registry / genius-cortex / 3.2.2

genius-cortex@3.2.2

Genius Cortex — multi-repo orchestration platform for Genius Team projects

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 474 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, raw.githubusercontent.com, registry.npmjs.org, tauri.localhost

Source & flagged code

2 flagged

dist/core/registry.jsView file

Lines 1-30javascript

1"use strict";

2Object.defineProperty(exports, "__esModule", { value: true });

3exports.loadRegistry = loadRegistry;

4exports.saveRegistry = saveRegistry;

5exports.inspectRepo = inspectRepo;

6exports

Source & flagged code

2 flagged · loading source

dist/core/registry.jsView file

10const path_1 = require("path"); L11: const child_process_1 = require("child_process"); L12: const config_1 = require("./config");

High

Child Process

Package source references child process execution.

dist/core/registry.jsView on unpkg · L10

dist/api/server.jsView file

417if (url.startsWith('/api/portfolio/intelligence')) { L418: const params = new URL(`http://x${url}`).searchParams; L419: const repoName = params.get('repo'); ... L425: try { L426: const { execSync } = require('child_process'); L427: const PATH = `/opt/homebrew/bin:/usr/local/bin:${process.env.PATH}`; L428: const ver = execSync('claude --version', { encoding: 'utf-8', timeout: 5000, env: { ...process.env, PATH } }).trim();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/api/server.jsView on unpkg · L417

Findings

3 High2 Medium5 Low

HighChild Processdist/core/registry.js

HighShell

HighSame File Env Network Executiondist/api/server.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/api/server.jsView file

Lines 397-437javascript

397 const repoPath = params.get('path');

398 if (!repoPath)

399 return json(res, { error: 'path required' });

400 const detail = (0, wiki_1.getCortexWikiRepoDetail)(repoPath);

401 if (!detail)

402 return json(res, { error: 'not found' });

403 return json(res, detail);

404 }

405 if (url.startsWith('/api/intelligence/search?q='))

406 return json(res, (0, intelligence_1.searchIntelligence)(decodeURIComponent(url.split('q=')[1] || '')));

407 if (url.startsWith('/api/intelligence/')) {

408 const kind = decodeURIComponent(url.replace('/api/intelligence/', ''));

409 if (['behavior', 'rule', 'memory', 'persona', 'codebit', 'glossary'].includes(kind)) {

410 return json(res, (0, intelligence_1.getIntelligenceKindItems)(kind));

411 }

412 }

413 if (url === '/api/portfolio')

414 return json(res, await (0, portfolio_1.buildPortfolioAggregate)());

415 if (url === '/api/portfolio/summary')

416 return json(res, await (0, portfolio_1.buildPortfolioSummary)());

417 if (url.startsWith('/api/portfolio/intelligence')) {

418 const params = new URL(`http://x${url}`).searchParams;

419 const repoName = params.get('repo');

420 if (repoName)

421 return json(res, (0, portfolio_1.getPortfolioIntelligenceForRepo)(repoName));

422 return json(res, (await (0, portfolio_1.buildPortfolioAggregate)()).intelligence);

423 }

424 if (url === '/api/claude-status') {

425 try {

426 const { execSync } = require('child_process');

427 const PATH = `/opt/homebrew/bin:/usr/local/bin:${process.env.PATH}`;

428 const ver = execSync('claude --version', { encoding: 'utf-8', timeout: 5000, env: { ...process.env, PATH } }).trim();

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/api/server.jsView on unpkg · L417

429 // Try a quick check if logged in

430 try {

431 execSync('claude --print "hi"', { encoding: 'utf-8', timeout: 10000, env: { ...process.env, PATH } });

432 return json(res, { installed: true, loggedIn: true, version: ver });

433 }

434 catch (e) {

435 const msg = e.stderr || e.stdout || e.message || '';

436 return json(res, { installed: true, loggedIn: !msg.includes('Not logged in'), version: ver, error: msg.slice(0, 200) });

437 }