registry / @rulemetric/cli / 0.3.0

@rulemetric/cli@0.3.0

The RuleMetric CLI. Manages instructions, sessions, evals, and (as of the user-management release) organizations.

Static Scan Results

scanned 9d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 215 file(s), 654 KB of source, external domains: rulemetric.com, www.apple.com

Source & flagged code

3 flagged

dist/commands/evals/run.jsView file

Lines 29-69javascript

29 static args = {

30 targetId: Args.string({ description: "Eval target ID", required: true })

31 };

32 static flags = {

33 parallel: Flags.integer({ description: "Number of parallel eval executions", default: 1 }),

34 "runs-per-eval": Flags.integer({ description: "Number of runs per eval for variance analysis", default: 1 }),

35 iteration: Flags.integer({ description: "Iteration number for tracking", default: 1 }),

36 "skip-baseline": Flags.boolean({ description: "Skip baseline (without_target) runs", default: false }),

37 "skip-grading": Flags.boolean({ description: "Skip LLM grading step", default: false }),

38 model: Flags.string({ description: "Model for eval execution (default: user configured)" }),

39 "grader-model": Flags.string({ description: "Model for grading (default: same as execution model)" }),

40 timeout: Flags.integer({ description: "Timeout per eval in ms", default: 12e4 })

41 };

42 async run() {

43 const { args, flags } = await this.parse(_EvalRunCommand);

44 this.requireAuth();

45 const target = await apiGet(`/api/eval-targets/${args.targetId}`);

46 const evals = await apiGet(`/api/eval-targets/${args.targetId}/evals`);

47 if (evals.length === 0) {

48 this.error(`No evals found for target "${target.name}". Create some with \`rulemetric evals create\`.`);

49 }

50 this.log(`Running ${evals.length} eval(s) for "${target.name}" v${target.version}`);

51 this.log(`Config: ${flags["runs-per-eval"]} run(s) per eval, parallel=${flags.parallel}, iteration=${flags.iteration}`);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/commands/evals/run.jsView on unpkg · L49

52 if (flags["skip-baseline"]) this.log("Skipping baseline runs");

53 if (flags["skip-grading"]) this.log("Skipping grading");

54 this.log("");

55 const configurations = [

56 { name: "with_target", content: target.content }

57 ];

58 if (!flags["skip-baseline"]) {

59 configurations.push({ name: "without_target" });

60 }

61 const workQueue = [];

62 for (const eval_ of evals) {

63 for (const config of configurations) {

64 for (let run = 1; run <= flags["runs-per-eval"]; run++) {

65 workQueue.push({

66 eval_,

67 configuration: config.name,

68 targetContent: config.content,

69 runNumber: run

dist/chunk-L674RNKQ.jsView file

Lines 1-21javascript

1// src/lib/hooks-config.ts

2import { execSync } from "node:child_process";

3import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from "node:fs";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-L674RNKQ.jsView on unpkg · L1

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-L674RNKQ.jsView on unpkg · L1

4import { homedir }

Source & flagged code

3 flagged · loading source

dist/commands/evals/run.jsView file

49} L50: this.log(`Running ${evals.length} eval(s) for "${target.name}" v${target.version}`); L51: this.log(`Config: ${flags["runs-per-eval"]} run(s) per eval, parallel=${flags.parallel}, iteration=${flags.iteration}`);

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/commands/evals/run.jsView on unpkg · L49

dist/chunk-L674RNKQ.jsView file

1// src/lib/hooks-config.ts L2: import { execSync } from "node:child_process"; L3: import { existsSync, mkdirSync, readFileSync, writeFileSync, unlinkSync } from "node:fs"; ... L94: try { L95: existing = JSON.parse(readFileSync(configPath, "utf-8")); L96: } catch { ... L120: function writeCursorUserHooks() { L121: return writeCursorHooksToDir(join(homedir(), ".cursor")); L122: } ... L186: } L187: settings["http.proxy"] = `http://localhost:${gatewayPort}`; L188: settings["http.proxyStrictSSL"] = existsSync(certPath);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-L674RNKQ.jsView on unpkg · L1

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-L674RNKQ.jsView on unpkg · L1

Findings

1 High4 Medium6 Low

HighSandbox Evasion Gated Capabilitydist/chunk-L674RNKQ.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/chunk-L674RNKQ.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvaldist/commands/evals/run.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License