highflame-taxonomy 1.1.0__tar.gz

highflame_taxonomy-1.1.0/PKG-INFO

@@ -0,0 +1,20 @@
+Metadata-Version: 2.4
+Name: highflame-taxonomy
+Version: 1.1.0
+Summary: Unified vulnerability taxonomy with multi-framework compliance mappings (MITRE ATLAS, OWASP, NIST, EU AI Act, CWE)
+License: Apache-2.0
+Project-URL: Homepage, https://github.com/highflame-ai/highflame-taxonomy
+Project-URL: Repository, https://github.com/highflame-ai/highflame-taxonomy.git
+Keywords: taxonomy,vulnerability,compliance,owasp,mitre,nist,highflame
+Classifier: Development Status :: 4 - Beta
+Classifier: Intended Audience :: Developers
+Classifier: License :: OSI Approved :: Apache Software License
+Classifier: Programming Language :: Python :: 3
+Classifier: Programming Language :: Python :: 3.9
+Classifier: Programming Language :: Python :: 3.10
+Classifier: Programming Language :: Python :: 3.11
+Classifier: Programming Language :: Python :: 3.12
+Classifier: Programming Language :: Python :: 3.13
+Classifier: Typing :: Typed
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown

highflame_taxonomy-1.1.0/highflame_taxonomy/__init__.py

@@ -0,0 +1,15 @@
+# =============================================================================
+# Highflame Taxonomy — Python Package
+# =============================================================================
+"""
+Unified vulnerability taxonomy with multi-framework compliance mappings.
+
+All constants, dataclasses, and utility functions are re-exported from the
+generated taxonomy module. This package has zero external dependencies.
+
+Usage:
+    from highflame_taxonomy import VULN_PROMPT_INJECTION, VULNERABILITIES
+    from highflame_taxonomy import enrich_finding, compliance_matrix, recommend_domains
+"""
+
+from highflame_taxonomy.taxonomy import *  # noqa: F401, F403

highflame_taxonomy-1.1.0/highflame_taxonomy/compliance/eu-ai-act.json

@@ -0,0 +1,326 @@
+{
+  "framework": {
+    "id": "eu-ai-act",
+    "name": "EU Artificial Intelligence Act",
+    "version": "2024",
+    "url": "https://artificialintelligenceact.eu/",
+    "structure": "tiered"
+  },
+  "coverage": {
+    "totalItems": 17,
+    "covered": 17,
+    "partial": 0,
+    "uncovered": 0,
+    "coveragePercent": 100
+  },
+  "matrix": [
+    {
+      "itemId": "ART5_1",
+      "itemName": "Subliminal or Manipulative Techniques",
+      "itemDescription": "AI systems deploying subliminal techniques beyond a person's consciousness or purposefully manipulative/deceptive techniques that materially distort behaviour and cause significant harm",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "agent_trust",
+          "vulnerabilityName": "Human-Agent Trust Exploitation",
+          "severity": "medium",
+          "confidence": "partial",
+          "notes": "Different scope, ART5_1 applies to all AI systems beyond just agents."
+        },
+        {
+          "vulnerabilityId": "personal_safety",
+          "vulnerabilityName": "Personal Safety",
+          "severity": "critical",
+          "confidence": "partial",
+          "notes": "Persons may be at risk of self harm due to AI manipulation."
+        },
+        {
+          "vulnerabilityId": "subliminal_manipulation",
+          "vulnerabilityName": "Subliminal or Manipulative Techniques",
+          "severity": "critical",
+          "confidence": "exact"
+        }
+      ]
+    },
+    {
+      "itemId": "ART5_2",
+      "itemName": "Exploitation of Vulnerabilities",
+      "itemDescription": "AI systems exploiting vulnerabilities of natural persons due to age, disability, or social/economic situation to materially distort behaviour and cause significant harm",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "exploit_vulnerable",
+          "vulnerabilityName": "Exploitation of Vulnerabilities",
+          "severity": "critical",
+          "confidence": "exact"
+        }
+      ]
+    },
+    {
+      "itemId": "ART5_3",
+      "itemName": "Social Scoring",
+      "itemDescription": "AI systems evaluating or classifying natural persons based on social behaviour or personality characteristics leading to detrimental treatment in unrelated contexts or disproportionate to their behaviour",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "social_scoring",
+          "vulnerabilityName": "Social Scoring",
+          "severity": "critical",
+          "confidence": "exact"
+        }
+      ]
+    },
+    {
+      "itemId": "ART5_4",
+      "itemName": "Predictive Criminal Profiling",
+      "itemDescription": "AI systems making risk assessments to predict the risk of a natural person committing a criminal offence based solely on profiling or personality traits, without objective verifiable facts",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "criminal_profiling",
+          "vulnerabilityName": "Criminal Predictive Profiling",
+          "severity": "critical",
+          "confidence": "exact"
+        }
+      ]
+    },
+    {
+      "itemId": "ART5_5",
+      "itemName": "Facial Recognition Database Scraping",
+      "itemDescription": "AI systems that create or expand facial recognition databases through untargeted scraping of facial images from the internet or CCTV footage",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "facial_recognition",
+          "vulnerabilityName": "Facial Recognition Database Scraping",
+          "severity": "critical",
+          "confidence": "exact"
+        },
+        {
+          "vulnerabilityId": "pii_leakage",
+          "vulnerabilityName": "PII Leakage",
+          "severity": "high",
+          "confidence": "related",
+          "notes": "PII leakage could result from scraping internet/video footage for facial recognition training."
+        }
+      ]
+    },
+    {
+      "itemId": "ART5_6",
+      "itemName": "Emotion Inference in Workplace and Education",
+      "itemDescription": "AI systems used to infer emotions of natural persons in workplace or educational settings, except for medical or safety purposes",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "emotion_inference",
+          "vulnerabilityName": "Emotion Inference in Workplace and Education",
+          "severity": "critical",
+          "confidence": "exact"
+        }
+      ]
+    },
+    {
+      "itemId": "ART5_7",
+      "itemName": "Biometric Categorisation for Sensitive Attributes",
+      "itemDescription": "Biometric categorisation systems that deduce or infer race, political opinions, trade union membership, religious or philosophical beliefs, sex life, or sexual orientation from biometric data",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "biometric_categorisation",
+          "vulnerabilityName": "Biometric Categorisation for Sensitive Attributes",
+          "severity": "critical",
+          "confidence": "exact"
+        }
+      ]
+    },
+    {
+      "itemId": "ART5_8",
+      "itemName": "Real-Time Remote Biometric Identification",
+      "itemDescription": "Use of real-time remote biometric identification systems in publicly accessible spaces for law enforcement, except for targeted searches for victims of serious crimes, imminent safety threats, or suspects of offences carrying custodial sentences of at least four years",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "realtime_biometric_id",
+          "vulnerabilityName": "Real-Time Remote Biometric Identification",
+          "severity": "critical",
+          "confidence": "exact"
+        }
+      ]
+    },
+    {
+      "itemId": "ART6_1",
+      "itemName": "Biometrics",
+      "itemDescription": "AI systems for remote biometric identification (except for authentication purposes), biometric categorisation based on sensitive or protected attributes, and emotion recognition",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "biometric_systems",
+          "vulnerabilityName": "High-Risk Biometric AI Systems",
+          "severity": "high",
+          "confidence": "exact"
+        }
+      ]
+    },
+    {
+      "itemId": "ART6_2",
+      "itemName": "Critical Infrastructure",
+      "itemDescription": "AI systems used as safety components in the management and operation of critical digital infrastructure, road traffic, or supply of water, gas, heating, or electricity",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "critical_infrastructure_ai",
+          "vulnerabilityName": "Critical Infrastructure AI",
+          "severity": "high",
+          "confidence": "exact"
+        }
+      ]
+    },
+    {
+      "itemId": "ART6_3",
+      "itemName": "Education and Vocational Training",
+      "itemDescription": "AI systems determining access or admission to educational institutions, evaluating learning outcomes, assessing appropriate education levels, or monitoring and detecting prohibited student behaviour during tests",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "education_ai",
+          "vulnerabilityName": "Education and Vocational Training AI",
+          "severity": "high",
+          "confidence": "exact"
+        },
+        {
+          "vulnerabilityId": "bias",
+          "vulnerabilityName": "Bias",
+          "severity": "high",
+          "confidence": "related",
+          "notes": "Bias in educational AI systems leads to discriminatory access and assessment decisions"
+        }
+      ]
+    },
+    {
+      "itemId": "ART6_4",
+      "itemName": "Employment and Workers Management",
+      "itemDescription": "AI systems for recruitment and selection of natural persons, and systems making decisions affecting work-related terms, promotions, terminations, task allocation, or performance and behaviour monitoring",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "employment_ai",
+          "vulnerabilityName": "Employment and Workers Management AI",
+          "severity": "high",
+          "confidence": "exact"
+        },
+        {
+          "vulnerabilityId": "bias",
+          "vulnerabilityName": "Bias",
+          "severity": "high",
+          "confidence": "related",
+          "notes": "Bias in recruitment and employment AI can cause unlawful discrimination"
+        }
+      ]
+    },
+    {
+      "itemId": "ART6_5",
+      "itemName": "Essential Private and Public Services",
+      "itemDescription": "AI systems evaluating eligibility for public benefits and healthcare, assessing creditworthiness or credit scores, risk assessment and pricing for life and health insurance, and evaluating or dispatching emergency calls and first response services",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "bias",
+          "vulnerabilityName": "Bias",
+          "severity": "high",
+          "confidence": "related",
+          "notes": "Bias in creditworthiness and benefits eligibility AI causes discriminatory outcomes"
+        },
+        {
+          "vulnerabilityId": "essential_services_ai",
+          "vulnerabilityName": "Essential Services AI",
+          "severity": "high",
+          "confidence": "exact"
+        }
+      ]
+    },
+    {
+      "itemId": "ART6_6",
+      "itemName": "Law Enforcement",
+      "itemDescription": "AI systems used by law enforcement to assess victimisation risk, act as polygraph tools, evaluate evidence reliability, assess offending or re-offending risk, or profile natural persons in the course of criminal investigation or prosecution",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "bias",
+          "vulnerabilityName": "Bias",
+          "severity": "high",
+          "confidence": "related",
+          "notes": "Bias in law enforcement AI affects risk assessments and profiling"
+        },
+        {
+          "vulnerabilityId": "law_enforcement_ai",
+          "vulnerabilityName": "Law Enforcement AI",
+          "severity": "high",
+          "confidence": "exact"
+        },
+        {
+          "vulnerabilityId": "criminal_profiling",
+          "vulnerabilityName": "Criminal Predictive Profiling",
+          "severity": "critical",
+          "confidence": "related",
+          "notes": "criminal_profiling covers the prohibited version; law enforcement AI profiling under ART6_6 to determine risk of becoming a victim."
+        }
+      ]
+    },
+    {
+      "itemId": "ART6_7",
+      "itemName": "Migration, Asylum and Border Control",
+      "itemDescription": "AI systems used by competent authorities as polygraph tools, to assess border security or migration risks, to examine asylum and visa applications, or to identify natural persons in migration and border control contexts",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "bias",
+          "vulnerabilityName": "Bias",
+          "severity": "high",
+          "confidence": "related",
+          "notes": "Bias in border control AI affects asylum and migration decisions"
+        },
+        {
+          "vulnerabilityId": "border_control_ai",
+          "vulnerabilityName": "Migration, Asylum and Border Control AI",
+          "severity": "high",
+          "confidence": "exact"
+        }
+      ]
+    },
+    {
+      "itemId": "ART6_8",
+      "itemName": "Administration of Justice and Democratic Processes",
+      "itemDescription": "AI systems assisting judicial authorities in researching or applying law, and systems intended to influence the outcome of elections, referenda, or voting behaviour of natural persons",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "justice_democracy_ai",
+          "vulnerabilityName": "Administration of Justice and Democratic Processes AI",
+          "severity": "high",
+          "confidence": "exact"
+        }
+      ]
+    },
+    {
+      "itemId": "LIMITED",
+      "itemName": "Limited Risk",
+      "itemDescription": "AI systems subject to transparency obligations (chatbots, deepfakes)",
+      "status": "covered",
+      "mappedVulnerabilities": [
+        {
+          "vulnerabilityId": "misinformation",
+          "vulnerabilityName": "Misinformation",
+          "severity": "high",
+          "confidence": "related",
+          "notes": "Misinformation may be more harmful if it is not clear it is AI generated"
+        },
+        {
+          "vulnerabilityId": "ai_transparency",
+          "vulnerabilityName": "Lack of Transparency in AI Content",
+          "severity": "low",
+          "confidence": "exact"
+        }
+      ]
+    }
+  ]
+}