registry / arcie / 0.2.8

arcie@0.2.8

The electronic line — build agents at the speed of light.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 282 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.deepseek.com, api.groq.com, api.mistral.ai, api.openai.com, api.together.xyz, cencori.com, generativelanguage.googleapis.com

Source & flagged code

4 flagged

templates/default/.env.localView file

•patternName = blocked_file severity = critical matchedText = templates/default/.env.local redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/default/.env.localView on unpkg

dist/dev-Q2WL7MQI.jsView file

Lines 20-60javascript

20import {

21 showHeader

22} from "./chunk-XOFWQUOO.js";

23import {

24 scaffoldWebChat

25} from "./chunk-WCY3PQEV.js";

26import {

27 streamAgent

28} from "./chunk-L7YWCY3M.js";

29import {

30 discoverAgents,

31 loadAgent,

32 loadAgentById

33} from "./chunk-QSJIS2NL.js";

34import {

35 discoverAgent

36} from "./chunk-6XETPLIF.js";

37import "./chunk-QE46QFID.js";

38import "./chunk-GDKRJQNX.js";

40// src/cli/dev.ts

41import { spawn } from "child_process";

42import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/dev-Q2WL7MQI.jsView on unpkg · L40

43import { existsSync as existsSync2, readFileSync as readFileSync2, watch as watch2 } from "fs";

44import { dirname, join as join2, resolve } from "path";

46// src/cli/tui/renderer/start-block-chat.ts

47import { watch } from "fs";

49// src/cli/agent-config.ts

50import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";

51import { join } from "path";

52function agentSourcePath(agentDir) {

53 return join(agentDir, "agent", "agent.ts");

54}

55function envLocalPath(agentDir) {

56 return join(agentDir, ".env.local");

57}

58function readAgentModel(agentDir) {

59 const path = agentSourcePath(agentDir);

60 if (!existsSync(path)) return void 0;

Lines 2210-2250javascript

2210 const projectRoot = dirname(agentDir);

2211 const webDir = join2(projectRoot, "channels", "web");

2212 if (!existsSync2(join2(webDir, "package.json"))) return void 0;

2213

dist/chunk-QSJIS2NL.jsView file

Lines 1-37javascript

1// src/loader.ts

2import { readFileSync, existsSync, readdirSync, statSync } from "fs";

3import { resolve, basename, extname } from "path";

4var PRIMARY_AGENT_ID = "agent";

5function moduleSpecifier(filePath, hotReload) {

Source & flagged code

4 flagged · loading source

templates/default/.env.localView file

•patternName = blocked_file severity = critical matchedText = templates/default/.env.local redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/default/.env.localView on unpkg

dist/dev-Q2WL7MQI.jsView file

40// src/cli/dev.ts L41: import { spawn } from "child_process"; L42: import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/dev-Q2WL7MQI.jsView on unpkg · L40

2230} L2231: const child = spawn("npm", ["run", "dev"], { L2232: cwd: webDir, L2233: env: { L2234: ...process.env, L2235: ARCIE_AGENT_DIR: agentDir, ... L2240: }); L2241: const url = await readNextLocalUrl(child, 45e3) ?? `http://localhost:${portHint}`; L2242: const ready = await waitForHttp(url, 45e3);

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/dev-Q2WL7MQI.jsView on unpkg · L2230

dist/chunk-QSJIS2NL.jsView file

17try { L18: const mod = await import(moduleSpecifier(agentFile, options.hotReload)); L19: if (mod.default) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-QSJIS2NL.jsView on unpkg · L17

Findings

1 Critical3 High4 Medium5 Low

CriticalCritical Secrettemplates/default/.env.local

HighChild Processdist/dev-Q2WL7MQI.js

HighShell

HighSame File Env Network Executiondist/dev-Q2WL7MQI.js

MediumDynamic Requiredist/chunk-QSJIS2NL.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

templates/default/.env.localView file

•patternName = blocked_file severity = critical matchedText = templates/default/.env.local redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/default/.env.localView on unpkg

dist/dev-Q2WL7MQI.jsView file

Lines 20-60javascript

20import {

21 showHeader

22} from "./chunk-XOFWQUOO.js";

23import {

24 scaffoldWebChat

25} from "./chunk-WCY3PQEV.js";

26import {

27 streamAgent

28} from "./chunk-L7YWCY3M.js";

29import {

30 discoverAgents,

31 loadAgent,

32 loadAgentById

33} from "./chunk-QSJIS2NL.js";

34import {

35 discoverAgent

36} from "./chunk-6XETPLIF.js";

37import "./chunk-QE46QFID.js";

38import "./chunk-GDKRJQNX.js";

40// src/cli/dev.ts

41import { spawn } from "child_process";

42import { createServer } from "http";

High

Child Process

Package source references child process execution.

dist/dev-Q2WL7MQI.jsView on unpkg · L40

43import { existsSync as existsSync2, readFileSync as readFileSync2, watch as watch2 } from "fs";

44import { dirname, join as join2, resolve } from "path";

46// src/cli/tui/renderer/start-block-chat.ts

47import { watch } from "fs";

49// src/cli/agent-config.ts

50import { existsSync, readFileSync, readdirSync, statSync, writeFileSync } from "fs";

51import { join } from "path";

52function agentSourcePath(agentDir) {

53 return join(agentDir, "agent", "agent.ts");

54}

55function envLocalPath(agentDir) {

56 return join(agentDir, ".env.local");

57}

58function readAgentModel(agentDir) {

59 const path = agentSourcePath(agentDir);

60 if (!existsSync(path)) return void 0;

Lines 2210-2250javascript

2210 const projectRoot = dirname(agentDir);

2211 const webDir = join2(projectRoot, "channels", "web");

2212 if (!existsSync2(join2(webDir, "package.json"))) return void 0;

2213

dist/chunk-QSJIS2NL.jsView file

Lines 1-37javascript

1// src/loader.ts

2import { readFileSync, existsSync, readdirSync, statSync } from "fs";

3import { resolve, basename, extname } from "path";

4var PRIMARY_AGENT_ID = "agent";

5function moduleSpecifier(filePath, hotReload) {