registry / exec-by-btw / 3.1.1

exec-by-btw@3.1.1

exec by btw — universal MCP server for Roblox. Execute Luau, inspect scripts, spy on remotes. Works on macOS, Linux, Windows with any executor.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 88 file(s), 530 KB of source, external domains: aka.ms, api.openai.com, bun.com, github.com, opencode.ai, pkgs.tailscale.com, tailscale.com, thumbnails.roblox.com, www.w3.org

Source & flagged code

6 flagged

dist/tools/impl/windows/list-roblox-windows.jsView file

Lines 1-54javascript

1import { z } from "zod";

2import { detectPlatform } from "../../../platform/cross-platform-screenshot.js";

3import { execSync } from "node:child_process";

4function listWindowsMacOS() {

High

Child Process

Package source references child process execution.

dist/tools/impl/windows/list-roblox-windows.jsView on unpkg · L2

5 try {

6 const out = execSync(`osascript -e 'tell application "System Events" to get name of every process whose name contains "Roblox"'`, { timeout: 3000 }).toString().trim();

7 if (!out)

8 return [];

9 // AppleScript returns comma-separated list

10 return out.split(",").map((name) => ({

11 title: name.trim(),

12 pid: 0,

13 }));

14 }

15 catch {

16 return [];

17 }

18}

19function listWindowsLinux() {

20 try {

21 const out = execSync(`xdotool search --name "Roblox" 2>/dev/null || echo ""`, {

22 timeout: 3000,

23 }).toString().trim();

24 if (!out)

25 return [];

26 return out.split("\n").map((id) => ({

27 title: `Roblox (window ${id})`,

28 pid: 0,

29 }));

30 }

31 catch {

32 return [];

33 }

34}

35function listWindowsPowerShell() {

36 try {

High

Shell

Package source references shell execution.

dist/tools/impl/windows/list-roblox-windows.jsView on unpkg · L34

37 const out = execSync(`powershell -NoProfile -Command "Get-Process | Where-Object { $_.MainWindowTitle -like '*Roblox*' } | Select-Object -ExpandProperty MainWindowTitle"`, { timeout: 5000 }).toString().trim();

38 if (!out)

39 return [];

40 return out.split("\n").filter(Boolean).map((title) => ({

41 title: title.trim(),

42 pid: 0,

43 }));

44 }

45 catch {

46 return [];

47 }

48}

49export function enumRobloxWindows() {

50 const platform = detectPlatform();

51 if (platform === "darwin")

52 return listWindowsMacOS();

53 if (platform === "linux")

54 return listWindowsLinux();

dist/platform/cross-platform-screenshot.jsView file

Lines 115-155javascript

115 }

116 // Last resort: create a placeholder and log instructions

117 log.warn("No screenshot tool found on Linux. Install imagemagick, scrot, maim, or gnome-screenshot.");

118 fs.writeFileSync(outPath + ".txt", "Screenshot not available: install imagemagick, scrot, maim, or gnome-screenshot.");

119 return { filePath: outPath + ".txt", platform: "linux", tool: "none (install imagemagick)"

scripts/run-with-bun.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import fs from "node:fs";

4import os from "node:os";

5import path from "node:path";

6import { fileURLToPath } from "node:url"

scripts/launcher.mjsView file

Lines 27-67javascript

27const isBun = typeof globalThis.Bun !== "undefined";

28const runner = isBun ? "bun" : "node";

30const paint = (code, s)

menu.batView file

•path = menu.bat kind = build_helper sizeBytes = 140 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

menu.batView on unpkg

Source & flagged code

6 flagged · loading source

dist/tools/impl/windows/list-roblox-windows.jsView file

2import { detectPlatform } from "../../../platform/cross-platform-screenshot.js"; L3: import { execSync } from "node:child_process"; L4: function listWindowsMacOS() {

High

Child Process

Package source references child process execution.

dist/tools/impl/windows/list-roblox-windows.jsView on unpkg · L2

34} L35: function listWindowsPowerShell() { L36: try {

High

Shell

Package source references shell execution.

dist/tools/impl/windows/list-roblox-windows.jsView on unpkg · L34

dist/platform/cross-platform-screenshot.jsView file

135'public class W{', L136: '[DllImport("user32.dll")]public static extern bool GetWindowRect(IntPtr h,out R r);', L137: '[DllImport("user32.dll")]public static extern bool SetForegroundWindow(IntPtr h);',

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/platform/cross-platform-screenshot.jsView on unpkg · L135

scripts/run-with-bun.mjsView file

1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import fs from "node:fs"; ... L7: L8: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L9: const repoRoot = path.resolve(__dirname, ".."); ... L24: const env = { L25: ...process.env, L26: PATH: prependPath(process.env.PATH || "", path.dirname(bun)), ... L60: const tag = version ? `bun-v${version}` : ""; L61: const command = process.platform === "win32" L62: ? installBunWindowsCommand(tag)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

scripts/run-with-bun.mjsView on unpkg · L1

scripts/launcher.mjsView file

47log("Installing dependencies..."); L48: const pm = isBun ? "bun install" : "npm install --no-audit --no-fund"; L49: try { L50: execSync(pm, { cwd: ROOT, stdio: "inherit" }); L51: } catch {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/launcher.mjsView on unpkg · L47

menu.batView file

•path = menu.bat kind = build_helper sizeBytes = 140 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

menu.batView on unpkg

Findings

4 High5 Medium4 Low

HighChild Processdist/tools/impl/windows/list-roblox-windows.js

HighShelldist/tools/impl/windows/list-roblox-windows.js

HighSandbox Evasion Gated Capabilityscripts/run-with-bun.mjs

HighRuntime Package Installscripts/launcher.mjs

MediumDynamic Requiredist/platform/cross-platform-screenshot.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpermenu.bat

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/tools/impl/windows/list-roblox-windows.jsView file

Lines 1-54javascript

1import { z } from "zod";

2import { detectPlatform } from "../../../platform/cross-platform-screenshot.js";

3import { execSync } from "node:child_process";

4function listWindowsMacOS() {

High

Child Process

Package source references child process execution.

dist/tools/impl/windows/list-roblox-windows.jsView on unpkg · L2

5 try {

6 const out = execSync(`osascript -e 'tell application "System Events" to get name of every process whose name contains "Roblox"'`, { timeout: 3000 }).toString().trim();

7 if (!out)

8 return [];

9 // AppleScript returns comma-separated list

10 return out.split(",").map((name) => ({

11 title: name.trim(),

12 pid: 0,

13 }));

14 }

15 catch {

16 return [];

17 }

18}

19function listWindowsLinux() {

20 try {

21 const out = execSync(`xdotool search --name "Roblox" 2>/dev/null || echo ""`, {

22 timeout: 3000,

23 }).toString().trim();

24 if (!out)

25 return [];

26 return out.split("\n").map((id) => ({

27 title: `Roblox (window ${id})`,

28 pid: 0,

29 }));

30 }

31 catch {

32 return [];

33 }

34}

35function listWindowsPowerShell() {

36 try {

High

Shell

Package source references shell execution.

dist/tools/impl/windows/list-roblox-windows.jsView on unpkg · L34

38 if (!out)

39 return [];

40 return out.split("\n").filter(Boolean).map((title) => ({

41 title: title.trim(),

42 pid: 0,

43 }));

44 }

45 catch {

46 return [];

47 }

48}

49export function enumRobloxWindows() {

50 const platform = detectPlatform();

51 if (platform === "darwin")

52 return listWindowsMacOS();

53 if (platform === "linux")

54 return listWindowsLinux();

dist/platform/cross-platform-screenshot.jsView file

Lines 115-155javascript

115 }

116 // Last resort: create a placeholder and log instructions

117 log.warn("No screenshot tool found on Linux. Install imagemagick, scrot, maim, or gnome-screenshot.");

118 fs.writeFileSync(outPath + ".txt", "Screenshot not available: install imagemagick, scrot, maim, or gnome-screenshot.");

119 return { filePath: outPath + ".txt", platform: "linux", tool: "none (install imagemagick)"

scripts/run-with-bun.mjsView file

Lines 1-21javascript

1#!/usr/bin/env node

2import { spawnSync } from "node:child_process";

3import fs from "node:fs";

4import os from "node:os";

5import path from "node:path";

6import { fileURLToPath } from "node:url"

scripts/launcher.mjsView file

Lines 27-67javascript

27const isBun = typeof globalThis.Bun !== "undefined";

28const runner = isBun ? "bun" : "node";

30const paint = (code, s)

menu.batView file

•path = menu.bat kind = build_helper sizeBytes = 140 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

menu.batView on unpkg