registry / @lebtiga/sonic-agent / 2.0.15

@lebtiga/sonic-agent@2.0.15

Sonic — a specialized AI agent for building WordPress authority websites at scale. Founders cohort license required.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 20 file(s), 120 KB of source, external domains: api.anthropic.com, api.openai.com, api.pexels.com, claude.com, fal.run, generativelanguage.googleapis.com, nodejs.org, sonic.saasperity.com, zjvmclbpjjzsmboptwgk.supabase.co

Source & flagged code

6 flagged

package.jsonView file

Lines 6-46json

6 "wordpress",

7 "ai",

8 "agent",

9 "seo",

10 "authority-site",

11 "claude-code",

12 "openclaw"

13 ],

14 "homepage": "https://sonic.saasperity.com",

15 "bugs": {

16 "url": "https://github.com/lebtiga/sonic-agent/issues",

17 "email": "rob@rizkadvertising.com"

18 },

19 "license": "Commercial",

20 "author": "Rob Rizk <rob@rizkadvertising.com>",

21 "main": "lib/index.js",

22 "bin": {

23 "sonic": "bin/sonic.js"

24 },

25 "scripts": {

26 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "build:skillpack": "node scripts/build-skillpack.js",

28 "verify:carve": "node scripts/verify-carve.js"

29 },

30 "files": [

31 "bin/",

32 "lib/",

33 "scripts/",

34 "README.md",

35 "LICENSE.txt",

36 "plugin/",

37 "!plugin/sops/**",

38 "!plugin/skills/aka-wireframe-wp/**",

39 "!plugin/skills/sonic-boom/**",

40 "!plugin/skills/brand-philosophy/**",

41 "!plugin/skills/visual-identity/**",

42 "!plugin/skills/programmatic-seo/**",

43 "!plugin/skills/sonic-templatize/**",

44 "!plugin/skills/sonic-instantiate/**",

45 "!plugin/skills/sonic-motion/**",

46 "!plugin/skills/wordpress-pro/**",

lib/server-validate.jsView file

Lines 4-44javascript

4// - 5 second timeout per request

5// - Returns the parsed JSON response on success

6// - Throws { kind: 'network', message } on connection/timeout/DNS failure

7// - Throws { kind: 'server', status, body } on HTTP 4xx/5xx

8//

9// Callers (lib/license.js, bin/sonic.js) are responsible for translating

10// these into user-facing messages and deciding whether to fall back to cache.

12const https = require('node:https');

bin/sonic.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// Sonic CLI — main entry point

3// Usage:

4// sonic start the Sonic agent (launches Claude Code with the plugin)

5// sonic init scaffold a new project workspace in the current directory

6// sonic activate enter/re-enter your license key (if postinstall was skipped)

7// sonic update pull the latest sonic-agent core (preserves user/skills folders)

8// sonic autopilot hands-off build — approve the plan, then build every page unattended

9// sonic status show install state, license info, version

10// sonic --version print version

11// sonic --help show this help

lib/doctor.jsView file

Lines 1-32javascript

1// Sonic Doctor — diagnostic + self-heal command.

2//

3// `sonic doctor` runs all checks, prints a report, suggests fixes

4// `sonic doctor --fix` runs the same checks, then applies safe auto-fixes

5//

6// Checks are grouped: ENVIRONMENT, LICENSE, INSTALL, CONFIG, CONNECTIVITY.

7// Each check returns { status: 'ok'|'warn'|'fail', label, detail?, fix? }

8// where `fix` (if present) is { description, auto: bool, run: async fn }.

10const fs = require(

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

lib/server-validate.jsView file

24patternName = supabase_service_key severity = critical line = 24 matchedText = 'eyJhbGc...MY';

Critical

Critical Secret

Package contains a critical-looking secret pattern.

lib/server-validate.jsView on unpkg · L24

24patternName = supabase_service_key severity = critical line = 24 matchedText = 'eyJhbGc...MY';

Critical

Secret Pattern

Supabase service role key (JWT) in lib/server-validate.js

lib/server-validate.jsView on unpkg · L24

bin/sonic.jsView file

12L13: const fs = require('fs'); L14: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/sonic.jsView on unpkg · L12

lib/doctor.jsView file

12const os = require('node:os'); L13: const https = require('node:https'); L14: const { execSync, spawnSync } = require('node:child_process'); L15: ... L26: L27: const pkg = require('../package.json'); L28: ... L50: function findClaudeBin() { L51: const PATH = process.env.PATH || ''; L52: const sep = process.platform === 'win32' ? ';' : ':'; L53: const ext = process.platform === 'win32' ? ['.exe', '.cmd', ''] : ['']; ... L80: // The #1 support ticket: root-owned npm cache / global dir.

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/doctor.jsView on unpkg · L12

Findings

2 Critical2 High5 Medium4 Low

CriticalCritical Secretlib/server-validate.js

CriticalSecret Patternlib/server-validate.js

HighInstall Time Lifecycle Scriptspackage.json

HighSandbox Evasion Gated Capabilitylib/doctor.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/sonic.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 6-46json

6 "wordpress",

7 "ai",

8 "agent",

9 "seo",

10 "authority-site",

11 "claude-code",

12 "openclaw"

13 ],

14 "homepage": "https://sonic.saasperity.com",

15 "bugs": {

16 "url": "https://github.com/lebtiga/sonic-agent/issues",

17 "email": "rob@rizkadvertising.com"

18 },

19 "license": "Commercial",

20 "author": "Rob Rizk <rob@rizkadvertising.com>",

21 "main": "lib/index.js",

22 "bin": {

23 "sonic": "bin/sonic.js"

24 },

25 "scripts": {

26 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L26

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L26

27 "build:skillpack": "node scripts/build-skillpack.js",

28 "verify:carve": "node scripts/verify-carve.js"

29 },

30 "files": [

31 "bin/",

32 "lib/",

33 "scripts/",

34 "README.md",

35 "LICENSE.txt",

36 "plugin/",

37 "!plugin/sops/**",

38 "!plugin/skills/aka-wireframe-wp/**",

39 "!plugin/skills/sonic-boom/**",

40 "!plugin/skills/brand-philosophy/**",

41 "!plugin/skills/visual-identity/**",

42 "!plugin/skills/programmatic-seo/**",

43 "!plugin/skills/sonic-templatize/**",

44 "!plugin/skills/sonic-instantiate/**",

45 "!plugin/skills/sonic-motion/**",

46 "!plugin/skills/wordpress-pro/**",

lib/server-validate.jsView file

Lines 4-44javascript

4// - 5 second timeout per request

5// - Returns the parsed JSON response on success

6// - Throws { kind: 'network', message } on connection/timeout/DNS failure

7// - Throws { kind: 'server', status, body } on HTTP 4xx/5xx

8//

9// Callers (lib/license.js, bin/sonic.js) are responsible for translating

10// these into user-facing messages and deciding whether to fall back to cache.

12const https = require('node:https');

bin/sonic.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2// Sonic CLI — main entry point

3// Usage:

4// sonic start the Sonic agent (launches Claude Code with the plugin)

5// sonic init scaffold a new project workspace in the current directory

6// sonic activate enter/re-enter your license key (if postinstall was skipped)

7// sonic update pull the latest sonic-agent core (preserves user/skills folders)

8// sonic autopilot hands-off build — approve the plan, then build every page unattended

9// sonic status show install state, license info, version

10// sonic --version print version

11// sonic --help show this help

lib/doctor.jsView file

Lines 1-32javascript

1// Sonic Doctor — diagnostic + self-heal command.

2//

3// `sonic doctor` runs all checks, prints a report, suggests fixes

4// `sonic doctor --fix` runs the same checks, then applies safe auto-fixes

5//

6// Checks are grouped: ENVIRONMENT, LICENSE, INSTALL, CONFIG, CONNECTIVITY.

7// Each check returns { status: 'ok'|'warn'|'fail', label, detail?, fix? }

8// where `fix` (if present) is { description, auto: bool, run: async fn }.

10const fs = require(