registry  /  @ranimontagna/agent-toolkit  /  0.1.24

@ranimontagna/agent-toolkit@0.1.24

Personal AI agent toolkit installer for Claude Code, Codex CLI, OpenCode, Gemini CLI, Antigravity and graph-aware workflows.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 28 file(s), 119 KB of source, external domains: antigravity.google, api.github.com, docs.npmjs.com, github.com, pypi.org

Source & flagged code

5 flagged · loading source
dist/src/system.jsView file
1import { spawnSync } from "node:child_process"; L2: import fs from "node:fs";
High
Child Process

Package source references child process execution.

dist/src/system.jsView on unpkg · L1
1import { spawnSync } from "node:child_process"; L2: import fs from "node:fs"; L3: import http from "node:http"; L4: import https from "node:https"; ... L8: export function findCommand(command) { L9: const pathValue = process.env.PATH || ""; L10: const pathExt = process.platform === "win32"
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/src/system.jsView on unpkg · L1
•matchType = previous_version_dangerous_delta matchedPackage = @ranimontagna/agent-toolkit@0.1.21 matchedIdentity = npm:[redacted]:0.1.21 similarity = 0.500 summary = stored previous version shares package body but lacks this dangerous source file
High
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/src/system.jsView on unpkg
setup-agent-toolkit.shView file
•path = setup-agent-toolkit.sh kind = build_helper sizeBytes = 561 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

setup-agent-toolkit.shView on unpkg
skills/backend/fastify-best-practices/rules/testing.mdView file
82patternName = generic_password severity = medium line = 82 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in skills/backend/fastify-best-practices/rules/testing.md

skills/backend/fastify-best-practices/rules/testing.mdView on unpkg · L82

Findings

4 High5 Medium5 Low
HighChild Processdist/src/system.js
HighShell
HighSame File Env Network Executiondist/src/system.js
HighPrevious Version Dangerous Deltadist/src/system.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helpersetup-agent-toolkit.sh
MediumStructural Risk Force Deep Review
MediumSecret Patternskills/backend/fastify-best-practices/rules/testing.md
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings