registry / @lmctl-ai/lmctl / 0.1.128

@lmctl-ai/lmctl@0.1.128

A provider-agnostic control plane for teams of AI coding agents — across providers, with independent review and durable memory.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 800 KB of source, external domains: 127.0.0.1, antigravity.google, api.github.com, cli.github.com, docs.anthropic.com, docs.claude.com, docs.github.com, github.com, lmctl.ai, lmctl.anthropic.com, lmctl.com, mailbox.local, nodejs.org, opencode.ai, registry.npmjs.org, unpkg.com

Source & flagged code

4 flagged

dist/cli/index.jsView file

4`).map(e=>Mn(e)).join(` L5: `)}function Jf(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=u.slice(Math.max(0,u.length-n));c=f.length,a=jn(f.join(`

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L4

1752${e.map(r=>` line ${r.line}: ${r.message}`).join(` L1753: `)}`),this.issues=e,this.name="DslCompileError"}},JA=new Set(["lmctl/assert-repo-clean","lmctl/review","lmctl/consolidate","lmctl/interactive","lmctl/loop","lmctl/render-docx","lmc... L1754: `)){let r=e.replace(/#.*/,"").trim();if(r.length!==0)return/^workflow\s+\S+\s+v\d+\s*$/.test(r)}return!1}function ct(t){if(typeof t=="string"&&YA()&&zA(t)){let r;try{r=oh(t)}catch(... L1755: `)||e.startsWith("{")||e.startsWith("[")?ch(t):e.endsWith(".json")?ch(KA(e,"utf8")):t}function ch(t){return JSON.parse(t)}function eR(t){return t!==null&&typeof t=="object"&&!Array... L1756: description: ${r}`:"";return`---

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L1752

1748and report the first step that would be started. Default output is the TTY L1749: table; --json emits the structured WorkflowVerifyReport payload.`;sA=["open","assigned","closed","reopened"]});import J_ from"jexl";function rn(t){J_.compile(X_(t))}async function ... L1750: `)||e.startsWith("{")||e.startsWith("[")?z_(t,"$"):e.endsWith(".json")?z_($A(e,"utf8"),e):t}function z_(t,e){try{return JSON.parse(t)}catch(r){let n=r instanceof Error?r.message:"i... ... L1754: `)){let r=e.replace(/#.*/,"").trim();if(r.length!==0)return/^workflow\s+\S+\s+v\d+\s*$/.test(r)}return!1}function ct(t){if(typeof t=="string"&&YA()&&zA(t)){let r;try{r=oh(t)}catch(... L1755: `)||e.startsWith("{")||e.startsWith("[")?ch(t):e.endsWith(".json")?ch(KA(e,"utf8")):t}function ch(t){return JSON.parse(t)}function eR(

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L1748

1var Gv=Object.defineProperty;var T=(t,e)=>()=>(t&&(e=t(t=0)),e);var ye=(t,e)=>{for(var r in e)Gv(t,r,{get:e[r],enumerable:!0})};import{existsSync as Hs,readdirSync as qq,readFileSy... L2: `)}function Ka(){return Ct(Er(),Qv)}function Wf(){return Ct(Er(),ek)}function rk(){try{return Hs(Ka())}catch{return!1}}function Bf(t=process.stderr){rk()&&t.write(`note: legacy ~/.... ... L4: `).map(e=>Mn(e)).join(` L5: `)}function Jf(t,e){let r=t.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=u.slice(Math.max(0,u.length-n));c=f.length,a=jn(f.join(` ... L14: `).filter(o=>o.length>0),i=s.slice(Math.max(0,s.length-r));return{source_path:e,tail_lines:i.length,tail:jn(i.join(` L15: `)),not

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index.jsView on unpkg · L1

Source & flagged code

4 flagged · loading source

dist/cli/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code