registry / evoagent-core / 0.9.5

evoagent-core@0.9.5

EvoAgent — Unified AI Agent with CodeEngine, Knowledge Graph, and Kimi-style UI

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 121 file(s), 723 KB of source, external domains: api.anthropic.com, api.bing.microsoft.com, api.deepseek.com, api.duckduckgo.com, api.example.com, api.groq.com, api.longcat.chat, api.mem0.ai, api.minimaxi.com, api.mistral.ai, api.moonshot.cn, api.openai.com, api.sgroup.qq.com, api.tavily.com, api.telegram.org, api.together.xyz, api.x.ai, api.xiaomimimo.com, clawhub.ai, dashscope.aliyuncs.com, discord.com, example.com, github.com, google.serper.dev, html.duckduckgo.com, models.dev, open.bigmodel.cn, qianfan.baidubce.com, sandbox.api.sgroup.qq.com, token-plan-cn.xiaomimimo.com

Source & flagged code

5 flagged

bin/evoagent.cjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * EvoAgent CLI — 直接通过 tsx 运行源码，无需构建。

4 *

5 * evoagent 交互式会话

6 * evoagent gui 启动 Web 仪表台

7 * evoagent gateway 启动网关

8 * evoagent status 查看状态

9 * evoagent <命令> CLI 子命令

10 */

11const { spawn } = require('child_process');

12const { resolve } = require('path');

High

Child Process

Package source references child process execution.

bin/evoagent.cjsView on unpkg · L10

13const { existsSync } = require('fs');

15const ROOT = resolve(__dirname, '..');

16const args = process.argv.slice(2);

18// gui 命令走 gui.cjs 启动器

19if (args[0] === 'gui') {

20 const script = resolve(ROOT, 'scripts', 'gui.cjs');

21 if (!existsSync(script)) {

22 console.error(' ✗ missing scripts/gui.cjs');

23 process.exit(1);

24 }

25 const child = spawn(process.execPath, [script, ...args.slice(1)], {

26 stdio: 'inherit', cwd: ROOT,

27 });

28 child.on('exit', (code) => process.exit(code ?? 0));

29 return;

30}

32// 其他所有命令：npx tsx 直接跑 TS 源码

33const child = spawn('npx', ['--yes', 'tsx', 'src/cli/index.ts', ...args], {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/evoagent.cjsView on unpkg · L24

34 stdio: 'inherit',

35 cwd: ROOT,

36 shell: true,

37 windowsHide: true,

38});

39child.on('exit', (code) => process.exit(code ?? 0));

dist/tools/bash.jsView file

Lines 1-23javascript

1import { spawn, exec } from "child_process";

2import { promisify } from "util";

3import { toolCache } from "../core/kv-cache.js";

4const execAsync = promisify

dist/tools/code.jsView file

Lines 33-73javascript

33 },

34 {

35 id: "no-var",

36 severity: "warning",

37 check: (_, lines) => {

dist/tools/web.jsView file

Lines 15-55javascript

15 engines: { type: "array", items: { type: "string", enum: ["tavily", "serper", "bing", "duckduckgo"] }, description: "Engines for multi_search (default: all)" }

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code