registry / create-agentic-qa / 1.1.0

create-agentic-qa@1.1.0

Official scaffolder for the Agentic QA ecosystem — bootstraps a project from agentic-qa-boilerplate and runs its interactive installer.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 153 KB of source, external domains: api.github.com, bun.com, bun.sh, cli.github.com, codeload.github.com, developer.atlassian.com, git-scm.com, github.com, jqlang.org, nodejs.org, playwright.dev, resend.com

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

2import{createRequire as w3}from"node:module";var W3=Object.create;var{getPrototypeOf:v3,defineProperty:_F,getOwnPropertyNames:P3}=Object;var x3=Object.prototype.hasOwnProperty;function S3(D){return this[D]}var m3,y3,a=(D,u,F)=>{var E=D!=null&&typeof D==="object";if(E){var C=u?m3??=new WeakMap:y3??=new WeakMap,B=C.get(D);if(B)return B}F=D!=null?W3(v3(D)):{};let A=u||!D||!D.__esModule?_F(F,"default",{value:D,enumerable:!0}):F;for(let I of P3(D))if(!x3.call(A,I))_F(A,I,{get:S3.bind(D,I),enumerable:!0});if(E)C.set(D,A);return A};var X=(D,u)=>()=>(u||D((u={exports:{}}).exports,u),u.exports);var zF= ...

3`,C=u.pad||" ",B=F!=="right"?_E:zE,A=!1;if(!Array.isArray(D))A=!0,D=String(D).split(E);let I,H=0;return D=D.map(function(T){return T=String(T),I=NE(T),H=Math.max(I,H),{str:T,width:I}}).map(function(T){return Array(B(H,T.width)+1).join(C)+T.str}),A?D.join(E):D}KD.left=function(u){return KD(u,{align:"left"})};KD.center=function(u){return KD(u,{align:"center"})};KD.right=function(u){return KD(u,{align:"right"})};J0.exports=KD;function _E(D,u){return Math.floor((D-u)/2)}function zE(D,u){return D-u}});var Iu=X((a6,j0)=>{var du=[],L0=0,w=(D,u)=>{if(L0>=u)du.push(D)};w.WARN=1;w.INFO=2;w.DEBUG=3;w.res ...

4`).reduce(function(C,B){return w0(B)>C?w0(B):C},0)}function hD(D,u){return Array(u+1).join(D)}function oE(D,

5`);let C=F?B8:A8;for(let B=0;B<u.length;B++)E.push.apply(E,C(D,u[B]));return E}function H8(D){let u={},F=[];for(let E=0;E<D.length;E++){let C=tE(u,D[E]);u=eE(C);let B=Object.assign({},u);F.push(g0(B,C))}return F}function T8(D,u){return["\x1B]","8",";",";",D||u,"\x07",u,"\x1B]","8",";",";","\x07"].join("")}c0.exports={strlen:ED,repeat:hD,pad:oE,truncate:F8,mergeOptions:C8,wordWrap:I8,colorizeLines:H8,hyperlink:T8}});var l0=X((o6,a0)=>{var d0={};a0.exports=d0;var p0={reset:[0,0],bold:[1,22],dim:[2,22],italic:[3,23],underline:[4,24],inverse:[7,27],hidden:[8,28],strikethrough:[9,29],black:[30,39], ...

6`)!=-1,E=this._styles,C=E.length;while(C--){var B=GD[E[C]];if(u=B.open+u.replace(B.closeRe,B.open)+B.close,F)u=u.replace(J8

7`))}wrapLines(D){let u=n.colorizeLines(D);if(this.href)return u.map((F)=>n.hyperlink(this.href,F));return u}init(D){let u=this.x,F=this.y;this.widths=D.colWidths.slice(u,u+this.colSpan),this.heights=D.rowHeights.slice(F,F+this.rowSpan),this.width=this.widths.reduce(O2,-1),this.height=this.heights.reduce(O2,-1),this.hAlign=this.options.hAlign||D.colAligns[u],this.vAlign=this.options.vAlign||D.rowAligns[F],this.drawRight=u+this.colSpan==D.colWidths.length}draw(D,u){if(D=="top")return this.drawTop(this.drawRight);if(D=="bottom")return this.drawBottom(this.drawRight);let F=n.truncate(this.content, ...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L5

8`)}get width(){return this.toString().split(`

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

9`)[0].length}}tu.reset=()=>HD.reset();function eu(D,u,F){let E=[];D.forEach(function(B){E.push(B.draw(u))});let C=E.join(

10`:`

11`)+F,C=E+1,E=D.indexOf(`

12`,C)}while(E!==-1);return B+=D.slice(C),B}var{stdout:sF,stderr:oF}=nF,ju=Symbol("GENERATOR"),$D=Symbol("STYLER"),SD=Symbol("IS_EMPTY"),eF=["ansi","ansi","ansi256","ansi16m"],ND=Object.create(null),TE=(D,u={})=>{if(u.level&&!(Number.isInteger(u.level)&&u.level>=0&&u.level<=3))throw Error("The `level` option should be an integer from 0 to 3");let F=sF?sF.level:0;D.level=u.level===void 0?F:u.level};var qE=(D)=>{let u=(...F)=>F.join(" ");return TE(u,D),Object.setPrototypeOf(u,mD.prototype),u};function mD(D){return qE(D)}Object.setPrototypeOf(mD.prototype,Function.prototype);for(let[D,u]of Object.e ...

13`);if(B!==-1)u=rF(u,C,E,B);return E+u+C};Object.defineProperties(mD.prototype,ND);var JE=mD(),K6=mD({level:oF?oF.level:0});var OD=JE

14`))u=Math.max(u,g(F));return u}var _0=a(Pu(),1);var ZE=/[\p{Lu}]/u,OE=/[\p{Ll}]/u,u0=/^[\p{Lu}](?![\p{Lu}]

15`),T=[...H],U=0;for(let[b,M]of T.entries()){if(E+=M,Eu.has(M)){let{groups:q}=new RegExp(`(?:\\${Y0}(?<code>\\d+)m|\\${Fu}(?<uri>.*)${gu})`).exec(H.slice(U))||{groups:{}};if(q.code!==void 0){let J=Number.parseFloat(q.code);C=J===vE?void 0:J}else if(q.uri!==void 0)B=q.uri.length===0?void 0:q.uri}let R=G0.codes.get(Number(C));if(T[b+1]===`

16`){if(B)E+=X0("");if(C&&R)E+=Q0(R)}else if(M===`

17`){if(C&&R)E+=Q0(C);if(B)E+=X0(B)}U+=M.length}return E};function Cu(D,u,F){return String(D).normalize().replaceAll(`\r

18`,`

19`).split(`

20`).map((E)=>mE(E,u,F)).join(`

21`)}var lE=a(Pu(),1),qD=`

22`,l=" ",yD="none",z0=()=>{let{env:D,stdout:u,stderr:F}=Bu;if(u?.columns)return u.columns;if(F?.columns)return F.columns;if(D.COLUMNS)return Number.parseInt(D.COLUMNS,10);return 80},V0=(D)=>typeof D==="number"?{top:D,right:D*3,bottom:D,left:D*3}:{top:0,right:0,bottom:0,left:

23`),J=Math.max(...q.map((Z)=>g(Z)));for(let Z of q){let O;switch(E){case"center":{O=l.repeat((I-J)/2)+Z;break}case"right":{O=l.repeat(I-J)+Z;break}default:{O=Z;break}}U.push(O)}}B=U}if(E==="center"&&A<I)B=B.map((U)=>l.repeat((I-A)/2)+U);else if(E==="right"&&A<I)B=B.map((U)=>l.repeat(I-A)+U);let H=l.repeat(u.left),T=l.repeat(u.right);if(B=B.map((U)=>{let b=H+U+T;return b+l.repeat(F-g(b))}),u.top>0)B=[...Array.from({length:u.top}).fill(l.repeat(F)),...B];if(u.bottom>0)B=[...B,...Array.from({length:u.bottom}).fill(l.repeat(F))];if(C&&B.length>C)B=B.slice(0,C);else if(C&&B.length<C)B=[...B,...Array ...

24`),U=!1;for(let b=0;b<T.length;b++){let M=T[b];if(E+=M,!U){if(U=M>="\uD800"&&M<="\uDBFF",U)continue}else U=!1;if(M===bu||M===S2){W2.lastIndex=b+1;let q=W2.exec(T)?.groups;if(q?.code!==void 0){let J=Number.parseFloat(q.code);C=J

25`){if(B)E+=x2("");let R=C?v2(C):void 0;if(C&&R)E+=P2(R)}else if(M===`

Long lines were clipped for display.

Lines 71-151javascript

71${I}

72`}}}}).prompt();var Qu=VD,RC=` ░█████ ░██████ ░███████░███ ░██░████████░██ ░██████

73 ░██ ░██░██ ░██ ░████ ░██ ░██ ░██░██

74 ░███████░██ ░███░█████ ░██░██ ░██ ░██ ░██░██

75 ██████████ ░██ ░██░██ ░██░██ ░██ ░██░██ ░██ ░██░██

76 ██▀▀▀▀▀▀██ ░██ ░██ ░██████ ░███████░██ ░████ ░██ ░██ ░██████

77 ██ ◉ ◉ ██ ░░ ░░ ░░░░░░ ░░░░░░░ ░░ ░░░░ ░░ ░░ ░░░░░░

78 ██ 3 ██

79 ██████████ ░███████░███ ░██ ░██████ ░██░███ ░██░███████░███████░██████

80 ██ ██ ░██ ░████ ░██░██ ░██░████ ░██░██ ░██ ░██ ░██

81 ░█████ ░██░██ ░██░██ ░███░██░██░██ ░██░█████ ░█████ ░██████

Source & flagged code

5 flagged · loading source

dist/cli.jsView file

106`),process.stdout.write(` L107: `)}import{existsSync as Vu,readdirSync as JC,readFileSync as A3}from"node:fs";import{join as KF}from"node:path";function GF(D,u){let F=KF(D,".template","installer.lock.json");if(!V... L108: `);let H=D.filter((U)=>U.required&&U.status==="fail"),T=H.length===0;if(T)process.stdout.write(YF.default.green(`${I3.tick??"✔"} All system prerequisites OK

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L106

139`);s();let E=await aD({message:"Want to see the full skill list for a category?",options:[{value:"back",label:"Back to menu"},{value:"gentle",label:`Expand gentle-ai skills (${u.ge... L140: `);s(),await fF()}var Y3=a(ZD(),1);import{spawnSync as VF}from"node:child_process";import{existsSync as nD}from"node:fs";import{readFile as J3,rm as M3,writeFile as Z3}from"node:fs... L141: `,"utf8"),j.dim(` Wrote package.json (name=${u}, version=0.1.0).`)}async function G3(D,u){let F=iD(D,".agents","project.yaml");if(!nD(F)){j.warn(" .agents/project.yaml not found ... ... L144: git config --global user.name "Your Name"`);j.dim(" git init + initial commit done.")}var vC=["packages",".github/workflows/pages.yml",".github/workflows/pages-squash.yml",".conte... L145: `),JF(Y3.default.bgCyan(" AGENTIC QA "));let D=await aD({message:"What would you like to do?",options:[{value:"scaffold",label:"Create a new project"},{value:"doctor",label:"Check ... L146: `),0;if(!D.noBanner)process.stdout.write(`${F3()}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.jsView on unpkg · L139

91bunx create-agentic-qa --here # use current directory`);return u}function OF(D,u,F){let E=D[u];if(!E||E.startsWith("--"))throw new $("USAGE",`Flag ${F} requires a value.`)... L92: `),process.stdout.write(`scaffolder for the Agentic QA ecosystem L93: ... L106: `),process.stdout.write(` L107: `)}import{existsSync as Vu,readdirSync as JC,readFileSync as A3}from"node:fs";import{join as KF}from"node:path";function GF(D,u){let F=KF(D,".template","installer.lock.json");if(!V... L108: `);let H=D.filter((U)=>U.required&&U.status==="fail"),T=H.length===0;if(T)process.stdout.write(YF.default.green(`${I3.tick??"✔"} All system prerequisites OK

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/cli.jsView on unpkg · L91

1#!/usr/bin/env node L2: import{createRequire as w3}from"node:module";var W3=Object.create;var{getPrototypeOf:v3,defineProperty:_F,getOwnPropertyNames:P3}=Object;var x3=Object.prototype.hasOwnProperty;func... L3: `,C=u.pad||" ",B=F!=="right"?_E:zE,A=!1;if(!Array.isArray(D))A=!0,D=String(D).split(E);let I,H=0;return D=D.map(function(T){return T=String(T),I=NE(T),H=Math.max(I,H),{str:T,width:... L4: `).reduce(function(C,B){return w0(B)>C?w0(B):C},0)}function hD(D,u){return Array(u+1).join(D)}function oE(D,u,F,E){let C=ED(D);if(u+1>=C){let B=u-C;switch(E){case"right":{D=hD(F,B)... L5: `);let C=F?B8:A8;for(let B=0;B<u.length;B++)E.push.apply(E,C(D,u[B]));return E}function H8(D){let u={},F=[];for(let E=0;E<D.length;E++){let C=tE(u,D[E]);u=eE(C);let B=Object.assign... L6: `)!=-1,E=this._styles,C=E.length;while(C--){var B=GD[E[C]];if(u=B.open+u.replace(B.closeRe,B.open)+B.close,F)u=u.replace(J8,function(A){return B.close+A+B.open})}return u}Q.setThem... L7: `))}wrapLines(D){let u=n.colorizeLines(D);if(this.href)return u.map((F)=>n.hyperlink(this.href,F));return u}init(D){let u=this.x,F=this.y;this.widths=D.colWidths.slice(u,u+this.col... L8: `)}get width(){return this.toString().split(

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

5`);let C=F?B8:A8;for(let B=0;B<u.length;B++)E.push.apply(E,C(D,u[B]));return E}function H8(D){let u={},F=[];for(let E=0;E<D.length;E++){let C=tE(u,D[E]);u=eE(C);let B=Object.assign... L6: `)!=-1,E=this._styles,C=E.length;while(C--){var B=GD[E[C]];if(u=B.open+u.replace(B.closeRe,B.open)+B.close,F)u=u.replace(J8,function(A){return B.close+A+B.open})}return u}Q.setThem... L7: `))}wrapLines(D){let u=n.colorizeLines(D);if(this.href)return u.map((F)=>n.hyperlink(this.href,F));return u}init(D){let u=this.x,F=this.y;this.widths=D.colWidths.slice(u,u+this.col...

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L5

Findings

4 High4 Medium4 Low

HighChild Processdist/cli.js

HighSame File Env Network Executiondist/cli.js

HighCommand Output Exfiltrationdist/cli.js

HighSandbox Evasion Gated Capabilitydist/cli.js

MediumDynamic Requiredist/cli.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/cli.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

4`).reduce(function(C,B){return w0(B)>C?w0(B):C},0)}function hD(D,u){return Array(u+1).join(D)}function oE(D,

6`)!=-1,E=this._styles,C=E.length;while(C--){var B=GD[E[C]];if(u=B.open+u.replace(B.closeRe,B.open)+B.close,F)u=u.replace(J8

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli.jsView on unpkg · L5

8`)}get width(){return this.toString().split(`

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/cli.jsView on unpkg · L1

9`)[0].length}}tu.reset=()=>HD.reset();function eu(D,u,F){let E=[];D.forEach(function(B){E.push(B.draw(u))});let C=E.join(

10`:`

11`)+F,C=E+1,E=D.indexOf(`

13`);if(B!==-1)u=rF(u,C,E,B);return E+u+C};Object.defineProperties(mD.prototype,ND);var JE=mD(),K6=mD({level:oF?oF.level:0});var OD=JE

14`))u=Math.max(u,g(F));return u}var _0=a(Pu(),1);var ZE=/[\p{Lu}]/u,OE=/[\p{Ll}]/u,u0=/^[\p{Lu}](?![\p{Lu}]

16`){if(B)E+=X0("");if(C&&R)E+=Q0(R)}else if(M===`

17`){if(C&&R)E+=Q0(C);if(B)E+=X0(B)}U+=M.length}return E};function Cu(D,u,F){return String(D).normalize().replaceAll(`\r

18`,`

19`).split(`

20`).map((E)=>mE(E,u,F)).join(`

21`)}var lE=a(Pu(),1),qD=`

25`){if(B)E+=x2("");let R=C?v2(C):void 0;if(C&&R)E+=P2(R)}else if(M===`

Long lines were clipped for display.

Lines 71-151javascript

71${I}

72`}}}}).prompt();var Qu=VD,RC=` ░█████ ░██████ ░███████░███ ░██░████████░██ ░██████

73 ░██ ░██░██ ░██ ░████ ░██ ░██ ░██░██

74 ░███████░██ ░███░█████ ░██░██ ░██ ░██ ░██░██

75 ██████████ ░██ ░██░██ ░██░██ ░██ ░██░██ ░██ ░██░██

76 ██▀▀▀▀▀▀██ ░██ ░██ ░██████ ░███████░██ ░████ ░██ ░██ ░██████

77 ██ ◉ ◉ ██ ░░ ░░ ░░░░░░ ░░░░░░░ ░░ ░░░░ ░░ ░░ ░░░░░░

78 ██ 3 ██

80 ██ ██ ░██ ░████ ░██░██ ░██░████ ░██░██ ░██ ░██ ░██

81 ░█████ ░██░██ ░██░██ ░███░██░██░██ ░██░█████ ░█████ ░██████