{ "ml": { "v": "7", "eng": "2.2.0-beta.2", "lvl": -1, "conf": 0, "mods": [ { "cls": 0, "raw": 0.82190573, "rte": "az", "prob": 0.82190573 }, { "cls": 0, "raw": 0.00022223592, "rte": "az/zip", "prob": 0.00022223592 } ], "prob": 0.82190573, "files": [ { "id": 0, "lvl": -1, "conf": 0, "prob": 0.8219057321548462, "type": "zip" }, { "id": 1, "lvl": -1, "conf": 0, "prob": 0.008203089237213135, "type": "markdown" }, { "id": 2, "lvl": -1, "conf": 0, "prob": 0.005069851875305176, "type": "text" }, { "id": 3, "lvl": -1, "conf": 0, "prob": 0.04189831018447876, "type": "markdown" }, { "id": 4, "lvl": -1, "conf": 0, "prob": 0.0076904296875, "type": "markdown" }, { "id": 5, "lvl": -1, "conf": 0, "prob": 0.012521535158157349, "type": "markdown" }, { "id": 6, "lvl": -1, "conf": 0, "prob": 0.00006219744682312012, "type": "json" } ], "version": "v18.18", "analyzed_at": "2026-06-30T11:58:17Z" }, "path": "contentstudio-1.0.9.zip", "raw": { "files": [ { "id": 0, "ctx": [ { "b": "p!H([6Awak2MK\u00268aPQpEH55W{007^\u0026000Ac002wSk#6{soIXehzdFSd?bkgL7qw9[Sfi5", "n": [ { "c": 2, "d": "Zip archive path", "i": "metadata/package/files/included::zip-archive-path", "o": 0, "z": 23, "cf": 0.949999988079071 } ], "ln": 0 } ], "mol": "O(Er)H(F)", "sha": "c6901c4459413837abe0f8830a981c318351693a882735a158802ecb6f6bc501", "path": "/data/samples/unknown/foraged/openclaw/clawhub.ai/_/contentstudio/contentstudio-1.0.9.zip", "risk": 2, "size": 20735, "type": "zip", "facts": { "metrics": { "file": { "size": 20735.0, "entropy": 7.97, "size_bytes": 20735.0 }, "binary": { "overall_entropy": 7.97, "peak_region_bytes": 20480.0, "peak_region_entropy": 7.82 }, "archive": { "file_count": 6.0, "member_count": 6.0, "script_count": 0.0, "zip_bomb_ratio": 3.15, "directory_count": 0.0, "executable_count": 0.0, "extra_field_size": 0.0, "noise_file_count": 0.0, "total_compressed": 20139.0, "compression.ratio": 0.37, "hidden_file_count": 0.0, "total_uncompressed": 54721.0, "crc_collision_count": 0.0, "entry_comment_count": 0.0, "max_filename_length": 13.0, "rtlo_filename_count": 0.0, "format.regular_count": 6.0, "nested_archive_count": 0.0, "path_traversal_count": 0.0, "symlink_escape_count": 0.0, "security.setgid_count": 0.0, "security.setuid_count": 0.0, "security.sticky_count": 0.0, "double_extension_count": 0.0, "duplicate_member_count": 0.0, "security.symlink_count": 0.0, "unicode_filename_count": 0.0, "homoglyph_filename_count": 0.0, "security.encrypted_count": 0.0, "timing.mtime_unique_count": 1.0, "timing.mtime_unique_ratio": 0.17, "misplaced_executable_count": 0.0, "timing.mtime_dominant_count": 6.0, "timing.mtime_spread_seconds": 0.0, "timing.sentinel_mtime_count": 0.0, "security.world_writable_count": 0.0, "timing.mtime_dominant_fraction": 1.0, "compression.method_counts.deflate": 6.0 } } }, "traits": [ { "id": "metadata/package/config::agent-skill-md-basename", "conf": 0.949999988079071, "crit": 1, "desc": "Agent skill markdown file name", "from": [ { "file": 5 } ] }, { "id": "objectives/evasion/security-bypass/llm/target::llm-agent-target", "conf": 0.8399999737739563, "crit": 3, "desc": "LLM or AI-agent context phrase", "from": [ { "file": 3 } ] }, { "id": "metadata/package/config::agent-skill-frontmatter-fields", "conf": 0.8600000143051147, "crit": 1, "desc": "Agent skill frontmatter fields", "from": [ { "file": 5 } ] }, { "id": "micro-behaviors/fs/path/application/config::claude-config-directory", "conf": 0.8999999761581421, "crit": 3, "desc": "Claude Code config directory path", "from": [ { "file": 3 } ] } ] }, { "ctx": [ { "b": "boPu!vqYZ?y\u0026r}", "ln": 1, "addr": 0 }, { "b": "", "ln": 2, "addr": 12 }, { "b": "bo[r=e?![raMv{oayO!\u003eaxi2{wNPa\u003cefE]mzdms4efFwswfsiPB.bSfC{4iEaARpdaAIsjy?$k8wPIv4x(Ffdz/b", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 47, "z": 3, "cf": 0.800000011920929 } ], "ln": 3, "addr": 13 }, { "b": "", "ln": 4, "addr": 84 }, { "b": "eG^$+nLz/gzdCWIBzbkdu$r?\u0026v@=p5BzkVhu)6u9CoyZoB98ECra{q-vpTBgaxiG2vR*6oayPd#avo)!wPITjayP88zFa38wmV)9xK@q$CXIkvx(mMaAbn%8w]zZbB1OOmxK@qNoI3vny\u0026T8}wo/qsB-qqrA==vBv@Dm5wN/*@zF78lxK#l@asHSav}fC1zGG}Xv@Dm5wN/*8BzbYavpTB!efFtev}fC1zGG}Xv@Dm5wN/*8BAICfy\u0026S]mayFR/v@DHcBAoGKwmNo3y\u0026%rgyK6qpefFzABrCWswGU]ewI4.jzE\u003c@iB.$#7A^n^vvpQG\u003eA+PccwN(](zE:(dzFTOvvpTK)A==2pwN({9xK@r8A+Pf2zEEu7xK$Q.y?W=#aAIaoe=", "ln": 5, "addr": 85 }, { "b": "", "ln": 9, "addr": 589 }, { "b": "eG^$+nLz/gzdCWIBzbkdl3mo.wO#Q7v{%E[z/cXswN/*@z/cXnz*9smz!0{bwO#QhasX\u003c.Cw!@XayPzmxDRn5Bzb.r\u0026^^mou$1h1xGx%Fxk8laeIgyIx!saiD0?:yx(n37A:-E1x)a5say/tcw[+)2w[=6)diJ5pwftn\u003eCYmOwBrA}Dpe\u003cUSr8V:@l}HfYk#pcWogq#\u003easH]mvpTg=B8@DSayO[]zGE1wB-8qnzdN=taz2ClaA?gldj#-xxK@q$zGWdCvr9GjvqxB}aAhvjv}xgZzEWl2z*2YjaARpday/tcw[+)2w[=6)e=", "ln": 10, "addr": 590 }, { "b": "eG^t\u0026wmYo]vixk{vpTg=B8@{zwPhE7D2mbgBrCEtBy^GQvixS8wO=f9u$BO4z/P@cay]z4B0bvsBrCKlA=U@oBrCWzayMylwPz%dv}u^4A=kD0B8%z=B7GCou{^Z+r7fLYq=D:+nL-XVp!t1!moK1vC4\u003ewcB9R?GwO\u003e%2u}1%Rx(XcfzdNQbjZY{Jmq^o.A=k\u0026jwO#PVx(4uzu[rA*z!0M]AV!:wwNE5iwPRAmefG4FwO@ShwPI%4A=-]RqGV(0x(dB5aARp9BrCj8By=OkzxJtcwPq\u003cbA+fqAwO#W0asH!Nxd+r5AaJ]Oy*?JpaAITkC{3Njz!0M]wfu2jBzkLlBzbkdC42A9vpB4:azC)tAb]JhwO#Pjx(k5nxK@r9A=kD0B8@EnzGY-mz/fA6zGEG", "n": [ { "c": 1, "d": "OpenClaw product name marker", "i": "well-known/app/openclaw::openclaw-product-name", "o": 1083, "z": 8, "cf": 0.8999999761581421 } ], "ln": 11, "addr": 840 }, { "b": "eG^@5B8L(rwPF#5ay]z2B1.xwBywY*Byuqex(!c1ByO#BaARpdazbUjzGG-7BAz8mayP8bwNPa{ay]4[y*?u}wfto2wPq\u003cbA+fqAwO#VLavw}1r7fLYq=D:+nL-XVp!t1!moK1HayYFnaARpdayYn1C{43yy\u003cvdlz!0{bwO#Q3wftn*B-.pTy\u0026r%2zEt1rB8Jf%AaJ]Oy*?Jgz/xodvruBdB0bWrA+cwfwOc3bvR/%)yH}30Cwhejaz#9ux(n0lA=\u003e(lx(v(iz/cXhz*9sCzY\u003cafBzk/dC{4ixwGUR]By^6", "n": [ { "c": 1, "d": "LLM prompt/instruction marker component", "i": "objectives/evasion/security-bypass/llm/override::llm-instruction-marker", "o": 1364, "z": 11, "cf": 0.7200000286102295 } ], "ln": 12, "addr": 1164 }, { "b": "eG^/bavw*]aAIEzA:@Vjv@C)?ay/7[zF9K4aMv{oaARpdavw*]ayP8bwNPa{aAz44woe(3lR*DRmnu/Xr8(sTpHuy:nNCaVsZSv:A=k!qBzbkdwO#W9A=k\u0026jwO#Pjc$4apv\u003eRtgzF0P}e{8exdj$", "ln": 13, "addr": 1404 }, { "b": "", "ln": 14, "addr": 1523 }, { "b": "l2puWzE[2mv@Dj3vqYQ%aAIWAAbP=sayD=Myiarhu)3\u003emB-.5lx(v)gayP8czY\u003cazAbY-oBrB%yeO5)EePL#Ku[0Y", "ln": 43, "addr": 4060 }, { "b": "", "ln": 44, "addr": 4132 }, { "b": "bo[r=e?![kaMv{oaAg+4x(mv3x(v(izdN/$wmoN*azbLjaveNwvp%d?BAm", "n": [ { "c": 1, "d": "\"ai agent\" identity", "i": "objectives/command-and-control/remote-command/llm/action::llm-agent-identity-ai-agent", "o": 4170, "z": 8, "cf": 0.800000011920929 } ], "ln": 45, "addr": 4133 }, { "b": "", "ln": 46, "addr": 4180 }, { "b": "eG^t}y-)ani=5IKBylk3z/6u1zE^/hzF%.wB9hInvpJ\u003c\u003eoKR%IC4CFjAa9x[zEET3z/cXmwPRu\u003evrt{2c$3LcA=L-eBye#}xjUE4ayGe1A:J=]xjUE4ayGqfByw#[efFtpvrlJ$Aa9x\u003cu[rBdw].*bu[rBdBz\u003eLrayF\u003e\u003eB6\u0026^5A+eScazCZoBzbkdn(FIXaz2ClwO=p7wGUA5ayMylx\u003c$))zF78gw/$F(vrt{=e=", "ln": 47, "addr": 4181 }, { "b": "eG^@5BAhTHz/cX9g+}70ayPd#ayE6KCWIUrx([2hwQ5fjzE)Zcx\u003c\u003e*2vQS+Zz!rPl", "ln": 65, "addr": 5637 }, { "b": "eG=]aaARgoBAnNzvrlH7zF79KFrRg0zFshnc$NBtz/P[Iay/tcw[+)eave*}efEqNnHU=jaAz44y+m}HnGZCSmj[", "ln": 66, "addr": 5690 }, { "b": "eG^$+nLz/gzdB+tayD*iy*?D%wI4\u003eqB.tAafjk]tvqY^\u003ewPI%mazbLjayG8aCP.6yx(4QbayO!\u003eu)5(}wfslQvrD9(avy6TwGU?#A+/ldAbn@)wI9", "n": [ { "c": 1, "d": "\"claude\" identity", "i": "objectives/command-and-control/remote-command/llm/action::llm-agent-identity-claude", "o": 5827, "z": 11, "cf": 0.800000011920929 }, { "c": 1, "d": "OpenClaw ecosystem phrase marker", "i": "well-known/app/openclaw::openclaw-ecosystem-phrase", "o": 5807, "z": 10, "cf": 0.8999999761581421 } ], "ln": 67, "addr": 5761 }, { "b": "", "ln": 68, "addr": 5852 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 5852.0, "entropy": 5.07, "size_bytes": 5852.0 }, "text": { "digit_ratio": 0.01, "space_count": 732.0, "total_lines": 67.0, "char_entropy": 5.07, "unique_chars": 86.0, "lines_over_200": 7.0, "avg_line_length": 86.34, "high_byte_ratio": 0.01, "max_line_length": 338.0, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.27, "last_line_length": 90.0, "whitespace_ratio": 0.14, "most_common_ratio": 0.08, "line_length_stddev": 86.28, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0 }, "binary": { "overall_entropy": 5.07, "peak_region_bytes": 5852.0, "peak_region_entropy": 5.33 } } }, "id": 1, "path": "/data/samples/unknown/foraged/openclaw/clawhub.ai/_/contentstudio/contentstudio-1.0.9.zip!!CHANGELOG.md", "risk": 1, "sha": "0c56ebca20d75ffd83c3202fc4ad8221a7032605757e53b7bd6d677d2e300842", "size": 5852, "traits": [ { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "spans": [ [ 0, 12 ] ] }, { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 12 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 47, 3 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "", "ln": 4, "addr": 46 }, { "b": "p?sV:x(!ufz/cXiB0bdcA+eZ9azk.6zGGD2efFLBwO005w/$O%vrc0(efG4MayPekaAg[jB8L}sz^)/%x(mT5xcpR9v@Dsi", "ln": 5, "addr": 47 }, { "b": "z!pblxLzJgB8LVjCvtJ6ayPd#ayPtjz!0G\u0026By!#9wn+$2zdNQbvruj4zxJL9y?mVgd0fclar\u003c:5w]@l9A+cBzefG4May]4(yY", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 127, "z": 4, "cf": 0.800000011920929 } ], "ln": 6, "addr": 124 }, { "b": "x(k5nxK@q+z!s9nvrb{4Cwhejz/{dAA+frlA+P39x(v(uazC.6y\u0026%o5zF78ox([3bB-X:xx(dNavruj4zxK4mwGV2cxj#yd", "ln": 7, "addr": 202 }, { "b": "Bz\u0026pAB7D)Bv@DsiefF!FwnbU3efF!vA+w@maAhEjy?W%7efFFqB98CpvS=^7efG1RvR/:*wO#N2efFwswg}\u003ewaAIagyY", "ln": 8, "addr": 279 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 1070.0, "entropy": 5.09, "size_bytes": 1070.0 }, "binary": { "overall_entropy": 5.09, "peak_region_bytes": 1024.0, "peak_region_entropy": 5.09 } } }, "id": 2, "path": "/data/samples/unknown/foraged/openclaw/clawhub.ai/_/contentstudio/contentstudio-1.0.9.zip!!LICENSE", "risk": 1, "sha": "8a5af640bbea4af3bcecf04b7dee0d546421c54daf201c1775fc6c55683a0a3c", "size": 1070, "traits": [ { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 127, 4 ] ] } ], "type": "text" }, { "ctx": [ { "b": "boQGmzGGDcBAqLDwnb%lv@b\u0026^3r[VTzG6CnC4CYnx(v({c$)ZAAc15[fkkooe]$YuwO+)#e[]kSzG6CCB$WuzzGGDcBn", "n": [ { "c": 1, "d": "Text, document, or config extension", "i": "metadata/file/extension/identity::doc-or-config-extension", "o": 0, "z": 9, "cf": 1.0 } ], "ln": 0, "col": 1, "line": 1 }, { "b": "wO#QhBAIbdz.kEnx!BEIxdmame?Y)\u0026lQ::GmjwMJdK[2cB97\u0026by-)ecayMylyIvQ3iW#P^u%)wKvrl8?zG6?yB8bGay\u0026Z.cwmM/)z/fVdzGG@wB.2i8x(tUmz/fVdzGG@wB.2i8eN-p6zGDj[u%\u003crGlVl\u003c:wO#P*BAIbdzY?zvnG^2yLPU3SxK$Z%y?j-gz!0G\u0026y+oHnwnbD{AbP/tB1wCJvqYH^wGU\u00263wnbE6ayO+\u0026z/]@tB1wCzz/6u5zGG}JayPd#ayPkdA=lbfy\u0026Z.cv@=HeB08}ZmQY!rvScg2efES2zFJ/]nP374rcJ4#By/FCss+N^zGx]dxl4A$efF8lBYrG)wH[%6x\u003e{W^yB*P8x(n37A+frlefFwswfsxXz!A($avpi(x(mH6B0aq1z!rZ1wHYeLBzbYkB.twgBzbkdtsisDBy/uiq/)d)x(vo9xMOunB2\u003e%cv@DmbwO#QhBAIbdz.t:xdiJOLvR/:*ave*}e^.}+xK@q]v@DmbwO#QhBAIbdz^TXPoI3vCA=lbnwmY*8vix5#zeAZ0wg.RizE\u003c@8zGGDgw)]gXazbLjay]5bwO=p7wPz\u0026mvqYP#k$JhcxjU$5B0bNyay]IbC4z!8avy6+By/uiq/)d)x(tbrz/PSmAa9l/azbUjz6i}lwGV8aA=2JdvqE7CFrRf$v}YB:B.\u003e=fxcqeiB98EOaA.Ttz^^f\u003czF78ewN]H-efF!rzEEf(zF782AbY\u0026oC42idefFwswftr6wncd1zF782", "n": [ { "c": 3, "d": "References multiple AI assistant products", "i": "micro-behaviors/data/llm::agent-identity-set", "o": 656, "z": 8, "cf": 0.9 }, { "c": 3, "d": "OpenClaw skill text marker", "i": "well-known/app/ai/openclaw::openclaw-skill-text", "o": 248, "z": 10, "cf": 0.9 }, { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-1", "o": 520, "z": 3, "cf": 0.8 }, { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-2", "o": 389, "z": 3, "cf": 0.8 }, { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-5", "o": 637, "z": 3, "cf": 0.8 }, { "c": 2, "d": "Markdown shell code-fence marker", "i": "metadata/package/documentation::md-docs-shell-code-fence", "o": 240, "z": 7, "cf": 0.9 } ], "ln": 184, "col": 46, "line": 4 }, { "b": "xcqqfwGV55zdK?Qp!q^Pz/{7ywmoK)vSbW}wftA3wPGEh3l{=rs7(\u003e4B-RapBzbxfavw*]3jnvcdK)\u0026bx)a5glVl\u003c:wO#P*BAIbdzY\u0026Ujz/3R9zH3CtwPzuidJ)-3LPTBzB7=Xqv@=p5BAn#QlRe{#l)cC.AaJ\u003c1zE)(uaveNwvp%d?BAnMMlU{gNwmV(Jz!9Agavyo(B8M7IawV@/zBntMwH[@\u003ez!9B7dj=PVibP\u003c.z/PS9y\u0026sJsefFCBB98tqayPzmz/5{8x(v)ge^:fMdK[4?pFJ3JB-.OBBrCglAV!!6wO#QhdK(O2FrRf/C4CYtay/tbzddr)aAIWAAbP=sB0a\u003cxeOYuBzEsN", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-7", "o": 873, "z": 4, "cf": 0.8 }, { "c": 1, "d": "Named LLM agent reference", "i": "micro-behaviors/data/llm::agent-identity", "o": 969, "z": 11, "cf": 1.0 } ], "ln": 825, "col": 247, "line": 13 }, { "b": "asH\u0026uAV^UtayO[]zGG}G3jovpaBd)FaA.:payPdgk$JhcB8#5pByx6easGP[vrD9(avy6TwH[@\u003eB-ILwAX5teAaJ]Oz!9Agavy6TwQ2:Gl3l*SwO#Pvaw1)]avp0QefFICv\u003eGhY", "n": [ { "c": 1, "d": "AI assistant identity reference", "i": "micro-behaviors/data/llm::agent-identity-ai-assistant", "o": 1677, "z": 12, "cf": 0.8 } ], "ln": 1645, "col": 22, "line": 38 }, { "b": "wGT]AnLz/gzdB=6B0b1lz/xVbwftP7Bz\u0026pkvpJ%[vp%d?BshbLB8bGay-)n5A+e:5z/QaCc$L2ze*aLJfd{:JvrD9(flp]yy\u00261eCv@DmbwO#QhBAIbdz.C3ZnLz/gzdE36e^.}gboPo{Bzbl6Bzkk[BzkVh3jo7wBzbl6Bzkk[BzkVhaA.:pB0a[easX\u003cbp!q^BwQb:PazC[rB.b8aw].*baBd)FAV^./zGGDcBw)p7wnb%8wmoK)vSbW}wg!h@bo[AQpJgz\u0026z/cWLiV}*sB-W", "n": [ { "c": 3, "d": "Claude Code skills directory path", "i": "micro-behaviors/fs/path/application/config::claude-skills-directory", "o": 2016, "z": 15, "cf": 0.93 }, { "c": 1, "d": "Names an API, access, or secret key", "i": "objectives/credential-access/theft/keywords::api-key-phrase", "o": 2102, "z": 7, "cf": 0.86 }, { "c": 1, "d": "References an agent skill markdown path", "i": "objectives/supply-chain/trojanized/app/debug-probe::skill-prompt-member", "o": 2044, "z": 9, "cf": 0.92 } ], "ln": 1951, "col": 64, "line": 46 }, { "b": "x\u003efym3l{VHe*9\u00264B95KDxK@rcz!0G\u0026y-)d@v@DHcBAnNmz/fD7v@#o)aARJABzb98aA}:AyJBD6v}u0Sz/fVdzGG@wB.2i8ayO+\u0026z/]@tB2[bKB95JRePtJmBy]Diz6iC0v}xa/z!/W!boO/}avyfXvru66vix93vp\u003cQ7AbP/tasIqtw[raAFrRg2", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-3", "o": 3406, "z": 4, "cf": 0.8 } ], "ln": 3358, "col": 41, "line": 95 }, { "b": "B2[bKB94:%u%\u003crGqE%@)A=b}vvqG:5f!$m4B9hCvz/P@hwft\u0026cvrua1A=2\u003euCwhejaARpdx(Ut7v@Dm5wN/*@z/e{0wPRQ7wmcJdu#GE@Bzb5kayFY1wN]v\u0026Bzkf1B6{Kwz/M$dzdds8vqGs2ayPd#aARpdaz2C3AbPDdBrCWzay!?@y+u54bo[AQ", "n": [ { "c": 2, "d": "Contains common English function words", "i": "metadata/file/profile/language::lang-english--atom-6", "o": 5102, "z": 4, "cf": 0.8 } ], "ln": 5054, "col": 30, "line": 156 }, { "b": "o)E\u003cGz/6ulzFsirav*D\u003cB-nJEtNzO@eIgWNvp%c]xMOunB2\u003e%cwQ4T2Abo8rv@Diqxl4{kA4LNrC4CXDyh^!)u%)vH3rgXIazCX3xjSh=qCniEB0byuBzkVhvqEL63peGAaARpqwN##]z/fD7v@@\u00266z/6u1zE^/hB9hB", "n": [ { "c": 1, "d": "HTTP URL targets an image file", "i": "micro-behaviors/communications/http/url/path::image-file-url", "o": 6369, "z": 35, "cf": 0.85 } ], "ln": 6337, "col": 11, "line": 191 }, { "b": "bo[shAboD3wft-2wnbDV3rq4Yz^^f0vixx8v{%f@w[=6)iTPn5u$9L=xBnl/zGGDcBAqLDwnb%8eIgZUz/cXmwN]H-i^2yTz^^f0eIgNGy?j.wfka{qz.t^zx9@3Ou\u003cWlpAV/7kAbP=sazbUjz6in8az2!twPzV%y-(.QoGAI*u%)CLB7+[\u003cz/fVdzGG@wB.2i8at2fWB8L}szdNl(vleKIy\u0026r-)at2f/A+(\u003eiBAzFyiXJc$CWUDdy?kkez/4doB8$]me]tL:3sEmH3joNFBzkVhvqG+9aAhd9v}u=%zGG!tvixf2y?d9$iTPn5u$9K", "n": [ { "c": 1, "d": "Skill text forwards content to a URL", "i": "objectives/supply-chain/trojanized/app/package::agent-skill-remote-forwarding", "o": 12203, "z": 159, "cf": 0.96 } ], "ln": 12171, "col": 2, "line": 379 }, { "b": "aAIsjy\u00261envpS[R3jo:CwGV28AbM\u003euxLzBbayMy2q+GXQoFgf)u)5(\u003cwO#Qhay!?$azC.mByx04aA}KwxDRkhwGUG3zeAZ0wi769u%)CLB7+[#AcJHDyIvQ3B0a[4wftx2zGGDcBAqLDwnb%@z.CQszGGDcBAqLDwnb%lvp%d?Bp8z-u\u0026", "n": [ { "c": 1, "d": "Agent skill names executable content", "i": "objectives/execution/automation/agent::skill-execute-content", "o": 17819, "z": 45, "cf": 0.9 } ], "ln": 17787, "col": 29, "line": 613 }, { "b": "u\u003cWk=bo[r*e*9D0Ab](uvqE69x(ET1x(mG8\u0026^^movrDWgeN-QqA=lbjaAhmuBAnNpA=k!qvixVjB-RUowftx5wNPX0ATAdYu%)CLB7+[9aUNqszzbEcB7+[WqDlT{mmpG.q:\u003cO\u003e", "n": [ { "c": 1, "d": "Auto-approval safety warning", "i": "metadata/library/ai::auto-approval-ui-warning", "o": 20095, "z": 12, "cf": 0.9 } ], "ln": 20063, "col": 3, "line": 703 }, { "b": "A+eV\u0026vpB4:e^.}Pz/PY6Buf+pu%).\u003cz/f4(DKp(rb4kC8uU:j#b03?\u003cv@(0fe?Ot03lQDnvQTs?uV*y9b03?\u003cxMOunB2\u003e%cvq]{kv@DmbwO#QhBAIbdz.t:xfjw*lflP5]ed8", "n": [ { "c": 1, "d": "API-key field marker for proxy use", "i": "objectives/supply-chain/recon-exfil/agent-skill::proxy-api-key-field", "o": 22248, "z": 10, "cf": 0.96 } ], "ln": 22216, "col": 53, "line": 756 }, { "b": "z7/yqzGGDcBAqLDwnb%@z.CQszGGDcBAqLDwnb%lvp%d?BuQ3-asX\u003cbp!q^xB.Lw$dK)F4jzn?UAc15[fjw*le[n*qBy/uiB98Lnx(tRrz.C:Cx\u003eg^s3n0wIdO\u003e1{zB48\u003caAIHkv\u003e5@?auTsVBz#pZfe3:Mx!A[lzGGDcBAqLDwnb%mx(tUkAa{[mz!0\u0026L3n0wIdNOb(By/uiq/)d)x(tEJiV{K#BAzFyiXJc@z/b", "n": [ { "c": 1, "d": "Skill names a URL destination", "i": "objectives/execution/automation/agent::skill-exfil-destination-url", "o": 30441, "z": 90, "cf": 0.9 } ], "ln": 30409, "col": 33, "line": 922 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 30640.0, "entropy": 5.13, "size_bytes": 30640.0 }, "text": { "digit_ratio": 0.02, "space_count": 5052.0, "total_lines": 929.0, "char_entropy": 5.13, "unique_chars": 113.0, "lines_over_200": 2.0, "ascii_art_lines": 3.0, "avg_line_length": 31.98, "high_byte_ratio": 0.01, "invisible_chars": 1.0, "max_line_length": 281.0, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.21, "last_line_length": 16.0, "long_token_count": 1.0, "whitespace_ratio": 0.2, "most_common_ratio": 0.06, "line_length_stddev": 36.92, "repeated_char_sequences": 57.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 64.0, "most_common_char_codepoint": 116.0 }, "binary": { "overall_entropy": 5.13, "peak_region_bytes": 22448.0, "peak_region_entropy": 5.21 } } }, "id": 3, "mol": "Hâ‚‚(DbF)", "path": "/data/samples/unknown/foraged/openclaw/clawhub.ai/_/contentstudio/contentstudio-1.0.9.zip!!README.md", "pid": 0, "risk": 2, "sha": "515bf50ed1535bc61b0ce54628ccfc146de3d93c266e5e3bfe01a3b0783c0cdd", "size": 30640, "traits": [ { "id": "metadata/file/profile/language::lang-english--atom-7", "conf": 0.8, "crit": 2, "desc": "Contains common English function words", "spans": [ [ 873, 0 ] ] }, { "id": "micro-behaviors/fs/path/application/config::claude-skills-directory", "conf": 0.93, "crit": 3, "desc": "Claude Code skills directory path", "spans": [ [ 2016, 15 ] ] }, { "id": "micro-behaviors/data/llm::agent-identity-claude", "conf": 0.8, "crit": 1, "desc": "Claude agent identity reference", "spans": [ [ 969, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-6", "conf": 0.8, "crit": 2, "desc": "Contains common English function words", "spans": [ [ 5102, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-1", "conf": 0.8, "crit": 2, "desc": "Contains common English function words", "spans": [ [ 520, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-5", "conf": 0.8, "crit": 2, "desc": "Contains common English function words", "spans": [ [ 637, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-2", "conf": 0.8, "crit": 2, "desc": "Contains common English function words", "spans": [ [ 389, 0 ] ] }, { "id": "metadata/file/profile/language::lang-english--atom-3", "conf": 0.8, "crit": 2, "desc": "Contains common English function words", "spans": [ [ 3406, 0 ] ] }, { "id": "micro-behaviors/data/llm::ai-agent-term-reference", "conf": 0.8, "crit": 1, "desc": "References the phrase \"AI agent\"", "spans": [ [ 656, 0 ] ] }, { "id": "micro-behaviors/fs/path/application/config::claude-config-directory", "conf": 0.9, "crit": 3, "desc": "Claude Code config directory path", "spans": [ [ 2015, 9 ] ] }, { "id": "micro-behaviors/data/llm::agent-identity-set", "conf": 0.9, "crit": 3, "desc": "References multiple AI assistant products", "spans": [ [ 656, 8 ], [ 969, 11 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "bo[s0wPIv4x(Ffdz/dPUjySs{", "ln": 1, "addr": 0 }, { "b": "lVl\u003c:wO#P*BAIbdzY\u0026.8y\u0026BCrvp%d?BAnNCv}YB:B.\u003eRiB8LM5vqEJjwN]H-aAhmuBAnNkzE:(bvqYH^wGU\u00263wnbE6ayO+\u0026z/]@tB1wCxAbY\u0026oC42idefGdPA+/-nvpJ\u003e\u0026efFChze-]$xkR=waz+E}wO=Asay!\u00264wOk}4x\u003equpayPd#aARg6z6iXbzdm6%B0bNrA=l8kxDRzgwGTuUzGGDcBw)p7wnb%8AckSax\u003e5nKp!rnZjySs{", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 76, "z": 3, "cf": 0.800000011920929 } ], "ln": 2, "addr": 21 }, { "b": "", "ln": 3, "addr": 218 }, { "b": "ra]#!aAIsjy?$kdB0bHmvpTTaw]zYjv@Dj3wPzo{vqEPmz/ddpz/6u5A:@/(y-)\u003ewwIb8/vSBT", "ln": 4, "addr": 219 }, { "b": "", "ln": 12, "addr": 419 }, { "b": "bo[shB7DEYvrl0vauTaNj]", "ln": 13, "addr": 420 }, { "b": "l$HKMy\u0026so7A=S=Oz/xodvruBdB1wCxzE:\u003eQnG.COwO#QhaA.:paARphB0bKtx(4PdBz\u0026pjA+PYdayMxWz/fVdzGF*0B.2i8aA}:AyJBD6v}u={A=k!qBzbkdBy/Gfx(mu}efFUAv@co#x(mMaAbP/taAI4awN]}1x(mMmaz\u003eX2x\u003c\u0026c3vqYH^wO(0@BsXLyv}fC1zGE1qz/oAlA4AbuAbY\u0026oC42idefFwswfu8mA+/-nvpJ\u003c\u003evrD9{BAo5SjySs{", "n": [ { "c": 1, "d": "\"ai agent\" identity", "i": "objectives/command-and-control/remote-command/llm/action::llm-agent-identity-ai-agent", "o": 465, "z": 8, "cf": 0.800000011920929 } ], "ln": 14, "addr": 438 }, { "b": "", "ln": 15, "addr": 643 }, { "b": "bo[AQl$HsNz*uhhzGE0\u003ewP8j4vq][9azbLjaxrF]iV{K]AY%", "ln": 16, "addr": 644 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 2404.0, "entropy": 4.95, "size_bytes": 2404.0 }, "text": { "digit_ratio": 0.0, "space_count": 260.0, "total_lines": 44.0, "char_entropy": 4.95, "unique_chars": 69.0, "lines_over_200": 2.0, "avg_line_length": 53.64, "max_line_length": 242.0, "empty_line_ratio": 0.3, "last_line_length": 242.0, "whitespace_ratio": 0.13, "most_common_ratio": 0.07, "line_length_stddev": 61.79, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 1.0, "most_common_char_codepoint": 101.0 }, "binary": { "overall_entropy": 4.95, "peak_region_bytes": 2404.0, "peak_region_entropy": 5.04 } } }, "id": 4, "path": "/data/samples/unknown/foraged/openclaw/clawhub.ai/_/contentstudio/contentstudio-1.0.9.zip!!skill-card.md", "risk": 1, "sha": "7ac91e95db6e8578585e02bbab7b752f3bfe312ca8f714ebecfe95f5a5838e32", "size": 2404, "traits": [ { "id": "metadata/file/extension/identity::markdown-file-basename", "conf": 1.0, "crit": 1, "desc": "Markdown document file extension", "spans": [ [ 0, 13 ] ] }, { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 13 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 76, 3 ] ] } ], "type": "markdown" }, { "ctx": [ { "b": "eIeK", "n": [ { "c": 2, "d": "Agent skill manifest frontmatter", "i": "metadata/package/config::agent-skill-frontmatter", "o": 0, "z": 8, "cf": 0.8999999761581421 } ], "ln": 1, "addr": 0 }, { "b": "zEEx[iV}{JzGGDcBAqLDwnb@", "n": [ { "c": 1, "d": "Agent skill frontmatter fields", "i": "metadata/package/config::agent-skill-frontmatter-fields", "o": 4, "z": 32, "cf": 0.8600000143051147 } ], "ln": 2, "addr": 4 }, { "b": "wmY*(A+PGmx(v(Iavy6+By/uiq/)d)x(tbdB0a)lBz(8laARJAB7n({wozZ1aAIEhx\u003c\u003e*fzdNl(vixJcB98ECvpKs@B8@D[vpJ\u003eTz/ozxawuG!yH}3Fzy=]fCwhevwPxCaefEJ4B97\u00266A:-/oax-S9rcqUYefE]ayGbj/efE=6zGGDgwPI@Aaxi2{wNPa\u003cefE]mzdms4efEn}B.bSfC}p7DzE:\u003eWz/oo8wGTrZB7]J6B8@E2A=kM7y?kjwrDzZ]Cw7M9aARpdaA.:pAV/NmzGG}xBz\u0026prx(!wHv@=c?By^aowO+}1wImFhAb](uwGU@gB98EOaz\u003eL8vp%c]zdNl(vjSKtAV!!kwnccdCw?IqB8UL$wPGyBvpJ!=B-8qxefFChze-]$xkR=waz+E}wO=Asay!\u00264wOk}4x\u003equpaA8oyBy!($eP26ovR6O3aA8cuBzbl1AV^./zGGDcBw)p7wnb%8vpJ!=B-8pN", "n": [ { "c": 2, "d": "English language detection", "i": "metadata/file/profile/language::lang-english", "o": 195, "z": 3, "cf": 0.800000011920929 } ], "ln": 3, "addr": 24 }, { "b": "C4CYnx(v(IatCG5e\u0026-", "ln": 4, "addr": 409 }, { "b": "xM4:0Aa9x\u003ciV@9TBz#pZfe3:Mx!A[lzGGDcBAqLDwnb%mx(tUqB.Lw$", "ln": 5, "addr": 424 }, { "b": "zdN/$wmoN*iV@+[z/xo9v@bN$b075{wO(v2x^bOZ[sL[#a$K{UwPq\u003cbA+fqoi^S5Wx(m#oi:i!rz/fVdzGG@wB.2i8b3=-zwO#Vni:i^}pFK\u003eTpe\u003ed\u003eryxzOuQmHWuRr*\u003cb3/RBEe", "n": [ { "c": 1, "d": "OpenClaw product name marker", "i": "well-known/app/openclaw::openclaw-product-name", "o": 481, "z": 8, "cf": 0.8999999761581421 } ], "ln": 6, "addr": 469 }, { "b": "eIeK", "ln": 7, "addr": 579 }, { "b": "", "ln": 8, "addr": 583 }, { "b": "D(%)*zEEx[dK(M*ay/tcBy/uiB98Lnx(tbw", "ln": 26, "addr": 1016 }, { "b": "D(%)*wmY*(A+PGmx(v(sdJ\u003c9Yq/ueWvqEJjwN]H-ayPzmz/5{8x(v(ilRH5]w]zYjB7n({wozZ5zF78hz/Z2wayPd#az\u003eL8vp%p(xcq55wnbE9vpJ!=B-8qxaA?EcaARpdavy6+By/uiq/)d)x(tbkBZ/f3v\u003c16lnG-x", "ln": 27, "addr": 1045 }, { "b": "D(%)*vqG:#Cv+qpBz(8lB1eTZD($::B7=$iz/fVdzGG@wB.2i8iW#N3D\u0026", "n": [ { "c": 1, "d": "Pipe to shell interpreter token", "i": "micro-behaviors/data/runtime/keywords::pipe-to-shell", "o": 1197, "z": 6, "cf": 0.8799999952316284 } ], "ln": 28, "addr": 1177 }, { "b": "", "ln": 29, "addr": 1223 }, { "b": "eIeK", "ln": 30, "addr": 1224 }, { "b": "u{5yAvrua1A=10FaA?gfB.bRpw]zYju$0LPz/]@tB2)/HzF\u003c2}BymcLu$J?SwNYN@yHwXou$J?SwNYN@yB%HCz!rZ1wNE5iu$\u003cI1Byw*5vqPy6ayF]3B97\u00266A:-/pC4\u003ewpw)]gXvScg2u[rBdBA.CvBy/G2efFtpx(mY$wnb{?efFttx(n37A+frlu[rBdBzkJjz!\u0026-iayGFkB-.+nwNE5iv0375wNPa\u003cu[rBdxkI9=efFtxB.$P7A:QH", "ln": 210, "addr": 9307 }, { "b": "", "ln": 211, "addr": 9507 }, { "b": "dK).]v@DHcBs?0vzF\u003c2}BzkVhazbCdCoyHoAV^UtayO[]zGG}XdK\u003e", "n": [ { "c": 1, "d": "\"ai agent\" identity", "i": "objectives/command-and-control/remote-command/llm/action::llm-agent-identity-ai-agent", "o": 9538, "z": 8, "cf": 0.800000011920929 } ], "ln": 212, "addr": 9508 }, { "b": "f!KODB-5sfAbn%8w]zZbB2[bKB97!jBz\u0026pywO00dxKM0gB0bKDAbY-oBy!#9vqYP#Cw7Y2xDRe6BzbP6az1$\u003exDRCswPF$xu#GE@Bzb58fcBUjA+e=)zGGP3y\u0026-#bfcBUtvqZi@y*XXA", "ln": 213, "addr": 9551 }, { "b": "ga\u003cXsz/M%@l3mo.aAhd9By]Dizf3*FzeTGqdj=PKvqG:5u$0LPz/]@tB2)/HzF\u003c2}BrAX+y*?A$z/PXUu)5(}wft@oA+n-\u0026wGV8dwGV28BAIRwwN(]-qCniPzY\u003cdnwGVbpwPw{MFrRf#xK#Diz/xo9azC{ux(k5nxK$)#ayYwfCxmtoaARJAvrDW9z/PMrwIb98xK@qNoI3vvBAq2fw/$#5C4CXpxKL^?y?mVgv@=c\u003ewO#Q7vqH0q", "ln": 214, "addr": 9664 } ], "depth": 1, "facts": { "metrics": { "file": { "size": 14623.0, "entropy": 5.06, "size_bytes": 14623.0 }, "text": { "digit_ratio": 0.01, "space_count": 1916.0, "total_lines": 378.0, "char_entropy": 5.06, "unique_chars": 104.0, "lines_over_200": 7.0, "ascii_art_lines": 10.0, "avg_line_length": 37.69, "high_byte_ratio": 0.01, "invisible_chars": 1.0, "max_line_length": 476.0, "non_ascii_ratio": 0.01, "empty_line_ratio": 0.26, "last_line_length": 5.0, "whitespace_ratio": 0.16, "most_common_ratio": 0.07, "line_length_stddev": 55.78, "repeated_char_sequences": 7.0, "most_common_char_is_null": 0.0, "max_inline_whitespace_run": 3.0, "most_common_char_codepoint": 101.0 }, "binary": { "overall_entropy": 5.06, "peak_region_bytes": 14623.0, "peak_region_entropy": 5.07 } } }, "id": 5, "path": "/data/samples/unknown/foraged/openclaw/clawhub.ai/_/contentstudio/contentstudio-1.0.9.zip!!SKILL.md", "risk": 1, "sha": "667c7a37ea0c38ed0569fa13ffd378cf1b50c0f46fc0b19b9e755e53de9b2da3", "size": 14623, "traits": [ { "id": "metadata/file/extension/identity::doc-or-config-extension", "conf": 1.0, "crit": 1, "desc": "Document or config file extension", "spans": [ [ 0, 8 ] ] }, { "id": "metadata/file/profile/language::lang-english", "conf": 0.800000011920929, "crit": 2, "desc": "English language detection", "spans": [ [ 195, 3 ] ] }, { "id": "metadata/package/config::agent-skill-md-basename", "conf": 0.949999988079071, "crit": 1, "desc": "Agent skill markdown file name", "spans": [ [ 0, 8 ] ] }, { "id": "metadata/package/config::agent-skill-frontmatter-fields", "conf": 0.8600000143051147, "crit": 1, "desc": "Agent skill frontmatter fields", "spans": [ [ 4, 32 ] ] }, { "id": "metadata/package/config::agent-skill-frontmatter", "conf": 0.8999999761581421, "crit": 2, "desc": "Agent skill manifest frontmatter", "spans": [ [ 0, 8 ], [ 4, 32 ] ] } ], "type": "markdown" }, { "id": 6, "sha": "aa2decdb17aafb855f15bccfe22b47bc36263b2515b22186c9e6ca9702c89c4f", "path": "/data/samples/unknown/foraged/openclaw/clawhub.ai/_/contentstudio/contentstudio-1.0.9.zip!!_meta.json", "risk": 1, "size": 132, "type": "json", "depth": 1 } ], "omitted_files": 1, "rev": "46112", "v": "8" } }