Implementation:Trailofbits Fickling AnalysisResults Severity

Knowledge Sources	Fickling
Domains	Security, Risk_Assessment
Last Updated	2026-02-14 14:00 GMT

Overview

Concrete property for computing the aggregate severity of pickle analysis results provided by the Fickling library.

Description

AnalysisResults.severity is a read-only property that returns the maximum Severity enum value across all individual AnalysisResult items. The Severity enum has six ordered levels from LIKELY_SAFE (0) to OVERTLY_MALICIOUS (5), with comparison operators enabling threshold-based decisions.

Usage

Access this property after running check_safety() to get the overall risk assessment. Use it for automated decision-making (block/allow) or for prioritizing files for human review.

Code Reference

Source Location

• Repository: fickling
• File: fickling/analysis.py
• Lines: L76-101 (Severity enum), L406-415 (AnalysisResults.severity property)

Signature

class Severity(Enum):
    LIKELY_SAFE = (0, "No Unsafe Operations Discovered")
    POSSIBLY_UNSAFE = (1, "Possibly Unsafe")
    SUSPICIOUS = (2, "Suspicious")
    LIKELY_UNSAFE = (3, "Likely Unsafe")
    LIKELY_OVERTLY_MALICIOUS = (4, "Likely Overtly Malicious")
    OVERTLY_MALICIOUS = (5, "Overtly Malicious")

class AnalysisResults:
    @property
    def severity(self) -> Severity:
        """Return the maximum severity across all results.
        Returns LIKELY_SAFE if no results exist."""

Import

from fickling.analysis import Severity, AnalysisResults

I/O Contract

Inputs

Name	Type	Required	Description
(self)	AnalysisResults	Yes	The analysis results container from check_safety()

Outputs

Name	Type	Description
.severity	Severity	Maximum severity enum value across all results
.severity.name	str	String name (e.g., "LIKELY_SAFE", "OVERTLY_MALICIOUS")
.severity.severity	int	Numeric value (0-5) for comparison
.severity.message	str	Human-readable description

Usage Examples

Threshold-Based Decision

from fickling.fickle import Pickled
from fickling.analysis import check_safety, Severity

with open("model.pkl", "rb") as f:
    pickled = Pickled.load(f)

results = check_safety(pickled)

# Use severity for automated decisions
if results.severity >= Severity.LIKELY_UNSAFE:
    print(f"BLOCKED: {results.severity.name} - {results.severity.message}")
elif results.severity >= Severity.SUSPICIOUS:
    print(f"FLAGGED FOR REVIEW: {results.severity.name}")
else:
    print(f"ALLOWED: {results.severity.name}")

Related Pages

Implements Principle

• Principle:Trailofbits_Fickling_Severity_Classification

Uses Heuristic

• Heuristic:Trailofbits_Fickling_Severity_Threshold_Selection