PyPI / grpcio / 1.84.0

grpcio 1.84.0

Source
https://github.com/grpc/grpc
Tag scanned
v1.84.0
Compared with
v1.83.1 (9 signals introduced since)
Files
7916 scanned, 2429 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 285 warn · 325 info
Scan time
152.7 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): the 202 most severe of 487 warn and critical signals (202 with a verdict); 202 demoted to info. The rest are unreviewed.
Disclude version
4.0.0
Scanned (UTC)
2026-10-14 21:28

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. `#define SEND_QUAL_ARG2 const` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type qualifier of arg 2 for send. */
    #define SEND_QUAL_ARG2 const
    
    /* Define to the type of arg 1 for send. */
  2. `#define SEND_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for send. */
    #define SEND_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for send. */
  3. `#define SEND_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for send. */
    #define SEND_TYPE_ARG4 int
    
    /* Define to the function return type for send. */
  4. `#define GETNAMEINFO_TYPE_ARG7 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 7 for getnameinfo. */
    #define GETNAMEINFO_TYPE_ARG7 int
    
    /* Specifies the number of arguments to getservbyport_r */
  5. `#define RECVFROM_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recvfrom. */
    #define RECVFROM_TYPE_ARG1 int
    
    /* Define to the type pointed by arg 2 for recvfrom. */
  6. `#define RECVFROM_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recvfrom. */
    #define RECVFROM_TYPE_ARG4 int
    
    /* Define to the type pointed by arg 5 for recvfrom. */
  7. `#define RECV_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recv. */
    #define RECV_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for recv. */
  8. `#define RECV_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recv. */
    #define RECV_TYPE_ARG4 int
    
    /* Define to the function return type for recv. */
  9. `#define SEND_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for send. */
    #define SEND_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for send. */
  10. `#define SEND_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for send. */
    #define SEND_TYPE_ARG4 int
    
    /* Define to the function return type for send. */
  11. `#define GETNAMEINFO_QUAL_ARG1 const` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type qualifier of arg 1 for getnameinfo. */
    #define GETNAMEINFO_QUAL_ARG1 const
    
    /* Define to the type of arg 1 for getnameinfo. */
  12. `#define GETNAMEINFO_TYPE_ARG7 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 7 for getnameinfo. */
    #define GETNAMEINFO_TYPE_ARG7 int
    
    /* Specifies the number of arguments to getservbyport_r */
  13. `#define RECVFROM_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recvfrom. */
    #define RECVFROM_TYPE_ARG1 int
    
    /* Define to the type pointed by arg 2 for recvfrom. */
  14. `#define RECVFROM_TYPE_ARG2 void` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type pointed by arg 2 for recvfrom. */
    #define RECVFROM_TYPE_ARG2 void
    
    /* Define to 1 if the type pointed by arg 2 for recvfrom is void. */
  15. `#define RECVFROM_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recvfrom. */
    #define RECVFROM_TYPE_ARG4 int
    
    /* Define to the type pointed by arg 5 for recvfrom. */
  16. `#define RECV_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recv. */
    #define RECV_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for recv. */
  17. `#define RECV_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recv. */
    #define RECV_TYPE_ARG4 int
    
    /* Define to the function return type for recv. */
  18. `#define RETSIGTYPE void` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define as the return type of signal handlers (`int' or `void'). */
    #define RETSIGTYPE void
    
    /* Define to the type qualifier of arg 2 for send. */
  19. `#define SEND_QUAL_ARG2 const` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type qualifier of arg 2 for send. */
    #define SEND_QUAL_ARG2 const
    
    /* Define to the type of arg 1 for send. */
  20. `#define SEND_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for send. */
    #define SEND_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for send. */
  21. `#define SEND_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for send. */
    #define SEND_TYPE_ARG4 int
    
    /* Define to the function return type for send. */
  22. `#define GETHOSTNAME_TYPE_ARG2 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 2 for gethostname. */
    #define GETHOSTNAME_TYPE_ARG2 int
    
    /* Define to the type qualifier of arg 1 for getnameinfo. */
  23. `#define GETNAMEINFO_TYPE_ARG7 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 7 for getnameinfo. */
    #define GETNAMEINFO_TYPE_ARG7 int
    
    /* Specifies the number of arguments to getservbyport_r */
  24. `#define RECVFROM_TYPE_ARG3 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 3 for recvfrom. */
    #define RECVFROM_TYPE_ARG3 int
    
    /* Define to the type of arg 4 for recvfrom. */
  25. `#define RECVFROM_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recvfrom. */
    #define RECVFROM_TYPE_ARG4 int
    
    /* Define to the type pointed by arg 5 for recvfrom. */
  26. `#define RECVFROM_TYPE_RETV int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the function return type for recvfrom. */
    #define RECVFROM_TYPE_RETV int
    
    /* Define to the type of arg 1 for recv. */
  27. `#define RECV_TYPE_ARG3 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 3 for recv. */
    #define RECV_TYPE_ARG3 int
    
    /* Define to the type of arg 4 for recv. */
  28. `#define RECV_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recv. */
    #define RECV_TYPE_ARG4 int
    
    /* Define to the function return type for recv. */
  29. `#define RECV_TYPE_RETV int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the function return type for recv. */
    #define RECV_TYPE_RETV int
    
    /* Define as the return type of signal handlers (`int' or `void'). */
  30. `#define SEND_TYPE_ARG3 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 3 for send. */
    #define SEND_TYPE_ARG3 int
    
    /* Define to the type of arg 4 for send. */
  31. `#define SEND_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for send. */
    #define SEND_TYPE_ARG4 int
    
    /* Define to the function return type for send. */
  32. `#define SEND_TYPE_RETV int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the function return type for send. */
    #define SEND_TYPE_RETV int
    
    /* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */
  33. string literal contains an embedded NUL followed by 3 more bytes of source (token pass, confidence 0.85)

        // string.
        {std::string("\0foo", 4),
         "0:0: Invalid control characters encountered in text."},
        {std::string("\0\0foo", 5),
  34. string literal contains an embedded NUL followed by 5 more bytes of source (token pass, confidence 0.85)

         "0:0: Invalid control characters encountered in text."},
        {std::string("\0\0foo", 5),
         "0:0: Invalid control characters encountered in text."},
  35. string literal contains an embedded NUL followed by 3 more bytes of source (token pass, confidence 0.85)

    TEST(FuzzTest, FileNameEmbeddedNull) {
      RoundTripDescriptor(ParseTextProtoOrDie(R"pb(file { name: "\000" })pb"));
    }
  36. string literal contains an embedded NUL followed by 41 more bytes of source (token pass, confidence 0.85)

      RoundTripDescriptor(ParseTextProtoOrDie(
          R"pb(file {
                 name: "\035"
                 enum_type {
  37. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:5:14

    identifier `ˈmaʳkʊs` mixes scripts: Other + Latin (raw pass, confidence 0.80)

    
    Markus Kuhn [ˈmaʳkʊs kuːn] <http://www.cl.cam.ac.uk/~mgk25/> — 2002-07-25 CC BY
  38. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:5:25

    identifier `kuːn` mixes scripts: Latin + Other (raw pass, confidence 0.80)

    
    Markus Kuhn [ˈmaʳkʊs kuːn] <http://www.cl.cam.ac.uk/~mgk25/> — 2002-07-25 CC BY
  39. identifier `α` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

                                                ⎪⎢⎜│a²+b³ ⎟⎥⎪
      ∀x∈ℝ: ⌈x⌉ = −⌊−x⌋, α ∧ ¬β = ¬(¬α ∨ β),    ⎪⎢⎜│───── ⎟⎥⎪
                                                ⎪⎢⎜⎷ c₈   ⎟⎥⎪
  40. identifier `α` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

                                                ⎪⎢⎜│a²+b³ ⎟⎥⎪
      ∀x∈ℝ: ⌈x⌉ = −⌊−x⌋, α ∧ ¬β = ¬(¬α ∨ β),    ⎪⎢⎜│───── ⎟⎥⎪
                                                ⎪⎢⎜⎷ c₈   ⎟⎥⎪
  41. identifier `aⁱ` mixes scripts: Latin + Other (raw pass, confidence 0.80)

      ⊥ < a ≠ b ≡ c ≤ d ≪ ⊤ ⇒ (⟦A⟧ ⇔ ⟪B⟫),      ⎪⎢⎜ ⎲     ⎟⎥⎪
                                                ⎪⎢⎜ ⎳aⁱ-bⁱ⎟⎥⎪
      2H₂ + O₂ ⇌ 2H₂O, R = 4.7 kΩ, ⌀ 200 mm     ⎩⎣⎝i=1    ⎠⎦⎭
  42. identifier `bⁱ` mixes scripts: Latin + Other (raw pass, confidence 0.80)

      ⊥ < a ≠ b ≡ c ≤ d ≪ ⊤ ⇒ (⟦A⟧ ⇔ ⟪B⟫),      ⎪⎢⎜ ⎲     ⎟⎥⎪
                                                ⎪⎢⎜ ⎳aⁱ-bⁱ⎟⎥⎪
      2H₂ + O₂ ⇌ 2H₂O, R = 4.7 kΩ, ⌀ 200 mm     ⎩⎣⎝i=1    ⎠⎦⎭
  43. identifier `kΩ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

                                                ⎪⎢⎜ ⎳aⁱ-bⁱ⎟⎥⎪
      2H₂ + O₂ ⇌ 2H₂O, R = 4.7 kΩ, ⌀ 200 mm     ⎩⎣⎝i=1    ⎠⎦⎭
    
    Linguistics and dictionaries:
  44. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:28:7

    identifier `ıntəˈnæʃənəl` mixes scripts: Latin + Other (raw pass, confidence 0.80)

    
      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
  45. identifier `fəˈnɛtık` mixes scripts: Latin + Other (raw pass, confidence 0.80)

    
      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
  46. identifier `əsoʊsiˈeıʃn` mixes scripts: Other + Latin (raw pass, confidence 0.80)

    
      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
  47. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:29:6

    identifier `ˈʏpsilɔn` mixes scripts: Other + Latin (raw pass, confidence 0.80)

      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
    
    APL:
  48. identifier `jɛn` mixes scripts: Latin + Other (raw pass, confidence 0.80)

      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
    
    APL:
  49. identifier `ˈjoːgɑ` mixes scripts: Other + Latin (raw pass, confidence 0.80)

      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
    
    APL:
  50. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:57:3

    identifier `STARGΛ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

    
      STARGΛ̊TE SG-1, a = v̇ = r̈, a⃑ ⊥ b⃑
    
    Greek (in Polytonic):
  51. identifier `τρομερή` contains homoglyph candidates: ρ (03C1)→p, ο (03BF)→o, ρ (03C1)→p (raw pass, confidence 0.70)

      Σὲ γνωρίζω ἀπὸ τὴν κόψη
      τοῦ σπαθιοῦ τὴν τρομερή,
      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
  52. identifier `τρομερή` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      Σὲ γνωρίζω ἀπὸ τὴν κόψη
      τοῦ σπαθιοῦ τὴν τρομερή,
      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
  53. identifier `μὲ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
  54. identifier `μετράει` contains homoglyph candidates: ρ (03C1)→p (raw pass, confidence 0.70)

      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
  55. identifier `μετράει` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
  56. identifier `βγαλμένη` contains homoglyph candidates: α (03B1)→a, ν (03BD)→v, η (03B7)→n (raw pass, confidence 0.70)

    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
  57. identifier `βγαλμένη` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
  58. identifier `ἀνδρειωμένη` contains homoglyph candidates: ν (03BD)→v, ρ (03C1)→p, ν (03BD)→v, η (03B7)→n (raw pass, confidence 0.70)

      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
      χαῖρε, ὦ χαῖρε, ᾿Ελευθεριά!
  59. identifier `ἀνδρειωμένη` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
      χαῖρε, ὦ χαῖρε, ᾿Ελευθεριά!
  60. identifier `μοι` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

    
      Οὐχὶ ταὐτὰ παρίσταταί μοι γιγνώσκειν, ὦ ἄνδρες ᾿Αθηναῖοι,
      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
  61. identifier `μοι` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

    
      Οὐχὶ ταὐτὰ παρίσταταί μοι γιγνώσκειν, ὦ ἄνδρες ᾿Αθηναῖοι,
      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
  62. identifier `πράγματα` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a, α (03B1)→a (raw pass, confidence 0.70)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
  63. identifier `πράγματα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
  64. identifier `μὲν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
  65. identifier `μὲν` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
  66. identifier `τιμωρήσασθαι` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a, α (03B1)→a (raw pass, confidence 0.70)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  67. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:78:3

    identifier `τιμωρήσασθαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  68. identifier `γιγνομένους` contains homoglyph candidates: ν (03BD)→v, ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (raw pass, confidence 0.70)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  69. identifier `γιγνομένους` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  70. identifier `πράγματ` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a (raw pass, confidence 0.70)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  71. identifier `πράγματ` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  72. identifier `μὴ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
  73. identifier `πεισόμεθ` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
  74. identifier `μοι` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
      οἱ τὰ τοιαῦτα λέγοντες ἢ τὴν ὑπόθεσιν, περὶ ἧς βουλεύεσθαι,
  75. identifier `μοι` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
      οἱ τὰ τοιαῦτα λέγοντες ἢ τὴν ὑπόθεσιν, περὶ ἧς βουλεύεσθαι,
  76. identifier `ὑμῖν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  77. identifier `ὑμῖν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  78. identifier `ἁμαρτάνειν` contains homoglyph candidates: α (03B1)→a, ρ (03C1)→p, ν (03BD)→v, ν (03BD)→v (raw pass, confidence 0.70)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  79. identifier `ἁμαρτάνειν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  80. identifier `μέν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  81. identifier `μέν` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  82. identifier `τιμωρήσασθαι` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a, α (03B1)→a (raw pass, confidence 0.70)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  83. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:84:3

    identifier `τιμωρήσασθαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  84. identifier `μάλ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  85. identifier `ἐμοῦ` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  86. identifier `ἐμοῦ` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  87. identifier `ἀμφότερα` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a (raw pass, confidence 0.70)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  88. identifier `ἀμφότερα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  89. identifier `μέντοι` contains homoglyph candidates: ν (03BD)→v, ο (03BF)→o (raw pass, confidence 0.70)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  90. identifier `μέντοι` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  91. identifier `πέπεισμαι` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  92. identifier `πέπεισμαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  93. identifier `ἡμῖν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  94. identifier `ἡμῖν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  95. identifier `συμμάχους` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  96. identifier `συμμάχους` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  97. identifier `σώσομεν` contains homoglyph candidates: ο (03BF)→o, ν (03BD)→v (raw pass, confidence 0.70)

      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
  98. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:87:3

    identifier `σώσομεν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
  99. identifier `τιμωρήσεταί` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a (raw pass, confidence 0.70)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  100. identifier `τιμωρήσεταί` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  101. identifier `μάταιον` contains homoglyph candidates: α (03B1)→a, ο (03BF)→o, ν (03BD)→v (raw pass, confidence 0.70)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  102. identifier `μάταιον` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  103. identifier `ἡγοῦμαι` contains homoglyph candidates: ο (03BF)→o, α (03B1)→a (raw pass, confidence 0.70)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  104. identifier `ἡγοῦμαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  105. identifier `Δημοσθένους` contains homoglyph candidates: η (03B7)→n, ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (raw pass, confidence 0.70)

    
      Δημοσθένους, Γ´ ᾿Ολυνθιακὸς
    
    Georgian:
  106. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:92:3

    identifier `Δημοσθένους` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      Δημοσθένους, Γ´ ᾿Ολυνθιακὸς
    
    Georgian:
  107. identifier `ἠḂӥẄɐː` mixes scripts: Greek + Latin + Cyrillic + Other (raw pass, confidence 0.80)

      –—‘“”„†•…‰™œŠŸž€ ΑΒΓΔΩαβγδω АБВГДабвгд
      ∀∂∈ℝ∧∪≡∞ ↑↗↨↻⇣ ┐┼╔╘░►☺♀ fi�⑀₂ἠḂӥẄɐː⍎אԱა
    
    Greetings in various languages:
  108. identifier `אԱა` mixes scripts: Hebrew + Armenian + Other (raw pass, confidence 0.80)

      –—‘“”„†•…‰™œŠŸž€ ΑΒΓΔΩαβγδω АБВГДабвгд
      ∀∂∈ℝ∧∪≡∞ ↑↗↨↻⇣ ┐┼╔╘░►☺♀ fi�⑀₂ἠḂӥẄɐː⍎אԱა
    
    Greetings in various languages:
  109. identifier `Καλημέρα` contains homoglyph candidates: Κ (039A)→K, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (raw pass, confidence 0.70)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  110. identifier `Καλημέρα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  111. identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (raw pass, confidence 0.70)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  112. identifier `κόσμε` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  113. identifier `ˈmaʳkʊs` mixes scripts: Other + Latin (raw pass, confidence 0.80)

    
    Markus Kuhn [ˈmaʳkʊs kuːn] &lt;mkuhn@acm.org> — 1999-08-20
  114. identifier `kuːn` mixes scripts: Latin + Other (raw pass, confidence 0.80)

    
    Markus Kuhn [ˈmaʳkʊs kuːn] &lt;mkuhn@acm.org> — 1999-08-20
  115. identifier `α` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

    
      ∮ E⋅da = Q,  n → ∞, ∑ f(i) = ∏ g(i), ∀x∈ℝ: ⌈x⌉ = −⌊−x⌋, α ∧ ¬β = ¬(¬α ∨ β),
    
      ℕ ⊆ ℕ₀ ⊂ ℤ ⊂ ℚ ⊂ ℝ ⊂ ℂ, ⊥ &lt; a ≠ b ≡ c ≤ d ≪ ⊤ ⇒ (A ⇔ B),
  116. identifier `α` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

    
      ∮ E⋅da = Q,  n → ∞, ∑ f(i) = ∏ g(i), ∀x∈ℝ: ⌈x⌉ = −⌊−x⌋, α ∧ ¬β = ¬(¬α ∨ β),
    
      ℕ ⊆ ℕ₀ ⊂ ℤ ⊂ ℚ ⊂ ℝ ⊂ ℂ, ⊥ &lt; a ≠ b ≡ c ≤ d ≪ ⊤ ⇒ (A ⇔ B),
  117. identifier `kΩ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

    
      2H₂ + O₂ ⇌ 2H₂O, R = 4.7 kΩ, ⌀ 200 mm
    
    Linguistics and dictionaries:
  118. identifier `ıntəˈnæʃənəl` mixes scripts: Latin + Other (raw pass, confidence 0.80)

    
      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
  119. identifier `fəˈnɛtık` mixes scripts: Latin + Other (raw pass, confidence 0.80)

    
      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
  120. identifier `əsoʊsiˈeıʃn` mixes scripts: Other + Latin (raw pass, confidence 0.80)

    
      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
  121. identifier `ˈʏpsilɔn` mixes scripts: Other + Latin (raw pass, confidence 0.80)

      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
    
    APL:
  122. identifier `jɛn` mixes scripts: Latin + Other (raw pass, confidence 0.80)

      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
    
    APL:
  123. identifier `ˈjoːgɑ` mixes scripts: Other + Latin (raw pass, confidence 0.80)

      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
    
    APL:
  124. identifier `τρομερή` contains homoglyph candidates: ρ (03C1)→p, ο (03BF)→o, ρ (03C1)→p (raw pass, confidence 0.70)

      Σὲ γνωρίζω ἀπὸ τὴν κόψη
      τοῦ σπαθιοῦ τὴν τρομερή,
      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
  125. identifier `τρομερή` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      Σὲ γνωρίζω ἀπὸ τὴν κόψη
      τοῦ σπαθιοῦ τὴν τρομερή,
      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
  126. identifier `μὲ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
  127. identifier `μετράει` contains homoglyph candidates: ρ (03C1)→p (raw pass, confidence 0.70)

      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
  128. identifier `μετράει` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
  129. identifier `βγαλμένη` contains homoglyph candidates: α (03B1)→a, ν (03BD)→v, η (03B7)→n (raw pass, confidence 0.70)

    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
  130. identifier `βγαλμένη` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
  131. identifier `ἀνδρειωμένη` contains homoglyph candidates: ν (03BD)→v, ρ (03C1)→p, ν (03BD)→v, η (03B7)→n (raw pass, confidence 0.70)

      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
      χαῖρε, ὦ χαῖρε, ᾿Ελευθεριά!
  132. identifier `ἀνδρειωμένη` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
      χαῖρε, ὦ χαῖρε, ᾿Ελευθεριά!
  133. identifier `μοι` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

    
      Οὐχὶ ταὐτὰ παρίσταταί μοι γιγνώσκειν, ὦ ἄνδρες ᾿Αθηναῖοι,
      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
  134. identifier `μοι` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

    
      Οὐχὶ ταὐτὰ παρίσταταί μοι γιγνώσκειν, ὦ ἄνδρες ᾿Αθηναῖοι,
      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
  135. identifier `πράγματα` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a, α (03B1)→a (raw pass, confidence 0.70)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
  136. identifier `πράγματα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
  137. identifier `μὲν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
  138. identifier `μὲν` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
  139. identifier `τιμωρήσασθαι` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a, α (03B1)→a (raw pass, confidence 0.70)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  140. identifier `τιμωρήσασθαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  141. identifier `γιγνομένους` contains homoglyph candidates: ν (03BD)→v, ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (raw pass, confidence 0.70)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  142. identifier `γιγνομένους` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  143. identifier `πράγματ` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a (raw pass, confidence 0.70)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  144. identifier `πράγματ` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  145. identifier `μὴ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
  146. identifier `πεισόμεθ` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
  147. identifier `μοι` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
      οἱ τὰ τοιαῦτα λέγοντες ἢ τὴν ὑπόθεσιν, περὶ ἧς βουλεύεσθαι,
  148. identifier `μοι` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
      οἱ τὰ τοιαῦτα λέγοντες ἢ τὴν ὑπόθεσιν, περὶ ἧς βουλεύεσθαι,
  149. identifier `ὑμῖν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  150. identifier `ὑμῖν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  151. identifier `ἁμαρτάνειν` contains homoglyph candidates: α (03B1)→a, ρ (03C1)→p, ν (03BD)→v, ν (03BD)→v (raw pass, confidence 0.70)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  152. identifier `ἁμαρτάνειν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  153. identifier `μέν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  154. identifier `μέν` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  155. identifier `τιμωρήσασθαι` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a, α (03B1)→a (raw pass, confidence 0.70)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  156. identifier `τιμωρήσασθαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  157. identifier `μάλ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  158. identifier `ἐμοῦ` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  159. identifier `ἐμοῦ` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  160. identifier `ἀμφότερα` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a (raw pass, confidence 0.70)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  161. identifier `ἀμφότερα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  162. identifier `μέντοι` contains homoglyph candidates: ν (03BD)→v, ο (03BF)→o (raw pass, confidence 0.70)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  163. identifier `μέντοι` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  164. identifier `πέπεισμαι` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  165. identifier `πέπεισμαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  166. identifier `ἡμῖν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  167. identifier `ἡμῖν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  168. identifier `συμμάχους` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  169. identifier `συμμάχους` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  170. identifier `σώσομεν` contains homoglyph candidates: ο (03BF)→o, ν (03BD)→v (raw pass, confidence 0.70)

      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
  171. identifier `σώσομεν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
  172. identifier `τιμωρήσεταί` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a (raw pass, confidence 0.70)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  173. identifier `τιμωρήσεταί` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  174. identifier `μάταιον` contains homoglyph candidates: α (03B1)→a, ο (03BF)→o, ν (03BD)→v (raw pass, confidence 0.70)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  175. identifier `μάταιον` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  176. identifier `ἡγοῦμαι` contains homoglyph candidates: ο (03BF)→o, α (03B1)→a (raw pass, confidence 0.70)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  177. identifier `ἡγοῦμαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  178. identifier `Δημοσθένους` contains homoglyph candidates: η (03B7)→n, ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (raw pass, confidence 0.70)

    
      Δημοσθένους, Γ´ ᾿Ολυνθιακὸς
    
    Georgian:
  179. identifier `Δημοσθένους` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      Δημοσθένους, Γ´ ᾿Ολυνθιακὸς
    
    Georgian:
  180. identifier `ἠḂӥẄɐː` mixes scripts: Greek + Latin + Cyrillic + Other (raw pass, confidence 0.80)

      –—‘“”„†•…‰™œŠŸž€ ΑΒΓΔΩαβγδω АБВГДабвгд
      ∀∂∈ℝ∧∪≡∞ ↑↗↨↻⇣ ┐┼╔╘░►☺♀ fi�⑀₂ἠḂӥẄɐː⍎אԱა
    
    Greetings in various languages:
  181. identifier `אԱა` mixes scripts: Hebrew + Armenian + Other (raw pass, confidence 0.80)

      –—‘“”„†•…‰™œŠŸž€ ΑΒΓΔΩαβγδω АБВГДабвгд
      ∀∂∈ℝ∧∪≡∞ ↑↗↨↻⇣ ┐┼╔╘░►☺♀ fi�⑀₂ἠḂӥẄɐː⍎אԱა
    
    Greetings in various languages:
  182. identifier `Καλημέρα` contains homoglyph candidates: Κ (039A)→K, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (raw pass, confidence 0.70)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  183. identifier `Καλημέρα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  184. identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (raw pass, confidence 0.70)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  185. identifier `κόσμε` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  186. string literal contains an embedded NUL followed by 2 more bytes of source (token pass, confidence 0.85)

      EXPECT_EQ(4, SpanStructurallyValid("abcd"));
      EXPECT_EQ(4, SpanStructurallyValid(absl::string_view("a\0cd", 4)));  // NULL
      EXPECT_EQ(4, SpanStructurallyValid("ab\xc2\x81"));                   // 2-byte
      EXPECT_EQ(4, SpanStructurallyValid("a\xe2\x81\x81"));                // 3-byte
  187. string literal contains an embedded NUL followed by 2 more bytes of source (token pass, confidence 0.85)

      EXPECT_TRUE(IsStructurallyValid("abcd"));
      EXPECT_TRUE(IsStructurallyValid(absl::string_view("a\0cd", 4)));  // NULL
      EXPECT_TRUE(IsStructurallyValid("ab\xc2\x81"));                   // 2-byte
      EXPECT_TRUE(IsStructurallyValid("a\xe2\x81\x81"));                // 3-byte
  188. warn macro-keyword-override third_party/xxhash/xxhash.h:2717:1

    `#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)

    #  elif defined(__ARM_NEON__) || defined(__ARM_NEON)
    #    define inline __inline__  /* circumvent a clang bug */
    #    include <arm_neon.h>
    #    undef inline
  189. warn identifier-confusable-collision third_party/xxhash/xxhash.h:3491:23

    two identifiers collapse to visual skeleton `bitf|ip|` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)

        XXH_ASSERT(9 <= len && len <= 16);
        {   xxh_u64 const bitflip1 = (XXH_readLE64(secret+24) ^ XXH_readLE64(secret+32)) + seed;
            xxh_u64 const bitflip2 = (XXH_readLE64(secret+40) ^ XXH_readLE64(secret+48)) - seed;
            xxh_u64 const input_lo = XXH_readLE64(input)           ^ bitflip1;
  190. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    cd $(dirname $0)/../..
    "${BAZEL_QUERY[@]}" 'deps(//test/...)' > tools/artifact_gen/test_deps.xml
    "${BAZEL_QUERY[@]}" 'deps(//:all)' > tools/artifact_gen/root_all_deps.xml
    "${BAZEL_QUERY[@]}" 'deps(//src/compiler/...)' > tools/artifact_gen/compiler_deps.xml
  191. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    "${BAZEL_QUERY[@]}" 'deps(//test/...)' > tools/artifact_gen/test_deps.xml
    "${BAZEL_QUERY[@]}" 'deps(//:all)' > tools/artifact_gen/root_all_deps.xml
    "${BAZEL_QUERY[@]}" 'deps(//src/compiler/...)' > tools/artifact_gen/compiler_deps.xml
  192. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    "${BAZEL_QUERY[@]}" 'deps(//:all)' > tools/artifact_gen/root_all_deps.xml
    "${BAZEL_QUERY[@]}" 'deps(//src/compiler/...)' > tools/artifact_gen/compiler_deps.xml
    "${BAZEL_QUERY[@]}" 'kind(alias, "//third_party:*")' > tools/artifact_gen/third_party_alias_deps.xml
  193. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    "${BAZEL_QUERY[@]}" 'deps(//src/compiler/...)' > tools/artifact_gen/compiler_deps.xml
    "${BAZEL_QUERY[@]}" 'kind(alias, "//third_party:*")' > tools/artifact_gen/third_party_alias_deps.xml
    "${BAZEL_QUERY[@]}" 'deps(kind("^proto_library", @envoy_api//envoy/...))' > tools/artifact_gen/envoy_api_proto_deps.xml
  194. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    "${BAZEL_QUERY[@]}" 'deps(kind("^proto_library", @envoy_api//envoy/...))' > tools/artifact_gen/envoy_api_proto_deps.xml
    "${BAZEL_QUERY[@]}" 'deps("@com_google_protobuf//upb:generated_code_support")' > tools/artifact_gen/upb_deps.xml
  195. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    "${BAZEL_QUERY[@]}" 'deps("@com_google_protobuf//upb:generated_code_support")' > tools/artifact_gen/upb_deps.xml
    "${BAZEL_SHOW_REPO[@]}" "${EXTERNAL_REPOS[@]}" > tools/artifact_gen/external_http_archive_deps.log || true
  196. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    "${BAZEL_SHOW_REPO[@]}" "${EXTERNAL_REPOS[@]}" > tools/artifact_gen/external_http_archive_deps.log || true
    python3 tools/buildgen/parse_http_archives.py < tools/artifact_gen/external_http_archive_deps.log > tools/artifact_gen/external_http_archive_deps.json
  197. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # Build the C++ generator. This must be done from within the sub-workspace.
    (cd tools/artifact_gen && "${BAZEL_BUILD_ARTIFACT[@]}" //:gen_upb_api_from_bazel)
    
    # Now that the tool is built, we can move the executable to a temporary location
  198. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    if [[ -n "${BUILD_TARGETS}" ]]; then
      "${BAZEL_BUILD[@]}" ${BUILD_TARGETS}
    fi
  199. command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # Run distribtest script passed as args
    "$@"
  200. command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # Run command passed as args
    "$@"
  201. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    then
      source "../${GRPC_RUNTESTS_PREPARE_SCRIPT}"
    fi
  202. warn decoder-import-with-exec tools/buildgen/_mako_renderer.py:150:36

    file imports decoder module(s) pickle and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)

                                args["selected"] = el
                                if not eval(src["cond"], {}, args):
                                    continue
                            items.append(el)
  203. `eval` called on a non-literal expression (ast pass, confidence 0.70)

                                args["selected"] = el
                                if not eval(src["cond"], {}, args):
                                    continue
                            items.append(el)
  204. `open(__file__)` — file reads its own source, common pattern for extracting payloads hidden in comments (ast pass, confidence 0.85)

        # copy-paste copyright notice from this file
        with open(__file__) as my_source:
            copyright = []
            for line in my_source:
  205. warn dynamic-import tools/distrib/black_code.sh:36:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    python3 -m venv "${VIRTUALENV}"
    source "${VIRTUALENV}/bin/activate"
    python -VV
  206. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    python3.11 -m venv "${VIRTUALENV}"
    source "${VIRTUALENV}/bin/activate"
    python -VV
  207. command name is a variable (`$1`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

              echo "Error: file '$f' is missing a trailing newline character."
              if $1; then # fix
                sed -i -e '$a\' $f
                echo 'Fixed!'
  208. warn dynamic-import tools/distrib/isort_code.sh:39:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    python3 -m venv "${VIRTUALENV}"
    source "${VIRTUALENV}/bin/activate"
    python -VV
  209. warn dynamic-import tools/distrib/pylint_code.sh:39:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    python3.11 -m venv "${VIRTUALENV}"
    source "${VIRTUALENV}/bin/activate"
    python -VV
  210. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    python3 -m venv "${VIRTUALENV}"
    source "${VIRTUALENV}/bin/activate"
    python3 -VV
  211. warn dynamic-execution tools/distrib/python/docgen.py:65:21

    `os.popen` called with a literal shell command (ast pass, confidence 0.70)

    if not args.repo_owner or not args.doc_branch:
        tty_width = int(os.popen("stty size", "r").read().split()[1])
        print("-" * tty_width)
        print("Please check generated Python doc inside doc/build")
  212. `exec` called on a non-literal expression (ast pass, confidence 0.70)

                        code = _proto_code_cache[self._module_name]
                        exec(code, module.__dict__)
                    else:
                        files = self._codegen_fn(
  213. `exec` called on a non-literal expression (ast pass, confidence 0.70)

                                importlib.import_module(module_name)
                        exec(files[-1][1], module.__dict__)
    
        class ProtoFinder(importlib.abc.MetaPathFinder):
  214. warn dynamic-import tools/distrib/ruff_code.sh:40:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    python3 -m venv "${VIRTUALENV}"
    source "${VIRTUALENV}/bin/activate"
    python -VV
  215. pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)

    touch .profile
    curl -o- https://raw.githubusercontent.com/creationix/nvm/v0.25.4/install.sh | bash
    # silence shellcheck as it cannot follow the following `source` path statically:
    # shellcheck disable=SC1090
  216. pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)

    gpg --keyserver hkp://pgp.mit.edu --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 7D2BAF1CF37B13E2069D6956105BD0E739499BDB
    curl -sSL https://get.rvm.io | bash -s stable --ruby
    # silence shellcheck as it cannot follow the following `source` path statically:
    # shellcheck disable=SC1090
  217. pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)

    # Install docker
    curl -sSL https://get.docker.com/ | sh
    # Enable kbuilder to use docker without sudo:
    sudo usermod -aG docker kbuilder
  218. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # shellcheck disable=SC1090
    [[ -s "$HOME/.rvm/scripts/rvm" ]] && source "$HOME/.rvm/scripts/rvm"
    
    # rvm commands are very verbose and we dont want to pollute the log by echo,
  219. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      set +x
      source $HOME/.rvm/scripts/rvm
    
      RUBY_VERSION=3.2.0
  220. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  221. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  222. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  223. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  224. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  225. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  226. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  227. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  228. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  229. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  230. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  231. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    export LANG=en_US.UTF-8
  232. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  233. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    echo "Activating Python venv"
    source "${VIRTUAL_ENV}/bin/activate"
    set -x
  234. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    echo "Activating Python venv"
    source "${VIRTUAL_ENV}/bin/activate"
    set -x
  235. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    
      source "${script_dir}/grpc_xds_k8s_run_xtest.sh"
    
      local failed_tests=0
  236. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    
      source "${script_dir}/grpc_xds_k8s_run_xtest.sh"
    
      local failed_tests=0
  237. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      fi
      source "${install_lib}"
    }
  238. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    
    source "${BUILD_SCRIPT_DIR}/psm-interop-install-lib.sh"
    psm::lang::source_install_lib
    source "${BUILD_SCRIPT_DIR}/psm-interop-build-${GRPC_LANGUAGE}.sh"
  239. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    psm::lang::source_install_lib
    source "${BUILD_SCRIPT_DIR}/psm-interop-build-${GRPC_LANGUAGE}.sh"
    psm::run "${PSM_TEST_SUITE}"
  240. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    
    source "${BUILD_SCRIPT_DIR}/psm-interop-install-lib.sh"
    psm::lang::source_install_lib
    source "${BUILD_SCRIPT_DIR}/psm-interop-build-${GRPC_LANGUAGE}.sh"
  241. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    psm::lang::source_install_lib
    source "${BUILD_SCRIPT_DIR}/psm-interop-build-${GRPC_LANGUAGE}.sh"
    psm::run "${PSM_TEST_SUITE}"
  242. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  243. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  244. command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    else
      $@
    fi
  245. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  246. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  247. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  248. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  249. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # List of benchmarks that provide good signal for analyzing performance changes in pull requests
  250. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  251. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  252. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  253. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  254. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  255. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  256. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # otherwise not respected when directly building the wheel.
    ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation "${WHEEL_PLAT_CONFIG_OPTION[@]}"
    
    GRPCIO_STRIP_TEMPDIR=$(mktemp -d)
  257. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # Build gRPC tools package source and binary distribution
    ${SETARCH_CMD} "${PYTHON}" -m build "tools/distrib/python/grpcio_tools" \
      --no-isolation "${WHEEL_PLAT_CONFIG_OPTION[@]}"
  258. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      "${PYTHON}" src/python/grpcio_observability/make_grpcio_observability.py
      ${SETARCH_CMD} "${PYTHON}" -m build "src/python/grpcio_observability" \
        --no-isolation "${WHEEL_PLAT_CONFIG_OPTION[@]}"
    fi
  259. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      if [ "$GRPC_BUILD_MAC" == "" ]; then
        ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation "src/python/grpcio_csm_observability"
        cp -r src/python/grpcio_csm_observability/dist/* "$ARTIFACT_DIR"
      fi
  260. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      # build_xds_protos.py is invoked as part of generate_projects.
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation \
        "py_xds_protos"
  261. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      # TODO(ssreenithi): find pyproject.toml/nox equivalent
      ${SETARCH_CMD} "${PYTHON}" src/python/grpcio_testing/setup.py preprocess
      ${SETARCH_CMD} "${PYTHON}" -m build src/python/grpcio_testing
      cp -r src/python/grpcio_testing/dist/* "$ARTIFACT_DIR"
  262. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      ${SETARCH_CMD} "${PYTHON}" src/python/grpcio_testing/setup.py preprocess
      ${SETARCH_CMD} "${PYTHON}" -m build src/python/grpcio_testing
      cp -r src/python/grpcio_testing/dist/* "$ARTIFACT_DIR"
  263. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      # TODO(ssreenithi): find pyproject.toml/nox equivalent
      ${SETARCH_CMD} "${PYTHON}" src/python/grpcio_channelz/setup.py \
          preprocess build_package_protos
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation \
  264. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          preprocess build_package_protos
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation \
        "src/python/grpcio_channelz"
  265. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      # TODO(ssreenithi): find pyproject.toml/nox equivalent
      ${SETARCH_CMD} "${PYTHON}" src/python/grpcio_health_checking/setup.py \
          preprocess build_package_protos
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation \
  266. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          preprocess build_package_protos
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation \
        "src/python/grpcio_health_checking"
  267. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      # TODO(ssreenithi): find pyproject.toml/nox equivalent
      ${SETARCH_CMD} "${PYTHON}" src/python/grpcio_reflection/setup.py \
          preprocess build_package_protos
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation \
  268. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          preprocess build_package_protos
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation \
        "src/python/grpcio_reflection"
  269. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      # TODO(ssreenithi): find pyproject.toml/nox equivalent
      ${SETARCH_CMD} "${PYTHON}" src/python/grpcio_status/setup.py \
          preprocess
      ${SETARCH_CMD} "${PYTHON}" -m build "src/python/grpcio_status"
  270. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          preprocess
      ${SETARCH_CMD} "${PYTHON}" -m build "src/python/grpcio_status"
      cp -r src/python/grpcio_status/dist/* "$ARTIFACT_DIR"
  271. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      # Build grpcio_csds source distribution
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation "src/python/grpcio_csds"
    
      cp -r src/python/grpcio_csds/dist/* "$ARTIFACT_DIR"
  272. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      "${PYTHON}" -m pip install grpcio-csds --no-index --find-links "file://$ARTIFACT_DIR/"
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation "src/python/grpcio_admin"
    
      cp -r src/python/grpcio_admin/dist/* "$ARTIFACT_DIR"
  273. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # Copy all files except '*.tar.gz' and '*py3-none-any.whl' files.
    "${find_cmd[@]}" -print0 \
        | xargs -0 -I% find % -type f -maxdepth 1 \
        -not -name "*.tar.gz" -not -name "*py3-none-any.whl" \
  274. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # Copy only the '*.tar.gz' and '*py3-none-any.whl' files.
    "${find_cmd[@]}" -print0 | xargs -0 -I% \
        find % \( -name "*.tar.gz" -o -name "*py3-none-any.whl" \) \
        -exec cp -v {} ./artifacts \;
  275. command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # shellcheck disable=SC2068
    $@
  276. command name is a variable (`$DOCKER_RUN_SCRIPT_COMMAND`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    exit_code=0
    ${DOCKER_RUN_SCRIPT_COMMAND} || exit_code=$?
    
    if [ -x "$(command -v ccache)" ]
  277. command name is a variable (`$1`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    function venv() {
      $1 -c "import sys; print('py{}{}'.format(*sys.version_info[:2]))"
    }
  278. command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    source ~/.nvm/nvm.sh
    "$@"
  279. command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    source /usr/local/rvm/scripts/rvm
    "$@"
  280. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # shellcheck disable=SC1090 disable=SC1091
    . "$HOME/.nvm/nvm.sh"
    
    nvm install 10
  281. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # shellcheck disable=SC1090 disable=SC1091
    . "$HOME/.nvm/nvm.sh"
    
    nvm use 10
  282. warn dynamic-execution tools/run_tests/run_tests.py:1914:15

    `subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)

    
        retcode = subprocess.call(
            "tools/run_tests/dockerize/build_and_run_docker.sh", shell=True, env=env
        )
  283. `subprocess.check_output` called with `shell=True` and a literal command (ast pass, confidence 0.70)

    git_submodules = (
        subprocess.check_output("git submodule", shell=True)
        .decode()
        .strip()
  284. `subprocess.check_output` called with `shell=True` and a literal command (ast pass, confidence 0.70)

        git_submodules = (
            subprocess.check_output("git submodule", shell=True)
            .decode()
            .strip()
  285. `subprocess.check_output` called with `shell=True` and a literal command (ast pass, confidence 0.70)

    try:
        branch_name = subprocess.check_output(
            "git rev-parse --abbrev-ref HEAD", shell=True
        ).decode()
  286. info dynamic-execution src/objective-c/tests/run_keepalive_test.sh:32:5 new in this release

    command name is a variable (`$BAZEL`) that this file sets only to plain text (ast pass, confidence 0.40)

    [ -f $INTEROP ] || {
        $BAZEL build //test/cpp/interop:interop_server
    }
  287. info dynamic-execution src/objective-c/tests/run_keepalive_test.sh:45:1 new in this release

    command name is a variable (`$INTEROP`) that this file sets only to plain text (ast pass, confidence 0.40)

    # from the port server with --ack_pings=false for keepalive testing.
    $INTEROP --port=$PLAIN_PORT --max_send_message_size=8388608 --ack_pings=false &
    $INTEROP --port=$TLS_PORT --max_send_message_size=8388608 --use_tls --ack_pings=false &
  288. info dynamic-execution src/objective-c/tests/run_keepalive_test.sh:46:1 new in this release

    command name is a variable (`$INTEROP`) that this file sets only to plain text (ast pass, confidence 0.40)

    $INTEROP --port=$PLAIN_PORT --max_send_message_size=8388608 --ack_pings=false &
    $INTEROP --port=$TLS_PORT --max_send_message_size=8388608 --use_tls --ack_pings=false &
    
    function finish {
  289. info dynamic-execution src/objective-c/tests/run_keepalive_test.sh:93:7 new in this release

    command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        ${XCODEBUILD_FLAGS} \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
    
    XCTEST=$(xcrun --find xctest || echo "/Applications/Xcode.app/Contents/Developer/usr/bin/xctest")
  290. info critical → info by review dynamic-execution src/objective-c/tests/run_keepalive_test.sh:99:1 new in this release

    command name is a variable (`$XCTEST`) and `XCTEST` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    export HOST_PORT_LOCALSSL="localhost:$TLS_PORT"
    "$XCTEST" -XCTest "InteropTestsLocalCleartext/testKeepaliveWithV2API" "$BUNDLE_PATH"
    likely benign LLM, confidence 0.85 Test runner invokes the XCTest binary via a variable path.
    Reasoning

    Test script runs an xctest binary whose path is a variable set by the test harness; command-name indirection is normal in test runners and no encoding or network fetch is present in the snippet.

  291. info warn → info by review encoding-base64 test/core/credentials/call/call_credentials_test.cc:5353:6 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "-----BEGIN PRIVATE KEY-----\n"
        "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgUBPYGHx4AnG2rIxQ\n"
        "5aXWVn2g4vGR4/WVxautYTHClUehRANCAAQ8TwEYxDnaovfS6UEHo6eNykUBlC2L\n"
        "GZ6rVuvkS+5Kw8k7IOVjrzE/lvVY1lDpKmIw2w7IgRxSIdDdyN6TbxNT\n"
    likely benign LLM, confidence 0.94 Test fixture PEM EC private key.
    Reasoning

    PEM private key body in a test fixture, as expected for credential-parsing tests. Raw base64 detection on PEM is a known false positive.

  292. info warn → info by review encoding-base64 test/core/credentials/call/call_credentials_test.cc:5354:6 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgUBPYGHx4AnG2rIxQ\n"
        "5aXWVn2g4vGR4/WVxautYTHClUehRANCAAQ8TwEYxDnaovfS6UEHo6eNykUBlC2L\n"
        "GZ6rVuvkS+5Kw8k7IOVjrzE/lvVY1lDpKmIw2w7IgRxSIdDdyN6TbxNT\n"
        "-----END PRIVATE KEY-----\n";
    likely benign LLM, confidence 0.94 Test fixture PEM EC private key continuation.
    Reasoning

    Continuation of the same PEM test fixture; benign.

  293. info warn → info by review encoding-base64 test/core/credentials/call/gdch_service_account_credentials_test.cc:55:6 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "-----BEGIN PRIVATE KEY-----\n"
        "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgUBPYGHx4AnG2rIxQ\n"
        "5aXWVn2g4vGR4/WVxautYTHClUehRANCAAQ8TwEYxDnaovfS6UEHo6eNykUBlC2L\n"
        "GZ6rVuvkS+5Kw8k7IOVjrzE/lvVY1lDpKmIw2w7IgRxSIdDdyN6TbxNT\n"
    likely benign LLM, confidence 0.94 Test fixture PEM private key for GDCH service account.
    Reasoning

    PEM private key test fixture in GDCH credentials test; standard test data.

  294. info warn → info by review encoding-base64 test/core/credentials/call/gdch_service_account_credentials_test.cc:56:6 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgUBPYGHx4AnG2rIxQ\n"
        "5aXWVn2g4vGR4/WVxautYTHClUehRANCAAQ8TwEYxDnaovfS6UEHo6eNykUBlC2L\n"
        "GZ6rVuvkS+5Kw8k7IOVjrzE/lvVY1lDpKmIw2w7IgRxSIdDdyN6TbxNT\n"
        "-----END PRIVATE KEY-----\n";
    likely benign LLM, confidence 0.94 Test fixture PEM private key continuation for GDCH.
    Reasoning

    Continuation of the GDCH PEM test fixture; benign.

  295. info long-line CMakeLists.txt:56404:1

    line length 602 characters (raw pass, confidence 0.50)

      "absl_algorithm_container absl_any_invocable absl_base absl_bind_front absl_bits absl_btree absl_check absl_cleanup absl_config absl_cord absl_core_headers absl_flags absl_flags_marshalling absl_flat_hash_map absl_flat_hash_set absl_function_ref absl_hash absl_inlined_vector absl_log absl_log_globals absl_log_severit
  296. info long-line CMakeLists.txt:56415:1

    line length 602 characters (raw pass, confidence 0.50)

      "absl_algorithm_container absl_any_invocable absl_base absl_bind_front absl_bits absl_btree absl_check absl_cleanup absl_config absl_cord absl_core_headers absl_flags absl_flags_marshalling absl_flat_hash_map absl_flat_hash_set absl_function_ref absl_hash absl_inlined_vector absl_log absl_log_globals absl_log_severit
  297. info long-line CMakeLists.txt:56426:1

    line length 723 characters (raw pass, confidence 0.50)

      "absl_absl_check absl_absl_log absl_algorithm_container absl_any_invocable absl_base absl_bind_front absl_bits absl_btree absl_charset absl_check absl_cleanup absl_config absl_cord absl_core_headers absl_dynamic_annotations absl_flags absl_flags_marshalling absl_flat_hash_map absl_flat_hash_set absl_function_ref absl
  298. info long-line CMakeLists.txt:56437:1

    line length 732 characters (raw pass, confidence 0.50)

      "absl_absl_check absl_absl_log absl_algorithm_container absl_any_invocable absl_base absl_bind_front absl_bits absl_btree absl_charset absl_check absl_cleanup absl_config absl_cord absl_core_headers absl_dynamic_annotations absl_flags absl_flags_marshalling absl_flat_hash_map absl_flat_hash_set absl_function_ref absl
  299. info long-line CMakeLists.txt:56449:1

    line length 750 characters (raw pass, confidence 0.50)

        "absl_absl_check absl_absl_log absl_algorithm_container absl_any_invocable absl_base absl_bind_front absl_bits absl_btree absl_charset absl_check absl_cleanup absl_config absl_cord absl_core_headers absl_dynamic_annotations absl_flags absl_flags_marshalling absl_flat_hash_map absl_flat_hash_set absl_function_ref ab
  300. line length 768 characters (raw pass, confidence 0.50)

    **Load Balancing:**<ul><li>[Virtual host]https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-virtualhost domains matching</li><li>Only default path ("" or "/") matching</li><li>Priority-based weighted round-robin locality picking</li><li>Round-robin endpoint picki
  301. line length 877 characters (raw pass, confidence 0.50)

    Request matching based on:<ul><li>[Path]https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-routematch (prefix, full path and safe regex)</li><ul><li>[case_sensitive](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v
  302. line length 733 characters (raw pass, confidence 0.50)

    [Ring hash]https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#ring-hash load balancing policy:<br> Only the following [policy specifiers](https://github.com/envoyproxy/envoy/blob/2443032526cf6e50d63d35770df9473dd0460fc0/api/envoy/config/route/v3/route_components.pro
  303. command name is a variable (`$cygwin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Increase the maximum file descriptors if we can.
    if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
        case $MAX_FD in #(
          max*)
  304. command name is a variable (`$darwin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Increase the maximum file descriptors if we can.
    if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
        case $MAX_FD in #(
          max*)
  305. command name is a variable (`$nonstop`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Increase the maximum file descriptors if we can.
    if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
        case $MAX_FD in #(
          max*)
  306. command name is a variable (`$cygwin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # For Cygwin or MSYS, switch paths to Windows format before running java
    if "$cygwin" || "$msys" ; then
        APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
        CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
  307. command name is a variable (`$msys`) that this file sets only to plain text (ast pass, confidence 0.40)

    # For Cygwin or MSYS, switch paths to Windows format before running java
    if "$cygwin" || "$msys" ; then
        APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
        CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
  308. info critical → info by review dynamic-execution examples/android/helloworld/gradlew:244:1

    `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

    
    eval "set -- $(
            printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
            xargs -n1 |
    likely benign LLM, confidence 0.97 Gradle wrapper uses eval to parse DEFAULT_JVM_OPTS and related options into arguments.
    Reasoning

    This is the standard Gradle wrapper script. The eval is used to re-split JVM options safely via xargs, a known idiom in the upstream generated gradlew. Context is a build wrapper, not a dropper.

  309. info critical → info by review dynamic-execution examples/android/helloworld/gradlew:251:1

    `exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)

    
    exec "$JAVACMD" "$@"
    likely benign LLM, confidence 0.95 Gradle wrapper execs the resolved Java binary with its arguments.
    Reasoning

    exec of $JAVACMD is the normal final step of the official Gradle wrapper, which locates a java binary and runs it with the wrapper arguments.

  310. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $PROTOC --proto_path=examples/protos \
           --php_out=examples/php \
           --grpc_out=generate_server:examples/php \
  311. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $PROTOC --proto_path=examples/protos \
           --php_out=examples/php/route_guide \
           --grpc_out=generate_server:examples/php/route_guide \
  312. info warn → info by review dynamic-execution examples/ruby/README.md:19:5

    [embedded bash] pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)

      $ gpg --keyserver hkp://keys.gnupg.net --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3
      $ \curl -sSL https://get.rvm.io | bash -s stable --ruby=ruby-2
      $
      $ # follow the instructions to ensure that your're using the latest stable version of Ruby
    likely benign LLM, confidence 0.90 Documentation tells users to install RVM by piping a remote script into bash.
    Reasoning

    This is the widely published RVM installation instruction piping a curl download to bash. It is risky practice but a documented legitimate install method, and the GPG key step is present in the surrounding README.

  313. command name is a variable (`$cygwin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Increase the maximum file descriptors if we can.
    if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
        case $MAX_FD in #(
          max*)
  314. command name is a variable (`$darwin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Increase the maximum file descriptors if we can.
    if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
        case $MAX_FD in #(
          max*)
  315. command name is a variable (`$nonstop`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Increase the maximum file descriptors if we can.
    if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
        case $MAX_FD in #(
          max*)
  316. command name is a variable (`$cygwin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # For Cygwin or MSYS, switch paths to Windows format before running java
    if "$cygwin" || "$msys" ; then
        APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
        CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
  317. command name is a variable (`$msys`) that this file sets only to plain text (ast pass, confidence 0.40)

    # For Cygwin or MSYS, switch paths to Windows format before running java
    if "$cygwin" || "$msys" ; then
        APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
        CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
  318. info critical → info by review dynamic-execution src/android/test/interop/gradlew:244:1

    `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

    
    eval "set -- $(
            printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
            xargs -n1 |
    likely benign LLM, confidence 0.97 Gradle wrapper uses eval to parse JVM options.
    Reasoning

    Identical standard Gradle wrapper eval idiom for splitting JVM options.

  319. info critical → info by review dynamic-execution src/android/test/interop/gradlew:251:1

    `exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)

    
    exec "$JAVACMD" "$@"
    likely benign LLM, confidence 0.97 Gradle wrapper execs the resolved Java binary.
    Reasoning

    Identical standard Gradle wrapper exec of the resolved Java binary.

  320. info warn → info by review dynamic-execution src/c-ares/gen_build_yaml.py:29:9

    `subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)

        def gen_ares_build(x):
            subprocess.call("third_party/cares/cares/buildconf", shell=True)
            subprocess.call("third_party/cares/cares/configure", shell=True)
    likely benign LLM, confidence 0.93 Build script runs a fixed local buildconf command via subprocess with shell=True.
    Reasoning

    Build-generation script calling fixed local autotools scripts with shell=True and literal strings. No untrusted input is involved, so the risk is low.

  321. info warn → info by review dynamic-execution src/c-ares/gen_build_yaml.py:30:9

    `subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)

            subprocess.call("third_party/cares/cares/buildconf", shell=True)
            subprocess.call("third_party/cares/cares/configure", shell=True)
    
        def config_platform(x):
    likely benign LLM, confidence 0.93 Build script runs a fixed local configure command via subprocess with shell=True.
    Reasoning

    Same as the preceding call: a literal local configure script run via shell=True in a build generator, with no dynamic input.

  322. info critical → info by review dynamic-execution src/core/util/subprocess_posix.cc:60:5

    `execv` called with a non-literal path (ast pass, confidence 0.90)

        exec_args[argc] = nullptr;
        execv(exec_args[0], exec_args);
        // if we reach here, an error has occurred
        LOG(ERROR) << "execv '" << exec_args[0]
    likely benign LLM, confidence 0.85 Subprocess helper calls execv with caller-provided arguments after fork.
    Reasoning

    This is the subprocess implementation of gRPC's utility library; execv on a caller-supplied argv is its intended purpose, a fork/exec wrapper with no obfuscation.

  323. info critical → info by review dynamic-execution src/core/util/subprocess_posix.cc:103:5

    `execve` called with a non-literal path (ast pass, confidence 0.90)

        envp_args[envc] = nullptr;
        execve(exec_args[0], exec_args, envp_args);
        // if we reach here, an error has occurred
        LOG(ERROR) << "execvpe '" << exec_args[0]
    likely benign LLM, confidence 0.85 Subprocess helper calls execve with caller-provided arguments and environment.
    Reasoning

    The execve call is the expected environment-aware exec in the same legitimate subprocess helper; the path is caller-supplied by design.

  324. info warn → info by review dynamic-execution src/objective-c/README.md:174:3

    [embedded bash] pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)

    ```sh
    $ curl -fsSL https://goo.gl/getgrpc | bash -
    ```
    This will download and run the [gRPC install script][].
    likely benign LLM, confidence 0.90 README instructs installing gRPC by piping a remote script into bash.
    Reasoning

    Documented gRPC install one-liner piping a short-link script to bash. It is a risky but documented install pattern in a README, not code executing in the library.

  325. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_option_test.sh:26:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    set -uo pipefail; set +e; f=bazel_tools/tools/bash/runfiles/runfiles.bash
    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
    likely benign LLM, confidence 0.93 Test script sources the Bazel runfiles library from a variable location.
    Reasoning

    Standard Bazel runfiles bootstrap pattern: sources runfiles.bash from known env-var or manifest locations, a fixed and well-known test idiom.

  326. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_option_test.sh:27:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.93 Test script falls back to sourcing runfiles from manifest-derived paths.
    Reasoning

    Same Bazel runfiles fallback chain; the sourced path is derived from the runfiles manifest and fixed relative name, typical for test bootstrapping.

  327. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_option_test.sh:28:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.93 Sources the Bazel runfiles.bash helper using a fallback chain of runfile locations.
    Reasoning

    This is the standard Bazel runfiles.bash bootstrap. It sources the runfiles library from RUNFILES_DIR, a manifest lookup, or a $0.runfiles path, with fallbacks. The path is built from a fixed constant and the script's own location, not from attacker-controlled input.

  328. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_option_test.sh:29:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    likely benign LLM, confidence 0.93 Continuation of the Bazel runfiles bootstrap, sourcing the helper from a manifest or runfiles path.
    Reasoning

    Part of the same Bazel runfiles initialization block. Each source target is resolved from the script's runfiles directory or manifest, and the block exits with an error if the file is missing. This is a conventional, transparent pattern.

  329. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_option_test.sh:30:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    # --- end runfiles.bash initialization v3 ---
    likely benign LLM, confidence 0.93 Final manifest-based fallback in the Bazel runfiles bootstrap.
    Reasoning

    The final fallback in the standard runfiles.bash initialization block. It greps a manifest for a fixed relative path and sources the result, which is ordinary build-system plumbing for locating test dependencies.

  330. info critical → info by review dynamic-execution src/objective-c/tests/PluginTest/plugin_option_test.sh:44:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    $PROTOC \
        --plugin=protoc-gen-grpc="$PLUGIN" \
        --objc_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.80 Runs the protoc binary, selected at runtime, to generate Objective-C output for a plugin test.
    Reasoning

    This is a gRPC protoc plugin test that runs $PROTOC with a plugin path and an objc output directory. The variable is set from the build environment or a locator command, which is typical for test harnesses. The snippet does not show the assignment, so the residual doubt is the source of PROTOC, but nothing here suggests malicious execution.

  331. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_test.sh:26:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    set -uo pipefail; set +e; f=bazel_tools/tools/bash/runfiles/runfiles.bash
    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
    likely benign LLM, confidence 0.93 Sources the Bazel runfiles.bash helper with fallback lookups.
    Reasoning

    Standard Bazel runfiles.bash initialization. It sources the helper from RUNFILES_DIR or a manifest with fallbacks, using a fixed path constant. Benign build-tooling boilerplate.

  332. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_test.sh:27:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.93 Runfiles bootstrap fallback sourcing a helper from a runfiles or manifest path.
    Reasoning

    Continuation of the standard Bazel runfiles bootstrap, using the same fixed-path fallback chain. No untrusted input is involved.

  333. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_test.sh:28:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.93 Manifest-based runfiles fallback for sourcing the Bazel helper.
    Reasoning

    Same Bazel runfiles initialization pattern, sourcing via manifest lookup. Standard and transparent.

  334. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_test.sh:29:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    likely benign LLM, confidence 0.93 Runfiles bootstrap fallback that exits with an error if the helper is not found.
    Reasoning

    Continuation of the runfiles bootstrap. It sources from the script's runfiles directory and fails loudly if nothing is found. Benign.

  335. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_test.sh:30:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    # --- end runfiles.bash initialization v3 ---
    likely benign LLM, confidence 0.93 Final runfiles manifest fallback closing the Bazel bootstrap block.
    Reasoning

    Final manifest fallback in the standard Bazel runfiles initialization block, ending with the v3 marker comment. Ordinary build-system boilerplate.

  336. info critical → info by review dynamic-execution src/objective-c/tests/PluginTest/plugin_test.sh:42:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    $PROTOC \
        --plugin=protoc-gen-grpc="$PLUGIN" \
        --objc_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.80 Invokes a runtime-selected protoc binary to generate Objective-C plugin output in a test.
    Reasoning

    A gRPC protoc plugin test invoking $PROTOC with a plugin path and an Objective-C output directory. The variable comes from the test environment or a locator command, which is normal for these harnesses. The assignment is not shown, but nothing indicates malicious behavior.

  337. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        CODE_SIGNING_ALLOWED=NO \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
    elif [ "$SCHEME" == "tvOS-sample" ]; then
      time xcodebuild \
  338. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        CODE_SIGNING_ALLOWED=NO \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
    else
      time xcodebuild \
  339. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        CODE_SIGNING_ALLOWED=NO \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
    fi
  340. command name is a variable (`$BAZEL`) that this file sets only to plain text (ast pass, confidence 0.40)

    [ -f $INTEROP ] || {
        $BAZEL build //test/cpp/interop:interop_server
    }
  341. command name is a variable (`$INTEROP`) that this file sets only to plain text (ast pass, confidence 0.40)

    # from the port server.
    $INTEROP --port=$PLAIN_PORT --max_send_message_size=8388608 &
    $INTEROP --port=$TLS_PORT --max_send_message_size=8388608 --use_tls &
  342. command name is a variable (`$INTEROP`) that this file sets only to plain text (ast pass, confidence 0.40)

    $INTEROP --port=$PLAIN_PORT --max_send_message_size=8388608 &
    $INTEROP --port=$TLS_PORT --max_send_message_size=8388608 --use_tls &
    
    function finish {
  343. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        "${XCODEBUILD_FLAGS}" \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
  344. command name is a variable (`$BAZEL`) that this file sets only to plain text (ast pass, confidence 0.40)

    [ -f $INTEROP ] || {
        $BAZEL build //test/cpp/interop:interop_server
    }
    [ -f $INTEROP ] || exit 1
  345. command name is a variable (`$INTEROP`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $INTEROP --port=$PLAIN_PORT --max_send_message_size=8388608 &
    $INTEROP --port=$TLS_PORT --max_send_message_size=8388608 --use_tls &
  346. command name is a variable (`$INTEROP`) that this file sets only to plain text (ast pass, confidence 0.40)

    $INTEROP --port=$PLAIN_PORT --max_send_message_size=8388608 &
    $INTEROP --port=$TLS_PORT --max_send_message_size=8388608 --use_tls &
    
    trap 'kill -9 `jobs -p` ; echo "EXIT TIME:  $(date)"' EXIT
  347. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $PROTOC --proto_path=src/proto/math \
           --php_out=src/php/tests/generated_code \
           --grpc_out=generate_server:src/php/tests/generated_code \
  348. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    # interop test protos
    $PROTOC -I . \
           -I third_party/protobuf/src \
           --php_out=src/php/tests/interop \
  349. info critical → info by review dynamic-execution src/php/bin/run_tests.sh:25:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    export DYLD_LIBRARY_PATH=$root/libs/$CONFIG
    $(which php) $extension_dir -d max_execution_time=300 $(which phpunit) -v --debug \
      --exclude-group persistent_list_bound_tests ../tests/unit_tests
    likely benign LLM, confidence 0.85 Test script resolves php and phpunit via which and runs them.
    Reasoning

    Uses command substitution $(which php) and $(which phpunit) to locate local test tools; this is a standard build/test script pattern with no remote fetch or decoding.

  350. info critical → info by review dynamic-execution src/php/bin/run_tests.sh:38:4

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    if [[ "$SKIP_PERSISTENT_CHANNEL_TESTS" != "true" ]]; then
       $(which php) $extension_dir -d max_execution_time=300 $(which phpunit) -v --debug \
         ../tests/unit_tests/PersistentChannelTests
    fi
    likely benign LLM, confidence 0.85 Conditional invocation of php and phpunit found via which for persistent channel tests.
    Reasoning

    Same pattern as the previous finding: locating local php/phpunit binaries via which inside a conditional test invocation. Benign test harness code.

  351. info dynamic-execution src/php/bin/run_xds_client.sh:60:7

    command name is a variable (`$running`) that this file sets only to plain text (ast pass, confidence 0.40)

    running=true
    while $running
    do
        sleep 1
  352. info warn → info by review implicit-int-function src/php/ext/grpc/call.c:59:1

    6 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. zval, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD) (ast pass, confidence 0.85)

     * grpc_metadata_array. Returns NULL on failure */
    zval *grpc_parse_metadata_array(grpc_metadata_array
                                    *metadata_array TSRMLS_DC) {
      int count = metadata_array->count;
    likely benign LLM, confidence 0.95 PHP gRPC extension C functions using legacy implicit return types.
    Reasoning

    Implicit int return types on PHP extension functions come from older PHP macro-based declarations (PHP_METHOD, TSRMLS_DC); a legacy style issue, not obfuscation.

  353. info warn → info by review implicit-int-function src/php/ext/grpc/call_credentials.c:55:1

    3 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. zval, PHP_METHOD, PHP_METHOD) (ast pass, confidence 0.85)

    
    zval *grpc_php_wrap_call_credentials(grpc_call_credentials
                                         *wrapped TSRMLS_DC) {
      zval *credentials_object;
    likely benign LLM, confidence 0.95 Legacy implicit-int function declarations in gRPC PHP extension.
    Reasoning

    Legacy K&R-style declarations in PHP extension source generated by PHP macros; no malicious content.

  354. info warn → info by review implicit-int-function src/php/ext/grpc/channel.c:326:1

    6 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, GRPC_STARTUP_FUNCTION) (ast pass, confidence 0.85)

     */
    PHP_METHOD(Channel, __construct) {
      wrapped_grpc_channel *channel =
        PHP_GRPC_GET_WRAPPED_OBJECT(wrapped_grpc_channel, getThis());
    likely benign LLM, confidence 0.95 PHP_METHOD handlers in gRPC channel code with implicit int.
    Reasoning

    PHP_METHOD macro expansions in a PHP extension lack explicit return types, a known legacy pattern with no security relevance.

  355. info warn → info by review implicit-int-function src/php/ext/grpc/channel_credentials.c:93:1

    8 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD) (ast pass, confidence 0.85)

     */
    PHP_METHOD(ChannelCredentials, setDefaultRootsPem) {
      char *pem_roots;
      php_grpc_int pem_roots_length;
    likely benign LLM, confidence 0.95 PHP_METHOD handlers for channel credentials with implicit int.
    Reasoning

    Legacy PHP extension method declarations; style artifact, not obfuscation.

  356. info warn → info by review implicit-int-function src/php/ext/grpc/server.c:68:1

    5 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD) (ast pass, confidence 0.85)

     */
    PHP_METHOD(Server, __construct) {
      wrapped_grpc_server *server =
        PHP_GRPC_GET_WRAPPED_OBJECT(wrapped_grpc_server, getThis());
    likely benign LLM, confidence 0.95 PHP_METHOD server constructor with implicit int return.
    Reasoning

    Legacy PHP_METHOD declarations in the gRPC server extension; benign.

  357. info warn → info by review implicit-int-function src/php/ext/grpc/timeval.c:60:1

    10 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD) (ast pass, confidence 0.85)

     */
    PHP_METHOD(Timeval, __construct) {
      wrapped_grpc_timeval *timeval =
        PHP_GRPC_GET_WRAPPED_OBJECT(wrapped_grpc_timeval, getThis());
    likely benign LLM, confidence 0.95 PHP_METHOD timeval handlers with implicit int return.
    Reasoning

    Legacy PHP_METHOD declarations in timeval wrapper; no malicious indicators.

  358. info warn → info by review frame-introspection src/python/grpcio_tests/tests_py3_only/unit/_simple_stubs_test.py:216:25

    `inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)

                target = f"localhost:{port}"
                test_name = inspect.stack()[0][3]
                args = (_REQUEST, target, _UNARY_UNARY)
                kwargs = {
    likely benign LLM, confidence 0.90 Test retrieves its own name via inspect.stack for use as a test identifier.
    Reasoning

    inspect.stack()[0][3] is used to fetch the current test function name for test labeling in a unit test; benign introspection.

  359. info warn → info by review dynamic-execution src/ruby/README.md:40:3

    [embedded bash] pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)

    $ command curl -sSL https://rvm.io/mpapis.asc | gpg --import -
    $ \curl -sSL https://get.rvm.io | bash -s stable --ruby=ruby-3
    $
    $ # follow the instructions to ensure that your're using the latest stable version of Ruby
    likely benign LLM, confidence 0.80 README documents installing RVM by piping a remote script to bash.
    Reasoning

    This is the standard RVM installation instruction from rvm.io, documented in a README. It pipes a remote script into bash, which is a well-known but risky install pattern; it is documentation rather than executed code in the package.

  360. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $PROTOC -I src/proto src/proto/grpc/health/v1/health.proto \
        --grpc_out=src/ruby/pb \
        --ruby_out=src/ruby/pb \
  361. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $PROTOC -I . \
        src/proto/grpc/testing/{messages,test,empty}.proto \
        --grpc_out=src/ruby/pb \
  362. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $PROTOC -I . \
        -I third_party/protobuf/src \
        src/proto/grpc/testing/{messages,payloads,stats,benchmark_service,report_qps_scenario_service,worker_service,control}.proto \
  363. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $PROTOC -I src/proto/math src/proto/math/math.proto \
        --grpc_out=src/ruby/bin \
        --ruby_out=src/ruby/bin \
  364. info warn → info by review embedded-nul-in-string test/core/address_utils/sockaddr_utils_test.cc:293:37

    string literal contains an embedded NUL followed by 9 more bytes of source (token pass, confidence 0.85)

                  grpc_core::UnixAbstractSockaddrPopulate(
                      std::string("path_\0with_null", 15), &addr));
      EXPECT_EQ(grpc_sockaddr_to_uri(&addr).value(),
                "unix-abstract:path_%00with_null");
    likely benign LLM, confidence 0.93 Unit test constructs an abstract unix socket path containing an embedded NUL byte.
    Reasoning

    An embedded NUL in a std::string literal is deliberate test input for abstract unix socket paths, checked against the expected URI with %00 encoding. Test code, no malicious behavior.

  365. info warn → info by review encoding-base64 test/core/credentials/call/call_credentials_test.cc:108:8

    base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "{ \"private_key\": \"-----BEGIN PRIVATE KEY-----"
        "\\nMIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAOEvJsnoHnyHkXcp\\n7mJE"
        "qg"
        "WGjiw71NfXByguekSKho65FxaGbsnSM9SMQAqVk7Q2rG+I0OpsT0LrWQtZ\\nyjSeg/"
    likely benign LLM, confidence 0.93 Test fixture containing a dummy PEM private key in JSON credentials.
    Reasoning

    Raw pass base64 hit on a PEM private key fixture embedded in a gRPC credentials test. Test fixtures with dummy keys are standard; the raw pass has a high false-positive rate for base64 content.

  366. info warn → info by review encoding-base64 test/core/credentials/call/call_credentials_test.cc:183:6

    base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)

    const char test_signed_jwt[] =
        "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImY0OTRkN2M1YWU2MGRmOTcyNmM4YW"
        "U0MDcyZTViYTdmZDkwODg2YzcifQ";
    const char test_signed_jwt_token_type[] =
    likely benign LLM, confidence 0.95 Test constant holding a signed JWT string.
    Reasoning

    The snippet is a JWT header segment (eyJhbGciOi... decodes to a JSON header with alg RS256 and typ JWT). This is a standard test token constant.

  367. info warn → info by review encoding-base64 test/core/credentials/call/call_credentials_test.cc:188:6

    base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)

    const char test_signed_jwt2[] =
        "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImY0OTRkN2M1YWU2MGRmOTcyNmM5YW"
        "U2MDcyZTViYTdnZDkwODg5YzcifQ";
    const char test_signed_jwt_token_type2[] =
    likely benign LLM, confidence 0.95 Second test constant holding a signed JWT string.
    Reasoning

    Same as the sibling JWT test constant: a standard JWT header in a test file, not obfuscation.

  368. base64-like blob (74 bytes, compression ratio 1.07) (outside string/comment) (raw pass, confidence 0.30)

        ExternalAccountCredentialsTest,
        AwsImdsv2ExternalAccountCredShouldNotUseMetadataServerOptionalTokenMissing) {
      ExecCtx exec_ctx;
      SetEnv("AWS_REGION", "test_regionz");
  369. info warn → info by review encoding-base64 test/core/credentials/call/external/aws_request_signer_test.cc:40:6

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "glv3KwuTfQsavRNs3v5pcSEm4SPO3l7mCs7KrQUHwGP0neZhIKxEXy+Ls//1C/"
        "Bqt53NL+LSbaGv6RPHaX82laz2qElphg95aVLdYgIFY6JWV5fzyjgnhz0DQmy62/"
        "Vi8pNcM2/"
        "VnxeCQ8CC8dRDSt52ry2v+nc77vstuI9xV5k8mPtnaPoJDRANh0bjwY5Sdwkbp+"
    likely benign LLM, confidence 0.94 AWS signer test vector containing base64-like data.
    Reasoning

    Base64-looking string in an AWS request signer test, likely a dummy credential or signature used as test vector. Test context, no execution or obfuscation.

  370. info warn → info by review encoding-base64 test/core/credentials/call/external/aws_request_signer_test.cc:45:6

    5 rows of base64-like lines, lines 45-54 (first: base64-like blob (72 bytes, compression ratio 1.15)) (raw pass, confidence 0.60)

        "Azuy1jQqfFZWgP68LSz5bURyIjlWDQunO82stZ0BgplKKAa/"
        "KJHBPCp8Qi6i99uy7qh76FQAqgVTsnDuU6fGpHDcsDSGoCls2HgZjZFPeOj8mmRhFk1Xqvkb"
        "juz8V1cJk54d3gIJvQt8gD2D6yJQZecnuGWd5K2e2HohvCc8Fc9kBl1300nUJPV+k4tr/"
        "A5R/0QfEKOZL1/"
    likely benign LLM, confidence 0.93 Multi-line base64-like test fixture for AWS signing.
    Reasoning

    Multi-line base64-like test data in AWS signer tests, consistent with dummy key material; raw pass false positive.

  371. info warn → info by review encoding-base64 test/core/credentials/call/jwt/json_token_test.cc:45:8

    base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "{ \"private_key\": \"-----BEGIN PRIVATE KEY-----"
        "\\nMIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAOEvJsnoHnyHkXcp\\n7mJE"
        "qg"
        "WGjiw71NfXByguekSKho65FxaGbsnSM9SMQAqVk7Q2rG+I0OpsT0LrWQtZ\\nyjSeg/"
    likely benign LLM, confidence 0.95 A test-only PEM private key literal used to exercise JWT token parsing.
    Reasoning

    The base64-like blob is an RSA private key embedded as a test fixture string in a JWT credentials unit test. Raw-pass base64 hits on PEM key material in test files are expected and carry no obfuscation or malicious intent.

  372. info warn → info by review encoding-base64 test/core/credentials/call/jwt/jwt_verifier_test.cc:42:8

    base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "{ \"private_key\": \"-----BEGIN PRIVATE KEY-----"
        "\\nMIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAOEvJsnoHnyHkXcp\\n7mJE"
        "qg"
        "WGjiw71NfXByguekSKho65FxaGbsnSM9SMQAqVk7Q2rG+I0OpsT0LrWQtZ\\nyjSeg/"
    likely benign LLM, confidence 0.95 A test-only PEM private key literal used by the JWT verifier tests.
    Reasoning

    The same embedded PEM private key fixture appears in the JWT verifier test. It is a standard test vector, and the raw base64 match is a false positive from key material.

  373. info warn → info by review encoding-base64 test/core/credentials/call/jwt/jwt_verifier_test.cc:98:8

    base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)

        "   \"n\": "
        "\"4S8myegefIeRdynuYkSqBYaOLDvU19cHKC56RIqGjrkXFoZuydIz1IxACpWTtDasb4jQ6mxP"
        "QutZC1nKNJ6D-tYFC9LiGV7gt-KOQ_cnkEb4hcMw_xF_OI1FCx6cBcM0-"
        "RjiQkK8q7HbF0M6dUXo3t0vedNhmD65Cs2wxPP1TFU=\","
    likely benign LLM, confidence 0.95 An RSA public modulus in a JWK fixture for JWT verification tests.
    Reasoning

    The snippet is the RSA modulus ('n') of a JWK in a verifier test. Public key components are base64url data by design, so the blob is an expected encoding, not obfuscation.

  374. info warn → info by review encoding-base64 test/core/credentials/call/jwt/jwt_verifier_test.cc:100:6

    base64-like blob (43 bytes, compression ratio 1.26) (raw pass, confidence 0.60)

        "QutZC1nKNJ6D-tYFC9LiGV7gt-KOQ_cnkEb4hcMw_xF_OI1FCx6cBcM0-"
        "RjiQkK8q7HbF0M6dUXo3t0vedNhmD65Cs2wxPP1TFU=\","
        "   \"e\": \"AQAB\""
        "  }"
    likely benign LLM, confidence 0.93 The remaining part of an RSA JWK public key fixture with its exponent.
    Reasoning

    This is the tail of the same JWK public key fixture, including the standard exponent 'AQAB'. It is ordinary test data with no execution or hiding behavior.

  375. info warn → info by review encoding-base64 test/core/credentials/call/jwt/jwt_verifier_test.cc:111:8

    base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "CERTIFICATE-----"
        "\\nMIICATCCAWoCCQDEywLhxvHjnDANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJB\\nVTET"
        "MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0\\ncyBQdHkgTHR"
        "kMB4XDTE1MDYyOTA4Mzk1MFoXDTI1MDYyNjA4Mzk1MFowRTELMAkG\\nA1UEBhMCQVUxEzARBg"
    likely benign LLM, confidence 0.94 A test X.509 certificate PEM body used in JWT verifier tests.
    Reasoning

    The blob is a base64-encoded X.509 certificate split across string literals in a JWT verifier test. Embedding certificates as test fixtures is standard practice.

  376. info warn → info by review encoding-base64 test/core/credentials/call/jwt/jwt_verifier_test.cc:120:11

    base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "cnkEb4hcMw/xF/OI1FCx6cBcM0+"
        "Rji\\nQkK8q7HbF0M6dUXo3t0vedNhmD65Cs2wxPP1TFUCAwEAATANBgkqhkiG9w0BAQsF\\nA"
        "AOBgQBfu69FkPmBknbKNFgurPz78kbs3VNN+k/"
        "PUgO5DHKskJmgK2TbtvX2VMpx\\nkftmHGzgzMzUlOtigCaGMgHWjfqjpP9uuDbahXrZBJzB8c"
    likely benign LLM, confidence 0.94 Continuation of a PEM test certificate/key fixture in JWT verifier tests.
    Reasoning

    This is a continuation of the PEM certificate and key fixture, split across concatenated literals. It is static test data with no decoding or execution step.

  377. info warn → info by review embedded-nul-in-string test/core/end2end/fuzzers/client_fuzzer.cc:136:61

    string literal contains an embedded NUL followed by 658 more bytes of source (token pass, confidence 0.85)

    TEST(ClientFuzzerTest, RunChannelzCallTracerRegression2) {
      Fuzz(ParseTestProto(R"pb(network_input {
                                 single_read_bytes: "K"
                                 connect_timeout_ms: -1
    likely benign LLM, confidence 0.93 A fuzzer regression test using a raw protobuf text literal containing a NUL byte.
    Reasoning

    The embedded NUL is inside a raw string literal (R"pb(...)pb") that holds a textproto regression input for a fuzzer. Raw literals contain such bytes legitimately and this is not a dropper or concealed payload.

  378. info warn → info by review embedded-nul-in-string test/core/end2end/fuzzers/server_fuzzer.cc:202:39

    string literal contains an embedded NUL followed by 983 more bytes of source (token pass, confidence 0.85)

      ChaoticGood(
          ParseTestProto(R"pb(network_input {
                                input_segments {
                                  segments {
    likely benign LLM, confidence 0.93 A server fuzzer regression case written as a raw textproto string.
    Reasoning

    The flagged literal is a raw-string textproto input for a server fuzzer regression test. The NUL scanner hit comes from the raw literal and has no malicious character.

  379. info warn → info by review embedded-nul-in-string test/core/end2end/tests/no_logging.cc:211:53

    string literal contains an embedded NUL followed by 13 more bytes of source (token pass, confidence 0.85)

          CoreTestConfigurationNamed("Chttp2FullstackCompression"),
          ParseTestProto(R"pb(config_vars { verbosity: "\000" trace: "" })pb"));
    }
    likely benign LLM, confidence 0.93 A test config literal setting a verbosity value with an escaped NUL.
    Reasoning

    The '\000' in the textproto string is an explicit escaped NUL within a test configuration for verbosity, not a hidden payload. It is a benign configuration value in a test.

  380. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        "${XCODEBUILD_FLAGS}" \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
    
    time xcodebuild \
  381. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        "${XCODEBUILD_FLAGS}" \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
    
    time xcodebuild \
  382. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        "${XCODEBUILD_FLAGS}" \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
    
    time xcodebuild \
  383. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        "${XCODEBUILD_FLAGS}" \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
  384. info warn → info by review encoding-hex test/core/transport/chttp2/bin_encoder_test.cc:131:8

    18 consecutive `\xNN` escapes (entropy 4.2 bits/byte) (raw pass, confidence 0.65)

      EXPECT_SLICE_EQ(
          "\xd0\x7a\xbe\x94\x10\x54\xd4\x44\xa8\x20\x05\x95\x04\x0b\x81\x66\xe0\x82"
          "\xa6\x2d\x1b\xff",
          HUFF("Mon, 21 Oct 2013 20:13:21 GMT"));
    likely benign LLM, confidence 0.94 Expected Huffman-encoded bytes for an HPACK header test assertion.
    Reasoning

    These \x escapes are Huffman-encoded byte vectors for HPACK test expectations, which are high-entropy by nature. The raw-pass hex signal is a false positive from a protocol test.

  385. info warn → info by review encoding-hex test/core/transport/chttp2/bin_encoder_test.cc:135:8

    17 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)

      EXPECT_SLICE_EQ(
          "\x9d\x29\xad\x17\x18\x63\xc7\x8f\x0b\x97\xc8\xe9\xae\x82\xae\x43\xd3",
          HUFF("https://www.example.com"));
    likely benign LLM, confidence 0.94 Expected Huffman-encoded bytes for an HPACK encoder test assertion.
    Reasoning

    This is another HPACK Huffman expected-output byte sequence in a transport encoder test. The byte-escape density is expected for encoded test vectors and shows no malicious intent.

  386. info warn → info by review encoding-hex test/core/transport/chttp2/bin_encoder_test.cc:154:8

    16 rows of escape runs, lines 154-169 (first: 16 consecutive `\xNN` escapes (entropy 4.0 bits/byte)) (raw pass, confidence 0.65)

      EXPECT_COMBINED_EQUIV(
          "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
          "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
          "\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
    likely benign LLM, confidence 0.97 Test vector listing consecutive byte values as escaped string literals for a bin-header encoding test.
    Reasoning

    Sequential \x00-\x2f byte escapes in a gRPC C++ test fixture for the binary header encoder are an enumeration of all byte values, a standard test-vector pattern. No execution or decoding of the data occurs in the snippet.

  387. info warn → info by review encoding-base64 test/core/transport/chttp2/hpack_parser_test.cc:658:15

    base64-like blob (64 bytes, compression ratio 1.06) (raw pass, confidence 0.60)

                   ":status: 200\naccept-ranges: grpc\n", 0}}},
            Test{"FuzzerCoveragea4a41007f0a40f2d62696e8beda42d5b63272129a410626907",
                 {},
                 {},
    likely benign LLM, confidence 0.95 Hex-like fuzzer corpus identifier used as a test case name in HPACK parser tests.
    Reasoning

    The base64-like string is a fuzzer-generated test case name (FuzzerCoverage prefix) in a gRPC HPACK parser test. It is a label or identifier used for regression tracking, not a payload executed by the code.

  388. info warn → info by review encoding-base64 test/core/tsi/ssl_transport_security_test.cc:1427:8

    15 rows of base64-like lines, lines 1427-1441 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

          "-----BEGIN CERTIFICATE-----\n"
          "MIIC3zCCAcegAwIBAgIUKMYmbfEcNkln+NB2bntR6854MpswDQYJKoZIhvcNAQEL\n"
          "BQAwDzENMAsGA1UEAwwEZXZpbDAeFw0yNjA1MTAyMjIzMThaFw0yNjA1MTEyMjIz\n"
          "MThaMA8xDTALBgNVBAMMBGV2aWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK\n"
    likely benign LLM, confidence 0.97 Embedded PEM test certificate for SSL transport security tests.
    Reasoning

    PEM-encoded certificate text inside a TLS test file, marked with BEGIN CERTIFICATE headers. Test certificates like this are standard fixtures for transport security tests.

  389. info warn → info by review encoding-base64 test/core/tsi/ssl_transport_security_utils_test.cc:82:6

    13 rows of base64-like lines, lines 82-94 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

        "-----BEGIN CERTIFICATE-----\n"
        "MIICZzCCAdCgAwIBAgIIN18/ctj3wpAwDQYJKoZIhvcNAQELBQAwKjEXMBUGA1UE\n"
        "ChMOR29vZ2xlIFRFU1RJTkcxDzANBgNVBAMTBnRlc3RDQTAeFw0xNTAxMDEwMDAw\n"
        "MDBaFw0yNTAxMDEwMDAwMDBaMC8xFzAVBgNVBAoTDkdvb2dsZSBURVNUSU5HMRQw\n"
    likely benign LLM, confidence 0.97 Embedded PEM certificate fixture used by SSL utility tests.
    Reasoning

    PEM certificate fixture with BEGIN CERTIFICATE header in a TLS utilities test. Standard test data, not an obfuscated payload.

  390. info warn → info by review encoding-base64 test/core/tsi/ssl_transport_security_utils_test.cc:98:6

    12 rows of base64-like lines, lines 98-109 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

        "-----BEGIN RSA PRIVATE KEY-----\n"
        "MIICXQIBAAKBgQDbSg7Ij580IJ4cncM2Maig88/jdDp6aFW+5YPymm1rnzZGDGr/\n"
        "iPVuX1w8d2gJ3LIexYVVRnOxyPaqEKWaUEAwQDn3k5TY1fZ3zWdKKHl3BlYsxFCQ\n"
        "QjPLFRHtV57d7KidAPgdJqZp68xK/v1ZNQEKjMQYhOpaeNgDXnYpRsD8iwIDAQAB\n"
    likely benign LLM, confidence 0.97 Embedded test RSA private key in PEM form for SSL utility tests.
    Reasoning

    PEM RSA private key fixture in a TLS test file. Test keys are committed for unit tests; no decoding or execution occurs in the snippet.

  391. info warn → info by review encoding-base64 test/core/tsi/ssl_transport_security_utils_test.cc:114:6

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "-----BEGIN PRIVATE KEY-----\n"
        "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgOM7iHjJw/N6n8HtM\n"
        "bVVVRhEYXoHFF+MSaTYQxOWM1p+hRANCAASMeWC+pIJAm/1fn0Wz3yyWGQzVPm9v\n"
        "LCQo5JvK0a2t+Aa6d3AtLRwo6vh1VbJ8zFZxxIwyJNis3n1jRMWal7Vo\n"
    likely benign LLM, confidence 0.97 Embedded test private key in PEM form for SSL utility tests.
    Reasoning

    PEM private key fixture used in TLS utility unit tests. Standard committed test data with a matching END marker.

  392. info warn → info by review encoding-base64 test/core/tsi/ssl_transport_security_utils_test.cc:115:6

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgOM7iHjJw/N6n8HtM\n"
        "bVVVRhEYXoHFF+MSaTYQxOWM1p+hRANCAASMeWC+pIJAm/1fn0Wz3yyWGQzVPm9v\n"
        "LCQo5JvK0a2t+Aa6d3AtLRwo6vh1VbJ8zFZxxIwyJNis3n1jRMWal7Vo\n"
        "-----END PRIVATE KEY-----";
    likely benign LLM, confidence 0.97 Continuation lines of a test private key PEM fixture.
    Reasoning

    Continuation of the same PEM private key fixture in the TLS utility test; the snippet ends with the END PRIVATE KEY marker. Standard test data.

  393. info warn → info by review encoding-base64 test/core/tsi/ssl_transport_security_utils_test.cc:121:6

    24 rows of base64-like lines, lines 121-144 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

        "MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCqyrzsrS8mWQwz\n"
        "VFudLgte2kJX/pZ3KqJQBtMrkLxpgyJJU8mVBB+quDwnfH6PnQk+sF9omTlGAAxR\n"
        "JzSEe8BS1Wnxld6rr6o/381VVW/2b+2kSifCtx/gVwCQQLnf4dbjfGW7ZClu1URG\n"
        "ks2lK9T9BIh9SMSnYLEKEC8sWW1LibzJxHapFjIP88GrqgpPNGdEK7ABMsqHASuU\n"
    likely benign LLM, confidence 0.96 Multi-line PEM private key fixture for SSL utility tests.
    Reasoning

    Multi-row PEM private key fixture in a TLS test file. Committed test data for exercising key parsing; no execution or decoding of hidden content.

  394. info warn → info by review embedded-nul-in-string test/core/util/json/json_test.cc:218:43

    string literal contains an embedded NUL followed by 9 more bytes of source (token pass, confidence 0.85)

      RunParseFailureTest("[[],]");
      const char kInputWithNull[] = "{\"a\":1}\0{\"b\":2}";
      RunParseFailureTest(
          absl::string_view(kInputWithNull, sizeof(kInputWithNull)));
    likely benign LLM, confidence 0.90 Test input string with an embedded NUL byte used to verify JSON parser handling of null bytes.
    Reasoning

    Deliberate embedded NUL in a string literal to test JSON parsing of input containing null bytes, with the length passed via sizeof. This is a common and intentional edge-case test, not an attack.

  395. info warn → info by review embedded-nul-in-string test/core/util/uri_test.cc:215:43

    string literal contains an embedded NUL followed by 12 more bytes of source (token pass, confidence 0.85)

      // Artificial examples to show that embedded nulls are supported.
      TestSucceeds(std::string("unix-abstract:\0should-be-ok", 27), "unix-abstract",
                   "", "", "", std::string("\0should-be-ok", 13), {}, {}, "");
    }
    likely benign LLM, confidence 0.90 Test string with embedded NUL to verify URI handling of unix-abstract socket names containing nulls.
    Reasoning

    The comment explicitly states the embedded nulls are artificial examples showing support for them in URI parsing. Intentional edge-case testing in a gRPC URI test.

  396. info warn → info by review embedded-nul-in-string test/core/util/uri_test.cc:216:41

    string literal contains an embedded NUL followed by 12 more bytes of source (token pass, confidence 0.85)

      TestSucceeds(std::string("unix-abstract:\0should-be-ok", 27), "unix-abstract",
                   "", "", "", std::string("\0should-be-ok", 13), {}, {}, "");
    }
    likely benign LLM, confidence 0.92 Test literal with an embedded NUL byte used to exercise abstract unix socket URI parsing.
    Reasoning

    The embedded NUL is deliberate. The test passes std::string with explicit lengths to check that the URI parser handles a NUL inside a unix-abstract socket path, which is expected for abstract sockets. This is a legitimate test-data pattern in a token-pass finding.

  397. info warn → info by review embedded-nul-in-string test/core/util/uri_test.cc:221:29

    string literal contains an embedded NUL followed by 1 more bytes of source (token pass, confidence 0.85)

      TestSucceeds("unix-abstract:%00x", "unix-abstract", "", "", "",
                   std::string("\0x", 2), {}, {}, "");
    }
    likely benign LLM, confidence 0.92 Explicit NUL-containing expected string in a URI parser unit test.
    Reasoning

    The std::string("\0x", 2) construction is an explicit, length-specified NUL-containing expected value in a URI parsing unit test. It matches the surrounding test cases and is not obfuscation.

  398. info warn → info by review embedded-nul-in-string test/core/xds/xds_client_fuzzer.cc:805:30

    string literal contains an embedded NUL followed by 180 more bytes of source (token pass, confidence 0.85)

    TEST(XdsClientFuzzer, RlsMissingTypedExtensionConfig) {
      Fuzz(ParseTestProto(R"pb(
        bootstrap: "{\"xds_servers\": [{\"server_uri\":\"xds.example.com:-257\", \"channel_creds\":[{\"type\": \"fake\"}]}]}"
        actions { start_watch { resource_type { route_config {} } } }
    likely benign LLM, confidence 0.80 Fuzzer regression test input with a NUL byte inside a protobuf text-format string.
    Reasoning

    The flagged literal is a protobuf text-format fuzzer seed embedding a bootstrap JSON string with escaped quotes and an invalid port. The NUL is most likely a fuzzing input byte inside a regression test for a missing typed extension config. Fuzzer corpus content of this kind is normal.

  399. info critical → info by review dynamic-execution test/cpp/common/time_jump_test.cc:44:33

    `system` called with a non-literal argument (ast pass, confidence 0.90)

    // Android doesn't have posix_spawn. Use std::system instead
    void run_cmd(const char* cmd) { std::system(cmd); }
    #else
    void run_cmd(const char* cmd) {
    likely benign LLM, confidence 0.90 Test helper wrapping std::system to run shell commands for clock-jump simulation on Android.
    Reasoning

    run_cmd is a thin wrapper over std::system on Android, used by a test to execute commands that simulate clock jumps. The argument is a parameter supplied by test code, not attacker input. This is a standard test-utility pattern.

  400. info critical → info by review dynamic-execution test/cpp/end2end/cfstream_test.cc:80:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

            << "  ' | sudo tee -a /etc/hosts";
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.85 Test helper that runs sudo shell commands to modify /etc/hosts for network simulation.
    Reasoning

    This is a test helper that builds a sudo command to edit /etc/hosts for simulating network failures in CFStream tests. The variable parts are the test's own server_host_ fields, not untrusted input. Privileged shell use is unusual but expected in network-fault test harnesses and does not indicate malicious intent.

  401. info critical → info by review dynamic-execution test/cpp/end2end/cfstream_test.cc:87:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "sudo sed -i '.bak' '/" << server_host_ << "/d' /etc/hosts";
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.85 Test helper running sudo sed on /etc/hosts for network fault injection.
    Reasoning

    Same test-harness pattern: a sudo sed command on /etc/hosts built from the test's configured server host. The non-literal argument comes from test fixture state, so the finding is a pattern match on a legitimate test utility.

  402. info critical → info by review dynamic-execution test/cpp/end2end/cfstream_test.cc:93:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "sudo /sbin/ifconfig " << interface_ << " alias " << ipv4_address_;
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.85 Test helper running sudo ifconfig to add a network alias for testing.
    Reasoning

    The command configures a network alias with sudo ifconfig using test-fixture interface and address values. This is a legitimate network-setup helper for an integration test.

  403. info critical → info by review dynamic-execution test/cpp/end2end/cfstream_test.cc:99:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "sudo /sbin/ifconfig " << interface_ << " -alias " << ipv4_address_;
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.85 Test helper running sudo ifconfig to remove a network alias during teardown.
    Reasoning

    The sudo ifconfig -alias command removes the alias created by the setup helper. It is the teardown half of the same test fixture and uses only test-controlled values.

  404. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:76:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "ip addr add " << ipv4_address_ << netmask_ << " dev " << interface_;
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.85 Test helper running ip addr add to configure a test network interface.
    Reasoning

    This builds an ip addr add command from test fixture addresses to simulate network conditions in a flaky-network test. The pattern is a common test-harness use of shell commands, with no sign of hidden or attacker-controlled input.

  405. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:83:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "ip addr del " << ipv4_address_ << netmask_ << " dev " << interface_;
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.85 Test helper running ip addr del to remove a test network address.
    Reasoning

    The ip addr del command is the cleanup counterpart to the add helper in the same test. It uses only fixture-supplied values and is legitimate test teardown.

  406. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:91:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

            << "' >> /etc/hosts";
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.85 Test helper that appends a test entry to /etc/hosts via shell redirection.
    Reasoning

    The command appends a hosts entry to /etc/hosts, with its values taken from test state, to redirect traffic during a flaky-network test. This is a test fixture for network failure simulation, not a dropper or persistence mechanism.

  407. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:102:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "sed  '/" << server_host_ << "/d' /etc/hosts > /etc/hosts.orig";
        std::system(cmd.str().c_str());
    
        // clear the stream
    likely benign LLM, confidence 0.85 Test helper running sed to remove a test hosts entry and back up /etc/hosts.
    Reasoning

    The sed command removes the test host entry from /etc/hosts and backs up the file. This reverses the earlier test setup and only touches test-controlled values, so it is consistent with a legitimate test harness.

  408. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:108:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "cat /etc/hosts.orig > /etc/hosts";
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.85 Test helper restoring /etc/hosts from a backup after a network test.
    Reasoning

    The cat command restores /etc/hosts from the backup made by the preceding helper. This is standard test cleanup for the same fixture and does not indicate malicious activity.

  409. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:116:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

    
        std::system(cmd.str().c_str());
        // clear the stream
        cmd.str("");
    likely benign LLM, confidence 0.80 Test helper running iptables/tc commands via std::system to simulate network failures.
    Reasoning

    This is a gRPC test helper that builds iptables/tc shell commands for injecting network faults during flaky-network tests. The command is built from test configuration (interface names, addresses), not untrusted input, so the system call is a legitimate test pattern.

  410. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:128:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "iptables -D INPUT -s " << ipv4_address_ << " -j DROP";
        std::system(cmd.str().c_str());
        // clear the stream
        cmd.str("");
    likely benign LLM, confidence 0.80 Test teardown removing an iptables DROP rule via std::system.
    Reasoning

    Same file and pattern: an iptables -D rule removal built from the test's own IP address member. Legitimate test teardown of network fault injection.

  411. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:143:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

               "0.1% corrupt 0.01% ";
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.80 Test helper invoking tc netem to inject packet loss and corruption.
    Reasoning

    Builds a tc netem command with loss/corrupt parameters for test network emulation. Consistent with the file's purpose; no untrusted input evident.

  412. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:150:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "tc qdisc del dev " << interface_ << " root netem";
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.80 Test cleanup deleting a tc netem qdisc via std::system.
    Reasoning

    Removes a netem qdisc from a configured interface as test cleanup. Legitimate, though it runs with elevated privileges, which is expected for network fault tests.

  413. info critical → info by review dynamic-execution test/cpp/interop/grpclb_fallback_test.cc:163:13

    `system` called with a non-literal argument (ast pass, confidence 0.90)

      LOG(INFO) << "RunCommand: |" << command << "|";
      int out = std::system(command.c_str());
      if (WIFEXITED(out)) {
        int code = WEXITSTATUS(out);
    likely benign LLM, confidence 0.80 Interop test helper that runs a shell command and reports its exit status.
    Reasoning

    A RunCommand helper in an interop test executes a shell command and logs it. The command originates from test code, so this is ordinary test tooling.

  414. info critical → info by review dynamic-execution test/cpp/interop/interop_test.cc:62:5

    `execv` called with a non-literal path (ast pass, confidence 0.90)

        args.push_back(nullptr);
        execv(args[0], args.data());
        return 1;
      }
    likely benign LLM, confidence 0.85 Test code that execs a server or client binary with constructed argv.
    Reasoning

    Standard fork/execv pattern in a test that launches a server binary with arguments assembled by the test. Not an obfuscation or dropper.

  415. info critical → info by review dynamic-execution test/cpp/interop/interop_test.cc:110:5

    `execv` called with a non-literal path (ast pass, confidence 0.90)

        args.push_back(nullptr);
        execv(args[0], args.data());
        return 1;
      }
    likely benign LLM, confidence 0.85 Second execv launch in the interop test harness.
    Reasoning

    Same fork/execv pattern for launching a test process; expected for interop test harnesses.

  416. command name is a variable (`$INTEROP_TEST_BINARY`) that this file sets only to plain text (ast pass, confidence 0.40)

    # by running the "custom_metadata" interop test case and inspect the logs afterwards.
    "${INTEROP_TEST_BINARY}" --extra_client_flags="--test_case=custom_metadata,--log_metadata_and_status" 2>&1 | tee "${LOGFILE}"
    
    # grep will return an error if any of the patterns below are not found in the log
  417. base64-like blob (70 bytes, compression ratio 1.07) (outside string/comment) (raw pass, confidence 0.30)

    TEST_F(AddressSortingTest,
           TestUsesDestinationWithHigherPrecedenceWithV4CompatAndLocalhostAddress) {
      bool ipv4_supported = true;
      bool ipv6_supported = true;
  418. base64-like blob (90 bytes, compression ratio 0.94) (outside string/comment) (raw pass, confidence 0.30)

        AddressSortingTest,
        TestUsesDestinationWithHigherPrecedenceWith2000PrefixedAddressEnsurePrefixMatchHasNoEffect) {
      bool ipv4_supported = true;
      bool ipv6_supported = true;
  419. base64-like blob (74 bytes, compression ratio 1.04) (outside string/comment) (raw pass, confidence 0.30)

        AddressSortingTest,
        TestUsesDestinationWithHigherPrecedenceWithCatchAllAndAndV4MappedAddresses) {
      bool ipv4_supported = true;
      bool ipv6_supported = true;
  420. file mixes tab and space indentation (1 tab-indented and 456 space-indented lines) (raw pass, confidence 0.40)

    argp.add_argument('--test_bin_path', default=None, type=str,
                      help='Path to gtest test binary to invoke.')
    argp.add_argument('--dns_server_bin_path', default=None, type=str,
                      help='Path to local DNS server python script.')
  421. line length 1271 characters (raw pass, confidence 0.50)

      expected_chosen_service_config: '{"loadBalancingPolicy":"round_robin","methodConfig":[{"name":[{"method":"Foo","service":"SimpleService"}],"waitForReady":true},{"name":[{"method":"FooTwo","service":"SimpleService"}],"waitForReady":true},{"name":[{"method":"FooThree","service":"SimpleService"}],"waitForReady":true},{"
  422. line length 1296 characters (raw pass, confidence 0.50)

        - {TTL: '2100', data: 'grpc_config=[{"serviceConfig":{"loadBalancingPolicy":"round_robin","methodConfig":[{"name":[{"method":"Foo","service":"SimpleService"}],"waitForReady":true},{"name":[{"method":"FooTwo","service":"SimpleService"}],"waitForReady":true},{"name":[{"method":"FooThree","service":"SimpleService"}],"
  423. info warn → info by review embedded-nul-in-string test/cpp/util/string_ref_test.cc:29:49

    string literal contains an embedded NUL followed by 3 more bytes of source (token pass, confidence 0.85)

    const char kTestString[] = "blah";
    const char kTestStringWithEmbeddedNull[] = "blah\0foo";
    const size_t kTestStringWithEmbeddedNullLength = 8;
    const char kTestUnrelatedString[] = "foo";
    dismissed LLM, confidence 0.90 Test fixture string containing an explicit \0 to exercise embedded-NUL handling.
    Reasoning

    An intentional embedded NUL in a string literal, used to test string_ref handling of embedded nulls. This is deliberate test data, not obfuscation.

  424. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_async_suffix_test.sh:30:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    set -uo pipefail; set +e; f=bazel_tools/tools/bash/runfiles/runfiles.bash
    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
    likely benign LLM, confidence 0.80 Bazel runfiles bootstrap that sources runfiles.bash via environment-based paths.
    Reasoning

    This is the standard Bazel runfiles bootstrap, sourcing runfiles.bash from RUNFILES_DIR or manifest fallbacks. The path is a fixed constant, and the variable portion comes from Bazel environment, so it is a known benign idiom.

  425. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_async_suffix_test.sh:31:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.80 Fallback source of runfiles.bash resolved from manifest lookup.
    Reasoning

    Part of the same standard Bazel runfiles fallback chain; the sourced path is derived from a hardcoded relative file name and Bazel manifest lookups.

  426. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_async_suffix_test.sh:32:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.80 Further runfiles fallback resolution in the Bazel test bootstrap.
    Reasoning

    Same Bazel runfiles bootstrap chain; sourced file is the fixed runfiles library located via $0 and manifest.

  427. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_async_suffix_test.sh:33:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    likely benign LLM, confidence 0.80 Last-resort runfiles manifest lookup in the Bazel test bootstrap.
    Reasoning

    Final branch of the standard Bazel runfiles bootstrap, ending in an explicit error if not found. Benign test scaffolding.

  428. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_async_suffix_test.sh:34:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    # --- end runfiles.bash initialization v3 ---
    likely benign LLM, confidence 0.93 Bazel runfiles initialization that sources runfiles.bash from a computed path.
    Reasoning

    This is the standard Bazel runfiles bootstrap boilerplate ("end runfiles.bash initialization v3"). The dynamic source path is resolved from RUNFILES_DIR or a manifest file, a common and legitimate pattern in Bazel test scripts. No network or encoded payload is involved.

  429. info critical → info by review dynamic-execution test/csharp/codegen/csharp_codegen_async_suffix_test.sh:51:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # run protoc and the plugin with append_async_suffix option
    $PROTOC \
        --plugin=protoc-gen-grpc="$PLUGIN" \
        --csharp_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.85 Test script invoking protoc (via a variable path) with a gRPC C# plugin to generate code.
    Reasoning

    The script runs protoc with a protoc-gen-grpc plugin and a csharp_out directory, which is ordinary code generation for a gRPC test. PROTOC is set by a command substitution that is not shown, most likely locating the protoc binary from the Bazel runfiles. Nothing here fetches or runs untrusted code.

  430. command name is a variable (`$DIFFCMD`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Diff to check the contents of the generated file
    $DIFFCMD ${DATA_DIR}/expected/GreetGrpc.cs ${PROTO_OUT}/GreetGrpc.cs
    # Silence shellcheck as it doesn't allow testing of $? and there isn't an easy
    # way around it with a command with several arguments.
  431. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_base_namespace_test.sh:30:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    set -uo pipefail; set +e; f=bazel_tools/tools/bash/runfiles/runfiles.bash
    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
    likely benign LLM, confidence 0.93 Bazel runfiles bootstrap sourcing runfiles.bash via several fallback paths.
    Reasoning

    This is the standard Bazel runfiles bootstrap that sources bazel_tools runfiles.bash from RUNFILES_DIR, a manifest, or a runfiles directory. It is a normal, expected pattern in Bazel test scripts.

  432. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_base_namespace_test.sh:31:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.93 Fallback source of the Bazel runfiles helper from a manifest or runfiles directory.
    Reasoning

    This is one line of the same standard Bazel runfiles fallback chain. The sourced file is the fixed bazel_tools runfiles helper, so there is no sign of malicious intent.

  433. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_base_namespace_test.sh:32:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.93 Fallback source of the Bazel runfiles helper via manifest lookup.
    Reasoning

    This line is part of the Bazel runfiles fallback chain that locates the fixed runfiles.bash helper. It is routine test infrastructure.

  434. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_base_namespace_test.sh:33:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    likely benign LLM, confidence 0.93 Fallback source of the Bazel runfiles helper from the runfiles directory.
    Reasoning

    This is another fallback line in the standard Bazel runfiles bootstrap. It only sources the fixed bazel_tools helper and exits with an error if none is found.

  435. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_base_namespace_test.sh:34:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    # --- end runfiles.bash initialization v3 ---
    likely benign LLM, confidence 0.93 Final fallback in the Bazel runfiles bootstrap, ending the initialization block.
    Reasoning

    This is the final fallback in the standard Bazel runfiles initialization, followed by the 'end runfiles.bash initialization v3' marker. It is expected boilerplate with no malicious behavior.

  436. info critical → info by review dynamic-execution test/csharp/codegen/csharp_codegen_base_namespace_test.sh:51:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # run protoc and the plugin specifying the base_namespace options
    $PROTOC \
        --plugin=protoc-gen-grpc-csharp="$PLUGIN" \
        --csharp_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.85 Test invoking protoc through a variable path with the gRPC C# plugin for code generation.
    Reasoning

    The script runs protoc with a gRPC C# plugin to generate code for a base_namespace test. The variable command name is most likely a runfiles-resolved protoc path. This is ordinary build test behavior.

  437. info critical → info by review dynamic-execution test/csharp/codegen/csharp_codegen_base_namespace_test.sh:88:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    $PROTOC \
        --plugin=protoc-gen-grpc-csharp="$PLUGIN" \
        --csharp_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.85 Second protoc code-generation invocation in the base_namespace test script.
    Reasoning

    The same protoc invocation with the gRPC C# plugin and csharp_out appears again in a second test case. It is code generation with no sign of untrusted execution.

  438. info critical → info by review dynamic-execution test/csharp/codegen/csharp_codegen_base_namespace_test.sh:124:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    $PROTOC \
        --plugin=protoc-gen-grpc-csharp="$PLUGIN" \
        --csharp_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.85 Third protoc code-generation invocation in the base_namespace test script.
    Reasoning

    This is a third protoc code-generation invocation with the gRPC C# plugin in the same test file. Its variable command resolves to protoc in the normal way for a test harness.

  439. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_deprecated_test.sh:30:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    set -uo pipefail; set +e; f=bazel_tools/tools/bash/runfiles/runfiles.bash
    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
    likely benign LLM, confidence 0.93 Bazel runfiles bootstrap that sources runfiles.bash from one of several candidate locations.
    Reasoning

    This is the standard Bazel runfiles.bash initialization boilerplate. The sourced path is a fixed relative path (bazel_tools/tools/bash/runfiles/runfiles.bash) resolved through known runfiles locations, a common and legitimate Bazel test idiom.

  440. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_deprecated_test.sh:31:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.93 Fallback source of runfiles.bash via manifest lookup, part of Bazel boilerplate.
    Reasoning

    Part of the same standard Bazel runfiles initialization chain; the dynamic source paths are derived from RUNFILES_DIR/manifest and the script's own path, which is expected for Bazel tests.

  441. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_deprecated_test.sh:32:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.93 Further runfiles fallback in standard Bazel test bootstrap.
    Reasoning

    Same standard Bazel runfiles fallback chain with manifest grep and $0.runfiles lookups; no network fetch or untrusted input is involved.

  442. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_deprecated_test.sh:33:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    likely benign LLM, confidence 0.93 Final runfiles fallback and error handling in Bazel test initialization.
    Reasoning

    Standard Bazel runfiles boilerplate ending with an error exit when the file cannot be found; this is the canonical template text.

  443. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_deprecated_test.sh:34:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    # --- end runfiles.bash initialization v3 ---
    likely benign LLM, confidence 0.90 End of standard Bazel runfiles initialization template.
    Reasoning

    Closing lines of the standard Bazel runfiles initialization block, with the end marker comment present; no malicious behavior.

  444. info critical → info by review dynamic-execution test/csharp/codegen/csharp_codegen_deprecated_test.sh:51:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # run protoc and the plugin
    $PROTOC \
        --plugin=protoc-gen-grpc="$PLUGIN" \
        --csharp_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.85 Invocation of the protoc compiler via a configured path variable with a C# gRPC plugin.
    Reasoning

    $PROTOC is a variable holding the protoc tool path set by the build system (Bazel test), then invoked with plugin and output arguments. This is a normal way to run a configured compiler, not injected code. The rule flags the runtime-determined command name, but the context is a legitimate codegen test.

  445. info critical → info by review dynamic-execution test/csharp/codegen/csharp_codegen_deprecated_test.sh:104:6

    command name is a variable (`$nmatches`) and `nmatches` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    nmatches=$(echo "$CTX" | grep -c "class GreeterServiceLevelDepClient" || true)
    if [ "$nmatches" -ne 1 ]
    then
        echo >&2 "Missing ObsoleteAttribute on class GreeterServiceLevelDepClient"
    dismissed LLM, confidence 0.88 Grep count stored in a variable and compared numerically to check for an attribute in generated code.
    Reasoning

    The snippet is not executing $nmatches as a command; it is used as an integer operand in a test expression `[ "$nmatches" -ne 1 ]`. The finding is a false positive from misreading a numeric comparison as command execution.

  446. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_simple_test.sh:30:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    set -uo pipefail; set +e; f=bazel_tools/tools/bash/runfiles/runfiles.bash
    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
    likely benign LLM, confidence 0.93 Bazel runfiles bootstrap sourcing runfiles.bash.
    Reasoning

    Standard Bazel runfiles.bash initialization boilerplate, identical to the sibling test script, with a fixed library path.

  447. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_simple_test.sh:31:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.93 Runfiles fallback source in Bazel test bootstrap.
    Reasoning

    Same standard Bazel runfiles fallback chain; dynamic paths come from runfiles configuration, a common benign pattern.

  448. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_simple_test.sh:32:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.90 Bazel runfiles bootstrap line that sources a helper script from a computed path.
    Reasoning

    This is the standard Bazel runfiles bash initialization. It sources the runfiles helper from paths built out of the manifest and $0, and falls back to an error if none is found. The dynamic path is expected for this boilerplate and is not an attack.

  449. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_simple_test.sh:33:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    likely benign LLM, confidence 0.90 Fallback line in the Bazel runfiles bootstrap chain, sourcing from runfiles paths.
    Reasoning

    Continuation of the same standard Bazel runfiles initialization chain. The fallback sources only resolve paths under the test's own runfiles directory or manifest, with no network or decoded payload involved.

  450. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_simple_test.sh:34:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    # --- end runfiles.bash initialization v3 ---
    likely benign LLM, confidence 0.90 Last part of the Bazel runfiles bootstrap that sources a helper and exits on failure.
    Reasoning

    Final lines of the standard runfiles bootstrap, ending with an error exit if the file is not found. This is ordinary Bazel test scaffolding.

  451. info critical → info by review dynamic-execution test/csharp/codegen/csharp_codegen_simple_test.sh:51:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # run protoc and the plugin
    $PROTOC \
        --plugin=protoc-gen-grpc="$PLUGIN" \
        --csharp_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.80 Test script runs protoc, whose path comes from a variable, with a local gRPC C# plugin.
    Reasoning

    $PROTOC is a variable holding the protoc binary path, set by the test's runfiles lookup. The command then runs protoc with a local plugin and an output directory, which is the normal way to run protobuf codegen in a test. The runtime-determined command is expected here. Confidence is lower than for the boilerplate because the assignment was not shown.

  452. command name is a variable (`$DIFFCMD`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Diff to check the contents of the generated file
    $DIFFCMD ${DATA_DIR}/expected/HelloworldGrpc.cs ${PROTO_OUT}/HelloworldGrpc.cs
    # Silence shellcheck as it doesn't allow testing of $? and there isn't an easy
    # way around it with a command with several arguments.
  453. info critical → info by review dynamic-execution test/distrib/python/run_binary_distrib_test.sh:19:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    
    "$(dirname "$0")/test_packages.sh" binary
    likely benign LLM, confidence 0.90 Distribution test driver that runs the sibling test_packages.sh in binary mode.
    Reasoning

    Executes a sibling script located via dirname of $0, passing the argument 'binary'. This is a normal test driver delegating to test_packages.sh, with no download or decode step.

  454. info critical → info by review dynamic-execution test/distrib/python/run_source_distrib_test.sh:19:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    
    "$(dirname "$0")/test_packages.sh" source
    likely benign LLM, confidence 0.90 Distribution test driver that runs the sibling test_packages.sh in source mode.
    Reasoning

    Same pattern as the binary variant: it runs test_packages.sh from the script's own directory with the argument 'source'. This is ordinary test orchestration.

  455. info warn → info by review dynamic-execution test/distrib/python/test_packages.sh:50:1

    command name is a variable (`$PYTHON_BIN`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # the version of the wheels we are testing.
    ${PYTHON_BIN:-python3} -m virtualenv "$VIRTUAL_ENV"
    PYTHON=$VIRTUAL_ENV/bin/python
    "$PYTHON" -m pip install --upgrade six pip wheel setuptools
    likely benign LLM, confidence 0.80 Creates a virtualenv using an interpreter chosen by the PYTHON_BIN environment variable, defaulting to python3.
    Reasoning

    ${PYTHON_BIN:-python3} lets the environment choose the interpreter, with python3 as the default, to create a virtualenv. Environment-selected interpreters are common in CI test scripts. The variable is not set in this file, but nothing suggests a malicious source.

  456. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    PYTHON=$VIRTUAL_ENV/bin/python
    "$PYTHON" -m pip install --upgrade six pip wheel setuptools
    
    function validate_wheel_hashes() {
  457. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      for file in "$@"; do
        "$PYTHON" -m wheel unpack "$file" -d /tmp || return 1
      done
      return 0
  458. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      for file in "$@"; do
        if "$PYTHON" -m pip install "$file"; then
          return 0
        fi
  459. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    # code from it and then use the generated code from distribtest.py
    "$PYTHON" -m grpc_tools.protoc --help
    
    "$PYTHON" distribtest.py
  460. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    "$PYTHON" distribtest.py
  461. info warn → info by review macro-keyword-override third_party/cares/config_android/ares_config.h:43:1

    `#define GETNAMEINFO_TYPE_ARG7 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 7 for getnameinfo. */
    #define GETNAMEINFO_TYPE_ARG7 int
    
    /* Specifies the number of arguments to getservbyport_r */
    dismissed LLM, confidence 0.95 Autoconf-generated macro defining the getnameinfo argument 7 type as int.
    Reasoning

    This is an autoconf-generated config header from the c-ares library. It defines type-alias macros such as GETNAMEINFO_TYPE_ARG7 to int, which is how c-ares records platform signature types. It is not a keyword-hiding obfuscation.

  462. info warn → info by review macro-keyword-override third_party/cares/config_android/ares_config.h:350:1

    `#define RECVFROM_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recvfrom. */
    #define RECVFROM_TYPE_ARG1 int
    
    /* Define to the type pointed by arg 2 for recvfrom. */
    dismissed LLM, confidence 0.95 Autoconf-generated macro defining the recvfrom argument 1 type as int.
    Reasoning

    Standard generated platform type macro in the c-ares Android config header, documenting recvfrom argument 1 as int. It is a normal configuration define.

  463. info warn → info by review macro-keyword-override third_party/cares/config_android/ares_config.h:362:1

    `#define RECVFROM_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recvfrom. */
    #define RECVFROM_TYPE_ARG4 int
    
    /* Define to the type pointed by arg 5 for recvfrom. */
    dismissed LLM, confidence 0.95 Autoconf-generated macro defining the recvfrom argument 4 type as int.
    Reasoning

    Standard generated platform type macro in the c-ares Android config header for recvfrom argument 4. This is expected autoconf output.

  464. info warn → info by review macro-keyword-override third_party/cares/config_android/ares_config.h:380:1

    `#define RECV_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recv. */
    #define RECV_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for recv. */
    dismissed LLM, confidence 0.95 Autoconf-generated macro defining the recv argument 1 type as int.
    Reasoning

    Standard generated platform type macro for recv argument 1 in the c-ares Android config. The pattern is the usual autoconf type-probe output and is not malicious.

  465. info warn → info by review macro-keyword-override third_party/cares/config_android/ares_config.h:389:1

    `#define RECV_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recv. */
    #define RECV_TYPE_ARG4 int
    
    /* Define to the function return type for recv. */
    dismissed LLM, confidence 0.95 Autoconf-generated type alias for recv argument 4 in the c-ares Android config.
    Reasoning

    This is an autoconf-generated c-ares config header. The macro maps a type-description name to a type for recv's argument signature, which is standard configure output and not obfuscation.

  466. info warn → info by review macro-keyword-override third_party/cares/config_android/ares_config.h:401:1

    `#define SEND_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for send. */
    #define SEND_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for send. */
    dismissed LLM, confidence 0.95 Autoconf-generated type alias for send argument 1 in the c-ares Android config.
    Reasoning

    Standard autoconf output in a vendored c-ares config header. The macro is a type alias used in function signature detection, with no execution or hidden payload.

  467. info warn → info by review macro-keyword-override third_party/cares/config_android/ares_config.h:410:1

    `#define SEND_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for send. */
    #define SEND_TYPE_ARG4 int
    
    /* Define to the function return type for send. */
    dismissed LLM, confidence 0.95 Autoconf-generated type alias for send argument 4 in the c-ares Android config.
    Reasoning

    Same autoconf pattern as the other c-ares config definitions. The rule fires on any macro that expands to a C type keyword, which is expected for these headers.

  468. info warn → info by review macro-keyword-override third_party/cares/config_darwin/ares_config.h:43:1

    `#define GETNAMEINFO_TYPE_ARG7 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 7 for getnameinfo. */
    #define GETNAMEINFO_TYPE_ARG7 int
    
    /* Specifies the number of arguments to getservbyport_r */
    dismissed LLM, confidence 0.95 Autoconf-generated type alias for getnameinfo argument 7 in the Darwin c-ares config.
    Reasoning

    Autoconf-generated c-ares config for Darwin defining the getnameinfo argument 7 type. This is a routine platform type probe result.

  469. info warn → info by review macro-keyword-override third_party/cares/config_darwin/ares_config.h:352:1

    `#define RECVFROM_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recvfrom. */
    #define RECVFROM_TYPE_ARG1 int
    
    /* Define to the type pointed by arg 2 for recvfrom. */
    dismissed LLM, confidence 0.95 Autoconf-generated type alias for recvfrom argument 1 in the Darwin c-ares config.
    Reasoning

    Standard autoconf type-detection output for recvfrom in a vendored c-ares header. The macro only names a C type.

  470. info warn → info by review macro-keyword-override third_party/cares/config_darwin/ares_config.h:364:1

    `#define RECVFROM_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recvfrom. */
    #define RECVFROM_TYPE_ARG4 int
    
    /* Define to the type pointed by arg 5 for recvfrom. */
    dismissed LLM, confidence 0.95 Autoconf-generated type alias for recvfrom argument 4 in the Darwin c-ares config.
    Reasoning

    Autoconf-generated type alias for recvfrom argument 4 in a vendored c-ares config header, with no executable behavior.

  471. info warn → info by review macro-keyword-override third_party/cares/config_darwin/ares_config.h:382:1

    `#define RECV_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recv. */
    #define RECV_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for recv. */
    dismissed LLM, confidence 0.95 Autoconf-generated type alias for recv argument 1 in the Darwin c-ares config.
    Reasoning

    Routine autoconf type-detection macro for recv in a vendored c-ares config. The rule misfires on ordinary C type macros.

  472. info warn → info by review macro-keyword-override third_party/cares/config_darwin/ares_config.h:391:1

    `#define RECV_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recv. */
    #define RECV_TYPE_ARG4 int
    
    /* Define to the function return type for recv. */
    dismissed LLM, confidence 0.95 Autoconf-generated type alias for recv argument 4 in the Darwin c-ares config.
    Reasoning

    Standard autoconf output for recv argument 4 in a vendored c-ares header. This is a false positive.

  473. info warn → info by review macro-keyword-override third_party/cares/config_darwin/ares_config.h:403:1

    `#define SEND_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for send. */
    #define SEND_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for send. */
    dismissed LLM, confidence 0.95 Autoconf-generated type alias for send argument 1 in the Darwin c-ares config.
    Reasoning

    Autoconf-generated type alias for send argument 1 in a vendored c-ares config header. The macro is a plain type name.

  474. info warn → info by review macro-keyword-override third_party/cares/config_darwin/ares_config.h:412:1

    `#define SEND_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for send. */
    #define SEND_TYPE_ARG4 int
    
    /* Define to the function return type for send. */
    dismissed LLM, confidence 0.95 Autoconf-generated type alias for send argument 4 in the Darwin c-ares config.
    Reasoning

    Autoconf-generated type alias for send argument 4 in a vendored c-ares config header, a routine build-time artifact.

  475. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:35:1

    `#define GETNAMEINFO_QUAL_ARG1 const` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type qualifier of arg 1 for getnameinfo. */
    #define GETNAMEINFO_QUAL_ARG1 const
    
    /* Define to the type of arg 1 for getnameinfo. */
    dismissed LLM, confidence 0.95 Autoconf-generated const qualifier macro for getnameinfo argument 1 in the FreeBSD c-ares config.
    Reasoning

    Autoconf-generated type qualifier macro for getnameinfo in a vendored c-ares FreeBSD config. Defining the qualifier as const is standard and benign.

  476. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:47:1

    `#define GETNAMEINFO_TYPE_ARG7 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 7 for getnameinfo. */
    #define GETNAMEINFO_TYPE_ARG7 int
    
    /* Specifies the number of arguments to getservbyport_r */
    dismissed LLM, confidence 0.95 Autoconf-generated type alias for getnameinfo argument 7 in the FreeBSD c-ares config.
    Reasoning

    Autoconf-generated type alias for getnameinfo argument 7 in a vendored c-ares config header. It is a benign type probe result.

  477. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:390:1

    `#define RECVFROM_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recvfrom. */
    #define RECVFROM_TYPE_ARG1 int
    
    /* Define to the type pointed by arg 2 for recvfrom. */
    dismissed LLM, confidence 0.97 Autoconf config macro mapping RECVFROM_TYPE_ARG1 to int.
    Reasoning

    Autoconf-generated config header defining a type macro to int, a standard practice for c-ares platform configuration. The keyword-override signal is a false positive from a pattern that is ubiquitous in autotools output.

  478. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:393:1

    `#define RECVFROM_TYPE_ARG2 void` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type pointed by arg 2 for recvfrom. */
    #define RECVFROM_TYPE_ARG2 void
    
    /* Define to 1 if the type pointed by arg 2 for recvfrom is void. */
    dismissed LLM, confidence 0.97 Autoconf config macro mapping RECVFROM_TYPE_ARG2 to void.
    Reasoning

    Standard autoconf-generated type macro for recvfrom signature; defining it as void is the expected platform configuration with comments matching autoconf templates.

  479. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:402:1

    `#define RECVFROM_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recvfrom. */
    #define RECVFROM_TYPE_ARG4 int
    
    /* Define to the type pointed by arg 5 for recvfrom. */
    dismissed LLM, confidence 0.97 Autoconf config macro mapping RECVFROM_TYPE_ARG4 to int.
    Reasoning

    Autoconf-generated socket type macro in a vendored c-ares config header; benign and expected.

  480. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:420:1

    `#define RECV_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recv. */
    #define RECV_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for recv. */
    dismissed LLM, confidence 0.97 Autoconf config macro mapping RECV_TYPE_ARG1 to int.
    Reasoning

    Standard autoconf-generated recv type macro in a vendored configuration header; no malicious indicators.

  481. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:429:1

    `#define RECV_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recv. */
    #define RECV_TYPE_ARG4 int
    
    /* Define to the function return type for recv. */
    dismissed LLM, confidence 0.97 Autoconf config macro mapping RECV_TYPE_ARG4 to int.
    Reasoning

    Standard autoconf-generated recv type macro with descriptive comments; benign platform configuration.

  482. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:435:1

    `#define RETSIGTYPE void` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define as the return type of signal handlers (`int' or `void'). */
    #define RETSIGTYPE void
    
    /* Define to the type qualifier of arg 2 for send. */
    dismissed LLM, confidence 0.97 Autoconf config macro mapping RETSIGTYPE to void.
    Reasoning

    RETSIGTYPE is a classic autoconf-generated macro whose value is void or int; this is a normal platform config entry.

  483. command name is a variable (`$RBE_CONFIGS_GEN_TOOL_PATH`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    ${RBE_CONFIGS_GEN_TOOL_PATH} \
        --bazel_version="${BAZEL_VERSION}" \
        --toolchain_container="${LINUX_RBE_DOCKER_IMAGE}" \
  484. command name is a variable (`$RBE_CONFIGS_GEN_TOOL_PATH`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    ${RBE_CONFIGS_GEN_TOOL_PATH} \
        --bazel_version="${BAZEL_VERSION}" \
        --toolchain_container="${WINDOWS_RBE_DOCKER_IMAGE}" \
  485. 13 of 30 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)

  486. identifier `𤭢XX` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

    
          "$¢€𤭢XX",
          "$¢€𤭢XX",
  487. identifier `𤭢XX` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

          "$¢€𤭢XX",
          "$¢€𤭢XX",
    
          "\xed\xa1\x92XX",
  488. info critical → info by review dynamic-execution tools/artifact_gen/gen_upb_api_from_bazel.sh:49:1

    command name is a variable (`$TMP_DIR`) and `TMP_DIR` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Clean existing generated files
    ${TMP_DIR}/gen_upb_api_from_bazel --mode=clean $@
    
    UPB_RULES_XML=$(mktemp)
    likely benign LLM, confidence 0.80 Build script runs a generator binary placed in a temp directory.
    Reasoning

    TMP_DIR is set from a mktemp/build step within the same script and the executed binary is a generator built into that temp directory. This is a build script pattern, though executing a runtime-built binary is worth noting. The flagged pattern is legitimate build tooling.

  489. info critical → info by review dynamic-execution tools/artifact_gen/gen_upb_api_from_bazel.sh:59:13

    command name is a variable (`$TMP_DIR`) and `TMP_DIR` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Now we can use the generator to get the list of deps.
    DEPS_LIST=$(${TMP_DIR}/gen_upb_api_from_bazel \
                  --mode=list_deps \
                  --upb_rules_xml="${UPB_RULES_XML}")
    likely benign LLM, confidence 0.80 Command substitution invoking the generator to list dependencies.
    Reasoning

    Same generator invocation pattern as the other findings in this script: the variable path points to a locally built helper used to list dependencies. Consistent with normal Bazel-driven codegen.

  490. info critical → info by review dynamic-execution tools/artifact_gen/gen_upb_api_from_bazel.sh:73:17

    command name is a variable (`$TMP_DIR`) and `TMP_DIR` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Get the list of upb targets to build
    BUILD_TARGETS=$(${TMP_DIR}/gen_upb_api_from_bazel \
                      --mode=list_build_targets \
                      --upb_rules_xml="${UPB_RULES_XML}")
    likely benign LLM, confidence 0.80 Command substitution invoking the generator to list build targets.
    Reasoning

    Invokes the same locally built generator in list_build_targets mode to collect build targets; legitimate codegen logic.

  491. info critical → info by review dynamic-execution tools/artifact_gen/gen_upb_api_from_bazel.sh:83:1

    command name is a variable (`$TMP_DIR`) and `TMP_DIR` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Run the C++ program to copy the generated files.
    ${TMP_DIR}/gen_upb_api_from_bazel \
      --mode=generate_and_copy \
      --upb_rules_xml="${UPB_RULES_XML}" \
    likely benign LLM, confidence 0.80 Runs the generator binary to copy generated upb files.
    Reasoning

    Runs the generator in generate_and_copy mode to copy generated sources; expected for a code generation script. Dynamic path is a locally produced binary, not attacker-controlled input.

  492. info critical → info by review dynamic-execution tools/bazel:89:1

    `exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)

    popd >/dev/null
    exec "${filename_abs}" "$@"
    likely benign LLM, confidence 0.80 Launcher script that execs the resolved bazel binary.
    Reasoning

    This is the standard Bazelisk-style wrapper that resolves and execs the real bazel binary from a path computed within the script. The dynamic exec is inherent to a launcher script and not evidence of a dropper.

  493. command name is a variable (`$BUILD_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

    SCRIPT_EXIT_CODE=0
    ../"${BUILD_SCRIPT}" >"../${SCRIPT_LOG_FILE}" 2>&1  || SCRIPT_EXIT_CODE="$?"
    
    # Store build script's exitcode in a file.
  494. info critical → info by review dynamic-execution tools/bazelify_tests/grpc_repo_archive.sh:47:6

    command name is a variable (`$GRPC_GIT_COMMIT_FROM_STABLE_STATUS`) and `GRPC_GIT_COMMIT_FROM_STABLE_STATUS` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    if [ "${GRPC_GIT_COMMIT_FROM_STABLE_STATUS}" == "" ]
    then
      echo "Failed to obtain info about gRPC git commit from the bazel workspace. Make sure you invoke bazel with --workspace_status_command=tools/bazelify_tests/workspace_status_cmd.sh" >&2
    likely benign LLM, confidence 0.90 A bash conditional that checks whether a workspace status variable is empty and prints an error if so.
    Reasoning

    The snippet is an if-test comparing the variable to an empty string. It does not execute the variable as a command, so the scanner's 'command name is a variable' signal is a false positive from the surrounding context.

  495. command name is a variable (`$BUILD_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Run build script passed as arg.
    "${BUILD_SCRIPT}"
  496. info critical → info by review dynamic-execution tools/bazelify_tests/test/bazel_build_out_of_tree_with_bzlmod_linux.sh:24:1

    command name is a variable (`$GIT_ROOT`) and `GIT_ROOT` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # releases.
    $GIT_ROOT/tools/bazel \
        build \
        -- \
    likely benign LLM, confidence 0.85 A test script that runs the repository's bundled bazel wrapper from a git-root-derived path.
    Reasoning

    $GIT_ROOT is almost certainly set from git rev-parse in a grpc test script, and the command invokes the repo's own tools/bazel wrapper. This is a routine build-test invocation with no sign of malicious intent.

  497. info critical → info by review dynamic-execution tools/bazelify_tests/test/bazel_build_out_of_tree_with_bzlmod_linux.sh:43:1

    command name is a variable (`$GIT_ROOT`) and `GIT_ROOT` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Some nobuild tests for bzlmod dependency check.
    $GIT_ROOT/tools/bazel \
        build \
        --nobuild \
    likely benign LLM, confidence 0.85 A nobuild bazel invocation through the git-root-derived bazel wrapper for a bzlmod dependency check.
    Reasoning

    The same pattern as the other finding in this file: the path comes from the git root and runs the repo's bazel wrapper with --nobuild for a dependency check. Routine test tooling.

  498. info critical → info by review dynamic-execution tools/bazelify_tests/test/bazel_build_out_of_tree_with_bzlmod_linux.sh:50:1

    command name is a variable (`$GIT_ROOT`) and `GIT_ROOT` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    $GIT_ROOT/tools/bazel \
        build \
        --nobuild \
    likely benign LLM, confidence 0.85 A bazel build invocation with --nobuild via the git-root-derived wrapper path.
    Reasoning

    Another bazel wrapper invocation from a git-root-derived variable, identical in shape to the other findings in this file. Benign test scaffolding.

  499. info critical → info by review dynamic-execution tools/buildgen/generate_projects.py:146:29

    `os.system` called on a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

                if os.path.isfile(g):
                    assert 0 == os.system("diff %s %s" % (s, g)), s
                    os.unlink(g)
                else:
    likely benign LLM, confidence 0.85 A build-generator check that diffs a generated file against its checked-in copy via os.system.
    Reasoning

    The os.system call runs a diff between generated and checked-in project files, with paths produced by the build generator. Shell string formatting is poor practice, but the inputs are internal build paths and the code is a legitimate consistency check.

  500. info critical → info by review dynamic-execution tools/buildgen/generate_projects.py:149:29

    `os.system` called on a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

                else:
                    assert 0 == os.system("diff -r %s %s" % (s, g)), s
                    shutil.rmtree(g, ignore_errors=True)
    likely benign LLM, confidence 0.85 A build-generator check that runs a recursive diff on generated directories via os.system.
    Reasoning

    This is the recursive directory variant of the same diff check, using internal generator paths. It is benign build tooling, with only a minor code-quality concern about shell interpolation.

  501. command name is a variable (`$VENV_PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      PY_VERSION="$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')"
      PY_VENV_VERSION="$(${VENV_PYTHON} -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")' || echo "broken")"
      if  [[ "${PY_VERSION}" !=  "${PY_VENV_VERSION}" ]]; then
  502. command name is a variable (`$VENV_PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    echo -n "Using ${VENV_DIR} venv with Python interpreter: "
    "${VENV_PYTHON}" -VV
    
    # TODO(sergiitk): remove GRPC_GENERATE_PROJECTS_SKIP_XDS_PROTOS when all CIs are
  503. command name is a variable (`$VENV_PIP`) that this file sets only to plain text (ast pass, confidence 0.40)

      # python releases, as older grpcio-tools release may not support them.
      "${VENV_PIP}" install grpcio-tools==1.74.0
      "${VENV_PIP}" list
  504. command name is a variable (`$VENV_PIP`) that this file sets only to plain text (ast pass, confidence 0.40)

      "${VENV_PIP}" install grpcio-tools==1.74.0
      "${VENV_PIP}" list
    
      echo "[gRPC Python] Generating xds-protos"
  505. command name is a variable (`$VENV_PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      echo "[gRPC Python] Generating xds-protos"
      "${VENV_PYTHON}" py_xds_protos/build_xds_protos.py
    fi
  506. command name is a variable (`$VENV_PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    echo "[gRPC Python] Making other grpcio auxilary packages"
    "${VENV_PYTHON}" tools/distrib/python/make_grpcio_tools.py
    "${VENV_PYTHON}" src/python/grpcio_observability/make_grpcio_observability.py
    echo "[gRPC Python] Done: auxilary packages"
  507. command name is a variable (`$VENV_PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    "${VENV_PYTHON}" tools/distrib/python/make_grpcio_tools.py
    "${VENV_PYTHON}" src/python/grpcio_observability/make_grpcio_observability.py
    echo "[gRPC Python] Done: auxilary packages"
  508. command name is a variable (`$buildifier_bin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # shellcheck disable=SC2086,SC2068
    ${buildifier_bin} ${EXTRA_BUILDIFIER_FLAGS[@]} -v ${bazel_files}
  509. command name is a variable (`$buildifier_format_script`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    ${buildifier_format_script} -lint fix
  510. info dynamic-execution tools/distrib/buildozer.sh:82:39

    command name is a variable (`$TEMP_BUILDOZER_PATH`) that this file sets only to plain text (ast pass, confidence 0.40)

        if [ -x ${TEMP_BUILDOZER_PATH} ]; then
            existing_buildozer_version="$(${TEMP_BUILDOZER_PATH} -version 2>&1 | head -n1 | cut -d" " -f3)"
            if [[ "${existing_buildozer_version}" != "${BUILDOZER_VERSION}" ]]; then
                download_buildozer
  511. info dynamic-execution tools/distrib/buildozer.sh:99:1

    command name is a variable (`$buildozer_bin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # shellcheck disable=SC2086,SC2068
    ${buildozer_bin} "$@"
  512. info critical → info by review dynamic-execution tools/distrib/check_copyright.py:279:9

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

        filename_list = (
            subprocess.check_output(FILE_LIST_COMMAND, shell=True)
            .decode()
            .splitlines()
    likely benign LLM, confidence 0.90 A copyright-check linter that gets its file list by running a constant shell command.
    Reasoning

    FILE_LIST_COMMAND is a module constant that lists tracked files, and the shell=True call only lists repo files for a copyright lint. The scanner flagged a non-literal command, but the command is fixed and internal.

  513. info critical → info by review dynamic-execution tools/distrib/check_include_guards.py:241:9

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

        filename_list = (
            subprocess.check_output(FILE_LIST_COMMAND, shell=True)
            .decode()
            .splitlines()
    likely benign LLM, confidence 0.90 An include-guard linter that obtains its file list from a constant shell command.
    Reasoning

    This is the same fixed FILE_LIST_COMMAND pattern in an include-guard linter. The command is a constant file-listing invocation with no external input.

  514. info critical → info by review dynamic-execution tools/distrib/check_namespace_qualification.py:115:9

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

        filename_list = (
            subprocess.check_output(FILE_LIST_COMMAND, shell=True)
            .decode()
            .splitlines()
    likely benign LLM, confidence 0.90 A namespace-qualification linter that gets its file list from a constant shell command.
    Reasoning

    Same constant FILE_LIST_COMMAND shell=True pattern in a namespace-qualification lint script. No untrusted input reaches the command.

  515. command name is a variable (`$FIX`) that this file sets only to plain text (ast pass, confidence 0.40)

      echo "$ERRORS"
      if ! $FIX; then
        exit 1
      fi
  516. info critical → info by review dynamic-execution tools/distrib/fix_build_deps.py:429:5

    `exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)

        parsing_path = dirname
        exec(
            open("%sBUILD" % (dirname + "/" if dirname else ""), "r").read(),
            {
    likely benign LLM, confidence 0.70 A dependency-fixing script that exec's the contents of a BUILD file at module scope to read its declarations.
    Reasoning

    The module-scope exec runs the contents of a repository BUILD file through a Python evaluator with a custom namespace. This is a deliberate evaluation of Bazel build files in a developer tool, not hidden obfuscation. Executing repo-controlled code at import is worth noting, but it fits the tool's purpose.

  517. info dynamic-execution tools/distrib/format_bazel.sh:24:1

    command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    PYTHON=${VIRTUAL_ENV}/bin/python
    "$PYTHON" -m pip install --upgrade pip==19.3.1
    "$PYTHON" -m pip install yapf==0.30.0
  518. info dynamic-execution tools/distrib/format_bazel.sh:25:1

    command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    "$PYTHON" -m pip install --upgrade pip==19.3.1
    "$PYTHON" -m pip install yapf==0.30.0
    
    pushd "$(dirname "${0}")/../.."
  519. info critical → info by review dynamic-execution tools/distrib/python_wrapper.sh:28:3

    `exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)

    if [ -x "$python" ] ; then
      exec "$python" "$@"
    else
      echo "No acceptable version of python found on the system"
    likely benign LLM, confidence 0.90 A shell wrapper that finds a usable python interpreter and execs it with the original arguments.
    Reasoning

    The wrapper selects an interpreter from a list of candidates, checks it is executable, and execs it with the script's arguments. This is the standard python-version-selection pattern and is benign.

  520. command name is a variable (`$PYTHON_PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)

    # install cython and wheel
    "${PYTHON_PREFIX}/bin/python3" -m pip install --upgrade 'cython==3.1.1' wheel
  521. command name is a variable (`$CLANG_FORMAT`) that this file sets only to plain text (ast pass, confidence 0.40)

        tmp=`mktemp`
        $CLANG_FORMAT $file > $tmp
        diff -u $file $tmp || ok=no
        rm $tmp
  522. command name is a variable (`$exclude`) that this file sets only to plain text (ast pass, confidence 0.40)

      done
      if $exclude; then
        continue
      fi
  523. info critical → info by review dynamic-execution tools/gce/linux_kokoro_performance_worker_init.sh:151:1

    `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

    export PATH="$HOME/.rbenv/bin:$PATH"
    eval "$(rbenv init -)"
    
    git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build
    likely benign LLM, confidence 0.92 Provisioning script that evals rbenv's init output and clones ruby-build into the home directory.
    Reasoning

    eval of `rbenv init -` is the standard documented way to set up rbenv shims. The surrounding lines add a local rbenv PATH and clone the public ruby-build repo. This is a normal provisioning step for a performance worker in a legitimate project.

  524. info critical → info by review dynamic-execution tools/gource/make-video.sh:20:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    shift
    $(dirname $0)/gource.sh \
      --disable-progress    \
      --stop-at-end         \
    dismissed LLM, confidence 0.93 Wrapper that invokes the sibling gource.sh helper via a dirname-based path.
    Reasoning

    `$(dirname $0)/gource.sh` runs a sibling script located relative to the current script. This is a common, safe idiom for invoking helper scripts in the same directory and contains no remote fetch or decoding.

  525. info critical → info by review dynamic-execution tools/internal_ci/helper_scripts/prepare_build_linux_perf_multilang_rc:31:1

    `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

    export PATH="$HOME/.rbenv/bin:$PATH"
    eval "$(rbenv init -)"
    gem list bundler
    gem install bundler --no-document
    likely benign LLM, confidence 0.92 CI helper that initializes rbenv via eval and installs bundler gem.
    Reasoning

    eval of `rbenv init -` followed by standard gem install bundler commands is routine CI environment setup. No obfuscated payload or untrusted input is involved.

  526. command name is a variable (`$is_sonoma`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    if $is_sonoma; then
      brew install cmake
      brew install gnupg
  527. command name is a variable (`$is_sonoma`) that this file sets only to plain text (ast pass, confidence 0.40)

    # cleanup this once migration complete
    if [ "${PREPARE_BUILD_INSTALL_DEPS_RUBY}" == "true" ] && ! $is_sonoma;
    then
      # Workaround for https://github.com/rvm/rvm/issues/5133
  528. command name is a variable (`$is_sonoma`) that this file sets only to plain text (ast pass, confidence 0.40)

    
      if $is_sonoma; then
        # See https://getcomposer.org/download.
        # Composer installer checksum verification: https://composer.github.io/pubkeys.html
  529. info critical → info by review dynamic-execution tools/internal_ci/linux/aws/grpc_aws_run_remote_test_8core.sh:18:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    
    AWS_INSTANCE_TYPE="t4g.2xlarge" "$(dirname $0)/grpc_aws_run_remote_test.sh"
    dismissed LLM, confidence 0.93 CI wrapper that runs the sibling remote-test script with an instance type override.
    Reasoning

    Runs a sibling script via `$(dirname $0)` with an environment variable set for instance type. This is the standard in-repo CI invocation pattern.

  530. command name is a variable (`$job_name`) that this file sets only to plain text (ast pass, confidence 0.40)

        set -x
        "cleanup::job::${job_name}" "${job_name}" || (( ++failed_jobs ))
        set +x
        echo "-------------------- Finished job ${job_name} --------------------"
  531. info critical → info by review dynamic-execution tools/internal_ci/linux/grpc_xds_v3_bazel_python_test_in_docker.sh:16:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    
    XDS_V3_OPT="--xds_v3_support" `dirname $0`/grpc_xds_bazel_python_test_in_docker.sh
    dismissed LLM, confidence 0.93 CI wrapper that runs the sibling xDS Python Docker test script with a v3 option.
    Reasoning

    Backtick `dirname $0` invokes a sibling test script with an env var option. This is an old-style but benign path-relative invocation within the repo's CI scripts.

  532. info critical → info by review dynamic-execution tools/internal_ci/linux/grpc_xds_v3_bazel_test_in_docker.sh:16:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    
    XDS_V3_OPT="--xds_v3_support" `dirname $0`/grpc_xds_bazel_test_in_docker.sh
    dismissed LLM, confidence 0.93 CI wrapper that runs the sibling xDS Bazel Docker test script with a v3 option.
    Reasoning

    Backtick `dirname $0` invokes a sibling xDS test script with a v3 flag. This is a benign relative-path invocation within the repo's CI tooling.

  533. info critical → info by review dynamic-execution tools/internal_ci/macos/grpc_basictests_csharp.sh:19:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    export PREPARE_BUILD_INSTALL_DEPS_CSHARP=true
    $(dirname $0)/grpc_run_tests_matrix.sh
    dismissed LLM, confidence 0.93 macOS CI entry script that sets a C# dependency flag and runs the shared test matrix script.
    Reasoning

    Exports a flag and runs the sibling grpc_run_tests_matrix.sh via dirname. This is a standard CI dispatcher pattern for language-specific test matrices.

  534. info critical → info by review dynamic-execution tools/internal_ci/macos/grpc_basictests_php.sh:19:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    export PREPARE_BUILD_INSTALL_DEPS_PHP=true
    $(dirname $0)/grpc_run_tests_matrix.sh
    dismissed LLM, confidence 0.93 macOS CI entry script that sets a PHP dependency flag and runs the shared test matrix script.
    Reasoning

    Exports a PHP dependency flag and runs the sibling test matrix script via dirname. This is a standard CI dispatch pattern.

  535. info critical → info by review dynamic-execution tools/internal_ci/macos/grpc_basictests_python.sh:19:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    export PREPARE_BUILD_INSTALL_DEPS_PYTHON=true
    $(dirname $0)/grpc_run_tests_matrix.sh
    dismissed LLM, confidence 0.93 macOS CI entry script that sets a Python dependency flag and runs the shared test matrix script.
    Reasoning

    Exports a Python dependency flag and runs the sibling test matrix script. This is a standard CI dispatch pattern.

  536. info critical → info by review dynamic-execution tools/internal_ci/macos/grpc_basictests_ruby.sh:19:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    export PREPARE_BUILD_INSTALL_DEPS_RUBY=true
    $(dirname $0)/grpc_run_tests_matrix.sh
    dismissed LLM, confidence 0.93 macOS CI entry script that sets a Ruby dependency flag and runs the shared test matrix script.
    Reasoning

    Exports a Ruby dependency flag and runs the sibling test matrix script. This is a standard CI dispatch pattern.

  537. command name is a variable (`$INTEROP_SERVER_BINARY`) that this file sets only to plain text (ast pass, confidence 0.40)

    # TODO(jtattermusch): can we make the ports configurable (but avoid breaking bazel build cache at the same time?)
    "${INTEROP_SERVER_BINARY}" --port=$PLAIN_PORT --max_send_message_size=8388608 &
    "${INTEROP_SERVER_BINARY}" --port=$TLS_PORT --max_send_message_size=8388608 --use_tls &
  538. command name is a variable (`$INTEROP_SERVER_BINARY`) that this file sets only to plain text (ast pass, confidence 0.40)

    "${INTEROP_SERVER_BINARY}" --port=$PLAIN_PORT --max_send_message_size=8388608 &
    "${INTEROP_SERVER_BINARY}" --port=$TLS_PORT --max_send_message_size=8388608 --use_tls &
    # make sure the interop_server processes we started on the background are killed upon exit.
  539. info critical → info by review dynamic-execution tools/internal_ci/macos/grpc_run_tests_matrix_objc.sh:19:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    export PREPARE_BUILD_INSTALL_DEPS_OBJC=true
    $(dirname $0)/grpc_run_tests_matrix.sh
    dismissed LLM, confidence 0.93 macOS CI entry script that sets an ObjC dependency flag and runs the shared test matrix script.
    Reasoning

    Exports an Objective-C dependency flag and runs the sibling test matrix script. This is a standard CI dispatch pattern.

  540. info critical → info by review dynamic-execution tools/interop_matrix/create_testcases.sh:40:5

    `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

        # The script should generate a line with "${docker_image:=...}".
        eval docker_image=$(grep -oe '${docker_image:=.*}' $testcase)
        if [ -z "$KEEP_IMAGE" ]; then
          echo "Clean up docker_image $docker_image"
    likely benign LLM, confidence 0.80 Interop matrix script that evals a docker_image default extracted by grep from a local testcase file.
    Reasoning

    eval runs an assignment built from grep output over the repo's own generated testcase files. The pattern targets a `${docker_image:=...}` default line in those files. That is an unsafe, fragile construct, but the input is local project data rather than attacker-controlled network content, so it reads as poor scripting, not a dropper.

  541. info critical → info by review dynamic-execution tools/interop_matrix/create_testcases.sh:62:1

    command name is a variable (`$GRPC_ROOT`) and `GRPC_ROOT` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    ${GRPC_ROOT}/tools/run_tests/run_interop_tests.py -l $client_lang --use_docker \
      --cloud_to_prod --prod_servers default gateway_v4 --manual_run --custom_credentials_type tls
    likely benign LLM, confidence 0.85 Invokes the repo's interop test runner through a GRPC_ROOT-based path.
    Reasoning

    The variable command is a path under GRPC_ROOT pointing to the repo's own run_interop_tests.py test runner. Runtime resolution of the path is ordinary for a repo-internal test script, and nothing in the snippet is encoded or hidden.

  542. compression ratio 0.623 is >2σ above file mean 0.613 (raw pass, confidence 0.50)

    lient/bin/Debug --net=host $docker_image bash -c "mono Grpc.IntegrationTesting.Client.exe --server_host=grpc-test.sandbox.googleapis.com --server_host_override=grpc-test.sandbox.googleapis.com --server_port=443 --use_tls=true --test_case=empty_unary"
  543. compression ratio 0.623 is >2σ above file mean 0.613 (raw pass, confidence 0.50)

    bin/Debug/net45 --net=host $docker_image bash -c "mono Grpc.IntegrationTesting.Client.exe --server_host=grpc-test.sandbox.googleapis.com --server_host_override=grpc-test.sandbox.googleapis.com --server_port=443 --use_tls=true --test_case=empty_unary"
  544. compression ratio 0.597 is >2σ above file mean 0.585 (raw pass, confidence 0.50)

    docker run -i --rm=true -w /go/src/google.golang.org/grpc/interop/client --net=host $docker_image bash -c "go run client.go --server_host=grpc-test.sandbox.googleapis.com --server_host_override=grpc-test.sandbox.googleapis.com --server_port=443 --use_tls=true --test_case=empty_unary"
  545. compression ratio 0.614 is >2σ above file mean 0.604 (raw pass, confidence 0.50)

    /local/git/grpc --net=host $docker_image bash -c "py27_native/bin/python src/python/grpcio_tests/setup.py run_interop --client --args=\"--server_host=grpc-test.sandbox.googleapis.com --server_host_override=grpc-test.sandbox.googleapis.com --server_port=443 --use_tls=true --test_case=cancel_after_begin\""
  546. compression ratio 0.592 is >2σ above file mean 0.585 (raw pass, confidence 0.50)

    docker run -i --rm=true -w /var/local/git/grpc --net=host $docker_image bash -c "source /usr/local/rvm/scripts/rvm && ruby src/ruby/pb/test/client.rb --server_host=grpc-test.sandbox.googleapis.com --server_host_override=grpc-test.sandbox.googleapis.com --server_port=443 --use_tls=true --test_case=client_streaming"
  547. info critical → info by review dynamic-execution tools/profiling/bloat/bloat_diff.py:149:1

    `subprocess.check_call` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

    )
    subprocess.check_call(
        "make -j%d bloaty" % args.jobs, shell=True, cwd="bloaty-build"
    )
    likely benign LLM, confidence 0.85 Runs make to build bloaty in a profiling helper script.
    Reasoning

    This is a profiling script that builds the bloaty tool with make. The command is a fixed format string with a job count, and the shell=True usage is a convenience rather than a sign of malice.

  548. info critical → info by review dynamic-execution tools/profiling/bloat/bloat_diff.py:164:13

    `subprocess.check_call` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

            if filename:
                subprocess.check_call(
                    "strip %s -o %s.stripped" % (filename[0], filename[0]),
                    shell=True,
    likely benign LLM, confidence 0.85 Strips debug symbols from a binary to produce a .stripped copy for size comparison.
    Reasoning

    The strip command interpolates a filename from a locally built binary list into a shell string. This is a build-analysis helper, and the input comes from local build artifacts rather than untrusted remote data.

  549. info critical → info by review dynamic-execution tools/profiling/bloat/bloat_diff.py:172:17

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

            assert len(old_version) == 1
            text += subprocess.check_output(
                "%s -n 0 --debug-file=%s --debug-file=%s %s.stripped -- %s.stripped"
                % (
    likely benign LLM, confidence 0.85 Runs bloaty to compare debug info between two binary versions.
    Reasoning

    This invokes the local bloaty binary with debug-file arguments built from paths the script itself produced. It is a size-diff tool with no network or persistence behavior.

  550. info critical → info by review dynamic-execution tools/profiling/bloat/bloat_diff.py:186:17

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

                for x in csv.reader(
                    subprocess.check_output(
                        "bloaty-build/bloaty -n 0 --csv %s -- %s"
                        % (new_version[0], old_version[0]),
    likely benign LLM, confidence 0.85 Runs bloaty in CSV mode to collect size data for binary comparison.
    Reasoning

    This runs the local bloaty binary in CSV mode over build artifacts to produce a size report. The shell string is built from local paths and matches the normal profiling workflow.

  551. info critical → info by review dynamic-execution tools/profiling/bloat/bloat_diff.py:205:17

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

        else:
            text += subprocess.check_output(
                "%s %s.stripped -n 0 --debug-file=%s"
                % (cmd, new_version[0], new_version[0]),
    likely benign LLM, confidence 0.85 Runs a size-analysis command against a locally stripped binary.
    Reasoning

    This runs a command (cmd) on a stripped local binary to gather size metrics. It is consistent with a benchmarking or size-analysis helper and contains no obfuscation or remote fetching.

  552. info critical → info by review dynamic-execution tools/profiling/ios_bin/binary_size.py:75:5

    `subprocess.check_call` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

        )
        subprocess.check_call(
            (
                "CONFIG=opt EXAMPLE_PATH=src/objective-c/examples/Sample"
    likely benign LLM, confidence 0.85 Runs a make-based build of an iOS sample app for binary size measurement.
    Reasoning

    This builds an iOS sample app with make, with config and path values set in the script. It is a standard CI and size-measurement build step with no malicious indicators.

  553. info critical → info by review dynamic-execution tools/release/backport_pr.sh:143:5

    `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

        git clean -xdff
        eval "$PER_BACKPORT_COMMAND"
        git add -A
        git commit --amend --no-edit
    likely benign LLM, confidence 0.80 Evaluates a per-backport command string supplied to a release backporting script.
    Reasoning

    eval runs PER_BACKPORT_COMMAND, a release-maintainer-supplied command for applying per-backport steps. It is a deliberate design choice in a developer release tool, not a hidden payload, though it does trust its input.

  554. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Needed for building binary distribution wheels -- bdist_wheel
    "${PYTHON}" -m pip install --upgrade pip
    # Pin to a single version to make sure we're building the same artifacts
    "${PYTHON}" -m pip install setuptools==77.0.1 wheel==0.43.0 build==1.5.0
  555. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Pin to a single version to make sure we're building the same artifacts
    "${PYTHON}" -m pip install setuptools==77.0.1 wheel==0.43.0 build==1.5.0
    
    if [ "$GRPC_SKIP_PIP_CYTHON_UPGRADE" == "" ]
  556. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      # as possible.
      "${PYTHON}" -m pip install --upgrade 'cython==3.1.1'
    fi
  557. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      GRPC_PYTHON_OVERRIDE_EXT_SUFFIX="$(${PYTHON} -c 'import sysconfig; print(sysconfig.get_config_var("EXT_SUFFIX").replace("-x86_64-linux-gnu.so", "-aarch64-linux-gnu.so"))')"
      export GRPC_PYTHON_OVERRIDE_EXT_SUFFIX
  558. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      GRPC_PYTHON_OVERRIDE_EXT_SUFFIX="$(${PYTHON} -c 'import sysconfig; print(sysconfig.get_config_var("EXT_SUFFIX").replace("-x86_64-linux-gnu.so", "-arm-linux-gnueabihf.so"))')"
      export GRPC_PYTHON_OVERRIDE_EXT_SUFFIX
  559. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Build gRPC tools package distribution
    "${PYTHON}" tools/distrib/python/make_grpcio_tools.py
    
    # Build gRPC tools package source and binary distribution
  560. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    if [ "$GRPC_BUILD_MAC" == "" ]; then
      "${PYTHON}" src/python/grpcio_observability/make_grpcio_observability.py
      ${SETARCH_CMD} "${PYTHON}" -m build "src/python/grpcio_observability" \
        --no-isolation "${WHEEL_PLAT_CONFIG_OPTION[@]}"
  561. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      # TODO(jtattermusch): cleanup the virtualenv version fallback logic.
      "${PYTHON}" -m pip install virtualenv
      "${PYTHON}" -m virtualenv venv || { "${PYTHON}" -m pip install virtualenv==20.0.23 && "${PYTHON}" -m virtualenv venv; }
      # Ensure the generated artifacts are valid using "twine check"
  562. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      "${PYTHON}" -m pip install virtualenv
      "${PYTHON}" -m virtualenv venv || { "${PYTHON}" -m pip install virtualenv==20.0.23 && "${PYTHON}" -m virtualenv venv; }
      # Ensure the generated artifacts are valid using "twine check"
      venv/bin/python -m pip install "cryptography==40.0.0" "twine==5.0.0" "readme_renderer<40.0"
  563. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      "${PYTHON}" -m pip install virtualenv
      "${PYTHON}" -m virtualenv venv || { "${PYTHON}" -m pip install virtualenv==20.0.23 && "${PYTHON}" -m virtualenv venv; }
      # Ensure the generated artifacts are valid using "twine check"
      venv/bin/python -m pip install "cryptography==40.0.0" "twine==5.0.0" "readme_renderer<40.0"
  564. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      "${PYTHON}" -m pip install virtualenv
      "${PYTHON}" -m virtualenv venv || { "${PYTHON}" -m pip install virtualenv==20.0.23 && "${PYTHON}" -m virtualenv venv; }
      # Ensure the generated artifacts are valid using "twine check"
      venv/bin/python -m pip install "cryptography==40.0.0" "twine==5.0.0" "readme_renderer<40.0"
  565. command name is a variable (`$AUDITWHEEL`) that this file sets only to plain text (ast pass, confidence 0.40)

      for wheel in dist/*.whl; do
        "${AUDITWHEEL}" show "$wheel" | tee /dev/stderr |  grep -E -w "$AUDITWHEEL_PLAT"
        "${AUDITWHEEL}" repair "$wheel" --strip --wheel-dir "$ARTIFACT_DIR"
        rm "$wheel"
  566. command name is a variable (`$AUDITWHEEL`) that this file sets only to plain text (ast pass, confidence 0.40)

        "${AUDITWHEEL}" show "$wheel" | tee /dev/stderr |  grep -E -w "$AUDITWHEEL_PLAT"
        "${AUDITWHEEL}" repair "$wheel" --strip --wheel-dir "$ARTIFACT_DIR"
        rm "$wheel"
      done
  567. command name is a variable (`$AUDITWHEEL`) that this file sets only to plain text (ast pass, confidence 0.40)

      for wheel in tools/distrib/python/grpcio_tools/dist/*.whl; do
        "${AUDITWHEEL}" show "$wheel" | tee /dev/stderr |  grep -E -w "$AUDITWHEEL_PLAT"
        "${AUDITWHEEL}" repair "$wheel" --strip --wheel-dir "$ARTIFACT_DIR"
        rm "$wheel"
  568. command name is a variable (`$AUDITWHEEL`) that this file sets only to plain text (ast pass, confidence 0.40)

        "${AUDITWHEEL}" show "$wheel" | tee /dev/stderr |  grep -E -w "$AUDITWHEEL_PLAT"
        "${AUDITWHEEL}" repair "$wheel" --strip --wheel-dir "$ARTIFACT_DIR"
        rm "$wheel"
      done
  569. command name is a variable (`$AUDITWHEEL`) that this file sets only to plain text (ast pass, confidence 0.40)

        for wheel in src/python/grpcio_observability/dist/*.whl; do
          "${AUDITWHEEL}" show "$wheel" | tee /dev/stderr |  grep -E -w "$AUDITWHEEL_PLAT"
          "${AUDITWHEEL}" repair "$wheel" --strip --wheel-dir "$ARTIFACT_DIR"
          rm "$wheel"
  570. command name is a variable (`$AUDITWHEEL`) that this file sets only to plain text (ast pass, confidence 0.40)

          "${AUDITWHEEL}" show "$wheel" | tee /dev/stderr |  grep -E -w "$AUDITWHEEL_PLAT"
          "${AUDITWHEEL}" repair "$wheel" --strip --wheel-dir "$ARTIFACT_DIR"
          rm "$wheel"
        done
  571. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    then
      "${PYTHON}" -m pip install -r requirements.txt
    
      "${PYTHON}" -m pip install grpcio --no-index --find-links "file://$ARTIFACT_DIR/"
  572. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    
      "${PYTHON}" -m pip install grpcio --no-index --find-links "file://$ARTIFACT_DIR/"
      "${PYTHON}" -m pip install grpcio-tools --no-index --find-links "file://$ARTIFACT_DIR/"
  573. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      "${PYTHON}" -m pip install grpcio --no-index --find-links "file://$ARTIFACT_DIR/"
      "${PYTHON}" -m pip install grpcio-tools --no-index --find-links "file://$ARTIFACT_DIR/"
    
      # Ancillary packages below require source-built grpcio/grpcio_tools packages
  574. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      # Install xds-protos as a dependency of grpcio-csds
      "${PYTHON}" -m pip install xds-protos --no-index --find-links "file://$ARTIFACT_DIR/"
    
      # Build grpcio_csds source distribution
  575. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      # of Channelz and CSDS to be installed.
      "${PYTHON}" -m pip install grpcio-channelz --no-index --find-links "file://$ARTIFACT_DIR/"
      "${PYTHON}" -m pip install grpcio-csds --no-index --find-links "file://$ARTIFACT_DIR/"
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation "src/python/grpcio_admin"
  576. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      "${PYTHON}" -m pip install grpcio-channelz --no-index --find-links "file://$ARTIFACT_DIR/"
      "${PYTHON}" -m pip install grpcio-csds --no-index --find-links "file://$ARTIFACT_DIR/"
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation "src/python/grpcio_admin"
  577. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    else
      $PYTHON -m venv "$VENV"
      VENV_PYTHON="$(pwd)/$VENV/$VENV_RELATIVE_PYTHON"
    fi
  578. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:142:3

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    pip_install() {
      $VENV_PYTHON -m pip install "$@"
    }
    likely benign LLM, confidence 0.88 Runs pip install through the project's virtualenv Python interpreter.
    Reasoning

    VENV_PYTHON is a locally created virtualenv interpreter used to run pip install. This is a normal Python build helper with no encoded or remote-sourced content.

  579. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:155:3

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

      cd "$1"
      "${VENV_PYTHON}" -m pip install --no-deps --no-build-isolation .
      cd "${workdir}"
    }
    likely benign LLM, confidence 0.88 Installs the local Python package into the build virtualenv.
    Reasoning

    The script invokes the local virtualenv Python to build and install the package from the current directory. This is a standard build step in the test helper.

  580. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:163:3

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

      cd "$1"
      "${VENV_PYTHON}" -m pip install --no-build-isolation .
      cd "${workdir}"
    }
    likely benign LLM, confidence 0.88 Installs the local Python package without build isolation in the virtualenv.
    Reasoning

    This is the same local virtualenv pip install pattern, using no-build-isolation for a source build. It is ordinary build tooling with no malicious indicators.

  581. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:172:9

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    if [ "$("$VENV_PYTHON" -c "import sys; print(sys.version_info[0])")" == "2" ]
    then
      pip_install --upgrade futures enum34
    likely benign LLM, confidence 0.90 Runs the build venv's Python to check its major version.
    Reasoning

    The flagged command is a Python interpreter path held in $VENV_PYTHON, used for a version check. The file is gRPC's standard test build script, where this is the normal way to run the venv's Python. The assignment isn't shown, but nothing in the snippet suggests a download or untrusted input.

  582. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:179:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    $VENV_PYTHON "$ROOT/tools/distrib/python/make_grpcio_tools.py"
    pip_install_dir_and_deps "$ROOT/tools/distrib/python/grpcio_tools"
    likely benign LLM, confidence 0.90 Runs the in-repo make_grpcio_tools.py generator with the venv Python.
    Reasoning

    This invokes the venv Python on the repo's make_grpcio_tools.py generator, a local in-repo build step. Variable-named interpreters are routine in build scripts, and the AST flag is a false positive on the pattern alone.

  583. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:187:3

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    else
      $VENV_PYTHON "$ROOT/src/python/grpcio_observability/make_grpcio_observability.py"
      pip_install_dir_and_deps "$ROOT/src/python/grpcio_observability"
      pip_install_dir_and_deps "$ROOT/src/python/grpcio_csm_observability"
    likely benign LLM, confidence 0.90 Runs the local make_grpcio_observability.py generator with the venv Python.
    Reasoning

    The command runs a local make script for grpcio_observability under the repo root, followed by pip installs of local package directories. It is ordinary package build code with no network fetch or encoded payload.

  584. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:193:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Build/install Channelz
    $VENV_PYTHON "$ROOT/src/python/grpcio_channelz/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_channelz/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_channelz"
    likely benign LLM, confidence 0.90 Preprocesses and builds the grpcio_channelz package using the venv Python.
    Reasoning

    Channelz setup.py preprocess and build steps run on local repo paths through the venv interpreter. This is the expected build sequence for a gRPC Python subpackage.

  585. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:194:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    $VENV_PYTHON "$ROOT/src/python/grpcio_channelz/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_channelz/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_channelz"
    likely benign LLM, confidence 0.90 Repeats the grpcio_channelz preprocess and build commands via the venv Python.
    Reasoning

    This is the same channelz build sequence, shown from a different line offset. It runs local setup.py commands against the repo, so the flag is the variable command name alone.

  586. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:198:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Build/install health checking
    $VENV_PYTHON "$ROOT/src/python/grpcio_health_checking/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_health_checking/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_health_checking"
    likely benign LLM, confidence 0.90 Preprocesses and builds the grpcio_health_checking package with the venv Python.
    Reasoning

    Health-checking setup.py steps run against local repo paths through the venv interpreter. This is routine packaging for the gRPC monorepo.

  587. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:199:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    $VENV_PYTHON "$ROOT/src/python/grpcio_health_checking/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_health_checking/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_health_checking"
    likely benign LLM, confidence 0.90 Repeats the grpcio_health_checking build commands via the venv Python.
    Reasoning

    This repeats the health-checking build commands at a different offset. Nothing beyond the variable command name is suspicious.

  588. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:203:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Build/install reflection
    $VENV_PYTHON "$ROOT/src/python/grpcio_reflection/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_reflection/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_reflection"
    likely benign LLM, confidence 0.90 Preprocesses and builds the grpcio_reflection package with the venv Python.
    Reasoning

    Reflection setup.py preprocess and build steps run on local repo directories through the venv Python. This is standard gRPC packaging with no remote fetch.

  589. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:204:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    $VENV_PYTHON "$ROOT/src/python/grpcio_reflection/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_reflection/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_reflection"
    likely benign LLM, confidence 0.90 Repeats the grpcio_reflection build commands via the venv Python.
    Reasoning

    This repeats the reflection build commands at a different offset, all against local repo paths. The finding reflects the variable command name rather than any malicious behaviour.

  590. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:208:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Build/install status proto mapping
    $VENV_PYTHON "$ROOT/src/python/grpcio_status/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_status/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_status"
    likely benign LLM, confidence 0.85 Invokes a build-time Python interpreter from a virtualenv to run grpcio_status setup steps.
    Reasoning

    The flagged $VENV_PYTHON is the interpreter of a local virtualenv created earlier in the same build script. Running setup.py preprocess and build_package_protos for grpc's own packages is the normal build flow, and the variable is not fetched from anywhere untrusted.

  591. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:209:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    $VENV_PYTHON "$ROOT/src/python/grpcio_status/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_status/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_status"
    likely benign LLM, confidence 0.85 Runs the venv Python against grpcio_status setup.py to build protos.
    Reasoning

    This line is the same pattern as the preceding finding: the variable is the venv interpreter and the command runs the repo's own setup.py. The snippet shows no download, decoding, or remote fetch.

  592. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:232:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    $VENV_PYTHON "$ROOT/src/python/grpcio_tests/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_tests/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_tests"
    likely benign LLM, confidence 0.85 Runs the venv Python against grpcio_tests setup.py to preprocess and build protos.
    Reasoning

    Same benign build pattern: $VENV_PYTHON runs the grpcio_tests setup.py preprocess step inside grpc's own test-build script.

  593. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:233:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    $VENV_PYTHON "$ROOT/src/python/grpcio_tests/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_tests/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_tests"
    likely benign LLM, confidence 0.85 Runs the venv Python to build grpcio_tests protos.
    Reasoning

    Repeats the grpcio_tests build step in the same script. The indirect command name is the locally configured interpreter, which is ordinary for build tooling.

  594. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/run_python.sh:27:1

    command name is a variable (`$PYTHON`) and `PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # TODO(ssreenithi): find pyproject.toml/pytest equivalent
    $PYTHON "$ROOT/src/python/grpcio_tests/setup.py" "$2"
    
    mkdir -p "$ROOT/reports"
    likely benign LLM, confidence 0.85 Runs the selected Python interpreter on grpcio_tests setup.py to run tests.
    Reasoning

    $PYTHON is a locally selected interpreter used to run the repo's grpcio_tests setup.py with a test argument. This is a test-runner invocation, not a payload.

  595. info critical → info by review dynamic-execution tools/run_tests/performance/build_performance.sh:76:5

    command name is a variable (`$bazel`) and `bazel` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

      "python")
        $bazel build -c opt //src/python/grpcio_tests/tests/qps:qps_worker
        ;;
      "python_asyncio")
    likely benign LLM, confidence 0.80 Invokes bazel to build the Python QPS worker target in a case branch.
    Reasoning

    $bazel is the Bazel binary set by the script, and it builds the in-repo qps worker target. The variable indirection is a common idiom and nothing here fetches or decodes code.

  596. info critical → info by review dynamic-execution tools/run_tests/performance/build_performance.sh:79:5

    command name is a variable (`$bazel`) and `bazel` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

      "python_asyncio")
        $bazel build -c opt //src/python/grpcio_tests/tests_aio/benchmark:worker
        ;;
      *)
    likely benign LLM, confidence 0.80 Invokes bazel to build the asyncio benchmark worker.
    Reasoning

    Same pattern as the adjacent finding: $bazel builds a repo-local asyncio benchmark worker target, consistent with a performance build script.

  597. command name is a variable (`$LOADTEST_CONFIG`) that this file sets only to plain text (ast pass, confidence 0.40)

        local -r language="$(example_language "${outputfile}")"
        ${LOADTEST_CONFIG} \
            -l "${language}" \
            -t ./tools/run_tests/performance/templates/loadtest_template_basic_all_languages.yaml \
  598. command name is a variable (`$LOADTEST_CONFIG`) that this file sets only to plain text (ast pass, confidence 0.40)

        local -r language="$(example_language "${outputfile}")"
        ${LOADTEST_CONFIG} \
            -l "${language}" \
            -t ./tools/run_tests/performance/templates/loadtest_template_prebuilt_all_languages.yaml \
  599. command name is a variable (`$LOADTEST_CONFIG`) that this file sets only to plain text (ast pass, confidence 0.40)

        local -r language="$(example_language "${outputfile}")"
        ${LOADTEST_CONFIG} \
            -l "${language}" \
            -t ./tools/run_tests/performance/templates/loadtest_template_psm_"${uniquifier}"_basic_all_languages.yaml \
  600. command name is a variable (`$LOADTEST_CONFIG`) that this file sets only to plain text (ast pass, confidence 0.40)

        local -r language="$(example_language "${outputfile}")"
        ${LOADTEST_CONFIG} \
            -l "${language}" \
            -t ./tools/run_tests/performance/templates/loadtest_template_psm_"${uniquifier}"_prebuilt_all_languages.yaml \
  601. info critical → info by review destructive-command-payload tools/run_tests/performance/remote_host_prepare.sh:30:23

    string literal contains recursive home deletion (rm -rf ~/) (ast pass, confidence 0.92)

    # cleanup after previous builds
    ssh "${USER_AT_HOST}" "rm -rf ~/performance_workspace && mkdir -p ~/performance_workspace"
    
    # push the current sources to the worker and unpack it.
    likely benign LLM, confidence 0.85 Clears and recreates a performance workspace directory on a remote host over ssh.
    Reasoning

    The command removes ~/performance_workspace, a specific subdirectory on the remote benchmark host, and then recreates it. This is a targeted cleanup before a fresh checkout, not recursive deletion of the home directory, so the rule matched a false pattern.

  602. info critical → info by review dynamic-execution tools/run_tests/performance/run_worker_go.sh:23:1

    command name is a variable (`$GOPATH`) and `GOPATH` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    "${GOPATH}/bin/worker" "$@"
    likely benign LLM, confidence 0.80 Launches the Go performance worker binary from GOPATH with forwarded arguments.
    Reasoning

    ${GOPATH}/bin/worker is the Go-built benchmark worker binary under GOPATH, executed with the script's arguments. This is a normal launcher for a test worker, not a hidden payload.

  603. info critical → info by review dynamic-execution tools/run_tests/python_utils/dockerjob.py:53:22

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

            try:
                output = subprocess.check_output(
                    "docker port %s %s" % (cid, port), stderr=_DEVNULL, shell=True
                ).decode()
    likely benign LLM, confidence 0.70 Runs docker port lookup through a shell using string formatting in a test helper.
    Reasoning

    shell=True with a %-formatted string is a command-injection smell, but cid comes from docker container IDs and port is a test-internal port number. This is a test helper, and the snippet shows no untrusted input path, so the risk is low.

  604. info critical → info by review dynamic-execution tools/run_tests/python_utils/dockerjob.py:70:22

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

            try:
                output = subprocess.check_output(
                    cmd, stderr=_DEVNULL, shell=True
                ).decode()
    likely benign LLM, confidence 0.80 Helper that runs docker CLI commands via subprocess with shell=True for test jobs.
    Reasoning

    This is a test-infrastructure helper in the grpc repo that runs docker commands built from internal test configuration. shell=True with a variable command is a common, if poor, practice in build tooling. No obfuscation or download-and-run pattern is shown; the command is developer-controlled.

  605. info critical → info by review dynamic-execution tools/run_tests/run_tests.py:72:9

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

        try:
            subprocess.check_output(cmd, shell=True, env=env, cwd=cwd)
        except subprocess.CalledProcessError as e:
            logging.exception(
    likely benign LLM, confidence 0.80 Test driver helper that runs shell commands with shell=True and a passed environment.
    Reasoning

    Generic command runner in the grpc test driver. The command comes from the developer's own test configuration, not untrusted input, so shell=True is a code-quality concern rather than malicious intent.

  606. info critical → info by review dynamic-execution tools/run_tests/sanity/check_bazel_workspace.py:173:1

    `exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)

    }
    exec((bazel_file), build_rules)
    grpc_dep_names_set = set(_GRPC_DEP_NAMES)
    names_set = set(names_and_urls.keys())
    likely benign LLM, confidence 0.85 Sanity check that execs repo Bazel rule files to collect dependency names.
    Reasoning

    Sanity-check script that execs the contents of a Bazel build file read from the repo to extract rule definitions. This is a known pattern for parsing Starlark-like files in Python; the source is the repository itself, and no network or encoded payload is involved.

  607. info critical → info by review dynamic-execution tools/run_tests/sanity/check_bazel_workspace.py:231:5

    `exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)

        }
        exec((bazel_file), rules)
        assert name not in list(names_and_urls_with_overridden_name.keys())
    likely benign LLM, confidence 0.85 Sanity check that execs a repo Bazel file inside a rules namespace to parse declarations.
    Reasoning

    Same pattern as the earlier exec: a repo-local Bazel file is executed in a controlled namespace to parse rule declarations during a sanity check. Benign parsing approach.

  608. info critical → info by review dynamic-execution tools/run_tests/sanity/check_buildifier.sh:19:1

    command name is a variable (`$GIT_ROOT`) and `GIT_ROOT` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    GIT_ROOT="$(dirname "$0")/../../.."
    "$GIT_ROOT/tools/distrib/buildifier_format_code.sh" -mode=diff -lint warn
    result=$?
    likely benign LLM, confidence 0.85 Shell sanity script that invokes the repo's buildifier formatting wrapper via a computed path.
    Reasoning

    GIT_ROOT is derived from the script's own path via dirname and relative navigation, then used to invoke a formatter script inside the same repository. Variable command name here is just a path to a sibling script, not attacker-controlled.

  609. info critical → info by review dynamic-execution tools/run_tests/sanity/check_deprecated_grpc++.py:172:13

    `os.system` called on a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

    
        if 0 != os.system("diff %s %s" % (path_file_expected, path_file)):
            print(("Difference found in file:", path_file))
            errors += 1
    likely benign LLM, confidence 0.85 Sanity check comparing expected and generated files with os.system diff.
    Reasoning

    os.system with a diff command built from local file paths in a sanity checker. Paths are internal test/generated file locations, not external input. Inelegant but not malicious.

  610. info critical → info by review dynamic-execution tools/run_tests/sanity/check_package_name.py:60:12

    `eval` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)

        # it's a python statement, so evaluate it to pull out the name of the package
        name = eval(
            text[pkg_start:pkg_end], {"grpc_package": lambda name, **kwargs: name}
        )
    likely benign LLM, confidence 0.85 Sanity check that evals a grpc_package() statement from a BUILD file to extract the package name.
    Reasoning

    eval is applied to a slice of a BUILD file's text containing a grpc_package call, with a restricted globals dict supplying a single lambda. This is a narrow parsing technique for reading the package name from the repo's own BUILD file; no obfuscation or external input is involved.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/grpc/grpc grpc && cd grpc
git checkout v1.84.0
disclude scan --severity info --diff v1.83.1 .