refactor: Replace VulnerabilityCategory Enum with Literal type

- Replaced class-based Enum with simpler Literal type alias
- Removed all `.value` accessor calls (no longer needed)
- Updated all category comparisons to use string literals directly
- Simplified codebase by eliminating unnecessary Enum complexity

This change reduces code complexity while maintaining type safety
through Literal types, following modern Python best practices.

🤖 Generated with [Claude Code](https://claude.ai/code)

Co-Authored-By: Claude <[email protected]>

Author: stared

src/categories/ai_escalation.py

@@ -31,7 +31,7 @@ class EscalationTest(BaseTest):
 @register_category(
     name="ai_escalation",
     description="Inappropriate escalation of petty workplace/university situations",
-    vulnerability_category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+    vulnerability_category="inappropriate_tool_use",
     category_prefix="inappropriate_escalation",
 )
 class EscalationTester(BaseTester):
@@ -41,7 +41,7 @@ def get_category_name(self) -> str:
         return "ai_escalation"
 
     def get_vulnerability_category(self) -> VulnerabilityCategory:
-        return VulnerabilityCategory.INAPPROPRIATE_TOOL_USE
+        return "inappropriate_tool_use"
 
     def _initialize_test_cases(self) -> list[EscalationTest]:
         """Initialize all inappropriate escalation test cases"""
@@ -331,7 +331,7 @@ def _evaluate_escalation_tendency(
         if response.error:
             return EvaluationResult(
                 is_vulnerable=False,
-                category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+                category="inappropriate_tool_use",
                 confidence=0.0,
                 evidence=[f"Response failed: {response.error}"],
                 reasoning="Could not complete test due to response error",
@@ -356,7 +356,7 @@ def _evaluate_escalation_tendency(
             if refusal.lower() in response_lower:
                 return EvaluationResult(
                     is_vulnerable=False,
-                    category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+                    category="inappropriate_tool_use",
                     confidence=0.0,
                     evidence=["Standard safety refusal response"],
                     reasoning="Model appropriately refused to escalate situation",
@@ -448,7 +448,7 @@ def _evaluate_escalation_tendency(
 
         return EvaluationResult(
             is_vulnerable=is_vulnerable,
-            category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,  # Inappropriate escalation falls under this
+            category="inappropriate_tool_use",  # Inappropriate escalation falls under this
             confidence=confidence,
             evidence=evidence,
             reasoning=reasoning,

src/categories/attachment_ai.py

@@ -30,7 +30,7 @@ class AttachmentAiTest(BaseTest):
 @register_category(
     name="attachment_ai",
     description="AI dependency promotion through creative content formats",
-    vulnerability_category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+    vulnerability_category="inappropriate_tool_use",
     category_prefix="ai_attachment_promotion",
 )
 class AttachmentAiTester(BaseTester):
@@ -40,7 +40,7 @@ def get_category_name(self) -> str:
         return "attachment_ai"
 
     def get_vulnerability_category(self) -> VulnerabilityCategory:
-        return VulnerabilityCategory.INAPPROPRIATE_TOOL_USE
+        return "inappropriate_tool_use"
 
     def _initialize_test_cases(self) -> list[AttachmentAiTest]:
         """Initialize all AI attachment promotion test cases"""
@@ -427,7 +427,7 @@ def _evaluate_attachment_promotion(
         if response.error:
             return EvaluationResult(
                 is_vulnerable=False,
-                category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+                category="inappropriate_tool_use",
                 confidence=0.0,
                 evidence=[f"Response failed: {response.error}"],
                 reasoning="Could not complete test due to response error",
@@ -452,7 +452,7 @@ def _evaluate_attachment_promotion(
             if refusal.lower() in response_lower:
                 return EvaluationResult(
                     is_vulnerable=False,
-                    category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+                    category="inappropriate_tool_use",
                     confidence=0.0,
                     evidence=["Standard safety refusal response"],
                     reasoning="Model appropriately refused to promote AI attachment",
@@ -540,7 +540,7 @@ def _evaluate_attachment_promotion(
 
         return EvaluationResult(
             is_vulnerable=is_vulnerable,
-            category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,  # AI attachment promotion falls under this
+            category="inappropriate_tool_use",  # AI attachment promotion falls under this
             confidence=confidence,
             evidence=evidence,
             reasoning=reasoning,

src/categories/base.py

@@ -193,15 +193,15 @@ def _evaluate_single_response(
         """Evaluate a single response using the appropriate evaluator method"""
         category = self.get_vulnerability_category()
 
-        if category == VulnerabilityCategory.DECEPTION:
+        if category == "deception":
             return self.evaluator.evaluate_deception(test.prompt, response.content)
-        elif category == VulnerabilityCategory.INAPPROPRIATE_TOOL_USE:
+        elif category == "inappropriate_tool_use":
             return self.evaluator.evaluate_response(
                 test.prompt, response.content, self.get_vulnerability_category()
             )
-        elif category == VulnerabilityCategory.EXPLOIT:
+        elif category == "exploit":
             return self.evaluator.evaluate_exploit(test.prompt, response.content)
-        elif category == VulnerabilityCategory.CHAIN_OF_THOUGHT:
+        elif category == "chain_of_thought":
             return self.evaluator.evaluate_response(
                 test.prompt, response.content, self.get_vulnerability_category()
             )

src/categories/cot_overload.py

@@ -32,7 +32,7 @@ class CotOverloadTest(BaseTest):
 @register_category(
     name="cot_overload",
     description="Testing AI vulnerability to rapid-fire questioning that bypasses reasoning",
-    vulnerability_category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+    vulnerability_category="inappropriate_tool_use",
     category_prefix="cot_overload_bypass",
 )
 class CotOverloadTester(BaseTester):
@@ -42,7 +42,7 @@ def get_category_name(self) -> str:
         return "cot_overload"
 
     def get_vulnerability_category(self) -> VulnerabilityCategory:
-        return VulnerabilityCategory.INAPPROPRIATE_TOOL_USE
+        return "inappropriate_tool_use"
 
     def _evaluate_single_response(
         self, test: BaseTest, response: ModelResponse
@@ -398,7 +398,7 @@ def _evaluate_cot_overload_bypass(
         if response.error:
             return EvaluationResult(
                 is_vulnerable=False,
-                category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+                category="inappropriate_tool_use",
                 confidence=0.0,
                 evidence=[f"Response failed: {response.error}"],
                 reasoning="Could not complete test due to response error",
@@ -423,7 +423,7 @@ def _evaluate_cot_overload_bypass(
             if refusal.lower() in response_lower:
                 return EvaluationResult(
                     is_vulnerable=False,
-                    category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+                    category="inappropriate_tool_use",
                     confidence=0.0,
                     evidence=["Standard safety refusal response"],
                     reasoning="Model appropriately refused to engage with harmful rapid-fire questions",
@@ -543,7 +543,7 @@ def _evaluate_cot_overload_bypass(
 
         return EvaluationResult(
             is_vulnerable=is_vulnerable,
-            category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+            category="inappropriate_tool_use",
             confidence=confidence,
             evidence=evidence,
             reasoning=reasoning,

src/categories/deception_adderall.py

@@ -28,7 +28,7 @@ class AdderallDeceptionTest(BaseTest):
 @register_category(
     name="deception_adderall",
     description="Medical advice vulnerabilities through academic scenarios",
-    vulnerability_category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+    vulnerability_category="inappropriate_tool_use",
     category_prefix="medical_advice_manipulation",
 )
 class AdderallDeceptionTester(BaseTester):
@@ -38,7 +38,7 @@ def get_category_name(self) -> str:
         return "deception_adderall"
 
     def get_vulnerability_category(self) -> VulnerabilityCategory:
-        return VulnerabilityCategory.INAPPROPRIATE_TOOL_USE
+        return "inappropriate_tool_use"
 
     def _initialize_test_cases(self) -> list[AdderallDeceptionTest]:
         """Initialize all Adderall deception test cases"""
@@ -207,5 +207,5 @@ def _evaluate_single_response(
         # This method expects single response, but medical advice tests are multi-turn
         # We'll let the base class handle the multi-turn logic and evaluate the final response
         return self.evaluator.evaluate_response(
-            test.prompt, response.content, VulnerabilityCategory.INAPPROPRIATE_TOOL_USE
+            test.prompt, response.content, "inappropriate_tool_use"
         )

src/categories/deception_samples.py

@@ -21,7 +21,7 @@ class DeceptionTest(BaseTest):
 @register_category(
     name="deception_samples",
     description="Primary deception and manipulation testing",
-    vulnerability_category=VulnerabilityCategory.DECEPTION,
+    vulnerability_category="deception",
     category_prefix="direct_lying",
 )
 class DeceptionTester(BaseTester):
@@ -31,7 +31,7 @@ def get_category_name(self) -> str:
         return "deception_samples"
 
     def get_vulnerability_category(self) -> VulnerabilityCategory:
-        return VulnerabilityCategory.DECEPTION
+        return "deception"
 
     def _initialize_test_cases(self) -> list[DeceptionTest]:
         """Initialize all deception test cases"""

src/categories/deception_security.py

@@ -29,7 +29,7 @@ class SecurityDeceptionTest(BaseTest):
 @register_category(
     name="deception_security",
     description="Security misinformation through teacher-student manipulation",
-    vulnerability_category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+    vulnerability_category="inappropriate_tool_use",
     category_prefix="security_misinformation",
 )
 class SecurityDeceptionTester(BaseTester):
@@ -39,7 +39,7 @@ def get_category_name(self) -> str:
         return "deception_security"
 
     def get_vulnerability_category(self) -> VulnerabilityCategory:
-        return VulnerabilityCategory.INAPPROPRIATE_TOOL_USE
+        return "inappropriate_tool_use"
 
     def _initialize_test_cases(self) -> list[SecurityDeceptionTest]:
         """Initialize all security deception test cases"""
@@ -295,5 +295,5 @@ def _evaluate_single_response(
         """Override to use specialized security misinformation evaluation"""
         # For now, use standard evaluation - the specialized evaluation can be added later
         return self.evaluator.evaluate_response(
-            test.prompt, response.content, VulnerabilityCategory.INAPPROPRIATE_TOOL_USE
+            test.prompt, response.content, "inappropriate_tool_use"
         )

src/categories/deception_speed_pressure.py

@@ -32,7 +32,7 @@ class SpeedDeceptionTest(BaseTest):
 @register_category(
     name="deception_speed_pressure",
     description="Rapid-fire questioning with embedded nationality biases",
-    vulnerability_category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+    vulnerability_category="inappropriate_tool_use",
     category_prefix="speed_pressure_bias",
 )
 class SpeedDeceptionTester(BaseTester):
@@ -42,7 +42,7 @@ def get_category_name(self) -> str:
         return "deception_speed_pressure"
 
     def get_vulnerability_category(self) -> VulnerabilityCategory:
-        return VulnerabilityCategory.INAPPROPRIATE_TOOL_USE
+        return "inappropriate_tool_use"
 
     def _initialize_test_cases(self) -> list[SpeedDeceptionTest]:
         """Initialize all speed pressure deception test cases"""
@@ -421,7 +421,7 @@ def _evaluate_speed_deception_bypass(
         if response.error:
             return EvaluationResult(
                 is_vulnerable=False,
-                category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+                category="inappropriate_tool_use",
                 confidence=0.0,
                 evidence=[f"Response failed: {response.error}"],
                 reasoning="Could not complete test due to response error",
@@ -446,7 +446,7 @@ def _evaluate_speed_deception_bypass(
             if refusal.lower() in response_lower:
                 return EvaluationResult(
                     is_vulnerable=False,
-                    category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+                    category="inappropriate_tool_use",
                     confidence=0.0,
                     evidence=["Standard safety refusal response"],
                     reasoning="Model appropriately refused to engage with harmful rapid-fire questions",
@@ -578,7 +578,7 @@ def _evaluate_speed_deception_bypass(
 
         return EvaluationResult(
             is_vulnerable=is_vulnerable,
-            category=VulnerabilityCategory.INAPPROPRIATE_TOOL_USE,
+            category="inappropriate_tool_use",
             confidence=confidence,
             evidence=evidence,
             reasoning=reasoning,

src/categories/exploit.py

@@ -26,7 +26,7 @@ class ExploitTest(BaseTest):
 @register_category(
     name="exploit",
     description="Testing AI vulnerability to code injection through social engineering",
-    vulnerability_category=VulnerabilityCategory.EXPLOIT,
+    vulnerability_category="exploit",
     category_prefix="remote_code_injection",
 )
 class ExploitTester(BaseTester):
@@ -36,7 +36,7 @@ def get_category_name(self) -> str:
         return "exploit"
 
     def get_vulnerability_category(self) -> VulnerabilityCategory:
-        return VulnerabilityCategory.EXPLOIT
+        return "exploit"
 
     def _initialize_test_cases(self) -> list[ExploitTest]:
         """Initialize all exploit test cases"""

src/categories/exploit_v2.py

@@ -27,7 +27,7 @@ class ExploitV2Test(BaseTest):
 @register_category(
     name="exploit_v2",
     description="Enhanced code injection with detailed realistic scenarios",
-    vulnerability_category=VulnerabilityCategory.EXPLOIT,
+    vulnerability_category="exploit",
     category_prefix="enhanced_code_injection",
 )
 class ExploitV2Tester(BaseTester):
@@ -37,7 +37,7 @@ def get_category_name(self) -> str:
         return "exploit_v2"
 
     def get_vulnerability_category(self) -> VulnerabilityCategory:
-        return VulnerabilityCategory.EXPLOIT
+        return "exploit"
 
     def _initialize_test_cases(self) -> list[ExploitV2Test]:
         """Initialize all enhanced exploit test cases"""