registry / @lawrencehui/citio / 0.3.0

@lawrencehui/citio@0.3.0

Self-hosted AI coding agents that live in Slack — run Claude Code or Codex in your own infra, ship PRs, and keep every credential behind a controlled MCP tool layer.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 19 file(s), 200 KB of source, external domains: api.github.com, api.slack.com, auth.openai.com, awscli.amazonaws.com, example.com, get.docker.com, git-scm.com, github.com, slack.com, www.docker.com

Source & flagged code

4 flagged

dist/core/agent-runner.jsView file

Lines 1-21javascript

1import { spawn } from "child_process";

2import { writeFileSync, mkdirSync, existsSync } from "fs";

High

Child Process

Package source references child process execution.

dist/core/agent-runner.jsView on unpkg · L1

3import path from "path";

4import { ensureCodexMcpConfigured }

Source & flagged code

4 flagged · loading source

dist/core/agent-runner.jsView file

1import { spawn } from "child_process"; L2: import { writeFileSync, mkdirSync, existsSync } from "fs";

High

Child Process

Package source references child process execution.

dist/core/agent-runner.jsView on unpkg · L1

dist/index.jsView file

51hasAuthFile: fs.existsSync(authPath), L52: hasApiKey: Boolean(process.env.OPENAI_API_KEY), L53: })); ... L64: console.log(JSON.stringify({ type: "token_refresh", status: "refreshing" })); L65: const { execSync: ex } = await import("child_process"); L66: const resp = ex(`curl -s -X POST "https://auth.openai.com/oauth/token" -H "Content-Type: application/json" -d '{"grant_type":"refresh_token","refresh_token":"${refreshToken}","clie... L67: const fresh = JSON.parse(resp);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L51

dist/cli/init.jsView file

3import pc from "picocolors"; L4: import { execSync, execFileSync } from "child_process"; L5: import { writeFileSync, readFileSync, existsSync, chmodSync, unlinkSync } from "fs"; ... L57: docker: "docker — runs the container build\n" + L58: " macOS/Windows: install Docker Desktop → https://www.docker.com/products/docker-desktop/\n" + L59: " Linux: curl -fsSL https://get.docker.com | sh\n" + ... L105: }); L106: const identity = JSON.parse(identityJson); L107: p.log.success(`AWS credentials verified — deploying to account ${identity.Account}` + ... L140: void homeDir; L141: if (process.env.CLAUDE_CODE_OAUTH_TOKEN) { L142: if (validateClaudeOauthToken(process.env.CLAUDE_CODE_OAUTH_TOKEN)) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/init.jsView on unpkg · L3

dist/core/skills.jsView file

1import { execSync } from "child_process"; L2: import { cpSync, existsSync, mkdirSync, mkdtempSync, rmSync } from "fs"; ... L5: // Curated for Citio's job (investigate bugs, read logs, fix code, open PRs). L6: // Every install command below is verified working with `npx skills add`. L7: export const SKILL_REGISTRY = {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/skills.jsView on unpkg · L1

Findings

5 High3 Medium5 Low

HighChild Processdist/core/agent-runner.js

HighShell

HighSame File Env Network Executiondist/index.js

HighSandbox Evasion Gated Capabilitydist/cli/init.js

HighRuntime Package Installdist/core/skills.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/index.jsView file

Lines 31-71javascript

31 const config = CitioConfigSchema.parse(rawConfig);

32 const workspacePath = process.env.CITIO_WORKSPACE || "/workspace";

33 console.log(JSON.stringify({

34 type: "startup",

35 name: config.name,

36 provider: config.engine.default_provider,

37 channel: config.slack.channel_id,

38 workspace: workspacePath,

39 repos: config.workspace.repos.length,

40 skills: config.skills.installed.length,

41 }));

42 // Refresh Codex tokens on startup (id_token expires every hour)

43 if (config.engine.default_provider === "codex") {

44 const fs = await import("fs");

45 const home = process.env.HOME || "/home/citio";

46 const authPath = getCodexAuthPath(home);

47 console.log(JSON.stringify({

48 type: "codex_auth_check",

49 home,

50 authPath,

51 hasAuthFile: fs.existsSync(authPath),

52 hasApiKey: Boolean(process.env.OPENAI_API_KEY),

53 }));

54 if (!hasCodexCredentials()) {

55 console.log(JSON.stringify({

56 type: "codex_auth_missing",

57 message: formatCodexAuthHint(home),

58 }));

59 }

60 try {

61 const authData = JSON.parse(fs.readFileSync(authPath, "utf-8"));

62 const refreshToken = authData?.tokens?.refresh_token;

63 if (refreshToken) {

64 console.log(JSON.stringify({ type: "token_refresh", status: "refreshing" }));

65 const { execSync: ex } = await import("child_process");

66 const resp = ex(`curl -s -X POST "https://auth.openai.com/oauth/token" -H "Content-Type: application/json" -d '{"grant_type":"refresh_token","refresh_token":"${refreshToken}","client_id":"app_EMoamEEZ73f0CkXaXp7hrann"}'`, { encoding: "utf-8", timeout: 15000 });

67 const fresh = JSON.parse(resp);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L51

68 if (fresh.id_token && fresh.access_token) {

69 authData.tokens.id_token = fresh.id_token;

70 authData.tokens.access_token = fresh.access_token;

71 if (fresh.refresh_token)

dist/cli/init.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import * as p from "@clack/prompts";

3import pc from "picocolors";

4import { execSync, execFileSync } from "child_process";

5import { writeFileSync, readFileSync, existsSync, chmodSync, unlinkSync } from "fs";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli/init.jsView on unpkg · L3

6import path from "path";

7import os from "os";

8import { parse, stringify } from "yaml";

9import { extractClaudeOauthTokenFromTranscript, normalizeClaudeOauthToken, validateClaudeOauthToken } from "../utils/claude.js";

10import { loadSavedInstallerState, saveInstallerState } from "../utils/installer-state.js";

11import { buildCitioSlackManifest, createCitioSlackApp, openBrowser, testSlackBotToken, validateSlackAppToken, validateSlackBotToken, validateSlackConfigToken, } from "../utils/slack-onboarding.js";

12import { SKILL_REGISTRY, installSkillsTo } from "../core/skills.js";

13import { destroyCommand, pauseCommand, resumeCommand, statusCommand } from "./ops.js";

14// --- styling helpers (color = information, not decoration) --------------------

15/** inline command the user should run: cyan */

16const cmd = (s) => pc.cyan(s);

17/** clickable/visitable URL: underlined cyan */

18const url = (s) => pc.underline(pc.cyan(s));

19/** step/section header inside a note: bold */

20const step = (s) => pc.bold(s);

21/** literal value/token prefix to recognise: yellow */

22const val = (s) => pc.yellow(s);

23/** caution line: yellow */

dist/core/skills.jsView file

Lines 1-21javascript

1import { execSync } from "child_process";

2import { cpSync, existsSync, mkdirSync, mkdtempSync, rmSync } from "fs";

3import os from "os";

4import path from "path";

5// Curated for Citio's job (investigate bugs, read logs, fix code, open PRs).

6// Every install command below is verified working with `npx skills add`.

7export const SKILL_REGISTRY = {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/skills.jsView on unpkg · L1

8 "systematic-debugging": {

9 url: "obra/superpowers --skill systematic-debugging",

10 description: "Root-cause debugging discipline — find the bug before patching it",

11 installMethod: "npx-skills",

12 },

13 "code-review": {

14 url: "obra/superpowers --skill receiving-code-review",

15 description: "Systematic code-review discipline — respond to and act on review feedback",

16 installMethod: "npx-skills",

17 },

18 "webapp-testing": {

19 url: "anthropics/skills --skill webapp-testing",

20 description: "Official Anthropic: verify fixes by driving the web app in a browser",

21 installMethod: "npx-skills",