registry / @agentiny-ai/cli / 0.0.154

@agentiny-ai/cli@0.0.154

Agentiny CLI — domain-expert AI agent teams

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 1.67 MB of source, external domains: 127.0.0.1, agentiny.tech, json-schema.org, registry.npmjs.org

Source & flagged code

4 flagged

dist/session-runner.jsView file

17793// daemon/agent/claude.ts L17794: import { spawn } from "child_process"; L17795: import { createInterface } from "readline";

High

Child Process

Package source references child process execution.

dist/session-runner.jsView on unpkg · L17793

dist/index.jsView file

87Cross-file remote execution chain: dist/index.js spawns dist/session-runner.js; helper contains network access plus dynamic code execution. L87: headers["X-Workspace-ID"] = this.workspaceId; L88: const res = await fetch(this.baseURL + path, { L89: method, L90: headers, L91: body: body ? JSON.stringify(body) : undefined L92: }); L93: if (!res.ok) { L94: const text = await res.text(); L95: throw new Error(`HTTP ${res.status}: ${text}`); ... L200: ]; L201: var POLL_INTERVAL_MS = Number(process.env.POLL_INTERVAL_MS) || 3000; L202: var OFFLINE_THRESHOLD_MS = Number(process.env.OFFLINE_THRESHOLD_MS) || 30000;

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/index.jsView on unpkg · L87

87headers["X-Workspace-ID"] = this.workspaceId; L88: const res = await fetch(this.baseURL + path, { L89: method, L90: headers, L91: body: body ? JSON.stringify(body) : undefined L92: }); L93: if (!res.ok) { L94: const text = await res.text(); L95: throw new Error(`HTTP ${res.status}: ${text}`); ... L200: ]; L201: var POLL_INTERVAL_MS = Number(process.env.POLL_INTERVAL_MS) || 3000; L202: var OFFLINE_THRESHOLD_MS = Number(process.env.OFFLINE_THRESHOLD_MS) || 30000;

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L87

dist/meeting-runner.jsView file

Lines 342-382javascript

342 `${process.env.LOCALAPPDATA}\\Google\\Chrome\\Application\\chrome.exe`

343 ]

344};

345function findChrome() {

346

Source & flagged code

4 flagged · loading source

dist/session-runner.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code