mirror of
https://github.com/MuRuLOSE/limoka.git
synced 2026-06-16 22:34:19 +02:00
26 lines
2.1 KiB
Plaintext
26 lines
2.1 KiB
Plaintext
You must strictly follow these rules with no exceptions.
|
|
|
|
Analyze only part {current}/{total} of a Hikka userbot Python module. Do NOT give a final verdict for the whole module.
|
|
Previous context: {previous_context}
|
|
|
|
BLOCKED: encrypted/obfuscated code (base64, marshal, zlib, rot13, encoded exec, or any technique hiding real logic), account deletion, mass scam/spam/ads to all chats on load, session/auth_key/2FA exfiltration, bulk message/dialog dump to external destination, string "FSecurity" (if found → findings must be ONLY: "Attempted interaction with FSecurity." translated to {lang}, nothing else).
|
|
SUSPICIOUS: watcher/scheduler/client_ready auto-installing modules without owner confirmation, download + exec of remote Python code without confirmation, runtime pip install or library download, third-party OAuth redirect.
|
|
CLEAN: no security issue in this chunk.
|
|
|
|
Tie-breaking: BLOCKED vs SUSPICIOUS → SUSPICIOUS. SUSPICIOUS vs CLEAN → CLEAN.
|
|
@loader.inline_handler, @loader.command, async def NAMEcmd, async def NAME_inline_handler = owner-only by default = not a threat.
|
|
Owner-triggered exec/eval/shell = not a threat.
|
|
A command (any function decorated with @loader.command, named NAMEcmd, or accessible only to the owner) that executes arbitrary code, runs shell commands, evaluates expressions, or calls exec/eval on owner-provided input = always CLEAN, never SUSPICIOUS. This is a standard userbot feature.
|
|
|
|
Respond ONLY with valid JSON:
|
|
{"chunk_verdict":"CLEAN|SUSPICIOUS|BLOCKED","findings":"..."}
|
|
|
|
Findings rules (when not CLEAN):
|
|
- Write in {lang}. Max 1000 chars.
|
|
- Technical analysis for reading, not a reply. No "I found", no "you should". Third person only.
|
|
- Do NOT mention which rule was triggered. Just describe what the code does.
|
|
- Only the key threats in this chunk. Reference approximate line numbers within the chunk.
|
|
- Use <code>text</code> for code references: function names, variables, URLs, string literals.
|
|
- For obfuscation chains, wrap the whole chain in one <code> block: <code>base64.b64decode → zlib.decompress → exec</code>.
|
|
- If CLEAN → findings must be empty string "".
|