registry / @vaibot/guard / 2.1.1

@vaibot/guard@2.1.1

VAIBot Guard — local policy enforcement + tamper-evident audit daemon for AI agent tool calls. The universal decision authority the codex/claudecode/openclaw plugins route through.

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 208 KB of source, external domains: api.vaibot.io, provenance.vaibot.io, staging-api.vaibot.io, vaibot-api-v1.fly.dev, www.apple.com

Source & flagged code

3 flagged

scripts/vaibot-guard.mjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * vaibot-guard (MVP CLI)

4 *

5 * Implements the interface described in SKILL.md:

6 * - vaibot-guard precheck --intent '<json>'

7 * - vaibot-guard exec --intent '<json>' -- <command...>

8 * - vaibot-guard finalize --run_id <id> --result '<json>'

9 */

11import http from "node:http";

12import { spawn } from "node:child_process";

13import fs from "node:fs";

High

Child Process

Package source references child process execution.

scripts/vaibot-guard.mjsView on unpkg · L11

14import os from "node:os";

15import path from "node:path";

16import { createHash, randomBytes } from "node:crypto";

17import readline from "node:readline/promises";

18import { fileURLToPath } from "node:url";

20const GUARD_HOST = process.env.VAIBOT_GUARD_HOST || "127.0.0.1";

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/vaibot-guard.mjsView on unpkg · L10

22const DEFAULT_ENV_PATH = path.join(os.homedir(), ".config", "vaibot-guard", "vaibot-guard.env");

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/vaibot-guard.mjsView on unpkg · L10

24function parseEnvFile(p) {

25 if (!fs.existsSync(p)) return {};

26 const out = {};

27 const lines = fs.readFileSync(p, "utf8").split(/\r?\n/);

28 for (const line of lines) {

29 const s = line.trim();

30 if (!s || s.startsWith("#")) continue;

31 const m = s.match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/);

Source & flagged code

3 flagged · loading source

scripts/vaibot-guard.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code