Static Scan Results
scanned 2h ago · by rust-scannerStatic analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
HighEntropyStringsMinifiedUrlStrings
Source & flagged code
7 flagged · loading sourcedist-electron/tests/electron/condition-trigger-skill.test.jsView file
10const node_os_1 = require("node:os");
L11: const node_child_process_1 = require("node:child_process");
L12: const managed_skill_catalog_js_1 = require("../../services/local-ai-core/src/runtime/managed-sk[redacted]");
High
Child Process
Package source references child process execution.
dist-electron/tests/electron/condition-trigger-skill.test.jsView on unpkg · L10dist-electron/services/local-ai-core/src/automation/scripts/anthropic-sandbox-runner.jsView file
2Object.defineProperty(exports, "__esModule", { value: true });
L3: exports.isPrivateNetworkAddress = exports.AnthropicSandboxRunner = exports.buildSandboxConfig = exports.SandboxUnavailableError = exports.PRIVATE_NETWORK_DENY_HOSTS = void 0;
L4: exports.buildSandboxRuntimeConfig = buildSandboxRuntimeConfig;
L5: exports.createAnthropicSandboxRunner = createAnthropicSandboxRunner;
L6: const node_child_process_1 = require("node:child_process");
L7: const promises_1 = require("node:dns/promises");
L8: const node_fs_1 = require("node:fs");
...
L83: function buildSandboxRuntimeConfig(input) {
L84: const cwd = input.cwd || input.workspacePath || process.cwd();
L85: const packagePath = absolutePath(input.packagePath || input.packageRoot || cwd);
...
L160: constructor(options = {}) {
L161: this.platform = normalizePlatform(options.platform || process.platform);
High
Cloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
dist-electron/services/local-ai-core/src/automation/scripts/anthropic-sandbox-runner.jsView on unpkg · L2432// Function avoids transpiling this call to require(), since ASRT is ESM.
L433: const dynamicImport = new Function('specifier', 'return import(specifier)');
L434: const module = await dynamicImport('@anthropic-ai/sandbox-runtime');
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist-electron/services/local-ai-core/src/automation/scripts/anthropic-sandbox-runner.jsView on unpkg · L432dist-electron/tests/integration/lark-gateway.test.jsView file
5Object.defineProperty(exports, "__esModule", { value: true });
L6: const node_test_1 = __importDefault(require("node:test"));
L7: const strict_1 = __importDefault(require("node:assert/strict"));
Medium
Dynamic Require
Package source references dynamic require/import behavior.
dist-electron/tests/integration/lark-gateway.test.jsView on unpkg · L5dist-electron/electron/main.jsView file
3Manifest entrypoint (manifest.main) carries capability families absent from dist/build output: environment+network, execution+network
L3: const electron_1 = require("electron");
L4: const node_child_process_1 = require("node:child_process");
L5: const node_fs_1 = require("node:fs");
L6: const node_net_1 = require("node:net");
L7: const node_path_1 = require("node:path");
...
L10: let localCoreStartupPromise = null;
L11: const userDataOverride = process.env.AI_WORKSTATION_USER_DATA_DIR?.trim();
L12: const smokeOutputPath = process.env.AI_WORKSTATION_SMOKE_OUTPUT?.trim();
...
L73: }
L74: return response.json();
L75: }
...
L131: icon: (0, node_fs_1.existsSync)(iconPath) ? iconPath : undefined,
High
Entrypoint Build Divergence
Manifest entrypoint contains risky behavior absent from dist/build output.
dist-electron/electron/main.jsView on unpkg · L3dist-electron/tests/electron/knowledge-skill-script.test.jsView file
7const strict_1 = __importDefault(require("node:assert/strict"));
L8: const node_http_1 = require("node:http");
L9: const node_child_process_1 = require("node:child_process");
L10: const node_path_1 = require("node:path");
...
L16: env: {
L17: ...process.env,
L18: ...env,
High
Same File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
dist-electron/tests/electron/knowledge-skill-script.test.jsView on unpkg · L7dist-electron/electron/managed-skills/agent-browser/templates/capture-workflow.shView file
•path = dist-electron/electron/managed-skills/agent-browser/templates/capture-workflow.sh
kind = build_helper
sizeBytes = 309
magicHex = [redacted]
Medium
Ships Build Helper
Package ships non-JavaScript build or shell helper files.
dist-electron/electron/managed-skills/agent-browser/templates/capture-workflow.shView on unpkgFindings
5 High5 Medium5 Low
HighChild Processdist-electron/tests/electron/condition-trigger-skill.test.js
HighShell
HighEntrypoint Build Divergencedist-electron/electron/main.js
HighSame File Env Network Executiondist-electron/tests/electron/knowledge-skill-script.test.js
HighCloud Metadata Accessdist-electron/services/local-ai-core/src/automation/scripts/anthropic-sandbox-runner.js
MediumDynamic Requiredist-electron/tests/integration/lark-gateway.test.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist-electron/electron/managed-skills/agent-browser/templates/capture-workflow.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowEvaldist-electron/services/local-ai-core/src/automation/scripts/anthropic-sandbox-runner.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings