registry / agency-lang / 0.16.0
agency-lang@0.16.0
The Agency language
AI Security Review
scanned 24d ago · by lpm-firewall-aiInspected the package manifest and required flagged source files. The scanner’s execution and network indicators correspond to application OAuth, subprocess, and CLI behavior; no malicious attack surface was found.
Static reason
No blocking static signals were detected.; previous stored version diff introduced dangerous source
Trigger
A user imports the library, runs the CLI, or invokes OAuth or subprocess runtime functionality.
Impact
No concrete malicious effect or unconsented install-time behavior was established.
Mechanism
The inspected OAuth code enforces HTTPS for remote URLs, while runtime subprocess and CLI execution use Node child processes; CLI execution disables shell mode.
AI rationale
Inspected the package manifest and required flagged source files. The scanner’s execution and network indicators correspond to application OAuth, subprocess, and CLI behavior; no malicious attack surface was found.
Evidence
package.jsondist/lib/runtime/ipc.jsdist/lib/stdlib/oauth.jsdist/lib/cli/commands.js
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json exposes the library and CLI entrypoints; its scripts section contains development commands, with no install lifecycle hook.
- The OAuth helper requires HTTPS for remote URLs and permits HTTP only for localhost addresses.
- IPC forks a subprocess bootstrap as part of a bounded runtime session.
- The CLI runs compiled output through Node with shell execution disabled.
Evidence against
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
7 flaggeddist/lib/runtime/ipc.jsView file
8import { fileURLToPath } from "url";
L9: import { fork } from "child_process";
L10: import { rmSync, writeFileSync, mkdirSync } from "fs";
High
Child Process
Package source references child process execution.
dist/lib/runtime/ipc.jsView on unpkg · L8dist/lib/stdlib/oauth.js#virtual:normalized:round1View file
44.replace(/>/g, ">")
L45: .replace(/"/g, """);\n}\nfunction parseExtraParams(str) {\n if (!str.trim())\n return {};\n const result = {};\n for (const pair of str.trim().split(/s+/)) {\n...
L46: return { revoked: false };
High
Shell
Package source references shell execution.
dist/lib/stdlib/oauth.js#virtual:normalized:round1View on unpkg · L44dist/lib/optimize/optimizerModule.jsView file
Findings
5 High4 Medium5 Low
HighChild Processdist/lib/runtime/ipc.js
HighShelldist/lib/stdlib/oauth.js#virtual:normalized:round1
HighSame File Env Network Executiondist/lib/stdlib/oauth.js
HighSemantic Analysis Limiteddist/lib/cli/commands.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltadist/lib/cli/commands.js
MediumDynamic Requiredist/lib/optimize/optimizerModule.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/lib/cli/schedule/backends/launchd.js
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Low
Affected versions and remediation
This report applies to agency-lang@0.16.0.
See all versions of agency-lang for other recorded verdicts.
- Review the evidence and your use of agency-lang@0.16.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.