registry / @sensigo/realm-cli / 0.14.0

@sensigo/realm-cli@0.14.0

Run autonomous agent workflows, host an MCP server over HTTP, and manage workflow definitions and run history from the terminal.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 45 file(s), 277 KB of source, external domains: json-schema.org, slack.com

Source & flagged code

3 flagged

dist/agent/providers/anthropic-provider.jsView file

Lines 15-55javascript

15 return 8192;

16 return 4096; // safe fallback for claude-3 and any unrecognised model

17}

18/**

19 * Anthropic LLM provider for realm agent.

20 * Uses the Messages API and extracts JSON from the first text content block.

21 * Retries once if the model returns non-JSON content.

22 */

23export class AnthropicProvider extends ToolCapableLlmProvider {

24 model;

25 constructor(model) {

26 super();

27 this.model = model;

28 }

29 async callStep(prompt, inputSchema, agentProfileInstructions) {

30 // Dynamically import @anthropic-ai/sdk to keep it an optional peer dependency.

31 // See openai-provider.ts for an explanation of the 'string' cast technique.

32 // eslint-disable-next-line @typescript-eslint/no-explicit-any

33 let mod;

34 try {

35 const moduleId = '@anthropic-ai/sdk';

36 mod = await import(moduleId);

37 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/agent/providers/anthropic-provider.jsView on unpkg · L35

38 catch {

39 console.error('realm agent requires the @anthropic-ai/sdk package. Run: npm install @anthropic-ai/sdk');

40 process.exit(1);

41 }

42 // eslint-disable-next-line @typescript-eslint/no-explicit-any

43 const client = new mod.default({

44 apiKey: process.env['ANTHROPIC_API_KEY'],

45 });

46 const systemPrompt = buildSystemPrompt(inputSchema, agentProfileInstructions);

47 const makeRequest = async (userContent) => {

48 const response = await // eslint-disable-next-line @typescript-eslint/no-explicit-any

49 client.messages.create({

50 model: this.model,

51 max_tokens: resolveMaxTokens(this.model),

52 system: systemPrompt,

53 messages: [{ role: 'user', content: userContent }],

54 });

55 const block = response.content.find(

dist/commands/watch.jsView file

Lines 1-24javascript

1// realm workflow watch <path> — watches a workflow YAML and re-registers on change.

2import { watch, existsSync } from 'node:fs';

3import { join, dirname, resolve } from 'node:path';

4import { Command } from 'commander';

5import { loadWorkflowFromFile, WorkflowError } from '@sensigo/realm';

6import { loadWorkflowForRegistration }

dist/extensions/load-project-extensions.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @sensigo/realm-cli@0.13.0 matchedIdentity = npm:QHNlbnNpZ28vcmVhbG0tY2xp:0.13.0 similarity = 0.659 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/extensions/load-project-extensions.jsView on unpkg

Source & flagged code

3 flagged · loading source

dist/agent/providers/anthropic-provider.jsView file

35const moduleId = '@anthropic-ai/sdk'; L36: mod = await import(moduleId); L37: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/agent/providers/anthropic-provider.jsView on unpkg · L35

dist/commands/watch.jsView file

4package = @sensigo/realm-cli; repositoryIdentity = realm; dependency = @sensigo/realm L4: import { Command } from 'commander'; L5: import { loadWorkflowFromFile, WorkflowError } from '@sensigo/realm'; L6: import { loadWorkflowForRegistration } from './register.js';

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/commands/watch.jsView on unpkg · L4

dist/extensions/load-project-extensions.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/extensions/load-project-extensions.jsView on unpkg

Findings

2 High5 Medium4 Low

HighCopied Package Dependency Bridgedist/commands/watch.js

HighPrevious Version Dangerous Deltadist/extensions/load-project-extensions.js

MediumDynamic Requiredist/agent/providers/anthropic-provider.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/agent/providers/anthropic-provider.jsView file

Lines 15-55javascript

15 return 8192;

16 return 4096; // safe fallback for claude-3 and any unrecognised model

17}

18/**

19 * Anthropic LLM provider for realm agent.

20 * Uses the Messages API and extracts JSON from the first text content block.

21 * Retries once if the model returns non-JSON content.

22 */

23export class AnthropicProvider extends ToolCapableLlmProvider {

24 model;

25 constructor(model) {

26 super();

27 this.model = model;

28 }

29 async callStep(prompt, inputSchema, agentProfileInstructions) {

30 // Dynamically import @anthropic-ai/sdk to keep it an optional peer dependency.

31 // See openai-provider.ts for an explanation of the 'string' cast technique.

32 // eslint-disable-next-line @typescript-eslint/no-explicit-any

33 let mod;

34 try {

35 const moduleId = '@anthropic-ai/sdk';

36 mod = await import(moduleId);

37 }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/agent/providers/anthropic-provider.jsView on unpkg · L35

38 catch {

39 console.error('realm agent requires the @anthropic-ai/sdk package. Run: npm install @anthropic-ai/sdk');

40 process.exit(1);

41 }

42 // eslint-disable-next-line @typescript-eslint/no-explicit-any

43 const client = new mod.default({

44 apiKey: process.env['ANTHROPIC_API_KEY'],

45 });

46 const systemPrompt = buildSystemPrompt(inputSchema, agentProfileInstructions);

47 const makeRequest = async (userContent) => {

48 const response = await // eslint-disable-next-line @typescript-eslint/no-explicit-any

49 client.messages.create({

50 model: this.model,

51 max_tokens: resolveMaxTokens(this.model),

52 system: systemPrompt,

53 messages: [{ role: 'user', content: userContent }],

54 });

55 const block = response.content.find(

dist/commands/watch.jsView file

Lines 1-24javascript

1// realm workflow watch <path> — watches a workflow YAML and re-registers on change.

2import { watch, existsSync } from 'node:fs';

3import { join, dirname, resolve } from 'node:path';

4import { Command } from 'commander';

5import { loadWorkflowFromFile, WorkflowError } from '@sensigo/realm';

6import { loadWorkflowForRegistration }

dist/extensions/load-project-extensions.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/extensions/load-project-extensions.jsView on unpkg