registry / arcie / 0.2.9

arcie@0.2.9

The electronic line — build agents at the speed of light.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 285 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.groq.com, api.mistral.ai, api.openai.com, api.together.xyz, cencori.com, generativelanguage.googleapis.com

Source & flagged code

4 flagged

templates/default/.env.localView file

•patternName = blocked_file severity = critical matchedText = templates/default/.env.local redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/default/.env.localView on unpkg

dist/init-XKZL275B.jsView file

35import { fileURLToPath } from "url"; L36: import { exec } from "child_process"; L37:

High

Child Process

Package source references child process execution.

dist/init-XKZL275B.jsView on unpkg · L35

dist/chunk-QSJIS2NL.jsView file

Lines 1-37javascript

1// src/loader.ts

2import { readFileSync, existsSync, readdirSync, statSync } from "fs";

3import { resolve, basename, extname } from "path";

4var PRIMARY_AGENT_ID = "agent";

5function moduleSpecifier(filePath, hotReload) {

6 if (!hotReload) return filePath;

7 return `${filePath}?v=${Date.now()}`;

9async function loadAgent(agentDir, options = {}) {

10 const absDir = resolve(process.cwd(), agentDir);

11 if (!existsSync(absDir)) {

12 throw new Error(`Agent directory not found: ${absDir}`);

13 }

14 const agentFile = resolve(absDir, "agent.ts");

15 let config = { model: "gpt-4o" };

16 if (existsSync(agentFile)) {

17 try {

18 const mod = await import(moduleSpecifier(agentFile, options.hotReload));

19 if (mod.default) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-QSJIS2NL.jsView on unpkg · L17

20 config = { ...config, ...mod.default };

21 }

22 } catch (err) {

23 console.warn(`[arcie] Failed to load agent.ts: ${err.message}. Using defaults.`);

24 }

25 }

26 const instructions = loadInstructionsFile(absDir);

27 const tools = await loadDirectory(absDir, "tools", options);

28 const skills = await loadDirectory(absDir, "skills", options);

29 const hooks = await loadDirectory(absDir, "hooks", options);

30 const channels = await loadDirectory(absDir, "channels", options);

31 const connections = await loadDirectory(absDir, "connections", options);

32 const schedules = await loadDirectory(absDir, "schedules", options);

33 const directorySubagents = await loadSubagents(absDir, options);

34 const inlineSubagents = materializeInlineSubagents(config.subagents);

35 const subagents = { ...inlineSubagents, ...directorySubagents };

36 const session = await loadSessionConfig(absDir, options);

37 const policy = await loadPolicyConfig(absDir, options);

dist/dev-I27XVV5J.jsView file

Lines 2268-2308javascript

2268 const projectRoot = dirname(agentDir);

2269 const webDir = join2(projectRoot, "channels", "web");

2270 if (!existsSync2(join2(webDir, "package.json"))) return void

Source & flagged code

4 flagged · loading source

templates/default/.env.localView file

•patternName = blocked_file severity = critical matchedText = templates/default/.env.local redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/default/.env.localView on unpkg

dist/init-XKZL275B.jsView file

35import { fileURLToPath } from "url"; L36: import { exec } from "child_process"; L37:

High

Child Process

Package source references child process execution.

dist/init-XKZL275B.jsView on unpkg · L35

dist/chunk-QSJIS2NL.jsView file

17try { L18: const mod = await import(moduleSpecifier(agentFile, options.hotReload)); L19: if (mod.default) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-QSJIS2NL.jsView on unpkg · L17

dist/dev-I27XVV5J.jsView file

2288} L2289: const child = spawn("npm", ["run", "dev"], { L2290: cwd: webDir, L2291: env: { L2292: ...process.env, L2293: ARCIE_AGENT_DIR: agentDir, ... L2298: }); L2299: const url = await readNextLocalUrl(child, 45e3) ?? `http://localhost:${portHint}`; L2300: const ready = await waitForHttp(url, 45e3);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/dev-I27XVV5J.jsView on unpkg · L2288

Findings

1 Critical3 High4 Medium5 Low

CriticalCritical Secrettemplates/default/.env.local

HighChild Processdist/init-XKZL275B.js

HighShell

HighSame File Env Network Executiondist/dev-I27XVV5J.js

MediumDynamic Requiredist/chunk-QSJIS2NL.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings