{"adoption": {"forks": 454, "observed_at": "2026-08-28T04:06:37.834601+00:00", "stars": 2332}, "canonical_url": "https://ross.abutalabs.com/products/sandbox-attacksurface-analysis-tools", "card": {"archived": false, "artifact_type": "cli-tool", "description": "Set of tools to analyze Windows sandboxes for exposed attack surface.", "domain": ["security", "windows", "developer-tools", "reverse-engineering"], "enriched": true, "function": ["security", "penetration-testing", "reverse-engineering", "cli"], "health_score": 59, "homepage": null, "language": "C#", "license": "Apache-2.0", "license_family": "permissive", "maturity": "active", "member_repos": ["googleprojectzero/sandbox-attacksurface-analysis-tools"], "name": "googleprojectzero/sandbox-attacksurface-analysis-tools", "platform": ["windows", "cli"], "pushed_at": "2025-11-06T16:27:47+00:00", "repo": "googleprojectzero/sandbox-attacksurface-analysis-tools", "stars": 2332, "tags": ["sandbox-analysis", "attack-surface", "windows-internals", "nt-api", "powershell-module", "google-project-zero"], "topics": [], "urls": [], "use_cases": ["enumerate NT object manager namespace accessible from a sandboxed process", "inspect and manipulate process tokens on Windows", "view security descriptors from SDDL strings", "analyze exposed attack surface of Windows sandboxes", "list and interact with NT kernel objects via PowerShell"], "what_it_is": "A suite of PowerShell tools and .NET libraries from Google Project Zero for analyzing Windows sandbox attack surfaces. It includes NtCoreLib/NtObjectManager for inspecting NT objects, tokens, and security descriptors from the perspective of a sandboxed process.", "when_to_avoid": ["you need a general-purpose vulnerability scanner", "you are not working on Windows", "you want a GUI-only security tool"], "when_to_choose": ["you are doing Windows security research or sandbox escape analysis", "you need low-level access to NT system calls and objects from managed code", "you want to enumerate what a sandboxed process can access"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/sandbox-attacksurface-analysis-tools", "repo": "googleprojectzero/sandbox-attacksurface-analysis-tools", "role": "main", "score": 56}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:06:37.834601+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-30T02:37:56.847806+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b8ebbd6495283fc999067144a9fde43f4a209545badd3eed7702ef25df43268f", "fetched_at": "2026-08-28T04:06:37.834601+00:00", "kind": "readme", "missing": false, "url": "https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:06:37.834601+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-30T02:37:56.847806+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b8ebbd6495283fc999067144a9fde43f4a209545badd3eed7702ef25df43268f", "fetched_at": "2026-08-28T04:06:37.834601+00:00", "kind": "readme", "missing": false, "url": "https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-30T02:37:56.847806+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b8ebbd6495283fc999067144a9fde43f4a209545badd3eed7702ef25df43268f", "fetched_at": "2026-08-28T04:06:37.834601+00:00", "kind": "readme", "missing": false, "url": "https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:06:37.834601+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:06:37.834601+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:06:37.834601+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-30T02:37:56.847806+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b8ebbd6495283fc999067144a9fde43f4a209545badd3eed7702ef25df43268f", "fetched_at": "2026-08-28T04:06:37.834601+00:00", "kind": "readme", "missing": false, "url": "https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:06:37.834601+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:06:37.834601+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-30T02:37:56.847806+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b8ebbd6495283fc999067144a9fde43f4a209545badd3eed7702ef25df43268f", "fetched_at": "2026-08-28T04:06:37.834601+00:00", "kind": "readme", "missing": false, "url": "https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:06:37.834601+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:06:37.834601+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:06:37.834601+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-30T02:37:56.847806+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b8ebbd6495283fc999067144a9fde43f4a209545badd3eed7702ef25df43268f", "fetched_at": "2026-08-28T04:06:37.834601+00:00", "kind": "readme", "missing": false, "url": "https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:06:37.834601+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:06:37.834601+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-30T02:37:56.847806+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b8ebbd6495283fc999067144a9fde43f4a209545badd3eed7702ef25df43268f", "fetched_at": "2026-08-28T04:06:37.834601+00:00", "kind": "readme", "missing": false, "url": "https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-30T02:37:56.847806+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b8ebbd6495283fc999067144a9fde43f4a209545badd3eed7702ef25df43268f", "fetched_at": "2026-08-28T04:06:37.834601+00:00", "kind": "readme", "missing": false, "url": "https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-30T02:37:56.847806+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b8ebbd6495283fc999067144a9fde43f4a209545badd3eed7702ef25df43268f", "fetched_at": "2026-08-28T04:06:37.834601+00:00", "kind": "readme", "missing": false, "url": "https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-30T02:37:56.847806+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "b8ebbd6495283fc999067144a9fde43f4a209545badd3eed7702ef25df43268f", "fetched_at": "2026-08-28T04:06:37.834601+00:00", "kind": "readme", "missing": false, "url": "https://github.com/googleprojectzero/sandbox-attacksurface-analysis-tools"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 50, "longevity": 100, "rhythm": 40}, "computed_at": "2026-09-02T17:46:02.011165+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 3967, "days_push": 300, "days_rel": 711, "gap_med": 0, "n_releases_24m": 2}, "score": 56, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}