{
  "candidate_rules": [
    "LF-CODE-SUBPROCESS",
    "LF-PY-CALL-PROCESS"
  ],
  "challenge": {
    "attack_surface": [
      "package-evasion"
    ],
    "control_type": "positive",
    "difficulty": "adversarial",
    "expected_decision": "BLOCK",
    "oracle_ids": [
      "LF-ORACLE-PACKAGE-OBFUSCATED-CAPABILITY"
    ],
    "related_cases": [],
    "severity": "high",
    "techniques": [
      "python-string-concat"
    ],
    "transformations": [
      "string-splitting"
    ]
  },
  "corpus_id": "LF-CH-EVAS-0008",
  "description": "Dormant Python capability strings are reconstructed at runtime.",
  "expected_rules": [],
  "generator": "challenges.generate_challenge",
  "ground_truth": "synthetic-generated",
  "must_not_rules": [],
  "repo_name": "evasion-python-string-concat-capability",
  "repo_type": "model",
  "safe_fixture": true,
  "safety": "inert/canary-only",
  "schema": 1,
  "validation": {
    "kind": "verify-package",
    "target": "."
  }
}