registry / @lmctl-ai/lmctl / 0.1.140

@lmctl-ai/lmctl@0.1.140

A provider-agnostic control plane for teams of AI coding agents — across providers, with independent review and durable memory.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 808 KB of source, external domains: 127.0.0.1, antigravity.google, api.github.com, cli.github.com, docs.anthropic.com, docs.claude.com, docs.github.com, github.com, lmctl.ai, lmctl.anthropic.com, lmctl.com, mailbox.local, nodejs.org, opencode.ai, registry.npmjs.org, unpkg.com

Source & flagged code

4 flagged

dist/cli/index.jsView file

4`).map(t=>Dn(t)).join(` L5: `)}function Vf(e,t){let r=e.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=u.slice(Math.max(0,u.length-n));c=f.length,a=Pn(f.join(`

High

Child Process

Package source references child process execution.

dist/cli/index.jsView on unpkg · L4

1755${t.map(r=>` line ${r.line}: ${r.message}`).join(` L1756: `)}`),this.issues=t,this.name="DslCompileError"}},uR=new Set(["lmctl/assert-repo-clean","lmctl/review","lmctl/consolidate","lmctl/interactive","lmctl/loop","lmctl/render-docx","lmc... L1757: `)){let r=t.replace(/#.*/,"").trim();if(r.length!==0)return/^workflow\s+\S+\s+v\d+\s*$/.test(r)}return!1}function ct(e){if(typeof e=="string"&&hR()&&gR(e)){let r;try{r=ch(e)}catch(... L1758: `)||t.startsWith("{")||t.startsWith("[")?fh(e):t.endsWith(".json")?fh(_R(t,"utf8")):e}function fh(e){return JSON.parse(e)}function ER(e){return e!==null&&typeof e=="object"&&!Array... L1759: description: ${r}`:"";return`---

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli/index.jsView on unpkg · L1755

1751and report the first step that would be started. Default output is the TTY L1752: table; --json emits the structured WorkflowVerifyReport payload.`;vA=["open","assigned","closed","reopened"]});import V_ from"jexl";function an(e){V_.compile(K_(e))}async function ... L1753: `)||t.startsWith("{")||t.startsWith("[")?eh(e,"$"):t.endsWith(".json")?eh(QA(t,"utf8"),t):e}function eh(e,t){try{return JSON.parse(e)}catch(r){let n=r instanceof Error?r.message:"i... ... L1757: `)){let r=t.replace(/#.*/,"").trim();if(r.length!==0)return/^workflow\s+\S+\s+v\d+\s*$/.test(r)}return!1}function ct(e){if(typeof e=="string"&&hR()&&gR(e)){let r;try{r=ch(e)}catch(... L1758: `)||t.startsWith("{")||t.startsWith("[")?fh(e):t.endsWith(".json")?fh(_R(t,"utf8")):e}function fh(e){return JSON.parse(e)}function ER(

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli/index.jsView on unpkg · L1751

1var fk=Object.defineProperty;var T=(e,t)=>()=>(e&&(t=e(e=0)),t);var ye=(e,t)=>{for(var r in t)fk(e,r,{get:t[r],enumerable:!0})};import{existsSync as Hs,readdirSync as wH,readFileSy... L2: `)}function Va(){return Mt(br(),yk)}function Hf(){return Mt(br(),wk)}function Tk(){try{return Hs(Va())}catch{return!1}}function Jf(e=process.stderr){Tk()&&e.write(`note: legacy ~/.... ... L4: `).map(t=>Dn(t)).join(` L5: `)}function Vf(e,t){let r=e.toUpperCase();return r.includes("TOKEN")||r.includes("SECRET")||r.includes("KEY")||r.includes("PASSWORD")||r.includes("PASSWD")||r.includes("CREDENTIAL"... L6: `),f=u.slice(Math.max(0,u.length-n));c=f.length,a=Pn(f.join(` ... L14: `).filter(o=>o.length>0),i=s.slice(Math.max(0,s.length-r));return{source_path:t,tail_lines:i.length,tail:Pn(i.join(` L15: `)),not

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli/index.jsView on unpkg · L1

Source & flagged code

4 flagged · loading source

dist/cli/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code