registry / @tonyclaw/agent-inspector / 3.0.15

@tonyclaw/agent-inspector@3.0.15

Agent observability and knowledge capture layer for AI coding tools.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsTelemetryUrlStrings

Manifest

WildcardDependency

scanned 252 file(s), 1.75 MB of source, external domains: 127.0.0.1, api-docs.deepseek.com, api.anthropic.com, api.deepseek.com, api.example.com, api.groq.com, api.minimaxi.com, api.openai.com, api.together.xyz, dashscope.aliyuncs.com, docs.bigmodel.cn, example.com, huggingface.co, mimo.xiaomi.com, nodejs.org, open.bigmodel.cn, opencode.ai, openrouter.ai, platform.minimaxi.com, www.w3.org

Source & flagged code

9 flagged

package.jsonView file

Lines 36-76json

36 },

37 "files": [

38 "bin",

39 "src",

40 "!src/**/*.test.ts",

41 "!src/**/*.stories.tsx",

42 "!src/**/__fixtures__",

43 "!src/routeTree.gen.ts",

44 "scripts/setup-windows-runtime.mjs",

45 "scripts/setup-agent-skills.mjs",

46 "styles",

47 ".output",

48 "!.output/*.exe"

49 ],

50 "scripts": {

51 "dev": "vite dev",

52 "start": "node .output/cli.js",

53 "build": "vite build && bun build:cli && bun build:mcp",

54 "build:cli": "npx esbuild src/cli.ts --bundle --platform=node --target=node18 --format=esm --outfile=.output/cli.js",

55 "build:mcp": "npx esbuild packages/agent-inspector-mcp/src/cli.ts --bundle --platform=node --target=node20 --format=esm --outfile=packages/agent-inspector-mcp/dist/cli.js",

56 "postinstall": "node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L56

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L56

57 "prepublishOnly": "npm run build",

58 "typecheck": "tsc --noEmit",

59 "lint": "eslint .",

60 "format": "biome format --write .",

61 "format:check": "biome format .",

62 "extension:zip": "node scripts/pack-chrome-extension.mjs",

63 "extension:release": "node scripts/release-chrome-extension.mjs",

64 "release": "node scripts/release.mjs",

65 "knip": "knip",

66 "check": "bun format && bun typecheck && bun lint",

67 "prepare": "husky",

68 "ladle": "ladle serve",

69 "ladle:build": "ladle build"

70 },

71 "dependencies": {

72 "@modelcontextprotocol/server": "^2.0.0-alpha.2",

73 "@radix-ui/react-dialog": "^1.1.14",

74 "@radix-ui/react-select": "^2.2.6",

75 "@tailwindcss/typography": "^0.5.19",

76 "@tanstack/react-router": "^1.160.2",

scripts/setup-agent-skills.mjsView file

Lines 1-23javascript

1import { existsSync } from "node:fs";

2import { homedir } from "node:os";

3import { dirname, join } from "node:path";

4import { spawnSync } from "node:child_process";

5import { fileURLToPath } from "node:url";

src/proxy/platformCommands.tsView file

Lines 1-38typescript

1import { statSync } from "node:fs";

2import { execFileSync } from "node:child_process";

3import { delimiter, isAbsolute, join } from "node:path";

5export type PlatformName = typeof process.platform;

6type

scripts/setup-windows-runtime.mjsView file

Lines 1-26javascript

1import { copyFile, mkdir, readFile } from "node:fs/promises";

2import { existsSync } from "node:fs";

3import { createRequire } from "node:module";

4import { dirname, join } from "node:path";

5import { fileURLToPath } from "node:url";

src/proxy/alerts.tsView file

Lines 32-72typescript

32export type ListAlertsOptions = AlertFilters & {

33 limit?: number;

34 scanLimit?: number;

35};

37type AlertObservation = {

src/cli.tsView file

Lines 514-554typescript

514 killProcessOnPort(targetPort);

515 }

516 }

517

518 if (background && enableIdentityProxy) {

519 const cliEntry = process.argv[1];

520 if (cliEntry === undefined || cliEntry.

.output/public/assets/agent-inspector-58K1_MsC.icoView file

•path = .output/public/assets/agent-inspector-58K1_MsC.ico kind = high_entropy_blob sizeBytes = 14586 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.output/public/assets/agent-inspector-58K1_MsC.icoView on unpkg

src/proxy/ecosystemRegistry.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = @tonyclaw/agent-inspector@3.0.13 matchedIdentity = npm:[redacted]:3.0.13 similarity = 0.950 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/proxy/ecosystemRegistry.tsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/setup-agent-skills.mjsView file

3import { dirname, join } from "node:path"; L4: import { spawnSync } from "node:child_process"; L5: import { fileURLToPath } from "node:url";

High

Child Process

Package source references child process execution.

scripts/setup-agent-skills.mjsView on unpkg · L3

src/proxy/platformCommands.tsView file

18if (platform !== "win32") return { command, args: [...args] }; L19: return { command: "cmd.exe", args: ["/d", "/s", "/c", command, ...args] }; L20: }

High

Shell

Package source references shell execution.

src/proxy/platformCommands.tsView on unpkg · L18

scripts/setup-windows-runtime.mjsView file

6L7: const require = createRequire(import.meta.url); L8: const scriptDir = dirname(fileURLToPath(import.meta.url));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/setup-windows-runtime.mjsView on unpkg · L6

src/proxy/alerts.tsView file

52evidence: AlertEvidenceLink[]; L53: metadata: Record<string, JsonValue>; L54: };

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/proxy/alerts.tsView on unpkg · L52

src/cli.tsView file

534}); L535: const supervisorProcess = spawn(process.execPath, [cliEntry, ...supervisorArgs], { L536: stdio: "ignore", L537: detached: true, L538: env: process.env, L539: windowsHide: true, ... L549: if (legacyAliasPort !== null) { L550: console.log(` Legacy proxy: http://localhost:${legacyAliasPort}/proxy`); L551: console.log(` Legacy MCP: http://localhost:${legacyAliasPort}/api/mcp`);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/cli.tsView on unpkg · L534

.output/public/assets/agent-inspector-58K1_MsC.icoView file

•path = .output/public/assets/agent-inspector-58K1_MsC.ico kind = high_entropy_blob sizeBytes = 14586 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.output/public/assets/agent-inspector-58K1_MsC.icoView on unpkg

src/proxy/ecosystemRegistry.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/proxy/ecosystemRegistry.tsView on unpkg

Findings

6 High6 Medium7 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processscripts/setup-agent-skills.mjs

HighShellsrc/proxy/platformCommands.ts

HighSame File Env Network Executionsrc/cli.ts

HighShips High Entropy Blob.output/public/assets/agent-inspector-58K1_MsC.ico

HighPrevious Version Dangerous Deltasrc/proxy/ecosystemRegistry.ts

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/setup-windows-runtime.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptosrc/proxy/alerts.ts

LowFilesystem

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

9 flagged

package.jsonView file

Lines 36-76json

36 },

37 "files": [

38 "bin",

39 "src",

40 "!src/**/*.test.ts",

41 "!src/**/*.stories.tsx",

42 "!src/**/__fixtures__",

43 "!src/routeTree.gen.ts",

44 "scripts/setup-windows-runtime.mjs",

45 "scripts/setup-agent-skills.mjs",

46 "styles",

47 ".output",

48 "!.output/*.exe"

49 ],

50 "scripts": {

51 "dev": "vite dev",

52 "start": "node .output/cli.js",

53 "build": "vite build && bun build:cli && bun build:mcp",

54 "build:cli": "npx esbuild src/cli.ts --bundle --platform=node --target=node18 --format=esm --outfile=.output/cli.js",

55 "build:mcp": "npx esbuild packages/agent-inspector-mcp/src/cli.ts --bundle --platform=node --target=node20 --format=esm --outfile=packages/agent-inspector-mcp/dist/cli.js",

56 "postinstall": "node scripts/setup-windows-runtime.mjs && node scripts/setup-agent-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L56

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L56

57 "prepublishOnly": "npm run build",

58 "typecheck": "tsc --noEmit",

59 "lint": "eslint .",

60 "format": "biome format --write .",

61 "format:check": "biome format .",

62 "extension:zip": "node scripts/pack-chrome-extension.mjs",

63 "extension:release": "node scripts/release-chrome-extension.mjs",

64 "release": "node scripts/release.mjs",

65 "knip": "knip",

66 "check": "bun format && bun typecheck && bun lint",

67 "prepare": "husky",

68 "ladle": "ladle serve",

69 "ladle:build": "ladle build"

70 },

71 "dependencies": {

72 "@modelcontextprotocol/server": "^2.0.0-alpha.2",

73 "@radix-ui/react-dialog": "^1.1.14",

74 "@radix-ui/react-select": "^2.2.6",

75 "@tailwindcss/typography": "^0.5.19",

76 "@tanstack/react-router": "^1.160.2",

scripts/setup-agent-skills.mjsView file

Lines 1-23javascript

1import { existsSync } from "node:fs";

2import { homedir } from "node:os";

3import { dirname, join } from "node:path";

4import { spawnSync } from "node:child_process";

5import { fileURLToPath } from "node:url";

src/proxy/platformCommands.tsView file

Lines 1-38typescript

1import { statSync } from "node:fs";

2import { execFileSync } from "node:child_process";

3import { delimiter, isAbsolute, join } from "node:path";

5export type PlatformName = typeof process.platform;

6type

scripts/setup-windows-runtime.mjsView file

Lines 1-26javascript

1import { copyFile, mkdir, readFile } from "node:fs/promises";

2import { existsSync } from "node:fs";

3import { createRequire } from "node:module";

4import { dirname, join } from "node:path";

5import { fileURLToPath } from "node:url";

src/proxy/alerts.tsView file

Lines 32-72typescript

32export type ListAlertsOptions = AlertFilters & {

33 limit?: number;

34 scanLimit?: number;

35};

37type AlertObservation = {

src/cli.tsView file

Lines 514-554typescript

514 killProcessOnPort(targetPort);

515 }

516 }

517

518 if (background && enableIdentityProxy) {

519 const cliEntry = process.argv[1];

520 if (cliEntry === undefined || cliEntry.

.output/public/assets/agent-inspector-58K1_MsC.icoView file

•path = .output/public/assets/agent-inspector-58K1_MsC.ico kind = high_entropy_blob sizeBytes = 14586 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.output/public/assets/agent-inspector-58K1_MsC.icoView on unpkg

src/proxy/ecosystemRegistry.tsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/proxy/ecosystemRegistry.tsView on unpkg