Text Classification
Scikit-learn
shell-security
shell-risk
bash
powershell
cmd
coding-agents
tf-idf
logistic-regression
cpu
research
cat-shell-risk-commander
shell-command-classification
shell-command-security
shell-risk-classification
command-risk-detection
agent-security
ai-agent-security
ai-security
tool-call-security
tool-security
posix
windows
linux
powershell-security
tfidf
shell-token-features
binary-classification
local-inference
on-device
cpu-inference
scikit-learn
json-model
a1
Eval Results (legacy)
Commit History
Today
-
run G: benign gh/git publish-command negatives
Verified signatureRoutine gh pr/issue/release create, gh pr merge and git push/tag are no longer flagged. Thresholds external_commands_1pct_fpr 0.475, block_0_1pct_fpr 2.518. Same shell_tokens tokenizer, format_version 2.30d77a8 -
run F: relations + heredoc masking + dosed agent and ops data
Verified signatureThresholds external_commands_1pct_fpr 0.519063, block_0_1pct_fpr 2.697449. Same format_version 2; runtimes without the shell_tokens heredoc masking must stay pinned to the previous revision.d9f4509
Yesterday
-
A1 + relations + heredoc masking (run D)
Verified signatureshell_tokens.features() no longer tokenises heredoc bodies fed to python/node/ruby/perl or written by cat/tee to code/data files as shell. Retrained with 5,276 mined benign agent code commands (Kwai-Klear/SWE-smith-mini_swe_agent_plus-trajectories-66k, MIT) and 191 synthetic negatives. Thresholds: external_commands_1pct_fpr 0.364353, block_0_1pct_fpr 2.889838. Same format_version 2; runtimes without the heredoc masking must stay pinned to f6243388.92aae0e -
A1 + download-execution relation markers (issue #159)
Verified signatureshell_tokens.features() now appends DL->PIPE->INTERP, DL->SUBST->INTERP, DL->FILE->EXEC, DL->PIPE->FILTER and DL->FILE. Same format_version 2; runtimes without the markers must stay pinned to 2ba751f9. Thresholds: external_commands_1pct_fpr 0.614926, block_0_1pct_fpr 2.538794.52a252b
3 days ago
-
Release A1 (format_version 2): char_wb + shell_tokens two-block model
Verified signatureAdds shell_tokens second TF-IDF block; fixes curl|jq false positive and reverse-shell gap (issue #128). Runtime support: patronus-protect/patronus-security#153.2ba751f
17 days ago
-
Add private Cat Shell Risk Commander preview with verified JSON inference and model card
Verified signaturefddb730