Add insecure sample script for testing detectors - #355

Open

powerexploit wants to merge 2 commits into

GitHub Advanced Security / Rudra failed Jul 13, 2026 in 2s

4 new alerts including 4 errors

New alerts in code changed by this pull request

4 errors

See annotations below for details.

View all branch alerts.

Annotations

Check failure on line 11 in Calculator_GUI/sample.py

Code scanning / Rudra

Hardcoded OpenAI API key Error

[LLM02:2025] A live-looking provider credential is committed in source. Anyone with repo access (or a leak) can run up cost and access your data. Remediation: Remove the key, rotate it immediately, and load it from an environment variable or secrets manager. Add a pre-commit secret scanner.
(Rudra score 8.6/10, confidence 0.95)

Check failure on line 26 in Calculator_GUI/sample.py

Code scanning / Rudra

Unsafe deserialization of a model/artifact Error

[LLM04:2025] pickle/dill executes arbitrary code on load. A poisoned model or cache file becomes code execution the moment it is loaded. Remediation: Load model weights with safetensors or torch.load(..., weights_only=True). Never unpickle data from an untrusted or network source.
(Rudra score 6.8/10, confidence 0.9)

Check failure on line 30 in Calculator_GUI/sample.py

Code scanning / Rudra

Agent loads dangerous tools: terminal Error

[LLM06:2025] These tools give the agent shell/HTTP/code capabilities exploitable via injection. Remediation: Drop the dangerous tools or replace with narrowly-scoped, audited equivalents.
(Rudra score 6.1/10, confidence 0.8)

Check failure on line 31 in Calculator_GUI/sample.py

Code scanning / Rudra

Agent granted a high-privilege tool (PythonREPLTool) Error

[LLM06:2025] The agent can execute shell/Python. Combined with prompt injection this is remote code execution with the app's privileges. Remediation: Remove code/shell execution tools, or sandbox them and require human approval for each invocation. Apply least privilege to the tool set.
(Rudra score 6.1/10, confidence 0.8)