registry / @monadeo.com/grimoire-cli / 0.2.2

@monadeo.com/grimoire-cli@0.2.2

Grimoire CLI — version-correct documentation retrieval for AI coding agents

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 24.4 KB of source, external domains: 127.0.0.1, grimoire-api-qa.monadeo.com, grimoire-api.monadeo.com

Source & flagged code

4 flagged

dist/index.jsView file

Lines 1-24javascript

1#!/usr/bin/env node

2import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);

4// src/index.ts

5import { execFileSync } from "node:child_process";

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L4

7// ../core/dist/config.js

8import { readFileSync, existsSync, mkdirSync, writeFileSync } from "node:fs";

9import { homedir } from "node:os";

10import { dirname, join } from "node:path";

11var DEFAULT_API_BASE = "https://grimoire-api.monadeo.com";

12function globalConfigPath() {

13 return join(process.env.XDG_CONFIG_HOME ?? join(homedir(), ".config"), "grimoire", "config.json");

14}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L4

15function readJsonConfig(path) {

16 try {

17 return JSON.parse(readFileSync(path, "utf8"));

18 } catch (err) {

19 process.stderr.write(`grimoire: ignoring malformed config at ${path}: ${err.message}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L4

20`);

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L4

21 return void 0;

22 }

23}

24function loadGlobalConfig() {

Source & flagged code

4 flagged · loading source

dist/index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code