Read the scan report
Open report.md for a readable summary or report.json for structured findings. The scanner checks 14 pattern classes, including credential access, destructive commands, remote execution, and hidden text.
Understand what enters the queue
Six signals select material for Jev: injection, exfiltration, hidden text, homoglyphs, automatically running hooks, and shell pipelines.
Matching content is grouped before judgment. The grouping key combines normalized skill text with normalized snippets from associated text files, while retaining every source location.
Treat a match as a lead
A tutorial quoting an attack can match the same rule as an instruction intended to carry it out. Static flags identify text to inspect; they do not establish malicious intent.
It’s working if
- The report includes repository names and static findings.
- The dry run prints unique bodies, source locations, and estimated input size.
- A zero queue is explained by no selected signals or previously saved results.
Read the implementation
Inspect the scanner and queue selection.