File size: 2,331 Bytes
b3a6002 c95fa65 b3a6002 | 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 | ---
license: other
pipeline_tag: text-classification
tags:
- shell
- bash
- cybersecurity
- safety
- classifier
---
# Kestrel
Kestrel is a compact local classifier for context-free cyber and system risk in
individual Bash tool calls.
## Release
Version 0.1.0 publishes the portable JSON model artifact used for the Kestrel
evaluation. This repository does not include training code, training data, or a
detailed training recipe.
| File | Description |
|---|---|
| `classifier.json` | Portable Kestrel v0.1.0 model artifact |
| `SHA256SUMS` | Integrity checksum for the release artifact |
The model is custom and is not a Transformers checkpoint. Download the artifact
with `huggingface_hub`:
```python
from huggingface_hub import hf_hub_download
model_path = hf_hub_download(
repo_id="kontext-security/Kestrel",
filename="classifier.json",
)
```
## Evaluation
On the published ShellRisk-Bench v0.1 test split, Kestrel reaches 0.947
precision, 0.922 recall, and 0.934 F1. The test split is a same-source,
in-distribution holdout; it is not evidence of transfer to a novel command
dialect.
See [ShellRisk-Bench](https://github.com/kontext-security/shellrisk-bench) for
the fixed split, evaluation methodology, prompts, scorer, aggregate results,
and per-example Kestrel verdicts. The dataset is available at
[kontext-security/ShellRisk-Bench](https://huggingface.co/datasets/kontext-security/ShellRisk-Bench).
## Scope and limitations
Kestrel evaluates one submitted Bash command without user, task, or session
context. It does not infer intent or make a complete authorization decision.
It is intended as one signal layered underneath deterministic protections and
runtime authorization policy, not as the sole control for executing commands.
## Try it
Kestrel is available as part of Kontext, where it evaluates the cyber risk of
agent tool calls locally. Learn more and try it at
[kontext.security](https://kontext.security).
## Integrity
```text
SHA-256 1df8b3e5f2bfc4e1fe95230ee9b3d37f63aaa461a8551982fcc0dd7103c8221b classifier.json
```
## License
The artifact is published with `license: other`. The public benchmark sources
retain their own upstream terms; review the
[dataset provenance](https://github.com/kontext-security/shellrisk-bench/blob/main/DATASETS.md)
before reuse or redistribution.
|