registry / aclade-agent / 1.2.0
aclade-agent@1.2.0
⚠ Under reviewAclade Local AI Agent Connector
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
NoLicense
Source & flagged code
4 flaggeddist/index.jsView file
38const https = __importStar(require("https"));
L39: const child_process = __importStar(require("child_process"));
L40: const fs = __importStar(require("fs"));
High
61* The agent already self-updates through npm, so telling a customer to run
L62: * `npx playwright install` by hand was busywork we could just do. playwright-core
L63: * ships the same installer the `playwright` package exposes, so we invoke it
...
L74: console.log("=> Preparing the browser (one-time download, ~50MB)…");
L75: const proc = child_process.spawn(process.execPath, [cli, "install", "chromium", "--only-shell", "--no-progress"], {
L76: stdio: ["ignore", "pipe", "pipe"],
High
Runtime Package Install
Package source invokes a package manager install command at runtime.
dist/index.jsView on unpkg · L61src/index.tsView file
374const proc = child_process.spawn(input.command, [], {
L375: shell: true,
L376: cwd: input.cwd ? resolvePath(input.cwd) : workspaceRoot,
Findings
4 High3 Medium5 Low
HighChild Processdist/index.js
HighShellsrc/index.ts
HighSandbox Evasion Gated Capabilitysrc/index.ts
HighRuntime Package Installdist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to aclade-agent@1.2.0.
See all versions of aclade-agent for other recorded verdicts.
- Review the evidence and your use of aclade-agent@1.2.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.