source/pkg/bundle/analyzer_shell.go

package bundle

// ShellAnalyzer inspects shell scripts (.sh/.bash and shebang-detected text).
// It is behavioral: a script that ships no suspicious indicator emits NO
// finding (presence != malice). High-confidence patterns — exfil co-occurring
// with env reads, curl|sh RCE, destructive commands, registry rewrites — come
// straight from the shared indicator vocabulary, plus a padding-evasion flag
// when the file was truncated at the read cap with a high newline ratio.
type ShellAnalyzer struct{}

func (ShellAnalyzer) Name() string { return "shell" }

func (ShellAnalyzer) Handles(kind FileKind) bool { return kind == KindShell }

func (ShellAnalyzer) Analyze(f *File, b *Bundle) ([]Finding, error) {
	if f == nil {
		return nil, nil
	}
	text := string(f.Sniff)
	out := sharedIndicatorScan(text, f.RelPath, "shell")
	if pe, ok := paddingEvasionFinding(f, "shell"); ok {
		out = append(out, pe)
	}
	return out, nil
}