Scan report
aws-solutions-library-samples / accelerated-intelligent-document-processing-on-aws
Could an attacker exploit mistakes in this code?
Minor issues. Worth a glance, unlikely to be urgent.
- High
- 0
- Medium
- 6
- Low
- 95
Sources: Bandit, Semgrep, pip-audit
Does this code look like it is trying to cause harm?
Serious issues. Review the high-severity findings before using it.
- High
- 31
- Medium
- 1
- Low
- 37
Sources: YARA, ClamAV, GuardDog, dependency checker
- Likely real
- 10
- Uncertain
- 15
- Likely noise
- 145
The risk classifier rates every finding for how likely it is to be a real issue. Likely noise still counts, just much less.
What we found, in plain English
This repository has been flagged as having high malicious-pattern risk, which means there are strong signs that the code was intentionally written to be dangerous rather than just containing ordinary insecure coding mistakes. While the vulnerability risk score is low and indicates only minor issues like unsafe YAML loading or XML parsing, the high malicious pattern score suggests the presence of specific threats such as credential harvesting, memory scraping, and deliberate attempts to download and execute remote files. You should treat this code with extreme caution because it contains multiple dangerous patterns that could be exploited by attackers, even though the overall vulnerability count is relatively small. The scan identified several critical issues including a YARA rule that detects credential harvesters, a pattern for downloading files and running them, and memory scraping techniques used to steal data from running processes. Given these specific high-risk indicators, it is not safe to use this code in production environments without thorough manual review and remediation of the identified threats.
Written by a local language model from the findings below. The risk scores come from the classifier, not from this summary.
Detections by engine
Score over time
Overall score each time this repository was scanned.
Findings
Highest severity first. Select a finding to see the code and what it means.
-
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /src/ui/package.json line 62
- Likely real
- Yes, 98% confidence
Detects HTTP/HTTPS URL dependencies in package.json (dependency confusion, untrusted sources) [threat-npm-http-dependency]
"vuera": "^0.2.7", "xlsx": "https://cdn.sheetjs.com/xlsx-0.20.2/xlsx-0.20.2.tgz" }, "scripts": { -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /scripts/srt/setup.py line 19
- Likely real
- Yes, 95% confidence
Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
if interactive: result = subprocess.run(cmd, shell=True, cwd=cwd, text=True) # nosec B602 nosemgrep: python.lang.security.audit.subprocess-shell-true.subpro... -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /scripts/srt/setup.py line 139
- Likely real
- Yes, 95% confidence
Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
try: urllib.request.urlretrieve(download_url, archive_path) # nosec B310 - GitHub release URL is trusted print(f"Downloaded: {archive_path.name}") return archive_path -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /scripts/srt/setup.py line 74
- Likely real
- Yes, 95% confidence
Detects download-and-execute patterns: fetching a remote file then executing it [threat-process-download-exec]
try: with urllib.request.urlopen(request) as response: # nosec B310 - GitHub API URL is trusted data = json.loads(response.read().decode()) return data["tag_name"], data["assets"] -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/confbench-testset/ui-deployer/handler.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/sample-health-insurance-review/ui-deployer/handler.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/idp-data-generator/ui-deployer/handler.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/feature-template/ui-deployer/handler.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/pii-anonymizer/ui-deployer/handler.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/sample-feature/ui-deployer/handler.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /samples/lambda-hook-inference/GENAIIDP-cohere-parse-hook/index.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /samples/lambda-hook-inference/GENAIIDP-chandra-ocr-hook/index.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/lambda/discovery_processor/index.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/lambda/ipset_updater/index.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/lambda/blueprint_optimization/index.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /samples/lambda-hook-inference/GENAIIDP-mistral-ocr-hook/index.py
- Likely real
- Uncertain, 33% confidence
YARA rule matched: detect_credential_harvester — References credential/secret material by name AND a deliberate outbound-send API in the same file - narrower than \'reads any env var\', which large legitimate codebases do constantly regardless of intent. Still not proof the two are connected (YARA can\'t trace data flow) - a known limitation, see NOTES.md
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/srt/setup.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /.github/workflows/developer-tests.yml
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /lib/idp_feature_sdk/idp_feature_sdk/pack.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /lib/idp_feature_sdk/idp_feature_sdk/publisher.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/sdlc/codebuild_deployment.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/security/dep_audit.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/ux_recorder.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/setup/dev_setup_ubuntu.sh
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/setup/mac_setup.sh
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/sdlc/check_branch_protection.py
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/setup/dev_setup_al2023.sh
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /.claude/skills/srt-security-scan.md
- Likely real
- Probably noise, 1% confidence
YARA rule matched: detect_download_and_execute — Downloads a remote resource AND executes it - the actually dangerous combination, not just downloading alone
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/setup/dev_setup_al2023.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/setup/mac_setup.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/setup/dev_setup_ubuntu.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_persistence_mechanism — Modifies a startup/scheduling location - legitimate application code essentially never does this
-
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/check_data_plane_tags.py line 195
- Likely real
- Yes, 98% confidence
Use of unsafe yaml load. Allows instantiation of arbitrary objects. Consider yaml.safe_load().
194 return {} 195 template = yaml.load(path.read_text(), Loader=_cfn_tag_loader()) 196 return (template or {}).get("Resources", {}) or {} -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /lib/idp_common_pkg/idp_common/ocr/document_converter.py line 1823
- Likely real
- Yes, 89% confidence
Detects heavy code obfuscation techniques [threat-runtime-obfuscation-general]
...\xff\xc0\x00\x11\x08\x00\x01\x00\x01\x01\x01\x11\x00\x02\x11\x01\x03\x11\x01\xff\xc4\x00\x14\x00\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x08\xff\xc4\x00\x14\x10\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xff\xda\x00\x0c\x03\x01\x00\x02\x11\x03\x11\x00\x3f\x00\x80\xff\xd9... -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder.py line 610
- Likely real
- Uncertain, 49% confidence
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
609 try: 610 with urllib.request.urlopen( 611 f"http://127.0.0.1:{port}/json/version", timeout=3 612 ) as resp: 613 return json.loads(resp.read().decode("utf-8")).get("Browser") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder_cdp.py line 339
- Likely real
- Uncertain, 49% confidence
Audit url open for permitted schemes. Allowing use of file:/ or custom schemes is often unexpected.
338 """Every debuggable target the browser advertises at ``/json``.""" 339 with urllib.request.urlopen(f"http://{host}:{port}/json", timeout=5) as resp: 340 return json.loads(resp.read().decode("utf-8")) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/check_threat_model_currency.py line 218
- Likely real
- Uncertain, 46% confidence
Possible SQL injection vector through string-based query construction.
217 readme = THREAT_MODEL_README.relative_to(REPO_ROOT) 218 return f"""\ 219 Threat model currency gate FAILED 220 221 {readme} records 222 {FIELD_LABEL}: {reviewed} 223 and VERSION is {current} — {behind} releases later. 224 225 Releases shipped since the last review: {", ".join(skipped) or "(none)"} 226 The gate allows at most {MAX_RELEASES_BEHIND}. 227 228 Do NOT clear this by editing the version field alone. A model that claims to 229 describe {current} while describing {reviewed}'s architecture is worse than one 230 that admits it is stale: readers act on the controls it names. Instead: 231 232 1. Re-review the model against the code. Start with 233 security/threat-modeling/architecture/system-overview.md 234 sections 4 (trust boundaries) and 5 (authorization model), then the 235 per-feature document for any surface the releases above touched. 236 Those releases' CHANGELOG.md entries are the shortest list of what changed. 237 238 2. Record the outcome: correct the threat entries, update each document's 239 "Applies to release" row, and add a Version History entry to {readme}. 240 241 3. Set "{FIELD_LABEL}" to {current}, then regenerate the export: 242 python3 security/threat-modeling/scripts/build_threat_model.py 243 244 4. Re-run: make check-threat-model-currency 245 """ 246 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/security/live_checks/verify_idp_group_mapping.py line 94
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
93 """Self-contained SAML IdP metadata. The SSO endpoint is never contacted.""" 94 work = pathlib.Path("/tmp/idp-verify-saml") 95 work.mkdir(exist_ok=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder.py line 130
- Likely real
- Probably noise, 25% confidence
Probable insecure usage of temp file/directory.
129 def socket_path_for(now: datetime, pid: int) -> str: 130 return f"/tmp/ux-recorder-{now.strftime('%Y%m%d-%H%M%S')}-{pid}.sock" 131 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder_render.py line 80
- Likely real
- Yes, 97% confidence
Using escape to parse untrusted XML data is known to be vulnerable to XML attacks. Replace escape with the equivalent defusedxml package, or make sure defusedxml.defuse_stdlib() is called.
79 from typing import Any 80 from xml.sax.saxutils import escape as xml_escape 81 -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /lib/idp_common_pkg/idp_common/ocr/service.py line 1565
- Likely real
- Yes, 92% confidence
Detects memory scraping and credential dumping from process memory [threat-process-memory]
""" Extract image bytes from a page at optimal size to prevent memory issues. If resize config is provided, images are extracted directly at target dimensions -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /lib/idp_common_pkg/idp_common/ocr/service.py line 1431
- Likely real
- Yes, 92% confidence
Detects memory scraping and credential dumping from process memory [threat-process-memory]
# Start monitoring thread monitor_thread = threading.Thread(target=monitor_memory, daemon=True) monitor_thread.start() -
- Engine
- GuardDog · Supply-chain attack heuristics
- Counts towards
- Malicious pattern
- File
- /lib/idp_common_pkg/idp_common/ocr/service.py line 1409
- Likely real
- Yes, 92% confidence
Detects memory scraping and credential dumping from process memory [threat-process-memory]
process = psutil.Process(os.getpid()) memory_info = process.memory_info() memory_mb = memory_info.rss / (1024 * 1024) # Convert to MB -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /feature-platform/pii-anonymizer/hook/vendor/pii_anonymizer/redaction/pdf_redactor.py line 150
- Likely real
- Probably noise, 28% confidence
Try, Except, Continue detected.
149 seg_px = _bbox_to_pixels_safe(seg, img.width, img.height) 150 except Exception: 151 continue 152 # First segment gets synthetic text, rest just white-out -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /nested/api-resolvers/src/lambda/test_set_resolver/index.py line 3846
- Likely real
- Probably noise, 28% confidence
Try, Except, Continue detected.
3845 ) 3846 except: 3847 continue # Skip if can't parse date 3848 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/sdlc/codebuild_deployment.py line 1534
- Likely real
- Probably noise, 28% confidence
Try, Except, Continue detected.
1533 role = iam.get_role(RoleName=rn)["Role"] 1534 except Exception: # noqa: BLE001 — role may be a path/ARN edge case 1535 continue 1536 checked += 1 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/sdlc/codebuild_deployment.py line 3687
- Likely real
- Probably noise, 28% confidence
Try, Except, Continue detected.
3686 3687 except Exception: 3688 # Skip nested stacks we can't access 3689 continue 3690 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_feature_sdk/idp_feature_sdk/publisher.py line 32
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
31 import shutil 32 import subprocess 33 from dataclasses import dataclass, field -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/operations/publish.py line 14
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
13 import shutil 14 import subprocess 15 from typing import List, Optional, Tuple -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/operations/stack.py line 104
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
103 import os 104 import subprocess 105 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder_render.py line 74
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
73 import shutil 74 import subprocess 75 from collections.abc import Callable, Iterable -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/rbac_common.py line 25
- Likely real
- Probably noise, 14% confidence
Consider possible security implications associated with the subprocess module.
24 import os 25 import subprocess 26 from pathlib import Path -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder.py line 75
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
74 import socketserver 75 import subprocess 76 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /benchmarks/harness/run_matrix.py line 21
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
20 import os 21 import subprocess 22 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_feature_sdk/idp_feature_sdk/pack.py line 30
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
29 import re 30 import subprocess 31 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/_core/publish.py line 18
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
17 import shutil 18 import subprocess 19 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/e2e_test_headless.py line 32
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
31 import ssl 32 import subprocess 33 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/generate_govcloud_template.py line 191
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
190 191 import subprocess 192 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/run_all_tests.py line 31
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
30 import os 31 import subprocess 32 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/sdlc/codebuild_deployment.py line 14
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
13 import signal 14 import subprocess 15 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/sdlc/integration_test_deployment.py line 9
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
8 import os 9 import subprocess 10 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/sdlc/typecheck_pr_changes.py line 23
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
22 import shutil 23 import subprocess 24 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/security/curate_results.py line 42
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
41 import re 42 import subprocess 43 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/security/live_checks/verify_idp_group_mapping.py line 31
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
30 import pathlib 31 import subprocess 32 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/srt/ci_paths.py line 26
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
25 26 import subprocess 27 from pathlib import Path -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/srt/fix.py line 5
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
4 import shlex 5 import subprocess 6 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/srt/run.py line 6
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
5 import shlex 6 import subprocess 7 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/srt/setup.py line 9
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
8 import shutil 9 import subprocess 10 import sys -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /benchmarks/harness/aggregate.py line 307
- Likely real
- Probably noise, 13% confidence
Consider possible security implications associated with the subprocess module.
306 def _meta(rm): 307 import subprocess 308 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/_core/publish.py line 3211
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
3210 try: 3211 subprocess.run(["rm", "-rf", sam_dir], check=False) 3212 except Exception as e2: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder_render.py line 1017
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
1016 ) 1017 subprocess.run( 1018 [ 1019 "ffmpeg", 1020 "-y", 1021 "-loglevel", 1022 "error", 1023 "-f", 1024 "concat", 1025 "-safe", 1026 "0", 1027 "-i", 1028 str(list_path), 1029 "-c", 1030 "copy", 1031 str(out), 1032 ], 1033 check=True, 1034 ) 1035 for part in parts: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/_core/publish.py line 535
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
534 try: 535 result = subprocess.run( 536 ["sam", "--version"], capture_output=True, text=True, check=True 537 ) 538 sam_version = result.stdout.split()[3] # Extract version from output -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/_core/publish.py line 3240
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
3239 # Run ruff check (same as GitLab CI lint-cicd) 3240 result = subprocess.run(["ruff", "check"], capture_output=True, text=True) 3241 if result.returncode != 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/_core/publish.py line 3247
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
3246 # Run ruff format check (same as GitLab CI lint-cicd) 3247 result = subprocess.run( 3248 ["ruff", "format", "--check"], capture_output=True, text=True 3249 ) 3250 if result.returncode != 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/_core/publish.py line 3341
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
3340 3341 result = subprocess.run( 3342 ["cfn-lint", template_path], capture_output=True, text=True 3343 ) 3344 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/operations/publish.py line 52
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
51 52 result = subprocess.run( 53 ["cfn-lint", template_path, "--region", region], 54 capture_output=True, 55 text=True, 56 ) 57 output = (result.stdout or "") + (result.stderr or "") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/e2e_test_headless.py line 70
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
69 """Read ApiGatewayEndpoint output from the stack.""" 70 result = subprocess.run( 71 [ 72 "aws", 73 "cloudformation", 74 "describe-stacks", 75 "--stack-name", 76 stack_name, 77 "--query", 78 "Stacks[0].Outputs[?OutputKey=='ApiGatewayEndpoint'].OutputValue", 79 "--output", 80 "text", 81 "--no-cli-pager", 82 ], 83 capture_output=True, 84 text=True, 85 check=True, 86 ) 87 endpoint = result.stdout.strip() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/sdlc/typecheck_pr_changes.py line 32
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
31 try: 32 result = subprocess.run( 33 ["git", *args], capture_output=True, text=True, check=True 34 ) 35 except subprocess.CalledProcessError: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/sdlc/typecheck_pr_changes.py line 99
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
98 try: 99 subprocess.run(["git", "branch", "-a"], check=False) 100 except Exception: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/sdlc/typecheck_pr_changes.py line 167
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
166 167 result = subprocess.run( 168 ["basedpyright", "--project", config_path], 169 capture_output=True, 170 text=True, 171 check=False, 172 ) 173 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/security/curate_results.py line 133
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
132 return ( 133 subprocess.run( 134 ["git", "rev-parse", "--short", "HEAD"], 135 capture_output=True, 136 text=True, 137 cwd=REPO_ROOT, 138 ).stdout.strip() 139 or "unknown" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/security/curate_results.py line 197
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
196 try: 197 res = subprocess.run( 198 ["git", "check-ignore", "--stdin"], 199 cwd=REPO_ROOT, 200 input="\n".join(uniq), 201 capture_output=True, 202 text=True, 203 ) 204 return {ln for ln in res.stdout.splitlines() if ln} -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/security/dep_audit.py line 294
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
293 print("Generating dependency manifests...", flush=True) 294 proc = subprocess.run( # nosec B603 - fixed argv, repo-local script 295 ["bash", str(GENERATE_SCRIPT)], 296 cwd=str(REPO_ROOT), 297 capture_output=True, 298 text=True, 299 ) 300 if proc.returncode != 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/security/live_checks/verify_idp_group_mapping.py line 98
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
97 if not cert.exists(): 98 subprocess.run( 99 [ 100 "openssl", "req", "-x509", "-newkey", "rsa:2048", 101 "-keyout", str(work / "key.pem"), "-out", str(cert), 102 "-days", "30", "-nodes", "-subj", "/CN=testokta.example", 103 ], 104 check=True, capture_output=True, 105 ) 106 body = "".join( -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/srt/ci_paths.py line 53
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
52 try: 53 result = subprocess.run( 54 ["git", "ls-files", "-z"], 55 cwd=str(project_root), 56 capture_output=True, 57 text=True, 58 check=False, 59 ) 60 except (OSError, subprocess.SubprocessError) as e: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/srt/run.py line 66
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
65 66 result = subprocess.run( 67 ["git", "worktree", "list", "--porcelain"], 68 cwd=root, 69 capture_output=True, 70 text=True, 71 check=False, 72 ) 73 if result.returncode == 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder_render.py line 923
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
922 def probe_duration(path: str | Path) -> float: 923 out = subprocess.run( 924 [ 925 "ffprobe", 926 "-v", 927 "error", 928 "-show_entries", 929 "format=duration", 930 "-of", 931 "csv=p=0", 932 str(path), 933 ], 934 check=True, 935 capture_output=True, 936 text=True, 937 ).stdout.strip() 938 return float(out) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder_render.py line 942
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
941 def probe_dimensions(path: str | Path) -> tuple[int, int]: 942 out = subprocess.run( 943 [ 944 "ffprobe", 945 "-v", 946 "error", 947 "-select_streams", 948 "v:0", 949 "-show_entries", 950 "stream=width,height", 951 "-of", 952 "csv=p=0", 953 str(path), 954 ], 955 check=True, 956 capture_output=True, 957 text=True, 958 ).stdout.strip() 959 width, height = (int(x) for x in out.split(",")[:2]) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /benchmarks/harness/aggregate.py line 309
- Likely real
- Probably noise, 12% confidence
Starting a process with a partial executable path
308 309 commit = subprocess.run( 310 "git rev-parse --short HEAD", 311 shell=True, # nosec B602 - fixed local command 312 capture_output=True, 313 text=True, 314 cwd=BENCH, 315 ).stdout.strip() 316 ph = subprocess.run( -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder_render.py line 1017
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
1016 ) 1017 subprocess.run( 1018 [ 1019 "ffmpeg", 1020 "-y", 1021 "-loglevel", 1022 "error", 1023 "-f", 1024 "concat", 1025 "-safe", 1026 "0", 1027 "-i", 1028 str(list_path), 1029 "-c", 1030 "copy", 1031 str(out), 1032 ], 1033 check=True, 1034 ) 1035 for part in parts: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/operations/publish.py line 52
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
51 52 result = subprocess.run( 53 ["cfn-lint", template_path, "--region", region], 54 capture_output=True, 55 text=True, 56 ) 57 output = (result.stdout or "") + (result.stderr or "") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/security/live_checks/verify_idp_group_mapping.py line 98
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
97 if not cert.exists(): 98 subprocess.run( 99 [ 100 "openssl", "req", "-x509", "-newkey", "rsa:2048", 101 "-keyout", str(work / "key.pem"), "-out", str(cert), 102 "-days", "30", "-nodes", "-subj", "/CN=testokta.example", 103 ], 104 check=True, capture_output=True, 105 ) 106 body = "".join( -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/security/curate_results.py line 197
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
196 try: 197 res = subprocess.run( 198 ["git", "check-ignore", "--stdin"], 199 cwd=REPO_ROOT, 200 input="\n".join(uniq), 201 capture_output=True, 202 text=True, 203 ) 204 return {ln for ln in res.stdout.splitlines() if ln} -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/security/curate_results.py line 133
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
132 return ( 133 subprocess.run( 134 ["git", "rev-parse", "--short", "HEAD"], 135 capture_output=True, 136 text=True, 137 cwd=REPO_ROOT, 138 ).stdout.strip() 139 or "unknown" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/sdlc/typecheck_pr_changes.py line 167
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
166 167 result = subprocess.run( 168 ["basedpyright", "--project", config_path], 169 capture_output=True, 170 text=True, 171 check=False, 172 ) 173 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/sdlc/typecheck_pr_changes.py line 99
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
98 try: 99 subprocess.run(["git", "branch", "-a"], check=False) 100 except Exception: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/sdlc/typecheck_pr_changes.py line 32
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
31 try: 32 result = subprocess.run( 33 ["git", *args], capture_output=True, text=True, check=True 34 ) 35 except subprocess.CalledProcessError: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/run_all_tests.py line 297
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
296 print(f"\n=== pytest -m '{marker}' {root} ===", flush=True) 297 result = subprocess.run( 298 [ 299 python, 300 "-m", 301 "pytest", 302 "-m", 303 marker, 304 *parallel, 305 "-q", 306 "-p", 307 "no:cacheprovider", 308 root, 309 ], 310 cwd=REPO_ROOT, 311 ) 312 # Exit code 5 == "no tests collected for this marker", which is fine. -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/generate_govcloud_template.py line 195
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
194 cmd = [sys.executable, publish_script] + publish_args 195 result = subprocess.run(cmd, cwd=project_root) 196 if result.returncode != 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/e2e_test_headless.py line 70
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
69 """Read ApiGatewayEndpoint output from the stack.""" 70 result = subprocess.run( 71 [ 72 "aws", 73 "cloudformation", 74 "describe-stacks", 75 "--stack-name", 76 stack_name, 77 "--query", 78 "Stacks[0].Outputs[?OutputKey=='ApiGatewayEndpoint'].OutputValue", 79 "--output", 80 "text", 81 "--no-cli-pager", 82 ], 83 capture_output=True, 84 text=True, 85 check=True, 86 ) 87 endpoint = result.stdout.strip() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/e2e_test_headless.py line 54
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
53 log("Acquiring OAuth bearer token…") 54 result = subprocess.run( 55 [str(GET_TOKEN_SCRIPT), stack_name], 56 capture_output=True, 57 text=True, 58 check=True, 59 ) 60 token = result.stdout.strip() -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/operations/stack.py line 125
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
124 ] 125 result = subprocess.run( 126 cmd, cwd=from_code, capture_output=True, text=True 127 ) 128 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/srt/ci_paths.py line 53
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
52 try: 53 result = subprocess.run( 54 ["git", "ls-files", "-z"], 55 cwd=str(project_root), 56 capture_output=True, 57 text=True, 58 check=False, 59 ) 60 except (OSError, subprocess.SubprocessError) as e: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/_core/publish.py line 3493
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
3492 3493 result = subprocess.run(cmd, capture_output=True, text=True) 3494 if result.returncode != 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/_core/publish.py line 3341
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
3340 3341 result = subprocess.run( 3342 ["cfn-lint", template_path], capture_output=True, text=True 3343 ) 3344 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/_core/publish.py line 3247
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
3246 # Run ruff format check (same as GitLab CI lint-cicd) 3247 result = subprocess.run( 3248 ["ruff", "format", "--check"], capture_output=True, text=True 3249 ) 3250 if result.returncode != 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/_core/publish.py line 3240
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
3239 # Run ruff check (same as GitLab CI lint-cicd) 3240 result = subprocess.run(["ruff", "check"], capture_output=True, text=True) 3241 if result.returncode != 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/_core/publish.py line 3211
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
3210 try: 3211 subprocess.run(["rm", "-rf", sam_dir], check=False) 3212 except Exception as e2: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/_core/publish.py line 1043
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
1042 1043 result = subprocess.run(cmd, capture_output=True, text=True) 1044 elapsed = time.time() - start -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/_core/publish.py line 535
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
534 try: 535 result = subprocess.run( 536 ["sam", "--version"], capture_output=True, text=True, check=True 537 ) 538 sam_version = result.stdout.split()[3] # Extract version from output -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/_core/publish.py line 339
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
338 # Original behavior - capture all output 339 result = subprocess.run(cmd, capture_output=True, text=True, cwd=cwd) 340 if result.returncode != 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_sdk/idp_sdk/_core/publish.py line 280
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
279 try: 280 process = subprocess.Popen( 281 cmd, 282 stdout=subprocess.PIPE, 283 stderr=subprocess.STDOUT, 284 text=True, 285 cwd=cwd, 286 bufsize=1, 287 universal_newlines=True, 288 ) 289 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_feature_sdk/idp_feature_sdk/publisher.py line 387
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
386 """ 387 result = subprocess.run( 388 cmd, cwd=self.project_dir, capture_output=True, text=True 389 ) 390 if result.returncode != 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_feature_sdk/idp_feature_sdk/publisher.py line 140
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
139 step.argv, 140 shell=False, 141 cwd=cwd, 142 check=False, 143 capture_output=True, 144 text=True, 145 ) 146 if result.returncode != 0: 147 self.console.print(result.stdout) 148 self.console.print(result.stderr) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/srt/run.py line 66
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
65 66 result = subprocess.run( 67 ["git", "worktree", "list", "--porcelain"], 68 cwd=root, 69 capture_output=True, 70 text=True, 71 check=False, 72 ) 73 if result.returncode == 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/srt/setup.py line 178
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
177 try: 178 result = subprocess.run( 179 [str(srt_executable), "--version"], 180 capture_output=True, 181 text=True, 182 check=False, 183 ) 184 if result.returncode == 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/srt/setup.py line 319
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
318 ): 319 result = subprocess.run( 320 [*args, "--profile", aws_profile], 321 capture_output=True, 322 text=True, 323 check=False, 324 ) 325 if result.returncode != 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/srt/setup.py line 416
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
415 416 result = subprocess.run(["./srt", "config"], cwd=srt_dir, check=False) 417 if result.returncode != 0: -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder.py line 713
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
712 with log_path.open("ab") as log_fh: 713 process = subprocess.Popen( 714 [ 715 sys.executable, 716 str(Path(__file__).resolve()), 717 "serve", 718 "--session", 719 str(session_dir), 720 ], 721 stdin=subprocess.DEVNULL, 722 stdout=log_fh, 723 stderr=log_fh, 724 start_new_session=True, 725 cwd=str(repo_root()), 726 ) 727 deadline = time.time() + START_TIMEOUT -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder_render.py line 923
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
922 def probe_duration(path: str | Path) -> float: 923 out = subprocess.run( 924 [ 925 "ffprobe", 926 "-v", 927 "error", 928 "-show_entries", 929 "format=duration", 930 "-of", 931 "csv=p=0", 932 str(path), 933 ], 934 check=True, 935 capture_output=True, 936 text=True, 937 ).stdout.strip() 938 return float(out) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder_render.py line 942
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
941 def probe_dimensions(path: str | Path) -> tuple[int, int]: 942 out = subprocess.run( 943 [ 944 "ffprobe", 945 "-v", 946 "error", 947 "-select_streams", 948 "v:0", 949 "-show_entries", 950 "stream=width,height", 951 "-of", 952 "csv=p=0", 953 str(path), 954 ], 955 check=True, 956 capture_output=True, 957 text=True, 958 ).stdout.strip() 959 width, height = (int(x) for x in out.split(",")[:2]) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder_render.py line 1428
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
1427 for cmd in audio_cmds: 1428 subprocess.run(cmd, check=True) 1429 subprocess.run(encode, check=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder_render.py line 1429
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
1428 subprocess.run(cmd, check=True) 1429 subprocess.run(encode, check=True) 1430 shutil.rmtree(seq_dir, ignore_errors=True) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /scripts/ux_recorder_render.py line 1451
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
1450 continue 1451 out = subprocess.run([tool, "-version"], capture_output=True, text=True).stdout 1452 found[tool] = out.splitlines()[0] if out else path -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_feature_sdk/idp_feature_sdk/pack.py line 1025
- Likely real
- Probably noise, 3% confidence
subprocess call - check for execution of untrusted input.
1024 cons.log(f"▸ Running {' '.join(cmd[2:])}") 1025 subprocess.run(cmd, cwd=source_dir, check=True) 1026 -
- Engine
- Dependency checker · CVEs, typosquats and risky installs
- Counts towards
- Supply chain
- File
- package.json
- Likely real
- Probably noise, 2% confidence
Loose version constraint: 'basedpyright^1.32.1' — attacker could push malicious update
basedpyright:^1.32.1 -
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/api_security_cases.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /samples/lambda-hook-inference/GENAIIDP-cohere-parse-hook/index.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /samples/lambda-hook-inference/GENAIIDP-mistral-ocr-hook/index.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /lib/idp_cli_pkg/idp_cli/cli.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /samples/lambda-hook-inference/GENAIIDP-chandra-ocr-hook/index.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /lib/idp_feature_sdk/idp_feature_sdk/pack.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /lib/idp_feature_sdk/idp_feature_sdk/cli.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /lib/idp_feature_sdk/idp_feature_sdk/publisher.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/security/dep_audit.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/ux_recorder.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/sample-health-insurance-review/ui-deployer/handler.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /nested/multi-doc-discovery/docker_build_lambda/index.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/sample-feature/ui-deployer/handler.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/pii-anonymizer/ui-deployer/handler.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/main-stack-extensions/lambdas/unsubscribe_feature/index.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/feature-template/ui-deployer/handler.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/confbench-testset/ingest/index.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/confbench-testset/shared/python/variants.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/idp-data-generator/ui-deployer/handler.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/confbench-testset/ui-deployer/handler.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/idp-data-generator/docker_build_lambda/index.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /feature-platform/idp-data-generator/agentcore_runtime_lambda/index.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/setup/mac_setup.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/setup/dev_setup_ubuntu.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/lambda/docsplit_testset_deployer/index.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/lambda/circuit_breaker_manager/index.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/lambda/ipset_updater/index.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /src/lambda/multi_doc_discovery/appsync_status.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/setup/wsl_setup.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/setup/dev_setup_al2023.sh
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/sdlc/check_branch_protection.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/srt/setup.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- YARA · Malware signature rules
- Counts towards
- Malicious pattern
- File
- /scripts/ux_recorder_cdp.py
- Likely real
- Probably noise, 0% confidence
YARA rule matched: detect_downloader — Downloads a remote resource - common and low-signal alone; see detect_download_and_execute for the composite version
-
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_common_pkg/idp_common/assessment/batching.py line 992
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
991 return "" 992 assert stats is not None 993 lines = [ -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_common_pkg/idp_common/assessment/batching.py line 1100
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
1099 return [] 1100 assert stats is not None 1101 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_common_pkg/idp_common/bedrock/tool_schema.py line 737
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
736 for safe, sub in props.items(): 737 assert self._kinds is not None 738 kinds = self._kinds.container_kinds(sub) -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_common_pkg/idp_common/extraction/agentic_idp.py line 2529
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
2528 raise exception 2529 assert result is not None # For type checker 2530 return result -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_common_pkg/idp_common/image/__init__.py line 480
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
479 # At this point, both dimensions must be set (type guard for Pylance) 480 assert target_width is not None and target_height is not None, ( 481 "Both dimensions should be set after calculation" 482 ) 483 -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_common_pkg/idp_common/schema/pydantic_generator.py line 173
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
172 if is_scalar_leaf: 173 assert types is not None 174 out["type"] = types + ["null"] -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /lib/idp_feature_sdk/idp_feature_sdk/cli.py line 578
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
577 # ----- Deploy ----- 578 assert wrapper_url is not None # mutex check guaranteed this above 579 console.rule("[bold]Deploying pack…[/bold]") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /notebooks/misc/standalone_sharded_extraction_demo.py line 78
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
77 runtime = select_runtime(config, config.extraction.agentic.max_concurrent_batches) 78 assert isinstance(runtime, InProcessRuntime), runtime 79 print(f"select_runtime() -> {runtime.name} (standalone default)") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /notebooks/misc/standalone_sharded_extraction_demo.py line 108
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
107 f"{[h.symbol for h in merged.holdings]}") 108 assert [h.symbol for h in merged.holdings] == ["AAA", "BBB", "CCC"] 109 assert merged.account_number == "1234-5678" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /notebooks/misc/standalone_sharded_extraction_demo.py line 109
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
108 assert [h.symbol for h in merged.holdings] == ["AAA", "BBB", "CCC"] 109 assert merged.account_number == "1234-5678" 110 print("OK: page-ordered concatenation + first-non-null scalars.\n") -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /notebooks/misc/standalone_sharded_extraction_demo.py line 147
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
146 print(f"shards that actually ran (page0 was pre-persisted): {sorted(ran)}") 147 assert 0 not in ran, "page-0 shard should have been skipped (loaded from S3)" 148 assert merged2.holdings[0].symbol == "PRE" -
- Engine
- Bandit · Python security linter
- Counts towards
- Vulnerability
- File
- /notebooks/misc/standalone_sharded_extraction_demo.py line 148
- Likely real
- Probably noise, 0% confidence
Use of assert detected. The enclosed code will be removed when compiling to optimised byte code.
147 assert 0 not in ran, "page-0 shard should have been skipped (loaded from S3)" 148 assert merged2.holdings[0].symbol == "PRE" 149 print("OK: completed shard loaded from persistence, only incomplete shards ran.\n")
No findings match these filters.