registry / @absolutejs/agent-conformance / 0.2.0

@absolutejs/agent-conformance@0.2.0

Provider-neutral adversarial conformance suites for agent actions, capabilities, tasks, credential destinations, replay, and race safety.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 5 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

SourceNo risky source behavior triggered.

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 362 KB of source, external domains: 169.254.169.254, api.example, api.example.com, api.example.com.evil.test, api.example.evil.test, cdn.example.net, github.com

Source & flagged code

1 flagged

dist/manifest.jsView file

Lines 40-80javascript

40 await run();

41 } catch (error) {

42 const message = error instanceof Error ? error.message : String(error);

43 if (expected !==

Source & flagged code

1 flagged · loading source

dist/manifest.jsView file

60actorId: "agent-a", L61: allowedOrigin: "https://api.example", L62: maximumUses: 1, ... L178: const results = await Promise.all([ L179: scenario("egress/private-network", async () => { L180: const harness = await create(); L181: await rejects(() => harness.request("https://169.254.169.254/latest")); L182: }), ... L819: function IsNonEscaped(pattern, index, char) { L820: return pattern[index] === char && pattern.charCodeAt(index - 1) !== 92; L821: }

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/manifest.jsView on unpkg · L60

Findings

1 High1 Medium3 Low

HighCloud Metadata Accessdist/manifest.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings