registry / agent-insight / 0.4.1

agent-insight@0.4.1

Agent Skill 评估与观测平台 — 量化评估 Skills 在 Agent 上的实际运行效果

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 39 file(s), 294 KB of source, external domains: atomgit.com, nodejs.org, registry.npmjs.org

Source & flagged code

9 flagged

package.jsonView file

Lines 1-40json

2 "name": "agent-insight",

3 "version": "0.4.1",

4 "description": "Agent Skill 评估与观测平台 — 量化评估 Skills 在 Agent 上的实际运行效果",

5 "license": "MIT",

6 "private": false,

7 "bin": {

8 "agent-insight": "./bin/cli.js"

9 },

10 "files": [

11 "bin/",

12 "scripts/",

13 "prisma/",

14 "public/",

15 ".next/standalone/",

16 ".next/static/",

17 ".env.example"

18 ],

19 "scripts": {

20 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "dev": "next dev -p 3000",

22 "build": "next build",

23 "prepack": "node scripts/prepare-npm-package.js",

24 "start": "next start -p 3000",

25 "lint": "eslint",

26 "test": "node --import tsx --test \"test/**/*.test.ts\"",

27 "test:skill": "node --import tsx --test --test-reporter=spec test/skill-generation.test.ts",

28 "skill:gen": "node --import tsx src/lib/engine/skill-generation/cli.ts",

29 "seed:skill-opt": "node --import tsx scripts/seed_skill_opt_mock.ts",

30 "clean:skill-opt": "node --import tsx scripts/clean_skill_opt_mock.ts",

31 "deepagent:ex1": "node --import tsx src/example/deepagent/01-basic-agent.ts",

32 "deepagent:ex2": "node --import tsx src/example/deepagent/02-skills-agent.ts",

33 "deepagent:ex3": "node --import tsx src/example/deepagent/03-subagent-agent.ts",

34 "deepagent:ex4": "node --import tsx src/example/deepagent/04-memory-hitl-agent.ts"

35 },

36 "dependencies": {

37 "@ai-sdk/langchain": "^2.0.176",

38 "@assistant-ui/react": "^0.10.29",

39 "@assistant-ui/react-ai-sdk": "^0.10.16",

40 "@dagrejs/dagre": "^3.0.0",

public/sync_skills.tsView file

Lines 1-29typescript

1/**

2 * Witty-Agent-Insight Skill Synchronizer

3 *

4 * Fetches configured skills from Dashboard and installs them locally.

5 * Usage: node sync_skills.js [--check-only] [--agent <name>]

6 *

7 * Requires: ~/.agent-insight/.env or ~/.witty/.env configuration

8 */

10import { execSync } from 'child_process';

11import

scripts/install.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { spawn } = require('child_process')

4const http = require('http')

5const path = require('path')

scripts/postinstall.jsView file

Lines 61-101javascript

61}

63console.log('=== Agent-Insight Post-Install Initialization ===\n')

65try {

66 migrateDataIfNeeded()

67 console.log()

69 ensureEnvFile()

70 console.log

.next/standalone/scripts/activate_telemetry.shView file

•path = .next/standalone/scripts/activate_telemetry.sh kind = build_helper sizeBytes = 8398 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.next/standalone/scripts/activate_telemetry.shView on unpkg

.next/standalone/.next/static/media/KaTeX_Size4-Regular.b211e3d3.woffView file

•path = .next/standalone/.next/static/media/KaTeX_Size4-Regular.b211e3d3.woff kind = high_entropy_blob sizeBytes = 5980 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/standalone/.next/static/media/KaTeX_Size4-Regular.b211e3d3.woffView on unpkg

.next/standalone/.next/server/chunks/[root-of-the-server]__a130a0e5._.jsView file

•path = .next/standalone/.next/server/chunks/[root-of-the-server]__a130a0e5._.js kind = payload_in_excluded_dir sizeBytes = 3942216 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/standalone/.next/server/chunks/[root-of-the-server]__a130a0e5._.jsView on unpkg

•path = .next/standalone/.next/server/chunks/[root-of-the-server]__a130a0e5._.js kind = oversized_source_file sizeBytes = 3942216 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

.next/standalone/.next/server/chunks/[root-of-the-server]__a130a0e5._.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

public/sync_skills.tsView file

9L10: import { execSync } from 'child_process'; L11: import * as fs from 'fs';

High

Child Process

Package source references child process execution.

public/sync_skills.tsView on unpkg · L9

scripts/install.jsView file

2L3: const { spawn } = require('child_process') L4: const http = require('http') L5: const path = require('path') ... L11: function getPreferredHomeDataRoot() { L12: return path.join(os.homedir(), '.agent-insight') L13: } ... L47: } L48: process.stdout.write(`\r⏳ 等待服务启动... (${i + 1}/${maxRetries})`) L49: await sleep(retryDelay) ... L74: try { L75: const result = JSON.parse(data)

High

Install Named Payload File

Install-named source file stages remote content through filesystem writes and execution.

scripts/install.jsView on unpkg · L2

scripts/postinstall.jsView file

81try { L82: execSync('npx prisma db push', { L83: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.jsView on unpkg · L81

.next/standalone/scripts/activate_telemetry.shView file

•path = .next/standalone/scripts/activate_telemetry.sh kind = build_helper sizeBytes = 8398 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.next/standalone/scripts/activate_telemetry.shView on unpkg

.next/standalone/.next/static/media/KaTeX_Size4-Regular.b211e3d3.woffView file

•path = .next/standalone/.next/static/media/KaTeX_Size4-Regular.b211e3d3.woff kind = high_entropy_blob sizeBytes = 5980 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

.next/standalone/.next/static/media/KaTeX_Size4-Regular.b211e3d3.woffView on unpkg

.next/standalone/.next/server/chunks/[root-of-the-server]__a130a0e5._.jsView file

•path = .next/standalone/.next/server/chunks/[root-of-the-server]__a130a0e5._.js kind = payload_in_excluded_dir sizeBytes = 3942216 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.next/standalone/.next/server/chunks/[root-of-the-server]__a130a0e5._.jsView on unpkg

•path = .next/standalone/.next/server/chunks/[root-of-the-server]__a130a0e5._.js kind = oversized_source_file sizeBytes = 3942216 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

.next/standalone/.next/server/chunks/[root-of-the-server]__a130a0e5._.jsView on unpkg

Findings

8 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processpublic/sync_skills.ts

HighShell

HighInstall Named Payload Filescripts/install.js

HighRuntime Package Installscripts/postinstall.js

HighShips High Entropy Blob.next/standalone/.next/static/media/KaTeX_Size4-Regular.b211e3d3.woff

HighPayload In Excluded Dir.next/standalone/.next/server/chunks/[root-of-the-server]__a130a0e5._.js

HighOversized Source File.next/standalone/.next/server/chunks/[root-of-the-server]__a130a0e5._.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper.next/standalone/scripts/activate_telemetry.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings