PyPI / grpcio / 1.84.0

grpcio 1.84.0

Source
https://github.com/grpc/grpc
Tag scanned
v1.84.0
Compared with
v1.83.1 (9 signals introduced since)
Files
7918 scanned, 2427 skipped (binary, oversized, or unrecognised)
Signals
0 critical · 285 warn · 325 info
Scan time
156.0 s
LLM review
Reviewed by claude-haiku-5-5 (Anthropic): the 202 most severe of 487 warn and critical signals (202 with a verdict); 202 demoted to info. The rest are unreviewed.
Disclude version
4.1.0
Scanned (UTC)
2026-10-22 00:40

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

  1. `#define SEND_QUAL_ARG2 const` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type qualifier of arg 2 for send. */
    #define SEND_QUAL_ARG2 const
    
    /* Define to the type of arg 1 for send. */
  2. `#define SEND_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for send. */
    #define SEND_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for send. */
  3. `#define SEND_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for send. */
    #define SEND_TYPE_ARG4 int
    
    /* Define to the function return type for send. */
  4. `#define GETNAMEINFO_TYPE_ARG7 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 7 for getnameinfo. */
    #define GETNAMEINFO_TYPE_ARG7 int
    
    /* Specifies the number of arguments to getservbyport_r */
  5. `#define RECVFROM_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recvfrom. */
    #define RECVFROM_TYPE_ARG1 int
    
    /* Define to the type pointed by arg 2 for recvfrom. */
  6. `#define RECVFROM_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recvfrom. */
    #define RECVFROM_TYPE_ARG4 int
    
    /* Define to the type pointed by arg 5 for recvfrom. */
  7. `#define RECV_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recv. */
    #define RECV_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for recv. */
  8. `#define RECV_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recv. */
    #define RECV_TYPE_ARG4 int
    
    /* Define to the function return type for recv. */
  9. `#define SEND_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for send. */
    #define SEND_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for send. */
  10. `#define SEND_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for send. */
    #define SEND_TYPE_ARG4 int
    
    /* Define to the function return type for send. */
  11. `#define GETNAMEINFO_QUAL_ARG1 const` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type qualifier of arg 1 for getnameinfo. */
    #define GETNAMEINFO_QUAL_ARG1 const
    
    /* Define to the type of arg 1 for getnameinfo. */
  12. `#define GETNAMEINFO_TYPE_ARG7 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 7 for getnameinfo. */
    #define GETNAMEINFO_TYPE_ARG7 int
    
    /* Specifies the number of arguments to getservbyport_r */
  13. `#define RECVFROM_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recvfrom. */
    #define RECVFROM_TYPE_ARG1 int
    
    /* Define to the type pointed by arg 2 for recvfrom. */
  14. `#define RECVFROM_TYPE_ARG2 void` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type pointed by arg 2 for recvfrom. */
    #define RECVFROM_TYPE_ARG2 void
    
    /* Define to 1 if the type pointed by arg 2 for recvfrom is void. */
  15. `#define RECVFROM_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recvfrom. */
    #define RECVFROM_TYPE_ARG4 int
    
    /* Define to the type pointed by arg 5 for recvfrom. */
  16. `#define RECV_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recv. */
    #define RECV_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for recv. */
  17. `#define RECV_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recv. */
    #define RECV_TYPE_ARG4 int
    
    /* Define to the function return type for recv. */
  18. `#define RETSIGTYPE void` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define as the return type of signal handlers (`int' or `void'). */
    #define RETSIGTYPE void
    
    /* Define to the type qualifier of arg 2 for send. */
  19. `#define SEND_QUAL_ARG2 const` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type qualifier of arg 2 for send. */
    #define SEND_QUAL_ARG2 const
    
    /* Define to the type of arg 1 for send. */
  20. `#define SEND_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for send. */
    #define SEND_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for send. */
  21. `#define SEND_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for send. */
    #define SEND_TYPE_ARG4 int
    
    /* Define to the function return type for send. */
  22. `#define GETHOSTNAME_TYPE_ARG2 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 2 for gethostname. */
    #define GETHOSTNAME_TYPE_ARG2 int
    
    /* Define to the type qualifier of arg 1 for getnameinfo. */
  23. `#define GETNAMEINFO_TYPE_ARG7 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 7 for getnameinfo. */
    #define GETNAMEINFO_TYPE_ARG7 int
    
    /* Specifies the number of arguments to getservbyport_r */
  24. `#define RECVFROM_TYPE_ARG3 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 3 for recvfrom. */
    #define RECVFROM_TYPE_ARG3 int
    
    /* Define to the type of arg 4 for recvfrom. */
  25. `#define RECVFROM_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recvfrom. */
    #define RECVFROM_TYPE_ARG4 int
    
    /* Define to the type pointed by arg 5 for recvfrom. */
  26. `#define RECVFROM_TYPE_RETV int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the function return type for recvfrom. */
    #define RECVFROM_TYPE_RETV int
    
    /* Define to the type of arg 1 for recv. */
  27. `#define RECV_TYPE_ARG3 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 3 for recv. */
    #define RECV_TYPE_ARG3 int
    
    /* Define to the type of arg 4 for recv. */
  28. `#define RECV_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recv. */
    #define RECV_TYPE_ARG4 int
    
    /* Define to the function return type for recv. */
  29. `#define RECV_TYPE_RETV int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the function return type for recv. */
    #define RECV_TYPE_RETV int
    
    /* Define as the return type of signal handlers (`int' or `void'). */
  30. `#define SEND_TYPE_ARG3 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 3 for send. */
    #define SEND_TYPE_ARG3 int
    
    /* Define to the type of arg 4 for send. */
  31. `#define SEND_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for send. */
    #define SEND_TYPE_ARG4 int
    
    /* Define to the function return type for send. */
  32. `#define SEND_TYPE_RETV int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the function return type for send. */
    #define SEND_TYPE_RETV int
    
    /* Define to 1 if you can safely include both <sys/time.h> and <time.h>. */
  33. string literal contains an embedded NUL followed by 3 more bytes of source (token pass, confidence 0.85)

        // string.
        {std::string("\0foo", 4),
         "0:0: Invalid control characters encountered in text."},
        {std::string("\0\0foo", 5),
  34. string literal contains an embedded NUL followed by 5 more bytes of source (token pass, confidence 0.85)

         "0:0: Invalid control characters encountered in text."},
        {std::string("\0\0foo", 5),
         "0:0: Invalid control characters encountered in text."},
  35. string literal contains an embedded NUL followed by 3 more bytes of source (token pass, confidence 0.85)

    TEST(FuzzTest, FileNameEmbeddedNull) {
      RoundTripDescriptor(ParseTextProtoOrDie(R"pb(file { name: "\000" })pb"));
    }
  36. string literal contains an embedded NUL followed by 41 more bytes of source (token pass, confidence 0.85)

      RoundTripDescriptor(ParseTextProtoOrDie(
          R"pb(file {
                 name: "\035"
                 enum_type {
  37. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:5:14

    identifier `ˈmaʳkʊs` mixes scripts: Other + Latin (raw pass, confidence 0.80)

    
    Markus Kuhn [ˈmaʳkʊs kuːn] <http://www.cl.cam.ac.uk/~mgk25/> — 2002-07-25 CC BY
  38. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:5:25

    identifier `kuːn` mixes scripts: Latin + Other (raw pass, confidence 0.80)

    
    Markus Kuhn [ˈmaʳkʊs kuːn] <http://www.cl.cam.ac.uk/~mgk25/> — 2002-07-25 CC BY
  39. identifier `α` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

                                                ⎪⎢⎜│a²+b³ ⎟⎥⎪
      ∀x∈ℝ: ⌈x⌉ = −⌊−x⌋, α ∧ ¬β = ¬(¬α ∨ β),    ⎪⎢⎜│───── ⎟⎥⎪
                                                ⎪⎢⎜⎷ c₈   ⎟⎥⎪
  40. identifier `α` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

                                                ⎪⎢⎜│a²+b³ ⎟⎥⎪
      ∀x∈ℝ: ⌈x⌉ = −⌊−x⌋, α ∧ ¬β = ¬(¬α ∨ β),    ⎪⎢⎜│───── ⎟⎥⎪
                                                ⎪⎢⎜⎷ c₈   ⎟⎥⎪
  41. identifier `aⁱ` mixes scripts: Latin + Other (raw pass, confidence 0.80)

      ⊥ < a ≠ b ≡ c ≤ d ≪ ⊤ ⇒ (⟦A⟧ ⇔ ⟪B⟫),      ⎪⎢⎜ ⎲     ⎟⎥⎪
                                                ⎪⎢⎜ ⎳aⁱ-bⁱ⎟⎥⎪
      2H₂ + O₂ ⇌ 2H₂O, R = 4.7 kΩ, ⌀ 200 mm     ⎩⎣⎝i=1    ⎠⎦⎭
  42. identifier `bⁱ` mixes scripts: Latin + Other (raw pass, confidence 0.80)

      ⊥ < a ≠ b ≡ c ≤ d ≪ ⊤ ⇒ (⟦A⟧ ⇔ ⟪B⟫),      ⎪⎢⎜ ⎲     ⎟⎥⎪
                                                ⎪⎢⎜ ⎳aⁱ-bⁱ⎟⎥⎪
      2H₂ + O₂ ⇌ 2H₂O, R = 4.7 kΩ, ⌀ 200 mm     ⎩⎣⎝i=1    ⎠⎦⎭
  43. identifier `kΩ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

                                                ⎪⎢⎜ ⎳aⁱ-bⁱ⎟⎥⎪
      2H₂ + O₂ ⇌ 2H₂O, R = 4.7 kΩ, ⌀ 200 mm     ⎩⎣⎝i=1    ⎠⎦⎭
    
    Linguistics and dictionaries:
  44. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:28:7

    identifier `ıntəˈnæʃənəl` mixes scripts: Latin + Other (raw pass, confidence 0.80)

    
      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
  45. identifier `fəˈnɛtık` mixes scripts: Latin + Other (raw pass, confidence 0.80)

    
      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
  46. identifier `əsoʊsiˈeıʃn` mixes scripts: Other + Latin (raw pass, confidence 0.80)

    
      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
  47. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:29:6

    identifier `ˈʏpsilɔn` mixes scripts: Other + Latin (raw pass, confidence 0.80)

      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
    
    APL:
  48. identifier `jɛn` mixes scripts: Latin + Other (raw pass, confidence 0.80)

      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
    
    APL:
  49. identifier `ˈjoːgɑ` mixes scripts: Other + Latin (raw pass, confidence 0.80)

      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
    
    APL:
  50. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:57:3

    identifier `STARGΛ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

    
      STARGΛ̊TE SG-1, a = v̇ = r̈, a⃑ ⊥ b⃑
    
    Greek (in Polytonic):
  51. identifier `τρομερή` contains homoglyph candidates: ρ (03C1)→p, ο (03BF)→o, ρ (03C1)→p (raw pass, confidence 0.70)

      Σὲ γνωρίζω ἀπὸ τὴν κόψη
      τοῦ σπαθιοῦ τὴν τρομερή,
      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
  52. identifier `τρομερή` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      Σὲ γνωρίζω ἀπὸ τὴν κόψη
      τοῦ σπαθιοῦ τὴν τρομερή,
      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
  53. identifier `μὲ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
  54. identifier `μετράει` contains homoglyph candidates: ρ (03C1)→p (raw pass, confidence 0.70)

      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
  55. identifier `μετράει` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
  56. identifier `βγαλμένη` contains homoglyph candidates: α (03B1)→a, ν (03BD)→v, η (03B7)→n (raw pass, confidence 0.70)

    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
  57. identifier `βγαλμένη` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
  58. identifier `ἀνδρειωμένη` contains homoglyph candidates: ν (03BD)→v, ρ (03C1)→p, ν (03BD)→v, η (03B7)→n (raw pass, confidence 0.70)

      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
      χαῖρε, ὦ χαῖρε, ᾿Ελευθεριά!
  59. identifier `ἀνδρειωμένη` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
      χαῖρε, ὦ χαῖρε, ᾿Ελευθεριά!
  60. identifier `μοι` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

    
      Οὐχὶ ταὐτὰ παρίσταταί μοι γιγνώσκειν, ὦ ἄνδρες ᾿Αθηναῖοι,
      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
  61. identifier `μοι` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

    
      Οὐχὶ ταὐτὰ παρίσταταί μοι γιγνώσκειν, ὦ ἄνδρες ᾿Αθηναῖοι,
      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
  62. identifier `πράγματα` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a, α (03B1)→a (raw pass, confidence 0.70)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
  63. identifier `πράγματα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
  64. identifier `μὲν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
  65. identifier `μὲν` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
  66. identifier `τιμωρήσασθαι` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a, α (03B1)→a (raw pass, confidence 0.70)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  67. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:78:3

    identifier `τιμωρήσασθαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  68. identifier `γιγνομένους` contains homoglyph candidates: ν (03BD)→v, ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (raw pass, confidence 0.70)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  69. identifier `γιγνομένους` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  70. identifier `πράγματ` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a (raw pass, confidence 0.70)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  71. identifier `πράγματ` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  72. identifier `μὴ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
  73. identifier `πεισόμεθ` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
  74. identifier `μοι` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
      οἱ τὰ τοιαῦτα λέγοντες ἢ τὴν ὑπόθεσιν, περὶ ἧς βουλεύεσθαι,
  75. identifier `μοι` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
      οἱ τὰ τοιαῦτα λέγοντες ἢ τὴν ὑπόθεσιν, περὶ ἧς βουλεύεσθαι,
  76. identifier `ὑμῖν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  77. identifier `ὑμῖν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  78. identifier `ἁμαρτάνειν` contains homoglyph candidates: α (03B1)→a, ρ (03C1)→p, ν (03BD)→v, ν (03BD)→v (raw pass, confidence 0.70)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  79. identifier `ἁμαρτάνειν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  80. identifier `μέν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  81. identifier `μέν` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  82. identifier `τιμωρήσασθαι` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a, α (03B1)→a (raw pass, confidence 0.70)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  83. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:84:3

    identifier `τιμωρήσασθαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  84. identifier `μάλ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  85. identifier `ἐμοῦ` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  86. identifier `ἐμοῦ` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  87. identifier `ἀμφότερα` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a (raw pass, confidence 0.70)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  88. identifier `ἀμφότερα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  89. identifier `μέντοι` contains homoglyph candidates: ν (03BD)→v, ο (03BF)→o (raw pass, confidence 0.70)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  90. identifier `μέντοι` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  91. identifier `πέπεισμαι` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  92. identifier `πέπεισμαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  93. identifier `ἡμῖν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  94. identifier `ἡμῖν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  95. identifier `συμμάχους` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  96. identifier `συμμάχους` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  97. identifier `σώσομεν` contains homoglyph candidates: ο (03BF)→o, ν (03BD)→v (raw pass, confidence 0.70)

      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
  98. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:87:3

    identifier `σώσομεν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
  99. identifier `τιμωρήσεταί` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a (raw pass, confidence 0.70)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  100. identifier `τιμωρήσεταί` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  101. identifier `μάταιον` contains homoglyph candidates: α (03B1)→a, ο (03BF)→o, ν (03BD)→v (raw pass, confidence 0.70)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  102. identifier `μάταιον` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  103. identifier `ἡγοῦμαι` contains homoglyph candidates: ο (03BF)→o, α (03B1)→a (raw pass, confidence 0.70)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  104. identifier `ἡγοῦμαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  105. identifier `Δημοσθένους` contains homoglyph candidates: η (03B7)→n, ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (raw pass, confidence 0.70)

    
      Δημοσθένους, Γ´ ᾿Ολυνθιακὸς
    
    Georgian:
  106. warn unicode-mixed-script third_party/utf8_range/UTF-8-demo.txt:92:3

    identifier `Δημοσθένους` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      Δημοσθένους, Γ´ ᾿Ολυνθιακὸς
    
    Georgian:
  107. identifier `ἠḂӥẄɐː` mixes scripts: Greek + Latin + Cyrillic + Other (raw pass, confidence 0.80)

      –—‘“”„†•…‰™œŠŸž€ ΑΒΓΔΩαβγδω АБВГДабвгд
      ∀∂∈ℝ∧∪≡∞ ↑↗↨↻⇣ ┐┼╔╘░►☺♀ fi�⑀₂ἠḂӥẄɐː⍎אԱა
    
    Greetings in various languages:
  108. identifier `אԱა` mixes scripts: Hebrew + Armenian + Other (raw pass, confidence 0.80)

      –—‘“”„†•…‰™œŠŸž€ ΑΒΓΔΩαβγδω АБВГДабвгд
      ∀∂∈ℝ∧∪≡∞ ↑↗↨↻⇣ ┐┼╔╘░►☺♀ fi�⑀₂ἠḂӥẄɐː⍎אԱა
    
    Greetings in various languages:
  109. identifier `Καλημέρα` contains homoglyph candidates: Κ (039A)→K, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (raw pass, confidence 0.70)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  110. identifier `Καλημέρα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  111. identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (raw pass, confidence 0.70)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  112. identifier `κόσμε` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  113. identifier `ˈmaʳkʊs` mixes scripts: Other + Latin (raw pass, confidence 0.80)

    
    Markus Kuhn [ˈmaʳkʊs kuːn] &lt;mkuhn@acm.org> — 1999-08-20
  114. identifier `kuːn` mixes scripts: Latin + Other (raw pass, confidence 0.80)

    
    Markus Kuhn [ˈmaʳkʊs kuːn] &lt;mkuhn@acm.org> — 1999-08-20
  115. identifier `α` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

    
      ∮ E⋅da = Q,  n → ∞, ∑ f(i) = ∏ g(i), ∀x∈ℝ: ⌈x⌉ = −⌊−x⌋, α ∧ ¬β = ¬(¬α ∨ β),
    
      ℕ ⊆ ℕ₀ ⊂ ℤ ⊂ ℚ ⊂ ℝ ⊂ ℂ, ⊥ &lt; a ≠ b ≡ c ≤ d ≪ ⊤ ⇒ (A ⇔ B),
  116. identifier `α` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

    
      ∮ E⋅da = Q,  n → ∞, ∑ f(i) = ∏ g(i), ∀x∈ℝ: ⌈x⌉ = −⌊−x⌋, α ∧ ¬β = ¬(¬α ∨ β),
    
      ℕ ⊆ ℕ₀ ⊂ ℤ ⊂ ℚ ⊂ ℝ ⊂ ℂ, ⊥ &lt; a ≠ b ≡ c ≤ d ≪ ⊤ ⇒ (A ⇔ B),
  117. identifier `kΩ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

    
      2H₂ + O₂ ⇌ 2H₂O, R = 4.7 kΩ, ⌀ 200 mm
    
    Linguistics and dictionaries:
  118. identifier `ıntəˈnæʃənəl` mixes scripts: Latin + Other (raw pass, confidence 0.80)

    
      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
  119. identifier `fəˈnɛtık` mixes scripts: Latin + Other (raw pass, confidence 0.80)

    
      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
  120. identifier `əsoʊsiˈeıʃn` mixes scripts: Other + Latin (raw pass, confidence 0.80)

    
      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
  121. identifier `ˈʏpsilɔn` mixes scripts: Other + Latin (raw pass, confidence 0.80)

      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
    
    APL:
  122. identifier `jɛn` mixes scripts: Latin + Other (raw pass, confidence 0.80)

      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
    
    APL:
  123. identifier `ˈjoːgɑ` mixes scripts: Other + Latin (raw pass, confidence 0.80)

      ði ıntəˈnæʃənəl fəˈnɛtık əsoʊsiˈeıʃn
      Y [ˈʏpsilɔn], Yen [jɛn], Yoga [ˈjoːgɑ]
    
    APL:
  124. identifier `τρομερή` contains homoglyph candidates: ρ (03C1)→p, ο (03BF)→o, ρ (03C1)→p (raw pass, confidence 0.70)

      Σὲ γνωρίζω ἀπὸ τὴν κόψη
      τοῦ σπαθιοῦ τὴν τρομερή,
      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
  125. identifier `τρομερή` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      Σὲ γνωρίζω ἀπὸ τὴν κόψη
      τοῦ σπαθιοῦ τὴν τρομερή,
      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
  126. identifier `μὲ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
  127. identifier `μετράει` contains homoglyph candidates: ρ (03C1)→p (raw pass, confidence 0.70)

      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
  128. identifier `μετράει` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      σὲ γνωρίζω ἀπὸ τὴν ὄψη
      ποὺ μὲ βία μετράει τὴ γῆ.
    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
  129. identifier `βγαλμένη` contains homoglyph candidates: α (03B1)→a, ν (03BD)→v, η (03B7)→n (raw pass, confidence 0.70)

    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
  130. identifier `βγαλμένη` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      ᾿Απ᾿ τὰ κόκκαλα βγαλμένη
      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
  131. identifier `ἀνδρειωμένη` contains homoglyph candidates: ν (03BD)→v, ρ (03C1)→p, ν (03BD)→v, η (03B7)→n (raw pass, confidence 0.70)

      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
      χαῖρε, ὦ χαῖρε, ᾿Ελευθεριά!
  132. identifier `ἀνδρειωμένη` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τῶν ῾Ελλήνων τὰ ἱερά
      καὶ σὰν πρῶτα ἀνδρειωμένη
      χαῖρε, ὦ χαῖρε, ᾿Ελευθεριά!
  133. identifier `μοι` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

    
      Οὐχὶ ταὐτὰ παρίσταταί μοι γιγνώσκειν, ὦ ἄνδρες ᾿Αθηναῖοι,
      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
  134. identifier `μοι` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

    
      Οὐχὶ ταὐτὰ παρίσταταί μοι γιγνώσκειν, ὦ ἄνδρες ᾿Αθηναῖοι,
      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
  135. identifier `πράγματα` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a, α (03B1)→a (raw pass, confidence 0.70)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
  136. identifier `πράγματα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
  137. identifier `μὲν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
  138. identifier `μὲν` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      ὅταν τ᾿ εἰς τὰ πράγματα ἀποβλέψω καὶ ὅταν πρὸς τοὺς
      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
  139. identifier `τιμωρήσασθαι` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a, α (03B1)→a (raw pass, confidence 0.70)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  140. identifier `τιμωρήσασθαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  141. identifier `γιγνομένους` contains homoglyph candidates: ν (03BD)→v, ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (raw pass, confidence 0.70)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  142. identifier `γιγνομένους` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  143. identifier `πράγματ` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a (raw pass, confidence 0.70)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  144. identifier `πράγματ` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      λόγους οὓς ἀκούω· τοὺς μὲν γὰρ λόγους περὶ τοῦ
      τιμωρήσασθαι Φίλιππον ὁρῶ γιγνομένους, τὰ δὲ πράγματ᾿ 
      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
  145. identifier `μὴ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
  146. identifier `πεισόμεθ` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      εἰς τοῦτο προήκοντα,  ὥσθ᾿ ὅπως μὴ πεισόμεθ᾿ αὐτοὶ
      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
  147. identifier `μοι` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
      οἱ τὰ τοιαῦτα λέγοντες ἢ τὴν ὑπόθεσιν, περὶ ἧς βουλεύεσθαι,
  148. identifier `μοι` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      πρότερον κακῶς σκέψασθαι δέον. οὐδέν οὖν ἄλλο μοι δοκοῦσιν
      οἱ τὰ τοιαῦτα λέγοντες ἢ τὴν ὑπόθεσιν, περὶ ἧς βουλεύεσθαι,
  149. identifier `ὑμῖν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  150. identifier `ὑμῖν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  151. identifier `ἁμαρτάνειν` contains homoglyph candidates: α (03B1)→a, ρ (03C1)→p, ν (03BD)→v, ν (03BD)→v (raw pass, confidence 0.70)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  152. identifier `ἁμαρτάνειν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  153. identifier `μέν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  154. identifier `μέν` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      οὐχὶ τὴν οὖσαν παριστάντες ὑμῖν ἁμαρτάνειν. ἐγὼ δέ, ὅτι μέν
      ποτ᾿ ἐξῆν τῇ πόλει καὶ τὰ αὑτῆς ἔχειν ἀσφαλῶς καὶ Φίλιππον
  155. identifier `τιμωρήσασθαι` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a, α (03B1)→a (raw pass, confidence 0.70)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  156. identifier `τιμωρήσασθαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  157. identifier `μάλ` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  158. identifier `ἐμοῦ` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  159. identifier `ἐμοῦ` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τιμωρήσασθαι, καὶ μάλ᾿ ἀκριβῶς οἶδα· ἐπ᾿ ἐμοῦ γάρ, οὐ πάλαι
      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
  160. identifier `ἀμφότερα` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a (raw pass, confidence 0.70)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  161. identifier `ἀμφότερα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  162. identifier `μέντοι` contains homoglyph candidates: ν (03BD)→v, ο (03BF)→o (raw pass, confidence 0.70)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  163. identifier `μέντοι` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  164. identifier `πέπεισμαι` contains homoglyph candidates: α (03B1)→a (raw pass, confidence 0.70)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  165. identifier `πέπεισμαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      γέγονεν ταῦτ᾿ ἀμφότερα· νῦν μέντοι πέπεισμαι τοῦθ᾿ ἱκανὸν
      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
  166. identifier `ἡμῖν` contains homoglyph candidates: ν (03BD)→v (raw pass, confidence 0.70)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  167. identifier `ἡμῖν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  168. identifier `συμμάχους` contains homoglyph candidates: ο (03BF)→o (raw pass, confidence 0.70)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  169. identifier `συμμάχους` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      προλαβεῖν ἡμῖν εἶναι τὴν πρώτην, ὅπως τοὺς συμμάχους
      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
  170. identifier `σώσομεν` contains homoglyph candidates: ο (03BF)→o, ν (03BD)→v (raw pass, confidence 0.70)

      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
  171. identifier `σώσομεν` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      σώσομεν. ἐὰν γὰρ τοῦτο βεβαίως ὑπάρξῃ, τότε καὶ περὶ τοῦ
      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
  172. identifier `τιμωρήσεταί` contains homoglyph candidates: ρ (03C1)→p, α (03B1)→a (raw pass, confidence 0.70)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  173. identifier `τιμωρήσεταί` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  174. identifier `μάταιον` contains homoglyph candidates: α (03B1)→a, ο (03BF)→o, ν (03BD)→v (raw pass, confidence 0.70)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  175. identifier `μάταιον` mixes scripts: Latin + Greek (raw pass, confidence 0.80)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  176. identifier `ἡγοῦμαι` contains homoglyph candidates: ο (03BF)→o, α (03B1)→a (raw pass, confidence 0.70)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  177. identifier `ἡγοῦμαι` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

      τίνα τιμωρήσεταί τις καὶ ὃν τρόπον ἐξέσται σκοπεῖν· πρὶν δὲ
      τὴν ἀρχὴν ὀρθῶς ὑποθέσθαι, μάταιον ἡγοῦμαι περὶ τῆς
      τελευτῆς ὁντινοῦν ποιεῖσθαι λόγον.
  178. identifier `Δημοσθένους` contains homoglyph candidates: η (03B7)→n, ο (03BF)→o, ν (03BD)→v, ο (03BF)→o (raw pass, confidence 0.70)

    
      Δημοσθένους, Γ´ ᾿Ολυνθιακὸς
    
    Georgian:
  179. identifier `Δημοσθένους` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      Δημοσθένους, Γ´ ᾿Ολυνθιακὸς
    
    Georgian:
  180. identifier `ἠḂӥẄɐː` mixes scripts: Greek + Latin + Cyrillic + Other (raw pass, confidence 0.80)

      –—‘“”„†•…‰™œŠŸž€ ΑΒΓΔΩαβγδω АБВГДабвгд
      ∀∂∈ℝ∧∪≡∞ ↑↗↨↻⇣ ┐┼╔╘░►☺♀ fi�⑀₂ἠḂӥẄɐː⍎אԱა
    
    Greetings in various languages:
  181. identifier `אԱა` mixes scripts: Hebrew + Armenian + Other (raw pass, confidence 0.80)

      –—‘“”„†•…‰™œŠŸž€ ΑΒΓΔΩαβγδω АБВГДабвгд
      ∀∂∈ℝ∧∪≡∞ ↑↗↨↻⇣ ┐┼╔╘░►☺♀ fi�⑀₂ἠḂӥẄɐː⍎אԱა
    
    Greetings in various languages:
  182. identifier `Καλημέρα` contains homoglyph candidates: Κ (039A)→K, α (03B1)→a, η (03B7)→n, ρ (03C1)→p (raw pass, confidence 0.70)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  183. identifier `Καλημέρα` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  184. identifier `κόσμε` contains homoglyph candidates: κ (03BA)→k (raw pass, confidence 0.70)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  185. identifier `κόσμε` mixes scripts: Greek + Latin (raw pass, confidence 0.80)

    
      Hello world, Καλημέρα κόσμε, コンニチハ
    
    Box drawing alignment tests:                                          █
  186. string literal contains an embedded NUL followed by 2 more bytes of source (token pass, confidence 0.85)

      EXPECT_EQ(4, SpanStructurallyValid("abcd"));
      EXPECT_EQ(4, SpanStructurallyValid(absl::string_view("a\0cd", 4)));  // NULL
      EXPECT_EQ(4, SpanStructurallyValid("ab\xc2\x81"));                   // 2-byte
      EXPECT_EQ(4, SpanStructurallyValid("a\xe2\x81\x81"));                // 3-byte
  187. string literal contains an embedded NUL followed by 2 more bytes of source (token pass, confidence 0.85)

      EXPECT_TRUE(IsStructurallyValid("abcd"));
      EXPECT_TRUE(IsStructurallyValid(absl::string_view("a\0cd", 4)));  // NULL
      EXPECT_TRUE(IsStructurallyValid("ab\xc2\x81"));                   // 2-byte
      EXPECT_TRUE(IsStructurallyValid("a\xe2\x81\x81"));                // 3-byte
  188. warn macro-keyword-override third_party/xxhash/xxhash.h:2717:1

    `#define inline` rebinds the reserved C keyword `inline` (token pass, confidence 0.85)

    #  elif defined(__ARM_NEON__) || defined(__ARM_NEON)
    #    define inline __inline__  /* circumvent a clang bug */
    #    include <arm_neon.h>
    #    undef inline
  189. warn identifier-confusable-collision third_party/xxhash/xxhash.h:3491:23

    two identifiers collapse to visual skeleton `bitf|ip|` (0/O/o and 1/l/I are confusable) (token pass, confidence 0.80)

        XXH_ASSERT(9 <= len && len <= 16);
        {   xxh_u64 const bitflip1 = (XXH_readLE64(secret+24) ^ XXH_readLE64(secret+32)) + seed;
            xxh_u64 const bitflip2 = (XXH_readLE64(secret+40) ^ XXH_readLE64(secret+48)) - seed;
            xxh_u64 const input_lo = XXH_readLE64(input)           ^ bitflip1;
  190. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    cd $(dirname $0)/../..
    "${BAZEL_QUERY[@]}" 'deps(//test/...)' > tools/artifact_gen/test_deps.xml
    "${BAZEL_QUERY[@]}" 'deps(//:all)' > tools/artifact_gen/root_all_deps.xml
    "${BAZEL_QUERY[@]}" 'deps(//src/compiler/...)' > tools/artifact_gen/compiler_deps.xml
  191. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    "${BAZEL_QUERY[@]}" 'deps(//test/...)' > tools/artifact_gen/test_deps.xml
    "${BAZEL_QUERY[@]}" 'deps(//:all)' > tools/artifact_gen/root_all_deps.xml
    "${BAZEL_QUERY[@]}" 'deps(//src/compiler/...)' > tools/artifact_gen/compiler_deps.xml
  192. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    "${BAZEL_QUERY[@]}" 'deps(//:all)' > tools/artifact_gen/root_all_deps.xml
    "${BAZEL_QUERY[@]}" 'deps(//src/compiler/...)' > tools/artifact_gen/compiler_deps.xml
    "${BAZEL_QUERY[@]}" 'kind(alias, "//third_party:*")' > tools/artifact_gen/third_party_alias_deps.xml
  193. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    "${BAZEL_QUERY[@]}" 'deps(//src/compiler/...)' > tools/artifact_gen/compiler_deps.xml
    "${BAZEL_QUERY[@]}" 'kind(alias, "//third_party:*")' > tools/artifact_gen/third_party_alias_deps.xml
    "${BAZEL_QUERY[@]}" 'deps(kind("^proto_library", @envoy_api//envoy/...))' > tools/artifact_gen/envoy_api_proto_deps.xml
  194. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    "${BAZEL_QUERY[@]}" 'deps(kind("^proto_library", @envoy_api//envoy/...))' > tools/artifact_gen/envoy_api_proto_deps.xml
    "${BAZEL_QUERY[@]}" 'deps("@com_google_protobuf//upb:generated_code_support")' > tools/artifact_gen/upb_deps.xml
  195. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    "${BAZEL_QUERY[@]}" 'deps("@com_google_protobuf//upb:generated_code_support")' > tools/artifact_gen/upb_deps.xml
    "${BAZEL_SHOW_REPO[@]}" "${EXTERNAL_REPOS[@]}" > tools/artifact_gen/external_http_archive_deps.log || true
  196. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    "${BAZEL_SHOW_REPO[@]}" "${EXTERNAL_REPOS[@]}" > tools/artifact_gen/external_http_archive_deps.log || true
    python3 tools/buildgen/parse_http_archives.py < tools/artifact_gen/external_http_archive_deps.log > tools/artifact_gen/external_http_archive_deps.json
  197. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # Build the C++ generator. This must be done from within the sub-workspace.
    (cd tools/artifact_gen && "${BAZEL_BUILD_ARTIFACT[@]}" //:gen_upb_api_from_bazel)
    
    # Now that the tool is built, we can move the executable to a temporary location
  198. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    if [[ -n "${BUILD_TARGETS}" ]]; then
      "${BAZEL_BUILD[@]}" ${BUILD_TARGETS}
    fi
  199. command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # Run distribtest script passed as args
    "$@"
  200. command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # Run command passed as args
    "$@"
  201. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    then
      source "../${GRPC_RUNTESTS_PREPARE_SCRIPT}"
    fi
  202. warn decoder-import-with-exec tools/buildgen/_mako_renderer.py:150:36

    file imports decoder module(s) pickle and calls `exec`/`eval`/`compile` — multi-stage payload shape (ast pass, confidence 0.80)

                                args["selected"] = el
                                if not eval(src["cond"], {}, args):
                                    continue
                            items.append(el)
  203. `eval` called on a non-literal expression (ast pass, confidence 0.70)

                                args["selected"] = el
                                if not eval(src["cond"], {}, args):
                                    continue
                            items.append(el)
  204. `open(__file__)` — file reads its own source, common pattern for extracting payloads hidden in comments (ast pass, confidence 0.85)

        # copy-paste copyright notice from this file
        with open(__file__) as my_source:
            copyright = []
            for line in my_source:
  205. warn dynamic-import tools/distrib/black_code.sh:36:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    python3 -m venv "${VIRTUALENV}"
    source "${VIRTUALENV}/bin/activate"
    python -VV
  206. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    python3.11 -m venv "${VIRTUALENV}"
    source "${VIRTUALENV}/bin/activate"
    python -VV
  207. command name is a variable (`$1`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

              echo "Error: file '$f' is missing a trailing newline character."
              if $1; then # fix
                sed -i -e '$a\' $f
                echo 'Fixed!'
  208. warn dynamic-import tools/distrib/isort_code.sh:39:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    python3 -m venv "${VIRTUALENV}"
    source "${VIRTUALENV}/bin/activate"
    python -VV
  209. warn dynamic-import tools/distrib/pylint_code.sh:39:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    python3.11 -m venv "${VIRTUALENV}"
    source "${VIRTUALENV}/bin/activate"
    python -VV
  210. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    python3 -m venv "${VIRTUALENV}"
    source "${VIRTUALENV}/bin/activate"
    python3 -VV
  211. warn dynamic-execution tools/distrib/python/docgen.py:65:21

    `os.popen` called with a literal shell command (ast pass, confidence 0.70)

    if not args.repo_owner or not args.doc_branch:
        tty_width = int(os.popen("stty size", "r").read().split()[1])
        print("-" * tty_width)
        print("Please check generated Python doc inside doc/build")
  212. `exec` called on a non-literal expression (ast pass, confidence 0.70)

                        code = _proto_code_cache[self._module_name]
                        exec(code, module.__dict__)
                    else:
                        files = self._codegen_fn(
  213. `exec` called on a non-literal expression (ast pass, confidence 0.70)

                                importlib.import_module(module_name)
                        exec(files[-1][1], module.__dict__)
    
        class ProtoFinder(importlib.abc.MetaPathFinder):
  214. warn dynamic-import tools/distrib/ruff_code.sh:40:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    python3 -m venv "${VIRTUALENV}"
    source "${VIRTUALENV}/bin/activate"
    python -VV
  215. pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)

    touch .profile
    curl -o- https://raw.githubusercontent.com/creationix/nvm/v0.25.4/install.sh | bash
    # silence shellcheck as it cannot follow the following `source` path statically:
    # shellcheck disable=SC1090
  216. pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)

    gpg --keyserver hkp://pgp.mit.edu --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 7D2BAF1CF37B13E2069D6956105BD0E739499BDB
    curl -sSL https://get.rvm.io | bash -s stable --ruby
    # silence shellcheck as it cannot follow the following `source` path statically:
    # shellcheck disable=SC1090
  217. pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)

    # Install docker
    curl -sSL https://get.docker.com/ | sh
    # Enable kbuilder to use docker without sudo:
    sudo usermod -aG docker kbuilder
  218. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # shellcheck disable=SC1090
    [[ -s "$HOME/.rvm/scripts/rvm" ]] && source "$HOME/.rvm/scripts/rvm"
    
    # rvm commands are very verbose and we dont want to pollute the log by echo,
  219. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      set +x
      source $HOME/.rvm/scripts/rvm
    
      RUBY_VERSION=3.2.0
  220. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  221. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  222. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  223. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  224. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  225. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  226. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  227. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  228. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  229. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  230. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  231. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    export LANG=en_US.UTF-8
  232. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  233. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    echo "Activating Python venv"
    source "${VIRTUAL_ENV}/bin/activate"
    set -x
  234. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    echo "Activating Python venv"
    source "${VIRTUAL_ENV}/bin/activate"
    set -x
  235. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    
      source "${script_dir}/grpc_xds_k8s_run_xtest.sh"
    
      local failed_tests=0
  236. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    
      source "${script_dir}/grpc_xds_k8s_run_xtest.sh"
    
      local failed_tests=0
  237. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      fi
      source "${install_lib}"
    }
  238. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    
    source "${BUILD_SCRIPT_DIR}/psm-interop-install-lib.sh"
    psm::lang::source_install_lib
    source "${BUILD_SCRIPT_DIR}/psm-interop-build-${GRPC_LANGUAGE}.sh"
  239. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    psm::lang::source_install_lib
    source "${BUILD_SCRIPT_DIR}/psm-interop-build-${GRPC_LANGUAGE}.sh"
    psm::run "${PSM_TEST_SUITE}"
  240. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    
    source "${BUILD_SCRIPT_DIR}/psm-interop-install-lib.sh"
    psm::lang::source_install_lib
    source "${BUILD_SCRIPT_DIR}/psm-interop-build-${GRPC_LANGUAGE}.sh"
  241. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    psm::lang::source_install_lib
    source "${BUILD_SCRIPT_DIR}/psm-interop-build-${GRPC_LANGUAGE}.sh"
    psm::run "${PSM_TEST_SUITE}"
  242. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  243. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  244. command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    else
      $@
    fi
  245. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  246. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  247. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  248. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  249. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # List of benchmarks that provide good signal for analyzing performance changes in pull requests
  250. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  251. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  252. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  253. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  254. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  255. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # avoid slow finalization after the script has exited.
    source $(dirname $0)/../../../tools/internal_ci/helper_scripts/move_src_tree_and_respawn_itself_rc
    
    # change to grpc repo root
  256. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # otherwise not respected when directly building the wheel.
    ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation "${WHEEL_PLAT_CONFIG_OPTION[@]}"
    
    GRPCIO_STRIP_TEMPDIR=$(mktemp -d)
  257. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # Build gRPC tools package source and binary distribution
    ${SETARCH_CMD} "${PYTHON}" -m build "tools/distrib/python/grpcio_tools" \
      --no-isolation "${WHEEL_PLAT_CONFIG_OPTION[@]}"
  258. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      "${PYTHON}" src/python/grpcio_observability/make_grpcio_observability.py
      ${SETARCH_CMD} "${PYTHON}" -m build "src/python/grpcio_observability" \
        --no-isolation "${WHEEL_PLAT_CONFIG_OPTION[@]}"
    fi
  259. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      if [ "$GRPC_BUILD_MAC" == "" ]; then
        ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation "src/python/grpcio_csm_observability"
        cp -r src/python/grpcio_csm_observability/dist/* "$ARTIFACT_DIR"
      fi
  260. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      # build_xds_protos.py is invoked as part of generate_projects.
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation \
        "py_xds_protos"
  261. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      # TODO(ssreenithi): find pyproject.toml/nox equivalent
      ${SETARCH_CMD} "${PYTHON}" src/python/grpcio_testing/setup.py preprocess
      ${SETARCH_CMD} "${PYTHON}" -m build src/python/grpcio_testing
      cp -r src/python/grpcio_testing/dist/* "$ARTIFACT_DIR"
  262. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      ${SETARCH_CMD} "${PYTHON}" src/python/grpcio_testing/setup.py preprocess
      ${SETARCH_CMD} "${PYTHON}" -m build src/python/grpcio_testing
      cp -r src/python/grpcio_testing/dist/* "$ARTIFACT_DIR"
  263. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      # TODO(ssreenithi): find pyproject.toml/nox equivalent
      ${SETARCH_CMD} "${PYTHON}" src/python/grpcio_channelz/setup.py \
          preprocess build_package_protos
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation \
  264. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          preprocess build_package_protos
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation \
        "src/python/grpcio_channelz"
  265. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      # TODO(ssreenithi): find pyproject.toml/nox equivalent
      ${SETARCH_CMD} "${PYTHON}" src/python/grpcio_health_checking/setup.py \
          preprocess build_package_protos
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation \
  266. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          preprocess build_package_protos
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation \
        "src/python/grpcio_health_checking"
  267. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      # TODO(ssreenithi): find pyproject.toml/nox equivalent
      ${SETARCH_CMD} "${PYTHON}" src/python/grpcio_reflection/setup.py \
          preprocess build_package_protos
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation \
  268. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          preprocess build_package_protos
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation \
        "src/python/grpcio_reflection"
  269. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      # TODO(ssreenithi): find pyproject.toml/nox equivalent
      ${SETARCH_CMD} "${PYTHON}" src/python/grpcio_status/setup.py \
          preprocess
      ${SETARCH_CMD} "${PYTHON}" -m build "src/python/grpcio_status"
  270. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

          preprocess
      ${SETARCH_CMD} "${PYTHON}" -m build "src/python/grpcio_status"
      cp -r src/python/grpcio_status/dist/* "$ARTIFACT_DIR"
  271. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      # Build grpcio_csds source distribution
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation "src/python/grpcio_csds"
    
      cp -r src/python/grpcio_csds/dist/* "$ARTIFACT_DIR"
  272. command name is a variable (`$SETARCH_CMD`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

      "${PYTHON}" -m pip install grpcio-csds --no-index --find-links "file://$ARTIFACT_DIR/"
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation "src/python/grpcio_admin"
    
      cp -r src/python/grpcio_admin/dist/* "$ARTIFACT_DIR"
  273. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # Copy all files except '*.tar.gz' and '*py3-none-any.whl' files.
    "${find_cmd[@]}" -print0 \
        | xargs -0 -I% find % -type f -maxdepth 1 \
        -not -name "*.tar.gz" -not -name "*py3-none-any.whl" \
  274. command name is a variable () not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # Copy only the '*.tar.gz' and '*py3-none-any.whl' files.
    "${find_cmd[@]}" -print0 | xargs -0 -I% \
        find % \( -name "*.tar.gz" -o -name "*py3-none-any.whl" \) \
        -exec cp -v {} ./artifacts \;
  275. command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # shellcheck disable=SC2068
    $@
  276. command name is a variable (`$DOCKER_RUN_SCRIPT_COMMAND`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    exit_code=0
    ${DOCKER_RUN_SCRIPT_COMMAND} || exit_code=$?
    
    if [ -x "$(command -v ccache)" ]
  277. command name is a variable (`$1`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    function venv() {
      $1 -c "import sys; print('py{}{}'.format(*sys.version_info[:2]))"
    }
  278. command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    source ~/.nvm/nvm.sh
    "$@"
  279. command name is a variable (`$@`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    source /usr/local/rvm/scripts/rvm
    "$@"
  280. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # shellcheck disable=SC1090 disable=SC1091
    . "$HOME/.nvm/nvm.sh"
    
    nvm install 10
  281. `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    # shellcheck disable=SC1090 disable=SC1091
    . "$HOME/.nvm/nvm.sh"
    
    nvm use 10
  282. warn dynamic-execution tools/run_tests/run_tests.py:1914:15

    `subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)

    
        retcode = subprocess.call(
            "tools/run_tests/dockerize/build_and_run_docker.sh", shell=True, env=env
        )
  283. `subprocess.check_output` called with `shell=True` and a literal command (ast pass, confidence 0.70)

    git_submodules = (
        subprocess.check_output("git submodule", shell=True)
        .decode()
        .strip()
  284. `subprocess.check_output` called with `shell=True` and a literal command (ast pass, confidence 0.70)

        git_submodules = (
            subprocess.check_output("git submodule", shell=True)
            .decode()
            .strip()
  285. `subprocess.check_output` called with `shell=True` and a literal command (ast pass, confidence 0.70)

    try:
        branch_name = subprocess.check_output(
            "git rev-parse --abbrev-ref HEAD", shell=True
        ).decode()
  286. info dynamic-execution src/objective-c/tests/run_keepalive_test.sh:32:5 new in this release

    command name is a variable (`$BAZEL`) that this file sets only to plain text (ast pass, confidence 0.40)

    [ -f $INTEROP ] || {
        $BAZEL build //test/cpp/interop:interop_server
    }
  287. info dynamic-execution src/objective-c/tests/run_keepalive_test.sh:45:1 new in this release

    command name is a variable (`$INTEROP`) that this file sets only to plain text (ast pass, confidence 0.40)

    # from the port server with --ack_pings=false for keepalive testing.
    $INTEROP --port=$PLAIN_PORT --max_send_message_size=8388608 --ack_pings=false &
    $INTEROP --port=$TLS_PORT --max_send_message_size=8388608 --use_tls --ack_pings=false &
  288. info dynamic-execution src/objective-c/tests/run_keepalive_test.sh:46:1 new in this release

    command name is a variable (`$INTEROP`) that this file sets only to plain text (ast pass, confidence 0.40)

    $INTEROP --port=$PLAIN_PORT --max_send_message_size=8388608 --ack_pings=false &
    $INTEROP --port=$TLS_PORT --max_send_message_size=8388608 --use_tls --ack_pings=false &
    
    function finish {
  289. info dynamic-execution src/objective-c/tests/run_keepalive_test.sh:93:7 new in this release

    command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        ${XCODEBUILD_FLAGS} \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
    
    XCTEST=$(xcrun --find xctest || echo "/Applications/Xcode.app/Contents/Developer/usr/bin/xctest")
  290. info critical → info by review dynamic-execution src/objective-c/tests/run_keepalive_test.sh:99:1 new in this release

    command name is a variable (`$XCTEST`) and `XCTEST` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    export HOST_PORT_LOCALSSL="localhost:$TLS_PORT"
    "$XCTEST" -XCTest "InteropTestsLocalCleartext/testKeepaliveWithV2API" "$BUNDLE_PATH"
    likely benign LLM, confidence 0.85 Runs an XCTest binary through a variable path to execute a keepalive interop test.
    Reasoning

    $XCTEST is the xctest runner path used to execute the interop test bundle, which is ordinary test execution. The variable command name is expected here.

  291. info warn → info by review encoding-base64 test/core/credentials/call/call_credentials_test.cc:5353:6 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "-----BEGIN PRIVATE KEY-----\n"
        "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgUBPYGHx4AnG2rIxQ\n"
        "5aXWVn2g4vGR4/WVxautYTHClUehRANCAAQ8TwEYxDnaovfS6UEHo6eNykUBlC2L\n"
        "GZ6rVuvkS+5Kw8k7IOVjrzE/lvVY1lDpKmIw2w7IgRxSIdDdyN6TbxNT\n"
    likely benign LLM, confidence 0.90 Test EC private key PEM fixture.
    Reasoning

    A PEM-formatted EC private key used as a test fixture in credentials tests; expected content for this test file with no execution or hiding.

  292. info warn → info by review encoding-base64 test/core/credentials/call/call_credentials_test.cc:5354:6 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgUBPYGHx4AnG2rIxQ\n"
        "5aXWVn2g4vGR4/WVxautYTHClUehRANCAAQ8TwEYxDnaovfS6UEHo6eNykUBlC2L\n"
        "GZ6rVuvkS+5Kw8k7IOVjrzE/lvVY1lDpKmIw2w7IgRxSIdDdyN6TbxNT\n"
        "-----END PRIVATE KEY-----\n";
    likely benign LLM, confidence 0.95 Base64 body of a test EC private key in a PEM string.
    Reasoning

    The blob is a PEM-encoded EC private key inside a gRPC credentials unit test. Test fixtures commonly embed throwaway keys, and the base64 structure is a standard PKCS#8 header. Nothing shows obfuscation or payload delivery.

  293. info warn → info by review encoding-base64 test/core/credentials/call/gdch_service_account_credentials_test.cc:55:6 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "-----BEGIN PRIVATE KEY-----\n"
        "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgUBPYGHx4AnG2rIxQ\n"
        "5aXWVn2g4vGR4/WVxautYTHClUehRANCAAQ8TwEYxDnaovfS6UEHo6eNykUBlC2L\n"
        "GZ6rVuvkS+5Kw8k7IOVjrzE/lvVY1lDpKmIw2w7IgRxSIdDdyN6TbxNT\n"
    likely benign LLM, confidence 0.95 PEM private key body in a GDCH credentials test fixture.
    Reasoning

    A PEM private key block in a GDCH service account credentials test, the same fixture pattern as its sibling findings. It is test data for parsing credentials, not hidden code.

  294. info warn → info by review encoding-base64 test/core/credentials/call/gdch_service_account_credentials_test.cc:56:6 new in this release

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgUBPYGHx4AnG2rIxQ\n"
        "5aXWVn2g4vGR4/WVxautYTHClUehRANCAAQ8TwEYxDnaovfS6UEHo6eNykUBlC2L\n"
        "GZ6rVuvkS+5Kw8k7IOVjrzE/lvVY1lDpKmIw2w7IgRxSIdDdyN6TbxNT\n"
        "-----END PRIVATE KEY-----\n";
    likely benign LLM, confidence 0.95 Repeated PEM private key fixture in a GDCH credentials test.
    Reasoning

    Same PEM private key fixture repeated in the GDCH test. Expected for testing credential parsing; no execution or concealed logic is present.

  295. info long-line CMakeLists.txt:56404:1

    line length 602 characters (raw pass, confidence 0.50)

      "absl_algorithm_container absl_any_invocable absl_base absl_bind_front absl_bits absl_btree absl_check absl_cleanup absl_config absl_cord absl_core_headers absl_flags absl_flags_marshalling absl_flat_hash_map absl_flat_hash_set absl_function_ref absl_hash absl_inlined_vector absl_log absl_log_globals absl_log_severit
  296. info long-line CMakeLists.txt:56415:1

    line length 602 characters (raw pass, confidence 0.50)

      "absl_algorithm_container absl_any_invocable absl_base absl_bind_front absl_bits absl_btree absl_check absl_cleanup absl_config absl_cord absl_core_headers absl_flags absl_flags_marshalling absl_flat_hash_map absl_flat_hash_set absl_function_ref absl_hash absl_inlined_vector absl_log absl_log_globals absl_log_severit
  297. info long-line CMakeLists.txt:56426:1

    line length 723 characters (raw pass, confidence 0.50)

      "absl_absl_check absl_absl_log absl_algorithm_container absl_any_invocable absl_base absl_bind_front absl_bits absl_btree absl_charset absl_check absl_cleanup absl_config absl_cord absl_core_headers absl_dynamic_annotations absl_flags absl_flags_marshalling absl_flat_hash_map absl_flat_hash_set absl_function_ref absl
  298. info long-line CMakeLists.txt:56437:1

    line length 732 characters (raw pass, confidence 0.50)

      "absl_absl_check absl_absl_log absl_algorithm_container absl_any_invocable absl_base absl_bind_front absl_bits absl_btree absl_charset absl_check absl_cleanup absl_config absl_cord absl_core_headers absl_dynamic_annotations absl_flags absl_flags_marshalling absl_flat_hash_map absl_flat_hash_set absl_function_ref absl
  299. info long-line CMakeLists.txt:56449:1

    line length 750 characters (raw pass, confidence 0.50)

        "absl_absl_check absl_absl_log absl_algorithm_container absl_any_invocable absl_base absl_bind_front absl_bits absl_btree absl_charset absl_check absl_cleanup absl_config absl_cord absl_core_headers absl_dynamic_annotations absl_flags absl_flags_marshalling absl_flat_hash_map absl_flat_hash_set absl_function_ref ab
  300. line length 768 characters (raw pass, confidence 0.50)

    **Load Balancing:**<ul><li>[Virtual host]https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-virtualhost domains matching</li><li>Only default path ("" or "/") matching</li><li>Priority-based weighted round-robin locality picking</li><li>Round-robin endpoint picki
  301. line length 877 characters (raw pass, confidence 0.50)

    Request matching based on:<ul><li>[Path]https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#config-route-v3-routematch (prefix, full path and safe regex)</li><ul><li>[case_sensitive](https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/route/v3/route_components.proto#envoy-v
  302. line length 733 characters (raw pass, confidence 0.50)

    [Ring hash]https://www.envoyproxy.io/docs/envoy/latest/intro/arch_overview/upstream/load_balancing/load_balancers#ring-hash load balancing policy:<br> Only the following [policy specifiers](https://github.com/envoyproxy/envoy/blob/2443032526cf6e50d63d35770df9473dd0460fc0/api/envoy/config/route/v3/route_components.pro
  303. command name is a variable (`$cygwin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Increase the maximum file descriptors if we can.
    if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
        case $MAX_FD in #(
          max*)
  304. command name is a variable (`$darwin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Increase the maximum file descriptors if we can.
    if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
        case $MAX_FD in #(
          max*)
  305. command name is a variable (`$nonstop`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Increase the maximum file descriptors if we can.
    if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
        case $MAX_FD in #(
          max*)
  306. command name is a variable (`$cygwin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # For Cygwin or MSYS, switch paths to Windows format before running java
    if "$cygwin" || "$msys" ; then
        APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
        CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
  307. command name is a variable (`$msys`) that this file sets only to plain text (ast pass, confidence 0.40)

    # For Cygwin or MSYS, switch paths to Windows format before running java
    if "$cygwin" || "$msys" ; then
        APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
        CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
  308. info critical → info by review dynamic-execution examples/android/helloworld/gradlew:244:1

    `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

    
    eval "set -- $(
            printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
            xargs -n1 |
    likely benign LLM, confidence 0.90 Gradle wrapper uses eval to parse JVM option strings into arguments.
    Reasoning

    This is the standard Gradle wrapper script idiom: eval over xargs-split JVM options to rebuild the argument list. Options come from the developer's own environment variables, so it is a known pattern but a real dynamic eval, not malicious here.

  309. info critical → info by review dynamic-execution examples/android/helloworld/gradlew:251:1

    `exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)

    
    exec "$JAVACMD" "$@"
    likely benign LLM, confidence 0.90 Gradle wrapper execs the Java binary with user arguments.
    Reasoning

    Final exec of the resolved java binary with forwarded arguments is the normal Gradle wrapper launch step.

  310. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $PROTOC --proto_path=examples/protos \
           --php_out=examples/php \
           --grpc_out=generate_server:examples/php \
  311. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $PROTOC --proto_path=examples/protos \
           --php_out=examples/php/route_guide \
           --grpc_out=generate_server:examples/php/route_guide \
  312. info warn → info by review dynamic-execution examples/ruby/README.md:19:5

    [embedded bash] pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)

      $ gpg --keyserver hkp://keys.gnupg.net --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3
      $ \curl -sSL https://get.rvm.io | bash -s stable --ruby=ruby-2
      $
      $ # follow the instructions to ensure that your're using the latest stable version of Ruby
    likely benign LLM, confidence 0.85 README instructs installing RVM via curl piped to bash.
    Reasoning

    Documentation showing the well-known RVM install command piping curl into bash. It is a legitimate, commonly documented install method from an official source, though it carries the usual pipe-to-shell risk for readers.

  313. command name is a variable (`$cygwin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Increase the maximum file descriptors if we can.
    if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
        case $MAX_FD in #(
          max*)
  314. command name is a variable (`$darwin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Increase the maximum file descriptors if we can.
    if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
        case $MAX_FD in #(
          max*)
  315. command name is a variable (`$nonstop`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Increase the maximum file descriptors if we can.
    if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
        case $MAX_FD in #(
          max*)
  316. command name is a variable (`$cygwin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # For Cygwin or MSYS, switch paths to Windows format before running java
    if "$cygwin" || "$msys" ; then
        APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
        CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
  317. command name is a variable (`$msys`) that this file sets only to plain text (ast pass, confidence 0.40)

    # For Cygwin or MSYS, switch paths to Windows format before running java
    if "$cygwin" || "$msys" ; then
        APP_HOME=$( cygpath --path --mixed "$APP_HOME" )
        CLASSPATH=$( cygpath --path --mixed "$CLASSPATH" )
  318. info critical → info by review dynamic-execution src/android/test/interop/gradlew:244:1

    `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

    
    eval "set -- $(
            printf '%s\n' "$DEFAULT_JVM_OPTS $JAVA_OPTS $GRADLE_OPTS" |
            xargs -n1 |
    likely benign LLM, confidence 0.90 Gradle wrapper eval of JVM options in a test project.
    Reasoning

    Identical Gradle wrapper eval idiom in a test directory, operating on the developer's own JVM option variables.

  319. info critical → info by review dynamic-execution src/android/test/interop/gradlew:251:1

    `exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)

    
    exec "$JAVACMD" "$@"
    likely benign LLM, confidence 0.90 Gradle wrapper execs Java binary in a test project.
    Reasoning

    Standard Gradle wrapper exec of the Java command with forwarded arguments.

  320. info warn → info by review dynamic-execution src/c-ares/gen_build_yaml.py:29:9

    `subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)

        def gen_ares_build(x):
            subprocess.call("third_party/cares/cares/buildconf", shell=True)
            subprocess.call("third_party/cares/cares/configure", shell=True)
    likely benign LLM, confidence 0.85 Build script runs fixed c-ares autotools commands via shell.
    Reasoning

    Build-generation script running fixed literal commands (buildconf, configure) with shell=True. No external input is involved, so the risk is low.

  321. info warn → info by review dynamic-execution src/c-ares/gen_build_yaml.py:30:9

    `subprocess.call` called with `shell=True` and a literal command (ast pass, confidence 0.70)

            subprocess.call("third_party/cares/cares/buildconf", shell=True)
            subprocess.call("third_party/cares/cares/configure", shell=True)
    
        def config_platform(x):
    likely benign LLM, confidence 0.85 Build script runs fixed c-ares configure command via shell.
    Reasoning

    Same as the adjacent finding: literal configure command with shell=True in a build generator, no untrusted input.

  322. info critical → info by review dynamic-execution src/core/util/subprocess_posix.cc:60:5

    `execv` called with a non-literal path (ast pass, confidence 0.90)

        exec_args[argc] = nullptr;
        execv(exec_args[0], exec_args);
        // if we reach here, an error has occurred
        LOG(ERROR) << "execv '" << exec_args[0]
    likely benign LLM, confidence 0.90 gRPC subprocess helper calls execv with caller-supplied arguments.
    Reasoning

    This is the core of gRPC's subprocess implementation, where execv runs a caller-specified program with an argument vector. The flagged call is expected for a subprocess utility and is not hidden or obfuscated.

  323. info critical → info by review dynamic-execution src/core/util/subprocess_posix.cc:103:5

    `execve` called with a non-literal path (ast pass, confidence 0.90)

        envp_args[envc] = nullptr;
        execve(exec_args[0], exec_args, envp_args);
        // if we reach here, an error has occurred
        LOG(ERROR) << "execvpe '" << exec_args[0]
    likely benign LLM, confidence 0.90 gRPC subprocess helper calls execve with caller-supplied environment.
    Reasoning

    Same subprocess utility implementing execve with an environment; this is its intended purpose, not evidence of malicious behavior.

  324. info warn → info by review dynamic-execution src/objective-c/README.md:174:3

    [embedded bash] pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)

    ```sh
    $ curl -fsSL https://goo.gl/getgrpc | bash -
    ```
    This will download and run the [gRPC install script][].
    likely benign LLM, confidence 0.85 README instructs installing gRPC via curl piped to bash.
    Reasoning

    Documentation of the gRPC install script via curl piped to bash from a short-link URL. It is a common install pattern that poses supply-chain risk, but the text is a legitimate documented instruction.

  325. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_option_test.sh:26:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    set -uo pipefail; set +e; f=bazel_tools/tools/bash/runfiles/runfiles.bash
    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
    likely benign LLM, confidence 0.85 Bazel runfiles bootstrap sources library from a variable path.
    Reasoning

    Standard Bazel runfiles bootstrap that sources the runfiles library from a path derived from environment variables and a manifest, with fallbacks. Dynamic sourcing is expected here and the file is a test script.

  326. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_option_test.sh:27:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.85 Bazel runfiles fallback sources library from manifest-derived path.
    Reasoning

    Part of the same standard Bazel runfiles fallback chain; no malicious indicators.

  327. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_option_test.sh:28:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.85 Bazel runfiles fallback sources library from exe manifest path.
    Reasoning

    Same Bazel runfiles bootstrap pattern; the fixed library name and local manifest lookup are benign.

  328. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_option_test.sh:29:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    likely benign LLM, confidence 0.85 Bazel runfiles final fallback sources library or errors out.
    Reasoning

    Final fallback in the standard Bazel runfiles bootstrap, ending with an error if not found; benign.

  329. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_option_test.sh:30:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    # --- end runfiles.bash initialization v3 ---
    likely benign LLM, confidence 0.85 Bazel runfiles initialization that sources the runfiles helper script via a computed path.
    Reasoning

    This is the standard Bazel runfiles.bash bootstrap boilerplate, which sources a runfiles library from a manifest or runfiles directory. The path comes from the build environment, not untrusted input, so this is a legitimate test-harness pattern.

  330. info critical → info by review dynamic-execution src/objective-c/tests/PluginTest/plugin_option_test.sh:44:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    $PROTOC \
        --plugin=protoc-gen-grpc="$PLUGIN" \
        --objc_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.85 Invokes the protoc compiler through a variable path to generate Objective-C code in a plugin test.
    Reasoning

    $PROTOC is a protoc binary path set by the test setup and invoked to generate Objective-C protobuf output. Variable command names are common in build scripts, and nothing here is an encoded dropper or hidden execution.

  331. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_test.sh:26:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    set -uo pipefail; set +e; f=bazel_tools/tools/bash/runfiles/runfiles.bash
    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
    likely benign LLM, confidence 0.85 Bazel runfiles bootstrap that sources runfiles.bash through several fallback paths.
    Reasoning

    Same Bazel runfiles bootstrap pattern, sourcing runfiles.bash from RUNFILES_DIR or manifest fallbacks. This is standard, legitimate test infrastructure.

  332. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_test.sh:27:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.85 Fallback line in the Bazel runfiles bootstrap that sources runfiles.bash from a manifest lookup.
    Reasoning

    Part of the same standard Bazel runfiles fallback chain. The sourced path is derived from the build environment and the known library name.

  333. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_test.sh:28:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.85 Another fallback line in the Bazel runfiles bootstrap sourcing the runfiles library.
    Reasoning

    Same standard Bazel runfiles bootstrap fallback chain, with no untrusted input or obfuscation.

  334. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_test.sh:29:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    likely benign LLM, confidence 0.85 Bazel runfiles fallback sourcing line that ends with an error exit if the library is not found.
    Reasoning

    Standard Bazel runfiles bootstrap fallback, including the error message on failure. Benign test-harness code.

  335. info warn → info by review dynamic-import src/objective-c/tests/PluginTest/plugin_test.sh:30:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    # --- end runfiles.bash initialization v3 ---
    likely benign LLM, confidence 0.85 Final manifest-based fallback in the Bazel runfiles bootstrap sequence.
    Reasoning

    Standard Bazel runfiles bootstrap line, the last of the fallback chain before the v3 initialization end marker. Legitimate build-test code.

  336. info critical → info by review dynamic-execution src/objective-c/tests/PluginTest/plugin_test.sh:42:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    $PROTOC \
        --plugin=protoc-gen-grpc="$PLUGIN" \
        --objc_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.85 Runs the protoc compiler through a variable to generate Objective-C protobuf code.
    Reasoning

    Same protoc invocation pattern as the sibling script: $PROTOC is a build-provided compiler path generating Objective-C output. No malicious indicators.

  337. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        CODE_SIGNING_ALLOWED=NO \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
    elif [ "$SCHEME" == "tvOS-sample" ]; then
      time xcodebuild \
  338. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        CODE_SIGNING_ALLOWED=NO \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
    else
      time xcodebuild \
  339. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        CODE_SIGNING_ALLOWED=NO \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
    fi
  340. command name is a variable (`$BAZEL`) that this file sets only to plain text (ast pass, confidence 0.40)

    [ -f $INTEROP ] || {
        $BAZEL build //test/cpp/interop:interop_server
    }
  341. command name is a variable (`$INTEROP`) that this file sets only to plain text (ast pass, confidence 0.40)

    # from the port server.
    $INTEROP --port=$PLAIN_PORT --max_send_message_size=8388608 &
    $INTEROP --port=$TLS_PORT --max_send_message_size=8388608 --use_tls &
  342. command name is a variable (`$INTEROP`) that this file sets only to plain text (ast pass, confidence 0.40)

    $INTEROP --port=$PLAIN_PORT --max_send_message_size=8388608 &
    $INTEROP --port=$TLS_PORT --max_send_message_size=8388608 --use_tls &
    
    function finish {
  343. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        "${XCODEBUILD_FLAGS}" \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
  344. command name is a variable (`$BAZEL`) that this file sets only to plain text (ast pass, confidence 0.40)

    [ -f $INTEROP ] || {
        $BAZEL build //test/cpp/interop:interop_server
    }
    [ -f $INTEROP ] || exit 1
  345. command name is a variable (`$INTEROP`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $INTEROP --port=$PLAIN_PORT --max_send_message_size=8388608 &
    $INTEROP --port=$TLS_PORT --max_send_message_size=8388608 --use_tls &
  346. command name is a variable (`$INTEROP`) that this file sets only to plain text (ast pass, confidence 0.40)

    $INTEROP --port=$PLAIN_PORT --max_send_message_size=8388608 &
    $INTEROP --port=$TLS_PORT --max_send_message_size=8388608 --use_tls &
    
    trap 'kill -9 `jobs -p` ; echo "EXIT TIME:  $(date)"' EXIT
  347. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $PROTOC --proto_path=src/proto/math \
           --php_out=src/php/tests/generated_code \
           --grpc_out=generate_server:src/php/tests/generated_code \
  348. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    # interop test protos
    $PROTOC -I . \
           -I third_party/protobuf/src \
           --php_out=src/php/tests/interop \
  349. info critical → info by review dynamic-execution src/php/bin/run_tests.sh:25:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    export DYLD_LIBRARY_PATH=$root/libs/$CONFIG
    $(which php) $extension_dir -d max_execution_time=300 $(which phpunit) -v --debug \
      --exclude-group persistent_list_bound_tests ../tests/unit_tests
    likely benign LLM, confidence 0.80 Test runner invoking php and phpunit resolved through which, with a library path export.
    Reasoning

    Command substitutions $(which php) and $(which phpunit) resolve local test tools in a PHP extension test runner. This is typical CI scripting with no network fetch or decoding.

  350. info critical → info by review dynamic-execution src/php/bin/run_tests.sh:38:4

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    if [[ "$SKIP_PERSISTENT_CHANNEL_TESTS" != "true" ]]; then
       $(which php) $extension_dir -d max_execution_time=300 $(which phpunit) -v --debug \
         ../tests/unit_tests/PersistentChannelTests
    fi
    likely benign LLM, confidence 0.80 Conditional invocation of php and phpunit to run persistent channel tests.
    Reasoning

    Same $(which php) / $(which phpunit) pattern inside a conditional that runs persistent channel tests. Ordinary test-runner logic.

  351. info dynamic-execution src/php/bin/run_xds_client.sh:60:7

    command name is a variable (`$running`) that this file sets only to plain text (ast pass, confidence 0.40)

    running=true
    while $running
    do
        sleep 1
  352. info warn → info by review implicit-int-function src/php/ext/grpc/call.c:59:1

    6 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. zval, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD) (ast pass, confidence 0.85)

     * grpc_metadata_array. Returns NULL on failure */
    zval *grpc_parse_metadata_array(grpc_metadata_array
                                    *metadata_array TSRMLS_DC) {
      int count = metadata_array->count;
    likely benign LLM, confidence 0.90 Old-style C function definitions without explicit return types in the gRPC PHP extension.
    Reasoning

    This is legacy K&R-style C from the PHP extension, using TSRMLS_DC macros and implicit int. It is a style and portability issue in old code, not obfuscation or malicious intent.

  353. info warn → info by review implicit-int-function src/php/ext/grpc/call_credentials.c:55:1

    3 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. zval, PHP_METHOD, PHP_METHOD) (ast pass, confidence 0.85)

    
    zval *grpc_php_wrap_call_credentials(grpc_call_credentials
                                         *wrapped TSRMLS_DC) {
      zval *credentials_object;
    likely benign LLM, confidence 0.93 Legacy PHP extension C code for wrapping gRPC call credentials objects.
    Reasoning

    Implicit-int functions are a legacy C style in PHP extension macros (PHP_METHOD, zval-returning helpers under TSRMLS_DC); this is a gRPC PHP extension with ordinary wrapper code and no obfuscation.

  354. info warn → info by review implicit-int-function src/php/ext/grpc/channel.c:326:1

    6 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, GRPC_STARTUP_FUNCTION) (ast pass, confidence 0.85)

     */
    PHP_METHOD(Channel, __construct) {
      wrapped_grpc_channel *channel =
        PHP_GRPC_GET_WRAPPED_OBJECT(wrapped_grpc_channel, getThis());
    likely benign LLM, confidence 0.93 PHP extension Channel constructor and related methods in legacy C style.
    Reasoning

    Implicit-int flags are artifacts of PHP_METHOD macro usage in an old PHP extension; the snippet shows normal channel constructor logic.

  355. info warn → info by review implicit-int-function src/php/ext/grpc/channel_credentials.c:93:1

    8 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD) (ast pass, confidence 0.85)

     */
    PHP_METHOD(ChannelCredentials, setDefaultRootsPem) {
      char *pem_roots;
      php_grpc_int pem_roots_length;
    likely benign LLM, confidence 0.93 PHP ChannelCredentials methods handling PEM root certificates.
    Reasoning

    Legacy PHP_METHOD macro-based functions handling PEM roots, consistent with the grpc PHP extension; no malicious behavior shown.

  356. info warn → info by review implicit-int-function src/php/ext/grpc/server.c:68:1

    5 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD) (ast pass, confidence 0.85)

     */
    PHP_METHOD(Server, __construct) {
      wrapped_grpc_server *server =
        PHP_GRPC_GET_WRAPPED_OBJECT(wrapped_grpc_server, getThis());
    likely benign LLM, confidence 0.93 PHP extension Server constructor code.
    Reasoning

    Standard PHP extension server constructor using wrapped object macros; the implicit-int flag is a stylistic artifact of the PHP macros.

  357. info warn → info by review implicit-int-function src/php/ext/grpc/timeval.c:60:1

    10 functions in this file lack an explicit return type (pre-ANSI K&R style; e.g. PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD, PHP_METHOD) (ast pass, confidence 0.85)

     */
    PHP_METHOD(Timeval, __construct) {
      wrapped_grpc_timeval *timeval =
        PHP_GRPC_GET_WRAPPED_OBJECT(wrapped_grpc_timeval, getThis());
    likely benign LLM, confidence 0.93 PHP extension Timeval class constructor and methods.
    Reasoning

    Standard PHP extension Timeval class methods using PHP_METHOD macros; legacy style with no concealment.

  358. info warn → info by review frame-introspection src/python/grpcio_tests/tests_py3_only/unit/_simple_stubs_test.py:216:25

    `inspect.stack` — call-stack frame introspection (ast pass, confidence 0.70)

                target = f"localhost:{port}"
                test_name = inspect.stack()[0][3]
                args = (_REQUEST, target, _UNARY_UNARY)
                kwargs = {
    likely benign LLM, confidence 0.90 Test code retrieves its own function name via inspect.stack.
    Reasoning

    inspect.stack()[0][3] in a test file is used to get the current test function's name for use in a test; a benign introspection pattern.

  359. info warn → info by review dynamic-execution src/ruby/README.md:40:3

    [embedded bash] pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)

    $ command curl -sSL https://rvm.io/mpapis.asc | gpg --import -
    $ \curl -sSL https://get.rvm.io | bash -s stable --ruby=ruby-3
    $
    $ # follow the instructions to ensure that your're using the latest stable version of Ruby
    likely benign LLM, confidence 0.85 README instructions to install RVM via curl piped to bash.
    Reasoning

    This is the standard RVM installation instruction piping a well-known remote script to bash; it is a documented install pattern, though curl-to-bash is a supply-chain risk worth noting, and the snippet is documentation rather than hidden code.

  360. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $PROTOC -I src/proto src/proto/grpc/health/v1/health.proto \
        --grpc_out=src/ruby/pb \
        --ruby_out=src/ruby/pb \
  361. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $PROTOC -I . \
        src/proto/grpc/testing/{messages,test,empty}.proto \
        --grpc_out=src/ruby/pb \
  362. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $PROTOC -I . \
        -I third_party/protobuf/src \
        src/proto/grpc/testing/{messages,payloads,stats,benchmark_service,report_qps_scenario_service,worker_service,control}.proto \
  363. command name is a variable (`$PROTOC`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    $PROTOC -I src/proto/math src/proto/math/math.proto \
        --grpc_out=src/ruby/bin \
        --ruby_out=src/ruby/bin \
  364. info warn → info by review embedded-nul-in-string test/core/address_utils/sockaddr_utils_test.cc:293:37

    string literal contains an embedded NUL followed by 9 more bytes of source (token pass, confidence 0.85)

                  grpc_core::UnixAbstractSockaddrPopulate(
                      std::string("path_\0with_null", 15), &addr));
      EXPECT_EQ(grpc_sockaddr_to_uri(&addr).value(),
                "unix-abstract:path_%00with_null");
    likely benign LLM, confidence 0.92 Unit test string with an embedded NUL for abstract socket path handling.
    Reasoning

    The embedded NUL is deliberate, testing abstract Unix socket paths with null bytes; the expected URI encodes it as %00. Legitimate test data.

  365. info warn → info by review encoding-base64 test/core/credentials/call/call_credentials_test.cc:108:8

    base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "{ \"private_key\": \"-----BEGIN PRIVATE KEY-----"
        "\\nMIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAOEvJsnoHnyHkXcp\\n7mJE"
        "qg"
        "WGjiw71NfXByguekSKho65FxaGbsnSM9SMQAqVk7Q2rG+I0OpsT0LrWQtZ\\nyjSeg/"
    likely benign LLM, confidence 0.90 Fake PEM private key embedded in a test fixture.
    Reasoning

    This is a fake test private key in a JSON credentials fixture for a unit test of gRPC call credentials; base64-like content is expected for keys and no real secret or execution is involved.

  366. info warn → info by review encoding-base64 test/core/credentials/call/call_credentials_test.cc:183:6

    base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)

    const char test_signed_jwt[] =
        "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImY0OTRkN2M1YWU2MGRmOTcyNmM4YW"
        "U0MDcyZTViYTdmZDkwODg2YzcifQ";
    const char test_signed_jwt_token_type[] =
    likely benign LLM, confidence 0.94 Test signed JWT fixture string.
    Reasoning

    This is a base64url-encoded JWT header and payload used as test data for signed JWT credential tests; standard test fixture content.

  367. info warn → info by review encoding-base64 test/core/credentials/call/call_credentials_test.cc:188:6

    base64-like blob (74 bytes, compression ratio 1.15) (raw pass, confidence 0.60)

    const char test_signed_jwt2[] =
        "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6ImY0OTRkN2M1YWU2MGRmOTcyNmM5YW"
        "U2MDcyZTViYTdnZDkwODg5YzcifQ";
    const char test_signed_jwt_token_type2[] =
    likely benign LLM, confidence 0.94 Second test signed JWT fixture string.
    Reasoning

    Second test signed JWT fixture with the same structure as the previous one; ordinary test data.

  368. base64-like blob (74 bytes, compression ratio 1.07) (outside string/comment) (raw pass, confidence 0.30)

        ExternalAccountCredentialsTest,
        AwsImdsv2ExternalAccountCredShouldNotUseMetadataServerOptionalTokenMissing) {
      ExecCtx exec_ctx;
      SetEnv("AWS_REGION", "test_regionz");
  369. info warn → info by review encoding-base64 test/core/credentials/call/external/aws_request_signer_test.cc:40:6

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "glv3KwuTfQsavRNs3v5pcSEm4SPO3l7mCs7KrQUHwGP0neZhIKxEXy+Ls//1C/"
        "Bqt53NL+LSbaGv6RPHaX82laz2qElphg95aVLdYgIFY6JWV5fzyjgnhz0DQmy62/"
        "Vi8pNcM2/"
        "VnxeCQ8CC8dRDSt52ry2v+nc77vstuI9xV5k8mPtnaPoJDRANh0bjwY5Sdwkbp+"
    likely benign LLM, confidence 0.93 Fake AWS secret-style base64 string in a signer unit test.
    Reasoning

    The string is a base64-like secret-key fixture for AWS request signing in a test file, split across concatenated literals. Test fixtures of this kind are normal, and the raw pass is prone to flagging long base64-looking text.

  370. info warn → info by review encoding-base64 test/core/credentials/call/external/aws_request_signer_test.cc:45:6

    5 rows of base64-like lines, lines 45-54 (first: base64-like blob (72 bytes, compression ratio 1.15)) (raw pass, confidence 0.60)

        "Azuy1jQqfFZWgP68LSz5bURyIjlWDQunO82stZ0BgplKKAa/"
        "KJHBPCp8Qi6i99uy7qh76FQAqgVTsnDuU6fGpHDcsDSGoCls2HgZjZFPeOj8mmRhFk1Xqvkb"
        "juz8V1cJk54d3gIJvQt8gD2D6yJQZecnuGWd5K2e2HohvCc8Fc9kBl1300nUJPV+k4tr/"
        "A5R/0QfEKOZL1/"
    likely benign LLM, confidence 0.93 Block of base64-like test fixture lines in an AWS signer test.
    Reasoning

    Multiple adjacent base64-like string lines in a signer test, consistent with fixture or sample key material. No decoding, execution, or dropper behavior is visible.

  371. info warn → info by review encoding-base64 test/core/credentials/call/jwt/json_token_test.cc:45:8

    base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "{ \"private_key\": \"-----BEGIN PRIVATE KEY-----"
        "\\nMIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAOEvJsnoHnyHkXcp\\n7mJE"
        "qg"
        "WGjiw71NfXByguekSKho65FxaGbsnSM9SMQAqVk7Q2rG+I0OpsT0LrWQtZ\\nyjSeg/"
    likely benign LLM, confidence 0.94 Inline JSON with a test RSA private key for JWT token parsing.
    Reasoning

    An inline JSON service-account string with an RSA private key in a JWT token unit test. Test JSON fixtures with throwaway keys are standard, and the base64 flagged is the key material.

  372. info warn → info by review encoding-base64 test/core/credentials/call/jwt/jwt_verifier_test.cc:42:8

    base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "{ \"private_key\": \"-----BEGIN PRIVATE KEY-----"
        "\\nMIICeAIBADANBgkqhkiG9w0BAQEFAASCAmIwggJeAgEAAoGBAOEvJsnoHnyHkXcp\\n7mJE"
        "qg"
        "WGjiw71NfXByguekSKho65FxaGbsnSM9SMQAqVk7Q2rG+I0OpsT0LrWQtZ\\nyjSeg/"
    likely benign LLM, confidence 0.94 Inline JSON test RSA private key in a JWT verifier test.
    Reasoning

    Same inline JSON RSA test key fixture in the JWT verifier test. Expected test data with no malicious behavior.

  373. info warn → info by review encoding-base64 test/core/credentials/call/jwt/jwt_verifier_test.cc:98:8

    base64-like blob (72 bytes, compression ratio 1.15) (raw pass, confidence 0.60)

        "   \"n\": "
        "\"4S8myegefIeRdynuYkSqBYaOLDvU19cHKC56RIqGjrkXFoZuydIz1IxACpWTtDasb4jQ6mxP"
        "QutZC1nKNJ6D-tYFC9LiGV7gt-KOQ_cnkEb4hcMw_xF_OI1FCx6cBcM0-"
        "RjiQkK8q7HbF0M6dUXo3t0vedNhmD65Cs2wxPP1TFU=\","
    likely benign LLM, confidence 0.93 RSA modulus field of a test JWK in a verifier test.
    Reasoning

    The base64url modulus field of a test JWK in a JWT verifier test. Public RSA modulus values in fixtures are ordinary and carry no execution risk.

  374. info warn → info by review encoding-base64 test/core/credentials/call/jwt/jwt_verifier_test.cc:100:6

    base64-like blob (43 bytes, compression ratio 1.26) (raw pass, confidence 0.60)

        "QutZC1nKNJ6D-tYFC9LiGV7gt-KOQ_cnkEb4hcMw_xF_OI1FCx6cBcM0-"
        "RjiQkK8q7HbF0M6dUXo3t0vedNhmD65Cs2wxPP1TFU=\","
        "   \"e\": \"AQAB\""
        "  }"
    likely benign LLM, confidence 0.93 Tail of a test JWK modulus and exponent in a verifier test.
    Reasoning

    Continuation of the same test JWK, containing the modulus tail and exponent. Ordinary test fixture data.

  375. info warn → info by review encoding-base64 test/core/credentials/call/jwt/jwt_verifier_test.cc:111:8

    base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "CERTIFICATE-----"
        "\\nMIICATCCAWoCCQDEywLhxvHjnDANBgkqhkiG9w0BAQsFADBFMQswCQYDVQQGEwJB\\nVTET"
        "MBEGA1UECAwKU29tZS1TdGF0ZTEhMB8GA1UECgwYSW50ZXJuZXQgV2lkZ2l0\\ncyBQdHkgTHR"
        "kMB4XDTE1MDYyOTA4Mzk1MFoXDTI1MDYyNjA4Mzk1MFowRTELMAkG\\nA1UEBhMCQVUxEzARBg"
    likely benign LLM, confidence 0.93 Base64 body of a test X.509 certificate in a JWT verifier test.
    Reasoning

    Base64 body of a self-signed test X.509 certificate used in JWT verifier tests. Certificate fixtures are normal, and the flag is only a long base64 run.

  376. info warn → info by review encoding-base64 test/core/credentials/call/jwt/jwt_verifier_test.cc:120:11

    base64-like blob (65 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "cnkEb4hcMw/xF/OI1FCx6cBcM0+"
        "Rji\\nQkK8q7HbF0M6dUXo3t0vedNhmD65Cs2wxPP1TFUCAwEAATANBgkqhkiG9w0BAQsF\\nA"
        "AOBgQBfu69FkPmBknbKNFgurPz78kbs3VNN+k/"
        "PUgO5DHKskJmgK2TbtvX2VMpx\\nkftmHGzgzMzUlOtigCaGMgHWjfqjpP9uuDbahXrZBJzB8c"
    likely benign LLM, confidence 0.93 Continued base64 certificate and key fixture in a JWT verifier test.
    Reasoning

    Continuation of the embedded test certificate and an RSA key structure in the JWT verifier test. Consistent with fixture data, with no decoding or execution.

  377. info warn → info by review embedded-nul-in-string test/core/end2end/fuzzers/client_fuzzer.cc:136:61

    string literal contains an embedded NUL followed by 658 more bytes of source (token pass, confidence 0.85)

    TEST(ClientFuzzerTest, RunChannelzCallTracerRegression2) {
      Fuzz(ParseTestProto(R"pb(network_input {
                                 single_read_bytes: "K"
                                 connect_timeout_ms: -1
    likely benign LLM, confidence 0.70 Fuzzer regression test with a protobuf-text literal containing an embedded NUL.
    Reasoning

    An embedded NUL in a raw protobuf-text string inside a fuzzer regression test. Fuzzer regressions often hold binary bytes that must be embedded literally, so this is probably a test input. The 658 trailing bytes are not visible, which leaves some doubt.

  378. info warn → info by review embedded-nul-in-string test/core/end2end/fuzzers/server_fuzzer.cc:202:39

    string literal contains an embedded NUL followed by 983 more bytes of source (token pass, confidence 0.85)

      ChaoticGood(
          ParseTestProto(R"pb(network_input {
                                input_segments {
                                  segments {
    likely benign LLM, confidence 0.80 Raw-string test protobuf literal in a gRPC end-to-end fuzzer containing a NUL byte.
    Reasoning

    The embedded NUL sits inside a raw-string protobuf text literal used as fuzzer/test input. Scanner noise from test data, not a payload.

  379. info warn → info by review embedded-nul-in-string test/core/end2end/tests/no_logging.cc:211:53

    string literal contains an embedded NUL followed by 13 more bytes of source (token pass, confidence 0.85)

          CoreTestConfigurationNamed("Chttp2FullstackCompression"),
          ParseTestProto(R"pb(config_vars { verbosity: "\000" trace: "" })pb"));
    }
    likely benign LLM, confidence 0.85 Test configuration proto text containing an escaped NUL for logging verbosity.
    Reasoning

    The \000 is an escaped NUL in a test config proto string setting verbosity, consistent with a logging test. No execution or obfuscation involved.

  380. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        "${XCODEBUILD_FLAGS}" \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
    
    time xcodebuild \
  381. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        "${XCODEBUILD_FLAGS}" \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
    
    time xcodebuild \
  382. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        "${XCODEBUILD_FLAGS}" \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
    
    time xcodebuild \
  383. command name is a variable (`$XCODEBUILD_FILTER_OUTPUT_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

        "${XCODEBUILD_FLAGS}" \
        | "${XCODEBUILD_FILTER_OUTPUT_SCRIPT}"
  384. info warn → info by review encoding-hex test/core/transport/chttp2/bin_encoder_test.cc:131:8

    18 consecutive `\xNN` escapes (entropy 4.2 bits/byte) (raw pass, confidence 0.65)

      EXPECT_SLICE_EQ(
          "\xd0\x7a\xbe\x94\x10\x54\xd4\x44\xa8\x20\x05\x95\x04\x0b\x81\x66\xe0\x82"
          "\xa6\x2d\x1b\xff",
          HUFF("Mon, 21 Oct 2013 20:13:21 GMT"));
    dismissed LLM, confidence 0.90 Expected Huffman-encoded byte sequence in an HPACK encoder unit test.
    Reasoning

    These hex escapes are Huffman-encoded byte vectors from HPACK/HTTP2 test expectations. Expected test data, not obfuscation.

  385. info warn → info by review encoding-hex test/core/transport/chttp2/bin_encoder_test.cc:135:8

    17 consecutive `\xNN` escapes (entropy 4.0 bits/byte) (raw pass, confidence 0.65)

      EXPECT_SLICE_EQ(
          "\x9d\x29\xad\x17\x18\x63\xc7\x8f\x0b\x97\xc8\xe9\xae\x82\xae\x43\xd3",
          HUFF("https://www.example.com"));
    dismissed LLM, confidence 0.90 Expected Huffman-encoded bytes for a URL in an HPACK encoder test.
    Reasoning

    Same HPACK Huffman test vector pattern as neighboring expectations; expected output data in a unit test.

  386. info warn → info by review encoding-hex test/core/transport/chttp2/bin_encoder_test.cc:154:8

    16 rows of escape runs, lines 154-169 (first: 16 consecutive `\xNN` escapes (entropy 4.0 bits/byte)) (raw pass, confidence 0.65)

      EXPECT_COMBINED_EQUIV(
          "\x00\x01\x02\x03\x04\x05\x06\x07\x08\x09\x0a\x0b\x0c\x0d\x0e\x0f"
          "\x10\x11\x12\x13\x14\x15\x16\x17\x18\x19\x1a\x1b\x1c\x1d\x1e\x1f"
          "\x20\x21\x22\x23\x24\x25\x26\x27\x28\x29\x2a\x2b\x2c\x2d\x2e\x2f"
    dismissed LLM, confidence 0.90 Byte-value table used as input in a binary encoder equivalence test.
    Reasoning

    Sequential byte values 0x00 through 0x2f form a counting table for an equivalence test. Ordinary test data.

  387. info warn → info by review encoding-base64 test/core/transport/chttp2/hpack_parser_test.cc:658:15

    base64-like blob (64 bytes, compression ratio 1.06) (raw pass, confidence 0.60)

                   ":status: 200\naccept-ranges: grpc\n", 0}}},
            Test{"FuzzerCoveragea4a41007f0a40f2d62696e8beda42d5b63272129a410626907",
                 {},
                 {},
    dismissed LLM, confidence 0.85 Long alphanumeric test identifier string in an HPACK parser test table.
    Reasoning

    The blob is a descriptive test case name string ('FuzzerCoverage...') in an HPACK parser test, not an encoded payload being decoded and run.

  388. info warn → info by review encoding-base64 test/core/tsi/ssl_transport_security_test.cc:1427:8

    15 rows of base64-like lines, lines 1427-1441 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

          "-----BEGIN CERTIFICATE-----\n"
          "MIIC3zCCAcegAwIBAgIUKMYmbfEcNkln+NB2bntR6854MpswDQYJKoZIhvcNAQEL\n"
          "BQAwDzENMAsGA1UEAwwEZXZpbDAeFw0yNjA1MTAyMjIzMThaFw0yNjA1MTEyMjIz\n"
          "MThaMA8xDTALBgNVBAMMBGV2aWwwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEK\n"
    likely benign LLM, confidence 0.85 PEM-encoded test certificate embedded in a TSI SSL unit test.
    Reasoning

    PEM certificate lines for a test CA/leaf (CN 'evil' is a conventional test name) in a TLS transport security test. Test fixtures, not a dropper.

  389. info warn → info by review encoding-base64 test/core/tsi/ssl_transport_security_utils_test.cc:82:6

    13 rows of base64-like lines, lines 82-94 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

        "-----BEGIN CERTIFICATE-----\n"
        "MIICZzCCAdCgAwIBAgIIN18/ctj3wpAwDQYJKoZIhvcNAQELBQAwKjEXMBUGA1UE\n"
        "ChMOR29vZ2xlIFRFU1RJTkcxDzANBgNVBAMTBnRlc3RDQTAeFw0xNTAxMDEwMDAw\n"
        "MDBaFw0yNTAxMDEwMDAwMDBaMC8xFzAVBgNVBAoTDkdvb2dsZSBURVNUSU5HMRQw\n"
    likely benign LLM, confidence 0.85 PEM-encoded test certificate in a TSI SSL utilities test.
    Reasoning

    PEM certificate fixture lines in an SSL utils unit test; standard test data with no execution path.

  390. info warn → info by review encoding-base64 test/core/tsi/ssl_transport_security_utils_test.cc:98:6

    12 rows of base64-like lines, lines 98-109 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

        "-----BEGIN RSA PRIVATE KEY-----\n"
        "MIICXQIBAAKBgQDbSg7Ij580IJ4cncM2Maig88/jdDp6aFW+5YPymm1rnzZGDGr/\n"
        "iPVuX1w8d2gJ3LIexYVVRnOxyPaqEKWaUEAwQDn3k5TY1fZ3zWdKKHl3BlYsxFCQ\n"
        "QjPLFRHtV57d7KidAPgdJqZp68xK/v1ZNQEKjMQYhOpaeNgDXnYpRsD8iwIDAQAB\n"
    likely benign LLM, confidence 0.85 PEM-encoded RSA private key test fixture.
    Reasoning

    PEM RSA private key fixture in a test file; test key material is expected in TLS unit tests and is not used for malicious purposes here.

  391. info warn → info by review encoding-base64 test/core/tsi/ssl_transport_security_utils_test.cc:114:6

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "-----BEGIN PRIVATE KEY-----\n"
        "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgOM7iHjJw/N6n8HtM\n"
        "bVVVRhEYXoHFF+MSaTYQxOWM1p+hRANCAASMeWC+pIJAm/1fn0Wz3yyWGQzVPm9v\n"
        "LCQo5JvK0a2t+Aa6d3AtLRwo6vh1VbJ8zFZxxIwyJNis3n1jRMWal7Vo\n"
    likely benign LLM, confidence 0.85 PEM-encoded private key test fixture.
    Reasoning

    PEM private key fixture in a TLS utils test, consistent with test data used to exercise key parsing.

  392. info warn → info by review encoding-base64 test/core/tsi/ssl_transport_security_utils_test.cc:115:6

    base64-like blob (64 bytes, compression ratio 1.17) (raw pass, confidence 0.60)

        "MIGHAgEAMBMGByqGSM49AgEGCCqGSM49AwEHBG0wawIBAQQgOM7iHjJw/N6n8HtM\n"
        "bVVVRhEYXoHFF+MSaTYQxOWM1p+hRANCAASMeWC+pIJAm/1fn0Wz3yyWGQzVPm9v\n"
        "LCQo5JvK0a2t+Aa6d3AtLRwo6vh1VbJ8zFZxxIwyJNis3n1jRMWal7Vo\n"
        "-----END PRIVATE KEY-----";
    likely benign LLM, confidence 0.85 Continuation of a PEM private key test fixture.
    Reasoning

    Continuation lines of the same PEM private key test fixture; no decoding or execution beyond test parsing.

  393. info warn → info by review encoding-base64 test/core/tsi/ssl_transport_security_utils_test.cc:121:6

    24 rows of base64-like lines, lines 121-144 (first: base64-like blob (64 bytes, compression ratio 1.17)) (raw pass, confidence 0.60)

        "MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQCqyrzsrS8mWQwz\n"
        "VFudLgte2kJX/pZ3KqJQBtMrkLxpgyJJU8mVBB+quDwnfH6PnQk+sF9omTlGAAxR\n"
        "JzSEe8BS1Wnxld6rr6o/381VVW/2b+2kSifCtx/gVwCQQLnf4dbjfGW7ZClu1URG\n"
        "ks2lK9T9BIh9SMSnYLEKEC8sWW1LibzJxHapFjIP88GrqgpPNGdEK7ABMsqHASuU\n"
    likely benign LLM, confidence 0.85 PEM-encoded RSA private key fixture in a TLS utils test.
    Reasoning

    Multi-line PEM RSA private key test fixture in an SSL utils test. Standard test key data.

  394. info warn → info by review embedded-nul-in-string test/core/util/json/json_test.cc:218:43

    string literal contains an embedded NUL followed by 9 more bytes of source (token pass, confidence 0.85)

      RunParseFailureTest("[[],]");
      const char kInputWithNull[] = "{\"a\":1}\0{\"b\":2}";
      RunParseFailureTest(
          absl::string_view(kInputWithNull, sizeof(kInputWithNull)));
    likely benign LLM, confidence 0.93 Test input string containing an embedded NUL byte for a JSON parse-failure test.
    Reasoning

    Embedded NUL in a C++ string literal used deliberately to test JSON parser handling of null bytes in input. Standard test-data construction in gRPC's test suite.

  395. info warn → info by review embedded-nul-in-string test/core/util/uri_test.cc:215:43

    string literal contains an embedded NUL followed by 12 more bytes of source (token pass, confidence 0.85)

      // Artificial examples to show that embedded nulls are supported.
      TestSucceeds(std::string("unix-abstract:\0should-be-ok", 27), "unix-abstract",
                   "", "", "", std::string("\0should-be-ok", 13), {}, {}, "");
    }
    likely benign LLM, confidence 0.93 URI test fixture with an embedded NUL to verify null-byte handling in unix-abstract URIs.
    Reasoning

    Explicit artificial example commented as showing embedded nulls are supported in URI parsing; a legitimate unit test fixture.

  396. info warn → info by review embedded-nul-in-string test/core/util/uri_test.cc:216:41

    string literal contains an embedded NUL followed by 12 more bytes of source (token pass, confidence 0.85)

      TestSucceeds(std::string("unix-abstract:\0should-be-ok", 27), "unix-abstract",
                   "", "", "", std::string("\0should-be-ok", 13), {}, {}, "");
    }
    likely benign LLM, confidence 0.93 Second use of the embedded-NUL URI test fixture.
    Reasoning

    Same deliberate embedded-NUL test fixture in the URI test, explicitly commented as an artificial example.

  397. info warn → info by review embedded-nul-in-string test/core/util/uri_test.cc:221:29

    string literal contains an embedded NUL followed by 1 more bytes of source (token pass, confidence 0.85)

      TestSucceeds("unix-abstract:%00x", "unix-abstract", "", "", "",
                   std::string("\0x", 2), {}, {}, "");
    }
    likely benign LLM, confidence 0.92 URI test string with an embedded NUL before a single character.
    Reasoning

    Test literal with a NUL followed by 'x' to check handling of percent-encoded and raw null bytes in URIs; benign test data.

  398. info warn → info by review embedded-nul-in-string test/core/xds/xds_client_fuzzer.cc:805:30

    string literal contains an embedded NUL followed by 180 more bytes of source (token pass, confidence 0.85)

    TEST(XdsClientFuzzer, RlsMissingTypedExtensionConfig) {
      Fuzz(ParseTestProto(R"pb(
        bootstrap: "{\"xds_servers\": [{\"server_uri\":\"xds.example.com:-257\", \"channel_creds\":[{\"type\": \"fake\"}]}]}"
        actions { start_watch { resource_type { route_config {} } } }
    likely benign LLM, confidence 0.90 Fuzzer regression test case embedding a JSON bootstrap config in a proto text literal.
    Reasoning

    Fuzzer test proto text with escaped JSON bootstrap config; the NUL-flagged literal is part of a protobuf text format string in a regression test. Benign.

  399. info critical → info by review dynamic-execution test/cpp/common/time_jump_test.cc:44:33

    `system` called with a non-literal argument (ast pass, confidence 0.90)

    // Android doesn't have posix_spawn. Use std::system instead
    void run_cmd(const char* cmd) { std::system(cmd); }
    #else
    void run_cmd(const char* cmd) {
    likely benign LLM, confidence 0.85 Test helper that runs a shell command via std::system to manipulate time in tests.
    Reasoning

    std::system with a cmd parameter is a helper used in a test that simulates clock jumps by running shell commands; the argument is supplied by test code, not external input. Expected in integration test infrastructure, though it is a shell call.

  400. info critical → info by review dynamic-execution test/cpp/end2end/cfstream_test.cc:80:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

            << "  ' | sudo tee -a /etc/hosts";
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.88 Test helper that edits /etc/hosts via sudo shell commands to simulate network conditions.
    Reasoning

    Test helper building sudo commands to edit /etc/hosts for simulating network failures in CFStream tests. Requires root and is intrusive, but is a legitimate, documented test pattern with hardcoded test hostnames/addresses.

  401. info critical → info by review dynamic-execution test/cpp/end2end/cfstream_test.cc:87:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "sudo sed -i '.bak' '/" << server_host_ << "/d' /etc/hosts";
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.88 Test helper running sudo sed to remove hosts entries during network simulation.
    Reasoning

    Same test helper pattern modifying /etc/hosts and network interfaces via sudo for network-failure simulation in tests.

  402. info critical → info by review dynamic-execution test/cpp/end2end/cfstream_test.cc:93:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "sudo /sbin/ifconfig " << interface_ << " alias " << ipv4_address_;
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.88 Test helper adding a network interface alias via sudo ifconfig.
    Reasoning

    Test helper adding an interface alias via sudo ifconfig for network-failure simulation; consistent with legitimate integration test setup.

  403. info critical → info by review dynamic-execution test/cpp/end2end/cfstream_test.cc:99:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "sudo /sbin/ifconfig " << interface_ << " -alias " << ipv4_address_;
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.88 Test helper removing a network interface alias via sudo ifconfig.
    Reasoning

    Test teardown removing the interface alias via sudo ifconfig; consistent with test cleanup.

  404. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:76:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "ip addr add " << ipv4_address_ << netmask_ << " dev " << interface_;
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.88 Test helper adding an IP address to a network interface via the ip command.
    Reasoning

    Test helper adding IP address to an interface with ip addr for flaky-network simulation; standard test scaffolding, inputs are test constants.

  405. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:83:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "ip addr del " << ipv4_address_ << netmask_ << " dev " << interface_;
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.88 Test helper removing an IP address from a network interface.
    Reasoning

    Test teardown deleting the test IP address via ip addr del; consistent with the setup helper.

  406. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:91:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

            << "' >> /etc/hosts";
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.88 Test helper appending an entry to /etc/hosts for network simulation.
    Reasoning

    Test helper appending hosts entries for flaky-network simulation; legitimate integration test behavior.

  407. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:102:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "sed  '/" << server_host_ << "/d' /etc/hosts > /etc/hosts.orig";
        std::system(cmd.str().c_str());
    
        // clear the stream
    likely benign LLM, confidence 0.88 Test helper modifying and backing up /etc/hosts during network simulation.
    Reasoning

    Test helper filtering /etc/hosts with sed and backing it up for later restore; standard test scaffolding.

  408. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:108:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "cat /etc/hosts.orig > /etc/hosts";
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.88 Test helper restoring the original /etc/hosts file after a network test.
    Reasoning

    Test helper restoring /etc/hosts from backup after a flaky-network test; consistent with cleanup of the earlier modification.

  409. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:116:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

    
        std::system(cmd.str().c_str());
        // clear the stream
        cmd.str("");
    likely benign LLM, confidence 0.87 Test helper executing a previously built shell command for network simulation.
    Reasoning

    Generic std::system call on a command built in the test file to apply network changes; part of the same legitimate test harness, though it runs shell commands with root privileges.

  410. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:128:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "iptables -D INPUT -s " << ipv4_address_ << " -j DROP";
        std::system(cmd.str().c_str());
        // clear the stream
        cmd.str("");
    likely benign LLM, confidence 0.90 Test helper that runs iptables via std::system to drop packets to a test address.
    Reasoning

    Builds an iptables command from a test-controlled IP address and runs it via std::system in a network-failure injection test. This is normal test scaffolding for gRPC flaky-network testing, not malicious.

  411. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:143:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

               "0.1% corrupt 0.01% ";
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.90 Test helper invoking tc netem via std::system to degrade the network for testing.
    Reasoning

    Runs a tc netem command assembled from test parameters to inject packet loss and corruption. Legitimate network fault injection in a test file.

  412. info critical → info by review dynamic-execution test/cpp/end2end/flaky_network_test.cc:150:5

    `system` called with a non-literal argument (ast pass, confidence 0.90)

        cmd << "tc qdisc del dev " << interface_ << " root netem";
        std::system(cmd.str().c_str());
      }
    likely benign LLM, confidence 0.90 Test cleanup that deletes a tc netem qdisc via std::system.
    Reasoning

    Removes a tc netem qdisc using a configured interface name. Cleanup code in a network test, consistent with the surrounding test.

  413. info critical → info by review dynamic-execution test/cpp/interop/grpclb_fallback_test.cc:163:13

    `system` called with a non-literal argument (ast pass, confidence 0.90)

      LOG(INFO) << "RunCommand: |" << command << "|";
      int out = std::system(command.c_str());
      if (WIFEXITED(out)) {
        int code = WEXITSTATUS(out);
    likely benign LLM, confidence 0.90 Interop test helper that logs and runs a shell command via std::system.
    Reasoning

    A RunCommand helper executes a shell command for interop test orchestration and logs it. Test-harness behavior with no sign of hidden intent.

  414. info critical → info by review dynamic-execution test/cpp/interop/interop_test.cc:62:5

    `execv` called with a non-literal path (ast pass, confidence 0.90)

        args.push_back(nullptr);
        execv(args[0], args.data());
        return 1;
      }
    likely benign LLM, confidence 0.92 Forked child execs a test server or client binary with args.
    Reasoning

    execv in a forked child launches a test binary path supplied by the test harness. Standard process spawning for interop tests.

  415. info critical → info by review dynamic-execution test/cpp/interop/interop_test.cc:110:5

    `execv` called with a non-literal path (ast pass, confidence 0.90)

        args.push_back(nullptr);
        execv(args[0], args.data());
        return 1;
      }
    likely benign LLM, confidence 0.92 Forked child execs a test binary with an argument vector.
    Reasoning

    Same pattern as the other execv call: a child process exec of a harness-supplied binary in interop testing.

  416. command name is a variable (`$INTEROP_TEST_BINARY`) that this file sets only to plain text (ast pass, confidence 0.40)

    # by running the "custom_metadata" interop test case and inspect the logs afterwards.
    "${INTEROP_TEST_BINARY}" --extra_client_flags="--test_case=custom_metadata,--log_metadata_and_status" 2>&1 | tee "${LOGFILE}"
    
    # grep will return an error if any of the patterns below are not found in the log
  417. base64-like blob (70 bytes, compression ratio 1.07) (outside string/comment) (raw pass, confidence 0.30)

    TEST_F(AddressSortingTest,
           TestUsesDestinationWithHigherPrecedenceWithV4CompatAndLocalhostAddress) {
      bool ipv4_supported = true;
      bool ipv6_supported = true;
  418. base64-like blob (90 bytes, compression ratio 0.94) (outside string/comment) (raw pass, confidence 0.30)

        AddressSortingTest,
        TestUsesDestinationWithHigherPrecedenceWith2000PrefixedAddressEnsurePrefixMatchHasNoEffect) {
      bool ipv4_supported = true;
      bool ipv6_supported = true;
  419. base64-like blob (74 bytes, compression ratio 1.04) (outside string/comment) (raw pass, confidence 0.30)

        AddressSortingTest,
        TestUsesDestinationWithHigherPrecedenceWithCatchAllAndAndV4MappedAddresses) {
      bool ipv4_supported = true;
      bool ipv6_supported = true;
  420. file mixes tab and space indentation (1 tab-indented and 456 space-indented lines) (raw pass, confidence 0.40)

    argp.add_argument('--test_bin_path', default=None, type=str,
                      help='Path to gtest test binary to invoke.')
    argp.add_argument('--dns_server_bin_path', default=None, type=str,
                      help='Path to local DNS server python script.')
  421. line length 1271 characters (raw pass, confidence 0.50)

      expected_chosen_service_config: '{"loadBalancingPolicy":"round_robin","methodConfig":[{"name":[{"method":"Foo","service":"SimpleService"}],"waitForReady":true},{"name":[{"method":"FooTwo","service":"SimpleService"}],"waitForReady":true},{"name":[{"method":"FooThree","service":"SimpleService"}],"waitForReady":true},{"
  422. line length 1296 characters (raw pass, confidence 0.50)

        - {TTL: '2100', data: 'grpc_config=[{"serviceConfig":{"loadBalancingPolicy":"round_robin","methodConfig":[{"name":[{"method":"Foo","service":"SimpleService"}],"waitForReady":true},{"name":[{"method":"FooTwo","service":"SimpleService"}],"waitForReady":true},{"name":[{"method":"FooThree","service":"SimpleService"}],"
  423. info warn → info by review embedded-nul-in-string test/cpp/util/string_ref_test.cc:29:49

    string literal contains an embedded NUL followed by 3 more bytes of source (token pass, confidence 0.85)

    const char kTestString[] = "blah";
    const char kTestStringWithEmbeddedNull[] = "blah\0foo";
    const size_t kTestStringWithEmbeddedNullLength = 8;
    const char kTestUnrelatedString[] = "foo";
    likely benign LLM, confidence 0.85 Test string literal deliberately containing an embedded NUL byte.
    Reasoning

    An intentional embedded NUL in a string literal, used to test string_ref handling of embedded nulls. Deliberate test data, not obfuscation.

  424. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_async_suffix_test.sh:30:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    set -uo pipefail; set +e; f=bazel_tools/tools/bash/runfiles/runfiles.bash
    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
    likely benign LLM, confidence 0.88 Bazel runfiles initialization that sources runfiles.bash from a dynamic location.
    Reasoning

    This is the standard Bazel runfiles.bash bootstrap block, which sources the runfiles library from a path resolved through env vars and manifests. Common and benign in Bazel test scripts.

  425. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_async_suffix_test.sh:31:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.88 Fallback source of runfiles.bash from manifest lookup in the Bazel bootstrap.
    Reasoning

    Part of the standard Bazel runfiles bootstrap fallback chain; the sourced path is a fixed runfiles-relative file name.

  426. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_async_suffix_test.sh:32:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.88 Bazel runfiles bootstrap fallback sourcing a manifest-resolved script.
    Reasoning

    Standard Bazel runfiles bootstrap fallback, sourcing a manifest-resolved path. Benign boilerplate.

  427. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_async_suffix_test.sh:33:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    likely benign LLM, confidence 0.88 Bazel runfiles bootstrap sourcing via exe.runfiles manifest lookup.
    Reasoning

    Standard Bazel runfiles bootstrap fallback chain with manifest lookups. Benign.

  428. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_async_suffix_test.sh:34:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    # --- end runfiles.bash initialization v3 ---
    likely benign LLM, confidence 0.88 Last fallback in Bazel runfiles bootstrap sourcing from a manifest.
    Reasoning

    Final fallback in the standard Bazel runfiles bootstrap, ending with an error if not found. Benign.

  429. info critical → info by review dynamic-execution test/csharp/codegen/csharp_codegen_async_suffix_test.sh:51:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # run protoc and the plugin with append_async_suffix option
    $PROTOC \
        --plugin=protoc-gen-grpc="$PLUGIN" \
        --csharp_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.85 Codegen test invoking protoc via a variable resolved from the build environment.
    Reasoning

    Runs $PROTOC, which is assigned from a runfiles or build-supplied path, to generate C# code in a codegen test. The indirection is from Bazel location resolution, which is expected in this test script.

  430. command name is a variable (`$DIFFCMD`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Diff to check the contents of the generated file
    $DIFFCMD ${DATA_DIR}/expected/GreetGrpc.cs ${PROTO_OUT}/GreetGrpc.cs
    # Silence shellcheck as it doesn't allow testing of $? and there isn't an easy
    # way around it with a command with several arguments.
  431. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_base_namespace_test.sh:30:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    set -uo pipefail; set +e; f=bazel_tools/tools/bash/runfiles/runfiles.bash
    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
    dismissed LLM, confidence 0.93 Standard Bazel runfiles bootstrap that sources runfiles.bash from a computed location.
    Reasoning

    This is the standard Bazel runfiles.bash initialization preamble. It sources the runfiles helper from RUNFILES_DIR, a manifest lookup, or a $0.runfiles path, with an error exit if none work. The dynamic path is the expected Bazel pattern and nothing here fetches or runs untrusted code.

  432. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_base_namespace_test.sh:31:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    dismissed LLM, confidence 0.93 Fallback source line in the Bazel runfiles initialization chain.
    Reasoning

    Continuation line of the same Bazel runfiles fallback chain. The sourced file is the fixed bazel_tools runfiles helper, so the dynamic source is legitimate test-harness boilerplate.

  433. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_base_namespace_test.sh:32:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    dismissed LLM, confidence 0.93 Another fallback source in the Bazel runfiles bootstrap.
    Reasoning

    Part of the standard runfiles fallback chain that resolves bazel_tools/tools/bash/runfiles/runfiles.bash through manifests. No attacker-controlled input or network fetch is involved.

  434. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_base_namespace_test.sh:33:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    dismissed LLM, confidence 0.93 Runfiles fallback chain ending in a clean error exit.
    Reasoning

    Same runfiles boilerplate, ending with an error message and exit if the helper cannot be found. This is a routine Bazel test-environment setup pattern.

  435. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_base_namespace_test.sh:34:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    # --- end runfiles.bash initialization v3 ---
    dismissed LLM, confidence 0.92 Closing lines of the Bazel runfiles initialization block.
    Reasoning

    Final lines of the standard runfiles initialization block, followed by a comment marking its end. This is ordinary Bazel test scaffolding.

  436. info critical → info by review dynamic-execution test/csharp/codegen/csharp_codegen_base_namespace_test.sh:51:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # run protoc and the plugin specifying the base_namespace options
    $PROTOC \
        --plugin=protoc-gen-grpc-csharp="$PLUGIN" \
        --csharp_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.80 Test script runs the protoc binary, resolved at runtime, with the gRPC C# plugin.
    Reasoning

    $PROTOC is a variable resolved from the runfiles lookup to the protoc binary, which the test runs with a plugin and output directory. The flagged dynamic execution is the test invoking its declared toolchain, not a dropper or obfuscated payload. The critical severity overstates it.

  437. info critical → info by review dynamic-execution test/csharp/codegen/csharp_codegen_base_namespace_test.sh:88:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    $PROTOC \
        --plugin=protoc-gen-grpc-csharp="$PLUGIN" \
        --csharp_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.80 Repeated protoc invocation for C# codegen in a test case.
    Reasoning

    Same protoc invocation with the plugin and C# output options, repeated in a second test case. It runs the test's own toolchain binary and shows no encoding, download, or evasion.

  438. info critical → info by review dynamic-execution test/csharp/codegen/csharp_codegen_base_namespace_test.sh:124:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    $PROTOC \
        --plugin=protoc-gen-grpc-csharp="$PLUGIN" \
        --csharp_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.80 Third protoc run for C# gRPC codegen in the test.
    Reasoning

    A third protoc invocation with the same plugin and output flags. The runtime-resolved command is the test's build tool, so the critical rating is a false positive.

  439. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_deprecated_test.sh:30:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    set -uo pipefail; set +e; f=bazel_tools/tools/bash/runfiles/runfiles.bash
    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
    dismissed LLM, confidence 0.93 Standard Bazel runfiles bootstrap in a deprecated-codegen test.
    Reasoning

    Same standard Bazel runfiles.bash bootstrap as the sibling test script. The dynamic source resolves a known bazel_tools helper and is expected in Bazel tests.

  440. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_deprecated_test.sh:31:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    dismissed LLM, confidence 0.93 Runfiles fallback source line in a Bazel test.
    Reasoning

    Fallback source line in the standard runfiles chain. It is routine Bazel test scaffolding with no malicious indicators.

  441. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_deprecated_test.sh:32:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    dismissed LLM, confidence 0.93 Manifest-based runfiles fallback source in a Bazel test.
    Reasoning

    Manifest-based fallback in the runfiles helper lookup. This is the expected Bazel pattern for locating test dependencies.

  442. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_deprecated_test.sh:33:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    likely benign LLM, confidence 0.95 Bazel runfiles bootstrap that sources the runfiles helper library via a computed path.
    Reasoning

    This is the standard Bazel runfiles.bash initialization fallback chain. It sources the Bazel runfiles helper from RUNFILES_DIR, the manifest, or $0.runfiles, with a fixed relative path. No attacker-controlled input reaches the path.

  443. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_deprecated_test.sh:34:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    # --- end runfiles.bash initialization v3 ---
    likely benign LLM, confidence 0.95 Continuation of the standard Bazel runfiles initialization fallback chain.
    Reasoning

    Same Bazel runfiles.bash boilerplate fallback as the neighboring line. The path is built from the fixed string bazel_tools/tools/bash/runfiles/runfiles.bash, which is standard and benign.

  444. info critical → info by review dynamic-execution test/csharp/codegen/csharp_codegen_deprecated_test.sh:51:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # run protoc and the plugin
    $PROTOC \
        --plugin=protoc-gen-grpc="$PLUGIN" \
        --csharp_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.93 Test invocation of the protoc compiler with the gRPC C# plugin to generate code.
    Reasoning

    PROTOC is a test-harness variable holding the protoc binary location, presumably set by Bazel from a build dependency. Running it to generate C# code from .proto files is the expected function of a codegen test. The flagged dynamic command name is normal for Bazel-provided tool paths.

  445. info critical → info by review dynamic-execution test/csharp/codegen/csharp_codegen_deprecated_test.sh:104:6

    command name is a variable (`$nmatches`) and `nmatches` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    nmatches=$(echo "$CTX" | grep -c "class GreeterServiceLevelDepClient" || true)
    if [ "$nmatches" -ne 1 ]
    then
        echo >&2 "Missing ObsoleteAttribute on class GreeterServiceLevelDepClient"
    likely benign LLM, confidence 0.93 Counts occurrences of an expected class in generated code to assert an ObsoleteAttribute is present.
    Reasoning

    nmatches is assigned the output of grep -c counting matches in generated code. The later use is only a numeric comparison within a test assertion. The flagged 'command name is a variable' is a false positive from the scanner misreading `[ ... ]` and echo usage.

  446. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_simple_test.sh:30:1

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    set -uo pipefail; set +e; f=bazel_tools/tools/bash/runfiles/runfiles.bash
    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
    likely benign LLM, confidence 0.95 Bazel runfiles bootstrap that sources the runfiles helper library.
    Reasoning

    Standard Bazel runfiles.bash initialization. It sources the helper from RUNFILES_DIR, the manifest, or $0.runfiles using a fixed relative path, with no untrusted input.

  447. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_simple_test.sh:31:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

    source "${RUNFILES_DIR:-/dev/null}/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.95 Continuation of the standard Bazel runfiles initialization.
    Reasoning

    Same Bazel runfiles fallback chain as the other test scripts in this repository. Fixed relative path, benign.

  448. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_simple_test.sh:32:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "${RUNFILES_MANIFEST_FILE:-/dev/null}" | cut -f2- -d' ')" 2>/dev/null || \
      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
    likely benign LLM, confidence 0.95 Continuation of the standard Bazel runfiles initialization.
    Reasoning

    Standard Bazel runfiles fallback sourcing with manifest lookup. No attacker-controlled input and a fixed library path.

  449. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_simple_test.sh:33:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$0.runfiles/$f" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    likely benign LLM, confidence 0.95 Continuation of the standard Bazel runfiles initialization with error handling.
    Reasoning

    Standard Bazel runfiles bootstrap sourcing with an error fallback that exits if the helper is missing. Benign boilerplate.

  450. info warn → info by review dynamic-import test/csharp/codegen/csharp_codegen_simple_test.sh:34:3

    `source` called with a dynamic path — sourcing a variable script path (ast pass, confidence 0.75)

      source "$(grep -sm1 "^$f " "$0.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      source "$(grep -sm1 "^$f " "$0.exe.runfiles_manifest" | cut -f2- -d' ')" 2>/dev/null || \
      { echo>&2 "ERROR: cannot find $f"; exit 1; }; f=; set -e
    # --- end runfiles.bash initialization v3 ---
    likely benign LLM, confidence 0.95 Final fallback line of the standard Bazel runfiles initialization.
    Reasoning

    Final fallback of the standard Bazel runfiles initialization. Fixed path, no untrusted input, and the trailing marker confirms the boilerplate.

  451. info critical → info by review dynamic-execution test/csharp/codegen/csharp_codegen_simple_test.sh:51:1

    command name is a variable (`$PROTOC`) and `PROTOC` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # run protoc and the plugin
    $PROTOC \
        --plugin=protoc-gen-grpc="$PLUGIN" \
        --csharp_out=${PROTO_OUT} \
    likely benign LLM, confidence 0.93 Test invocation of the protoc compiler with the gRPC C# plugin.
    Reasoning

    Same protoc invocation pattern as the deprecated test: PROTOC is a build-provided compiler path used to generate C# gRPC code in a test. Expected behavior for a codegen test.

  452. command name is a variable (`$DIFFCMD`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Diff to check the contents of the generated file
    $DIFFCMD ${DATA_DIR}/expected/HelloworldGrpc.cs ${PROTO_OUT}/HelloworldGrpc.cs
    # Silence shellcheck as it doesn't allow testing of $? and there isn't an easy
    # way around it with a command with several arguments.
  453. info critical → info by review dynamic-execution test/distrib/python/run_binary_distrib_test.sh:19:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    
    "$(dirname "$0")/test_packages.sh" binary
    likely benign LLM, confidence 0.93 Distribution test driver that invokes the sibling test_packages.sh script for binary packages.
    Reasoning

    The script runs a sibling test_packages.sh located relative to $0 with a fixed argument 'binary'. This is ordinary distribution-test driver logic in the grpc repository, with no external input.

  454. info critical → info by review dynamic-execution test/distrib/python/run_source_distrib_test.sh:19:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    
    "$(dirname "$0")/test_packages.sh" source
    likely benign LLM, confidence 0.93 Distribution test driver that invokes the sibling test_packages.sh script for source packages.
    Reasoning

    Same pattern as the binary distribution driver: it runs the sibling test_packages.sh with the fixed argument 'source'. Benign test orchestration.

  455. info warn → info by review dynamic-execution test/distrib/python/test_packages.sh:50:1

    command name is a variable (`$PYTHON_BIN`) not set in this file — the caller or environment decides what runs (ast pass, confidence 0.70)

    # the version of the wheels we are testing.
    ${PYTHON_BIN:-python3} -m virtualenv "$VIRTUAL_ENV"
    PYTHON=$VIRTUAL_ENV/bin/python
    "$PYTHON" -m pip install --upgrade six pip wheel setuptools
    likely benign LLM, confidence 0.90 A test script runs the Python interpreter chosen through an environment variable with a python3 default.
    Reasoning

    The command name comes from ${PYTHON_BIN:-python3}, a standard override with a fallback in a test-distribution script. Nothing in the snippet is encoded or hidden, and the caller choosing the interpreter is normal for build and test tooling.

  456. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    PYTHON=$VIRTUAL_ENV/bin/python
    "$PYTHON" -m pip install --upgrade six pip wheel setuptools
    
    function validate_wheel_hashes() {
  457. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      for file in "$@"; do
        "$PYTHON" -m wheel unpack "$file" -d /tmp || return 1
      done
      return 0
  458. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      for file in "$@"; do
        if "$PYTHON" -m pip install "$file"; then
          return 0
        fi
  459. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    # code from it and then use the generated code from distribtest.py
    "$PYTHON" -m grpc_tools.protoc --help
    
    "$PYTHON" distribtest.py
  460. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    "$PYTHON" distribtest.py
  461. info warn → info by review macro-keyword-override third_party/cares/config_android/ares_config.h:43:1

    `#define GETNAMEINFO_TYPE_ARG7 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 7 for getnameinfo. */
    #define GETNAMEINFO_TYPE_ARG7 int
    
    /* Specifies the number of arguments to getservbyport_r */
    likely benign LLM, confidence 0.93 Autoconf-style type define for getnameinfo arg 7 in the bundled c-ares Android config.
    Reasoning

    This is an autoconf-generated config header from c-ares. The macro documents the getnameinfo argument type and is a standard feature-detection define, not an obfuscation attempt.

  462. info warn → info by review macro-keyword-override third_party/cares/config_android/ares_config.h:350:1

    `#define RECVFROM_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recvfrom. */
    #define RECVFROM_TYPE_ARG1 int
    
    /* Define to the type pointed by arg 2 for recvfrom. */
    likely benign LLM, confidence 0.93 Generated define mapping the recvfrom arg 1 type in the c-ares Android config.
    Reasoning

    This is a generated type define for recvfrom arg 1, with a documenting comment. Mapping socket argument types to int in platform configs is standard for c-ares.

  463. info warn → info by review macro-keyword-override third_party/cares/config_android/ares_config.h:362:1

    `#define RECVFROM_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recvfrom. */
    #define RECVFROM_TYPE_ARG4 int
    
    /* Define to the type pointed by arg 5 for recvfrom. */
    likely benign LLM, confidence 0.93 Generated define for the recvfrom arg 4 type in the c-ares Android config.
    Reasoning

    This is a generated type define for recvfrom arg 4, matching the standard autoconf socket-type probe output in c-ares.

  464. info warn → info by review macro-keyword-override third_party/cares/config_android/ares_config.h:380:1

    `#define RECV_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recv. */
    #define RECV_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for recv. */
    likely benign LLM, confidence 0.93 Generated define for the recv arg 1 type in the c-ares Android config.
    Reasoning

    This is a generated type define for recv arg 1, documented by its comment. It is a routine platform-probe artifact.

  465. info warn → info by review macro-keyword-override third_party/cares/config_android/ares_config.h:389:1

    `#define RECV_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recv. */
    #define RECV_TYPE_ARG4 int
    
    /* Define to the function return type for recv. */
    likely benign LLM, confidence 0.93 Generated define for the recv arg 4 type in the c-ares Android config.
    Reasoning

    This is a generated define for recv arg 4 with a documenting comment. The pattern is the standard autoconf socket-type probe output.

  466. info warn → info by review macro-keyword-override third_party/cares/config_android/ares_config.h:401:1

    `#define SEND_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for send. */
    #define SEND_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for send. */
    likely benign LLM, confidence 0.93 Generated define for the send arg 1 type in the c-ares Android config.
    Reasoning

    This is a generated define for send arg 1, a standard platform-probe output in c-ares configs. The macro name is not a hidden keyword alias of any security relevance.

  467. info warn → info by review macro-keyword-override third_party/cares/config_android/ares_config.h:410:1

    `#define SEND_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for send. */
    #define SEND_TYPE_ARG4 int
    
    /* Define to the function return type for send. */
    likely benign LLM, confidence 0.93 Generated define for the send arg 4 type in the c-ares Android config.
    Reasoning

    This is a generated define for send arg 4 with a documenting comment, typical of autoconf output for socket function signatures.

  468. info warn → info by review macro-keyword-override third_party/cares/config_darwin/ares_config.h:43:1

    `#define GETNAMEINFO_TYPE_ARG7 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 7 for getnameinfo. */
    #define GETNAMEINFO_TYPE_ARG7 int
    
    /* Specifies the number of arguments to getservbyport_r */
    likely benign LLM, confidence 0.93 Generated getnameinfo arg 7 type define in the c-ares Darwin config.
    Reasoning

    This is the same autoconf-generated getnameinfo type define as in the Android config, in the Darwin config. It is a standard feature probe with no malicious effect.

  469. info warn → info by review macro-keyword-override third_party/cares/config_darwin/ares_config.h:352:1

    `#define RECVFROM_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recvfrom. */
    #define RECVFROM_TYPE_ARG1 int
    
    /* Define to the type pointed by arg 2 for recvfrom. */
    likely benign LLM, confidence 0.93 Generated recvfrom arg 1 type define in the c-ares Darwin config.
    Reasoning

    This is a generated recvfrom arg 1 define, identical in form to the other c-ares platform configs.

  470. info warn → info by review macro-keyword-override third_party/cares/config_darwin/ares_config.h:364:1

    `#define RECVFROM_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recvfrom. */
    #define RECVFROM_TYPE_ARG4 int
    
    /* Define to the type pointed by arg 5 for recvfrom. */
    likely benign LLM, confidence 0.93 Generated recvfrom arg 4 type define in the c-ares Darwin config.
    Reasoning

    This is a generated recvfrom arg 4 define, a standard autoconf probe output with a documenting comment.

  471. info warn → info by review macro-keyword-override third_party/cares/config_darwin/ares_config.h:382:1

    `#define RECV_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recv. */
    #define RECV_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for recv. */
    likely benign LLM, confidence 0.93 Generated recv arg 1 type define in the c-ares Darwin config.
    Reasoning

    This is a generated recv arg 1 define in a vendored config header, with a documenting comment and no executable effect.

  472. info warn → info by review macro-keyword-override third_party/cares/config_darwin/ares_config.h:391:1

    `#define RECV_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recv. */
    #define RECV_TYPE_ARG4 int
    
    /* Define to the function return type for recv. */
    likely benign LLM, confidence 0.93 Generated recv arg 4 type define in the c-ares Darwin config.
    Reasoning

    This is a generated recv arg 4 define in a vendored configuration header, the usual autoconf output pattern.

  473. info warn → info by review macro-keyword-override third_party/cares/config_darwin/ares_config.h:403:1

    `#define SEND_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for send. */
    #define SEND_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for send. */
    likely benign LLM, confidence 0.93 Generated send arg 1 type define in the c-ares Darwin config.
    Reasoning

    This is a generated send arg 1 define in a vendored config header, consistent with standard c-ares platform probing.

  474. info warn → info by review macro-keyword-override third_party/cares/config_darwin/ares_config.h:412:1

    `#define SEND_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for send. */
    #define SEND_TYPE_ARG4 int
    
    /* Define to the function return type for send. */
    likely benign LLM, confidence 0.95 Autoconf type-alias macro for send() argument type in c-ares config header.
    Reasoning

    Autoconf-generated config header defining SEND_TYPE_ARG4 as int. This is a standard configure-time type alias pattern; the macro name is not a keyword and the expansion is expected. Not obfuscation.

  475. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:35:1

    `#define GETNAMEINFO_QUAL_ARG1 const` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type qualifier of arg 1 for getnameinfo. */
    #define GETNAMEINFO_QUAL_ARG1 const
    
    /* Define to the type of arg 1 for getnameinfo. */
    likely benign LLM, confidence 0.95 Autoconf macro defining getnameinfo arg1 qualifier as const.
    Reasoning

    Standard autoconf-generated macro mapping getnameinfo qualifier to const. Common in c-ares platform configs; benign.

  476. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:47:1

    `#define GETNAMEINFO_TYPE_ARG7 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 7 for getnameinfo. */
    #define GETNAMEINFO_TYPE_ARG7 int
    
    /* Specifies the number of arguments to getservbyport_r */
    likely benign LLM, confidence 0.95 Autoconf macro defining getnameinfo arg7 type as int.
    Reasoning

    Autoconf-generated type alias for getnameinfo arg 7. Expected configure output in a vendored third-party header.

  477. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:390:1

    `#define RECVFROM_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recvfrom. */
    #define RECVFROM_TYPE_ARG1 int
    
    /* Define to the type pointed by arg 2 for recvfrom. */
    likely benign LLM, confidence 0.95 Autoconf macro defining recvfrom arg1 type as int.
    Reasoning

    Autoconf-generated recvfrom argument type macro. Standard configure probe output; the rule is a false positive on expected platform configuration.

  478. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:393:1

    `#define RECVFROM_TYPE_ARG2 void` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type pointed by arg 2 for recvfrom. */
    #define RECVFROM_TYPE_ARG2 void
    
    /* Define to 1 if the type pointed by arg 2 for recvfrom is void. */
    likely benign LLM, confidence 0.95 Autoconf macro defining recvfrom arg2 pointee type as void.
    Reasoning

    Autoconf-generated recvfrom arg2 pointee type macro set to void. Normal configure output for a vendored library.

  479. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:402:1

    `#define RECVFROM_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recvfrom. */
    #define RECVFROM_TYPE_ARG4 int
    
    /* Define to the type pointed by arg 5 for recvfrom. */
    likely benign LLM, confidence 0.95 Autoconf macro defining recvfrom arg4 type as int.
    Reasoning

    Autoconf-generated recvfrom arg4 type macro. Expected platform configuration in vendored c-ares.

  480. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:420:1

    `#define RECV_TYPE_ARG1 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 1 for recv. */
    #define RECV_TYPE_ARG1 int
    
    /* Define to the type of arg 2 for recv. */
    likely benign LLM, confidence 0.95 Autoconf macro defining recv arg1 type as int.
    Reasoning

    Autoconf-generated recv arg1 type macro. Standard configure output; no malicious indicators.

  481. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:429:1

    `#define RECV_TYPE_ARG4 int` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define to the type of arg 4 for recv. */
    #define RECV_TYPE_ARG4 int
    
    /* Define to the function return type for recv. */
    likely benign LLM, confidence 0.95 Autoconf macro defining recv arg4 type as int.
    Reasoning

    Autoconf-generated recv arg4 type macro in vendored c-ares config. Benign.

  482. info warn → info by review macro-keyword-override third_party/cares/config_freebsd/ares_config.h:435:1

    `#define RETSIGTYPE void` aliases a C reserved keyword behind a non-keyword macro name (ast pass, confidence 0.85)

    /* Define as the return type of signal handlers (`int' or `void'). */
    #define RETSIGTYPE void
    
    /* Define to the type qualifier of arg 2 for send. */
    likely benign LLM, confidence 0.95 Autoconf macro defining signal handler return type as void.
    Reasoning

    Autoconf-generated RETSIGTYPE macro set to void, a standard portability define. Benign.

  483. command name is a variable (`$RBE_CONFIGS_GEN_TOOL_PATH`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    ${RBE_CONFIGS_GEN_TOOL_PATH} \
        --bazel_version="${BAZEL_VERSION}" \
        --toolchain_container="${LINUX_RBE_DOCKER_IMAGE}" \
  484. command name is a variable (`$RBE_CONFIGS_GEN_TOOL_PATH`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    ${RBE_CONFIGS_GEN_TOOL_PATH} \
        --bazel_version="${BAZEL_VERSION}" \
        --toolchain_container="${WINDOWS_RBE_DOCKER_IMAGE}" \
  485. 13 of 30 non-conventional identifiers are single-character (43%) (token pass, confidence 0.50)

  486. identifier `𤭢XX` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

    
          "$¢€𤭢XX",
          "$¢€𤭢XX",
  487. identifier `𤭢XX` mixes scripts: Other + Latin (in string/comment) (raw pass, confidence 0.40)

          "$¢€𤭢XX",
          "$¢€𤭢XX",
    
          "\xed\xa1\x92XX",
  488. info critical → info by review dynamic-execution tools/artifact_gen/gen_upb_api_from_bazel.sh:49:1

    command name is a variable (`$TMP_DIR`) and `TMP_DIR` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Clean existing generated files
    ${TMP_DIR}/gen_upb_api_from_bazel --mode=clean $@
    
    UPB_RULES_XML=$(mktemp)
    likely benign LLM, confidence 0.90 Build script invoking a generator binary via a temp-dir variable.
    Reasoning

    TMP_DIR is set by the script itself from a mktemp-style command and the executed binary is the generator built in that directory. Variable command invocation here is a normal build-tool pattern, not a download-and-run dropper. Benign pattern, though the variable-path invocation is worth a glance in review.

  489. info critical → info by review dynamic-execution tools/artifact_gen/gen_upb_api_from_bazel.sh:59:13

    command name is a variable (`$TMP_DIR`) and `TMP_DIR` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Now we can use the generator to get the list of deps.
    DEPS_LIST=$(${TMP_DIR}/gen_upb_api_from_bazel \
                  --mode=list_deps \
                  --upb_rules_xml="${UPB_RULES_XML}")
    likely benign LLM, confidence 0.90 Build script capturing dependency list from the local generator binary.
    Reasoning

    Same script runs the locally built generator from TMP_DIR in list_deps mode; the flagged dynamic command name reflects a build step, not malicious execution.

  490. info critical → info by review dynamic-execution tools/artifact_gen/gen_upb_api_from_bazel.sh:73:17

    command name is a variable (`$TMP_DIR`) and `TMP_DIR` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Get the list of upb targets to build
    BUILD_TARGETS=$(${TMP_DIR}/gen_upb_api_from_bazel \
                      --mode=list_build_targets \
                      --upb_rules_xml="${UPB_RULES_XML}")
    likely benign LLM, confidence 0.90 Build script retrieving upb build targets from the local generator.
    Reasoning

    Runs the local generator in list_build_targets mode with an XML input produced by the build; consistent with legitimate code generation.

  491. info critical → info by review dynamic-execution tools/artifact_gen/gen_upb_api_from_bazel.sh:83:1

    command name is a variable (`$TMP_DIR`) and `TMP_DIR` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Run the C++ program to copy the generated files.
    ${TMP_DIR}/gen_upb_api_from_bazel \
      --mode=generate_and_copy \
      --upb_rules_xml="${UPB_RULES_XML}" \
    likely benign LLM, confidence 0.90 Build script invoking the generator to copy generated upb files.
    Reasoning

    Runs the local generator to copy generated files; the command is a locally compiled tool in a temp directory, consistent with normal codegen scripts.

  492. info critical → info by review dynamic-execution tools/bazel:89:1

    `exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)

    popd >/dev/null
    exec "${filename_abs}" "$@"
    dismissed LLM, confidence 0.92 Bazel wrapper script that execs the resolved Bazel binary.
    Reasoning

    This is the Bazel launcher wrapper, which execs the real Bazel binary resolved from its own directory. The dynamic path is the wrapper's own relocated target, which is the expected design for this script.

  493. command name is a variable (`$BUILD_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

    SCRIPT_EXIT_CODE=0
    ../"${BUILD_SCRIPT}" >"../${SCRIPT_LOG_FILE}" 2>&1  || SCRIPT_EXIT_CODE="$?"
    
    # Store build script's exitcode in a file.
  494. info critical → info by review dynamic-execution tools/bazelify_tests/grpc_repo_archive.sh:47:6

    command name is a variable (`$GRPC_GIT_COMMIT_FROM_STABLE_STATUS`) and `GRPC_GIT_COMMIT_FROM_STABLE_STATUS` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    if [ "${GRPC_GIT_COMMIT_FROM_STABLE_STATUS}" == "" ]
    then
      echo "Failed to obtain info about gRPC git commit from the bazel workspace. Make sure you invoke bazel with --workspace_status_command=tools/bazelify_tests/workspace_status_cmd.sh" >&2
    likely benign LLM, confidence 0.80 Shell check that a git-commit status variable is non-empty, with an error message if it is unset.
    Reasoning

    The snippet shows only a string comparison and an error message about a workspace status variable. The command-name finding looks like a parser artifact, since no command in the snippet is run from that variable.

  495. command name is a variable (`$BUILD_SCRIPT`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Run build script passed as arg.
    "${BUILD_SCRIPT}"
  496. info critical → info by review dynamic-execution tools/bazelify_tests/test/bazel_build_out_of_tree_with_bzlmod_linux.sh:24:1

    command name is a variable (`$GIT_ROOT`) and `GIT_ROOT` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # releases.
    $GIT_ROOT/tools/bazel \
        build \
        -- \
    likely benign LLM, confidence 0.92 Out-of-tree bzlmod build test that runs the repo's bundled bazel from the git root.
    Reasoning

    GIT_ROOT is derived from the repository's own git root, and the command runs the repo's bundled tools/bazel. This is a test script invoking the project's own tooling.

  497. info critical → info by review dynamic-execution tools/bazelify_tests/test/bazel_build_out_of_tree_with_bzlmod_linux.sh:43:1

    command name is a variable (`$GIT_ROOT`) and `GIT_ROOT` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Some nobuild tests for bzlmod dependency check.
    $GIT_ROOT/tools/bazel \
        build \
        --nobuild \
    likely benign LLM, confidence 0.92 Bzlmod nobuild dependency check run via the repo's bundled bazel.
    Reasoning

    Same pattern as the previous finding: a nobuild dependency check invoking $GIT_ROOT/tools/bazel within the project's test harness.

  498. info critical → info by review dynamic-execution tools/bazelify_tests/test/bazel_build_out_of_tree_with_bzlmod_linux.sh:50:1

    command name is a variable (`$GIT_ROOT`) and `GIT_ROOT` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    $GIT_ROOT/tools/bazel \
        build \
        --nobuild \
    likely benign LLM, confidence 0.92 Another nobuild bazel invocation from the test script.
    Reasoning

    Same pattern again: a nobuild test invoking the repository's own bazel binary under the git root.

  499. info critical → info by review dynamic-execution tools/buildgen/generate_projects.py:146:29

    `os.system` called on a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

                if os.path.isfile(g):
                    assert 0 == os.system("diff %s %s" % (s, g)), s
                    os.unlink(g)
                else:
    likely benign LLM, confidence 0.85 Build generator that shells out to diff to compare generated and existing project files.
    Reasoning

    This is a build-generation tool that diffs generated project files against committed ones. The command is built from internal file paths and does not take untrusted input, so it is a normal developer tool pattern.

  500. info critical → info by review dynamic-execution tools/buildgen/generate_projects.py:149:29

    `os.system` called on a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

                else:
                    assert 0 == os.system("diff -r %s %s" % (s, g)), s
                    shutil.rmtree(g, ignore_errors=True)
    likely benign LLM, confidence 0.85 Build generator shelling out to recursive diff on generated directories.
    Reasoning

    Same generator pattern, using diff -r on directories with internally derived paths. No untrusted input reaches the command.

  501. command name is a variable (`$VENV_PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      PY_VERSION="$(python3 -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")')"
      PY_VENV_VERSION="$(${VENV_PYTHON} -c 'import sys; print(f"{sys.version_info.major}.{sys.version_info.minor}")' || echo "broken")"
      if  [[ "${PY_VERSION}" !=  "${PY_VENV_VERSION}" ]]; then
  502. command name is a variable (`$VENV_PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    echo -n "Using ${VENV_DIR} venv with Python interpreter: "
    "${VENV_PYTHON}" -VV
    
    # TODO(sergiitk): remove GRPC_GENERATE_PROJECTS_SKIP_XDS_PROTOS when all CIs are
  503. command name is a variable (`$VENV_PIP`) that this file sets only to plain text (ast pass, confidence 0.40)

      # python releases, as older grpcio-tools release may not support them.
      "${VENV_PIP}" install grpcio-tools==1.74.0
      "${VENV_PIP}" list
  504. command name is a variable (`$VENV_PIP`) that this file sets only to plain text (ast pass, confidence 0.40)

      "${VENV_PIP}" install grpcio-tools==1.74.0
      "${VENV_PIP}" list
    
      echo "[gRPC Python] Generating xds-protos"
  505. command name is a variable (`$VENV_PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      echo "[gRPC Python] Generating xds-protos"
      "${VENV_PYTHON}" py_xds_protos/build_xds_protos.py
    fi
  506. command name is a variable (`$VENV_PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    echo "[gRPC Python] Making other grpcio auxilary packages"
    "${VENV_PYTHON}" tools/distrib/python/make_grpcio_tools.py
    "${VENV_PYTHON}" src/python/grpcio_observability/make_grpcio_observability.py
    echo "[gRPC Python] Done: auxilary packages"
  507. command name is a variable (`$VENV_PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    "${VENV_PYTHON}" tools/distrib/python/make_grpcio_tools.py
    "${VENV_PYTHON}" src/python/grpcio_observability/make_grpcio_observability.py
    echo "[gRPC Python] Done: auxilary packages"
  508. command name is a variable (`$buildifier_bin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # shellcheck disable=SC2086,SC2068
    ${buildifier_bin} ${EXTRA_BUILDIFIER_FLAGS[@]} -v ${bazel_files}
  509. command name is a variable (`$buildifier_format_script`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    ${buildifier_format_script} -lint fix
  510. info dynamic-execution tools/distrib/buildozer.sh:82:39

    command name is a variable (`$TEMP_BUILDOZER_PATH`) that this file sets only to plain text (ast pass, confidence 0.40)

        if [ -x ${TEMP_BUILDOZER_PATH} ]; then
            existing_buildozer_version="$(${TEMP_BUILDOZER_PATH} -version 2>&1 | head -n1 | cut -d" " -f3)"
            if [[ "${existing_buildozer_version}" != "${BUILDOZER_VERSION}" ]]; then
                download_buildozer
  511. info dynamic-execution tools/distrib/buildozer.sh:99:1

    command name is a variable (`$buildozer_bin`) that this file sets only to plain text (ast pass, confidence 0.40)

    # shellcheck disable=SC2086,SC2068
    ${buildozer_bin} "$@"
  512. info critical → info by review dynamic-execution tools/distrib/check_copyright.py:279:9

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

        filename_list = (
            subprocess.check_output(FILE_LIST_COMMAND, shell=True)
            .decode()
            .splitlines()
    likely benign LLM, confidence 0.90 Copyright checker that lists repository files via a fixed shell command.
    Reasoning

    FILE_LIST_COMMAND is a fixed constant such as a git ls-files invocation used to lint the repo. Using shell=True with a constant string is a common, low-risk pattern here.

  513. info critical → info by review dynamic-execution tools/distrib/check_include_guards.py:241:9

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

        filename_list = (
            subprocess.check_output(FILE_LIST_COMMAND, shell=True)
            .decode()
            .splitlines()
    likely benign LLM, confidence 0.90 Include-guard linter that lists files through a constant shell command.
    Reasoning

    The shell command is a fixed file-listing constant in a lint script, with no external input.

  514. info critical → info by review dynamic-execution tools/distrib/check_namespace_qualification.py:115:9

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

        filename_list = (
            subprocess.check_output(FILE_LIST_COMMAND, shell=True)
            .decode()
            .splitlines()
    likely benign LLM, confidence 0.90 Namespace-qualification linter using a constant shell file-list command.
    Reasoning

    Same as the other lint scripts: a constant file-list command run with shell=True in a repository checker.

  515. command name is a variable (`$FIX`) that this file sets only to plain text (ast pass, confidence 0.40)

      echo "$ERRORS"
      if ! $FIX; then
        exit 1
      fi
  516. info critical → info by review dynamic-execution tools/distrib/fix_build_deps.py:429:5

    `exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)

        parsing_path = dirname
        exec(
            open("%sBUILD" % (dirname + "/" if dirname else ""), "r").read(),
            {
    likely benign LLM, confidence 0.80 Dependency-fixing tool that evaluates local BUILD file contents at module scope.
    Reasoning

    The script execs the contents of local BUILD files as Starlark-style Python to read dependency data. That is an unusual choice but is confined to a developer tool reading the repo's own build files, not fetched or hidden payloads.

  517. info dynamic-execution tools/distrib/format_bazel.sh:24:1

    command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    PYTHON=${VIRTUAL_ENV}/bin/python
    "$PYTHON" -m pip install --upgrade pip==19.3.1
    "$PYTHON" -m pip install yapf==0.30.0
  518. info dynamic-execution tools/distrib/format_bazel.sh:25:1

    command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    "$PYTHON" -m pip install --upgrade pip==19.3.1
    "$PYTHON" -m pip install yapf==0.30.0
    
    pushd "$(dirname "${0}")/../.."
  519. info critical → info by review dynamic-execution tools/distrib/python_wrapper.sh:28:3

    `exec` called with a dynamic (variable/substitution) path (ast pass, confidence 0.85)

    if [ -x "$python" ] ; then
      exec "$python" "$@"
    else
      echo "No acceptable version of python found on the system"
    dismissed LLM, confidence 0.92 Python interpreter selection wrapper that execs the chosen python.
    Reasoning

    This wrapper picks an acceptable python interpreter from candidates and execs it with the original arguments. Dynamic exec is the wrapper's purpose.

  520. command name is a variable (`$PYTHON_PREFIX`) that this file sets only to plain text (ast pass, confidence 0.40)

    # install cython and wheel
    "${PYTHON_PREFIX}/bin/python3" -m pip install --upgrade 'cython==3.1.1' wheel
  521. command name is a variable (`$CLANG_FORMAT`) that this file sets only to plain text (ast pass, confidence 0.40)

        tmp=`mktemp`
        $CLANG_FORMAT $file > $tmp
        diff -u $file $tmp || ok=no
        rm $tmp
  522. command name is a variable (`$exclude`) that this file sets only to plain text (ast pass, confidence 0.40)

      done
      if $exclude; then
        continue
      fi
  523. info critical → info by review dynamic-execution tools/gce/linux_kokoro_performance_worker_init.sh:151:1

    `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

    export PATH="$HOME/.rbenv/bin:$PATH"
    eval "$(rbenv init -)"
    
    git clone https://github.com/rbenv/ruby-build.git ~/.rbenv/plugins/ruby-build
    likely benign LLM, confidence 0.90 CI worker provisioning script that initializes rbenv and clones ruby-build.
    Reasoning

    eval "$(rbenv init -)" is the standard rbenv setup, followed by cloning ruby-build from its public GitHub repository during worker provisioning. This is ordinary CI setup.

  524. info critical → info by review dynamic-execution tools/gource/make-video.sh:20:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    shift
    $(dirname $0)/gource.sh \
      --disable-progress    \
      --stop-at-end         \
    dismissed LLM, confidence 0.92 Video generation helper that runs the sibling gource.sh script.
    Reasoning

    The script runs gource.sh from its own directory via $(dirname $0). That is a normal sibling-script invocation in a video-making helper.

  525. info critical → info by review dynamic-execution tools/internal_ci/helper_scripts/prepare_build_linux_perf_multilang_rc:31:1

    `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

    export PATH="$HOME/.rbenv/bin:$PATH"
    eval "$(rbenv init -)"
    gem list bundler
    gem install bundler --no-document
    likely benign LLM, confidence 0.90 Sets up rbenv in a CI build script by evaluating its init output.
    Reasoning

    The eval wraps the output of `rbenv init -`, the standard way to activate rbenv in a shell. The script is a CI build helper and nothing in the snippet is attacker-controlled.

  526. command name is a variable (`$is_sonoma`) that this file sets only to plain text (ast pass, confidence 0.40)

    
    if $is_sonoma; then
      brew install cmake
      brew install gnupg
  527. command name is a variable (`$is_sonoma`) that this file sets only to plain text (ast pass, confidence 0.40)

    # cleanup this once migration complete
    if [ "${PREPARE_BUILD_INSTALL_DEPS_RUBY}" == "true" ] && ! $is_sonoma;
    then
      # Workaround for https://github.com/rvm/rvm/issues/5133
  528. command name is a variable (`$is_sonoma`) that this file sets only to plain text (ast pass, confidence 0.40)

    
      if $is_sonoma; then
        # See https://getcomposer.org/download.
        # Composer installer checksum verification: https://composer.github.io/pubkeys.html
  529. info critical → info by review dynamic-execution tools/internal_ci/linux/aws/grpc_aws_run_remote_test_8core.sh:18:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    
    AWS_INSTANCE_TYPE="t4g.2xlarge" "$(dirname $0)/grpc_aws_run_remote_test.sh"
    likely benign LLM, confidence 0.90 CI wrapper that runs a sibling test script with an AWS instance type variable.
    Reasoning

    The command is the script's own sibling, located via `$(dirname $0)`, with an environment variable set inline. This is a common CI wrapper pattern and does not fetch or run anything external.

  530. command name is a variable (`$job_name`) that this file sets only to plain text (ast pass, confidence 0.40)

        set -x
        "cleanup::job::${job_name}" "${job_name}" || (( ++failed_jobs ))
        set +x
        echo "-------------------- Finished job ${job_name} --------------------"
  531. info critical → info by review dynamic-execution tools/internal_ci/linux/grpc_xds_v3_bazel_python_test_in_docker.sh:16:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    
    XDS_V3_OPT="--xds_v3_support" `dirname $0`/grpc_xds_bazel_python_test_in_docker.sh
    likely benign LLM, confidence 0.90 CI wrapper that runs a sibling xDS Python test script with a fixed flag.
    Reasoning

    The backtick `dirname $0` resolves the script's own directory to run a sibling script. The flag is a fixed string, so this is a routine CI dispatch.

  532. info critical → info by review dynamic-execution tools/internal_ci/linux/grpc_xds_v3_bazel_test_in_docker.sh:16:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    
    XDS_V3_OPT="--xds_v3_support" `dirname $0`/grpc_xds_bazel_test_in_docker.sh
    likely benign LLM, confidence 0.90 CI wrapper that runs a sibling xDS Bazel test script with a fixed flag.
    Reasoning

    Same pattern as the sibling xDS script: `dirname $0` locates a neighbouring script and a fixed flag is passed. Nothing indicates malicious intent.

  533. info critical → info by review dynamic-execution tools/internal_ci/macos/grpc_basictests_csharp.sh:19:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    export PREPARE_BUILD_INSTALL_DEPS_CSHARP=true
    $(dirname $0)/grpc_run_tests_matrix.sh
    likely benign LLM, confidence 0.90 macOS CI wrapper that enables C# dependencies and runs the test matrix script.
    Reasoning

    The script exports a flag and then runs the sibling matrix script located via `$(dirname $0)`. This is ordinary CI dispatch with no external input.

  534. info critical → info by review dynamic-execution tools/internal_ci/macos/grpc_basictests_php.sh:19:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    export PREPARE_BUILD_INSTALL_DEPS_PHP=true
    $(dirname $0)/grpc_run_tests_matrix.sh
    likely benign LLM, confidence 0.90 macOS CI wrapper that enables PHP dependencies and runs the test matrix script.
    Reasoning

    Same benign CI dispatch pattern: a fixed environment flag followed by a sibling script invoked via `$(dirname $0)`.

  535. info critical → info by review dynamic-execution tools/internal_ci/macos/grpc_basictests_python.sh:19:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    export PREPARE_BUILD_INSTALL_DEPS_PYTHON=true
    $(dirname $0)/grpc_run_tests_matrix.sh
    likely benign LLM, confidence 0.90 macOS CI wrapper that enables Python dependencies and runs the test matrix script.
    Reasoning

    Same benign CI dispatch pattern: a fixed environment flag followed by a sibling script invoked via `$(dirname $0)`.

  536. info critical → info by review dynamic-execution tools/internal_ci/macos/grpc_basictests_ruby.sh:19:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    export PREPARE_BUILD_INSTALL_DEPS_RUBY=true
    $(dirname $0)/grpc_run_tests_matrix.sh
    likely benign LLM, confidence 0.90 macOS CI wrapper that enables Ruby dependencies and runs the test matrix script.
    Reasoning

    Same benign CI dispatch pattern: a fixed environment flag followed by a sibling script invoked via `$(dirname $0)`.

  537. command name is a variable (`$INTEROP_SERVER_BINARY`) that this file sets only to plain text (ast pass, confidence 0.40)

    # TODO(jtattermusch): can we make the ports configurable (but avoid breaking bazel build cache at the same time?)
    "${INTEROP_SERVER_BINARY}" --port=$PLAIN_PORT --max_send_message_size=8388608 &
    "${INTEROP_SERVER_BINARY}" --port=$TLS_PORT --max_send_message_size=8388608 --use_tls &
  538. command name is a variable (`$INTEROP_SERVER_BINARY`) that this file sets only to plain text (ast pass, confidence 0.40)

    "${INTEROP_SERVER_BINARY}" --port=$PLAIN_PORT --max_send_message_size=8388608 &
    "${INTEROP_SERVER_BINARY}" --port=$TLS_PORT --max_send_message_size=8388608 --use_tls &
    # make sure the interop_server processes we started on the background are killed upon exit.
  539. info critical → info by review dynamic-execution tools/internal_ci/macos/grpc_run_tests_matrix_objc.sh:19:1

    command name is a variable or substitution — executed command determined at runtime (ast pass, confidence 0.90)

    export PREPARE_BUILD_INSTALL_DEPS_OBJC=true
    $(dirname $0)/grpc_run_tests_matrix.sh
    likely benign LLM, confidence 0.90 macOS CI wrapper that enables Objective-C dependencies and runs the test matrix script.
    Reasoning

    Same benign CI dispatch pattern: a fixed environment flag followed by a sibling script invoked via `$(dirname $0)`.

  540. info critical → info by review dynamic-execution tools/interop_matrix/create_testcases.sh:40:5

    `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

        # The script should generate a line with "${docker_image:=...}".
        eval docker_image=$(grep -oe '${docker_image:=.*}' $testcase)
        if [ -z "$KEEP_IMAGE" ]; then
          echo "Clean up docker_image $docker_image"
    likely benign LLM, confidence 0.80 Test-matrix script that evals a docker_image assignment extracted from a local testcase file.
    Reasoning

    The eval runs grep output taken from the repository's own generated testcase files, so the input is local and not attacker-supplied. Eval is still a fragile pattern, but nothing here suggests malicious intent.

  541. info critical → info by review dynamic-execution tools/interop_matrix/create_testcases.sh:62:1

    command name is a variable (`$GRPC_ROOT`) and `GRPC_ROOT` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    ${GRPC_ROOT}/tools/run_tests/run_interop_tests.py -l $client_lang --use_docker \
      --cloud_to_prod --prod_servers default gateway_v4 --manual_run --custom_credentials_type tls
    likely benign LLM, confidence 0.85 Runs the interop test runner from a GRPC_ROOT path computed at runtime.
    Reasoning

    GRPC_ROOT is a repository root path, presumably set from a git or dirname command, and the script runs a test runner under it. This is routine build-script path handling.

  542. compression ratio 0.623 is >2σ above file mean 0.613 (raw pass, confidence 0.50)

    lient/bin/Debug --net=host $docker_image bash -c "mono Grpc.IntegrationTesting.Client.exe --server_host=grpc-test.sandbox.googleapis.com --server_host_override=grpc-test.sandbox.googleapis.com --server_port=443 --use_tls=true --test_case=empty_unary"
  543. compression ratio 0.623 is >2σ above file mean 0.613 (raw pass, confidence 0.50)

    bin/Debug/net45 --net=host $docker_image bash -c "mono Grpc.IntegrationTesting.Client.exe --server_host=grpc-test.sandbox.googleapis.com --server_host_override=grpc-test.sandbox.googleapis.com --server_port=443 --use_tls=true --test_case=empty_unary"
  544. compression ratio 0.597 is >2σ above file mean 0.585 (raw pass, confidence 0.50)

    docker run -i --rm=true -w /go/src/google.golang.org/grpc/interop/client --net=host $docker_image bash -c "go run client.go --server_host=grpc-test.sandbox.googleapis.com --server_host_override=grpc-test.sandbox.googleapis.com --server_port=443 --use_tls=true --test_case=empty_unary"
  545. compression ratio 0.614 is >2σ above file mean 0.604 (raw pass, confidence 0.50)

    /local/git/grpc --net=host $docker_image bash -c "py27_native/bin/python src/python/grpcio_tests/setup.py run_interop --client --args=\"--server_host=grpc-test.sandbox.googleapis.com --server_host_override=grpc-test.sandbox.googleapis.com --server_port=443 --use_tls=true --test_case=cancel_after_begin\""
  546. compression ratio 0.592 is >2σ above file mean 0.585 (raw pass, confidence 0.50)

    docker run -i --rm=true -w /var/local/git/grpc --net=host $docker_image bash -c "source /usr/local/rvm/scripts/rvm && ruby src/ruby/pb/test/client.rb --server_host=grpc-test.sandbox.googleapis.com --server_host_override=grpc-test.sandbox.googleapis.com --server_port=443 --use_tls=true --test_case=client_streaming"
  547. info critical → info by review dynamic-execution tools/profiling/bloat/bloat_diff.py:149:1

    `subprocess.check_call` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

    )
    subprocess.check_call(
        "make -j%d bloaty" % args.jobs, shell=True, cwd="bloaty-build"
    )
    likely benign LLM, confidence 0.90 Build helper that runs make for bloaty via a shell with a job count.
    Reasoning

    The command is built with %d from args.jobs, which is an integer, and runs make in a local build directory. This is a normal build-tool invocation and the shell=True use is not exploitable here.

  548. info critical → info by review dynamic-execution tools/profiling/bloat/bloat_diff.py:164:13

    `subprocess.check_call` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

            if filename:
                subprocess.check_call(
                    "strip %s -o %s.stripped" % (filename[0], filename[0]),
                    shell=True,
    likely benign LLM, confidence 0.85 Profiling utility that strips local binaries via a shell command.
    Reasoning

    The strip command interpolates a filename from local build artifacts into a shell string. It is a profiling utility on local files and shows no sign of hostile input.

  549. info critical → info by review dynamic-execution tools/profiling/bloat/bloat_diff.py:172:17

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

            assert len(old_version) == 1
            text += subprocess.check_output(
                "%s -n 0 --debug-file=%s --debug-file=%s %s.stripped -- %s.stripped"
                % (
    likely benign LLM, confidence 0.85 Profiling utility that runs bloaty diff on local stripped binaries via a shell.
    Reasoning

    The check_output command interpolates local binary paths into a bloaty diff invocation. Using shell=True with local paths is a code-quality issue rather than evidence of malicious intent.

  550. info critical → info by review dynamic-execution tools/profiling/bloat/bloat_diff.py:186:17

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

                for x in csv.reader(
                    subprocess.check_output(
                        "bloaty-build/bloaty -n 0 --csv %s -- %s"
                        % (new_version[0], old_version[0]),
    likely benign LLM, confidence 0.75 Profiling script shells out to bloaty via check_output with shell=True and a formatted command string.
    Reasoning

    The command is a bloaty invocation built with % formatting from version/file arguments in a profiling tool. Using shell=True with interpolated paths is poor practice and could allow injection if untrusted input reaches it, but nothing here is obfuscated or malicious.

  551. info critical → info by review dynamic-execution tools/profiling/bloat/bloat_diff.py:205:17

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

        else:
            text += subprocess.check_output(
                "%s %s.stripped -n 0 --debug-file=%s"
                % (cmd, new_version[0], new_version[0]),
    likely benign LLM, confidence 0.75 Second shell=True check_output call in the bloat diff tool, building a bloaty debug-file command.
    Reasoning

    Same pattern as the sibling finding: a developer-run size-diff tool formats file names into a shell command. It is a risky idiom but reads as ordinary build tooling.

  552. info critical → info by review dynamic-execution tools/profiling/ios_bin/binary_size.py:75:5

    `subprocess.check_call` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

        )
        subprocess.check_call(
            (
                "CONFIG=opt EXAMPLE_PATH=src/objective-c/examples/Sample"
    likely benign LLM, confidence 0.80 Build script runs an xcodebuild-style sample build via check_call with shell=True.
    Reasoning

    The command sets build environment variables for an iOS sample build in the gRPC repo. The shell invocation is an ordinary build step with no encoding or hidden behavior.

  553. info critical → info by review dynamic-execution tools/release/backport_pr.sh:143:5

    `eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)

        git clean -xdff
        eval "$PER_BACKPORT_COMMAND"
        git add -A
        git commit --amend --no-edit
    likely benign LLM, confidence 0.80 Release backport script evals a user-configured per-backport command string.
    Reasoning

    eval runs a per-backport command that the release maintainer supplies, as part of a release-branch automation script. It is a deliberate design choice in a developer tool, not an obfuscated dropper.

  554. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Needed for building binary distribution wheels -- bdist_wheel
    "${PYTHON}" -m pip install --upgrade pip
    # Pin to a single version to make sure we're building the same artifacts
    "${PYTHON}" -m pip install setuptools==77.0.1 wheel==0.43.0 build==1.5.0
  555. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Pin to a single version to make sure we're building the same artifacts
    "${PYTHON}" -m pip install setuptools==77.0.1 wheel==0.43.0 build==1.5.0
    
    if [ "$GRPC_SKIP_PIP_CYTHON_UPGRADE" == "" ]
  556. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      # as possible.
      "${PYTHON}" -m pip install --upgrade 'cython==3.1.1'
    fi
  557. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      GRPC_PYTHON_OVERRIDE_EXT_SUFFIX="$(${PYTHON} -c 'import sysconfig; print(sysconfig.get_config_var("EXT_SUFFIX").replace("-x86_64-linux-gnu.so", "-aarch64-linux-gnu.so"))')"
      export GRPC_PYTHON_OVERRIDE_EXT_SUFFIX
  558. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      GRPC_PYTHON_OVERRIDE_EXT_SUFFIX="$(${PYTHON} -c 'import sysconfig; print(sysconfig.get_config_var("EXT_SUFFIX").replace("-x86_64-linux-gnu.so", "-arm-linux-gnueabihf.so"))')"
      export GRPC_PYTHON_OVERRIDE_EXT_SUFFIX
  559. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    # Build gRPC tools package distribution
    "${PYTHON}" tools/distrib/python/make_grpcio_tools.py
    
    # Build gRPC tools package source and binary distribution
  560. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    if [ "$GRPC_BUILD_MAC" == "" ]; then
      "${PYTHON}" src/python/grpcio_observability/make_grpcio_observability.py
      ${SETARCH_CMD} "${PYTHON}" -m build "src/python/grpcio_observability" \
        --no-isolation "${WHEEL_PLAT_CONFIG_OPTION[@]}"
  561. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      # TODO(jtattermusch): cleanup the virtualenv version fallback logic.
      "${PYTHON}" -m pip install virtualenv
      "${PYTHON}" -m virtualenv venv || { "${PYTHON}" -m pip install virtualenv==20.0.23 && "${PYTHON}" -m virtualenv venv; }
      # Ensure the generated artifacts are valid using "twine check"
  562. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      "${PYTHON}" -m pip install virtualenv
      "${PYTHON}" -m virtualenv venv || { "${PYTHON}" -m pip install virtualenv==20.0.23 && "${PYTHON}" -m virtualenv venv; }
      # Ensure the generated artifacts are valid using "twine check"
      venv/bin/python -m pip install "cryptography==40.0.0" "twine==5.0.0" "readme_renderer<40.0"
  563. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      "${PYTHON}" -m pip install virtualenv
      "${PYTHON}" -m virtualenv venv || { "${PYTHON}" -m pip install virtualenv==20.0.23 && "${PYTHON}" -m virtualenv venv; }
      # Ensure the generated artifacts are valid using "twine check"
      venv/bin/python -m pip install "cryptography==40.0.0" "twine==5.0.0" "readme_renderer<40.0"
  564. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      "${PYTHON}" -m pip install virtualenv
      "${PYTHON}" -m virtualenv venv || { "${PYTHON}" -m pip install virtualenv==20.0.23 && "${PYTHON}" -m virtualenv venv; }
      # Ensure the generated artifacts are valid using "twine check"
      venv/bin/python -m pip install "cryptography==40.0.0" "twine==5.0.0" "readme_renderer<40.0"
  565. command name is a variable (`$AUDITWHEEL`) that this file sets only to plain text (ast pass, confidence 0.40)

      for wheel in dist/*.whl; do
        "${AUDITWHEEL}" show "$wheel" | tee /dev/stderr |  grep -E -w "$AUDITWHEEL_PLAT"
        "${AUDITWHEEL}" repair "$wheel" --strip --wheel-dir "$ARTIFACT_DIR"
        rm "$wheel"
  566. command name is a variable (`$AUDITWHEEL`) that this file sets only to plain text (ast pass, confidence 0.40)

        "${AUDITWHEEL}" show "$wheel" | tee /dev/stderr |  grep -E -w "$AUDITWHEEL_PLAT"
        "${AUDITWHEEL}" repair "$wheel" --strip --wheel-dir "$ARTIFACT_DIR"
        rm "$wheel"
      done
  567. command name is a variable (`$AUDITWHEEL`) that this file sets only to plain text (ast pass, confidence 0.40)

      for wheel in tools/distrib/python/grpcio_tools/dist/*.whl; do
        "${AUDITWHEEL}" show "$wheel" | tee /dev/stderr |  grep -E -w "$AUDITWHEEL_PLAT"
        "${AUDITWHEEL}" repair "$wheel" --strip --wheel-dir "$ARTIFACT_DIR"
        rm "$wheel"
  568. command name is a variable (`$AUDITWHEEL`) that this file sets only to plain text (ast pass, confidence 0.40)

        "${AUDITWHEEL}" show "$wheel" | tee /dev/stderr |  grep -E -w "$AUDITWHEEL_PLAT"
        "${AUDITWHEEL}" repair "$wheel" --strip --wheel-dir "$ARTIFACT_DIR"
        rm "$wheel"
      done
  569. command name is a variable (`$AUDITWHEEL`) that this file sets only to plain text (ast pass, confidence 0.40)

        for wheel in src/python/grpcio_observability/dist/*.whl; do
          "${AUDITWHEEL}" show "$wheel" | tee /dev/stderr |  grep -E -w "$AUDITWHEEL_PLAT"
          "${AUDITWHEEL}" repair "$wheel" --strip --wheel-dir "$ARTIFACT_DIR"
          rm "$wheel"
  570. command name is a variable (`$AUDITWHEEL`) that this file sets only to plain text (ast pass, confidence 0.40)

          "${AUDITWHEEL}" show "$wheel" | tee /dev/stderr |  grep -E -w "$AUDITWHEEL_PLAT"
          "${AUDITWHEEL}" repair "$wheel" --strip --wheel-dir "$ARTIFACT_DIR"
          rm "$wheel"
        done
  571. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    then
      "${PYTHON}" -m pip install -r requirements.txt
    
      "${PYTHON}" -m pip install grpcio --no-index --find-links "file://$ARTIFACT_DIR/"
  572. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    
      "${PYTHON}" -m pip install grpcio --no-index --find-links "file://$ARTIFACT_DIR/"
      "${PYTHON}" -m pip install grpcio-tools --no-index --find-links "file://$ARTIFACT_DIR/"
  573. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      "${PYTHON}" -m pip install grpcio --no-index --find-links "file://$ARTIFACT_DIR/"
      "${PYTHON}" -m pip install grpcio-tools --no-index --find-links "file://$ARTIFACT_DIR/"
    
      # Ancillary packages below require source-built grpcio/grpcio_tools packages
  574. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      # Install xds-protos as a dependency of grpcio-csds
      "${PYTHON}" -m pip install xds-protos --no-index --find-links "file://$ARTIFACT_DIR/"
    
      # Build grpcio_csds source distribution
  575. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      # of Channelz and CSDS to be installed.
      "${PYTHON}" -m pip install grpcio-channelz --no-index --find-links "file://$ARTIFACT_DIR/"
      "${PYTHON}" -m pip install grpcio-csds --no-index --find-links "file://$ARTIFACT_DIR/"
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation "src/python/grpcio_admin"
  576. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

      "${PYTHON}" -m pip install grpcio-channelz --no-index --find-links "file://$ARTIFACT_DIR/"
      "${PYTHON}" -m pip install grpcio-csds --no-index --find-links "file://$ARTIFACT_DIR/"
      ${SETARCH_CMD} "${PYTHON}" -m build --no-isolation "src/python/grpcio_admin"
  577. command name is a variable (`$PYTHON`) that this file sets only to plain text (ast pass, confidence 0.40)

    else
      $PYTHON -m venv "$VENV"
      VENV_PYTHON="$(pwd)/$VENV/$VENV_RELATIVE_PYTHON"
    fi
  578. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:142:3

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    pip_install() {
      $VENV_PYTHON -m pip install "$@"
    }
    likely benign LLM, confidence 0.92 pip_install helper invokes the venv's Python interpreter via a variable.
    Reasoning

    VENV_PYTHON is set by the build script to a local interpreter path when the virtualenv is created. Calling it is the normal way to run pip inside that venv.

  579. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:155:3

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

      cd "$1"
      "${VENV_PYTHON}" -m pip install --no-deps --no-build-isolation .
      cd "${workdir}"
    }
    likely benign LLM, confidence 0.92 Installs a Python package into the test venv using the VENV_PYTHON variable.
    Reasoning

    Standard use of the venv interpreter variable to run pip install from a package directory in a CI test helper.

  580. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:163:3

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

      cd "$1"
      "${VENV_PYTHON}" -m pip install --no-build-isolation .
      cd "${workdir}"
    }
    likely benign LLM, confidence 0.92 Installs a package with pip in the venv using VENV_PYTHON.
    Reasoning

    Same benign venv pip invocation as the other build_python.sh findings, from a standard CI build script.

  581. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:172:9

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    if [ "$("$VENV_PYTHON" -c "import sys; print(sys.version_info[0])")" == "2" ]
    then
      pip_install --upgrade futures enum34
    likely benign LLM, confidence 0.92 Queries the venv Python version to decide whether to install legacy backports.
    Reasoning

    The check runs the venv interpreter to read its major version, a routine Python 2/3 detection step in a build script.

  582. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:179:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    $VENV_PYTHON "$ROOT/tools/distrib/python/make_grpcio_tools.py"
    pip_install_dir_and_deps "$ROOT/tools/distrib/python/grpcio_tools"
    likely benign LLM, confidence 0.92 Runs make_grpcio_tools.py with the venv Python before packaging.
    Reasoning

    Runs the grpc code generator script with the venv interpreter, a normal build step with no hidden behavior.

  583. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:187:3

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    else
      $VENV_PYTHON "$ROOT/src/python/grpcio_observability/make_grpcio_observability.py"
      pip_install_dir_and_deps "$ROOT/src/python/grpcio_observability"
      pip_install_dir_and_deps "$ROOT/src/python/grpcio_csm_observability"
    likely benign LLM, confidence 0.92 Generates grpcio_observability sources using VENV_PYTHON.
    Reasoning

    Runs the observability code generator with the venv interpreter, consistent with the rest of the build script.

  584. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:193:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Build/install Channelz
    $VENV_PYTHON "$ROOT/src/python/grpcio_channelz/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_channelz/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_channelz"
    likely benign LLM, confidence 0.92 Preprocesses and builds grpcio_channelz protos with VENV_PYTHON.
    Reasoning

    Runs setup.py preprocess and build steps for grpcio_channelz with the venv interpreter, the normal packaging flow.

  585. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:194:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    $VENV_PYTHON "$ROOT/src/python/grpcio_channelz/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_channelz/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_channelz"
    likely benign LLM, confidence 0.92 Runs the grpcio_channelz setup.py preprocess step via VENV_PYTHON.
    Reasoning

    Same setup.py preprocess and build sequence as the previous finding, with the same benign packaging purpose.

  586. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:198:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Build/install health checking
    $VENV_PYTHON "$ROOT/src/python/grpcio_health_checking/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_health_checking/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_health_checking"
    likely benign LLM, confidence 0.90 Runs the grpcio_health_checking setup.py through an interpreter variable chosen by the build script.
    Reasoning

    The variable $VENV_PYTHON names a Python interpreter in a gRPC build helper that runs setup.py preprocess and build steps. Resolving the interpreter from the environment or a venv path is a standard build pattern, and the command is a project-local setup script, not a payload fetched from elsewhere.

  587. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:199:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    $VENV_PYTHON "$ROOT/src/python/grpcio_health_checking/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_health_checking/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_health_checking"
    likely benign LLM, confidence 0.90 Invokes the health-checking package build via the venv Python variable.
    Reasoning

    Same pattern as the neighbouring lines: $VENV_PYTHON runs the project's own setup.py for grpcio_health_checking to build protos. The variable indirection only reflects the chosen virtualenv interpreter.

  588. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:203:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Build/install reflection
    $VENV_PYTHON "$ROOT/src/python/grpcio_reflection/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_reflection/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_reflection"
    likely benign LLM, confidence 0.90 Runs the grpcio_reflection setup.py using the venv interpreter variable.
    Reasoning

    The reflection package build uses $VENV_PYTHON to run its own setup.py for preprocessing and proto generation. This is ordinary repository build tooling with no network fetch or decoding involved.

  589. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:204:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    $VENV_PYTHON "$ROOT/src/python/grpcio_reflection/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_reflection/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_reflection"
    likely benign LLM, confidence 0.90 Builds grpcio_reflection protos by invoking setup.py through the venv interpreter variable.
    Reasoning

    The line runs the grpcio_reflection setup.py build_package_protos step through $VENV_PYTHON. This is a normal local build step in a known project file.

  590. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:208:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # Build/install status proto mapping
    $VENV_PYTHON "$ROOT/src/python/grpcio_status/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_status/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_status"
    likely benign LLM, confidence 0.90 Runs the grpcio_status setup.py via the venv Python variable during the build.
    Reasoning

    The grpcio_status setup.py is run through $VENV_PYTHON for preprocessing and proto building. The indirection is the only AST signal, and the target is a repository-local build script.

  591. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:209:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    $VENV_PYTHON "$ROOT/src/python/grpcio_status/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_status/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_status"
    likely benign LLM, confidence 0.90 Builds grpcio_status protos through the venv interpreter variable.
    Reasoning

    This is the build_package_protos step for grpcio_status, executed through $VENV_PYTHON on a repository setup.py. Nothing in the snippet is obfuscated or malicious.

  592. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:232:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    $VENV_PYTHON "$ROOT/src/python/grpcio_tests/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_tests/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_tests"
    likely benign LLM, confidence 0.90 Runs the grpcio_tests setup.py through the venv interpreter variable.
    Reasoning

    $VENV_PYTHON runs the grpcio_tests setup.py for preprocessing and proto generation. This matches the other build lines in the same script and is routine test-package tooling.

  593. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/build_python.sh:233:1

    command name is a variable (`$VENV_PYTHON`) and `VENV_PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    $VENV_PYTHON "$ROOT/src/python/grpcio_tests/setup.py" preprocess
    $VENV_PYTHON "$ROOT/src/python/grpcio_tests/setup.py" build_package_protos
    pip_install_dir "$ROOT/src/python/grpcio_tests"
    likely benign LLM, confidence 0.90 Builds grpcio_tests protos using the venv Python variable.
    Reasoning

    The build_package_protos call for grpcio_tests goes through $VENV_PYTHON on a repository file. The dynamic command name only reflects interpreter selection.

  594. info critical → info by review dynamic-execution tools/run_tests/helper_scripts/run_python.sh:27:1

    command name is a variable (`$PYTHON`) and `PYTHON` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    # TODO(ssreenithi): find pyproject.toml/pytest equivalent
    $PYTHON "$ROOT/src/python/grpcio_tests/setup.py" "$2"
    
    mkdir -p "$ROOT/reports"
    likely benign LLM, confidence 0.88 Runs the grpcio_tests setup.py test entry point with an interpreter chosen at runtime.
    Reasoning

    $PYTHON is set to an interpreter in a test-runner helper and then runs the repository's grpcio_tests setup.py with a test argument. Selecting the interpreter at runtime is normal for cross-platform test scripts.

  595. info critical → info by review dynamic-execution tools/run_tests/performance/build_performance.sh:76:5

    command name is a variable (`$bazel`) and `bazel` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

      "python")
        $bazel build -c opt //src/python/grpcio_tests/tests/qps:qps_worker
        ;;
      "python_asyncio")
    likely benign LLM, confidence 0.88 Builds the Python QPS worker with Bazel via a variable-named binary.
    Reasoning

    In a case branch for the python benchmark, $bazel is the Bazel binary found by the script, used to build the qps_worker target. Storing the tool path in a variable is a common build-script pattern and the target is a project path.

  596. info critical → info by review dynamic-execution tools/run_tests/performance/build_performance.sh:79:5

    command name is a variable (`$bazel`) and `bazel` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

      "python_asyncio")
        $bazel build -c opt //src/python/grpcio_tests/tests_aio/benchmark:worker
        ;;
      *)
    likely benign LLM, confidence 0.88 Builds the asyncio benchmark worker with Bazel through a variable-named binary.
    Reasoning

    The python_asyncio branch runs $bazel to build the aio benchmark worker target inside the repository. This is ordinary performance-test build logic with no download or decode step.

  597. command name is a variable (`$LOADTEST_CONFIG`) that this file sets only to plain text (ast pass, confidence 0.40)

        local -r language="$(example_language "${outputfile}")"
        ${LOADTEST_CONFIG} \
            -l "${language}" \
            -t ./tools/run_tests/performance/templates/loadtest_template_basic_all_languages.yaml \
  598. command name is a variable (`$LOADTEST_CONFIG`) that this file sets only to plain text (ast pass, confidence 0.40)

        local -r language="$(example_language "${outputfile}")"
        ${LOADTEST_CONFIG} \
            -l "${language}" \
            -t ./tools/run_tests/performance/templates/loadtest_template_prebuilt_all_languages.yaml \
  599. command name is a variable (`$LOADTEST_CONFIG`) that this file sets only to plain text (ast pass, confidence 0.40)

        local -r language="$(example_language "${outputfile}")"
        ${LOADTEST_CONFIG} \
            -l "${language}" \
            -t ./tools/run_tests/performance/templates/loadtest_template_psm_"${uniquifier}"_basic_all_languages.yaml \
  600. command name is a variable (`$LOADTEST_CONFIG`) that this file sets only to plain text (ast pass, confidence 0.40)

        local -r language="$(example_language "${outputfile}")"
        ${LOADTEST_CONFIG} \
            -l "${language}" \
            -t ./tools/run_tests/performance/templates/loadtest_template_psm_"${uniquifier}"_prebuilt_all_languages.yaml \
  601. info critical → info by review destructive-command-payload tools/run_tests/performance/remote_host_prepare.sh:30:23

    string literal contains recursive home deletion (rm -rf ~/) (ast pass, confidence 0.92)

    # cleanup after previous builds
    ssh "${USER_AT_HOST}" "rm -rf ~/performance_workspace && mkdir -p ~/performance_workspace"
    
    # push the current sources to the worker and unpack it.
    likely benign LLM, confidence 0.85 Remote SSH command that clears and recreates a performance workspace directory before pushing sources.
    Reasoning

    The flagged string removes ~/performance_workspace on a remote benchmark worker and then recreates it. The scanner's 'home deletion' wording overstates this: it targets one project-specific directory, not the home directory itself, and it is a normal pre-build cleanup step.

  602. info critical → info by review dynamic-execution tools/run_tests/performance/run_worker_go.sh:23:1

    command name is a variable (`$GOPATH`) and `GOPATH` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    
    "${GOPATH}/bin/worker" "$@"
    dismissed LLM, confidence 0.85 Wrapper that executes the Go worker binary located under $GOPATH/bin.
    Reasoning

    GOPATH is set from the Go toolchain environment, and the script runs the worker binary under it. This is the usual way to launch a locally built Go binary in a test harness.

  603. info critical → info by review dynamic-execution tools/run_tests/python_utils/dockerjob.py:53:22

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

            try:
                output = subprocess.check_output(
                    "docker port %s %s" % (cid, port), stderr=_DEVNULL, shell=True
                ).decode()
    likely benign LLM, confidence 0.80 Test helper that queries the host port mapped to a Docker container.
    Reasoning

    The shell=True call formats a container ID and port from internal test-harness values into a docker port query. It is a shell-injection hazard in principle, but the inputs are not attacker-controlled and the purpose is ordinary.

  604. info critical → info by review dynamic-execution tools/run_tests/python_utils/dockerjob.py:70:22

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

            try:
                output = subprocess.check_output(
                    cmd, stderr=_DEVNULL, shell=True
                ).decode()
    likely benign LLM, confidence 0.75 Test helper that runs a constructed docker command through the shell.
    Reasoning

    A shell=True call on a constructed command in a test-orchestration helper. The command comes from the harness itself, so this is a code-quality concern rather than evidence of obfuscation or malice.

  605. info critical → info by review dynamic-execution tools/run_tests/run_tests.py:72:9

    `subprocess.check_output` with `shell=True` and a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

        try:
            subprocess.check_output(cmd, shell=True, env=env, cwd=cwd)
        except subprocess.CalledProcessError as e:
            logging.exception(
    likely benign LLM, confidence 0.80 Test runner helper that executes shell commands with a custom environment and working directory.
    Reasoning

    The main test runner executes build and test commands through the shell. Running shell commands is its job, and the command strings are generated locally by the repository's own tooling.

  606. info critical → info by review dynamic-execution tools/run_tests/sanity/check_bazel_workspace.py:173:1

    `exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)

    }
    exec((bazel_file), build_rules)
    grpc_dep_names_set = set(_GRPC_DEP_NAMES)
    names_set = set(names_and_urls.keys())
    likely benign LLM, confidence 0.70 Sanity check that execs repository Bazel files to collect dependency rule names.
    Reasoning

    The sanity checker exec's BUILD and bzl files from the repository to extract rule definitions. Executing repo files at module scope is unusual, but the sources are in-tree and the purpose is static consistency checking, not hiding behavior.

  607. info critical → info by review dynamic-execution tools/run_tests/sanity/check_bazel_workspace.py:231:5

    `exec` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)

        }
        exec((bazel_file), rules)
        assert name not in list(names_and_urls_with_overridden_name.keys())
    likely benign LLM, confidence 0.70 Sanity check that execs a repository Bazel file to validate overridden dependency names.
    Reasoning

    Same pattern as the earlier exec: it evaluates an in-repo Bazel file to inspect rule names and overrides. The code is part of the repository's own validation logic.

  608. info critical → info by review dynamic-execution tools/run_tests/sanity/check_buildifier.sh:19:1

    command name is a variable (`$GIT_ROOT`) and `GIT_ROOT` is assigned the output of a command — executed command determined at runtime (ast pass, confidence 0.90)

    GIT_ROOT="$(dirname "$0")/../../.."
    "$GIT_ROOT/tools/distrib/buildifier_format_code.sh" -mode=diff -lint warn
    result=$?
    dismissed LLM, confidence 0.85 Sanity script that runs the in-repo buildifier formatting helper, with its path derived from the script location.
    Reasoning

    GIT_ROOT is derived from the script's own location with dirname, giving a relative repo path. The script then runs the buildifier helper bundled in the repository. Nothing here is fetched or decoded at runtime.

  609. info critical → info by review dynamic-execution tools/run_tests/sanity/check_deprecated_grpc++.py:172:13

    `os.system` called on a non-literal command — runtime-determined shell invocation (ast pass, confidence 0.85)

    
        if 0 != os.system("diff %s %s" % (path_file_expected, path_file)):
            print(("Difference found in file:", path_file))
            errors += 1
    likely benign LLM, confidence 0.80 Sanity check that shells out to diff to compare expected and generated files.
    Reasoning

    The script runs diff between an expected and an actual file path, both produced by the sanity check. Using os.system here is weak style but not malicious.

  610. info critical → info by review dynamic-execution tools/run_tests/sanity/check_package_name.py:60:12

    `eval` at module scope (runs on import) on a non-literal expression (ast pass, confidence 0.80)

        # it's a python statement, so evaluate it to pull out the name of the package
        name = eval(
            text[pkg_start:pkg_end], {"grpc_package": lambda name, **kwargs: name}
        )
    likely benign LLM, confidence 0.70 Sanity check that evaluates the package declaration in a BUILD file to read the package name.
    Reasoning

    eval runs on a slice of an in-repo BUILD file to extract a package name. The globals dict does not sandbox builtins, so it is not a real restriction, but the input is a repository file and the purpose is ordinary.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/grpc/grpc grpc && cd grpc
git checkout v1.84.0
disclude scan --severity info --diff v1.83.1 .