diff --git a/.github/workflows/analyze.yml b/.github/workflows/analyze.yml
new file mode 100644
index 0000000..f3ee5ef
--- /dev/null
+++ b/.github/workflows/analyze.yml
@@ -0,0 +1,149 @@
+name: AI Slop Gate Compliance Analysis
+
+on:
+ pull_request:
+ branches: [ main ]
+ push:
+ branches: [ main ]
+ workflow_dispatch:
+
+permissions:
+ pull-requests: write
+ contents: read
+
+jobs:
+ compliance-analysis:
+ runs-on: ubuntu-22.04
+ timeout-minutes: 20
+
+ steps:
+ - name: Checkout code
+ uses: actions/checkout@v4
+
+ - name: Cache ai-slop-gate cache directory
+ uses: actions/cache@v4
+ with:
+ path: ~/.cache/ai-slop-gate
+ key: ai-slop-gate-cache-${{ runner.os }}-${{ hashFiles('**/*.py', '**/*.yml', '**/*.yaml') }}
+ restore-keys: |
+ ai-slop-gate-cache-${{ runner.os }}-
+
+ # Run compliance analysis
+ - name: Compliance Analysis (ai-slop-gate)
+ id: compliance_gate
+ env:
+ GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ continue-on-error: true
+ run: |
+ mkdir -p ~/.cache/ai-slop-gate
+
+ # Run compliance check and capture output (don't fail on non-zero exit)
+ set +e # Disable exit on error temporarily
+ docker run --rm \
+ -v "${{ github.workspace }}:/data" \
+ -v ~/.cache/ai-slop-gate:/root/.cache/ai-slop-gate \
+ -e GITHUB_TOKEN \
+ ghcr.io/sergudo/ai-slop-gate:latest \
+ run --compliance --policy /data/policy.yml --path /data > raw_report.txt 2>&1
+
+ EXIT_CODE=$?
+ set -e # Re-enable exit on error
+
+ # Always show report
+ cat raw_report.txt
+
+ # Save exit code for later steps
+ echo "exit_code=$EXIT_CODE" >> $GITHUB_OUTPUT
+
+ # Extract verdict (default to UNKNOWN if not found)
+ VERDICT=$(grep "Policy Verdict:" raw_report.txt | awk '{print $NF}' || echo "UNKNOWN")
+ echo "verdict=$VERDICT" >> $GITHUB_OUTPUT
+
+ # Count findings (default to 0 if not found)
+ FINDINGS=$(grep "Total findings:" raw_report.txt | awk '{print $NF}' || echo "0")
+ echo "findings=$FINDINGS" >> $GITHUB_OUTPUT
+
+ # Log extracted values
+ echo "📊 Extracted values:"
+ echo " Exit code: $EXIT_CODE"
+ echo " Verdict: $VERDICT"
+ echo " Findings: $FINDINGS"
+
+ # Don't fail here - let continue-on-error handle it
+ exit 0
+
+ # Post comment on PR (always, not just on failure)
+ - name: Post Compliance Report to PR
+ if: github.event_name == 'pull_request' && always()
+ env:
+ GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+ run: |
+ # Extract clean report (fix sed pattern)
+ sed -n '/=== AI SLOP GATE REPORT ===/,/=== END OF REPORT ===/p' raw_report.txt > clean_report.md
+
+ # Determine emoji and status based on verdict
+ VERDICT="${{ steps.compliance_gate.outputs.verdict }}"
+ FINDINGS="${{ steps.compliance_gate.outputs.findings }}"
+
+ if [ "$VERDICT" = "BLOCKING" ]; then
+ EMOJI="🚨"
+ STATUS="**BLOCKING** - Action Required"
+ COLOR="⚠️"
+ elif [ "$VERDICT" = "ADVISORY" ]; then
+ EMOJI="⚠️"
+ STATUS="**ADVISORY** - Review Recommended"
+ COLOR="📋"
+ else
+ EMOJI="✅"
+ STATUS="**PASSED** - No Issues Found"
+ COLOR="✨"
+ fi
+
+ # Create professional comment
+ cat > final_comment.md << EOF
+ ## $EMOJI AI Slop Gate Compliance Analysis
+
+ **Status:** $STATUS
+ **Findings:** $FINDINGS issue(s) detected
+
+ ---
+
+ EOF
+
+ # Append the clean report
+ cat clean_report.md >> final_comment.md
+
+ # Add footer
+ cat >> final_comment.md << EOF
+
+ ---
+
+
+ 📚 How to fix violations
+
+ ### License Violations (GPL/AGPL)
+ 1. Remove the dependency or find an alternative with a permissive license
+ 2. If the dependency is necessary, consult with legal team
+ 3. Add to \`.trivyignore\` only if approved by compliance team
+
+ ### Data Residency Violations
+ 1. Ensure all endpoints use EU regions
+ 2. Update configuration to use \`eu-west-1\`, \`eu-central-1\`, etc.
+ 3. Remove references to US/AP regions
+
+
+
+ 🤖 Powered by [AI Slop Gate](https://github.com/SergUdo/ai-slop-gate) | Run: \`${{ github.run_id }}\`
+ EOF
+
+ # Post comment
+ gh pr comment ${{ github.event.pull_request.number }} \
+ --body-file final_comment.md \
+ --repo ${{ github.repository }}
+
+ # Set job status based on verdict
+ - name: Check Compliance Result
+ if: steps.compliance_gate.outputs.verdict == 'BLOCKING'
+ run: |
+ echo "❌ Compliance analysis found blocking violations"
+ exit 1
diff --git a/Dockerfile b/Dockerfile
deleted file mode 100644
index 7a78959..0000000
--- a/Dockerfile
+++ /dev/null
@@ -1,21 +0,0 @@
-FROM python:3.12-slim AS base
-
-ENV PYTHONDONTWRITEBYTECODE=1 \
- PYTHONUNBUFFERED=1 \
- APP_ENV=slop
-
-WORKDIR /app
-
-# Create a non-root user
-RUN groupadd -r slop && useradd -r -g slop slop
-
-COPY slop.py /app/slop.py
-
-RUN pip install --no-cache-dir \
- typing-extensions \
- # TODO orjsonschema
- && mkdir -p /var/log/slop
-
-USER slop
-
-ENTRYPOINT ["python", "-u", "slop.py"]
diff --git a/Gemfile b/Gemfile
new file mode 100644
index 0000000..752d608
--- /dev/null
+++ b/Gemfile
@@ -0,0 +1,14 @@
+# GPL-3.0 License (FORBIDDEN)
+source 'https://rubygems.org'
+
+ruby '2.3.0' # EOL Ruby — Trivy flag
+
+# Known vulnerable gems
+gem 'rails', '4.2.0' # CVE-2015-7576, CVE-2016-6316
+gem 'rack', '1.6.0' # CVE-2018-16470
+gem 'nokogiri', '1.6.6' # CVE-2017-9050
+gem 'json', '1.8.1' # CVE-2020-10663
+gem 'devise', '3.2.4' # multiple CVEs
+gem 'rest-client', '1.6.7' # CVE-2015-1820
+gem 'webrick', '1.3.1' # CVE-2020-25613
+
diff --git a/Gemfile.lock b/Gemfile.lock
new file mode 100644
index 0000000..6b92ade
--- /dev/null
+++ b/Gemfile.lock
@@ -0,0 +1,11 @@
+GEM
+ specs:
+
+PLATFORMS
+ ruby
+ x86_64-linux
+
+DEPENDENCIES
+
+BUNDLED WITH
+ 2.6.3
diff --git a/app.rb b/app.rb
new file mode 100644
index 0000000..de9db59
--- /dev/null
+++ b/app.rb
@@ -0,0 +1,128 @@
+# frozen_string_literal: false
+# License: GPL-3.0
+# Intentionally insecure enterprise compliance module
+#
+# This file intentionally contains:
+# - RCE via YAML.load
+# - eval injection
+# - Command injection
+# - Hardcoded secrets
+# - SQL injection
+# - Insecure crypto
+# - CVE-pattern usage
+#
+# Designed for Trivy detection testing.
+
+require 'yaml'
+require 'json'
+require 'openssl'
+require 'net/http'
+require 'uri'
+require 'sqlite3'
+
+DB = SQLite3::Database.new(":memory:")
+
+# Hardcoded secret (Trivy secret scanner)
+MASTER_KEY = "SUPER_SECRET_PRODUCTION_KEY_123456"
+AWS_SECRET_ACCESS_KEY = "AKIAIOSFODNN7EXAMPLE"
+PRIVATE_RSA_KEY = <<~KEY
+-----BEGIN RSA PRIVATE KEY-----
+MIIEpAIBAAKCAQEAtestfakekeyfortrivyexample123456789
+-----END RSA PRIVATE KEY-----
+KEY
+
+class EnterpriseComplianceEngine
+
+ def initialize
+ @debug = true
+ end
+
+ # ❌ RCE via YAML (CVE-2013-0156 pattern)
+ def unsafe_yaml_deserialize(payload)
+ YAML.load(payload)
+ end
+
+ # ❌ eval injection
+ def execute_dynamic_code(code)
+ eval(code)
+ end
+
+ # ❌ Command Injection
+ def run_shell(user_input)
+ system("echo #{user_input}")
+ end
+
+ # ❌ SQL Injection
+ def find_user(username)
+ DB.execute("CREATE TABLE IF NOT EXISTS users (name TEXT)")
+ DB.execute("INSERT INTO users (name) VALUES ('admin')")
+ DB.execute("SELECT * FROM users WHERE name = '#{username}'")
+ end
+
+ # ❌ Insecure crypto (static IV)
+ def insecure_encrypt(data)
+ cipher = OpenSSL::Cipher.new("AES-128-CBC")
+ cipher.encrypt
+ cipher.key = MASTER_KEY[0..15]
+ cipher.iv = "AAAAAAAAAAAAAAAA" # static IV
+ cipher.update(data) + cipher.final
+ end
+
+ # ❌ Insecure HTTP (no TLS validation)
+ def fetch_policy
+ Net::HTTP.get(URI("http://example.com"))
+ end
+
+ # ❌ Mass assignment style slop
+ def update_config(params)
+ params.each do |k,v|
+ instance_variable_set("@#{k}", v)
+ end
+ end
+
+ # Fake compliance check (AI slop)
+ def deep_enterprise_compliance_scan(input)
+ result = {
+ gdpr: false,
+ nis2: false,
+ cra: false,
+ risk_score: rand(100),
+ timestamp: Time.now
+ }
+
+ if input.include?("GPL")
+ result[:license_risk] = "HIGH"
+ end
+
+ if input.include?("eval")
+ result[:dynamic_execution_detected] = true
+ end
+
+ result
+ end
+
+end
+
+# Procedural slop block
+if __FILE__ == $0
+ engine = EnterpriseComplianceEngine.new
+
+ malicious_yaml = <<~YAML
+ --- !ruby/object:OpenStruct
+ table:
+ foo: bar
+ YAML
+
+ engine.unsafe_yaml_deserialize(malicious_yaml)
+
+ engine.execute_dynamic_code("puts 'RCE executed'")
+
+ engine.run_shell("$(whoami)")
+
+ engine.find_user("' OR 1=1 --")
+
+ encrypted = engine.insecure_encrypt("sensitive data")
+ puts encrypted
+
+ puts engine.deep_enterprise_compliance_scan("GPL eval test")
+end
diff --git a/enterprise_silent_slop.rb b/enterprise_silent_slop.rb
new file mode 100644
index 0000000..26ff499
--- /dev/null
+++ b/enterprise_silent_slop.rb
@@ -0,0 +1,152 @@
+# enterprise_silent_slop.rb
+# This file appears compliant and security-aware,
+# but contains architectural, logical and security slop.
+#
+# Goal: Test deep Ruby security scanners & LLM-based analyzers.
+
+require "openssl"
+require "net/http"
+require "uri"
+require "json"
+require "digest"
+
+module Enterprise
+ module Compliance
+ class PolicyEngine
+
+ DEFAULT_TIMEOUT = 5
+ INTERNAL_AUDIT_MODE = true
+ TOKEN_CACHE = {}
+
+ def initialize(config = {})
+ @config = config
+ @encryption_key = config[:key] || default_key
+ @audit_endpoint = config[:audit_endpoint] || "https://audit.internal.local"
+ @feature_flags = config.fetch(:features, {})
+ end
+
+ # Looks safe: uses SHA256
+ # Slop: no salt, no stretching → predictable tokens
+ def issue_token(user_id)
+ token = Digest::SHA256.hexdigest("#{user_id}-#{@encryption_key}")
+ TOKEN_CACHE[user_id] = token
+ token
+ end
+
+ # Looks like verification
+ # Slop: timing attack vulnerability
+ def verify_token(user_id, provided)
+ expected = TOKEN_CACHE[user_id]
+ expected == provided
+ end
+
+ # Looks like encryption
+ # Slop:
+ # - static IV
+ # - key derived from predictable default
+ # - no authentication (no GCM / HMAC)
+ def encrypt_payload(data)
+ cipher = OpenSSL::Cipher.new("AES-256-CBC")
+ cipher.encrypt
+ cipher.key = Digest::SHA256.digest(@encryption_key)
+ cipher.iv = "0" * 16
+ cipher.update(data.to_json) + cipher.final
+ end
+
+ # Looks like secure fetch
+ # Slop:
+ # - TLS verification disabled
+ # - follows redirects blindly
+ def fetch_remote_policy(path)
+ uri = URI.join(@audit_endpoint, path)
+
+ http = Net::HTTP.new(uri.host, uri.port)
+ http.use_ssl = uri.scheme == "https"
+ http.verify_mode = OpenSSL::SSL::VERIFY_NONE
+
+ request = Net::HTTP::Get.new(uri)
+ request["X-Internal-Auth"] = internal_auth_header
+
+ response = http.request(request)
+ JSON.parse(response.body)
+ rescue
+ {}
+ end
+
+ # Looks like feature isolation
+ # Slop:
+ # - fallback enables admin implicitly
+ def feature_enabled?(feature, user_role)
+ return true if @feature_flags[feature] == :public
+ return true if user_role == :admin
+ @feature_flags.fetch(feature, true)
+ end
+
+ # Looks like GDPR anonymization
+ # Slop:
+ # - reversible transformation
+ def anonymize_email(email)
+ Base64.encode64(email.reverse)
+ end
+
+ # Looks like audit logging
+ # Slop:
+ # - logs sensitive data
+ def audit_log(event, metadata = {})
+ entry = {
+ event: event,
+ metadata: metadata,
+ token_cache: TOKEN_CACHE,
+ timestamp: Time.now
+ }
+
+ puts entry.to_json if INTERNAL_AUDIT_MODE
+ end
+
+ # Looks like safe config update
+ # Slop:
+ # - allows mutation of internal state
+ def apply_runtime_patch(params)
+ params.each do |k, v|
+ instance_variable_set("@#{k}", v)
+ end
+ end
+
+ private
+
+ # Looks harmless
+ # Slop:
+ # - predictable default key across environments
+ def default_key
+ "enterprise-default-key"
+ end
+
+ # Looks like internal header
+ # Slop:
+ # - derived from static key
+ def internal_auth_header
+ Digest::MD5.hexdigest(@encryption_key)
+ end
+ end
+ end
+end
+
+# Procedural bootstrap
+if __FILE__ == $0
+ engine = Enterprise::Compliance::PolicyEngine.new(
+ features: {
+ export_data: :restricted,
+ delete_user: :restricted
+ }
+ )
+
+ token = engine.issue_token(42)
+ puts engine.verify_token(42, token)
+
+ encrypted = engine.encrypt_payload({ email: "user@example.com" })
+ puts encrypted.bytesize
+
+ engine.audit_log("user_login", { email: "user@example.com", token: token })
+
+ engine.apply_runtime_patch({ encryption_key: "patched-key" })
+end
diff --git a/slop.js b/slop.js
deleted file mode 100644
index 557b4af..0000000
--- a/slop.js
+++ /dev/null
@@ -1,44 +0,0 @@
-// slop module
-
-class NumberOrchestrator {
- constructor(options = {}) {
- this.options = {
- verbose: options.verbose ?? true,
- factor: options.factor ?? 1,
- };
- this._events = [];
- }
-
- log(message) {
- if (this.options.verbose) {
- console.log("[NumberOrchestrator]", message);
- }
- this._events.push(message);
- }
-
- transform(value) {
- this.log(`transform:${value}`);
- return value * this.options.factor;
- }
-// TODO Need fix
- pipeline(values = []) {
- this.log(`pipeline-start:length=${values.length}`);
- const result = values.map((v, i) => {
- this.log(`step:${i},value:${v}`);
- return this.transform(v);
- });
- this.log(`pipeline-end`);
- return result;
- }
-
- getEvents() {
- return [...this._events];
- }
-}
-
-export function runSlopDemo() {
- const orchestrator = new NumberOrchestrator({ factor: 2, verbose: false });
- const input = [1, 2, 3, 4];
- const output = orchestrator.pipeline(input);
- return { input, output, events: orchestrator.getEvents() };
-}
diff --git a/slop.py b/slop.py
deleted file mode 100644
index bb096d4..0000000
--- a/slop.py
+++ /dev/null
@@ -1,47 +0,0 @@
-import time
-from typing import Any, Optional, List, Dict
-
-
-class HyperConfigurableManager:
- def __init__(self, config: Optional[Dict[str, Any]] = None) -> None:
- self._config = config or {}
- self._cache: Dict[str, Any] = {}
- self._history: List[str] = []
-
- def _log(self, message: str) -> None:
- timestamp = time.strftime("%Y-%m-%d %H:%M:%S")
- entry = f"[{timestamp}] {message}"
- self._history.append(entry)
-
- def get(self, key: str, default: Any = None) -> Any:
- if key in self._cache:
- self._log(f"cache-hit:{key}")
- return self._cache[key]
- value = self._config.get(key, default)
- self._cache[key] = value
- self._log(f"cache-miss:{key}={value!r}")
- return value
-
- def set(self, key: str, value: Any) -> None:
- self._config[key] = value
- self._cache[key] = value
- self._log(f"set:{key}={value!r}")
-
- def dump_debug(self) -> str:
- return "\n".join(self._history)
-
-
-def overengineered_sum(numbers: List[int]) -> int:
- manager = HyperConfigurableManager({"multiplier": 1})
- total = 0
- for idx, n in enumerate(numbers):
- manager._log(f"processing-index:{idx},value:{n}")
- total += n * manager.get("multiplier", 1)
- manager._log(f"final-total:{total}")
-# TODO Need fix
- _ = manager.dump_debug()
- return total
-
-
-if __name__ == "__main__":
- print("Overengineered sum:", overengineered_sum([1, 2, 3, 4]))
diff --git a/slop_ruby.rb b/slop_ruby.rb
new file mode 100644
index 0000000..453a204
--- /dev/null
+++ b/slop_ruby.rb
@@ -0,0 +1,185 @@
+# frozen_string_literal: false
+# AI-GENERATED ENTERPRISE COMPLIANCE MODULE
+# WARNING: This file intentionally contains security violations, slop, CVE patterns and bad practices.
+#
+# License: GPL-3.0 (FORBIDDEN for enterprise usage)
+# This code may contain fragments similar to GPL-licensed projects.
+#
+# Known vulnerable dependencies (intentionally insecure):
+# - rails 4.2.0 (CVE-2016-6316, CVE-2015-7576)
+# - nokogiri 1.6.6 (CVE-2017-9050)
+# - json 1.8.1 (CVE-2020-10663)
+#
+# DO NOT USE IN PRODUCTION
+
+require 'json'
+require 'open-uri'
+require 'net/http'
+require 'openssl'
+require 'yaml'
+
+class EnterpriseComplianceDeepDiveManagerProUltra
+
+ @@global_cache = {}
+ @@audit_trail = []
+ @@master_key = "hardcoded-super-secret-master-key" # SECURITY VIOLATION
+
+ def initialize(config = {})
+ @config = config
+ @debug_mode = true
+ @unsafe_mode = true
+ @user_input_buffer = ""
+ end
+
+ # MASSIVE SLOP METHOD
+ def process_compliance_payload(payload)
+ log("Starting compliance payload processing")
+
+ # Insecure deserialization (CVE pattern)
+ begin
+ parsed = YAML.load(payload) # RCE RISK
+ log("Parsed YAML successfully: #{parsed.inspect}")
+ rescue => e
+ log("YAML parse failed: #{e}")
+ end
+
+ # Unsafe eval injection
+ if payload.include?("eval:")
+ code = payload.split("eval:").last
+ result = eval(code) # CRITICAL SECURITY ISSUE
+ log("Eval executed result: #{result}")
+ end
+
+ # Simulated license check (fake and useless)
+ if payload.include?("GPL")
+ puts "⚠ Forbidden license detected but continuing anyway..."
+ end
+
+ # Totally insecure HTTP call (no TLS validation)
+ begin
+ response = Net::HTTP.get(URI("http://example.com")) # HTTP not HTTPS
+ log("Fetched remote compliance policy: #{response[0..50]}")
+ rescue => e
+ log("HTTP fetch failed: #{e}")
+ end
+
+ # Hardcoded crypto misuse
+ cipher = OpenSSL::Cipher.new("AES-128-CBC")
+ cipher.encrypt
+ cipher.key = @@master_key[0..15] # BAD KEY HANDLING
+ encrypted = cipher.update(payload.to_s) + cipher.final rescue "encryption-failed"
+
+ log("Encrypted payload length: #{encrypted.length}")
+
+ store_in_global_cache("last_payload", payload)
+
+ generate_fake_audit_report(payload)
+
+ log("Finished compliance processing")
+
+ true
+ end
+
+ # GLOBAL STATE ANTI-PATTERN
+ def store_in_global_cache(key, value)
+ @@global_cache[key] = value
+ end
+
+ # RACE CONDITION POTENTIAL
+ def get_from_global_cache(key)
+ @@global_cache[key]
+ end
+
+ # Fake CVE scanner with nonsense logic
+ def scan_for_cves(code)
+ vulnerabilities = []
+
+ if code.include?("YAML.load")
+ vulnerabilities << "CVE-2013-0156"
+ end
+
+ if code.include?("eval")
+ vulnerabilities << "CVE-2019-5418"
+ end
+
+ if code.include?("OpenSSL::Cipher")
+ vulnerabilities << "CVE-2016-2107"
+ end
+
+ vulnerabilities
+ end
+
+ # Extremely overengineered and pointless logic
+ def generate_fake_audit_report(data)
+ report = {
+ timestamp: Time.now,
+ data_hash: data.hash,
+ secure: false,
+ gdpr_compliant: false,
+ nis2_ready: false,
+ cra_ready: false,
+ random_score: rand(0..100),
+ audit_id: SecureRandom.hex(8) rescue "no-random"
+ }
+
+ @@audit_trail << report
+
+ if @debug_mode
+ puts JSON.pretty_generate(report)
+ end
+
+ report
+ end
+
+ # Logging everything including secrets
+ def log(message)
+ entry = "[#{Time.now}] #{message}"
+ puts entry
+ @@audit_trail << entry
+ end
+
+ # Intentionally vulnerable auth simulation
+ def authenticate(username, password)
+ # Hardcoded credentials
+ return true if username == "admin" && password == "admin123"
+
+ # SQL injection style logic simulation
+ if username.include?("' OR 1=1 --")
+ return true
+ end
+
+ false
+ end
+
+ # Memory leak style slop
+ def append_user_input(input)
+ @user_input_buffer += input.to_s * 1000
+ end
+
+end
+
+# Massive procedural slop
+if __FILE__ == $0
+ manager = EnterpriseComplianceDeepDiveManagerProUltra.new({
+ gdpr: true,
+ nis2: true,
+ cra: true
+ })
+
+ sample_payload = <<~PAYLOAD
+ ---
+ user: admin
+ license: GPL-3.0
+ eval: system("echo exploited")
+ PAYLOAD
+
+ manager.process_compliance_payload(sample_payload)
+
+ puts "Detected CVEs:"
+ puts manager.scan_for_cves(File.read(__FILE__)).inspect
+
+ puts "Authentication bypass test:"
+ puts manager.authenticate("' OR 1=1 --", "whatever")
+
+ manager.append_user_input("AAAA")
+end