": "References a public code-forge URL",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/shell::shell-wget-url-call",
            "atk": "T1105",
            "conf": 0.8,
            "crit": 3,
            "desc": "wget call names an HTTP URL",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-6",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"with\"",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/directory/chdir::shell-change-directory",
            "conf": 0.95,
            "crit": 3,
            "desc": "Shell changes working directory",
            "from": [
              {
                "file": 5
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/workers::xargs-cmd",
            "conf": 0.6,
            "crit": 3,
            "desc": "xargs command usage",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "metadata/file/catalog/service::service-name-github",
            "conf": 0.6,
            "crit": 3,
            "desc": "GitHub service name",
            "from": [
              {
                "file": 3
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/local-exec::execute-quoted-var",
            "atk": "T1059.004",
            "conf": 0.88,
            "crit": 3,
            "desc": "Executes a quoted shell-variable path",
            "from": [
              {
                "file": 8
              }
            ]
          },
          {
            "id": "micro-behaviors/os/sysinfo/platform/arch::multiple-architecture-references--x86-or-amd64",
            "conf": 0.94,
            "crit": 3,
            "desc": "x86 or AMD64 architecture reference",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/download/shell::fetch-command-with-var",
            "atk": "T1105",
            "conf": 0.9,
            "crit": 3,
            "desc": "curl or wget references shell variable",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "objectives/supply-chain/hidden-payload/ci::gha-action-yml-manifest",
            "atk": "T1195.002",
            "conf": 0.98,
            "crit": 3,
            "desc": "GitHub Action action.yml manifest",
            "from": [
              {
                "file": 9
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-1",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"the\"",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/lang/natural::lang-english--atom-7",
            "conf": 0.8,
            "crit": 1,
            "desc": "English function-word token \"this\"",
            "from": [
              {
                "file": 2
              }
            ]
          },
          {
            "id": "micro-behaviors/communications/http/services/google::google-api-host-reference",
            "mbc": "C0002",
            "conf": 0.95,
            "crit": 3,
            "desc": "References a Google API host",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "metadata/import/shell/relative/1/tests/shunit2::relative/1/tests/shunit2",
            "conf": 0.95,
            "crit": 2,
            "desc": "imports ./tests/shunit2",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "micro-behaviors/fs/file/copy::copy-to-executable-directory",
            "conf": 0.88,
            "crit": 3,
            "desc": "Copies a file into executable directory",
            "from": [
              {
                "file": 7
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/script/file::shell-script-execution-alt",
            "atk": "T1059.004",
            "conf": 0.7,
            "crit": 3,
            "desc": "Executes shell script via alt interpreters",
            "from": [
              {
                "file": 1
              }
            ]
          },
          {
            "id": "metadata/build/ci/secret::action-secret-input",
            "conf": 0.95,
            "crit": 3,
            "desc": "Action input references workflow secret"
          },
          {
            "id": "micro-behaviors/process/create/local-exec::execute-dot-slash-literal",
            "conf": 0.88,
            "crit": 3,
            "desc": "Executes a local relative file",
            "from": [
              {
                "file": 13
              }
            ]
          },
          {
            "id": "micro-behaviors/process/create/shell/spawn::shell-execution-current-dir",
            "conf": 0.7,
            "crit": 3,
            "desc": "Execution from current directory (./file)",
            "from": [
              {
                "file": 13
              }
            ]
          }
        ]
      }
    ]
  }
}