registry / @pentoshi/clai / 2.0.27

@pentoshi/clai@2.0.27

A fast, cross-platform AI CLI assistant with ask and agent modes for shell tasks, file operations, and cybersecurity workflows.

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 113 file(s), 1.11 MB of source, external domains: agentrouter.org, api.anthropic.com, api.github.com, api.groq.com, api.openai.com, bedrock-mantle.ap-south-1.api.aws, example.com, generativelanguage.googleapis.com, github.com, html.duckduckgo.com, integrate.api.nvidia.com, llm.kimchi.dev, openrouter.ai, router.bynara.id

Source & flagged code

2 flagged

dist/store/keys.jsView file

Lines 14-54javascript

14// is NOT encrypted; it is plaintext that the OS protects with file permissions.

15// The agent is also blocked from reading that path (see safety/patterns.ts).

16const keychainModuleName = '@napi-rs/keyring/keytar.js';

17const keysFile = join(homedir(), '.clai', 'keys.json');

18let cachedKeytar;

19let keytarLoadAttempted = false;

20// On many Linux servers and most Windows non-interactive sessions the

21// napi-rs keyring binary loads cleanly but the underlying OS keystore

22// (libsecret/DBus on Linux, Windows Credential Manager) is unreachable.

23// In that case the first call fails — we record it and stop trying

24// for the rest of the process so every read/write/delete falls back

25// to the restricted-permission plaintext JSON file silently.

26let keychainRuntimeUnavailable = false;

27let keychainRuntimeWarned = false;

28async function loadKeytar() {

29 if (cachedKeytar)

30 return cachedKeytar;

31 if (keytarLoadAttempted)

32 return cachedKeytar;

33 keytarLoadAttempted = true;

34 try {

35 const imported = (await import(keychainModuleName));

36 cachedKeytar = imported.default ?? imported;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/store/keys.jsView on unpkg · L34

37 return cachedKeytar;

38 }

39 catch {

40 return undefined;

41 }

42}

43function isMissingKeychainError(error) {

44 // Best-effort detection so transient errors (eg locked keychain prompt

45 // dismissed) don't permanently disable the keychain. Anything that

46 // looks like a missing-platform-service signature gets latched off.

47 const message = error instanceof Error ? error.message : String(error);

49}

50function noteKeychainRuntimeFailure(error) {

51 if (isMissingKeychainError(error))

52 keychainRuntimeUnavailable = true;

53 if (!keychainRuntimeWarned) {

54 keychainRuntimeWarned = true;

dist/tools/web/ssrf-guard.jsView file

Lines 1-22javascript

1/**

2 * SSRF guard — classifies an address (or a hostname literal) as belonging

3 * to a private/loopback/link-local/cloud-metadata/CGNAT range.

4 *

5 * The structured {@link classify} / {@link classifyHost} helpers are used

6 * by the `web.fetch` pipeline (synchronous classifier branch + per-hop

7 * resolution check) and by the safety classifier in

8 * `src/safety/classifier.ts`.

Source & flagged code

2 flagged · loading source

dist/store/keys.jsView file

34try { L35: const imported = (await import(keychainModuleName)); L36: cachedKeytar = imported.default ?? imported;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/store/keys.jsView on unpkg · L34

dist/tools/web/ssrf-guard.jsView file

2* SSRF guard — classifies an address (or a hostname literal) as belonging L3: * to a private/loopback/link-local/cloud-metadata/CGNAT range. L4: * ... L19: */ L20: import net from "node:net"; L21: /** ... L23: * `http:` or `https:`. Returns `false` for any other scheme (including L24: * `ftp:`, `file:`, `data:`, `javascript:`, `gopher:`), for empty strings, L25: * for malformed inputs that fail `new URL()` parsing, and for non-string

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/tools/web/ssrf-guard.jsView on unpkg · L2

Findings

1 High4 Medium5 Low

HighCloud Metadata Accessdist/tools/web/ssrf-guard.js

MediumDynamic Requiredist/store/keys.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/store/keys.jsView file

Lines 14-54javascript

14// is NOT encrypted; it is plaintext that the OS protects with file permissions.

15// The agent is also blocked from reading that path (see safety/patterns.ts).

16const keychainModuleName = '@napi-rs/keyring/keytar.js';

17const keysFile = join(homedir(), '.clai', 'keys.json');

18let cachedKeytar;

19let keytarLoadAttempted = false;

20// On many Linux servers and most Windows non-interactive sessions the

21// napi-rs keyring binary loads cleanly but the underlying OS keystore

22// (libsecret/DBus on Linux, Windows Credential Manager) is unreachable.

23// In that case the first call fails — we record it and stop trying

24// for the rest of the process so every read/write/delete falls back

25// to the restricted-permission plaintext JSON file silently.

26let keychainRuntimeUnavailable = false;

27let keychainRuntimeWarned = false;

28async function loadKeytar() {

29 if (cachedKeytar)

30 return cachedKeytar;

31 if (keytarLoadAttempted)

32 return cachedKeytar;

33 keytarLoadAttempted = true;

34 try {

35 const imported = (await import(keychainModuleName));

36 cachedKeytar = imported.default ?? imported;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/store/keys.jsView on unpkg · L34

37 return cachedKeytar;

38 }

39 catch {

40 return undefined;

41 }

42}

43function isMissingKeychainError(error) {

44 // Best-effort detection so transient errors (eg locked keychain prompt

45 // dismissed) don't permanently disable the keychain. Anything that

46 // looks like a missing-platform-service signature gets latched off.

47 const message = error instanceof Error ? error.message : String(error);

49}

50function noteKeychainRuntimeFailure(error) {

51 if (isMissingKeychainError(error))

52 keychainRuntimeUnavailable = true;

53 if (!keychainRuntimeWarned) {

54 keychainRuntimeWarned = true;

dist/tools/web/ssrf-guard.jsView file

Lines 1-22javascript

1/**

2 * SSRF guard — classifies an address (or a hostname literal) as belonging

3 * to a private/loopback/link-local/cloud-metadata/CGNAT range.

4 *

5 * The structured {@link classify} / {@link classifyHost} helpers are used

6 * by the `web.fetch` pipeline (synchronous classifier branch + per-hop

7 * resolution check) and by the safety classifier in

8 * `src/safety/classifier.ts`.