registry  /  @guangnao/agent-cli  /  1.3.1

@guangnao/agent-cli@1.3.1

AgentOS terminal CLI — drive a real LLM agent on the microkernel; strongest-UX shell, advanced agent core

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsObfuscatedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 678 KB of source, external domains: 127.0.0.1, aistudio.google.com, api.anthropic.com, api.deepseek.com, api.guangnao.com, api.openai.com, auth.openai.com, chatgpt.com, console.anthropic.com, generativelanguage.googleapis.com, guangnao.com, platform.deepseek.com, platform.openai.com

Source & flagged code

7 flagged · loading source
dist/cli.jsView file
7074// src/tools/shell.ts L7075: import { exec } from "node:child_process"; L7076: var MAX_OUT = 4e3;
High
Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L7074
7086schema: { name: "shell", description: "run a shell command and return stdout/stderr + exit code", parameters: { type: "object", required: ["command"], properties: { L7087: command: { type: "string", description: "the command line to run (sh -c)" }, L7088: cwd: { type: "string", description: "working directory (optional; defaults to where agentos was launched)" }
High
Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L7086
7086schema: { name: "shell", description: "run a shell command and return stdout/stderr + exit code", parameters: { type: "object", required: ["command"], properties: { L7087: command: { type: "string", description: "the command line to run (sh -c)" }, L7088: cwd: { type: "string", description: "working directory (optional; defaults to where agentos was launched)" } L7089: } } }, L7090: run: (i) => new Promise((resolve4) => { L7091: const { command, cwd } = i; L7092: if (!command || !command.trim()) return resolve4({ error: "empty command" }); L7093: exec(command, { cwd: cwd || process.env["AGENTOS_CWD"] || process.cwd(), timeout: 3e4, maxBuffer: 1 << 20 }, (err, stdout, stderr) => { L7094: const merged = (stdout + (stderr ? (stdout ? "\n" : "") + stderr : "")).trim();
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L7086
18031if (paintTimer) clearInterval(paintTimer); L18032: if (tty) process.stderr.write("\n"); L18033: try { ... L18038: closeLocal(); L18039: resolve4(); L18040: }; ... L18046: // src/cli.ts L18047: import { spawnSync, spawn as spawn6 } from "node:child_process"; L18048: import { homedir as homedir10 } from "node:os";
High
Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L18031
191function charWidth(ch) { L192: const cc = ch.length === 1 ? ch.charCodeAt(0) : -1; L193: if (cc >= 32 && cc <= 126) return 1; ... L285: GLYPH_MARKERS = /* @__PURE__ */ new Set(["\u23FA", "\u23BF", "\u2713", "\u2717", "\u25B8", "\u25CC", "\xB7", "-", "*", "!", "?", "\u25CF", "\u2514", "\xD7", "\u25BA", "\u25CB"]); L286: legacyWin = process.platform === "win32" && !process.env["WT_SESSION"] && process.env["TERM_PROGRAM"] !== "vscode" && !/xterm|screen|vt100/i.test(process.env["TERM"] ?? ""); L287: GLYPH = { ... L366: function terminalWidth() { L367: return process.stdout.columns || 80; L368: } ... L1229: graph[models[i]] = { L1230: // http://jsperf.com/1-vs-infinity L1231: // micro-opt, but this is simple.
High
Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L191
6514var openaiResponses = (cfg2) => { L6515: const base4 = (cfg2.baseUrl ?? "https://api.openai.com/v1").replace(/\/$/, ""); L6516: const headers = { "Content-Type": "application/json", Authorization: `Bearer ${cfg2.apiKey}` }; ... L7074: // src/tools/shell.ts L7075: import { exec } from "node:child_process"; L7076: var MAX_OUT = 4e3; ... L7140: try { L7141: const content = readFileSync(abs, "utf8"); L7142: const total = content.length; ... L9509: if (b.goal) parts.push(`Goal: ${b.goal}`); L9510: if (b.tools?.length) parts.push(`Available tools: ${b.tools.join(", ")}`); L9511: if (b.lessons?.length) parts.push(`Lessons to bake in:
High
Remote Agent Bridge

Source exposes local file and command tools to a remote model endpoint.

dist/cli.jsView on unpkg · L6514
1511"use strict"; L1512: var os = __require("os"); L1513: var tty = __require("tty");
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L1511

Findings

6 High4 Medium6 Low
HighChild Processdist/cli.js
HighShelldist/cli.js
HighSame File Env Network Executiondist/cli.js
HighCommand Output Exfiltrationdist/cli.js
HighSandbox Evasion Gated Capabilitydist/cli.js
HighRemote Agent Bridgedist/cli.js
MediumDynamic Requiredist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings