aisafepy

v0.1.0 suspicious
4.0
Medium Risk

Capability-based IFC, streaming-native cascaded guardrails, and an eval-to-guardrail compiler for LLM agents.

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows some signs of potential risk, particularly concerning its metadata and obfuscation techniques, despite having low risks in network, shell, and credential handling.

  • Metadata risk due to incomplete author information and lack of maintainer history.
  • Observed obfuscation patterns, though not definitively malicious.
Per-check LLM notes
  • Network: The use of httpx for making network calls is common and not inherently suspicious, but could be used for data exfiltration if misused.
  • Shell: No shell execution patterns were detected, indicating low risk.
  • Obfuscation: The observed patterns suggest some level of obfuscation, but they appear to be related to normal model evaluation and device assignment procedures rather than malicious intent.
  • Credentials: No clear signs of credential harvesting or secret handling were detected.
  • Metadata: The package appears suspicious due to the author's incomplete information and being a new package with no maintainer history.

📦 Package Quality Overall: Medium (6.4/10)

✦ High Test Suite 9.0

Test suite present — 11 test file(s) found

  • Test runner config found: conftest.py
  • Test runner config found: pyproject.toml
  • 11 test file(s) detected (e.g. conftest.py)
◈ Medium Documentation 7.0

Some documentation present

  • Documentation URL: "Documentation" -> https://github.com/Vidura-Wijekoon/aisafepy#readme
  • Detailed PyPI description (6143 chars)
◈ Medium Contributing Guide 7.0

Some contribution signals present

  • Governance file: governance.py
◈ Medium Type Annotations 7.0

Partial type annotation coverage

  • Classifier: Typing :: Typed
  • 192 type-annotated function signatures detected in source
○ Low Multiple Contributors 2.0

Single-author or unverifiable project

  • 1 unique contributor(s) across 10 commits in Vidura-Wijekoon/aisafepy
  • Single author with few commits — possibly a personal or throwaway project

🔬 Heuristic Checks

⚠ Outbound Network Calls score 1.5

Found 1 network call pattern(s)

  • try: async with httpx.AsyncClient(timeout=self.timeout_s) as client: resp = a
⚠ Code Obfuscation score 8.0

Found 4 obfuscation pattern(s)

  • e "cpu" model.to(device).eval() def mean_activations(texts: list[str]) -> torch.Ten
  • self._model.to(device).eval() self.device = device async def __call__(se
  • (device) self._model.eval() self.device = device async def __call__(se
  • self._model.to(device).eval() async def __call__(self, ctx: Context) -> GuardDeci
✓ Shell / Subprocess Execution

No shell execution patterns detected

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: viduraaitech.space>

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository Vidura-Wijekoon/aisafepy appears legitimate

⚠ Maintainer History score 6.0

3 maintainer concern(s) found

  • Only one version has ever been released — brand new package
  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with aisafepy 
Create a mini-application named 'GuardRailBot' using the Python package 'aisafepy'. This application will serve as a safety guardian for LLM-driven chatbots, ensuring that their responses adhere strictly to predefined ethical and operational guidelines. Here’s a step-by-step guide on how to build it:

1. **Setup Project**: Initialize a new Python project and install 'aisafepy'.
2. **Define Capabilities**: Use 'aisafepy' to define different capabilities of the chatbot, such as responding to user queries, providing specific types of information, etc., each with its own set of constraints.
3. **Streaming-Native Guardrails**: Implement guardrails that monitor the chatbot’s responses in real-time, ensuring they meet ethical standards. These guardrails should be capable of stopping a response mid-stream if necessary.
4. **Eval-to-Guardrail Compiler**: Develop a feature where users can input custom rules (in a simple language) that get compiled into guardrails automatically. This allows for dynamic adjustment of safety protocols based on feedback or changing needs.
5. **User Interface**: Create a basic web interface where users can interact with the chatbot and see the guardrails at work. Include options to test different scenarios and observe how the guardrails respond.
6. **Testing & Feedback**: Provide a mechanism within the app for users to give feedback on the chatbot’s behavior and the effectiveness of the guardrails. Use this feedback to refine the system.
7. **Documentation & Deployment**: Write comprehensive documentation explaining how to use 'GuardRailBot', including setup instructions and best practices for configuring guardrails. Deploy the application to a public server for others to try out.

By following these steps, you'll create a robust tool that not only showcases the power of 'aisafepy' but also provides practical value in enhancing the safety and reliability of AI-driven conversational interfaces.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!