EVIDENCE BEFORE ASSUMPTIONS
Trust is not a green tick.
Security tools can trigger detections. An undetected tool can still be dangerous. Read the scope, source and date behind every check.
Three separate questions
Who published it?
Source reviewed means an administrator recorded a source review and evidence note. It does not verify every contributor or every future release.
What was analyzed?
Static README observations identify limited textual patterns. They are not full source audits. VirusTotal lookup, when configured, checks an existing repository URL reputation record, not executable files. No provider record does not mean clean.
What is the publication decision?
Imports enter a private draft queue. An administrator reviews the record before publishing. Flagged records require attention; read the review note. Unreviewed source identity is not a malware verdict.
Safe handling
Arsenal does not install or execute discovered tools. Do not run commands blindly, especially commands requesting administrator rights or downloading executable content. Use a disposable lab and systems you are authorized to assess.
What this release does not establish
It does not provide full binary malware analysis, dependency auditing, verified government affiliation, autonomous discovery across the internet or a guarantee of safe execution. Those capabilities need separate, isolated infrastructure and explicit coverage. AI troubleshooting is not enabled in this first release.
Correct a record
Send the tool URL, affected version and source evidence to aeglixmind@gmail.com. Do not email credentials, sensitive samples or private data.