Skills/ClawHub/cue-dd-checklist

cue-dd-checklist@0.1.36

VERIFIED· install only

Publisher claims: "给你一家公司 + 基准日 + 回看窗口 + 用途档位（投资/授信/并购），还你一张固定七列的风险事实表：每条都回指具体披露（公告号、函件号、裁判文书号或 URL），外加九类覆盖率对账表，写清每类查没查到、没查到是没工具还是真零条。不适合：投资意见、法律意见、批量多主体、公开面之外的深查（会标注需商用库）。适合：投前初筛、授信背景核查、并购线索起点。八道机检管形制：无锚、无日期、归属不清的条目进不了表，「无风险」「可投」类措辞出现即拦，账、流水、快照三者互相对账；但锚内容是否本站真造（整份快照或流水链重写）机器验不出，须人工抽 3 对原文——SKILL §7 把这条边界写死，本件不假装能挡。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher huhoo · publishing for 23 daysInstalls 290Last detonated 8 h ago
$clawhub install cue-dd-checklist
WatchReport an issue

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-14 and scored it 85/100 (Verified). In what ran, nothing we could detect went wrong: no undeclared network egress, no credential reads, no persistent instruction writes. What it does with a real credential was not observed; the static findings and the publisher carry the rest of the score. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B16-confidence-illegal.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B06-investment-words.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B04-category-outside.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B03-confession-words.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B14-sha-mismatch.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B07-legal-opinion.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B10-multi-subject.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-B10-multi-subject.json:1 · File type combined with upload action — agent may exfiltrate local data files…dir -p \"$T/$(dirname \"$d\")\"; cp \"../_shared/$src\" \"$T/$d\"; done < shared.txt; cp -R . \"$T\"/ 2>/dev/null; [ -d local ] && cp -R local/. \"$T\"/ 2>/dev/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B09-notool-to-nothing.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B01-anchor-missing.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B08-completeness-claim.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B05-impact-carries-advice.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B13-evidence-empty.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B12-date-order.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
npx invocation of non-well-known packageSKILL.md:216 · npx invocation of non-well-known package — may execute untrusted code…"。本条只加人审一格，机器面不扩。 ## 8. 通道依赖与降级 首次开通三层本件自己写全（见本件 README 的「首次开通 Cue」那一节）：装本件用 `npx skills add huhoo/cue-awesome --skill dd-checklist`，取证腿 `cue-data-mcp`（`cue-omni-reader…Fix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B15-kind-illegal.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B11-naked-row.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B02-amount-as-anchor.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X11-statute-wrong-kind.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-X15a-declaration-missing.json:1 · File type combined with upload action — agent may exfiltrate local data files…dir -p \"$T/$(dirname \"$d\")\"; cp \"../_shared/$src\" \"$T/$d\"; done < shared.txt; cp -R . \"$T\"/ 2>/dev/null; [ -d local ] && cp -R local/. \"$T\"/ 2>/dev/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B24-shortname-collision.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X01-date-outside-window.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B17-asof-illegal.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X14-user-supplied-no-evidence.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X05-header-renamed.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X02-anchor-in-fact-only.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X16b-delete-source-and-evidence.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X15a-declaration-missing.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X08-fake-zero-entries.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X17-statute-other-article.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-X15c-declaration-bag.json:1 · File type combined with upload action — agent may exfiltrate local data files…dir -p \"$T/$(dirname \"$d\")\"; cp \"../_shared/$src\" \"$T/$d\"; done < shared.txt; cp -R . \"$T\"/ 2>/dev/null; [ -d local ] && cp -R local/. \"$T\"/ 2>/dev/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X15c-declaration-bag.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B23-evidence-other-subject.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B18-title-window-drift.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-B19-missing-purpose.json:1 · File type combined with upload action — agent may exfiltrate local data files…dir -p \"$T/$(dirname \"$d\")\"; cp \"../_shared/$src\" \"$T/$d\"; done < shared.txt; cp -R . \"$T\"/ 2>/dev/null; [ -d local ] && cp -R local/. \"$T\"/ 2>/dev/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X09-refile-to-other.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X10-redline-in-ledger.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X15b-declaration-late.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B22-statute-fake.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X07-coverage-missing-row.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X13-no-subject-condition.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B19-missing-purpose.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --sources sources.jsonl --evid…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X12-statute-cross-file.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B20-missing-evidence.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X04-evidence-wrong-anchor.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X16c-vague-progress-claim.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-B18-title-window-drift.json:1 · File type combined with upload action — agent may exfiltrate local data files…dir -p \"$T/$(dirname \"$d\")\"; cp \"../_shared/$src\" \"$T/$d\"; done < shared.txt; cp -R . \"$T\"/ 2>/dev/null; [ -d local ] && cp -R local/. \"$T\"/ 2>/dev/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X06-fact-too-long.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-B21-derive-no-statute.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-10-31 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-B20-missing-evidence.json:1 · File type combined with upload action — agent may exfiltrate local data files…dir -p \"$T/$(dirname \"$d\")\"; cp \"../_shared/$src\" \"$T/$d\"; done < shared.txt; cp -R . \"$T\"/ 2>/dev/null; [ -d local ] && cp -R local/. \"$T\"/ 2>/dev/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X03-anchor-multi-parse.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-X15b-declaration-late.json:1 · File type combined with upload action — agent may exfiltrate local data files…dir -p \"$T/$(dirname \"$d\")\"; cp \"../_shared/$src\" \"$T/$d\"; done < shared.txt; cp -R . \"$T\"/ 2>/dev/null; [ -d local ] && cp -R local/. \"$T\"/ 2>/dev/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X16a-zero-without-reason.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X28-called-washed-to-no-tool.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X22-section-lookup-bypass.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X19-long-window-undeclared.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-boundary-40-pass.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X18-condition-other-subject.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/ctl-declaration-missing.json:1 · File type combined with upload action — agent may exfiltrate local data files…dir -p \"$T/$(dirname \"$d\")\"; cp \"../_shared/$src\" \"$T/$d\"; done < shared.txt; cp -R . \"$T\"/ 2>/dev/null; [ -d local ] && cp -R local/. \"$T\"/ 2>/dev/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X21-double-declared-variant.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X31-duplicate-domain-line.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-age-cap-overclaim.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X25-h1-title-masquerade.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-declaration-missing.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-boundary-41-fail.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-age-requested-mismatch.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X27-ledger-tenth-category.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-fence-domain-footer-example-good.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-age-beyond-nonexistent.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X23-duplicate-coverage-sections.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-fence-authority-only.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X29-fenced-fake-section.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-age-single-malformed.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X24-h5-insection-duplicate.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/ctl-fence-authority-only.json:1 · File type combined with upload action — agent may exfiltrate local data files…dir -p \"$T/$(dirname \"$d\")\"; cp \"../_shared/$src\" \"$T/$d\"; done < shared.txt; cp -R . \"$T\"/ 2>/dev/null; [ -d local ] && cp -R local/. \"$T\"/ 2>/dev/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/bad-X30-dual-subject-in-param.json:1 · File type combined with upload action — agent may exfiltrate local data files…dir -p \"$T/$(dirname \"$d\")\"; cp \"../_shared/$src\" \"$T/$d\"; done < shared.txt; cp -R . \"$T\"/ 2>/dev/null; [ -d local ] && cp -R local/. \"$T\"/ 2>/dev/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-age-sectioned-declared.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X30-dual-subject-in-param.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09\uff1b\u6d77\u5cb3\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff0860000…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X20-beyond-laundered.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X26-age-cap-underclaim.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/bad-X32-asof-not-a-calendar-day.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-underreport-drop-source.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-fence-longer-close-good.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-ledger-header-order.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-input-double-h1.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/good-anchors-wide.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-underreport-with-reason.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-flow-age-trigger-launder.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-ledger-separator-width.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/good-X29-fenced-heading-example.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/good-X19-long-window-declared.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-overclaim-row-missing.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-fence-redline-still-scanned.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-flow-domain-snapshot-mismatch.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-ledger-row-width.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-ledger-header-width.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/good-X24-sectioned-h5-before-declaration.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-underreport-drop-row.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/good-X23-compact-h5-note.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/ctl-input-double-echo.json:1 · File type combined with upload action — agent may exfiltrate local data files…dir -p \"$T/$(dirname \"$d\")\"; cp \"../_shared/$src\" \"$T/$d\"; done < shared.txt; cp -R . \"$T\"/ 2>/dev/null; [ -d local ] && cp -R local/. \"$T\"/ 2>/dev/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-flow-two-domains-one-omitted.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/good-X28-two-domains-booked.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-input-double-echo.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-fence-four-space-not-open.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
File type combined with upload actionscripts/fixtures/samples/ctl-input-double-h1.json:1 · File type combined with upload action — agent may exfiltrate local data files…dir -p \"$T/$(dirname \"$d\")\"; cp \"../_shared/$src\" \"$T/$d\"; done < shared.txt; cp -R . \"$T\"/ 2>/dev/null; [ -d local ] && cp -R local/. \"$T\"/ 2>/dev/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-runner-expect-extra-code.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-ledger-second-header.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-ledger-no-header.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-flow-ledger-domain-mismatch.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/good-X16-downgrade-accounted.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-ledger-entirely-fenced.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/ctl-flow-missing-hits.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 24m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/good-baseline.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/good-subject-code-only.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…e3d6c70aaf429aee9cbaf3caf79667eb6c629fbc7717e5cf0a62a2c1e9524349 entity_data-Z-\u80a1\u6743\u4e0e\u63a7\u5236\u6743.json\nd0a1d9b8b20d786d5b0eb88b556a0aac8e27cf24d2a4fd7e0f2aa3c4a37ee7b1 disclos…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/good-statute-derive.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07
MEDIUM
Unicode escape sequence detectedscripts/fixtures/samples/good-zero-entries-evidence-backed.json:1 · Unicode escape sequence detected — may contain obfuscated payloads…v/null; cd \"$T\" && python3 \"$OLDPWD/../../check_dd.py\" report.md --subject '\u5317\u8fb0\u80a1\u4efd\u6709\u9650\u516c\u53f8\uff08600001.SH\uff09' --asof 2026-09-21 --lookback 36m --purpose investment --sources…Fix: Put hosts, commands and strings in plain source. Decoding at runtime looks identical to malware and costs points on its own.
AST07

Cost to the agent

Instructions loaded
≈4,571 tok
1 file · 157 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.