registry / agentlas / 0.5.2

agentlas@0.5.2

Agentlas agent terminal — chat with your installed AI agents and teams from the terminal, Claude Code style. Standalone: no desktop app required.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 556 KB of source, external domains: 127.0.0.1, agentlas.cloud, api.anthropic.com, api.openai.com, api.upstage.ai, generativelanguage.googleapis.com, github.com, registry.npmjs.org

Source & flagged code

7 flagged

bin/agentlas.cjsView file

Lines 1-43javascript

1#!/usr/bin/env node

2/*

3 * agentlas — Agentlas를 터미널에서 쓰는 독립 CLI (Claude Code 방식).

4 *

5 * `npm install -g agentlas` 후 `agentlas` 하나로 완결된다. 데스크탑 앱은 필요 없다:

6 * 엔진(engine/agentlas.cjs — REPL·라우팅·클라우드·자격증명 포함 전체 터미널

7 * 클라이언트)이 이 패키지에 들어 있고(정본), 첫 실행 시 앱과 동일한 SQLite 스키마를

8 * 직접 부트스트랩한 뒤 빌트인 에이전트를 시드한다. 데스크탑 앱이 설치돼 있으면

9 * 같은 userData(SQLite)를 자동으로 공유한다 — 별도 설정 없이 데이터가 한 몸이다.

10 *

11 * SQLite: better-sqlite3(optionalDependency, npm이 빌드해주면 네이티브) →

12 * 실패 시 Node 22+의 node:sqlite 폴백.

13 *

14 * env 오버라이드:

15 * AGENTLAS_USER_DATA_DIR 데이터 폴더 (기본: 앱과 동일한 userData)

16 *

17 * 런처 자체 명령: `agentlas --where` → 해석 결과 JSON 출력 후 종료.

18 */

19"use strict";

21const fs = require("node:fs");

22const os = require("node:os");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/agentlas.cjsView on unpkg · L20

23const path = require("node:path");

24const { spawn } = require("node:child_process");

High

Child Process

Package source references child process execution.

bin/agentlas.cjsView on unpkg · L23

26const REAL_SELF = (() => {

27 try { return fs.realpathSync(__filename); } catch { return __filename; }

28})();

29const PKG_ROOT = path.dirname(path.dirname(REAL_SELF));

30const ENGINE = path.join(PKG_ROOT, "engine", "agentlas.cjs");

32function exists(p) {

33 try { fs.accessSync(p); return true; } catch { return false; }

34}

36// ── userData / DB 경로 (engine/agentlas.cjs의 userDataDir와 동일 규칙) ──

37function userDataDir() {

38 const override = process.env.AGENTLAS_USER_DATA_DIR;

39 if (override) return override;

40 const home = os.homedir();

41 if (process.platform === "darwin") return path.join(home, "Library", "Application Support", "Agentlas");

42 if (process.platform === "win32") return path.join(process.env.APPDATA || path.join(home, "AppData", "Roaming"), "Agentlas");

43 return path.join(process.env.XDG_CONFIG_HOME || path.join(home, ".config"), "Agentlas");

engine/agentlas-parity.cjsView file

Lines 1-38javascript

1"use strict";

2/*

3 * agentlas-parity: 데스크탑 앱 전용이던 기능의 터미널 패리티 구현.

4 *

5 * storm — Hephaestus Stormbreaker(route --auto-run) 파이프라인 실행 (+연구 증거)

6 * swarm — emergent 에이전트 스웜 (블랙보드 + `## Spawn` 그래프 성장 + 종합)

7 * automation — 앱 스케줄러가 실행하는 자동화의 등록/목록/토글 (같은 SQLite)

8 * usage — 로컬 실행/자동화/세션 집계

9 * telegram — 텔레그램 바인딩 현황 (읽기 전용; 페어링은 앱 Connect)

10 * cloud search — 마켓플레이스 검색 (MCP marketplace.search_agents)

11 *

engine/agentlas.cjsView file

Lines 5989-6029javascript

5989 const resp = await fetch("https://api.anthropic.com/v1/messages", {

5990 method: "POST",

5991 headers: { "content-type": "application/json", "x-api-key": key, "anthropic-version": "2023-06-01" },

5992 body: JSON.stringify({ model, max_tokens:

test/smoke.shView file

•path = test/smoke.sh kind = payload_in_excluded_dir sizeBytes = 2141 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/smoke.shView on unpkg

•path = test/smoke.sh kind = build_helper sizeBytes = 2141 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test/smoke.shView on unpkg

Source & flagged code

7 flagged · loading source

bin/agentlas.cjsView file

23const path = require("node:path"); L24: const { spawn } = require("node:child_process"); L25:

High

Child Process

Package source references child process execution.

bin/agentlas.cjsView on unpkg · L23

20L21: const fs = require("node:fs"); L22: const os = require("node:os");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/agentlas.cjsView on unpkg · L20

engine/agentlas-parity.cjsView file

238? "설치 또는 지정: HEPHAESTUS_CAREER_GRAPH_BIN=<경로> 또는 HEPHAESTUS_RUNTIME_ROOT=<경로>\n" L239: : "설치: https://agentlas.cloud · 또는 HEPHAESTUS_BIN=<경로> 지정\n", L240: ); ... L247: found.kind === "bin" L248: ? spawn(found.exec, isCareerGraph ? args.slice(1) : args, { cwd, stdio: "inherit" }) L249: : spawn("python3", ["-c", PY_BOOTSTRAP, moduleName, ...moduleArgs], { ... L251: stdio: "inherit", L252: env: { ...process.env, HEPHAESTUS_RUNTIME_ROOT: found.root }, L253: });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

engine/agentlas-parity.cjsView on unpkg · L238

18const crypto = require("node:crypto"); L19: const { spawn } = require("node:child_process"); L20: const { Ui } = require("./agentlas-ui.cjs"); ... L42: const candidates = [ L43: process.env.HEPHAESTUS_BIN, L44: path.join(os.homedir(), ".agentlas", "runtime", "current", "bin", "hephaestus"), L45: ]; ... L56: if (process.resourcesPath) roots.push(path.join(process.resourcesPath, "Hephaestus")); L57: if (process.platform === "darwin") roots.push("/Applications/Agentlas.[redacted]"); L58: for (const root of roots) { ... L127: ui.error("Hephaestus 런타임이 없습니다 — 데스크탑 앱 설치 또는 Hephaestus 인스톨러 실행 후 다시 시도하세요."); L128: ui.info("설치: https://agentlas.cloud · 또는 HEPHAESTUS_BIN=<경로> 지정");

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

engine/agentlas-parity.cjsView on unpkg · L18

engine/agentlas.cjsView file

6009if (backend === "google") { L6010: const url = `https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent?key=${encodeURIComponent(key)}`; L6011: const resp = await fetch(url, { ... L6013: headers: { "content-type": "application/json" }, L6014: body: JSON.stringify({ systemInstruction: { parts: [{ text: system }] }, contents: [{ role: "user", parts: [{ text: prompt }] }] }), L6015: }); ... L6023: L6024: // 1회 실행 — CLI면 spawn(스트리밍 stdout), API면 호출 후 텍스트 출력. 종료코드 반환. L6025: // ctx = { projectPath, agentId } — 메모리 주입/큐레이션에 사용.

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

engine/agentlas.cjsView on unpkg · L6009

test/smoke.shView file

•path = test/smoke.sh kind = payload_in_excluded_dir sizeBytes = 2141 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/smoke.shView on unpkg

•path = test/smoke.sh kind = build_helper sizeBytes = 2141 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test/smoke.shView on unpkg

Findings

6 High5 Medium4 Low

HighChild Processbin/agentlas.cjs

HighShell

HighSame File Env Network Executionengine/agentlas-parity.cjs

HighCommand Output Exfiltrationengine/agentlas.cjs

HighSandbox Evasion Gated Capabilityengine/agentlas-parity.cjs

HighPayload In Excluded Dirtest/smoke.sh

MediumDynamic Requirebin/agentlas.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertest/smoke.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

bin/agentlas.cjsView file

Lines 1-43javascript

1#!/usr/bin/env node

2/*

3 * agentlas — Agentlas를 터미널에서 쓰는 독립 CLI (Claude Code 방식).

4 *

5 * `npm install -g agentlas` 후 `agentlas` 하나로 완결된다. 데스크탑 앱은 필요 없다:

6 * 엔진(engine/agentlas.cjs — REPL·라우팅·클라우드·자격증명 포함 전체 터미널

7 * 클라이언트)이 이 패키지에 들어 있고(정본), 첫 실행 시 앱과 동일한 SQLite 스키마를

8 * 직접 부트스트랩한 뒤 빌트인 에이전트를 시드한다. 데스크탑 앱이 설치돼 있으면

9 * 같은 userData(SQLite)를 자동으로 공유한다 — 별도 설정 없이 데이터가 한 몸이다.

10 *

11 * SQLite: better-sqlite3(optionalDependency, npm이 빌드해주면 네이티브) →

12 * 실패 시 Node 22+의 node:sqlite 폴백.

13 *

14 * env 오버라이드:

15 * AGENTLAS_USER_DATA_DIR 데이터 폴더 (기본: 앱과 동일한 userData)

16 *

17 * 런처 자체 명령: `agentlas --where` → 해석 결과 JSON 출력 후 종료.

18 */

19"use strict";

21const fs = require("node:fs");

22const os = require("node:os");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/agentlas.cjsView on unpkg · L20

23const path = require("node:path");

24const { spawn } = require("node:child_process");

High

Child Process

Package source references child process execution.

bin/agentlas.cjsView on unpkg · L23

26const REAL_SELF = (() => {

27 try { return fs.realpathSync(__filename); } catch { return __filename; }

28})();

29const PKG_ROOT = path.dirname(path.dirname(REAL_SELF));

30const ENGINE = path.join(PKG_ROOT, "engine", "agentlas.cjs");

32function exists(p) {

33 try { fs.accessSync(p); return true; } catch { return false; }

34}

36// ── userData / DB 경로 (engine/agentlas.cjs의 userDataDir와 동일 규칙) ──

37function userDataDir() {

38 const override = process.env.AGENTLAS_USER_DATA_DIR;

39 if (override) return override;

40 const home = os.homedir();

41 if (process.platform === "darwin") return path.join(home, "Library", "Application Support", "Agentlas");

42 if (process.platform === "win32") return path.join(process.env.APPDATA || path.join(home, "AppData", "Roaming"), "Agentlas");

43 return path.join(process.env.XDG_CONFIG_HOME || path.join(home, ".config"), "Agentlas");

engine/agentlas-parity.cjsView file

Lines 1-38javascript

1"use strict";

2/*

3 * agentlas-parity: 데스크탑 앱 전용이던 기능의 터미널 패리티 구현.

4 *

5 * storm — Hephaestus Stormbreaker(route --auto-run) 파이프라인 실행 (+연구 증거)

6 * swarm — emergent 에이전트 스웜 (블랙보드 + `## Spawn` 그래프 성장 + 종합)

7 * automation — 앱 스케줄러가 실행하는 자동화의 등록/목록/토글 (같은 SQLite)

8 * usage — 로컬 실행/자동화/세션 집계

9 * telegram — 텔레그램 바인딩 현황 (읽기 전용; 페어링은 앱 Connect)

10 * cloud search — 마켓플레이스 검색 (MCP marketplace.search_agents)

11 *

engine/agentlas.cjsView file

Lines 5989-6029javascript

5989 const resp = await fetch("https://api.anthropic.com/v1/messages", {

5990 method: "POST",

5991 headers: { "content-type": "application/json", "x-api-key": key, "anthropic-version": "2023-06-01" },

5992 body: JSON.stringify({ model, max_tokens:

test/smoke.shView file

•path = test/smoke.sh kind = payload_in_excluded_dir sizeBytes = 2141 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

test/smoke.shView on unpkg

•path = test/smoke.sh kind = build_helper sizeBytes = 2141 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

test/smoke.shView on unpkg

Lines 218-258javascript

218 else if (args[i] === "--background") ctx.background = true;

219 else rest.push(args[i]);

220 }

221 const r = await stormRun(db, rest.join(" "), ctx);

222 if (!r.ok) process.exitCode = 1;

223 }

224

225 // ── Hephaestus 네이티브 패스스루 — 엔진 전 기능을 터미널 1급으로 노출 ──

226 // stdio inherit 로 돌려 색/프롬프트/스트리밍이 네이티브 그대로 나온다.

227 function runHephaestusInteractive(args, opts = {}) {

228 const isCareerGraph = args[0] === "career-graph" || args[0] === "career_graph";

229 const found = isCareerGraph ? careerGraphRuntime() : hephaestusBin();

230 if (!found) {

231 process.stderr.write(

232 isCareerGraph

233 ? "Career Graph 런타임이 없습니다 — 최신 Agentlas OS / Hephaestus 설치 후 다시 시도하세요.\n"

234 : "Hephaestus 런타임이 없습니다 — 데스크탑 앱 설치 또는 Hephaestus 인스톨러 실행 후 다시 시도하세요.\n",

235 );

236 process.stderr.write(

237 isCareerGraph

238 ? "설치 또는 지정: HEPHAESTUS_CAREER_GRAPH_BIN=<경로> 또는 HEPHAESTUS_RUNTIME_ROOT=<경로>\n"

239 : "설치: https://agentlas.cloud · 또는 HEPHAESTUS_BIN=<경로> 지정\n",

240 );

241 return Promise.resolve(1);

242 }

243 const cwd = opts.cwd || D.runCwd();

244 const moduleName = found.kind === "python" && isCareerGraph ? "career_graph" : "agentlas_cloud";

245 const moduleArgs = moduleName === "career_graph" ? args.slice(1) : args;

246 const child =

247 found.kind === "bin"

248 ? spawn(found.exec, isCareerGraph ? args.slice(1) : args, { cwd, stdio: "inherit" })

249 : spawn("python3", ["-c", PY_BOOTSTRAP, moduleName, ...moduleArgs], {

250 cwd,

251 stdio: "inherit",

252 env: { ...process.env, HEPHAESTUS_RUNTIME_ROOT: found.root },

253 });

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

engine/agentlas-parity.cjsView on unpkg · L238

254 return new Promise((resolve) => {

255 child.on("error", (e) => {

256 process.stderr.write(`Hephaestus 실행 실패: ${e.message}\n`);

257 resolve(1);

258 });