registry / @tiens.nguyen/gonext-local-worker / 1.0.114

@tiens.nguyen/gonext-local-worker@1.0.114

Polls GoNext cloud API for async local LLM jobs and runs them against Ollama/OpenAI-compatible servers on this Mac

Static Scan Results

scanned 6h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 72.0 KB of source, external domains: hwohu56e8d.execute-api.ap-southeast-1.amazonaws.com, ollama1.gomarsic.cc

Source & flagged code

2 flagged

gonext_agent_chat.pyView file

Lines 785-825python

785 from datetime import datetime as _dt_now

786 now_str = _dt_now.now().astimezone().strftime("%A, %d %B %Y, %H:%M %Z")

787 tool_hint = (

788 "YOU HAVE EXACTLY ONE TURN. Read the TASK above. In a single code block, call "

789 "the ONE tool that fits THAT task, then pass its result to final_answer(). "

790 "Do not plan multiple steps.\n\n"

791 "You have FOUR tools:\n"

792 " 1. http_request(method, url, headers='', body='', username='', password='') — "

793 "call a SPECIFIC known API/URL.\n"

794 " 2. web_search(query) — look up facts about a person, place, thing, or topic "

795 "when you do NOT already have a real URL. Returns a summary + source.\n"

796 f" 3. get_current_datetime(timezone='') — current date/time ONLY (now: {now_str}). "

797 "Use this ONLY when the task explicitly asks for the date or time.\n"

798 " 4. create_pdf(text, title='') — make a PDF document from text/data and return a "

799 "download link. Use ONLY when the task asks to create/make/generate/export a PDF.\n"

800 "\n"

801 "http_request RETURN FORMAT: 'HTTP 200\\n{body}' — first line is 'HTTP <code>', body follows.\n"

802 "\n"

803 "BASIC AUTH — ALWAYS use username= and password=, NEVER construct headers manually:\n"

804 " response = http_request('GET', 'https://api.example.com/data',\n"

805 " username='alice@example.com', password='secret123')\n"

Medium

Secret Pattern

Package contains a possible secret pattern.

gonext_agent_chat.pyView on unpkg · L805

806 " final_answer(response)\n"

807 "The function handles base64 encoding automatically. NEVER write 'Basic ' + anything.\n"

808 "\n"

809 "BEARER TOKEN — use headers:\n"

810 " response = http_request('GET', url, headers='{\"Authorization\": \"Bearer TOKEN\"}')\n"

811 " final_answer(response)\n"

812 "\n"

813 "CHOOSING A TOOL (match the TASK, not these examples):\n"

814 "- ONLY a date/time question (e.g. 'what is the date today') -> get_current_datetime().\n"

815 "- 'who is' / 'what is' / 'tell me about' / a person / place / topic / general "

816 "knowledge -> web_search(query).\n"

817 "- 'create/make/generate/export a PDF' of some text/data -> create_pdf(text, title).\n"

818 "- A specific known API/URL was given -> http_request().\n"

819 "\n"

820 "RULES:\n"

821 "- NEVER invent or guess a URL. If you have no real URL, use web_search() instead. "

822 "If nothing works, call final_answer explaining what you need — do NOT make up an answer.\n"

823 "- Only report what a tool ACTUALLY returned. Never fabricate a response, body, or status code.\n"

824 "- Pass an http_request response DIRECTLY to final_answer — do NOT split, parse, or index it.\n"

825 "- If a response starts with 'HTTP 2' it SUCCEEDED — call final_answer immediately.\n"

gonext_transcribe.pyView file

•path = gonext_transcribe.py kind = build_helper sizeBytes = 4252 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gonext_transcribe.pyView on unpkg

Source & flagged code

2 flagged · loading source

gonext_agent_chat.pyView file

805patternName = generic_password severity = medium line = 805 matchedText = " ...)\n"

Medium

Secret Pattern

Package contains a possible secret pattern.

gonext_agent_chat.pyView on unpkg · L805

gonext_transcribe.pyView file

•path = gonext_transcribe.py kind = build_helper sizeBytes = 4252 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gonext_transcribe.pyView on unpkg

Findings

5 Medium4 Low

MediumSecret Patterngonext_agent_chat.py

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpergonext_transcribe.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

gonext_agent_chat.pyView file

Lines 785-825python

785 from datetime import datetime as _dt_now

786 now_str = _dt_now.now().astimezone().strftime("%A, %d %B %Y, %H:%M %Z")

787 tool_hint = (

788 "YOU HAVE EXACTLY ONE TURN. Read the TASK above. In a single code block, call "

789 "the ONE tool that fits THAT task, then pass its result to final_answer(). "

790 "Do not plan multiple steps.\n\n"

791 "You have FOUR tools:\n"

792 " 1. http_request(method, url, headers='', body='', username='', password='') — "

793 "call a SPECIFIC known API/URL.\n"

794 " 2. web_search(query) — look up facts about a person, place, thing, or topic "

795 "when you do NOT already have a real URL. Returns a summary + source.\n"

796 f" 3. get_current_datetime(timezone='') — current date/time ONLY (now: {now_str}). "

797 "Use this ONLY when the task explicitly asks for the date or time.\n"

798 " 4. create_pdf(text, title='') — make a PDF document from text/data and return a "

799 "download link. Use ONLY when the task asks to create/make/generate/export a PDF.\n"

800 "\n"

801 "http_request RETURN FORMAT: 'HTTP 200\\n{body}' — first line is 'HTTP <code>', body follows.\n"

802 "\n"

803 "BASIC AUTH — ALWAYS use username= and password=, NEVER construct headers manually:\n"

804 " response = http_request('GET', 'https://api.example.com/data',\n"

805 " username='alice@example.com', password='secret123')\n"

Medium

Secret Pattern

Package contains a possible secret pattern.

gonext_agent_chat.pyView on unpkg · L805

806 " final_answer(response)\n"

807 "The function handles base64 encoding automatically. NEVER write 'Basic ' + anything.\n"

808 "\n"

809 "BEARER TOKEN — use headers:\n"

810 " response = http_request('GET', url, headers='{\"Authorization\": \"Bearer TOKEN\"}')\n"

811 " final_answer(response)\n"

812 "\n"

813 "CHOOSING A TOOL (match the TASK, not these examples):\n"

814 "- ONLY a date/time question (e.g. 'what is the date today') -> get_current_datetime().\n"

815 "- 'who is' / 'what is' / 'tell me about' / a person / place / topic / general "

816 "knowledge -> web_search(query).\n"

817 "- 'create/make/generate/export a PDF' of some text/data -> create_pdf(text, title).\n"

818 "- A specific known API/URL was given -> http_request().\n"

819 "\n"

820 "RULES:\n"

821 "- NEVER invent or guess a URL. If you have no real URL, use web_search() instead. "

822 "If nothing works, call final_answer explaining what you need — do NOT make up an answer.\n"

823 "- Only report what a tool ACTUALLY returned. Never fabricate a response, body, or status code.\n"

824 "- Pass an http_request response DIRECTLY to final_answer — do NOT split, parse, or index it.\n"

825 "- If a response starts with 'HTTP 2' it SUCCEEDED — call final_answer immediately.\n"

gonext_transcribe.pyView file

•path = gonext_transcribe.py kind = build_helper sizeBytes = 4252 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gonext_transcribe.pyView on unpkg