registry / customize-agent / 3.0.0

customize-agent@3.0.0

通用终端 AI 助手 — 原生 Function Calling + 双语 TUI + 三级模型分层

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 29 file(s), 303 KB of source, external domains: 127.0.0.1

Source & flagged code

3 flagged

dist/tui/file-index.jsView file

Lines 1-24javascript

1/**

2 * 按需文件索引 — 首次 @ 触发时 git ls-files 扫描，子串匹配 + 评分排序。

3 * 优先 git ls-files（毫秒级），回退 fast-glob。会话期间缓存。

4 */

5import { execFileSync } from 'child_process';

6import glob from 'fast-glob';

High

Child Process

Package source references child process execution.

dist/tui/file-index.jsView on unpkg · L4

7export class FileIndex {

8 files = null;

9 root;

10 constructor(root) { this.root = root; }

11 /** 子串匹配 + 按匹配位置/路径长度评分排序，最多 max 条 */

12 search(partial, max = 12) {

13 if (!this.files)

14 this._build();

15 const lower = partial.toLowerCase();

16 const scored = [];

17 for (const f of this.files) {

18 const idx = f.toLowerCase().indexOf(lower);

19 if (idx >= 0) {

20 scored.push({ f, s: idx * 10000 + f.length });

21 }

22 }

23 scored.sort((a, b) => a.s - b.s);

24 return scored.slice(0, max).map(x => x.f);

dist/agent/executor.jsView file

Lines 19-59javascript

19 controller;

20 contextManager;

21 approvalHandler;

22 i18n;

23 projectRoot;

24 repoMap;

25 maxIterations;

26 stream;

27 onWrite;

28 onEvent;

29 /** 最近一次 thinking 完整内容（ctrl+o 展开用） */

30 _lastThinkingContent =

dist/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2// ↑ shebang — 必须保留。让操作系统知道用 Node.js 执行此文件，CLI 的 bin 入口依赖它。

3import { Command } from 'commander';

4import { execSync } from 'child_process';

5import { readFileSync } from 'fs';

6import { dirname, resolve } from 'path';

7import

Source & flagged code

3 flagged · loading source

dist/tui/file-index.jsView file

4*/ L5: import { execFileSync } from 'child_process'; L6: import glob from 'fast-glob';

High

Child Process

Package source references child process execution.

dist/tui/file-index.jsView on unpkg · L4

dist/agent/executor.jsView file

39this.i18n = config.i18n; L40: this.projectRoot = config.projectRoot ?? process.cwd(); L41: this.repoMap = config.repoMap; ... L109: } L110: /** 统一输出：onWrite 优先 → onEvent 其次 → process.stdout 回退 */ L111: _write(text) { ... L119: } L120: process.stdout.write(text); L121: } ... L320: try { L321: const validation = PlanModeManager.validatePlan(JSON.parse(jsonText)); L322: const formatted = validation.valid && validation.plan

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/agent/executor.jsView on unpkg · L39

dist/index.jsView file

3import { Command } from 'commander'; L4: import { execSync } from 'child_process'; L5: import { readFileSync } from 'fs'; L6: import { dirname, resolve } from 'path'; L7: import { createServer } from 'net'; L8: import { createRequire } from 'module'; ... L17: function resolveUserProjectRoot() { L18: return resolve(process.env.CUSTOMIZE_PROJECT_ROOT ?? process.env.INIT_CWD ?? process.env.PWD ?? process.cwd()); L19: }

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L3

Findings

3 High3 Medium6 Low

HighChild Processdist/tui/file-index.js

HighShell

HighSame File Env Network Executiondist/index.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptodist/agent/executor.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/tui/file-index.jsView file

Lines 1-24javascript

1/**

2 * 按需文件索引 — 首次 @ 触发时 git ls-files 扫描，子串匹配 + 评分排序。

3 * 优先 git ls-files（毫秒级），回退 fast-glob。会话期间缓存。

4 */

5import { execFileSync } from 'child_process';

6import glob from 'fast-glob';

High

Child Process

Package source references child process execution.

dist/tui/file-index.jsView on unpkg · L4

7export class FileIndex {

8 files = null;

9 root;

10 constructor(root) { this.root = root; }

11 /** 子串匹配 + 按匹配位置/路径长度评分排序，最多 max 条 */

12 search(partial, max = 12) {

13 if (!this.files)

14 this._build();

15 const lower = partial.toLowerCase();

16 const scored = [];

17 for (const f of this.files) {

18 const idx = f.toLowerCase().indexOf(lower);

19 if (idx >= 0) {

20 scored.push({ f, s: idx * 10000 + f.length });

21 }

22 }

23 scored.sort((a, b) => a.s - b.s);

24 return scored.slice(0, max).map(x => x.f);

dist/agent/executor.jsView file

Lines 19-59javascript

19 controller;

20 contextManager;

21 approvalHandler;

22 i18n;

23 projectRoot;

24 repoMap;

25 maxIterations;

26 stream;

27 onWrite;

28 onEvent;

29 /** 最近一次 thinking 完整内容（ctrl+o 展开用） */

30 _lastThinkingContent =

dist/index.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2// ↑ shebang — 必须保留。让操作系统知道用 Node.js 执行此文件，CLI 的 bin 入口依赖它。

3import { Command } from 'commander';

4import { execSync } from 'child_process';

5import { readFileSync } from 'fs';

6import { dirname, resolve } from 'path';

7import