registry  /  @conto_finance/create-conto-agent  /  0.3.0

@conto_finance/create-conto-agent@0.3.0

CLI quickstart for Conto — Agentic Payments Control Center

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 9 file(s), 99.5 KB of source, external domains: 127.0.0.1, conto.finance, explore.moderato.tempo.xyz, explore.tempo.xyz, github.com, rpc.moderato.tempo.xyz, rpc.tempo.xyz

Source & flagged code

3 flagged · loading source
dist/chunk-ICDSTI2Z.jsView file
85import path from "path"; L86: import { spawnSync } from "child_process"; L87:
High
Child Process

Package source references child process execution.

dist/chunk-ICDSTI2Z.jsView on unpkg · L85
15L16: // package.json L17: var package_default = { ... L53: type: "git", L54: url: "https://github.com/kwattana/conto.git", L55: directory: "packages/cli" ... L85: import path from "path"; L86: import { spawnSync } from "child_process"; L87: ... L146: if (!res.ok) throw new Error(`HTTP ${res.status}`); L147: const data = await res.json(); L148: const chains = {};
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-ICDSTI2Z.jsView on unpkg · L15
dist/cli.jsView file
1407// src/commands/mcp.ts L1408: import { spawn } from "child_process"; L1409: async function mcpCommand() { ... L1411: if (!config.apiKey) { L1412: printError('Not configured. Run "npx create-conto-agent" or "conto login" first.'); L1413: process.exit(1);
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L1407

Findings

4 High3 Medium4 Low
HighChild Processdist/chunk-ICDSTI2Z.js
HighShell
HighSandbox Evasion Gated Capabilitydist/chunk-ICDSTI2Z.js
HighRuntime Package Installdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings