{ "ml": { "v": "7", "eng": "2.3.1-beta.0", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.48564434, "rte": "az", "prob": 0.48564434 }, { "cls": 0, "raw": 0.012838095, "rte": "az/zip", "prob": 0.012838095 } ], "prob": 0.48564434, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.4856443405151367, "type": "zip" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.000052283208788139746, "type": "lua" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.00001000364591163816, "type": "lua" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.00002658367156982422, "type": "lua" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.000019878149032592773, "type": "lua" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.000017235675841220655, "type": "lua" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.000028252601623535156, "type": "lua" }, { "id": 7, "lvl": -1, "conf": 0, "prob": 0.00001337130834144773, "type": "markdown" }, { "id": 8, "lvl": -1, "conf": 0, "prob": 0.000012308359146118164, "type": "github_actions" }, { "id": 9, "lvl": -1, "conf": 0, "prob": 0.00001428524683433352, "type": "github_actions" }, { "id": 10, "lvl": -1, "conf": 0, "prob": 0.000017980733900913037, "type": "github_actions" }, { "id": 11, "lvl": -1, "conf": 0, "prob": 0.000013569991097028833, "type": "github_actions" }, { "id": 12, "lvl": -1, "conf": 0, "prob": 0.000013083219528198242, "type": "github_actions" }, { "id": 13, "lvl": -1, "conf": 0, "prob": 0.00014372666191775352, "type": "python" } ], "version": "v18.18", "analyzed_at": "2026-07-14T19:31:37Z" }, "path": "ai-lasso-guardrail-1.0.0-1.src.rock", "raw": { "fetched": [ { "kind": "command", "cached": false, "locator": "pkg:npm/spec.helpers", "outcome": "unresolved", "fetched_at": 0, "source_offset": 637, "source_sha256": "d66969dad602ad006f1cf88158019e0d200930b65f63f608ceecc52ca5cb6337" }, { "kind": "command", "cached": false, "locator": "pkg:npm/kong.plugins.ai-lasso-guardrail.lasso", "outcome": "unresolved", "fetched_at": 0, "source_offset": 301, "source_sha256": "7518c276152e4dba75aa06c819847993823bdb478fdc0bed2a34df66d294ef37" }, { "kind": "command", "cached": false, "locator": "pkg:npm/kong.plugins.ai-lasso-guardrail.client", "outcome": "unresolved", "fetched_at": 0, "source_offset": 621, "source_sha256": "3137ac85824c51b27b842ba8486a6123d1062b93cff1fb15dc2112c0bcdc7390" }, { "kind": "command", "cached": false, "locator": "pkg:npm/cjson.safe", "outcome": "unresolved", "fetched_at": 0, "source_offset": 684, "source_sha256": "3137ac85824c51b27b842ba8486a6123d1062b93cff1fb15dc2112c0bcdc7390" }, { "kind": "command", "cached": false, "locator": "pkg:npm/kong.db.schema.typedefs", "outcome": "unresolved", "fetched_at": 0, "source_offset": 17, "source_sha256": "f6a7744cabf01c5594bccc8295db4c7ae92e99ce61873e9ad5ef1102c53acb98" }, { "kind": "command", "cached": false, "locator": "pkg:npm/resty.http", "outcome": "unresolved", "fetched_at": 0, "source_offset": 272, "source_sha256": "ddc1c0a3a4c1bffe3448574d4c0674abd656fb182f0707e3b7d042e08493cabc" } ], "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MOvM)P.#TGbNbU002:@001kz8#%zYeO[\u003cpB8JTyBZYr3A:-V#eIO\u003eie?!\u003eie]\u003e(uyJBDav]VFm00vJ.r+={@r+==43JHhg]-k3)1qy?o0g/lnpS1\u003c$HwgR6q=X.6aHa(}5\u0026ju.H#ETe:TNjLkr]?C", "n": [ { "c": 2, "d": "Compact JAR archive size", "i": "metadata/package/metrics::compact-jar-archive", "o": 0, "z": 26, "cf": 0.8999999761581421 } ], "ln": 0 } ], "mol": "H₂(Cm₃Db₂)Md(Bk)", "sha": "b912402c92ee73f1905921a0ecba79084649d7f1780d370cf3180e3e286c7ccb", "path": "/data/samples/unknown/foraged/lua/luarocks.org/_/ai-lasso-guardrail/ai-lasso-guardrail-1.0.0-1.src.rock", "risk": 4, "size": 34318, "type": "zip", "facts": { "metrics": { "file": { "size": 34318.0, "entropy": 7.82, "size_bytes": 34318.0 }, "binary": { "overall_entropy": 7.82, "peak_region_bytes": 28672.0, "peak_region_entropy": 7.84 }, "archive": { "file_count": 20.0, "member_count": 29.0, "script_count": 7.0, "zip_bomb_ratio": 4.15, "directory_count": 9.0, "executable_count": 0.0, "extra_field_size": 696.0, "noise_file_count": 0.0, "total_compressed": 27810.0, "compression.ratio": 0.35, "hidden_file_count": 7.0, "total_uncompressed": 78544.0, "crc_collision_count": 1.0, "entry_comment_count": 0.0, "max_filename_length": 69.0, "rtlo_filename_count": 0.0, "format.regular_count": 20.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "format.directory_count": 9.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 1.0, "timing.mtime_unique_ratio": 0.03, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 29.0, "timing.mtime_spread_seconds": 0.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.stored": 9.0, "compression.method_counts.deflate": 20.0 }, "consistency": { "extension_content_mismatch": 1.0, "extension_content_mismatch.archive_as_unknown": 1.0 } } }, "traits": [ { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 1, "desc": "File is in common test directory", "from": [ { "file": 1 } ], "spans": [ [ 0, 62 ] ] }, { "id": "metadata/package/testing/harness-lua::lua-busted-spec", "conf": 0.949999988079071, "crit": 2, "desc": "Lua Busted-style spec file", "from": [ { "file": 1 }, { "file": 2 } ], "spans": [ [ 0, 14 ] ] }, { "id": "metadata/package/testing/harness-lua::lua-busted-it", "conf": 0.8999999761581421, "crit": 1, "desc": "Lua it test case", "from": [ { "file": 1 } ] }, { "id": "metadata/build/github-actions::pull-request-target-trigger", "conf": 0.8999999761581421, "crit": 3, "desc": "GitHub pull_request_target workflow trigger", "from": [ { "file": 10 } ] }, { "id": "metadata/build/github-actions::mutable-main-action-ref", "conf": 0.8799999952316284, "crit": 3, "desc": "Workflow action pinned to main", "from": [ { "file": 11 } ] }, { "id": "micro-behaviors/communications/http/server/framework::server-python", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Python HTTP server", "from": [ { "file": 13 } ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File in a test directory", "from": [ { "file": 1 }, { "file": 2 } ], "spans": [ [ 0, 62 ] ] }, { "id": "metadata/package/testing/harness-lua::lua-busted-describe", "conf": 0.8999999761581421, "crit": 1, "desc": "Lua describe test block", "from": [ { "file": 1 } ] }, { "id": "micro-behaviors/communications/http/llm::llm-chat-completions-path", "atk": "T1071.001", "conf": 0.7599999904632568, "crit": 3, "desc": "OpenAI-compatible chat completions path", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/data/llm::jailbreak-term-reference", "conf": 0.699999988079071, "crit": 3, "desc": "References LLM jailbreak terminology", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/data/serialize/json::json-loads-call", "conf": 0.8999999761581421, "crit": 3, "desc": "Python json.loads call", "from": [ { "file": 13 } ] }, { "id": "metadata/build/github-actions::scheduled-workflow-trigger", "conf": 0.8999999761581421, "crit": 3, "desc": "GitHub scheduled workflow trigger" }, { "id": "metadata/build/github-actions::id-token-write-permission", "conf": 0.8999999761581421, "crit": 3, "desc": "GitHub Actions OIDC write permission", "from": [ { "file": 9 } ] }, { "id": "micro-behaviors/communications/http/server/framework::http-server-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Imports from Python's http.server module", "from": [ { "file": 13 } ] }, { "id": "micro-behaviors/communications/http/server/framework::builtin-http-server", "atk": "T1071.001", "mbc": "C0002", "conf": 1.0, "crit": 2, "desc": "Built-in Python HTTP server modules", "from": [ { "off": 706, "file": 13, "line": 15 } ] }, { "id": "metadata/build/github-actions::contents-write-permission", "conf": 0.9200000166893005, "crit": 3, "desc": "GitHub Actions contents write permission" }, { "id": "metadata/package/testing/harness-lua::lua-spec-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Lua spec filename", "from": [ { "file": 1 } ], "spans": [ [ 0, 14 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.8999999761581421, "crit": 3, "desc": "HTTP application/json Content-Type header", "from": [ { "file": 1 } ], "spans": [ [ 2628, 32 ] ] } ] }, { "ctx": [ { "b": "eIe8pzGGD5A::67z/cXsAaJJ4\u0026^^moA=(nvaA.NjwPw[\u0026z/fiaasHSpz/fiaaAzQxu[0SHCw7Y2xDQ=5z/*4yvixP4vqE5Vz/fhgd\u003ce}EwGU@dB.tAae^:fZ3n0?Lpes?TiV@JTx(+zqwPq\u003cbA+fqmviwiYzF78jB-8qnzdK?rp\u0026yk:z.BH%v@2T@diJ5pwftPcaz2!ev%8)8wftP7avwZKawLZiazCZoBzbj)eIe8:y*?3}eLHp}aA.NoBrCdjC4\u003e#nzF-%5Bs[XnxK@q}B.rpBA=k\u0026baz+$ex\u003e5o1B0a$hC4CY9wftubaz+FcB8LAbAaJJiy\u0026%eec#%DFaA}KwxBlsyayYFmBy!#ij0nSUx(+zrAaJJ4Ab](uwPF#oxK@q.l}XUDx(W{9xcp=6wg.[weOe*giV})Fz!0M9A+funA=b}vBzbkdv@Dl%x\u003eINewN({8ByxolB1vUIeD", "ln": 0, "col": 1, "line": 1 }, { "b": "xF6SzeEB6Yawui+B8JgfzE:(ixK@reAc3bwwNPA#oIwe6vrb{4B98LlvR66)Cwhejazt\u003esA9)E2v@0i0x)s-xA+fqmyH}^5wft/daARTrxj\u003e^@aAIWmB98CpzFa1", "ln": 436, "col": 70, "line": 6 }, { "b": "xcqqfwGV5cvrb{\u0026ay/tcw]zZbvqYN^az(4byC2@3y\u0026r/(y-)z5y\u0026A%aB09Q*A+flkx(W=cb6dZmv\u003eICay\u0026A%aB0p}#y\u0026r/(y-(LFryYRQuRS)YmiB-ob4kgqy*?yaz.kQAvrb[0vqfK43jpP/v{%f@w[=HiB-I5mauZ\u0026]3lQE8BAzFezeS{1auZ\u0026]3lQDlaz+FcB8Jf:ax@4SarR^HarU-pA=#2maBsCrarR^HarR!yx(!xczxH[#i5\u0026#barR^HarR^Hy\u0026r/(BzkVhatmwoBy/V8C}Ts%fjO*bB8#5cC{4CvarR^HarR^HarUfjzGGDcByeH5uU\u003c\u003c[uT^?\u0026v@0il3lQDlarR^HarR^Haz+$avqE5}z!abojS[SPCRj2FAv$)nByeG}wo?J)vrt{adiJLHar\u00260parR^HarR^HarR^HzFahDxK$Q.wPz00lVl\u003c:wO#Pwrc-B]b3=rOar\u003elkAbok#vruj4zzb:Cz/c:aarR^HarR^HarR^Hx\u003ewF%z!abOw[=c[c)ztJq=uF0lqgfxocL/cBzbl63lQDlarR^HarR^HarR!AxlV4Ivr\u003cmGDM)0iAclnpwPG4RDM)ikx(4m0wNPu#i=]y+wQM9Nw[=c[x(mN8b075{ygg*)vSD3*yA+/zDM()dBzkVhb03]moIX2Ga$K{QvqPN1iWeJSa$K{VwP?T9x([RAiWd9^m[s?Lu41mFC4\u003e(hvruj4zGxe}wPRG[By!#bi=\u003e", "ln": 589, "col": 54, "line": 9 }, { "b": "BAhInefX}xB8$=5wPG4RtydMmz!@#eiWeY/wPw$Cb4CLeBy/uib03]Vzddc{auS7!k$K:lb7i:BcN/xBarR^HarR^HaBKOtarR^HarR!P3lQDlarR!P3lQDlayen73lQEtedc!j3tai%ayuVxB98ChBy/9gazCZoxK#10wPz\u0026AwNP7ZuVQsfvru6[C{\u003e9:wn.!$ay]58v@=o)wHHwGryYRQuRS)YmiBinar?}jbo!l.e*bjSA::63xl+QLe*8uza$K\u003cGB-7Yhx(v(qdgdguarUGsv{%f@v@b\u003c\u003czGDi)arR^Hy*?TnuVP!2B-n:vB-7Yhx(v(qdf", "ln": 1651, "col": 198, "line": 34 }, { "b": "x\u003cUT!C{2l)b6myqBs?otC{j^DarR^HarR^HarUGeB8#nbvq]{/vQTs?auZ?\u003exMOuniXJcvgb**te?![jiYG8Ui4[]MBy/V8C}Ts%a$K6zarR^HarR^HaAIQuuV{13x\u003ezSkjS[uBy\u0026:esazk?9A+5J$wPq\u003c7B95J/aARTDwH[fharR^HarR!Ped9HxarR^HEjkHgarR^H", "ln": 2343, "col": 19, "line": 56 }, { "b": "zyu}Rx\u003ewF$y?WD#BrCWswO@S2y?WD#Bui]Fz/YFrdiJhtwftD3wgm\u0026)arR^Hx(\u003e:EAa9*ewPF#7y?m3)aAhvtze:PraARpqz/]Yaa$K\u003cGB-7Yhx(v(qdgdguarR^Hy\u0026r/(y-)+fB09Q*v@b\u003c\u003czGE{Uz/Z1Ga$)zwz!0MbefGoDarR^HarR^HxK}", "ln": 3239, "col": 23, "line": 84 }, { "b": "x(v(J3lQDlarR^UeG!FyB7GxlaARpdaz\u003eLdyH}30Bz\u003e@azxJ$hvpJ$Zwfu2lB98ClvqNR7arR^HarU9lB7Gxle]t3sv}YB{c)y=xo*IuAj%zK2v}{76zEl%)v@C)?c\u0026", "ln": 4351, "col": 94, "line": 109 } ], "depth": 1, "facts": { "imp": [ [ "", "require" ], [ "", "helpers.each_strategy" ], [ "", "describe" ], [ "", "lazy_setup" ], [ "", "helpers.get_db_utils" ], [ "", "assert" ], [ "", "helpers.start_kong" ], [ "", "lazy_teardown" ], [ "", "helpers.stop_kong" ], [ "", "before_each" ], [ "", "helpers.proxy_client" ], [ "", "after_each" ], [ "", "it" ], [ "", "assert.not_equal" ], [ "", "it" ], [ "", "assert.equal" ], [ "", "it" ], [ "", "assert.not_equal" ], [ "", "assert.response.has.jsonbody" ], [ "", "assert.response" ], [ "", "assert.matches" ], [ "", "cjson_encode" ], [ "", "pcall" ], [ "", "cjson.encode" ], [ "", "tostring" ], [ "", "spec.helpers" ] ], "mbr": [ "assert.equal", "assert.matches", "assert.not_equal", "assert.response", "assert.response().has", "assert.response().has.jsonbody", "bp.plugins", "bp.routes", "bp.services", "cjson.encode", "helpers.each_strategy", "helpers.get_db_utils", "helpers.mock_upstream_url", "helpers.proxy_client", "helpers.start_kong", "helpers.stop_kong", "res.status", "route_block.id", "route_mask.id" ], "tgt": [ "after_each", "assert", "assert.equal", "assert.matches", "assert.not_equal", "assert.response", "assert.response().has.jsonbody", "before_each", "cjson.encode", "cjson_encode", "describe", "helpers.each_strategy", "helpers.get_db_utils", "helpers.proxy_client", "helpers.start_kong", "helpers.stop_kong", "it", "lazy_setup", "lazy_teardown", "pcall", "require", "tostring" ], "funcs": [ [ "cjson_encode", 4550 ] ], "metrics": { "ast": { "op.lor": 1, "op.land": 1, "max_depth": 25, "call_count": 34, "node_count": 947, "member_count": 19, "max_array_len": 5, "op_density.lor": 0, "op_density.land": 0, "member_depth_max": 4 }, "file": { "size": 4670, "entropy": 4.86 }, "text": { "lines": 120, "top_char": 101, "max_ws_run": 1, "digit_ratio": 0.01, "space_count": 996, "char_entropy": 4.86, "unique_chars": 78, "top_char_null": 0, "lines_over_200": 1, "string_density": 0.28, "top_char_ratio": 0.07, "avg_line_length": 37.92, "max_line_length": 259, "non_ascii_ratio": 0, "empty_line_ratio": 0.13, "last_line_length": 3, "long_token_count": 2, "whitespace_ratio": 0.24, "identifier_density": 1.26, "line_length_stddev": 37.05, "normalized_string_count": 3.01, "repeated_char_sequences": 19, "suspicious_comment_ratio": 0.08, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 9.56 }, "binds": { "count": 13 }, "binary": { "peak_region_bytes": 4670, "peak_region_entropy": 4.91 }, "source": { "function_count": 1 }, "imports": { "count": 1, "third_party_count": 1, "third_party_ratio": 1 }, "strings": { "bytes": 1473, "count": 33, "url_count": 2, "avg_length": 44.64, "max_length": 1000, "path_count": 5, "avg_entropy": 2.98, "email_count": 1, "entropy_stddev": 0.93 }, "comments": { "chars": 848, "count": 13, "empty": 2, "lines": 11, "high_entropy": 1, "to_code_ratio": 0.1 }, "functions": { "count": 1 }, "identifiers": { "count": 151, "unique": 66, "avg_length": 7.35, "max_length": 17, "min_length": 1, "avg_entropy": 2.46, "reuse_ratio": 0.44, "length_stddev": 3.43, "sequential_names": 1, "single_char_count": 2, "single_char_ratio": 0.03, "high_entropy_count": 3, "high_entropy_ratio": 0.05, "all_lowercase_ratio": 0.98, "all_uppercase_ratio": 0.03, "underscore_prefix_count": 1 } } }, "id": 1, "mol": "H(Cm)", "path": "/data/samples/unknown/foraged/lua/luarocks.org/_/ai-lasso-guardrail/ai-lasso-guardrail-1.0.0-1.src.rock!!kong-ai-lasso-guardrail/spec/ai-lasso-guardrail/integration_spec.lua", "pid": 0, "risk": 2, "sha": "d66969dad602ad006f1cf88158019e0d200930b65f63f608ceecc52ca5cb6337", "size": 4670, "traits": [ { "id": "metadata/file/profile/language::lang-english--atom-1", "conf": 0.8, "crit": 2, "desc": "English function-word token \"the\"", "spans": [ [ 82, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-2", "conf": 0.8, "crit": 2, "desc": "English function-word token \"and\"", "spans": [ [ 150, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-5", "conf": 0.8, "crit": 2, "desc": "English function-word token \"for\"", "spans": [ [ 1760, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-7", "conf": 0.8, "crit": 2, "desc": "English function-word token \"this\"", "spans": [ [ 106, 0 ] ] }, { "id": "metadata/package/testing/harness-lua::lua-busted-describe", "conf": 0.9, "crit": 1, "desc": "Lua describe test block", "spans": [ [ 1808, 0 ] ] }, { "id": "metadata/package/testing/harness-lua::lua-busted-it", "conf": 0.9, "crit": 1, "desc": "Lua it test case", "spans": [ [ 3287, 0 ] ] }, { "id": "metadata/package/testing/harness-lua::lua-spec-basename", "conf": 0.9, "crit": 1, "desc": "Lua spec filename", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 1, "desc": "File is in common test directory", "spans": [ [ 0, 0 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "spans": [ [ 941, 34 ] ] }, { "id": "metadata/package/testing/harness-lua::lua-busted-spec", "conf": 0.95, "crit": 2, "desc": "Lua Busted-style spec file", "spans": [ [ 0, 0 ], [ 3287, 0 ] ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File identified as a test by path or name", "spans": [ [ 0, 0 ] ] }, { "id": "metadata/package/testing/harness/runtime::is-test", "conf": 0.9, "crit": 2, "desc": "Test, spec, or fixture file", "spans": [ [ 0, 0 ], [ 3287, 0 ] ] } ], "type": "lua" }, { "ctx": [ { "b": "eIe8BzFshnBy/JnB0b7kAV/EqwGU@mA+cwnA:-\u003cby*?B1z/cXlz!A=]asI2zzF7Rwy\u0026%x8zGvEtx!sdfB8#mKxlvT6wo89)y+GQkB8#mLy\u0026%ene=", "n": [ { "c": 3, "d": "Recognized Python SSL-unverified marker", "i": "objectives/evasion/security-bypass/tls::python-ssl-unverified-recognized-marker", "o": 0, "z": 62, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "eIe8yB-8myz/cXaaAhd9x(k4!BZVzbzGGDgAb]JiwPw[wzF{T[AaJ]+wPI%sfh3k3xdj$.FrRf#xKM0gB0bWuC{3{iB8#mLy\u0026%eexKL%8zF]", "ln": 2, "addr": 90 }, { "b": "eIe8=wPI%sfjO:rz/djzz/fhgA+flkx(W^ae*a5mzxKdqBz8!aB-RUowftG8z/3RsxK@rbwPhMgA=k(re=", "ln": 3, "addr": 177 }, { "b": "", "ln": 4, "addr": 243 }, { "b": "", "ln": 6, "addr": 286 }, { "b": "y\u0026r/(y-)L5B8#mxjS[=RADL#owGSgjz/fhuAboVfx(m#AvqdrfvrlHdeOximA+6i0x(2zrvrlHda]", "n": [ { "c": 2, "d": "Loads Lua modules (require)", "i": "metadata/lang/scripted::module-require", "o": 301, "z": 7, "cf": 0.800000011920929 } ], "ln": 7, "addr": 287 }, { "b": "", "ln": 8, "addr": 349 }, { "b": "", "ln": 19, "addr": 558 }, { "b": "wmY*(A+O#]c)AqnzEmK5x\u003eezsazb+lv@#B6zyu}", "n": [ { "c": 2, "d": "Lua Busted-style spec file", "i": "metadata/package/testing/harness-lua::lua-busted-spec", "o": 559, "z": 8, "cf": 0.949999988079071 } ], "ln": 20, "addr": 559 }, { "b": "arUxuc)AwDatL?$lVN9PyI4H9wg.n0B7Ec.ay/7[A=SAQazb+lv@#B6zyu}", "n": [ { "c": 2, "d": "authorized_keys benign context", "i": "micro-behaviors/fs/path/sensitive/credentials::ssh-authorized-keys-benign-context", "o": 593, "z": 2, "cf": 0.949999988079071 } ], "ln": 21, "addr": 591 }, { "b": "arR^Hy\u0026r/(y-)\u003cyjS[MHB8#mLxjU%/B.\u003e=5c[b", "ln": 22, "addr": 639 }, { "b": "", "ln": 366, "addr": 15202 }, { "b": "wmY*(A+O#]c)A+KuUKz1wO#P%Bz(8lB0rdTw{503BzkVhc[b", "ln": 367, "addr": 15203 }, { "b": "arUxuc)AntvruQ5zGu{@AaJ]MnG-a[z!{LbwOc0aBz\u0026pzxK@rcwPz%9AWL]Jl3uWJy**^?wMiO^y-)!jvq]^4efFLEzEW^5z/c%L", "n": [ { "c": 1, "d": "AI and vault service names", "i": "metadata/file/catalog/service::ai-vault-service-names", "o": 15257, "z": 6, "cf": 0.8199999928474426 } ], "ln": 368, "addr": 15242 }, { "b": "arR^Hy\u0026r/(y-)UsBrAZ?y*?yaz.ucIuUKz1wO#P%Bz(8lB0#w", "ln": 369, "addr": 15323 }, { "b": "arR^HarV1NBA}?pauZ?\u003ew{503BzkVha$K\u003cvb4+$nv@#B6zx-vejS]7]zEEx[auZ?\u003exjVf(z/Px1AW04", "ln": 370, "addr": 15363 } ], "depth": 1, "facts": { "imp": [ [ "", "require" ], [ "", "describe" ], [ "", "it" ], [ "", "lasso.gen_ulid" ], [ "", "assert.equal" ], [ "", "assert.is_true" ], [ "", "is_crockford" ], [ "", "it" ], [ "", "lasso.gen_ulid" ], [ "", "lasso.gen_ulid" ], [ "", "assert.is_true" ], [ "", "it" ], [ "", "lasso.gen_ulid" ], [ "", "lasso.gen_ulid" ], [ "", "assert.are_not.equal" ], [ "", "describe" ], [ "", "it" ], [ "", "assert.same" ], [ "", "lasso.direction" ], [ "", "assert.same" ], [ "", "lasso.direction" ], [ "", "assert.same" ], [ "", "lasso.direction" ], [ "", "describe" ], [ "", "it" ], [ "", "lasso.build_payload" ], [ "", "assert.equal" ], [ "", "assert.equal" ], [ "", "assert.same" ], [ "", "assert.is_nil" ], [ "", "assert.is_nil" ], [ "", "it" ], [ "", "lasso.build_payload" ], [ "", "string.rep" ], [ "", "assert.equal" ], [ "", "assert.is_nil" ], [ "", "it" ], [ "", "lasso.build_payload" ], [ "", "assert.same" ], [ "", "describe" ], [ "", "it" ], [ "", "lasso.extract_block" ], [ "", "assert.is_true" ], [ "", "assert.matches" ], [ "", "it" ], [ "", "lasso.extract_block" ], [ "", "assert.is_false" ], [ "", "describe" ], [ "", "it" ], [ "", "lasso.apply_masks" ], [ "", "assert.is_true" ], [ "", "assert.equal" ], [ "", "it" ], [ "", "lasso.apply_masks" ], [ "", "assert.is_true" ], [ "", "assert.equal" ], [ "", "it" ], [ "", "lasso.apply_masks" ], [ "", "assert.equal" ], [ "", "it" ], [ "", "lasso.apply_masks" ], [ "", "assert.is_false" ], [ "", "assert.equal" ], [ "", "describe" ], [ "", "it" ], [ "", "lasso.decide" ], [ "", "assert.equal" ], [ "", "it" ], [ "", "lasso.decide" ], [ "", "assert.equal" ], [ "", "it" ], [ "", "lasso.decide" ], [ "", "assert.equal" ], [ "", "assert.equal" ], [ "", "it" ], [ "", "lasso.decide" ], [ "", "assert.equal" ], [ "", "it" ], [ "", "lasso.decide" ], [ "", "assert.equal" ], [ "", "it" ], [ "", "lasso.decide" ], [ "", "assert.equal" ], [ "", "describe" ], [ "", "it" ], [ "", "lasso.derive_event_id" ], [ "", "assert.equal" ], [ "", "assert.is_true" ], [ "", "is_crockford" ], [ "", "it" ], [ "", "assert.equal" ], [ "", "lasso.derive_event_id" ], [ "", "lasso.derive_event_id" ], [ "", "it" ], [ "", "assert.are_not.equal" ], [ "", "lasso.derive_event_id" ], [ "", "lasso.derive_event_id" ], [ "", "describe" ], [ "", "it" ], [ "", "lasso.to_intent_messages" ], [ "", "assert.equal" ], [ "", "assert.equal" ], [ "", "assert.equal" ], [ "", "assert.equal" ], [ "", "assert.equal" ], [ "", "assert.equal" ], [ "", "assert.equal" ], [ "", "assert.equal" ], [ "", "assert.equal" ], [ "", "it" ], [ "", "lasso.to_intent_messages" ], [ "", "assert.equal" ], [ "", "assert.equal" ], [ "", "it" ], [ "", "lasso.to_intent_messages" ], [ "", "assert.equal" ], [ "", "type" ], [ "", "assert.equal" ], [ "", "it" ], [ "", "lasso.to_intent_messages" ], [ "", "assert.equal" ], [ "", "type" ], [ "", "it" ], [ "", "lasso.to_intent_messages" ], [ "", "ipairs" ], [ "", "assert.equal" ], [ "", "it" ], [ "", "lasso.to_intent_messages" ], [ "", "lasso.to_intent_messages" ], [ "", "it" ], [ "", "lasso.to_intent_messages" ], [ "", "lasso.derive_event_id" ], [ "", "it" ], [ "", "lasso.to_intent_messages" ], [ "", "lasso.derive_event_id" ], [ "", "assert.is_true" ], [ "", "assert.not_equal" ], [ "", "it" ], [ "", "lasso.to_intent_messages" ], [ "", "lasso.to_intent_messages" ], [ "", "assert.is_true" ], [ "", "assert.not_equal" ], [ "", "assert.not_equal" ], [ "", "it" ], [ "", "lasso.to_intent_messages" ], [ "", "lasso.to_intent_messages" ], [ "", "lasso.to_intent_messages" ], [ "", "assert.is_true" ], [ "", "assert.not_equal" ], [ "", "lasso.to_intent_messages" ], [ "", "describe" ], [ "", "lasso.reasoning_text" ], [ "", "lasso.reasoning_text" ], [ "", "assert.is_nil" ], [ "", "lasso.reasoning_text" ], [ "", "describe" ], [ "", "lasso.to_intent_tools" ], [ "", "assert.is_nil" ], [ "", "assert.is_nil" ], [ "", "lasso.to_intent_tools" ], [ "", "assert.is_nil" ], [ "", "lasso.to_intent_tools" ], [ "", "assert.is_nil" ], [ "", "lasso.to_intent_tools" ], [ "", "describe" ], [ "", "lasso.flatten_text" ], [ "", "lasso.flatten_text" ], [ "", "kong.plugins.ai-lasso-guardrail.lasso" ] ], "mbr": [ "ans.content", "ans.eventId", "ans.eventIndex", "assert.are_not", "assert.are_not.equal", "assert.equal", "assert.is_false", "assert.is_nil", "assert.is_true", "assert.matches", "assert.not_equal", "assert.same", "d.action", "e.eventId", "e.traceId", "lasso.apply_masks", "lasso.build_payload", "lasso.decide", "lasso.derive_event_id", "lasso.direction", "lasso.extract_block", "lasso.flatten_text", "lasso.gen_ulid", "lasso.reasoning_text", "lasso.to_intent_messages", "lasso.to_intent_tools", "p.messageType", "p.sessionId", "p.source", "p.tools", "p.userId", "package.path", "reason.content", "reason.content.content", "reason.content.type", "reason.eventId", "reason.eventIndex", "reason.role", "string.rep" ], "tgt": [ "assert.are_not.equal", "assert.equal", "assert.is_false", "assert.is_nil", "assert.is_true", "assert.matches", "assert.not_equal", "assert.same", "describe", "ipairs", "is_crockford", "it", "lasso.apply_masks", "lasso.build_payload", "lasso.decide", "lasso.derive_event_id", "lasso.direction", "lasso.extract_block", "lasso.flatten_text", "lasso.gen_ulid", "lasso.reasoning_text", "lasso.to_intent_messages", "lasso.to_intent_tools", "require", "string.rep", "type" ], "metrics": { "ast": { "op.lt": 4.0, "op.lnot": 1.0, "max_depth": 25.0, "bind_count": 50.0, "call_count": 217.0, "node_count": 5584.0, "member_count": 39.0, "op_density.lt": 0.0, "op_density.lnot": 0.0, "identifier_count": 92.0, "member_depth_max": 3.0, "string_literal_count": 244.0, "array_literal_max_length": 5.0 }, "file": { "size": 16646.0, "entropy": 4.83, "size_bytes": 16646.0 }, "text": { "digit_ratio": 0.03, "space_count": 3056.0, "total_lines": 403.0, "char_entropy": 4.83, "unique_chars": 92.0, "string_density": 0.61, "avg_line_length": 40.31, "high_byte_ratio": 0.0, "max_line_length": 129.0, "non_ascii_ratio": 0.0, "empty_line_ratio": 0.11, "last_line_length": 4.0, "whitespace_ratio": 0.21, "most_common_ratio": 0.07, "identifier_density": 2.16, "line_length_stddev": 30.99, "normalized_string_count": 12.15, "repeated_char_sequences": 15.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 23.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.1, "normalized_unique_identifiers": 10.63 }, "binds": { "count": 50.0 }, "calls": { "count": 217.0 }, "binary": { "overall_entropy": 4.83, "peak_region_bytes": 16384.0, "peak_region_entropy": 5.0 }, "source": { "function_count": 2.0 }, "imports": { "count": 1.0, "unique_modules": 1.0, "third_party_count": 1.0, "third_party_ratio": 1.0 }, "members": { "count": 39.0 }, "strings": { "total": 244.0, "avg_length": 14.5, "max_length": 83.0, "path_count": 1.0, "avg_entropy": 2.54, "email_count": 5.0, "empty_count": 3.0, "total_bytes": 3538.0, "entropy_stddev": 1.1 }, "comments": { "chars": 1489.0, "lines": 29.0, "total": 29.0, "to_code_ratio": 0.08 }, "functions": { "count": 2.0 }, "identifiers": { "count": 92.0, "total": 870.0, "avg_length": 7.13, "max_length": 19.0, "min_length": 1.0, "avg_entropy": 2.23, "reuse_ratio": 0.11, "unique_count": 92.0, "length_stddev": 4.17, "sequential_names": 9.0, "single_char_count": 10.0, "single_char_ratio": 0.11, "high_entropy_count": 1.0, "high_entropy_ratio": 0.01, "all_lowercase_ratio": 0.92, "all_uppercase_ratio": 0.02, "underscore_prefix_count": 1.0 } } }, "id": 2, "path": "/data/samples/unknown/foraged/lua/luarocks.org/_/ai-lasso-guardrail/ai-lasso-guardrail-1.0.0-1.src.rock!!kong-ai-lasso-guardrail/spec/ai-lasso-guardrail/lasso_spec.lua", "pid": 0, "risk": 1, "sha": "7518c276152e4dba75aa06c819847993823bdb478fdc0bed2a34df66d294ef37", "size": 16646, "traits": [ { "id": "metadata/package/testing/harness-lua::lua-spec-basename", "conf": 0.8999999761581421, "crit": 1, "desc": "Lua spec filename", "spans": [ [ 0, 14 ] ] }, { "id": "metadata/package/testing/harness-lua::lua-busted-it", "conf": 0.8999999761581421, "crit": 1, "desc": "Lua it test case", "spans": [ [ 593, 2 ] ] }, { "id": "metadata/package/testing/harness-lua::lua-busted-describe", "conf": 0.8999999761581421, "crit": 1, "desc": "Lua describe test block", "spans": [ [ 559, 8 ] ] }, { "id": "metadata/package/testing/presence/harness::test-directory-path", "conf": 1.0, "crit": 1, "desc": "File is in common test directory", "spans": [ [ 0, 62 ] ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Source file has low overall entropy", "spans": [ [ 0, 29 ] ] }, { "id": "metadata/file/profile/identity::sequential-identifiers", "conf": 0.800000011920929, "crit": 2, "desc": "Sequential source identifier names", "spans": [ [ 0, 35 ] ] }, { "id": "metadata/package/testing/harness-lua::lua-busted-spec", "conf": 0.949999988079071, "crit": 2, "desc": "Lua Busted-style spec file", "spans": [ [ 0, 14 ], [ 559, 8 ], [ 593, 2 ] ] }, { "id": "metadata/package/testing/presence/harness::test-directory", "conf": 1.0, "crit": 2, "desc": "File in a test directory", "spans": [ [ 0, 62 ] ] }, { "id": "metadata/package/testing/harness/runtime::is-test", "conf": 0.8999999761581421, "crit": 2, "desc": "Test, spec, or fixture file", "spans": [ [ 0, 14 ], [ 559, 8 ], [ 593, 2 ] ] } ], "type": "lua" }, { "ctx": [ { "b": "eIe8Nx!sdfB8#mKxlvT6wo89)y-}./LPSRqzF78hy\u0026%x8zxK4mvrrS4y*?yax\u003ez6\u003cB0a$avrrSlA:-M(x\u003e5ofx([2hoKS0-zY\u0026Fawftt$z!0N7aA8o", "n": [ { "c": 2, "d": "Source file has low overall entropy", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 0, "z": 29, "cf": 0.8999999761581421 }, { "c": 2, "d": "Contains frequent English function words", "i": "metadata/file/profile/language::lang-english", "o": 38, "z": 4, "cf": 0.800000011920929 } ], "ln": 1, "addr": 0 }, { "b": "eIe8Zvrlj9azC{ux(m:3zE\u003eByqGV\u003e#azCZoBzbkdA+flkwPI@oAa9\u003c4asHVdv}x.5diJ5pwgO\u003cwAcb/jzEEu$C}p7EB.kk%A=SvBxK@rbwPI*ezGxv", "ln": 2, "addr": 92 }, { "b": "eIe7[A+frhz/fScaAh15B7D^yBz\u0026pyv{%l$v@Dj6y?mZ5z/fRG", "ln": 3, "addr": 184 }, { "b": "", "ln": 9, "addr": 543 }, { "b": "y\u0026r/(y-)L5B8#mxjS[=RADL#owGSgjz/fhuAboVfx(m#AvqdrfvrlHdeOximA+6i0x(2zrvrlHda]", "n": [ { "c": 2, "d": "Loads Lua modules (require)", "i": "metadata/lang/scripted::module-require", "o": 558, "z": 7, "cf": 0.800000011920929 } ], "ln": 10, "addr": 544 }, { "b": "y\u0026r/(y-)k7x\u003eqg7auZ\u0026/wPq\u003cbA+cvqyJ196e]USHxk8m8e[5DCy*?yaz.kQAvrb[0vqfKgv@b\u003c\u003czGE6", "ln": 11, "addr": 606 }, { "b": "Ee", "ln": 18, "addr": 865 }, { "b": "", "ln": 19, "addr": 867 }, { "b": "eIe8my*?BcwO@R^AaJ]MnG.\u003e)y\u0026\u003cxdz!9o)ay/tcBy/uiasIqMA+PA7aBCquA=LPlaA7\u003cmvR/%)yJy{EBz\u0026pzwQ5qtw]zYjv@bN{B7]l2v{%E[z/df", "n": [ { "c": 1, "d": "AI and vault service names", "i": "metadata/file/catalog/service::ai-vault-service-names", "o": 879, "z": 6, "cf": 0.8199999928474426 } ], "ln": 20, "addr": 868 }, { "b": "y\u0026r/(y-)tjzEW^5z/cXfy*?BcwO$\u003c+z/fVdzGEppz/fVdzGEr", "ln": 21, "addr": 960 }, { "b": "arUxgaAR)FwHI5bzGGDcBsws}jS\u003e}\u0026BAh8kxcFEuxK#5", "ln": 22, "addr": 1000 }, { "b": "arR^HarUlkwb", "ln": 30, "addr": 1338 }, { "b": "arR^HwO#2", "ln": 31, "addr": 1348 }, { "b": "arR^HA+funA=91wvpB4:e[n*qv{%EcAa9^eB1wBTar\u0026l=azb4#B7DEpeIe8.z/ddFBAh8kxcpY5zGGDcBugK=v{%l$By/YsefFFwzyoJGzddH3ayX+?yx", "n": [ { "c": 1, "d": "Lua byte-string construction", "i": "objectives/command-and-control/backdoor/broad::lua-byte-builder", "o": 1367, "z": 12, "cf": 0.8799999952316284 } ], "ln": 32, "addr": 1356 }, { "b": "arUlkwb", "ln": 33, "addr": 1450 }, { "b": "arUYoBAIRwar\u00260Xazb4#B7C", "ln": 34, "addr": 1456 }, { "b": "arUlkwb", "ln": 101, "addr": 3832 }, { "b": "arUGsv{%f@wnc6bjS[MHB8#mLwnc6}v@#B6zyxNAB-H#6df", "ln": 102, "addr": 3838 }, { "b": "arUGsv{%f@Aaa3dz^^f0jS[MHB8#mLvS=y3wm6p:D2dzcwgh^", "n": [ { "c": 1, "d": "Exploit marker indicators", "i": "objectives/privilege-escalation/exploit/vulnerabilities::tunables-exploit-marker", "o": 3884, "z": 7, "cf": 1.0 } ], "ln": 103, "addr": 3876 }, { "b": "arR^HzdN^fvp%d)auZ\u0026*v{%ma", "ln": 104, "addr": 3916 }, { "b": "arR^HzdN^fvp%dUBA}?pauZ\u0026Tx(U?ywPI{3xjUB(D2NsC", "ln": 105, "addr": 3937 }, { "b": "", "ln": 136, "addr": 5123 }, { "b": "eIea8LZ}+TFfmB3By/uiay]zkvR/QcwoA0taMwSo\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[@", "n": [ { "c": 2, "d": "Contains a box-drawing text banner", "i": "metadata/file/format::box-drawing-banner", "o": 5153, "z": 162, "cf": 0.8999999761581421 } ], "ln": 137, "addr": 5124 }, { "b": "eIe8DxK#67x(n37zGE1rz!9A4x(+znzxJw9wft#cwGUA2A3fjkwN]v.ayMyiwPxwAB-IvxBAg/1wL3zPxK$Q.wPxsABzbj", "ln": 138, "addr": 5316 }, { "b": "arR^HarSl/asHVmy\u0026sJewftP7aARpdaAz4mAbPSnwGU@9vrl0eaAy[jxK#ibBzb92aAIaouVGO0uT^}:C{1IAz!ac2w[=76wPxwvzFTOEefG1L", "ln": 337, "addr": 12826 }, { "b": "arR^HarSl/aARpdaA}Hqy?j-fwP@feBy=Odvq{f%zGu}mzxJ\u003enwGU@9vrl05vR6d\u0026A+cwbwNPaXA=SviA+cw9y\u0026%/jwN)y", "ln": 338, "addr": 12915 }, { "b": "arR^HarUYoBAIRwazU[kxd!joB8V5nB7D$nCXImFyJ196e]\u003eJAAbPSnwIdRbByf9hvruTkc[cX\u0026wO#0@wmYp5", "ln": 339, "addr": 12991 }, { "b": "arR^HarR^HDMVJplVl\u003c:wO#Pwrc-B]b3=rOar\u003elkAbok#vruj4zzb:Cz/c:wEjk", "n": [ { "c": 3, "d": "HTTP application/json Content-Type header", "i": "micro-behaviors/communications/http/header/content-type::json-header", "o": 13072, "z": 34, "cf": 0.8999999761581421 } ], "ln": 340, "addr": 13060 }, { "b": "arR^HwO=B0", "ln": 341, "addr": 13111 }, { "b": "arR^HarUDrzF7Orz!yXlA=JMLy*?yazY\u0026Xnvrb[0vqfKsazb4@y?mc1Bz\u0026pxwI4Fhv@C)?az\u003eLdyH}30A+frhz/fScayYn1C{jW", "ln": 342, "addr": 13120 }, { "b": "arR^HwO#2", "ln": 343, "addr": 13200 } ], "depth": 1, "facts": { "imp": [ [ "", "require" ], [ "", "require" ], [ "", "require" ], [ "", "type" ], [ "", "type" ], [ "", "ipairs" ], [ "", "type" ], [ "", "table.concat" ], [ "", "ipairs" ], [ "", "type" ], [ "", "flatten_content" ], [ "", "tostring" ], [ "", "ipairs" ], [ "", "type" ], [ "", "type" ], [ "", "tostring" ], [ "", "kong.request.get_header" ], [ "", "lasso.gen_ulid" ], [ "", "kong.request.get_header" ], [ "", "kong.client.get_consumer" ], [ "", "lasso.direction" ], [ "", "lasso.build_payload" ], [ "", "session_id" ], [ "", "resolve_user_id" ], [ "", "client.call" ], [ "", "lasso.decide" ], [ "", "kong.log.warn" ], [ "", "kong.log.err" ], [ "", "kong.response.exit" ], [ "", "kong.log.err" ], [ "", "kong.response.exit" ], [ "", "kong.request.get_header" ], [ "", "kong.request.get_header" ], [ "", "kong.request.get_header" ], [ "", "ngx.unescape_uri" ], [ "", "decode" ], [ "", "kong.request.get_header" ], [ "", "decode" ], [ "", "lasso.build_payload" ], [ "", "session_id" ], [ "", "resolve_user_id" ], [ "", "client.call" ], [ "", "surface_auth" ], [ "", "fail_or_allow" ], [ "", "lasso.decide" ], [ "", "kong.response.exit" ], [ "", "lasso.to_intent_messages" ], [ "", "classify_intent" ], [ "", "intent_session_information" ], [ "", "lasso.to_intent_tools" ], [ "", "kong.service.response.get_raw_body" ], [ "", "cjson.decode" ], [ "", "type" ], [ "", "type" ], [ "", "ipairs" ], [ "", "type" ], [ "", "type" ], [ "", "lasso.to_intent_messages" ], [ "", "classify_intent" ], [ "", "intent_trace_id" ], [ "", "kong.request.get_body" ], [ "", "type" ], [ "", "type" ], [ "", "access_intent" ], [ "", "kong.request.get_body" ], [ "", "type" ], [ "", "type" ], [ "", "scan_messages_from_request" ], [ "", "classify" ], [ "", "surface_auth" ], [ "", "fail_or_allow" ], [ "", "kong.response.exit" ], [ "", "ipairs" ], [ "", "pcall" ], [ "", "kong.service.request.set_raw_body" ], [ "", "kong.log.err" ], [ "", "intent_trace_id" ], [ "", "response_intent" ], [ "", "kong.service.response.get_raw_body" ], [ "", "cjson.decode" ], [ "", "type" ], [ "", "type" ], [ "", "scan_messages_from_response" ], [ "", "classify" ], [ "", "surface_auth" ], [ "", "fail_or_allow" ], [ "", "kong.response.exit" ], [ "", "ipairs" ], [ "", "pcall" ], [ "", "kong.response.exit" ], [ "", "kong.response.get_status" ], [ "", "kong.log.err" ], [ "", "cjson.safe" ], [ "", "kong.plugins.ai-lasso-guardrail.client" ], [ "", "kong.plugins.ai-lasso-guardrail.lasso" ] ], "mbr": [ "block.text", "block.type", "body.choices", "body.messages", "body.tools", "c.finish_reason", "c.message", "choice.message", "choice.message.content", "cjson.decode", "cjson.encode", "client.call", "conf.block_message", "conf.block_status_code", "conf.fail_open", "conf.guard_request", "conf.guard_response", "conf.intent", "conf.intent_app_intent_header", "conf.intent_app_name_header", "conf.intent_encoding_header", "conf.intent_finalize_on_stop", "conf.intent_trace_header", "conf.masking", "conf.session_header", "conf.source_type", "conf.user_header", "consumer.id", "consumer.username", "decision.action", "decision.detail", "decision.err", "dir.message_type", "ibody.messages", "info.agenticAppName", "kong.client", "kong.client.get_consumer", "kong.ctx", "kong.ctx.shared", "kong.ctx.shared.lasso_intent_count", "kong.log", "kong.log.err", "kong.log.warn", "kong.request", "kong.request.get_body", "kong.request.get_header", "kong.response", "kong.response.exit", "kong.response.get_status", "kong.service", "kong.service.request", "kong.service.request.set_raw_body", "kong.service.response", "kong.service.response.get_raw_body", "lasso.build_payload", "lasso.decide", "lasso.direction", "lasso.gen_ulid", "lasso.to_intent_messages", "lasso.to_intent_tools", "m.content", "m.role", "msg.content", "msg.role", "ngx.unescape_uri", "shared.lasso_session_id", "table.concat" ], "tgt": [ "access_intent", "cjson.decode", "classify", "classify_intent", "client.call", "decode", "fail_or_allow", "flatten_content", "intent_session_information", "intent_trace_id", "ipairs", "kong.client.get_consumer", "kong.log.err", "kong.log.warn", "kong.request.get_body", "kong.request.get_header", "kong.response.exit", "kong.response.get_status", "kong.service.request.set_raw_body", "kong.service.response.get_raw_body", "lasso.build_payload", "lasso.decide", "lasso.direction", "lasso.gen_ulid", "lasso.to_intent_messages", "lasso.to_intent_tools", "ngx.unescape_uri", "pcall", "require", "resolve_user_id", "response_intent", "scan_messages_from_request", "scan_messages_from_response", "session_id", "surface_auth", "table.concat", "tostring", "type" ], "metrics": { "ast": { "op.eq": 27.0, "op.gt": 1.0, "op.add": 4.0, "op.lor": 11.0, "op.land": 20.0, "op.lnot": 7.0, "max_depth": 16.0, "bind_count": 51.0, "call_count": 92.0, "node_count": 3130.0, "member_count": 67.0, "op_density.eq": 0.01, "op_density.gt": 0.0, "op_density.add": 0.0, "op_density.lor": 0.0, "op_density.land": 0.01, "op_density.lnot": 0.0, "identifier_count": 128.0, "member_depth_max": 4.0, "string_literal_count": 65.0, "array_literal_max_length": 7.0, "string_concat_chain_max_length": 2.0 }, "file": { "size": 13243.0, "entropy": 4.69, "size_bytes": 13243.0 }, "text": { "digit_ratio": 0.0, "space_count": 2200.0, "total_lines": 347.0, "char_entropy": 4.69, "unique_chars": 81.0, "string_density": 0.19, "avg_line_length": 37.16, "high_byte_ratio": 0.01, "max_line_length": 191.0, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.07, "last_line_length": 23.0, "long_token_count": 1.0, "whitespace_ratio": 0.19, "most_common_ratio": 0.09, "identifier_density": 1.8, "line_length_stddev": 30.03, "normalized_string_count": 3.49, "repeated_char_sequences": 1.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.02, "max_inline_whitespace_run": 8.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.02, "normalized_unique_identifiers": 15.17 }, "binds": { "count": 51.0 }, "calls": { "count": 92.0 }, "binary": { "overall_entropy": 4.69, "peak_region_bytes": 13243.0, "peak_region_entropy": 4.84 }, "source": { "function_count": 14.0 }, "imports": { "count": 3.0, "unique_modules": 3.0, "third_party_count": 3.0, "third_party_ratio": 1.0 }, "members": { "count": 67.0 }, "strings": { "total": 65.0, "avg_length": 10.68, "max_length": 57.0, "avg_entropy": 2.61, "empty_count": 8.0, "total_bytes": 694.0, "entropy_stddev": 0.8 }, "comments": { "chars": 3955.0, "lines": 52.0, "total": 53.0, "to_code_ratio": 0.18, "empty_comments": 1.0, "high_entropy_comments": 1.0 }, "functions": { "count": 14.0 }, "identifiers": { "count": 128.0, "total": 624.0, "avg_length": 8.95, "max_length": 27.0, "min_length": 1.0, "avg_entropy": 2.48, "reuse_ratio": 0.21, "unique_count": 128.0, "length_stddev": 5.72, "sequential_names": 3.0, "single_char_count": 4.0, "single_char_ratio": 0.03, "high_entropy_count": 2.0, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.95, "all_uppercase_ratio": 0.02, "underscore_prefix_count": 1.0 } } }, "id": 3, "mol": "H(Cm)", "path": "/data/samples/unknown/foraged/lua/luarocks.org/_/ai-lasso-guardrail/ai-lasso-guardrail-1.0.0-1.src.rock!!kong-ai-lasso-guardrail/kong/plugins/ai-lasso-guardrail/handler.lua", "pid": 0, "risk": 1, "sha": "3137ac85824c51b27b842ba8486a6123d1062b93cff1fb15dc2112c0bcdc7390", "size": 13243, "traits": [ { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.8999999761581421, "crit": 3, "desc": "HTTP application/json Content-Type header", "spans": [ [ 13072, 34 ] ] } ], "type": "lua" }, { "ctx": [ { "b": "eIe8wB-I4oBAg/cB8kobx(v(iy\u0026r%2v\u003c2x4AV/EqwGUz}eO[\u003cpB8JTyBZYr3A:-V#aAhdtxk8lo", "n": [ { "c": 2, "d": "Source file has low overall entropy", "i": "metadata/file/metrics::low-overall-entropy-source", "o": 0, "z": 29, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "eIc", "ln": 2, "addr": 61 }, { "b": "eIe8kwO=6\u0026wPzj3wO=Smw].D]aA7\u003cmu#/?1BA]F*u[rBdv}{76zEt1rvqYP#u#6W#xd+VwaAz4kB.L(cB0bKxazC{uv{%l$vR3W8zFshABy/JnwN\u003e", "ln": 3, "addr": 64 }, { "b": "arR^Hv}Yp\u003eB6Au:auZ\u0026mqCPUMmO=]Ii=/BMc#0jpefFUqCQS", "ln": 50, "addr": 2281 }, { "b": "arUlkwb", "ln": 51, "addr": 2320 }, { "b": "arUYoBAIRwaAR43y?kkez/f5[BspTjvrcAr", "n": [ { "c": 1, "d": "Lua byte-string construction", "i": "objectives/command-and-control/backdoor/broad::lua-byte-builder", "o": 2335, "z": 12, "cf": 0.8799999952316284 } ], "ln": 52, "addr": 2326 }, { "b": "wO#2", "ln": 53, "addr": 2355 }, { "b": "", "ln": 54, "addr": 2359 }, { "b": "eIe8iB.LV5aARpdaw3D]z!\u0026]LwPh^lx\u003equ-wPq\u003c7B95Klz!aboc$ak(BZVzmvpB4:j0n3Hx\u003eqg7e]kVsaAIamx\u003c\u003e*(Ds.dux(\u003e^R", "ln": 59, "addr": 2461 }, { "b": "w{503BzkVhawBE$B.LV5uVoC0y\u0026r-)c#T6DB14", "ln": 60, "addr": 2542 }, { "b": "arUGsv{%f@Aaa3dz^^f0jS]7", "n": [ { "c": 1, "d": "Exploit marker indicators", "i": "objectives/privilege-escalation/exploit/vulnerabilities::tunables-exploit-marker", "o": 2581, "z": 7, "cf": 1.0 } ], "ln": 61, "addr": 2573 }, { "b": "arR^HzdN^fvp%d)arR^HjS[VZBAo6KwPI{3xjVcn", "ln": 62, "addr": 2593 }, { "b": "arR^HzdN^fvp%dJD2NsqjS[VZBAo6KwPI{3xjUB(D2NsC", "ln": 63, "addr": 2626 }, { "b": "", "ln": 79, "addr": 3174 }, { "b": "eIea8LZ}+TFfmB3By/uiay]zkvR/QcwoA0tasIboBzk]faAhvjfk$\u0026JBs*fWo^}jALZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[#MLZ}+TFz#/z\u0026/[@", "n": [ { "c": 2, "d": "Contains a box-drawing text banner", "i": "metadata/file/format::box-drawing-banner", "o": 3226, "z": 96, "cf": 0.8999999761581421 } ], "ln": 80, "addr": 3175 }, { "b": "eIe8DxK#67Bzbkdvq{fdw{50ewO=AgoIwe6v{%g\u0026B0bNrA=l8kxDP@^zF782zE:(hwO2y[ayMyiwPxwAB-Ivxv03A$v}wkxu\u0026", "ln": 81, "addr": 3323 }, { "b": "eIe8UwNPaXAX5tPxK@r9y\u0026%x8zyoGFwQ4{gBzkS9ayFR/v}x.5u[U]dwPI*ezGxw%ay/j@B8#5cC{3Q9y\u00261enwn=Q1y?j.$A@", "ln": 82, "addr": 3401 }, { "b": "eIe8VzGGDcBrCpnxjVdax(v(waxi2=B7DFkB-I4oxK#10wPz\u0026mBAIRwawV@/zB3\u0026CCwh8eaz\u003eXhB75Y)B0bgmBz\u0026pzxK}", "n": [ { "c": 1, "d": "AI and vault service names", "i": "metadata/file/catalog/service::ai-vault-service-names", "o": 3524, "z": 6, "cf": 0.8199999928474426 } ], "ln": 83, "addr": 3479 }, { "b": "eIe8^wPz%9AWL]Jx(n37zGE1eo\u003ewx!vp%dVaAIj8AaHduA=k=9aB22Ix(mN1wGUG3zGGDcBs*%rz!0MiaA}KwxDRwrvpB4:", "ln": 84, "addr": 3554 }, { "b": "eIe8VwofpAB8JgyxK@rcwPz%9AV![7A+PYdB0bKrxkRc]B0a[ewftz]woz\u003cjaAz3BB7GlhaztFgBz(hBayYQsu$BH)zGFDXu[I", "ln": 85, "addr": 3631 }, { "b": "arR^HarR^HarUGsv{%f@B8UM9B09Q*vThr{zE^s6twX7W", "ln": 344, "addr": 14696 }, { "b": "arR^HarR^HarU-AvqZc\u003cbxE*jzGu{JatEdAjS]7]B97\u0026hBrAZ?w?FdDvrcDvax{43zE:}%auZ\u0026VtoWS@wfLqgaz\u003eLdyAL+.w?E}eB88[D", "n": [ { "c": 2, "d": "References a Windows .exe filename or extension", "i": "micro-behaviors/fs/path/extension::exe-dup", "o": 14800, "z": 4, "cf": 0.5 } ], "ln": 345, "addr": 14733 }, { "b": "arR^HarR^HwO#2", "ln": 346, "addr": 14818 } ], "depth": 1, "facts": { "imp": [ [ "", "math.randomseed" ], [ "", "os.time" ], [ "", "os.clock" ], [ "", "math.floor" ], [ "", "os.time" ], [ "", "math.floor" ], [ "", "rand" ], [ "", "table.concat" ], [ "", "string.sub" ], [ "", "type" ], [ "", "type" ], [ "", "ipairs" ], [ "", "type" ], [ "", "type" ], [ "", "table.concat" ], [ "", "tostring" ], [ "", "math.floor" ], [ "", "tonumber" ], [ "", "math.floor" ], [ "", "table.concat" ], [ "", "type" ], [ "", "type" ], [ "", "type" ], [ "", "ipairs" ], [ "", "type" ], [ "", "type" ], [ "", "table.concat" ], [ "", "type" ], [ "", "type" ], [ "", "type" ], [ "", "decode_json" ], [ "", "type" ], [ "", "math.floor" ], [ "", "tonumber" ], [ "", "M.derive_event_id" ], [ "", "M.derive_event_id" ], [ "", "ipairs" ], [ "", "type" ], [ "", "tostring" ], [ "", "push" ], [ "", "M.flatten_text" ], [ "", "M.reasoning_text" ], [ "", "push_reasoning" ], [ "", "M.flatten_text" ], [ "", "push" ], [ "", "type" ], [ "", "ipairs" ], [ "", "type" ], [ "", "type" ], [ "", "push" ], [ "", "tool_input_object" ], [ "", "type" ], [ "", "ipairs" ], [ "", "type" ], [ "", "type" ], [ "", "type" ], [ "", "pairs" ], [ "", "type" ], [ "", "ipairs" ], [ "", "type" ], [ "", "table.concat" ], [ "", "table.sort" ], [ "", "ipairs" ], [ "", "type" ], [ "", "tostring" ], [ "", "tostring" ], [ "", "pairs" ], [ "", "type" ], [ "", "ipairs" ], [ "", "type" ], [ "", "pairs" ], [ "", "tostring" ], [ "", "apply_spans_to_text" ], [ "", "M.extract_block" ], [ "", "M.apply_masks" ] ], "mbr": [ "DIRECTION.INPUT", "M.EVENT_INDEX_STRIDE", "M.USER_ID_MAX_LENGTH", "M.apply_masks", "M.build_payload", "M.decide", "M.derive_event_id", "M.direction", "M.extract_block", "M.flatten_text", "M.gen_ulid", "M.reasoning_text", "M.to_intent_messages", "M.to_intent_tools", "a.start", "b.start", "b.thinking", "block.text", "block.type", "f.action", "f.mask", "f.message_index", "f.name", "f.severity", "f.start", "fn.arguments", "fn.description", "fn.name", "fn.parameters", "m.content", "m.reasoning_content", "m.role", "m.thinking_blocks", "m.tool_call_id", "m.tool_calls", "math.floor", "math.random", "math.randomseed", "msg.content", "opts.message_type", "opts.messages", "opts.session_id", "opts.session_information", "opts.source_type", "opts.tools", "opts.user_id", "os.clock", "os.time", "payload.sessionInformation", "payload.tools", "payload.userId", "resp.findings", "resp.messages", "resp.violations_detected", "s.mask", "s.start", "string.sub", "table.concat", "table.sort", "tc.id" ], "tgt": [ "M.apply_masks", "M.derive_event_id", "M.extract_block", "M.flatten_text", "M.reasoning_text", "apply_spans_to_text", "decode_json", "ipairs", "math.floor", "math.randomseed", "os.clock", "os.time", "pairs", "push", "push_reasoning", "rand", "string.sub", "table.concat", "table.sort", "tonumber", "tool_input_object", "tostring", "type" ], "metrics": { "ast": { "op.eq": 32.0, "op.ge": 1.0, "op.gt": 6.0, "op.le": 1.0, "op.lt": 2.0, "op.add": 18.0, "op.div": 2.0, "op.lor": 21.0, "op.mod": 2.0, "op.mul": 5.0, "op.sub": 3.0, "op.land": 29.0, "op.lnot": 2.0, "max_depth": 23.0, "bind_count": 62.0, "call_count": 82.0, "node_count": 3461.0, "member_count": 60.0, "op_density.eq": 0.01, "op_density.ge": 0.0, "op_density.gt": 0.0, "op_density.le": 0.0, "op_density.lt": 0.0, "op_density.add": 0.01, "op_density.div": 0.0, "op_density.lor": 0.01, "op_density.mod": 0.0, "op_density.mul": 0.0, "op_density.sub": 0.0, "op_density.land": 0.01, "op_density.lnot": 0.0, "identifier_count": 128.0, "member_depth_max": 2.0, "string_literal_count": 75.0, "array_literal_max_length": 5.0, "string_concat_chain_max_length": 4.0 }, "file": { "size": 16069.0, "entropy": 4.81, "size_bytes": 16069.0 }, "text": { "digit_ratio": 0.01, "space_count": 3190.0, "total_lines": 388.0, "char_entropy": 4.81, "unique_chars": 98.0, "string_density": 0.19, "avg_line_length": 40.41, "high_byte_ratio": 0.01, "max_line_length": 147.0, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.06, "last_line_length": 8.0, "whitespace_ratio": 0.22, "most_common_ratio": 0.08, "identifier_density": 1.57, "line_length_stddev": 32.5, "normalized_string_count": 3.81, "repeated_char_sequences": 27.0, "most_common_char_is_null": 0.0, "suspicious_comment_ratio": 0.15, "max_inline_whitespace_run": 15.0, "most_common_char_codepoint": 101.0, "suspicious_identifier_ratio": 0.07, "normalized_unique_identifiers": 14.88 }, "binds": { "count": 62.0 }, "calls": { "count": 82.0 }, "binary": { "overall_entropy": 4.81, "peak_region_bytes": 14021.0, "peak_region_entropy": 4.97 }, "source": { "function_count": 15.0 }, "members": { "count": 60.0 }, "strings": { "total": 75.0, "avg_length": 4.97, "max_length": 32.0, "avg_entropy": 2.17, "empty_count": 10.0, "total_bytes": 373.0, "entropy_stddev": 0.79 }, "comments": { "chars": 7235.0, "lines": 91.0, "total": 93.0, "to_code_ratio": 0.31, "empty_comments": 2.0, "base64_in_comments": 2.0, "high_entropy_comments": 12.0 }, "functions": { "count": 15.0 }, "identifiers": { "count": 128.0, "total": 611.0, "avg_length": 7.36, "max_length": 19.0, "min_length": 1.0, "avg_entropy": 2.28, "reuse_ratio": 0.21, "unique_count": 128.0, "length_stddev": 4.52, "sequential_names": 9.0, "single_char_count": 10.0, "single_char_ratio": 0.08, "high_entropy_count": 3.0, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.89, "all_uppercase_ratio": 0.06, "underscore_prefix_count": 1.0 } } }, "id": 4, "path": "/data/samples/unknown/foraged/lua/luarocks.org/_/ai-lasso-guardrail/ai-lasso-guardrail-1.0.0-1.src.rock!!kong-ai-lasso-guardrail/kong/plugins/ai-lasso-guardrail/lasso.lua", "pid": 0, "risk": 1, "sha": "b771ae9bc253dea82aa52313a76b29dd3bac806ccd3b86841dd6d364833a01ff", "size": 16069, "traits": [ { "id": "metadata/file/format::box-drawing-banner", "conf": 0.8999999761581421, "crit": 2, "desc": "Contains a box-drawing text banner", "spans": [ [ 3226, 96 ] ] }, { "id": "metadata/file/metrics::low-overall-entropy-source", "conf": 0.8999999761581421, "crit": 2, "desc": "Source file has low overall entropy", "spans": [ [ 0, 29 ] ] }, { "id": "metadata/file/profile/identity::sequential-identifiers", "conf": 0.800000011920929, "crit": 2, "desc": "Sequential source identifier names", "spans": [ [ 0, 35 ] ] } ], "type": "lua" }, { "id": 5, "sha": "f6a7744cabf01c5594bccc8295db4c7ae92e99ce61873e9ad5ef1102c53acb98", "path": "/data/samples/unknown/foraged/lua/luarocks.org/_/ai-lasso-guardrail/ai-lasso-guardrail-1.0.0-1.src.rock!!kong-ai-lasso-guardrail/kong/plugins/ai-lasso-guardrail/schema.lua", "risk": 1, "size": 4090, "type": "lua", "depth": 1 }, { "id": 6, "mol": "H(Cm)", "sha": "ddc1c0a3a4c1bffe3448574d4c0674abd656fb182f0707e3b7d042e08493cabc", "path": "/data/samples/unknown/foraged/lua/luarocks.org/_/ai-lasso-guardrail/ai-lasso-guardrail-1.0.0-1.src.rock!!kong-ai-lasso-guardrail/kong/plugins/ai-lasso-guardrail/client.lua", "risk": 1, "size": 1583, "type": "lua", "depth": 1 }, { "id": 7, "sha": "a0711f8aadf0b2b9a6be7a7760da5dda45911f94ab4a244c17978fab52be4693", "path": "/data/samples/unknown/foraged/lua/luarocks.org/_/ai-lasso-guardrail/ai-lasso-guardrail-1.0.0-1.src.rock!!kong-ai-lasso-guardrail/README.md", "risk": 1, "size": 6473, "type": "markdown", "depth": 1 }, { "id": 8, "sha": "cc21ec559251c9abe2e556c10aed62d347b858a4253596cb51173d0ac658387c", "path": "/data/samples/unknown/foraged/lua/luarocks.org/_/ai-lasso-guardrail/ai-lasso-guardrail-1.0.0-1.src.rock!!kong-ai-lasso-guardrail/.github/workflows/release.yml", "risk": 1, "size": 540, "type": "github_actions", "depth": 1 }, { "ctx": [ { "b": "boP)bzGu}eBrAm%iXSlgnPO]XwO-Ghx(dA7c@\u003ckld(eQ%wP?T9C{34dzE^g33lQEnz/PS9y\u0026sJ8wnca7vru0)iTMj9zGX5FarTMJp!%a{bZT\u003eXxk8E3BZ=$zwPhNex([olC{4J-3jpJ^vSKNqarUSzePV5KzddEgiTM#LarUYEzGvyFzAn[.vS=NgBUdArBy/Jn3lQDlaAg[jze16jx(v)giTM#LarR^Hv@DmbwO#QhiV@S!x()[[arR^HarUxeeP+]DwO%KKCxdztwEoL5arU-EwPhYK3lQDlarR^Uaz$R8wJy@3xK$W?z/{dAA+fidB7]-mA^n0marR^HarR!HB7GzNayO=4x(v)gfjOWbv@319Bu\u003e1c3lQDlapoklarR^HeG!}tzdL:Jm}DNHA::63av*c/noFw:l2Z==Bz\u003e@azvdHeao", "ln": 79, "col": 26, "line": 5 }, { "b": "arR^HarR^HCwhejiTM#LarR^HarR^Hvq{f)x\u003efmEbZT\u003eXB7F\u003c4wPR#ClRgSLoIXzLuQvK/uQmH+uR9TdEshCBarR^HarR^HaAhvnC42G7uU:j#iV]X{DMWxvv@=d5B1P*KuQEH.pdnIRpGgW!p/7H}qB%[Pr7gd!moG", "ln": 489, "col": 1, "line": 24 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2107, "entropy": 4.72 }, "binary": { "peak_region_bytes": 2107, "peak_region_entropy": 4.73 }, "references": { "declared_count": 1, "unresolved_count": 0 } } }, "id": 9, "mol": "Md(Bk₃)", "path": "/data/samples/unknown/foraged/lua/luarocks.org/_/ai-lasso-guardrail/ai-lasso-guardrail-1.0.0-1.src.rock!!kong-ai-lasso-guardrail/.github/workflows/scan-dependabot-open-pr.yml", "pid": 0, "refs": [ { "to": "pkg:github/actions/checkout@v6", "off": 356, "kind": "dependency" }, { "to": "pkg:github/tibdex/github-app-token@v2", "off": 462, "kind": "dependency" }, { "to": "pkg:github/slackapi/slack-github-action@v2.1.1", "off": 1443, "kind": "dependency" }, { "to": "pkg:github/lasso-security/github-action@notify-failure-1.0.3", "off": 1816, "kind": "dependency" } ], "risk": 1, "sha": "019b7018d4d9bf125c71602072cd24f221eeec3d14229e7d6d2c06cb3610cacb", "size": 2107, "traits": [ { "id": "metadata/build/ci/permission::id-token-write-permission", "conf": 0.9, "crit": 3, "desc": "GitHub Actions OIDC write permission", "spans": [ [ 274, 22 ] ] }, { "id": "metadata/build/ci/permission::job-contents-write-permission", "conf": 0.92, "crit": 3, "desc": "Job grants contents write permission" }, { "id": "metadata/build/ci/secret::action-secret-input", "conf": 0.95, "crit": 3, "desc": "Action input references workflow secret" }, { "id": "metadata/build/ci/trigger::scheduled-workflow-trigger", "conf": 0.9, "crit": 3, "desc": "GitHub scheduled workflow trigger" } ], "type": "github_actions" }, { "ctx": [ { "b": "zEEx[iV{.8wPz(nz/cW=wPhi#wmn}=BrByT3jpY?iTM#LAck#kuVGZ$B.bSouVYZ%xjVfC3lQDlaAR)FwPG)Ptw[E(zE)ufaAz4iAaJ]#wl/JHAaK6bx(!ufz/fRS3lQE3z/fVdzGG}XaA}\u003cuBy+!4aAhEty+oWsADL\u0026lBAoF=CxdztwGRr!yhWN5iTM#LzF%Shw{DAAarR^Hx\u003exyGxk8E3BZ=$iv@#Tfau.\u003eg", "ln": 0, "col": 1, "line": 1 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 449, "entropy": 4.73 }, "binary": { "peak_region_bytes": 449, "peak_region_entropy": 4.73 }, "references": { "declared_count": 1, "unresolved_count": 0 } } }, "id": 10, "mol": "Md(Bk₄)", "path": "/data/samples/unknown/foraged/lua/luarocks.org/_/ai-lasso-guardrail/ai-lasso-guardrail-1.0.0-1.src.rock!!kong-ai-lasso-guardrail/.github/workflows/notify-dependabot-pr.yml", "pid": 0, "refs": [ { "to": "pkg:github/lasso-security/github-action@dependabot-new-pr-alert-1.0.1", "off": 291, "kind": "dependency" } ], "risk": 1, "sha": "335580a1a40bde728fc06489ebb7d3f21a788c31635341606a86e64d36924fa5", "size": 449, "traits": [ { "id": "metadata/build/ci/gate::dependabot-actor-gate", "conf": 0.95, "crit": 3, "desc": "PR target job restricted to Dependabot" }, { "id": "metadata/build/ci/permission::contents-write-permission", "conf": 0.92, "crit": 3, "desc": "GitHub Actions contents write permission" }, { "id": "metadata/build/ci/secret::action-secret-input", "conf": 0.95, "crit": 3, "desc": "Action input references workflow secret" }, { "id": "metadata/build/ci/trigger::pull-request-target-trigger", "conf": 0.9, "crit": 3, "desc": "GitHub pull_request_target workflow trigger", "spans": [ [ 33, 23 ] ] } ], "type": "github_actions" }, { "ctx": [ { "b": "w[u6]xF0+aAcb+OatscBarR^HarR^HaARKqwO%KKbZT\u003eXB7F\u003c4wPR#CoHhPQpF:$%p/QB+aBOUBarR^HarR1larR^Hat1ZUB7GzNayPefxMw3gx\u003e8iqv@bN@wmWu5z!9AhB7F\u003c7A+PSvePLACx\u003eqGNzddb", "ln": 296, "col": 11, "line": 18 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 568, "entropy": 4.59 }, "binary": { "peak_region_bytes": 568, "peak_region_entropy": 4.59 }, "references": { "declared_count": 1, "unresolved_count": 0 } } }, "id": 11, "mol": "Md(Bk₂)", "path": "/data/samples/unknown/foraged/lua/luarocks.org/_/ai-lasso-guardrail/ai-lasso-guardrail-1.0.0-1.src.rock!!kong-ai-lasso-guardrail/.github/workflows/pr-checks.yml", "pid": 0, "refs": [ { "to": "pkg:github/actions/checkout@v6", "off": 252, "kind": "dependency" }, { "to": "pkg:github/anthropics/claude-code-security-review@main", "off": 377, "kind": "dependency" } ], "risk": 1, "sha": "9e519efed335776425cee6b14fe65c3a4ba8ffe17cac0ab4bc68ba026f1392b1", "size": 568, "traits": [ { "id": "metadata/build/ci/secret::action-secret-input", "conf": 0.95, "crit": 3, "desc": "Action input references workflow secret" }, { "id": "metadata/build/ci/secret::step-token-input-secret-reference", "conf": 0.95, "crit": 3, "desc": "Step token input references an Actions secret" }, { "id": "metadata/build/ci/step::mutable-main-action-ref", "conf": 0.88, "crit": 3, "desc": "Workflow action uses mutable main ref" } ], "type": "github_actions" }, { "id": 12, "sha": "0264c0be51bf63f5d2ea93779ca057d68bdd5c2f262c47e0c7bfeac5f0a6a336", "path": "/data/samples/unknown/foraged/lua/luarocks.org/_/ai-lasso-guardrail/ai-lasso-guardrail-1.0.0-1.src.rock!!kong-ai-lasso-guardrail/.github/workflows/ci.yml", "risk": 1, "size": 706, "type": "github_actions", "depth": 1 }, { "ctx": [ { "b": "a%Fj9z!0M9B7GxnwPw]9z/M$xxK@qVz/fhgwIN*TaAIamC4C.qlqHMKaARpdawui+B8Jghy*?yax\u003ezSkk#pb}vqYP#vixe\u003cyH[RZoIDTLAc3bwwNPBd3jojtwn(E3zGG}X3lQD/pG7jnfk1ZnwP}NdflPc8v@bN{B7]liarR^HarR^HeJ$q7wmY.5BzkrcefFLszE^E0xlbQDC4\u003e\u003c", "ln": 0, "col": 1, "line": 1 }, { "b": "B8#5cx)p:yarR^Hat2=1vpBd#wGSGCzddH3wN({2wPI{3xjVc*t{7TuB8UM9aA7\u003e7B7GDm3lQD/pG7jnflP66v}Yp)fjO{qAbo9cx(v)garR^HarR^HeJ$p*v}Y^(B0bNrwGV28v}xv$wN({5A=k/lBrCpnBz\u0026pzxK@q@z/6DfwPRT8zvdHearR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^HarR^Hd06qHA+flkwPI@BzddH3x(mMax(+zux(^#$y?j-1", "ln": 207, "col": 23, "line": 5 }, { "b": "B8$=5wGV8aCYUw}awt71q+{:!oIX2GefERLq=uF0o*IYJe^-^Da{@43AbP=sazL$ozvg8{AbP=saAz32w].*bazt\u003esA4ViyA=#2mazCXiz/P}xlsB}Dnk@L+qE%\u0026\u003cwPI@:vqYQ(wPxsAra{q-vpT7\u0026xgM03p/y}CC4CX33pNVPnLyl\u0026aAz3Cv@Dj6x(4ueAW1Z)Cp\u003ex$t}nfAtZ4=9d{KYhtZ4!Lt}m9F3jmbJwO96bwQ5r7z!pzbz!abxiTM#LarUSiA==vBjS)%m3lQDlazbLjaz\u0026lnzxJzbwo/!uwPPsAzdN^fvp%d)a$jTMAV!N(iTM#LarR^HarUepjS[O]xjVfkb4CLeBy/uia$i\u003cwarR^HarR!vw/$/ex(n0lvqYN^c$s!JB98BKiTM#LarR^HarQ", "ln": 642, "col": 47, "line": 11 }, { "b": "b5H[jB75Y)uUKy*wQ2yWattt?b5Q?awG\u003ceTb5?lued9HxarR^HarR^HarR^HarR^HarR^HarR^HarR^JvpKy[z/c:War\u003ccCpEv=0efDcTwP?T9x([RAiV]RqnK(q}Eo?mL3lQDlarR^HarR^HarR^Har\u003e#yz!@\u003c7x(v)guU0.\u0026", "ln": 1278, "col": 45, "line": 34 }, { "b": "3lQDlay]4}ayxh3zE+epwO+%fay/t2wH[%xvRNtM3lQDlarR^Hay[]5vivYQyiarhe[x9wAc0BCvRNtAwO#0@wmWer3lQDlarR^HaAIagw?FdozE^9{wPI*ezGxwqv@C)?dgdguarR^HarU-py?tqvwO#3=xK$Q.wPxgylVl\u003c:wO#Pwrc-B]a$K\u0026Xvq{g4x\u003e7N[x(v(xyiarha$i\u003cwarR^HarR!FwO+%hB7Gl1uUB1VwmY^fb13o^By/uieLG.[xlm/hefG1QAWU:nzyx47ByuQEdgdguarR^HarU-py?tqhzE^9/wNPaXA=SST3lQDlarR^HaAIagw?Fptx(4ukCxdztwHI7$ByuQ93lQDlay]4}ay]y$p!$1?d05%ow*]+FarR^HarR^HzxI7+x(n2vB7Gf1e[!*8wmY!5e[X:qc)z2%zGGDcBs*f$zFa68a$jTMAV^4+3lQDlarR^HaARTHiTM#LarR^HarR^HarUciwo/pXazL$ozz2:zvpTBcB7Gf1e]\u003eMry?kktwNP9$zyDYDAV!*nDWN7!3lQDlarR^Haz2!cwPh-lyiarhe\u003eP5rpdeV6z!9AFA=M8siTM#LarR^HarR^HarUciwo/pXaBwIzarR^HarR^HA3dp^B7Gf1e]UlvxBk\u003e8arR^HarUxgaAeDqzxHtKfk1ZnwP}NdflPc8v@bM", "ln": 2496, "col": 1, "line": 62 }, { "b": "3lQDlarR^HarR^HarR^HarR^MasHYqwo/!uwPPsAB7GAlx(v(XwfJDNasHYqwo/!uwPPsAB8Mhwv}u\u0026kaA8oyDWNs}xjVfkb6n9HwG\u0026MO3lQDlarR^HarR^HarR^HarR^Hao", "ln": 3228, "col": 62, "line": 80 }, { "b": "wgfn*g+o+@b4U!nz/N3.ar\u003eYwBrCglB-7.lEjkHg3tB8{uTEXVzdN6Yau.\u003egb41X]vqfQ^uM}JrarR^Hra{q-vpT7\u0026xgM03p/y}CC4CXxc)yt$fFk4ifD@4\u003ci50rCdj=Pjdk2WMA=#23w]zZ3C4CXxdgc", "ln": 3985, "col": 25, "line": 92 } ], "depth": 1, "facts": { "imp": [ [ "", "re.compile" ], [ "", "body.get" ], [ "", "m.get" ], [ "", "isinstance" ], [ "", "parts.append" ], [ "", "isinstance" ], [ "", "b.get" ], [ "", "isinstance" ], [ "", "\" \".join" ], [ "", "EMAIL.search" ], [ "", "body[\"findings\"][\"pattern-detection\"][0].update" ], [ "", "m.start" ], [ "", "m.end" ], [ "", "m.start" ], [ "", "m.end" ], [ "", "json.dumps(obj).encode" ], [ "", "json.dumps" ], [ "", "self.send_response" ], [ "", "self.send_header" ], [ "", "self.send_header" ], [ "", "str" ], [ "", "len" ], [ "", "self.end_headers" ], [ "", "self.wfile.write" ], [ "", "int" ], [ "", "self.headers.get" ], [ "", "json.loads" ], [ "", "self.rfile.read" ], [ "", "print" ], [ "", "body.get" ], [ "", "(body.get(\"source\") or {}).get" ], [ "", "body.get" ], [ "", "body.get" ], [ "", "self._send" ], [ "", "classify" ], [ "", "text_of" ], [ "", "self._send" ], [ "", "classify" ], [ "", "text_of" ], [ "", "self._send" ], [ "", "completion" ], [ "", "text_of" ], [ "", "self._send" ], [ "", "completion" ], [ "", "self._send" ], [ "", "ThreadingHTTPServer((\"0.0.0.0\", 8080), H).serve_forever" ], [ "", "ThreadingHTTPServer" ], [ "", "BaseHTTPRequestHandler" ], [ "", "ThreadingHTTPServer" ], [ "", "http.server" ], [ "", "json" ], [ "", "re" ] ], "mbr": [ "EMAIL.search", "ThreadingHTTPServer().serve_forever", "b.get", "body.findings", "body.get", "body.messages", "json.JSONDecodeError", "json.dumps", "json.dumps().encode", "json.loads", "m.end", "m.get", "m.start", "parts.append", "re.compile", "self._send", "self.end_headers", "self.headers", "self.headers.get", "self.path", "self.rfile", "self.rfile.read", "self.send_header", "self.send_response", "self.wfile", "self.wfile.write" ], "tgt": [ "EMAIL.search", "ThreadingHTTPServer", "ThreadingHTTPServer().serve_forever", "b.get", "body.get", "classify", "completion", "int", "isinstance", "json.dumps", "json.dumps().encode", "json.loads", "len", "m.end", "m.get", "m.start", "parts.append", "print", "re.compile", "self._send", "self.end_headers", "self.headers.get", "self.rfile.read", "self.send_header", "self.send_response", "self.wfile.write", "str", "text_of" ], "funcs": [ [ "text_of", 825 ], [ "classify", 1126 ], [ "completion", 2185 ], [ "log_message", 2456 ], [ "_send", 2501 ], [ "do_POST", 2785 ] ], "metrics": { "ast": { "op.add": 4, "op.lor": 4, "op.mod": 1, "max_depth": 20, "call_count": 47, "node_count": 1225, "member_count": 26, "max_array_len": 3, "op_density.add": 0, "op_density.lor": 0, "op_density.mod": 0, "max_concat_chain": 3, "member_depth_max": 3 }, "file": { "size": 4107, "entropy": 4.72 }, "text": { "lines": 96, "top_char": 101, "max_ws_run": 8, "digit_ratio": 0.02, "space_count": 1054, "char_entropy": 4.72, "unique_chars": 80, "top_char_null": 0, "string_density": 0.84, "top_char_ratio": 0.07, "avg_line_length": 41.78, "max_line_length": 101, "non_ascii_ratio": 0, "empty_line_ratio": 0.16, "last_line_length": 61, "whitespace_ratio": 0.28, "identifier_density": 1.63, "line_length_stddev": 29.56, "normalized_string_count": 8.27, "repeated_char_sequences": 29, "suspicious_identifier_ratio": 0.12, "normalized_unique_identifiers": 9.11 }, "binds": { "count": 12 }, "binary": { "peak_region_bytes": 4096, "peak_region_entropy": 4.76 }, "source": { "class_count": 1, "function_count": 6 }, "imports": { "count": 5, "stdlib_count": 3, "stdlib_ratio": 0.6, "third_party_count": 2, "third_party_ratio": 0.4 }, "strings": { "bytes": 1516, "count": 81, "ip_count": 1, "avg_length": 18.72, "max_length": 681, "path_count": 6, "avg_entropy": 2.62, "email_count": 2, "empty_count": 1, "entropy_stddev": 0.82 }, "comments": { "chars": 145, "count": 2, "lines": 2, "to_code_ratio": 0.02 }, "functions": { "count": 7, "density": 6.25, "avg_params": 1.67, "code_ratio": 0.67, "max_params": 3, "length_stddev": 7.65, "avg_name_length": 8, "avg_length_lines": 10.67, "max_length_lines": 22, "min_length_lines": 2, "single_char_params": 1, "avg_param_name_length": 4.2 }, "identifiers": { "count": 156, "unique": 60, "avg_length": 5.88, "max_length": 22, "min_length": 1, "avg_entropy": 2.01, "reuse_ratio": 0.38, "length_stddev": 4.14, "sequential_names": 7, "single_char_count": 7, "single_char_ratio": 0.12, "high_entropy_count": 1, "high_entropy_ratio": 0.02, "all_lowercase_ratio": 0.9, "all_uppercase_ratio": 0.03, "double_underscore_count": 1, "underscore_prefix_count": 2 } } }, "id": 13, "mol": "H₂(Cm₆Db)", "path": "/data/samples/unknown/foraged/lua/luarocks.org/_/ai-lasso-guardrail/ai-lasso-guardrail-1.0.0-1.src.rock!!kong-ai-lasso-guardrail/dev/mock.py", "pid": 0, "risk": 3, "sha": "496d00a1c24a5722830178d9ded963561a484f59baf3537100c5a9f35c7f8a75", "size": 4107, "traits": [ { "id": "metadata/file/profile/language::lang-english--atom-1", "conf": 0.8, "crit": 2, "desc": "English function-word token \"the\"", "spans": [ [ 19, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-2", "conf": 0.8, "crit": 2, "desc": "English function-word token \"and\"", "spans": [ [ 68, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-5", "conf": 0.8, "crit": 2, "desc": "English function-word token \"for\"", "spans": [ [ 15, 0 ] ] }, { "id": "micro-behaviors/communications/http/header/content-length::python-content-length-header", "atk": "T1071.001", "mbc": "C0002", "conf": 0.9, "crit": 3, "desc": "Python HTTP Content-Length header", "spans": [ [ 2689, 14 ] ] }, { "id": "micro-behaviors/communications/http/llm::llm-chat-completions-path", "atk": "T1071.001", "conf": 0.76, "crit": 3, "desc": "OpenAI-compatible chat completions path", "spans": [ [ 271, 20 ] ] }, { "id": "micro-behaviors/communications/http/server/request::python-http-file-response", "conf": 0.86, "crit": 3, "desc": "Writes file response from HTTP handler", "spans": [ [ 2757, 16 ] ] }, { "id": "micro-behaviors/communications/http/server/request::python-http-request-body-read", "conf": 0.9, "crit": 3, "desc": "Reads raw Python HTTP request body", "spans": [ [ 2904, 15 ] ] }, { "id": "micro-behaviors/communications/socket/bind/address::python-http-server-all-interfaces", "conf": 0.88, "crit": 3, "desc": "Python HTTP server binds all interfaces", "spans": [ [ 4049, 30 ] ] }, { "id": "micro-behaviors/fs/read/file::file-read-content", "atk": "T1005", "mbc": "E1005", "conf": 0.6, "crit": 2, "desc": "Reads file content (Python)", "spans": [ [ 2914, 0 ] ] }, { "id": "micro-behaviors/communications/http/header/content-type::json-header", "conf": 0.9, "crit": 3, "desc": "References HTTP Content-Type application/json", "spans": [ [ 2628, 32 ] ] }, { "id": "micro-behaviors/communications/http/server/framework::http-server-import", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Imports from Python's http.server module", "spans": [ [ 706, 23 ] ] }, { "id": "micro-behaviors/data/serialize/json::json-loads-call", "conf": 0.9, "crit": 3, "desc": "Parses JSON data with Python", "spans": [ [ 2893, 10 ] ] }, { "id": "micro-behaviors/communications/http/server/framework::builtin-http-server", "atk": "T1071.001", "mbc": "C0002", "conf": 1.0, "crit": 2, "desc": "Built-in Python HTTP server modules", "spans": [ [ 706, 0 ] ] }, { "id": "micro-behaviors/communications/http/server/framework::server-python", "atk": "T1071.001", "mbc": "C0002", "conf": 0.75, "crit": 3, "desc": "Python HTTP server", "spans": [ [ 706, 23 ] ] } ], "type": "python" } ], "omitted_files": 5, "rev": "1e08b", "v": "8" } }