{
  "schemaVersion": "1.0.0",
  "name": "agentic-workflow-guard-benchmark-corpus",
  "version": "1.0.0",
  "generatedBy": "agentic-workflow-guard@1.0.0",
  "description": "Reusable vulnerable and safe fixtures for AI automation workflow security scanners.",
  "homepage": "https://github.com/guorunjie/agentic-workflow-guard",
  "fixtureManifestVersion": 1,
  "fixtureCount": 54,
  "platforms": [
    "AWS CodeBuild",
    "Activepieces",
    "Airflow",
    "Argo Workflows",
    "Azure Pipelines",
    "Bitbucket Pipelines",
    "Browser automation",
    "Buildkite",
    "CircleCI",
    "Dify",
    "Drone CI",
    "Flowise",
    "GitHub Actions",
    "GitLab CI",
    "Google Cloud Build",
    "Harness CI/CD",
    "Jenkins",
    "Langflow",
    "MCP",
    "Make",
    "Node-RED",
    "Pipedream",
    "TeamCity",
    "Tekton Pipelines",
    "Travis CI",
    "Zapier",
    "n8n"
  ],
  "ruleIds": [
    "AWI001",
    "AWI002",
    "AWI003",
    "AWI005",
    "AWI006",
    "AWI007",
    "AWI008",
    "AWI009",
    "AWI010"
  ],
  "fixtures": [
    {
      "name": "vulnerable-github-action",
      "kind": "vulnerable",
      "platformId": "github-actions",
      "platform": "GitHub Actions",
      "path": "examples/vulnerable-github-action",
      "expectedRules": [
        "AWI001",
        "AWI002",
        "AWI003",
        "AWI008"
      ],
      "risk": "Expected to trigger AWI001, AWI002, AWI003, AWI008."
    },
    {
      "name": "safe-github-action",
      "kind": "safe",
      "platformId": "github-actions",
      "platform": "GitHub Actions",
      "path": "examples/safe-github-action",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-bitbucket-pipelines",
      "kind": "vulnerable",
      "platformId": "bitbucket-pipelines",
      "platform": "Bitbucket Pipelines",
      "path": "examples/vulnerable-bitbucket-pipelines",
      "expectedRules": [
        "AWI001",
        "AWI002",
        "AWI007",
        "AWI008"
      ],
      "risk": "Expected to trigger AWI001, AWI002, AWI007, AWI008."
    },
    {
      "name": "safe-bitbucket-pipelines",
      "kind": "safe",
      "platformId": "bitbucket-pipelines",
      "platform": "Bitbucket Pipelines",
      "path": "examples/safe-bitbucket-pipelines",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-gitlab-ci",
      "kind": "vulnerable",
      "platformId": "gitlab-ci",
      "platform": "GitLab CI",
      "path": "examples/vulnerable-gitlab-ci",
      "expectedRules": [
        "AWI001",
        "AWI002",
        "AWI007",
        "AWI008"
      ],
      "risk": "Expected to trigger AWI001, AWI002, AWI007, AWI008."
    },
    {
      "name": "safe-gitlab-ci",
      "kind": "safe",
      "platformId": "gitlab-ci",
      "platform": "GitLab CI",
      "path": "examples/safe-gitlab-ci",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-travis-ci",
      "kind": "vulnerable",
      "platformId": "travis-ci",
      "platform": "Travis CI",
      "path": "examples/vulnerable-travis-ci",
      "expectedRules": [
        "AWI001",
        "AWI002",
        "AWI007",
        "AWI008"
      ],
      "risk": "Expected to trigger AWI001, AWI002, AWI007, AWI008."
    },
    {
      "name": "safe-travis-ci",
      "kind": "safe",
      "platformId": "travis-ci",
      "platform": "Travis CI",
      "path": "examples/safe-travis-ci",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-drone-ci",
      "kind": "vulnerable",
      "platformId": "drone-ci",
      "platform": "Drone CI",
      "path": "examples/vulnerable-drone-ci",
      "expectedRules": [
        "AWI001",
        "AWI002",
        "AWI007",
        "AWI008"
      ],
      "risk": "Expected to trigger AWI001, AWI002, AWI007, AWI008."
    },
    {
      "name": "safe-drone-ci",
      "kind": "safe",
      "platformId": "drone-ci",
      "platform": "Drone CI",
      "path": "examples/safe-drone-ci",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-teamcity",
      "kind": "vulnerable",
      "platformId": "teamcity",
      "platform": "TeamCity",
      "path": "examples/vulnerable-teamcity",
      "expectedRules": [
        "AWI001",
        "AWI002",
        "AWI007",
        "AWI008"
      ],
      "risk": "Expected to trigger AWI001, AWI002, AWI007, AWI008."
    },
    {
      "name": "safe-teamcity",
      "kind": "safe",
      "platformId": "teamcity",
      "platform": "TeamCity",
      "path": "examples/safe-teamcity",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-harness",
      "kind": "vulnerable",
      "platformId": "harness",
      "platform": "Harness CI/CD",
      "path": "examples/vulnerable-harness",
      "expectedRules": [
        "AWI001",
        "AWI002",
        "AWI007",
        "AWI008"
      ],
      "risk": "Expected to trigger AWI001, AWI002, AWI007, AWI008."
    },
    {
      "name": "safe-harness",
      "kind": "safe",
      "platformId": "harness",
      "platform": "Harness CI/CD",
      "path": "examples/safe-harness",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-tekton",
      "kind": "vulnerable",
      "platformId": "tekton",
      "platform": "Tekton Pipelines",
      "path": "examples/vulnerable-tekton",
      "expectedRules": [
        "AWI001",
        "AWI002",
        "AWI007",
        "AWI008"
      ],
      "risk": "Expected to trigger AWI001, AWI002, AWI007, AWI008."
    },
    {
      "name": "safe-tekton",
      "kind": "safe",
      "platformId": "tekton",
      "platform": "Tekton Pipelines",
      "path": "examples/safe-tekton",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-argo-workflows",
      "kind": "vulnerable",
      "platformId": "argo-workflows",
      "platform": "Argo Workflows",
      "path": "examples/vulnerable-argo-workflows",
      "expectedRules": [
        "AWI001",
        "AWI002",
        "AWI007",
        "AWI008"
      ],
      "risk": "Expected to trigger AWI001, AWI002, AWI007, AWI008."
    },
    {
      "name": "safe-argo-workflows",
      "kind": "safe",
      "platformId": "argo-workflows",
      "platform": "Argo Workflows",
      "path": "examples/safe-argo-workflows",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-aws-codebuild",
      "kind": "vulnerable",
      "platformId": "aws-codebuild",
      "platform": "AWS CodeBuild",
      "path": "examples/vulnerable-aws-codebuild",
      "expectedRules": [
        "AWI001",
        "AWI002",
        "AWI007",
        "AWI008"
      ],
      "risk": "Expected to trigger AWI001, AWI002, AWI007, AWI008."
    },
    {
      "name": "safe-aws-codebuild",
      "kind": "safe",
      "platformId": "aws-codebuild",
      "platform": "AWS CodeBuild",
      "path": "examples/safe-aws-codebuild",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-google-cloud-build",
      "kind": "vulnerable",
      "platformId": "google-cloud-build",
      "platform": "Google Cloud Build",
      "path": "examples/vulnerable-google-cloud-build",
      "expectedRules": [
        "AWI001",
        "AWI002",
        "AWI007",
        "AWI008"
      ],
      "risk": "Expected to trigger AWI001, AWI002, AWI007, AWI008."
    },
    {
      "name": "safe-google-cloud-build",
      "kind": "safe",
      "platformId": "google-cloud-build",
      "platform": "Google Cloud Build",
      "path": "examples/safe-google-cloud-build",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-circleci",
      "kind": "vulnerable",
      "platformId": "circleci",
      "platform": "CircleCI",
      "path": "examples/vulnerable-circleci",
      "expectedRules": [
        "AWI001",
        "AWI002",
        "AWI007",
        "AWI008"
      ],
      "risk": "Expected to trigger AWI001, AWI002, AWI007, AWI008."
    },
    {
      "name": "safe-circleci",
      "kind": "safe",
      "platformId": "circleci",
      "platform": "CircleCI",
      "path": "examples/safe-circleci",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-azure-pipelines",
      "kind": "vulnerable",
      "platformId": "azure-pipelines",
      "platform": "Azure Pipelines",
      "path": "examples/vulnerable-azure-pipelines",
      "expectedRules": [
        "AWI001",
        "AWI002",
        "AWI007",
        "AWI008"
      ],
      "risk": "Expected to trigger AWI001, AWI002, AWI007, AWI008."
    },
    {
      "name": "safe-azure-pipelines",
      "kind": "safe",
      "platformId": "azure-pipelines",
      "platform": "Azure Pipelines",
      "path": "examples/safe-azure-pipelines",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-jenkins",
      "kind": "vulnerable",
      "platformId": "jenkins",
      "platform": "Jenkins",
      "path": "examples/vulnerable-jenkins",
      "expectedRules": [
        "AWI001",
        "AWI002",
        "AWI007",
        "AWI008"
      ],
      "risk": "Expected to trigger AWI001, AWI002, AWI007, AWI008."
    },
    {
      "name": "safe-jenkins",
      "kind": "safe",
      "platformId": "jenkins",
      "platform": "Jenkins",
      "path": "examples/safe-jenkins",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-buildkite",
      "kind": "vulnerable",
      "platformId": "buildkite",
      "platform": "Buildkite",
      "path": "examples/vulnerable-buildkite",
      "expectedRules": [
        "AWI001",
        "AWI002",
        "AWI007",
        "AWI008"
      ],
      "risk": "Expected to trigger AWI001, AWI002, AWI007, AWI008."
    },
    {
      "name": "safe-buildkite",
      "kind": "safe",
      "platformId": "buildkite",
      "platform": "Buildkite",
      "path": "examples/safe-buildkite",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-n8n",
      "kind": "vulnerable",
      "platformId": "n8n",
      "platform": "n8n",
      "path": "examples/vulnerable-n8n",
      "expectedRules": [
        "AWI005"
      ],
      "risk": "Expected to trigger AWI005."
    },
    {
      "name": "safe-n8n",
      "kind": "safe",
      "platformId": "n8n",
      "platform": "n8n",
      "path": "examples/safe-n8n",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-mcp",
      "kind": "vulnerable",
      "platformId": "mcp",
      "platform": "MCP",
      "path": "examples/vulnerable-mcp",
      "expectedRules": [
        "AWI006"
      ],
      "risk": "Expected to trigger AWI006."
    },
    {
      "name": "safe-mcp",
      "kind": "safe",
      "platformId": "mcp",
      "platform": "MCP",
      "path": "examples/safe-mcp",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-activepieces",
      "kind": "vulnerable",
      "platformId": "activepieces",
      "platform": "Activepieces",
      "path": "examples/vulnerable-activepieces",
      "expectedRules": [
        "AWI009"
      ],
      "risk": "Expected to trigger AWI009."
    },
    {
      "name": "safe-activepieces",
      "kind": "safe",
      "platformId": "activepieces",
      "platform": "Activepieces",
      "path": "examples/safe-activepieces",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-dify",
      "kind": "vulnerable",
      "platformId": "dify",
      "platform": "Dify",
      "path": "examples/vulnerable-dify",
      "expectedRules": [
        "AWI009"
      ],
      "risk": "Expected to trigger AWI009."
    },
    {
      "name": "safe-dify",
      "kind": "safe",
      "platformId": "dify",
      "platform": "Dify",
      "path": "examples/safe-dify",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-flowise",
      "kind": "vulnerable",
      "platformId": "flowise",
      "platform": "Flowise",
      "path": "examples/vulnerable-flowise",
      "expectedRules": [
        "AWI009"
      ],
      "risk": "Expected to trigger AWI009."
    },
    {
      "name": "safe-flowise",
      "kind": "safe",
      "platformId": "flowise",
      "platform": "Flowise",
      "path": "examples/safe-flowise",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-langflow",
      "kind": "vulnerable",
      "platformId": "langflow",
      "platform": "Langflow",
      "path": "examples/vulnerable-langflow",
      "expectedRules": [
        "AWI009"
      ],
      "risk": "Expected to trigger AWI009."
    },
    {
      "name": "safe-langflow",
      "kind": "safe",
      "platformId": "langflow",
      "platform": "Langflow",
      "path": "examples/safe-langflow",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-node-red",
      "kind": "vulnerable",
      "platformId": "node-red",
      "platform": "Node-RED",
      "path": "examples/vulnerable-node-red",
      "expectedRules": [
        "AWI009"
      ],
      "risk": "Expected to trigger AWI009."
    },
    {
      "name": "safe-node-red",
      "kind": "safe",
      "platformId": "node-red",
      "platform": "Node-RED",
      "path": "examples/safe-node-red",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-make",
      "kind": "vulnerable",
      "platformId": "make",
      "platform": "Make",
      "path": "examples/vulnerable-make",
      "expectedRules": [
        "AWI009"
      ],
      "risk": "Expected to trigger AWI009."
    },
    {
      "name": "safe-make",
      "kind": "safe",
      "platformId": "make",
      "platform": "Make",
      "path": "examples/safe-make",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-pipedream",
      "kind": "vulnerable",
      "platformId": "pipedream",
      "platform": "Pipedream",
      "path": "examples/vulnerable-pipedream",
      "expectedRules": [
        "AWI009"
      ],
      "risk": "Expected to trigger AWI009."
    },
    {
      "name": "safe-pipedream",
      "kind": "safe",
      "platformId": "pipedream",
      "platform": "Pipedream",
      "path": "examples/safe-pipedream",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-zapier",
      "kind": "vulnerable",
      "platformId": "zapier",
      "platform": "Zapier",
      "path": "examples/vulnerable-zapier",
      "expectedRules": [
        "AWI009"
      ],
      "risk": "Expected to trigger AWI009."
    },
    {
      "name": "safe-zapier",
      "kind": "safe",
      "platformId": "zapier",
      "platform": "Zapier",
      "path": "examples/safe-zapier",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-airflow",
      "kind": "vulnerable",
      "platformId": "airflow",
      "platform": "Airflow",
      "path": "examples/vulnerable-airflow",
      "expectedRules": [
        "AWI009"
      ],
      "risk": "Expected to trigger AWI009."
    },
    {
      "name": "safe-airflow",
      "kind": "safe",
      "platformId": "airflow",
      "platform": "Airflow",
      "path": "examples/safe-airflow",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    },
    {
      "name": "vulnerable-browser-trace",
      "kind": "vulnerable",
      "platformId": "browser-automation",
      "platform": "Browser automation",
      "path": "examples/vulnerable-browser-trace",
      "expectedRules": [
        "AWI010"
      ],
      "risk": "Expected to trigger AWI010."
    },
    {
      "name": "safe-browser-trace",
      "kind": "safe",
      "platformId": "browser-automation",
      "platform": "Browser automation",
      "path": "examples/safe-browser-trace",
      "expectedRules": [],
      "risk": "Expected to produce no findings."
    }
  ]
}