registry / @botbuddy/cli / 1.61.0
@botbuddy/cli@1.61.0
⚠ Under reviewBotBuddy — Swarm coordination CLI for multi-agent workflows
Static Scan Results
scanned 14d ago · by rust-scannerStatic analysis completed at 93.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedsrc/update-check.mjsView file
15import { mkdir, readFile, writeFile } from "node:fs/promises";
L16: import { spawn, spawnSync } from "node:child_process";
L17: import { homedir } from "node:os";
High
Child Process
Package source references child process execution.
src/update-check.mjsView on unpkg · L15src/staging-pool/cli.mjsView file
21Trigger-reachable persistence chain: manifest.bin -> bin/botbuddy.mjs -> src/commands.mjs -> src/staging-pool/cli.mjs
L21:
L22: import { execFile } from "node:child_process";
L23: import * as nodeFs from "node:fs/promises";
...
L32: import { assessPoolHealth, healthReasons } from "./health.mjs";
L33: import { buildLaunchAgentPlist, createLaunchctl } from "./launchd.mjs";
L34: import { createEnvFilePasswordSource } from "./password-source.mjs";
...
L83:
L84: export function exitCodeFor(error) {
L85: if (error instanceof MintRefusedError || error?.code === "persona_not_allowed") return 2;
...
L222: */
L223: export function resolveInstalledPool({ home = homedir(), poolId = null, tenantHint = null } = {}) {
L224: const installed = listInstalledPools(home).filter((pool) => !pool.installed.err
High
Trigger Reachable Persistence
A manifest entrypoint or package-local install chain reaches persistence behavior.
Findings
5 High5 Medium3 Low
HighChild Processsrc/update-check.mjs
HighSame File Env Network Executionsrc/pw/daemon.mjs
HighTrigger Reachable Persistencesrc/staging-pool/cli.mjs
HighSemantic Analysis Limitedsrc/agent-credential-store.mjs#virtual:normalized:round1
HighPrevious Version Dangerous Deltasrc/stack.mjs
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencesrc/staging-pool/cli.mjs
MediumShips Native Binarydaemon/bin/darwin-arm64/botbuddy-daemon
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @botbuddy/cli@1.61.0.
See all versions of @botbuddy/cli for other recorded verdicts.
- Review the evidence and your use of @botbuddy/cli@1.61.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.