audison

v2.3.4 suspicious
7.0
High Risk

AI proposes. You decide. — Adversarial AI workflow engine with built-in quality arbitration

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits significant risks due to potential command injection and code injection vulnerabilities, as well as a method that could be used to harvest user credentials. While there are some benign aspects, the overall risk profile is too high to consider it safe.

  • High shell risk due to unvalidated use of os.system and subprocess.run
  • High obfuscation risk from the use of eval
Per-check LLM notes
  • Network: The network calls appear to be legitimate API requests to fetch tags and models, which is reasonable for a package that might interact with an external service.
  • Shell: Use of os.system and subprocess.run without proper input validation indicates potential command injection vulnerabilities, suggesting significant risk of malicious activity.
  • Obfuscation: The use of eval to process data is highly suspicious and indicates potential for code injection attacks.
  • Credentials: Prompting users to input sensitive information like API keys directly through the package may indicate an attempt to harvest credentials.
  • Metadata: The author's information is incomplete and the account seems new or inactive, raising some concerns but not definitive evidence of malicious intent.

📦 Package Quality Overall: Medium (6.0/10)

✦ High Test Suite 9.0

Test suite present — 2 test file(s) found

  • Test runner config found: pyproject.toml
  • 2 test file(s) detected (e.g. test_cli_e2e.py)
◈ Medium Documentation 7.0

Some documentation present

  • Documentation URL: "Documentation" -> https://github.com/wdnmd1265/audison#readme
  • Detailed PyPI description (22550 chars)
○ Low Contributing Guide 2.0

No contributing guide or governance files found

  • No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
◈ Medium Type Annotations 7.0

Partial type annotation coverage

  • Type checker (mypy / pyright / pytype) referenced in project
  • 413 type-annotated function signatures detected in source
◈ Medium Multiple Contributors 5.0

Limited contributor diversity

  • 1 unique contributor(s) across 38 commits in wdnmd1265/audison
  • Single author but highly active (38 commits)

🔬 Heuristic Checks

⚠ Outbound Network Calls score 6.0

Found 4 network call pattern(s)

  • try: req = urllib.request.Request( f"{base_url.rstrip('/')}/api/tags",
  • "}, ) urllib.request.urlopen(req, timeout=timeout) latency = (time.ti
  • try: req = urllib.request.Request( f"{base_url.rstrip('/')}/models",
  • }, ) urllib.request.urlopen(req, timeout=timeout) latency = (time.ti
⚠ Code Obfuscation score 4.0

Found 2 obfuscation pattern(s)

  • ut="def process(data): return eval(data)", session_id="blind-spot-3", b
  • "字符串拼接 SQL", "high"), (re.compile(r'(?:execute|exec|query)\s*\(\s*["\'].*?\b(?:SELECT|INSERT|UPDATE|DELETE)\b',
⚠ Shell / Subprocess Execution score 4.0

Found 2 shell execution pattern(s)

  • 统命令。""" # 命令注入漏洞（漏洞5） os.system(f"ping {cmd_param}") if __name__ == "__main__": # 使用弱哈希
  • p_file)] result = subprocess.run( cmd, capture_output=True,
⚠ Credential Harvesting score 5.0

Found 2 credential access pattern(s)

  • n] 配置 API Key") api_key = getpass.getpass("API Key (输入不可见): ").strip() if not api_key: con
  • = "ollama": api_key = getpass.getpass(f" Enter your {pname} API Key (input hidden): ").strip()
✓ Typosquatting

No typosquatting candidates detected

⚠ Registered Email Domain score 3.0

Suspicious email domain flags: Very short email domain: qq.com>

  • Very short email domain: qq.com>
✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository wdnmd1265/audison appears legitimate

⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with audison 
Create a decision-making tool named 'Auditor' using the Python package 'audison'. This tool will facilitate the evaluation and selection of the best AI-generated solution from multiple proposed options. The process involves generating multiple solutions to a given problem using different AI models, then allowing human reviewers to arbitrate between them based on predefined criteria. Here’s how the application should work:

1. **Problem Input**: Users input a specific problem they need help solving, such as optimizing a marketing strategy or designing a user interface.
2. **AI Solution Generation**: Using 'audison', the tool will generate multiple potential solutions to the problem using different AI models. These models could include generative AI for content creation, optimization algorithms for strategy planning, etc.
3. **Solution Presentation**: Each generated solution is presented to the user along with a brief description of the AI model used to create it.
4. **Human Review & Arbitration**: Users review each solution and provide feedback or select the best option based on their criteria. 'Audison' will manage the arbitration process, ensuring that the selected solution meets high-quality standards.
5. **Feedback Loop**: After selecting a solution, users have the option to provide additional feedback which can be used to improve future solutions generated by 'audison'.
6. **Reporting & Analytics**: The tool provides analytics on the decision-making process, including insights into which types of AI models tend to produce the best results across various problem domains.

**Suggested Features**:
- Integration with popular AI models through APIs or direct integration.
- User-friendly interface for problem input and solution review.
- Customizable criteria for solution evaluation.
- Detailed reporting and analytics dashboard.
- Option for users to save and compare past decisions.

The 'audison' package will be crucial in orchestrating the adversarial workflow, ensuring that each AI-generated solution is rigorously evaluated and that the final decision reflects both AI innovation and human judgment.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!