scanned 17d ago·osv · gitleaks · opengrep · picklescan + heuristics·full breakdown in the Security tab ↓
spacy-llm
spacy-llm brings large language models into spaCy's production NLP pipeline system. It provides drop-in components that use LLMs for tasks like NER, text classification, lemmatisation, and relation extraction — with support for zero-shot and few-shot prompting, Jinja2 templates, and custom task definitions.
! Security: Review · 8888/100 · grade Bscanned 17d ago
✓ no compromise signals7 risk-surface · 6/20 OWASP controls flagged
Compromise signals — malicious or tampered code (leaked secrets, backdoors, a dropped executable) — reduce the score, and known dependency CVEs carry a bounded penalty (they warrant review but never QUARANTINE — update the dependency to clear). Other dangerous-by-capability traits are risk surface, expected for some capabilities. Every finding is mapped to its OWASP control below.
What this capability can do · med confidence (static)
Findings mapped to the OWASP Top 10 for LLM Applications (2025) and the OWASP Machine Learning Security Top 10. Expand any flagged control for the exact findings — compromise reduces the score; expected/risk-surface do not, except a known CVE, which carries a small bounded penalty (high/critical → Review).
OWASP Top 10 for LLM Applications
⚠LLM03Supply Chainhigh
Vulnerable/compromised dependencies, models or archives in the artifact.
Tampered model weight files; integrity must be verifiable.
Static check enforces safe formats + records a content hash for downstream verification.
Other findings (7) · hygiene / uncategorized
•Unrecognized file type — '.gitignore' is not on the allowlist · explosion-spacy-llm-99ac922/.gitignorerisk surface
•Unrecognized file type — '.?' is not on the allowlist · explosion-spacy-llm-99ac922/LICENSErisk surface
•Unrecognized file type — '.in' is not on the allowlist · explosion-spacy-llm-99ac922/MANIFEST.inrisk surface
•Unrecognized file type — '.cfg' is not on the allowlist · explosion-spacy-llm-99ac922/setup.cfgrisk surface
•Unrecognized file type — '.jinja' is not on the allowlist · explosion-spacy-llm-99ac922/spacy_llm/tasks/templates/entity_linker.v1.jinjarisk surface
•Unrecognized file type — '.jsonl' is not on the allowlist · explosion-spacy-llm-99ac922/spacy_llm/tests/tasks/examples/entity_linker.jsonlrisk surface
•Unrecognized file type — '.jinja2' is not on the allowlist · explosion-spacy-llm-99ac922/spacy_llm/tests/tasks/legacy/templates/ner.jinja2risk surface