registry / @rynx-ai/emulator / 0.1.8

@rynx-ai/emulator@0.1.8

Standalone mobile emulator capability layer for Rynx agents and optional UI surfaces.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 111 KB of source, external domains: developer.android.com

Source & flagged code

3 flagged

dist/control.jsView file

Lines 1-21javascript

1import { execFile, spawn } from "node:child_process";

2import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/control.jsView on unpkg · L1

3import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";

4import { tmpdir } from "node:os";

5import path from "node:path";

6import { promisify } from "node:util";

7import { discoverAndroidSdk, inspectAndroidEnvironment, inspectEmulatorEnvironment, pickDefaultIosDevice, resolveServeSimExecutable, } from "./environment.js";

8import { buildCompactGestureFrames, stableGestureDurationMs, validateGesturePoints as validateGesturePointData, } from "./gesture.js";

9import { emulatorActiveSessionFile, emulatorSessionsFile, emulatorStateDir } from "./paths.js";

10const run = promisify(execFile);

11class RynxEmulatorError extends Error {

12 code;

13 constructor(code, message) {

14 super(message);

15 this.code = code;

16 this.name = "RynxEmulatorError";

17 }

18}

19class IosGesturePlaybackError extends RynxEmulatorError {

20 sentFrames;

21 constructor(sentFrames, cause) {

Lines 1285-1325javascript

1285}

1286function stripTargetArgs(args) {

1287 const stripped = [];

1288 for (let index = 0; index < args.length; index += 1) {

1289 const arg = args[index];

dist/skill.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { existsSync, readFileSync } from "node:fs";

3import { readFile } from "node:fs/promises";

4import path from "node:path";

5import { fileURLToPath } from "node:url";

Source & flagged code

3 flagged · loading source

dist/control.jsView file

1import { execFile, spawn } from "node:child_process"; L2: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/control.jsView on unpkg · L1

1305} L1306: export async function execAndroidEmulator(commandText, deviceOrName) { L1307: const device = await resolveAndroidDevice(deviceOrName);

High

Shell

Package source references shell execution.

dist/control.jsView on unpkg · L1305

dist/skill.jsView file

1import { spawn } from "node:child_process"; L2: import { existsSync, readFileSync } from "node:fs"; ... L14: * REPO ROOT (`skills/rynx-emulator/` — the skills CLI's discovery convention, L15: * so `npx skills add <repo>` finds it); the package build copies it to L16: * `<package>/skills/` so the npm artifact ships it. Resolution prefers the

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/skill.jsView on unpkg · L1

Findings

3 High3 Medium4 Low

HighChild Processdist/control.js

HighShelldist/control.js

HighRuntime Package Installdist/skill.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/control.jsView file

Lines 1-21javascript

1import { execFile, spawn } from "node:child_process";

2import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/control.jsView on unpkg · L1

3import { mkdir, readFile, readdir, rm, writeFile } from "node:fs/promises";

4import { tmpdir } from "node:os";

5import path from "node:path";

6import { promisify } from "node:util";

7import { discoverAndroidSdk, inspectAndroidEnvironment, inspectEmulatorEnvironment, pickDefaultIosDevice, resolveServeSimExecutable, } from "./environment.js";

8import { buildCompactGestureFrames, stableGestureDurationMs, validateGesturePoints as validateGesturePointData, } from "./gesture.js";

9import { emulatorActiveSessionFile, emulatorSessionsFile, emulatorStateDir } from "./paths.js";

10const run = promisify(execFile);

11class RynxEmulatorError extends Error {

12 code;

13 constructor(code, message) {

14 super(message);

15 this.code = code;

16 this.name = "RynxEmulatorError";

17 }

18}

19class IosGesturePlaybackError extends RynxEmulatorError {

20 sentFrames;

21 constructor(sentFrames, cause) {

Lines 1285-1325javascript

1285}

1286function stripTargetArgs(args) {

1287 const stripped = [];

1288 for (let index = 0; index < args.length; index += 1) {

1289 const arg = args[index];

dist/skill.jsView file

Lines 1-21javascript

1import { spawn } from "node:child_process";

2import { existsSync, readFileSync } from "node:fs";

3import { readFile } from "node:fs/promises";

4import path from "node:path";

5import { fileURLToPath } from "node:url";