registry  /  @ia-ccun/code-agent-cli  /  0.0.53

@ia-ccun/code-agent-cli@0.0.53

AI Coding Agent CLI - 基于OpenClaw🦞底层Agent原理封装的编码智能体（供学习使用）。

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 31 file(s), 424 KB of source, external domains: github.com, www.npmjs.com

Source & flagged code

10 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/cli.jsView file
10L11: import { spawn } from 'child_process'; L12: import { fileURLToPath } from 'url';
High
Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L10
config/agent/skills/brainstorming/scripts/server.cjsView file
1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L11: function computeAcceptKey(clientKey) { L12: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L13: } ... L75: L76: const PORT = process.env.BRAINSTORM_PORT || (49152 + Math.floor(Math.random() * 16383)); L77: const HOST = process.env.BRAINSTORM_HOST || '127.0.0.1'; ... L98: L99: const frameTemplate = fs.readFileSync(path.join(__dirname, 'frame-template.html'), 'utf-8'); L100: const helperScript = fs.readFileSync(path.join(__dirname, 'helper.js'), 'utf-8');
Low
Weak Crypto

Package source references weak cryptographic algorithms.

config/agent/skills/brainstorming/scripts/server.cjsView on unpkg · L1
scripts/postinstall.jsView file
8Manifest entrypoint (scripts.postinstall) carries capability families absent from dist/build output: environment+network, execution+network L8: import { fileURLToPath } from 'url'; L9: import { spawn } from 'child_process'; L10: L11: // Get __dirname equivalent for ES modules L12: const __filename = fileURLToPath(import.meta.url); ... L39: const stream = createWriteStream(SECURITY_LOG, { flags: 'a', mode: 0o600 }); L40: stream.write(JSON.stringify(entry) + '\n'); L41: stream.end(); ... L45: L46: if (process.env.DEBUG) { L47: console.error(`[🔒 安全] ${event}:`, details); ... L71: // ============================================================================
High
Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

scripts/postinstall.jsView on unpkg · L8
config/agent/extensions/custom.tsView file
145await new Promise<void>((resolve) => { L146: exec("npm install -g @ia-ccun/code-agent-cli", (error, stdout, stderr) => { L147: if (error) {
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

config/agent/extensions/custom.tsView on unpkg · L145
config/agent/bin/fdView file
•path = config/agent/bin/fd kind = native_binary sizeBytes = 3558816 magicHex = [redacted]
Medium
Ships Native Binary

Package ships native binary artifacts.

config/agent/bin/fdView on unpkg
config/agent/skills/ui-ux-pro-max/scripts/core.pyView file
•path = config/agent/skills/ui-ux-pro-max/scripts/core.py kind = build_helper sizeBytes = 9111 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

config/agent/skills/ui-ux-pro-max/scripts/core.pyView on unpkg
config/agent/skills/milvus-skill/references/user-role.mdView file
7patternName = generic_password severity = medium line = 7 matchedText = client.c...23")
Medium
Secret Pattern

Hardcoded password in config/agent/skills/milvus-skill/references/user-role.md

config/agent/skills/milvus-skill/references/user-role.mdView on unpkg · L7
16patternName = generic_password severity = medium line = 16 matchedText = client.u...56")
Medium
Secret Pattern

Hardcoded password in config/agent/skills/milvus-skill/references/user-role.md

config/agent/skills/milvus-skill/references/user-role.mdView on unpkg · L16

Findings

5 High8 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/cli.js
HighShell
HighEntrypoint Build Divergencescripts/postinstall.js
HighRuntime Package Installconfig/agent/extensions/custom.ts
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Native Binaryconfig/agent/bin/fd
MediumShips Build Helperconfig/agent/skills/ui-ux-pro-max/scripts/core.py
MediumStructural Risk Force Deep Review
MediumSecret Patternconfig/agent/skills/milvus-skill/references/user-role.md
MediumSecret Patternconfig/agent/skills/milvus-skill/references/user-role.md
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptoconfig/agent/skills/brainstorming/scripts/server.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings