interplains
It scans locally without uploading evidence or making network requests during a scan, while reporting both matches and checks it could not complete. Give it a computer account, AndroidQF collection, or local iPhone evidence and it produces readable and JSON findings. It checks about 12,400 published indicators from 29 sources, but cannot detect unpublished spyware.
For At-risk computer and phone owners checking possible mercenary spyware exposure, and security analysts interpreting JSON reports
The toolkit treats scans as local, read-only evidence examination and preserves uncertainty as explicit coverage gaps rather than reporting unreadable artifacts as clean. Independent scan modules share a registry and return structured results that feed one machine-readable and human-readable report.
scan/CONTRACT.md; scan/zbtriage/readers.py; scan/zbtriage/modules/browser.py; scan/zbtriage/report.py
Command-line orchestration
Parses commands, loads indicators, runs selected modules and finalizes reports.
scan/zbtriage/cli.py
Reader registry
Selects and dispatches trusted scan modules for each scope.
scan/zbtriage/readers.py
Browser artifact scanner
Examines browser and embedded Chromium artifacts while preserving per-artifact failures.
scan/zbtriage/modules/browser.py
Reporting and verdicts
Builds JSON and readable reports, summaries, timelines and coverage gaps.
scan/zbtriage/report.py
Generated
