registry / @weirdmm/olliecli / 0.1.7

@weirdmm/olliecli@0.1.7

OllieChat in your terminal — a warm, streaming AI CLI with workspace, web search and command execution.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 3 file(s), 67.3 KB of source, external domains: api.duckduckgo.com, html.duckduckgo.com, olliechat-lac.vercel.app, registry.npmjs.org, sh00t.host

Source & flagged code

1 flagged

dist/chunk-4E5MVMGY.jsView file

Lines 81-121javascript

81}

82var EFFORTS = [

83 { v: "off", label: "Off", sub: "answer directly" },

84 { v: "low", label: "Low", sub: "a quick think" },

85 { v: "medium", label: "Medium", sub: "balanced" },

86 { v: "high", label: "High", sub: "think it through" },

87 { v: "xhigh", label: "Max", sub: "think hardest" }

88];

89function modelById(id) {

90 return MODELS.find((m) => m.id === id);

91}

92function resolveModel(hint) {

93 const h = hint.trim().toLowerCase();

94 return MODELS.find((m) => m.id.toLowerCase() === h) || MODELS.find((m) => m.name.toLowerCase() === h) || MODELS.find((m) => m.id.toLowerCase().includes(h) || m.name.toLowerCase().includes(h));

95}

97// src/config.ts

98import { homedir } from "os";

99import { join } from "path";

100import { readFileSync } from "fs";

101import { mkdir, readFile, writeFile } from "fs/promises";

102var API_BASE = process.env.OLLIE_API_BASE || "https://sh00t.host/v1";

103var SITE_BASE = (process.env.OLLIE_SITE || "https://olliechat-lac.vercel.app").replace(/\/+$/, "");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-4E5MVMGY.jsView on unpkg · L101

104var PKG_NAME = "@weirdmm/olliecli";

105var API_KEY = process.env.OLLIE_API_KEY || "sk_d9E6Xj4vbxy9CNhorUIn9t5dxuAYokLse31EPIMqVUOmC7BI";

106function authHeaders() {

107 return { "Content-Type": "application/json", Authorization: `Bearer ${API_KEY}` };

108}

109var DEFAULT_SYSTEM = "You are Ollie, a warm, sharp, plainspoken assistant working inside the user's terminal. Be genuinely helpful and friendly without being fake or fawning. Give concrete answers over hedging, admit uncertainty when it is real, and skip filler. You have tools to read and write files in the current workspace, run shell commands, search the web, and fetch URLs \u2014 use them when they help. Prefer showing your work with real file edits and command output over describing what you would do. Use Markdown when it genuinely helps readability.";

110var DEFAULTS = {

111 model: DEFAULT_MODEL,

112 effort: "high",

113 think: true,

114 web: true,

115 autoApprove: false

116};

117var OLLIE_MD = "OLLIE.md";

118function loadSystemPrompt(cwd) {

119 try {

120 const content = readFileSync(join(cwd, OLLIE_MD), "utf8").trim();

121 if (content) {

Source & flagged code

1 flagged · loading source

dist/chunk-4E5MVMGY.jsView file

101import { mkdir, readFile, writeFile } from "fs/promises"; L102: var API_BASE = process.env.OLLIE_API_BASE || "https://sh00t.host/v1"; L103: var SITE_BASE = (process.env.OLLIE_SITE || "https://olliechat-lac.vercel.app").replace(/\/+$/, ""); ... L130: } L131: var CONFIG_DIR = join(homedir(), ".olliechat"); L132: var CONFIG_PATH = join(CONFIG_DIR, "config.json"); ... L135: const raw = await readFile(CONFIG_PATH, "utf8"); L136: return { ...DEFAULTS, ...JSON.parse(raw) }; L137: } catch { ... L150: import { mkdir as mkdir2, readFile as readFile2, writeFile as writeFile2 } from "fs/promises"; L151: import { spawn } from "child_process"; L152: var DIR = join2(homedir2(), ".olliechat");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-4E5MVMGY.jsView on unpkg · L101

Findings

1 High3 Medium5 Low

HighSandbox Evasion Gated Capabilitydist/chunk-4E5MVMGY.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

dist/chunk-4E5MVMGY.jsView file

Lines 81-121javascript

81}

82var EFFORTS = [

83 { v: "off", label: "Off", sub: "answer directly" },

84 { v: "low", label: "Low", sub: "a quick think" },

85 { v: "medium", label: "Medium", sub: "balanced" },

86 { v: "high", label: "High", sub: "think it through" },

87 { v: "xhigh", label: "Max", sub: "think hardest" }

88];

89function modelById(id) {

90 return MODELS.find((m) => m.id === id);

91}

92function resolveModel(hint) {

93 const h = hint.trim().toLowerCase();

94 return MODELS.find((m) => m.id.toLowerCase() === h) || MODELS.find((m) => m.name.toLowerCase() === h) || MODELS.find((m) => m.id.toLowerCase().includes(h) || m.name.toLowerCase().includes(h));

95}

97// src/config.ts

98import { homedir } from "os";

99import { join } from "path";

100import { readFileSync } from "fs";

101import { mkdir, readFile, writeFile } from "fs/promises";

102var API_BASE = process.env.OLLIE_API_BASE || "https://sh00t.host/v1";

103var SITE_BASE = (process.env.OLLIE_SITE || "https://olliechat-lac.vercel.app").replace(/\/+$/, "");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-4E5MVMGY.jsView on unpkg · L101

104var PKG_NAME = "@weirdmm/olliecli";

105var API_KEY = process.env.OLLIE_API_KEY || "sk_d9E6Xj4vbxy9CNhorUIn9t5dxuAYokLse31EPIMqVUOmC7BI";

106function authHeaders() {

107 return { "Content-Type": "application/json", Authorization: `Bearer ${API_KEY}` };

108}

110var DEFAULTS = {

111 model: DEFAULT_MODEL,

112 effort: "high",

113 think: true,

114 web: true,

115 autoApprove: false

116};

117var OLLIE_MD = "OLLIE.md";

118function loadSystemPrompt(cwd) {

119 try {

120 const content = readFileSync(join(cwd, OLLIE_MD), "utf8").trim();

121 if (content) {