PyPI / fsspec / 2026.9.0

fsspec 2026.9.0

Source: https://github.com/fsspec/filesystem_spec
Tag scanned: 2026.9.0
Compared with: 2026.7.0 (0 signals introduced since)
Files: 141 scanned, 10 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 76 info
Scan time: 60.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 76 of 76 warn and critical signals; 76 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 18:16

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review decoder-decompress-payload fsspec/compression.py:137:16

file imports decoder module(s) bz2, gzip, lzma and calls `.decompress()` — embedded payload decompressed at runtime (ast pass, confidence 0.75)
```
        data = self.infile.read(end - start)
        return self.codec.decompress(data)
```
likely benign LLM, confidence 0.90 Codec wrapper in fsspec that decompresses data read from a file stream using the bz2/gzip/lzma module it was configured with.
Reasoning
The file is a compression wrapper for fsspec that implements random-access reads over bz2, gzip and lzma streams. Calling self.codec.decompress on bytes read from the file's own input is the expected behaviour of a decompression library, not a hidden payload. The ast signal fires on the generic combination of decoder imports and .decompress() calls.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_listing.yaml:73:9

base64-like blob (180 bytes over 3 lines, compression ratio 0.93) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzMOw7CMAwA0Lt4jhQX8VMOwAUYURWVxBFGFEe2Wah6dyrWN7wFGr/IIN0W6JM/
        IEG8bHJ1UYrNrFPJ9d4sdpUnFc8q4hCALVdWSK4fCv8kG38JEgaYpXLjMjnLOzvPmw6nw2444x6P
        iLiO6w8AAP//AwBhkoZWeAAAAA==
```
likely benign LLM, confidence 0.90 Base64-encoded gzip-compressed HTTP response body recorded in a DBFS test cassette.
Reasoning
The blob starts with H4sI, the base64 prefix for a gzip stream. It sits in a VCR cassette, which is a recorded HTTP response body stored in a YAML test fixture. Gzip-compressed API responses are normal in such recordings, and the file is test data rather than executable code.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_listing.yaml:178:9

base64-like blob (328 bytes over 5 lines, compression ratio 0.87) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAzyOUUvEMBCE/0rIs20VC7nek3BWuJcrtCcIIiFNtjXSduNuFI/j/rupBz4tw843
        M2cJREjaogO5lW3dNc/trtaPTd3pQ3PU9cu+O8obOQOzGVfPAcXgJxBIwnkCG5FOAn48Rxa4iGDi
        uyiekqNLHygG5gBWu37gIhB+JEATYixmz+yXUf+H5KnGQTR+Yrl9PcuHeApr4XryEXGcwATPucW5
```
likely benign LLM, confidence 0.90 Base64 gzip-compressed HTTP response body stored in a DBFS test cassette.
Reasoning
The blob is a base64 gzip stream (H4sI prefix) inside a VCR cassette. It is a recorded HTTP response in a test fixture, which is the standard way these tests store responses. The raw-pass signal is a generic encoding match.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_mkdir.yaml:73:9

base64-like blob (236 bytes over 4 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5zQTQrCMBAF4LvMOmBSJ/3JAbyAS5GQNgmOWFuScaGld7d1bTfdPngfjzdBpEfI
        YC4TjI5vYOBwWpIzDykcYs5j6KxvYwYBlK2nBIbTK4hfz2b6BDBSQD94itQ5puFpmfolVZUuVC1R
        llLKWfzz7y7tglHquqjKYhPu396x27MZm6rEo1KbNLt2PWzHHUo3qLHBlb7OXwAAAP//AwCF/1Z8
```
likely benign LLM, confidence 0.90 Base64 gzip-compressed HTTP response body recorded for a DBFS mkdir test.
Reasoning
This is a base64 gzip stream (H4sI prefix) with a !!binary tag inside a VCR test cassette. It is a recorded HTTP response body, not code, and the high compression ratio is typical of recorded JSON responses.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_mkdir.yaml:130:9

base64-like blob (300 bytes over 4 lines, compression ratio 0.87) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAySMUUvDMBSF/0rIs01V2ozuSdAKe1mhnSCIhCy5rYG2t95EsYz9d2/Z0+Fwvu9c
        JBAhGYce5F62dde8tc+1eWnqzhybk6nfD91J3skJYrTDxhxR9GEEgSR8IHAJaRXwF2KKAmex2PQl
        8lcmOl4gn9acMcUXHpINY5T7j4t8SuuynW2hBsRhBLuEqBxO+a0qWpxq4fsHYjrMPfIB3ZoJns37
```
likely benign LLM, confidence 0.90 Base64 gzip-compressed HTTP response body in a DBFS mkdir test cassette.
Reasoning
The value is a base64 gzip stream (H4sI prefix) stored under !!binary in a VCR cassette. This is a recorded HTTP response in test data, consistent with the other cassette blobs in the same file.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_mkdir.yaml:236:9

base64-like blob (244 bytes over 4 lines, compression ratio 0.90) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5zRTQ7CIBAF4LvMmqSA0B8O4AVcGkNogTjGSgO40KZ3t3VtXbB9yXx5eTODx7tL
        oM4zTCZfQUF1XJNTDtFVPqXJDdr2PgEBTNpiBJXj05HvnU74dqAogTFY9DiYjOGhM45ryhrJWUsF
        rSmlC/nl30wsggWVLW9qvguPr9K+jHP2h7UmmxJadE0tDmyfzqbf/lCwMpOdkKITW+vL8gEAAP//
```
likely benign LLM, confidence 0.90 Base64 gzip-compressed HTTP response body in a DBFS mkdir test cassette.
Reasoning
The blob is a base64 gzip stream with an H4sI header in a VCR cassette, a recorded HTTP response in a test fixture. The raw-pass encoding flag does not indicate malicious content.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_mkdir.yaml:293:9

base64-like blob (164 bytes over 3 lines, compression ratio 0.95) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA6pWSsvMSS1WsoquVipILMlQslLSdwOKBJfkF6Xq51bqp2QWKekoZRbHgxhWJUWl
        qTpgLfHFmVWpSlYGOkq5+SmZaZnJiSWZ+XnxJZm5QFFDc1MjQwtDIyNDAwOD2thaAAAAAP//AwCJ
        NH9UZgAAAA==
```
likely benign LLM, confidence 0.90 Base64 gzip-compressed HTTP response body in a DBFS mkdir test cassette.
Reasoning
This is a base64 gzip stream (H4sI prefix) in a VCR cassette used for testing. It is recorded response data in a YAML fixture, not an executed payload.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_mkdir.yaml:349:9

base64-like blob (152 bytes over 2 lines, compression ratio 0.95) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA6pWKkgsyVCyUtJ3y8xJDS7JL0rVz63UT8ksUtJRyiyOBzGsSopKU3WU0oAK4osz
        q1KVrAx0lHLzUzLTMpMTSzLz8+JLMnOBoobmpkaGFoZGRoYGBga1AAAAAP//AwB/E7r0WgAAAA==
    headers:
```
likely benign LLM, confidence 0.90 Base64 gzip-compressed HTTP response body in a DBFS mkdir test cassette.
Reasoning
The value is a base64 gzip stream inside a VCR test cassette. It is recorded HTTP response data for a test, and nothing in the YAML executes it.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_mkdir.yaml:404:9

base64-like blob (548 bytes over 8 lines, compression ratio 0.81) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA7SR3WrcMBCFX0XooleWLXsl/0FIL+pCoHRhu1fplkW2Ro7BthxpvMGEvHvlhPQN
        qhsxks6ZT3NeKThn3bWzGmhNH47X5nQ6nmhEJ/Be9fvhcQGncLAzMWoYQdfkQs9PQBx0q/PDDcjz
        Cm4ji3JqAgRHbmpcgUyrR9ICQRcKtETDGG6JIrOdGUwLbkQPwQSt2+ILjYjgVUS+NT+acxORJ8TF
```
likely benign LLM, confidence 0.90 Base64 gzip-compressed HTTP response body in a DBFS mkdir test cassette.
Reasoning
This is a base64 gzip stream (H4sI prefix) stored as !!binary in a VCR cassette. It is a recorded HTTP response fixture for a test, not a dropper or executable payload.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_mkdir.yaml:465:9

base64-like blob (244 bytes over 4 lines, compression ratio 0.90) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5zRTQ7CIBAF4LvMmqSA0B8O4AVcGkNogTjGSgO40KZ3t3VtXbB9yXx5eTODx7tL
        oM4zTCZfQUF1XJNTDtFVPqXJDdr2PgEBTNpiBJXj05HvnU74dqAogTFY9DiYjOGhM45ryhrJWUsF
        rSmlC/nl30wsggWVLW9qvguPr9K+jHP2h7UmmxJadE0tDmyfzqbf/lCwMpOdkKITW+vL8gEAAP//
```
likely benign LLM, confidence 0.95 Gzip-compressed HTTP response recorded in a DBFS mkdir test cassette.
Reasoning
The snippet is a YAML !!binary block holding a gzip-compressed HTTP response body (the H4sI prefix is a gzip header). This is standard VCR cassette recording for a test fixture, and the raw base64 signal is a false positive.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_mkdir.yaml:571:9

base64-like blob (236 bytes over 4 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5zQTQrCMBAF4LvMOmBSJ/3JAbyAS5GQNgmOWFuScaGld7d1bTfdPngfjzdBpEfI
        YC4TjI5vYOBwWpIzDykcYs5j6KxvYwYBlK2nBIbTK4hfz2b6BDBSQD94itQ5puFpmfolVZUuVC1R
        llLKWfzz7y7tglHquqjKYhPu396x27MZm6rEo1KbNLt2PWzHHUo3qLHBlb7OXwAAAP//AwCF/1Z8
```
likely benign LLM, confidence 0.95 Gzip-compressed HTTP response body stored in a test cassette.
Reasoning
Same pattern as the other cassette finding: a gzip-compressed recorded response in a YAML !!binary field inside a test fixture directory. No executable or dropper behaviour is present.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:73:9

base64-like blob (236 bytes over 4 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5zQTQrCMBAF4LvMOmBSJ/3JAbyAS5GQNgmOWFuScaGld7d1bTfdPngfjzdBpEfI
        YC4TjI5vYOBwWpIzDykcYs5j6KxvYwYBlK2nBIbTK4hfz2b6BDBSQD94itQ5puFpmfolVZUuVC1R
        llLKWfzz7y7tglHquqjKYhPu396x27MZm6rEo1KbNLt2PWzHHUo3qLHBlb7OXwAAAP//AwCF/1Z8
```
likely benign LLM, confidence 0.95 Gzip-compressed recorded HTTP body in a pyarrow read test cassette.
Reasoning
A gzip-compressed (H4sI) recorded HTTP response stored as YAML !!binary in a VCR cassette used by the dbfs read tests. Expected test data, not an obfuscated payload.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:130:9

base64-like blob (304 bytes over 4 lines, compression ratio 0.87) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAySN3WrDMAxGX8X4enHG0jZtrwZbCr1pIOlgMIpRbTU1pJErez+h9N3n0AshPvSd
        o5tEZmJtyKJcy6Zq64/mrdLvddXqXb3X1ee23csnecEQoJs6OxIn16MgFtYxmkg8CvxzIQZBg/AQ
        zyLfpEabLpj7EdKHX5UcFiO4Psj1102+xtFPtmmpjqjrEbwLytAlf0TF3qgGr98Y4nY4URLwI2ln
```
likely benign LLM, confidence 0.95 Gzip-compressed recorded response in a pyarrow read test cassette.
Reasoning
Another gzip-compressed YAML !!binary response in the same VCR cassette. The base64 flag is a byte-level false positive on recorded test traffic.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:187:9

base64-like blob (304 bytes over 4 lines, compression ratio 0.87) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAySNUWuDMBSF/0rIc40FZxv7VOgc9KWCdjAYJURzdQHrzW6yblL63xfp0+Vwzvfd
        OwciJNWhAb7jddlU7/WhVK9V2ahTdVblx7E58xW/gvd6WDYnZL0dgSExYwm6gDQz+LM+eIYTczp8
        sfQtLprYQOpmHT/8iugwELQdPd993vk+zG6xLUcMiMMI2lkvOrymzyjIdaKG7x/w4Tj1GAX0TMqa
```
likely benign LLM, confidence 0.95 Gzip-compressed recorded response in a pyarrow read test cassette.
Reasoning
Gzip-compressed recorded HTTP response in a VCR test fixture, with the same structure as the other cassette blobs. Benign test data.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:244:9

base64-like blob (316 bytes over 5 lines, compression ratio 0.86) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAySNy2rDMBBFf0VoHct5uE6cVaFxIZsY7BQKoYiJNXIFjkeV1KQm5N8rk9Vwufec
        uXN0jpxsSSHf8rpsqo/6rZS7qmzkoTrK8nPfHPmMX9B76KbNgZg2PTJyTBmHbSA3MvwzPnhGA7MQ
        vln6HhdNbDC1I8QPt1QZOGNAL6JMYQDTe7493flrGO2knY7oiLoewRovWrqkzyicbUWNP7/ow37Q
```
likely benign LLM, confidence 0.95 Gzip-compressed recorded response in a pyarrow read test cassette.
Reasoning
Gzip-compressed recorded HTTP response stored as YAML binary in a test cassette. Raw base64 detection on recorded traffic, not an encoded dropper.
info ~~warn~~ → info by review long-line fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:380:1

line length 5864 characters (raw pass, confidence 0.65)
```
    body: '{"handle": 5831327244878228, "data": "UEFSMRUEFdABFdABTBUaFQASAAABAAAAAAAAAAUAAAAAAAAACAAAAAAAAAAGAAAAAAAAAAoAAAAAAAAABAAAAAAAAAAMAAAAAAAAAA8AAAAAAAAACQAAAAAAAAANAAAAAAAAAAsAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABUAFTAVMCwVMhUQFQYVBhwYCBAAAAAAAAAAGAgAAAAAAAAAABYAKAgQAAAAAAAAABgIAAAAAAAAAAAAAAACAAAAMgEECRAyVAZVJnOHiUq
```
likely benign LLM, confidence 0.90 Recorded DBFS JSON response carrying a base64-encoded Parquet payload.
Reasoning
A long JSON body in a VCR cassette whose 'data' field is base64 of a Parquet file (the 'UEFSMQ' prefix decodes to PAR1). This is recorded API response data for a read test, with no executable code involved.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:499:9

base64-like blob (220 bytes over 3 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzNQQ6CMBBA0bvMGm0LRWgP4AVcGkOGdhonAYttjVHC3SVu/1v8FQJPlMFeV1iw
        3MGCOO/lUmIisXwwpfgWnnGkQlmYEaUONXnjjNaEWDtyoTv1mozrRnWQxwXT80UFKuA8eE5gA06Z
        qv9oyPwlsLppTQVz9BzYYeH4GArPO6iurVWv6qaXUm637QcAAP//AwChybKmnwAAAA==
```
likely benign LLM, confidence 0.95 Gzip-compressed recorded response in a pyarrow read test cassette.
Reasoning
Gzip-compressed recorded HTTP response in a YAML !!binary field of a test cassette. Standard recorded test data.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:555:9

base64-like blob (220 bytes over 3 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzNQQ6CMBBA0bvMGm0LRWgP4AVcGkOGdhonAYttjVHC3SVu/1v8FQJPlMFeV1iw
        3MGCOO/lUmIisXwwpfgWnnGkQlmYEaUONXnjjNaEWDtyoTv1mozrRnWQxwXT80UFKuA8eE5gA06Z
        qv9oyPwlsLppTQVz9BzYYeH4GArPO6iurVWv6qaXUm637QcAAP//AwChybKmnwAAAA==
```
likely benign LLM, confidence 0.95 Gzip-compressed recorded response in a pyarrow read test cassette.
Reasoning
Gzip-compressed recorded response in a VCR cassette, identical in content to the finding at line 499. Benign test fixture data.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:611:9

base64-like blob (220 bytes over 3 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzNQQ6CMBBA0bvMGm0LRWgP4AVcGkOGdhonAYttjVHC3SVu/1v8FQJPlMFeV1iw
        3MGCOO/lUmIisXwwpfgWnnGkQlmYEaUONXnjjNaEWDtyoTv1mozrRnWQxwXT80UFKuA8eE5gA06Z
        qv9oyPwlsLppTQVz9BzYYeH4GArPO6iurVWv6qaXUm637QcAAP//AwChybKmnwAAAA==
```
likely benign LLM, confidence 0.95 Base64-encoded gzip HTTP response body in a recorded test cassette.
Reasoning
The blob starts with H4sI, the base64 of a gzip header, and sits under a VCR cassette's !!binary response body. This is a recorded HTTP response from a test fixture, not executable or hidden code.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:667:9

base64-like blob (176 bytes over 3 lines, compression ratio 0.94) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzLQQrCMBBG4bvMOpCkUiw5gBfoskiIZoo/WFMmI1JL725w+/HeTjOeXClMO61J
        HxTIXpqMWoTtuiWR8rEZ6cbaMkOoMUMoqLzZ/OdY8WUKztBSMmbck6K8omJp6s995wffnQbn3HE9
        fgAAAP//AwDO0BaucAAAAA==
```
likely benign LLM, confidence 0.95 Base64-encoded gzip response body in a DBFS test cassette.
Reasoning
Same H4sI gzip base64 pattern inside a !!binary field of a VCR cassette. Typical recorded API response payload in a fsspec DBFS test.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:723:9

base64-like blob (176 bytes over 3 lines, compression ratio 0.94) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzLQQrCMBBG4bvMOpCkUiw5gBfoskiIZoo/WFMmI1JL725w+/HeTjOeXClMO61J
        HxTIXpqMWoTtuiWR8rEZ6cbaMkOoMUMoqLzZ/OdY8WUKztBSMmbck6K8omJp6s995wffnQbn3HE9
        fgAAAP//AwDO0BaucAAAAA==
```
likely benign LLM, confidence 0.95 Base64-encoded gzip response body in a recorded test cassette.
Reasoning
Identical gzip base64 blob to other entries in the same cassette, consistent with a recorded HTTP body. Raw-pass base64 hits on fixtures like this are expected false positives.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:779:9

base64-like blob (176 bytes over 3 lines, compression ratio 0.94) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzLQQrCMBBG4bvMOpCkUiw5gBfoskiIZoo/WFMmI1JL725w+/HeTjOeXClMO61J
        HxTIXpqMWoTtuiWR8rEZ6cbaMkOoMUMoqLzZ/OdY8WUKztBSMmbck6K8omJp6s995wffnQbn3HE9
        fgAAAP//AwDO0BaucAAAAA==
```
likely benign LLM, confidence 0.95 Base64-encoded gzip response body in a recorded test cassette.
Reasoning
Gzip base64 payload in a !!binary YAML field of a VCR cassette. Recorded test data, not obfuscated code.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:835:9

base64-like blob (176 bytes over 3 lines, compression ratio 0.94) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzLQQrCMBBG4bvMOpCkUiw5gBfoskiIZoo/WFMmI1JL725w+/HeTjOeXClMO61J
        HxTIXpqMWoTtuiWR8rEZ6cbaMkOoMUMoqLzZ/OdY8WUKztBSMmbck6K8omJp6s995wffnQbn3HE9
        fgAAAP//AwDO0BaucAAAAA==
```
likely benign LLM, confidence 0.95 Base64-encoded gzip response body in a recorded test cassette.
Reasoning
Repeats the same gzip-encoded recorded response body pattern. The file is a VCR cassette used for replaying HTTP interactions in tests.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:891:9

base64-like blob (220 bytes over 3 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzNQQ6CMBBA0bvMGm0LRWgP4AVcGkOGdhonAYttjVHC3SVu/1v8FQJPlMFeV1iw
        3MGCOO/lUmIisXwwpfgWnnGkQlmYEaUONXnjjNaEWDtyoTv1mozrRnWQxwXT80UFKuA8eE5gA06Z
        qv9oyPwlsLppTQVz9BzYYeH4GArPO6iurVWv6qaXUm637QcAAP//AwChybKmnwAAAA==
```
likely benign LLM, confidence 0.95 Base64-encoded gzip response body in a recorded test cassette.
Reasoning
Gzip base64 blob in a !!binary field of a VCR test cassette. The raw-pass base64 signal fires on ordinary recorded binary response data.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:947:9

base64-like blob (220 bytes over 3 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzNQQ6CMBBA0bvMGm0LRWgP4AVcGkOGdhonAYttjVHC3SVu/1v8FQJPlMFeV1iw
        3MGCOO/lUmIisXwwpfgWnnGkQlmYEaUONXnjjNaEWDtyoTv1mozrRnWQxwXT80UFKuA8eE5gA06Z
        qv9oyPwlsLppTQVz9BzYYeH4GArPO6iurVWv6qaXUm637QcAAP//AwChybKmnwAAAA==
```
likely benign LLM, confidence 0.95 Base64-encoded gzip response body in a recorded test cassette.
Reasoning
Same gzip-encoded response body in the VCR cassette. No executable context or decoding pipeline is involved.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:1003:9

base64-like blob (220 bytes over 3 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzNQQ6CMBBA0bvMGm0LRWgP4AVcGkOGdhonAYttjVHC3SVu/1v8FQJPlMFeV1iw
        3MGCOO/lUmIisXwwpfgWnnGkQlmYEaUONXnjjNaEWDtyoTv1mozrRnWQxwXT80UFKuA8eE5gA06Z
        qv9oyPwlsLppTQVz9BzYYeH4GArPO6iurVWv6qaXUm637QcAAP//AwChybKmnwAAAA==
```
likely benign LLM, confidence 0.95 Base64-encoded gzip response body in a recorded test cassette.
Reasoning
Gzip base64 payload within a YAML !!binary block of a test fixture recording a DBFS HTTP response. Benign test data.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:1060:9

base64-like blob (3540 bytes over 47 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5xYW7OquBL+L/t1nSrRpWvpvCXcBG8EIQgvp/CyQRHxshRx6vz30wmasHfNqpka
        qqJNku7+0v0laf3zx7L62lz+e97E6x9/dN97g//8WMdf8Y8/fvi6MZ+48LlGmDUP+7FB0BwhhKE9
        H/8lIFVIyJRiIcSG0kR0or4QVSLEqZDQRYpSIkLEPjI8RCdqSSepTwwSUpyWodpwZqJETEc4RCOU
```
likely benign LLM, confidence 0.95 Larger base64-encoded gzip response body in a recorded test cassette.
Reasoning
Larger gzip base64 blob in a VCR cassette !!binary field, with the same H4sI header and recorded-response structure. Consistent with legitimate test fixture data.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:1160:9

base64-like blob (220 bytes over 3 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzNQQ6CMBBA0bvMGm0LRWgP4AVcGkOGdhonAYttjVHC3SVu/1v8FQJPlMFeV1iw
        3MGCOO/lUmIisXwwpfgWnnGkQlmYEaUONXnjjNaEWDtyoTv1mozrRnWQxwXT80UFKuA8eE5gA06Z
        qv9oyPwlsLppTQVz9BzYYeH4GArPO6iurVWv6qaXUm637QcAAP//AwChybKmnwAAAA==
```
likely benign LLM, confidence 0.95 Recorded gzip-compressed HTTP response body stored as base64 in a test cassette.
Reasoning
The file is a VCR-style HTTP cassette. The !!binary value starts with H4sI, the base64 of a gzip header, so it is a recorded gzip-compressed API response body. Raw-pass base64 hits on such fixtures are expected noise.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:1216:9

base64-like blob (220 bytes over 3 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzNQQ6CMBBA0bvMGm0LRWgP4AVcGkOGdhonAYttjVHC3SVu/1v8FQJPlMFeV1iw
        3MGCOO/lUmIisXwwpfgWnnGkQlmYEaUONXnjjNaEWDtyoTv1mozrRnWQxwXT80UFKuA8eE5gA06Z
        qv9oyPwlsLppTQVz9BzYYeH4GArPO6iurVWv6qaXUm637QcAAP//AwChybKmnwAAAA==
```
likely benign LLM, confidence 0.95 Duplicate recorded gzip response body in a DBFS test cassette.
Reasoning
Identical blob to the finding at line 1160, a gzip body (H4sI prefix) recorded in a test cassette. It is test data for the DBFS mock, not executable or hidden payload.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:1273:9

base64-like blob (3540 bytes over 47 lines, compression ratio 0.76) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5xYW7OquBL+L/t1nSrRpWvpvCXcBG8EIQgvp/CyQRHxshRx6vz30wmasHfNqpka
        qqJNku7+0v0laf3zx7L62lz+e97E6x9/dN97g//8WMdf8Y8/fvi6MZ+48LlGmDUP+7FB0BwhhKE9
        H/8lIFVIyJRiIcSG0kR0or4QVSLEqZDQRYpSIkLEPjI8RCdqSSepTwwSUpyWodpwZqJETEc4RCOU
```
likely benign LLM, confidence 0.95 Larger recorded gzip response body stored as base64 in a test cassette.
Reasoning
A longer gzip-encoded (H4sI) binary body in a VCR cassette YAML file. It is a recorded HTTP response, a standard fixture pattern, with no decoding or execution path in the code.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_pyarrow_non_partitioned.yaml:1422:9

base64-like blob (236 bytes over 4 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5zQTQrCMBAF4LvMOmBSJ/3JAbyAS5GQNgmOWFuScaGld7d1bTfdPngfjzdBpEfI
        YC4TjI5vYOBwWpIzDykcYs5j6KxvYwYBlK2nBIbTK4hfz2b6BDBSQD94itQ5puFpmfolVZUuVC1R
        llLKWfzz7y7tglHquqjKYhPu396x27MZm6rEo1KbNLt2PWzHHUo3qLHBlb7OXwAAAP//AwCF/1Z8
```
likely benign LLM, confidence 0.95 Recorded gzip-compressed response body in a DBFS cassette.
Reasoning
Another gzip (H4sI) base64 response body inside a recorded test cassette. Raw-pass entropy and base64 hits on compressed fixture data are false positives.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_range.yaml:73:9

base64-like blob (236 bytes over 4 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5zQTQrCMBAF4LvMOmBSJ/3JAbyAS5GQNgmOWFuScaGld7d1bTfdPngfjzdBpEfI
        YC4TjI5vYOBwWpIzDykcYs5j6KxvYwYBlK2nBIbTK4hfz2b6BDBSQD94itQ5puFpmfolVZUuVC1R
        llLKWfzz7y7tglHquqjKYhPu396x27MZm6rEo1KbNLt2PWzHHUo3qLHBlb7OXwAAAP//AwCF/1Z8
```
likely benign LLM, confidence 0.95 Recorded gzip response body in the DBFS read-range test cassette.
Reasoning
Same gzip-encoded response body pattern in a VCR cassette used for read-range tests. It is recorded test data with no code path that decodes or runs it.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_range.yaml:277:9

base64-like blob (264 bytes over 4 lines, compression ratio 0.88) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5yRzQ6CMBCE32XPRNra8tMH8AU8GkMKLXENCKFrohLeXetFTcQYrrPZbyYzI9TY
        OA96N0Jv6AAa4s1D2VI3uDjcVnQhiAB9YXEAXZvGu+j5VXi8OdBcRdB2FmusDGF3KgjbIKdK8IwL
        kTDGpugr3vveVYUta//mQMP504D94DPJ5vlHMywCS6YykSZiNnh7tYbMkswyTxO55nwWTaYMe7wK
```
likely benign LLM, confidence 0.95 Recorded gzip-compressed HTTP response in a test cassette.
Reasoning
A gzip (H4sI) base64 body recorded in a test cassette. The fixture is an HTTP response captured for replay, consistent with the file's purpose.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_range.yaml:334:9

base64-like blob (264 bytes over 4 lines, compression ratio 0.88) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5yRzQ6CMBCE32XPRNra8tMH8AU8GkMKLXENCKFrohLeXetFTcQYrrPZbyYzI9TY
        OA96N0Jv6AAa4s1D2VI3uDjcVnQhiAB9YXEAXZvGu+j5VXi8OdBcRdB2FmusDGF3KgjbIKdK8IwL
        kTDGpugr3vveVYUta//mQMP504D94DPJ5vlHMywCS6YykSZiNnh7tYbMkswyTxO55nwWTaYMe7wK
```
likely benign LLM, confidence 0.95 Recorded gzip response body duplicated in the DBFS read-range cassette.
Reasoning
Duplicate of the blob at line 277, a gzip response body in a VCR cassette. Test fixture data, not an obfuscated payload.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_range.yaml:391:9

base64-like blob (88 bytes over 2 lines, compression ratio 1.12) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA6pWSqosSS2OL0pNTFGyMtdRSkksSVSyUooMdjKIivAzcE63tVWqBQAAAP//AwA9
        si7rJgAAAA==
    headers:
```
likely benign LLM, confidence 0.95 Small recorded gzip response body in a DBFS test cassette.
Reasoning
Short gzip (H4sI) base64 body in a recorded HTTP response inside a test cassette. Consistent with captured API replay data and not executable.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_range.yaml:495:9

base64-like blob (236 bytes over 4 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5zQTQrCMBAF4LvMOmBSJ/3JAbyAS5GQNgmOWFuScaGld7d1bTfdPngfjzdBpEfI
        YC4TjI5vYOBwWpIzDykcYs5j6KxvYwYBlK2nBIbTK4hfz2b6BDBSQD94itQ5puFpmfolVZUuVC1R
        llLKWfzz7y7tglHquqjKYhPu396x27MZm6rEo1KbNLt2PWzHHUo3qLHBlb7OXwAAAP//AwCF/1Z8
```
likely benign LLM, confidence 0.95 Recorded gzip-compressed response body in the DBFS read-range cassette.
Reasoning
Gzip (H4sI) base64 response body in a VCR cassette, identical in form to other recorded fixtures in the same file. It is test data, and the raw-pass base64 signal is a false positive here.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_range_chunked.yaml:73:9

base64-like blob (236 bytes over 4 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5zQTQrCMBAF4LvMOmBSJ/3JAbyAS5GQNgmOWFuScaGld7d1bTfdPngfjzdBpEfI
        YC4TjI5vYOBwWpIzDykcYs5j6KxvYwYBlK2nBIbTK4hfz2b6BDBSQD94itQ5puFpmfolVZUuVC1R
        llLKWfzz7y7tglHquqjKYhPu396x27MZm6rEo1KbNLt2PWzHHUo3qLHBlb7OXwAAAP//AwCF/1Z8
```
dismissed LLM, confidence 0.95 Base64-encoded gzip HTTP response body recorded in a test cassette.
Reasoning
This is a gzip-compressed (H4sI header) base64 blob stored as !!binary in a recorded VCR cassette for DBFS tests. It is an ordinary recorded HTTP response body, and the raw pass has a high false-positive rate on such data. No execution or hidden payload is involved.
info ~~warn~~ → info by review long-line fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_range_chunked.yaml:158:1

line length 1398156 characters (raw pass, confidence 0.65)
```
    body: '{"handle": 5831327195375276, "data": "VGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyB
```
dismissed LLM, confidence 0.95 Very long recorded JSON response line holding base64 of repeated test text.
Reasoning
The long line is a recorded JSON API response from the DBFS read endpoint. Its data field is base64 of the repeated plaintext 'This is a test', so the length comes from the fixture's repetitive test content, not from obfuscation.
info ~~warn~~ → info by review long-line fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_range_chunked.yaml:207:1

line length 1398156 characters (raw pass, confidence 0.65)
```
    body: '{"handle": 5831327195375276, "data": "aGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGE
```
dismissed LLM, confidence 0.95 Long recorded JSON response with base64 of repeated test text in a VCR cassette.
Reasoning
This is another recorded DBFS read response in a test cassette. The base64 data decodes to repeated benign test text, and the file is a VCR fixture, so the long-line signal is a fixture artifact.
info ~~warn~~ → info by review long-line fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_range_chunked.yaml:256:1

line length 1398156 characters (raw pass, confidence 0.65)
```
    body: '{"handle": 5831327195375276, "data": "aXMgaXMgYSB0ZXN0ClRoaXMgaXMgYSB0ZXN0ClRoaXMgaXMgYSB0ZXN0ClRoaXMgaXMgYSB0ZXN0ClRoaXMgaXMgYSB0ZXN0ClRoaXMgaXMgYSB0ZXN0ClRoaXMgaXMgYSB0ZXN0ClRoaXMgaXMgYSB0ZXN0ClRoaXMgaXMgYSB0ZXN0ClRoaXMgaXMgYSB0ZXN0ClRoaXMgaXMgYSB0ZXN0ClRoaXMgaXMgYSB0ZXN0ClRoaXMgaXMgYSB0ZXN0ClRoaXMgaXMgYSB
```
dismissed LLM, confidence 0.95 Long recorded DBFS read response with repetitive base64 test data.
Reasoning
Same pattern as the other chunked-read recordings: a large JSON body whose base64 data is repetitive plain test content. The file is a test cassette, so this is not malicious.
info ~~warn~~ → info by review long-line fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_range_chunked.yaml:305:1

line length 1048656 characters (raw pass, confidence 0.65)
```
    body: '{"handle": 5831327195375276, "data": "cyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHR
```
dismissed LLM, confidence 0.95 Long recorded DBFS chunk response with base64 test payload.
Reasoning
A recorded DBFS chunk response in a test fixture. The body is repetitive base64 of benign test text, and the line length reflects the size of the recorded chunk.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_range_chunked.yaml:424:9

base64-like blob (276 bytes over 4 lines, compression ratio 0.88) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5yRTQ6CMBCF7zLrRlpoQTiAF3BpTFNoqzUgpB0TlXB3wRUmYgzbl8z3fqYH62oT
        oDj00Ck8QwHRblT22HoT2RA6U0ld2gAEXJDaeSjQ3wx538ngngYKSqBptbOuUujaq0TXjCrLRMy2
        lNOUUjqQb/yL8qvAnIptnKXxIrhW/mTkVG2Dd5xlt6oOn+GTPJli/qjA4oQtOjUPrVDNHP5eh+dZ
```
dismissed LLM, confidence 0.95 Gzip-compressed base64 HTTP response in a test cassette.
Reasoning
A gzip-compressed base64 response body stored as !!binary in a VCR cassette. This is standard recorded HTTP data for tests and contains no executable logic.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_range_chunked.yaml:481:9

base64-like blob (276 bytes over 4 lines, compression ratio 0.88) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5yRTQ6CMBCF7zLrRlpoQTiAF3BpTFNoqzUgpB0TlXB3wRUmYgzbl8z3fqYH62oT
        oDj00Ck8QwHRblT22HoT2RA6U0ld2gAEXJDaeSjQ3wx538ngngYKSqBptbOuUujaq0TXjCrLRMy2
        lNOUUjqQb/yL8qvAnIptnKXxIrhW/mTkVG2Dd5xlt6oOn+GTPJli/qjA4oQtOjUPrVDNHP5eh+dZ
```
dismissed LLM, confidence 0.95 Gzip-compressed base64 HTTP response body in a test cassette.
Reasoning
Identical to the earlier gzip blob in this cassette: a recorded compressed HTTP body in a test fixture. The raw pass flags it on entropy alone.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_read_range_chunked.yaml:1382:9

base64-like blob (236 bytes over 4 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5zQTQrCMBAF4LvMOmBSJ/3JAbyAS5GQNgmOWFuScaGld7d1bTfdPngfjzdBpEfI
        YC4TjI5vYOBwWpIzDykcYs5j6KxvYwYBlK2nBIbTK4hfz2b6BDBSQD94itQ5puFpmfolVZUuVC1R
        llLKWfzz7y7tglHquqjKYhPu396x27MZm6rEo1KbNLt2PWzHHUo3qLHBlb7OXwAAAP//AwCF/1Z8
```
dismissed LLM, confidence 0.95 Gzip-compressed base64 HTTP response body in a test cassette.
Reasoning
Same 236-byte gzip blob as an earlier entry, recorded as a !!binary HTTP body in a VCR cassette. It is ordinary test fixture data.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_write_and_read.yaml:73:9

base64-like blob (236 bytes over 4 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5zQTQrCMBAF4LvMOmBSJ/3JAbyAS5GQNgmOWFuScaGld7d1bTfdPngfjzdBpEfI
        YC4TjI5vYOBwWpIzDykcYs5j6KxvYwYBlK2nBIbTK4hfz2b6BDBSQD94itQ5puFpmfolVZUuVC1R
        llLKWfzz7y7tglHquqjKYhPu396x27MZm6rEo1KbNLt2PWzHHUo3qLHBlb7OXwAAAP//AwCF/1Z8
```
dismissed LLM, confidence 0.95 Gzip-compressed base64 HTTP response in a DBFS test cassette.
Reasoning
A gzip-compressed base64 blob stored as !!binary in a recorded DBFS write-and-read cassette. It is a recorded HTTP response for testing and contains no executable or hidden payload.
info ~~warn~~ → info by review long-line fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_write_and_read.yaml:158:1

line length 1398156 characters (raw pass, confidence 0.65)
```
    body: '{"handle": 5831327279713389, "data": "VGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyBhIHRlc3QKVGhpcyBpcyB
```
dismissed LLM, confidence 0.93 Long base64-encoded test payload in a recorded HTTP response body.
Reasoning
The line is a recorded DBFS API response in a VCR cassette, with base64 of repeated plaintext 'This is a test'. It is test fixture data from a raw, low-signal pass, not code.
info ~~warn~~ → info by review long-line fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_write_and_read.yaml:207:1

line length 601980 characters (raw pass, confidence 0.65)
```
    body: '{"handle": 5831327279713389, "data": "aGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGEgdGVzdApUaGlzIGlzIGE
```
dismissed LLM, confidence 0.93 Long base64 test-data body in a recorded HTTP response.
Reasoning
Same cassette, a recorded DBFS read response whose base64 decodes to repeated 'this is a test' text. This is expected test data with no execution path.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_write_and_read.yaml:326:9

base64-like blob (268 bytes over 4 lines, compression ratio 0.89) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5yRTQ7CIBCF7zJrYgGhPxzAC7g0htACEdPaBtBEm95dcaMm1phu5818b/LeCNa1
        JoDYjTCoeAAB2eYx2cbemyxpqyZcAIELUjsPwqo2GPS8ksHdDAjCMcYUI+h67axrVHT9SUbXJa3g
        lJSE0rQzoa8eIQymkbq24c0m+vOnyy8+Zjif5R+VXwRmmJe0yOksuLtqFdWSn1lV5GxNyCw6qjqV
```
likely benign LLM, confidence 0.92 Gzip-compressed recorded HTTP response body in a YAML cassette.
Reasoning
The H4sI prefix is a gzip header. This is a recorded compressed HTTP response body stored as !!binary in a VCR cassette, a standard way to record gzip-encoded responses. Not a dropper.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_write_and_read.yaml:383:9

base64-like blob (268 bytes over 4 lines, compression ratio 0.89) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5yRTQ7CIBCF7zJrYgGhPxzAC7g0htACEdPaBtBEm95dcaMm1phu5818b/LeCNa1
        JoDYjTCoeAAB2eYx2cbemyxpqyZcAIELUjsPwqo2GPS8ksHdDAjCMcYUI+h67axrVHT9SUbXJa3g
        lJSE0rQzoa8eIQymkbq24c0m+vOnyy8+Zjif5R+VXwRmmJe0yOksuLtqFdWSn1lV5GxNyCw6qjqV
```
likely benign LLM, confidence 0.92 Gzip-compressed recorded HTTP response body in a YAML cassette.
Reasoning
Identical gzip-compressed !!binary response body in the same cassette file, consistent with recorded HTTP traffic from the test suite.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_write_and_read.yaml:825:9

base64-like blob (236 bytes over 4 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5zQTQrCMBAF4LvMOmBSJ/3JAbyAS5GQNgmOWFuScaGld7d1bTfdPngfjzdBpEfI
        YC4TjI5vYOBwWpIzDykcYs5j6KxvYwYBlK2nBIbTK4hfz2b6BDBSQD94itQ5puFpmfolVZUuVC1R
        llLKWfzz7y7tglHquqjKYhPu396x27MZm6rEo1KbNLt2PWzHHUo3qLHBlb7OXwAAAP//AwCF/1Z8
```
likely benign LLM, confidence 0.92 Gzip-compressed recorded HTTP response body in a YAML cassette.
Reasoning
Gzip header with a recorded binary HTTP response inside a VCR cassette. Recorded test traffic, not executable content.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_write_pyarrow_non_partitioned.yaml:73:9

base64-like blob (236 bytes over 4 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5zQTQrCMBAF4LvMOmBSJ/3JAbyAS5GQNgmOWFuScaGld7d1bTfdPngfjzdBpEfI
        YC4TjI5vYOBwWpIzDykcYs5j6KxvYwYBlK2nBIbTK4hfz2b6BDBSQD94itQ5puFpmfolVZUuVC1R
        llLKWfzz7y7tglHquqjKYhPu396x27MZm6rEo1KbNLt2PWzHHUo3qLHBlb7OXwAAAP//AwCF/1Z8
```
likely benign LLM, confidence 0.92 Gzip-compressed recorded HTTP response body in a test cassette.
Reasoning
Gzip-compressed !!binary body in a VCR cassette for a pyarrow DBFS write test. This is a recorded HTTP response, not obfuscated code.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_write_pyarrow_non_partitioned.yaml:130:9

base64-like blob (304 bytes over 4 lines, compression ratio 0.87) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAySNwWrDMBBEf0XoXMuto2KaU6F1IJcY7AQKpYi1tHYEjleV1CYm5N8jk9MyzLy3
        V47ek1eaDPI1b6q2PjQflfqsq1bt6r2qvrbtnj/xE4YAw7LZEevtiIw8M9ajjuRnhhcbYmA0MQfx
        yPJNWrSpwdzNkD6cRXIYjGDHwNffV/4eZ7fYliMGomFEcDYITaf8EYV3WjT4+4chbqeeksA/krIm
```
likely benign LLM, confidence 0.92 Gzip-compressed recorded HTTP response body in a test cassette.
Reasoning
Gzip-encoded binary response recorded in a VCR cassette for a DBFS pyarrow test. Expected test fixture content.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_write_pyarrow_non_partitioned.yaml:187:9

base64-like blob (304 bytes over 4 lines, compression ratio 0.87) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAySN3WrDMAxGX8X4enG6NilbrwpbBr1pIOlgMIYxtpwZ0siTvZ9Q+u5T6IUQH/rO
        0UUCEZK26EDuZNf07Wv31Ojntun1sT3p5u3Qn+SdPENKZlg6RxQ+jCCQhAsENiPNAv5CykngJKLJ
        n6J84UbPFyjjbPjDr2KHg2zCmOTu/SL3eY6LbVlqQBxGMDEkZfFc3qKiaFUHX9+Q8mHyyAK6JR0c
```
likely benign LLM, confidence 0.92 Gzip-compressed recorded HTTP response body in a test cassette.
Reasoning
Gzip-compressed binary HTTP body in a test cassette. Recorded traffic from the test suite, with no code execution or obfuscation.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_write_pyarrow_non_partitioned.yaml:244:9

base64-like blob (316 bytes over 5 lines, compression ratio 0.86) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAySNy2rDMBBFf0VoXcu183RWhcaFbGKwUyiUIGRp7AgcjzpSHybk3yuT1XC595y5
        cSBCkhoN8B2vy6Z6r19Lua/KRh6rkyw/Ds2JP/EreK/6eXNE1tkBGBIzlkAHpInBn/XBMxyZU+HC
        0re4aGIDqZtU/PCbGqtaCOBFlBkIyg6e7z5v/CVMbtbOR/SI/QDKWS80XtNHFOS0qOHrG3w4jB1G
```
likely benign LLM, confidence 0.92 Gzip-compressed recorded HTTP response body in a test cassette.
Reasoning
Gzip-compressed !!binary response in a VCR cassette. Test fixture data recorded from an HTTP interaction, not malicious payload.
info ~~warn~~ → info by review long-line fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_write_pyarrow_non_partitioned.yaml:380:1

line length 5940 characters (raw pass, confidence 0.65)
```
    body: '{"handle": 5831327183338995, "data": "UEFSMRUEFfABFfABTBUeFQASAAABAAAAAAAAAAoAAAAAAAAACwAAAAAAAAAEAAAAAAAAAA4AAAAAAAAABwAAAAAAAAAQAAAAAAAAAAMAAAAAAAAAAgAAAAAAAAAIAAAAAAAAAAkAAAAAAAAABQAAAAAAAAAGAAAAAAAAAAAAAAAAAAAADwAAAAAAAAAVABUwFTAsFTIVEBUGFQYcGAgQAAAAAAAAABgIAAAAAAAAAAAWACgIEAAAAAAAAAAYCAAAAAAAAAAAAAAAAgA
```
likely benign LLM, confidence 0.90 Long base64-encoded Parquet data in a VCR test cassette.
Reasoning
A long base64 body in a recorded HTTP cassette is a Parquet payload (PAR1 magic visible when decoded) from a DBFS write test; long lines in recorded fixtures are expected.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_write_pyarrow_non_partitioned.yaml:499:9

base64-like blob (216 bytes over 3 lines, compression ratio 0.90) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzNTQ6CMBBA4bvMGu2/SA/gBVwaQ6a0jZMAxbbGKOHuErfvW7wVIo2hgL2tsGB9
        gAV22cu1phzY8sGc05t5QhdqKMwpiR41OjM4Lb3ulPFdlMa3HE9KuQM/Lpifr1ChASq9pww24lhC
        8x/1hb4BrNbCNDAlT5EGrJTmvtK0g2iNFGchVcs53+7bDwAA//8DAIK7zyGfAAAA
```
likely benign LLM, confidence 0.92 Gzip-compressed binary response body recorded in a test cassette.
Reasoning
The !!binary blob starts with H4sI, the gzip base64 header, which is a recorded HTTP response body in a test cassette. This is a raw-pass finding in test data with no execution path.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_write_pyarrow_non_partitioned.yaml:555:9

base64-like blob (216 bytes over 3 lines, compression ratio 0.90) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzNTQ6CMBBA4bvMGu2/SA/gBVwaQ6a0jZMAxbbGKOHuErfvW7wVIo2hgL2tsGB9
        gAV22cu1phzY8sGc05t5QhdqKMwpiR41OjM4Lb3ulPFdlMa3HE9KuQM/Lpifr1ChASq9pww24lhC
        8x/1hb4BrNbCNDAlT5EGrJTmvtK0g2iNFGchVcs53+7bDwAA//8DAIK7zyGfAAAA
```
likely benign LLM, confidence 0.92 Gzip-compressed binary response body recorded in a test cassette.
Reasoning
Identical gzip-base64 recorded response body as the other cassette entries; benign test fixture data.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_write_pyarrow_non_partitioned.yaml:611:9

base64-like blob (216 bytes over 3 lines, compression ratio 0.90) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEAxzNTQ6CMBBA4bvMGu2/SA/gBVwaQ6a0jZMAxbbGKOHuErfvW7wVIo2hgL2tsGB9
        gAV22cu1phzY8sGc05t5QhdqKMwpiR41OjM4Lb3ulPFdlMa3HE9KuQM/Lpifr1ChASq9pww24lhC
        8x/1hb4BrNbCNDAlT5EGrJTmvtK0g2iNFGchVcs53+7bDwAA//8DAIK7zyGfAAAA
```
likely benign LLM, confidence 0.92 Gzip-compressed binary response body recorded in a test cassette.
Reasoning
Same recorded gzip response pattern repeated in the cassette; no code runs from it.
info ~~warn~~ → info by review encoding-base64 fsspec/implementations/tests/cassettes/test_dbfs/test_dbfs_write_pyarrow_non_partitioned.yaml:716:9

base64-like blob (236 bytes over 4 lines, compression ratio 0.91) (raw pass, confidence 0.60)
```
      string: !!binary |
        H4sIAAAAAAAEA5zQTQrCMBAF4LvMOmBSJ/3JAbyAS5GQNgmOWFuScaGld7d1bTfdPngfjzdBpEfI
        YC4TjI5vYOBwWpIzDykcYs5j6KxvYwYBlK2nBIbTK4hfz2b6BDBSQD94itQ5puFpmfolVZUuVC1R
        llLKWfzz7y7tglHquqjKYhPu396x27MZm6rEo1KbNLt2PWzHHUo3qLHBlb7OXwAAAP//AwCF/1Z8
```
likely benign LLM, confidence 0.90 Gzip-compressed binary response body recorded in a test cassette.
Reasoning
Another gzip base64 recorded HTTP body in a VCR cassette used by fsspec's DBFS tests; standard test fixture content.
info ~~warn~~ → info by review dynamic-execution fsspec/implementations/tests/test_ftp.py:72:19

`open(__file__)` — file reads its own source, common pattern for extracting payloads hidden in comments (ast pass, confidence 0.85)
```
    out = fs.cat(f"/{os.path.basename(__file__)}")
    assert out == open(__file__, "rb").read()
```
likely benign LLM, confidence 0.85 Test reads its own source file to compare against the FTP-retrieved copy.
Reasoning
The test compares a remote FTP fetch against the test file's own bytes, a simple equality assertion with no payload extraction or execution.
info ~~warn~~ → info by review dynamic-execution fsspec/implementations/tests/test_ftp.py:89:19

`open(__file__)` — file reads its own source, common pattern for extracting payloads hidden in comments (ast pass, confidence 0.85)
```
    out = fs.cat(f"/{os.path.basename(__file__)}")
    assert out == open(__file__, "rb").read()
```
likely benign LLM, confidence 0.85 Test reads its own source file to compare against the FTP-retrieved copy.
Reasoning
Same self-read comparison in a second FTP test; it verifies round-trip content, not hidden payload extraction.
info ~~warn~~ → info by review dynamic-execution fsspec/implementations/tests/test_git.py:20:9

`subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        os.chdir(d)
        subprocess.call("git init -b master", shell=True, cwd=d)
        subprocess.call("git init -b master", shell=True, cwd=d)
        subprocess.call('git config user.email "you@example.com"', shell=True, cwd=d)
```
likely benign LLM, confidence 0.90 Test fixture runs literal git init and config commands with shell=True.
Reasoning
Fixed literal git setup commands run in a temporary test directory; no untrusted input is interpolated. Shell use is unnecessary but harmless here.
info ~~warn~~ → info by review dynamic-execution fsspec/implementations/tests/test_git.py:21:9

`subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        subprocess.call("git init -b master", shell=True, cwd=d)
        subprocess.call("git init -b master", shell=True, cwd=d)
        subprocess.call('git config user.email "you@example.com"', shell=True, cwd=d)
        subprocess.call('git config user.name "Your Name"', shell=True, cwd=d)
```
likely benign LLM, confidence 0.90 Test fixture runs literal git init and config commands with shell=True.
Reasoning
Same literal git setup commands in the test repository fixture; benign.
info ~~warn~~ → info by review dynamic-execution fsspec/implementations/tests/test_git.py:22:9

`subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        subprocess.call("git init -b master", shell=True, cwd=d)
        subprocess.call('git config user.email "you@example.com"', shell=True, cwd=d)
        subprocess.call('git config user.name "Your Name"', shell=True, cwd=d)
        open(os.path.join(d, "file1"), "wb").write(b"data0")
```
likely benign LLM, confidence 0.95 Test helper running a literal git init command via subprocess with shell=True.
Reasoning
Test fixture in fsspec's git tests runs fixed literal git commands with shell=True in a temp directory. No external input is interpolated; this is ordinary test setup.
info ~~warn~~ → info by review dynamic-execution fsspec/implementations/tests/test_git.py:23:9

`subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        subprocess.call('git config user.email "you@example.com"', shell=True, cwd=d)
        subprocess.call('git config user.name "Your Name"', shell=True, cwd=d)
        open(os.path.join(d, "file1"), "wb").write(b"data0")
        subprocess.call("git add file1", shell=True, cwd=d)
```
likely benign LLM, confidence 0.95 Test setup running a literal git config command with shell=True.
Reasoning
Literal git config command in a test fixture setting dummy user identity; no untrusted input and no malicious behavior.
info ~~warn~~ → info by review dynamic-execution fsspec/implementations/tests/test_git.py:25:9

`subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        open(os.path.join(d, "file1"), "wb").write(b"data0")
        subprocess.call("git add file1", shell=True, cwd=d)
        subprocess.call('git commit -m "init"', shell=True, cwd=d)
        sha = open(os.path.join(d, ".git/refs/heads/master"), "r").read().strip()
```
likely benign LLM, confidence 0.95 Test fixture running literal git commit with shell=True.
Reasoning
Literal git add/commit commands within a temporary test repository. Benign test scaffolding.
info ~~warn~~ → info by review dynamic-execution fsspec/implementations/tests/test_git.py:26:9

`subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        subprocess.call("git add file1", shell=True, cwd=d)
        subprocess.call('git commit -m "init"', shell=True, cwd=d)
        sha = open(os.path.join(d, ".git/refs/heads/master"), "r").read().strip()
        open(os.path.join(d, "file1"), "wb").write(b"data00")
```
likely benign LLM, confidence 0.95 Test fixture performing git add and commit steps via shell=True.
Reasoning
Literal git add and commit commands with a file write in a test directory. The shell=True use is unnecessary but harmless here.
info ~~warn~~ → info by review dynamic-execution fsspec/implementations/tests/test_git.py:29:9

`subprocess.check_output` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        open(os.path.join(d, "file1"), "wb").write(b"data00")
        subprocess.check_output('git commit -a -m "tagger"', shell=True, cwd=d)
        subprocess.call('git tag -a thetag -m "make tag"', shell=True, cwd=d)
        open(os.path.join(d, "file2"), "wb").write(b"data000")
```
likely benign LLM, confidence 0.95 Test fixture running literal git commit with shell=True.
Reasoning
Literal git commit and tag commands in a test fixture creating a repository state. No dynamic or untrusted input.
info ~~warn~~ → info by review dynamic-execution fsspec/implementations/tests/test_git.py:30:9

`subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        subprocess.check_output('git commit -a -m "tagger"', shell=True, cwd=d)
        subprocess.call('git tag -a thetag -m "make tag"', shell=True, cwd=d)
        open(os.path.join(d, "file2"), "wb").write(b"data000")
        subprocess.call("git add file2", shell=True)
```
likely benign LLM, confidence 0.95 Test fixture running literal git tag command with shell=True.
Reasoning
Literal git tag and add commands used to build a test repository. Benign.
info ~~warn~~ → info by review dynamic-execution fsspec/implementations/tests/test_git.py:32:9

`subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        open(os.path.join(d, "file2"), "wb").write(b"data000")
        subprocess.call("git add file2", shell=True)
        subprocess.call('git commit -m "master tip"', shell=True, cwd=d)
        subprocess.call("git checkout -b abranch", shell=True, cwd=d)
```
likely benign LLM, confidence 0.95 Test fixture running literal git checkout with shell=True.
Reasoning
Literal git add, commit and checkout commands in a test repository setup. Benign test scaffolding.
info ~~warn~~ → info by review dynamic-execution fsspec/implementations/tests/test_git.py:33:9

`subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        subprocess.call("git add file2", shell=True)
        subprocess.call('git commit -m "master tip"', shell=True, cwd=d)
        subprocess.call("git checkout -b abranch", shell=True, cwd=d)
        os.mkdir("inner")
```
likely benign LLM, confidence 0.95 Test fixture running literal git checkout -b with shell=True.
Reasoning
Literal git checkout and directory creation in a test fixture. Benign.
info ~~warn~~ → info by review dynamic-execution fsspec/implementations/tests/test_git.py:34:9

`subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        subprocess.call('git commit -m "master tip"', shell=True, cwd=d)
        subprocess.call("git checkout -b abranch", shell=True, cwd=d)
        os.mkdir("inner")
        open(os.path.join(d, "inner", "file1"), "wb").write(b"data3")
```
likely benign LLM, confidence 0.95 Test fixture running literal git commit with shell=True.
Reasoning
Literal git commit in a test fixture building branch state. No untrusted input.
info ~~warn~~ → info by review dynamic-execution fsspec/implementations/tests/test_git.py:37:9

`subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        open(os.path.join(d, "inner", "file1"), "wb").write(b"data3")
        subprocess.call("git add inner/file1", shell=True, cwd=d)
        subprocess.call('git commit -m "branch tip"', shell=True, cwd=d)
        os.chdir(orig_dir)
```
likely benign LLM, confidence 0.95 Test fixture running literal git add and commit with shell=True.
Reasoning
Literal git add and commit commands in a test fixture, followed by restoring the working directory. Benign.
info ~~warn~~ → info by review dynamic-execution fsspec/implementations/tests/test_git.py:38:9

`subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)
```
        subprocess.call("git add inner/file1", shell=True, cwd=d)
        subprocess.call('git commit -m "branch tip"', shell=True, cwd=d)
        os.chdir(orig_dir)
        yield d, sha
```
likely benign LLM, confidence 0.90 Test helper invoking git add and git commit via subprocess with shell=True on literal commands.
Reasoning
Test fixture in fsspec's git tests runs fixed git commands with shell=True in a temp directory. The command strings are literals with no untrusted input, so this is ordinary test setup rather than malicious execution.
info ~~warn~~ → info by review dynamic-execution fsspec/tests/abstract/mv.py:36:9

`os.system` called with a literal shell command (ast pass, confidence 0.70)
```
    if os.name == "nt":
        os.system(f'icacls "{protected_path}" /deny Everyone:(W)')
    else:
        os.chmod(protected_path, 0o555)  # Sets the directory to read-only
```
likely benign LLM, confidence 0.92 Windows-branch test setup running icacls to make a protected test directory read-only.
Reasoning
Within a test helper, on Windows it uses icacls to deny write permissions on a test directory, with POSIX chmod otherwise. The f-string interpolates only a local test path, not external input. This is a standard way to make a directory read-only for a move-failure test.
info ~~warn~~ → info by review dynamic-execution fsspec/tests/abstract/mv.py:55:9

`os.system` called with a literal shell command (ast pass, confidence 0.70)
```
    if os.name == "nt":
        os.system(f'icacls "{protected_path}" /remove:d Everyone')
    else:
        os.chmod(protected_path, 0o755)  # Restore write permission for cleanup
```
likely benign LLM, confidence 0.92 Windows-branch test teardown removing the icacls deny entry on a protected test directory.
Reasoning
Cleanup counterpart of the previous finding: removes the icacls deny ACE on Windows and restores permissions otherwise. Interpolated value is a local test path, and the action is restoring access for test teardown.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/fsspec/filesystem_spec filesystem_spec && cd filesystem_spec
git checkout 2026.9.0
disclude scan --severity info --diff 2026.7.0 .