registry  /  @agentled/cli  /  0.8.0

@agentled/cli@0.8.0

CLI for Agentled — manage workflows, apps, and knowledge from the command line. Zero context-window cost for AI agents.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 54 file(s), 477 KB of source, external domains: 127.0.0.1, example.com, github.com, registry.npmjs.org, schemas.agentled.app, www.agentled.ai, www.agentled.app

Source & flagged code

1 flagged · loading source
dist/utils/mcp-config.jsView file
13import { homedir } from 'node:os'; L14: import { spawn } from 'node:child_process'; L15: export function getClientLabel(client) { ... L25: export function detectMcpClient() { L26: if (process.env.CODEX_SHELL || process.env.CODEX_THREAD_ID || process.env.CODEX_CI) L27: return 'codex'; L28: if (existsSync(join(homedir(), '.claude'))) L29: return 'claude-code'; ... L41: function getClaudeDesktopConfigPath() { L42: if (process.platform === 'darwin') { L43: return join(homedir(), 'Library', 'Application Support', 'Claude', 'claude_desktop_config.json'); ... L66: '-e', `AGENTLED_API_KEY=${apiKey}`,
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/utils/mcp-config.jsView on unpkg · L13

Findings

1 High3 Medium5 Low
HighSandbox Evasion Gated Capabilitydist/utils/mcp-config.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings