registry / @farmost/social-agent / 4.0.3

@farmost/social-agent@4.0.3

社交关系AI管家 - 独立 CLI 工具。自动追踪社交关系，帮你拟消息、记待办、维护人脉。v3.0 起支持多 LLM provider（Claude/OpenAI/MiniMax）。

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystem

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 5.12 KB of source, external domains: www.python.org

Source & flagged code

7 flagged

package.jsonView file

Lines 15-55json

15 "url": "https://github.com/farmost-beep/social-agent/issues"

16 },

17 "homepage": "https://github.com/farmost-beep/social-agent#readme",

18 "keywords": [

19 "claude-code",

20 "claude-code-skill",

21 "social"

Source & flagged code

7 flagged · loading source

package.jsonView file

•scripts.postinstall = node ./bin/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node ./bin/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/postinstall.jsView file

5*/ L6: const { execSync } = require('child_process'); L7: const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L5

5*/ L6: const { execSync } = require('child_process'); L7: const fs = require('fs'); ... L9: L10: const ROOT = path.join(__dirname, '..'); L11: const python = process.platform === 'win32' ? 'python' : 'python3'; L12: ... L28: } catch { L29: console.warn('⚠ 未检测到 Python 3，请先安装: https://www.python.org/downloads/'); L30: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/postinstall.jsView on unpkg · L5

bin/cli.jsView file

5* 用法: L6: * npx @farmost/social-agent <args> # 走 social 命令（v3 统一入口） L7: * social-agent <args> # 兼容 v2 入口 ... L14: */ L15: const { spawn } = require('child_process'); L16: const path = require('path');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L5

social_cli/__init__.pyView file

•path = social_cli/__init__.py kind = build_helper sizeBytes = 375 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

social_cli/__init__.pyView on unpkg

tests/test_engine.pyView file

•path = tests/test_engine.py kind = payload_in_excluded_dir sizeBytes = 5388 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tests/test_engine.pyView on unpkg

Findings

5 High4 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/postinstall.js

HighSandbox Evasion Gated Capabilitybin/postinstall.js

HighRuntime Package Installbin/cli.js

HighPayload In Excluded Dirtests/test_engine.py

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumEnvironment Vars

MediumShips Build Helpersocial_cli/__init__.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

bin/postinstall.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * social-agent — npm postinstall 脚本

4 * 自动安装 Python 依赖并初始化数据目录

5 */

6const { execSync } = require('child_process');

7const fs = require('fs');

High

Child Process

Package source references child process execution.

bin/postinstall.jsView on unpkg · L5

8const path = require('path');

10const ROOT = path.join(__dirname, '..');

11const python = process.platform === 'win32' ? 'python' : 'python3';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/postinstall.jsView on unpkg · L5

13function run(cmd, opts = {}) {

14 try {

15 execSync(cmd, { cwd: ROOT, stdio: 'inherit', ...opts });

16 return true;

17 } catch {

18 return false;

19 }

20}

22console.log('\n:: social-agent 安装中...\n');

24// 1. 检查 Python

25try {

bin/cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2/**

3 * social-agent / social — CLI 入口（npm 包装层 v3.0）

4 *

5 * 用法:

6 * npx @farmost/social-agent <args> # 走 social 命令（v3 统一入口）

7 * social-agent <args> # 兼容 v2 入口

8 * social <args> # v3 统一入口

9 *

10 * v3.0 行为变化：

11 * - 默认调 social_cli/cli.py（v3 统一入口）

12 * - social-agent 子命令调 src/social.py（v2 兼容）

13 * - 自动检测哪个 Python 模块可用

14 */

15const { spawn } = require('child_process');

16const path = require('path');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L5

17const fs = require('fs');

18const { exit } = require('process');

20const python = process.platform === 'win32' ? 'python' : 'python3';

21const ROOT = path.join(__dirname, '..');

22const args = process.argv.slice(2);

24// 判断用哪个入口

25// 1. 如果显式调用 `social-agent` bin（通过 npm bin link），走 v2