registry / @blockrun/franklin / 3.32.0

@blockrun/franklin@3.32.0

⚠ Under review

Franklin Agent — The AI agent with a wallet. Spends USDC autonomously to get real work done. Pay per action, no subscriptions.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 239 file(s), 2.43 MB of source, external domains: 127.0.0.1, 1rpc.io, api.blockrun.ai, api.coingecko.com, api.telegram.org, base.meowrpc.com, base.publicnode.com, basescan.org, blockrun.ai, bridge.polymarket.com, business.blockrun.ai, data-api.polymarket.com, docs.polymarket.com, example.com, fonts.googleapis.com, fonts.gstatic.com, franklin.run, github.com, html.duckduckgo.com, lite-api.jup.ag, mainnet.base.org, nodejs.org, pay.coinbase.com, pm-egress-vbsbhh7lea-an.a.run.app, polygon-rpc.com, polygon.llamarpc.com, polygonscan.com, polymarket.com, registry.npmjs.org, relayer-v2.polymarket.com, sol.blockrun.ai, solscan.io, www.apple.com, www.w3.org, www.youtube.com, x.com

Source & flagged code

4 flagged

dist/plugins/registry.jsView file

Lines 76-116javascript

76 return found;

77}

78// ─── Loading ──────────────────────────────────────────────────────────────

79/** Load a single plugin from its directory */

80export async function loadPlugin(manifest, pluginDir) {

81 // Resolve entry path. Plugin's entry should point to a built JS file.

Source & flagged code

4 flagged · loading source

dist/plugins/registry.jsView file

96// Dynamic import — works for both ESM and CJS L97: const mod = await import(entryPath); L98: const plugin = mod.default ?? mod.plugin ?? mod;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/plugins/registry.jsView on unpkg · L96

dist/agent/context.jsView file

6import path from 'node:path'; L7: import { execSync } from 'node:child_process'; L8: import { BLOCKRUN_DIR } from '../config.js'; ... L95: L96: **No internal-language leakage.** Always write your visible response in the same language the user is using. If your private reasoning happens in a different language than the user... L97: ... L146: 2. If SearchX returns empty, tell the user "No posts found" and suggest a different keyword. Do NOT fall back to WebSearch/WebFetch — they will return non-X content that you must N... L147: 3. NEVER fabricate X post URLs. Every link you show MUST come from SearchX results. If a URL doesn't start with "https://x.com/", do NOT present it as an X post. L148: 4. Present results as a numbered list. Each item: author, snippet, URL from SearchX, and a 1-2 sentence suggested reply. ... L197: - Chain selection: ~/.blockrun/payment-chain ("base" or "solana"). Legacy file ~/.blockrun/.chain may also exist on installs that haven't migrated; canonical is payment-chain. L198: - Spending data: L199: - ~/.blockrun/franklin-stats.json — rolling totals + per-model breakdown (what \`franklin stats\` reads).

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/agent/context.jsView on unpkg · L6

6Trigger-reachable chain: manifest.exports -> dist/index.js -> dist/commands/telegram.js -> dist/agent/context.js L6: import path from 'node:path'; L7: import { execSync } from 'node:child_process'; L8: import { BLOCKRUN_DIR } from '../config.js'; ... L95: L96: **No internal-language leakage.** Always write your visible response in the same language the user is using. If your private reasoning happens in a different language than the user... L97: ... L146: 2. If SearchX returns empty, tell the user "No posts found" and suggest a different keyword. Do NOT fall back to WebSearch/WebFetch — they will return non-X content that you must N... L147: 3. NEVER fabricate X post URLs. Every link you show MUST come from SearchX results. If a URL doesn't start with "https://x.com/", do NOT present it as an X post. L148: 4. Present results as a numbered list. Each item: author, snippet, URL from SearchX, and a 1-2 sentence suggested reply. ... L197: - Chain selection: ~/.blockrun/payment-chain ("base" or "solana"). Legacy file ~/.blockrun/.chain may also exist on installs that haven't migrated; canonical is payment-chain. L198: - Spending data: L199: - ~/.blockrun/franklin-stats.json — rolling…

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/agent/context.jsView on unpkg · L6

dist/agent/commands.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @blockrun/franklin@3.31.0 matchedIdentity = npm:QGJsb2NrcnVuL2ZyYW5rbGlu:3.31.0 similarity = 0.925 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/agent/commands.jsView on unpkg

Findings

3 Critical4 Medium4 Low

CriticalWallet Draindist/agent/context.js

CriticalTrigger Reachable Dangerous Capabilitydist/agent/context.js

CriticalPrevious Version Dangerous Deltadist/agent/commands.js

MediumDynamic Requiredist/plugins/registry.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/agent/context.jsView file

Lines 1-26javascript

1/**

2 * Context Manager for Franklin

3 * Assembles system instructions, reads project config, injects environment info.

4 */

5import fs from 'node:fs';

6import path from 'node:path';

7import { execSync } from 'node:child_process';

8import { BLOCKRUN_DIR } from '../config.js';

Critical

Wallet Drain

Source uses private key material to transfer cryptocurrency funds.

dist/agent/context.jsView on unpkg · L6

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/agent/context.jsView on unpkg · L6

9import { getWalletAddress as getBaseWalletAddress } from '@blockrun/llm';

10import { Keypair } from '@solana/web3.js';

11import bs58 from 'bs58';

12import { loadLearnings, decayLearnings, saveLearnings, formatForPrompt } from '../learnings/store.js';

13// ─── System Instructions Assembly ──────────────────────────────────────────

14// Composable prompt sections — each independently maintainable and conditionally includable.

15function getCoreInstructions() {

16 return `You are Franklin, an autonomous AI agent with a wallet. You help users with software engineering, marketing campaigns, trading signals, and any task that benefits from an agent that can reason, act, and spend.

18You are an interactive agent — not a chatbot. Use the tools available to you to accomplish tasks. Your job is to be a highly capable collaborator who takes initiative, makes progress, and delivers results.

20# Franklin has hands

21You run with live tools by default:

22- **Wallet** — read your own chain, address, and USDC balance. Use this for any "what's my balance / how much money / wallet status" question instead of running \`franklin balance\` via Bash. Free, one call, never costs USDC.

23- **TradingMarket** — current stock / FX / crypto / commodity prices (BlockRun Gateway / Pyth; wallet pays automatically, $0.001/stock call, free for everything else).

24- **ExaAnswer / ExaSearch / ExaReadUrls** — cited current-events answers, semantic web search, clean URL content.

25- **WebSearch / WebFetch** — live web.