registry / @proagentstore/cli / 0.4.172
@proagentstore/cli@0.4.172
⚠ Under reviewCLI for creating, publishing, and running ProAgentStore agents
Static Scan Results
scanned 15d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 15 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
HighEntropyStringsUrlStrings
Source & flagged code
8 flaggeddist/browser-runner/site-builder/runtime.jsView file
32*/
L33: import { spawn as nodeSpawn } from "node:child_process";
L34: import { randomBytes } from "node:crypto";
High
Child Process
Package source references child process execution.
dist/browser-runner/site-builder/runtime.jsView on unpkg · L32dist/browser-runner/coding/actions-runner.jsView file
138if (asset.zip)
L139: await step(job, deps, "powershell", ["-NoProfile", "-Command", `Expand-Archive -Force -Path '${archive}' -DestinationPath '${job.dir}'`], req.token);
L140: else
High
Shell
Package source references shell execution.
dist/browser-runner/coding/actions-runner.jsView on unpkg · L13822*/
L23: import { execFile, spawnSync } from "node:child_process";
L24: import { randomUUID } from "node:crypto";
...
L47: const file = `actions-runner-${os}-${cpu}-${version}.${zip ? "zip" : "tar.gz"}`;
L48: return { file, url: `https://github.[redacted]${version}/${file}`, zip };
L49: }
...
L211: // `.runner` is written by config with a UTF-8 BOM on some platforms.
L212: const r = JSON.parse(raw.replace(/^/, ""));
L213: return { dir, managed, name: typeof r.agentName === "string" ? r.agentName : null, url: typeof r.gitHubUrl === "string" ? r.gitHubUrl : null };
...
L220: export function liveRunnerDeps() {
L221: const win = process.platform === "win32";
L222: return {
Findings
6 High5 Medium4 Low
HighChild Processdist/browser-runner/site-builder/runtime.js
HighShelldist/browser-runner/coding/actions-runner.js
HighSame File Env Network Executiondist/index.js
HighCommand Output Exfiltrationdist/index.js
HighSandbox Evasion Gated Capabilitydist/browser-runner/coding/actions-runner.js
HighSemantic Analysis Limiteddist/browser-runner/coding/repo.js#virtual:normalized:round1
MediumDynamic Requiredist/browser-runner/coding/runtime.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/index.js
MediumStructural Risk Force Deep Review
LowScripts Present
Low
Affected versions and remediation
This report applies to @proagentstore/cli@0.4.172.
See all versions of @proagentstore/cli for other recorded verdicts.
- Review the evidence and your use of @proagentstore/cli@0.4.172 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.