Enum SuspicionKind 

pub enum SuspicionKind {
    ShellPipe,
    EvalDecode,
    CredentialFileRead,
    SecretEnvRead,
    ExfilEndpoint,
    BareIpHttp,
}

Why a script body got flagged. Each variant carries a one-line description for the user-facing warning and a category tag used by interactive surfaces (aube approve-builds picker labels) that need a short marker.

Ord / PartialOrd are derived (variant declaration order) so containers of Suspicion are sortable — needed by Vec<Suspicion>: Ord which in turn is needed by IgnoredEntry’s derived Ord.

Variants

ShellPipe

curl … | sh, wget … | bash, and friends — fetch a remote payload and pipe it to a shell.

EvalDecode

eval(atob(…)) / Function(atob(…)) — runtime decoding of a base64 string into executable code. Common dropper shape.

CredentialFileRead

Reads from ~/.ssh, ~/.aws, ~/.npmrc, ~/.config/gh — credential files a lifecycle script has no business touching.

SecretEnvRead

Reads process.env.*TOKEN, *SECRET, *API_KEY, etc. — secret-shaped env vars exfilled from CI.

ExfilEndpoint

discord.com/api/webhooks/, api.telegram.org/bot, OAST collaborator hosts (oast.pro, interactsh, webhook.site, pipedream.net, ngrok.io, …) — known exfil channels.

BareIpHttp

http://1.2.3.4/… — bare-IP HTTP target. Legitimate packages use DNS names; bare IPs are dropper / C2 staging.

Implementations

impl SuspicionKind

pub fn description(self) -> &'static str

pub fn category(self) -> &'static str

Short tag for compact UIs (picker labels). 1–2 words.

Trait Implementations

impl Clone for SuspicionKind

fn clone(&self) -> SuspicionKind

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for SuspicionKind

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Hash for SuspicionKind

fn hash<__H: Hasher>(&self, state: &mut __H)

Feeds this value into the given Hasher.

fn hash_slice<H>(data: &[Self], state: &mut H)

where H: Hasher, Self: Sized,

Feeds a slice of this type into the given Hasher.

impl Ord for SuspicionKind

fn cmp(&self, other: &SuspicionKind) -> Ordering

This method returns an Ordering between self and other.

fn max(self, other: Self) -> Self

where Self: Sized,

Compares and returns the maximum of two values.

fn min(self, other: Self) -> Self

where Self: Sized,

Compares and returns the minimum of two values.

fn clamp(self, min: Self, max: Self) -> Self

where Self: Sized,

Restrict a value to a certain interval.

impl PartialEq for SuspicionKind

fn eq(&self, other: &SuspicionKind) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl PartialOrd for SuspicionKind

fn partial_cmp(&self, other: &SuspicionKind) -> Option<Ordering>

This method returns an ordering between self and other values if one exists.

fn lt(&self, other: &Rhs) -> bool

Tests less than (for self and other) and is used by the < operator.

fn le(&self, other: &Rhs) -> bool

Tests less than or equal to (for self and other) and is used by the <= operator.

fn gt(&self, other: &Rhs) -> bool

Tests greater than (for self and other) and is used by the > operator.

fn ge(&self, other: &Rhs) -> bool

Tests greater than or equal to (for self and other) and is used by the >= operator.

impl Copy for SuspicionKind

impl Eq for SuspicionKind

impl StructuralPartialEq for SuspicionKind