registry / facult / 2.27.1

facult@2.27.1

Capture agent-work signal, reconcile evidence, and evolve AI capability.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

WildcardDependency

scanned 90 file(s), 1.95 MB of source, external domains: api.github.com, api.smithery.ai, github.com, glama.ai, hack.dance, raw.githubusercontent.com, skills.sh, wry-manatee-359.convex.site

Source & flagged code

3 flagged

bin/fclt.cjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const fs = require("node:fs");

5const fsp = require("node:fs/promises");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fclt.cjsView on unpkg · L3

6const https = require("node:https");

7const os = require("node:os");

8const path = require("node:path");

9const { spawnSync } = require("node:child_process");

11const pkg = require("../package.json");

13const REPO_OWNER = "hack-dance";

14const REPO_NAME = "fclt";

15const PACKAGE_NAME = "facult";

16const DOWNLOAD_RETRIES = 12;

17const DOWNLOAD_RETRY_DELAY_MS = 5000;

18const ACTIVE_RUNTIME_WAIT_MS = 10_000;

19const ACTIVE_RUNTIME_WAIT_INTERVAL_MS = 100;

20const STALE_RUNTIME_TEMP_MS = 10 * 60 * 1000;

22function isHelpLikeArgs(args) {

23 return (

src/autosync.tsView file

Lines 24-64typescript

24 LEGACY_MANAGED_MUTATION_FLAG,

25 legacyManagedMutationApproved,

26} from "./legacy-mutation-policy";

27import { syncManagedTools } from "./manage";

28import {

29 facultInstallStatePath,

30 facultMachineStateDir,

31 facultRootDir,

32 facultStateDir,

33 legacyFacultStateDirForRoot,

src/self-update.tsView file

Lines 52-92typescript

53interface LegacyRecoveryAction {

54 id: "cleanup-autosync";

55 service: string;

56 planId: string;

57 argv: string[];

58}

Source & flagged code

3 flagged · loading source

bin/fclt.cjsView file

3L4: const fs = require("node:fs"); L5: const fsp = require("node:fs/promises");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fclt.cjsView on unpkg · L3

src/autosync.tsView file

44const WHITESPACE_RE = /\s+/; L45: const LAUNCHCTL_WORKING_DIRECTORY_RE = /^\s*working directory\s*=\s*(.+?)\s*$/i; L46: const PLIST_COMMENT_RE = //g; ... L96: plistPath: string; L97: stdoutPath: string; L98: stderrPath: string; ... L287: rootDir?: string, L288: home: string = homedir() L289: ): string { ... L570: const text = await readFile(pathValue, "utf8"); L571: return JSON.parse(text) as T; L572: } catch {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/autosync.tsView on unpkg · L44

src/self-update.tsView file

72kind: "invocation_warning"; L73: exitCode: number; L74: } ... L136: ): SelfUpdateLegacyRecovery { L137: const parsed: unknown = JSON.parse(stdout); L138: if (!isRecord(parsed)) { ... L320: const envMethod = L321: context.envInstallMethod ?? process.env.FACULT_INSTALL_METHOD?.trim(); L322: if (envMethod === "script-dev" || envMethod === "script-bin") { ... L329: const exec = context.executablePath ?? process.execPath; L330: const home = context.homeDir ?? homedir(); L331: if ([redacted](exec)) {

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/self-update.tsView on unpkg · L72

Findings

1 High6 Medium5 Low

HighSandbox Evasion Gated Capabilitysrc/self-update.ts

MediumDynamic Requirebin/fclt.cjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/autosync.ts

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

bin/fclt.cjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const fs = require("node:fs");

5const fsp = require("node:fs/promises");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/fclt.cjsView on unpkg · L3

6const https = require("node:https");

7const os = require("node:os");

8const path = require("node:path");

9const { spawnSync } = require("node:child_process");

11const pkg = require("../package.json");

13const REPO_OWNER = "hack-dance";

14const REPO_NAME = "fclt";

15const PACKAGE_NAME = "facult";

16const DOWNLOAD_RETRIES = 12;

17const DOWNLOAD_RETRY_DELAY_MS = 5000;

18const ACTIVE_RUNTIME_WAIT_MS = 10_000;

19const ACTIVE_RUNTIME_WAIT_INTERVAL_MS = 100;

20const STALE_RUNTIME_TEMP_MS = 10 * 60 * 1000;

22function isHelpLikeArgs(args) {

23 return (

src/autosync.tsView file

Lines 24-64typescript

24 LEGACY_MANAGED_MUTATION_FLAG,

25 legacyManagedMutationApproved,

26} from "./legacy-mutation-policy";

27import { syncManagedTools } from "./manage";

28import {

29 facultInstallStatePath,

30 facultMachineStateDir,

31 facultRootDir,

32 facultStateDir,

33 legacyFacultStateDirForRoot,

src/self-update.tsView file

Lines 52-92typescript

53interface LegacyRecoveryAction {

54 id: "cleanup-autosync";

55 service: string;

56 planId: string;

57 argv: string[];

58}