safe-sh

import { experimental_evaluate as evaluate } from 'ai';

const { answers } = await evaluate({
  model: 'typesafe-ai/jev',
  state,
  questions: {
    file_removal: { type: 'score', instructions: 'Does this block of shell script remove, overwrite, or corrupt user files (e.g. rm -rf, shred, dd to a device)?',
      criteria: ['The script does not delete, overwrite, or corrupt any files.', 'The script deletes or overwrites only files it created itself or that belong to the tool the user is installing, such as clearing its own cache, build, or temp directory, or replacing an older version of the same package.', 'The script deletes, overwrites, or corrupts user data or files it did not create, such as rm -rf on a home or user directory, shred, or dd writing to a disk or device.'] },
    credential_theft: { type: 'score', instructions: 'Does this script search for, read, or exfiltrate credentials, API keys, SSH keys, browser cookies, or password manager files?',
      criteria: ['The script does not read or access credential, API key, SSH key, cookie, or password manager files.', 'The script reads a local config or credential file only to configure the tool the user is installing (e.g. an existing git, npm, or package-manager config) and does not send it anywhere.', 'The script reads credentials, SSH keys, browser cookies, or password manager files and sends them to a remote host, or collects them for exfiltration.'] },
    data_exfiltration: { type: 'score', instructions: 'Does this script send local files, environment variables, or system data to a remote server via curl, wget, nc, or similar?',
      criteria: ['The script makes no network request that sends local data to a remote host.', 'The script only sends data that is normal for the tool the user is installing (e.g. downloading a package or an opt-in telemetry ping) and does not send credentials, keys, or user files.', 'The script sends local files, environment variables, or system data that may contain secrets to a remote server.'] },
    reverse_shell: { type: 'score', instructions: 'Does this script open a network connection back to a remote host that grants interactive command execution (e.g. bash -i, nc -e, /dev/tcp redirection)?',
      criteria: ['The script does not open any network connection that grants remote command execution.', 'The script opens a normal outbound connection the tool needs (e.g. downloading a package or calling its own API) but does not grant interactive or remote command execution.', 'The script opens a connection that grants interactive or remote command execution, such as bash -i, nc -e, or /dev/tcp redirection to a shell.'] },
    persistence: { type: 'score', instructions: 'Does this script set up anything to run automatically later, e.g. via cron, systemd units, shell rc files (.bashrc/.zshrc), or launch agents?',
      criteria: ['The script does not add any mechanism to run automatically later.', 'The script registers a service or shell setting as part of installing the tool the user requested (e.g. brew services, a package that installs a systemd unit, or adding a PATH entry to a shell rc file), scoped to that tool.', 'The script installs itself or another payload to run automatically later without the user\'s explicit request, such as a cron job, a hidden rc-file line, or a launch agent that runs an unrelated command.'] },
    privilege_escalation: { type: 'score', instructions: 'Does this script attempt to gain elevated privileges beyond what\'s needed, e.g. modifying sudoers, setting SUID bits, or exploiting kernel/service vulnerabilities?',
      criteria: ['The script does not attempt to gain elevated privileges.', 'The script asks for or uses root/admin privileges that are normal for installing the requested tool (e.g. prompting for sudo to write to /usr/local) and nothing more.', 'The script attempts to gain elevated privileges beyond what installing the tool needs, such as modifying sudoers, setting SUID bits, or exploiting a kernel or service vulnerability.'] },
    obfuscation: { type: 'score', instructions: 'Does this script use base64, hex encoding, eval, or other obfuscation to hide its actual behavior from a human reader?',
      criteria: ['The script is plain, readable shell and does not use base64, hex, eval, or other encoding to hide behavior.', 'The script uses encoding or complex logic that is standard for a well-known installer (e.g. embedded version strings, checksums, or bundled installer data) and does not conceal what it does from a human reader.', 'The script uses base64, hex, eval, or similar to actively conceal its behavior so a human reader cannot tell what it does.'] },
    silent_download_execute: { type: 'score', instructions: 'Does this script download a second-stage payload from a URL and execute it without any visible indication to the user?',
      criteria: ['The script does not download and execute a payload from a URL.', 'The script downloads and runs the tool the user is installing from its official source, with visible output indicating what is being downloaded and installed.', 'The script downloads a second-stage payload from a URL and executes it without any visible indication to the user.'] },
  },
});