registry / instar / 1.3.728

instar@1.3.728

⚠ Under review

Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 21 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 1,528 file(s), 19.5 MB of source, external domains: 127.0.0.1, abc123.trycloudflare.com, api.anthropic.com, api.cloudflare.com, api.github.com, api.groq.com, api.mail.tm, api.openai.com, api.slack.com, api.telegra.ph, api.telegram.org, blob.vercel-storage.com, bot-me.ai, brew.sh, cli.github.com, console.cloud.google.com, dawn.bot-me.ai, docs.anthropic.com, en.wikipedia.org, feedback.dawn-tunnel.dev, files.slack.com, git-scm.com, github.com, graph.facebook.com, instar-telemetry.sagemind-ai.workers.dev, instar.sh, myapp.vercel.app, nodejs.org, platform.claude.com, raw.githubusercontent.com, sagemindai.io, sentry.io, slack.com, staging.myapp.com, telegra.ph, threadline-relay.fly.dev, web.telegram.org, www.apple.com, www.npmjs.com

Source & flagged code

12 flagged

package.jsonView file

Lines 33-73json

33 "lint:no-unbounded-llm-spawn:staged": "node scripts/lint-no-unbounded-llm-spawn.js --staged",

34 "lint:destructive": "node scripts/lint-no-direct-destructive.js",

35 "lint:dev-agent-dark-gate": "node scripts/lint-dev-agent-dark-gate.js",

36 "lint:guard-manifest": "node scripts/lint-guard-manifest.js",

37 "lint:dev-agent-dark-gate:staged": "node scripts/lint-dev-agent-dark-gate.js --staged",

38 "lint:destructive:staged": "node scripts/lint-no-direct-destructive.js --staged",

39 "lint:llm-http": "node scripts/lint-no-direct-llm-http.js",

40 "lint:scrape-realness": "node scripts/lint-scrape-fixture-realness.js",

41 "lint:scrape-realness:staged": "node scripts/lint-scrape-fixture-realness.js --staged",

42 "lint:llm-attribution": "node scripts/lint-llm-attribution.js",

43 "lint:llm-attribution:staged": "node scripts/lint-llm-attribution.js --staged",

44 "lint:llm-http:staged": "node scripts/lint-no-direct-llm-http.js --staged",

45 "lint:credential-write": "node scripts/lint-no-unfunneled-credential-write.js",

46 "lint:credential-write:staged": "node scripts/lint-no-unfunneled-credential-write.js --staged",

47 "clean": "rm -rf dist",

48 "check:upgrade-guide": "node scripts/check-upgrade-guide.js",

49 "check:pre-push-gate": "node scripts/pre-push-gate.js",

50 "check:release": "node scripts/analyze-release.js",

51 "check:contract-evidence": "node scripts/check-contract-evidence.js",

52 "prepublishOnly": "npm run build && npm run check:upgrade-guide && npm run check:contract-evidence",

53 "postinstall": "node scripts/fix-better-sqlite3.cjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L53

54 "prepare": "husky"

55 },

56 "keywords": [

57 "instar",

58 "ai-agent",

59 "autonomous-agent",

60 "claude",

61 "claude-code",

62 "agent-framework",

63 "telegram-bot",

64 "job-scheduler",

65 "agent-memory",

66 "agent-identity",

67 "llm",

68 "mcp",

69 "cli",

70 "molt",

71 "lobster"

72 ],

73 "repository": {

skills/credential-leak-detector/SKILL.mdView file

Lines 7-47markdown

7 version: "1.0"

8 homepage: https://instar.sh

9---

11# credential-leak-detector — Catch Leaked Credentials Before They Spread

13Every time your agent runs a Bash command, the output flows back into the conversation — and into your API provider's logs, any monitoring tools, and the model's context window. If that output contains an API key, a private key, or a database password, the credential is now exposed in places you never intended.

15This hook scans every Bash tool response for 14 credential patterns before the output reaches the agent. Critical matches (API keys, AWS credentials, private keys) get blocked entirely. High-severity matches get redacted with a warning. Suspicious patterns get flagged as advisories. No external dependencies — just Python stdlib.

dist/threadline/PipeSessionSpawner.jsView file

Lines 1-35javascript

1/**

2 * PipeSessionSpawner — Spawns lightweight `claude -p` sessions for simple

3 * threadline queries. Sessions auto-exit when done, reducing zombie risk

4 * and session slot consumption.

5 *

6 * Part of RFC: Persistent Listener Daemon Architecture (Phase 2).

7 *

8 * Security model:

9 * - Messages wrapped in <untrusted-message> XML tags (injection-hardened)

10 * - Thread history LLM-summarized before injection (strips jailbreak assembly)

11 * - Tool restrictions: read-only + threadline_send

dist/memory/SemanticMemory.jsView file

Lines 408-448javascript

408 return false;

409 const vecAvailable = await this.embeddingProvider.loadVecModule();

410 if (!vecAvailable)

411 return false;

412 this.

skills/spec-converge/scripts/publish-spec-review.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * publish-spec-review.mjs — the sanctioned way to deliver a spec for review.

4 *

5 * Structure > Willpower: sending a spec for review WITHOUT a rendered,

6 * verified ELI16 tunnel link should be impossible, not something the agent

7 * remembers to attach. This script makes the correct delivery atomic:

8 *

9 * 1. Resolve the spec's ELI16 companion using the SAME convention the

10 * commit-time gate enforces (scripts/eli16-overview-check.mjs).

11 * 2. Refuse if the ELI16 is missing or a stub (reuses checkEli16Overview).

dist/core/upgradeAnnouncement.jsView file

Lines 1-39javascript

1/**

2 * upgradeAnnouncement — pure parsing + maturity-framing for the user-facing

3 * announcement block of a release upgrade guide

4 * (MATURE-UPDATE-ANNOUNCEMENTS spec). No I/O, no spawn, no config — just the

5 * deterministic mapping from a guide's `user_announcement` front-matter to the

6 * announcement decision, so every rule is unit-testable in isolation.

7 *

8 * THE polarity invariant: a guide with no parseable `audience: user` entry

9 * yields NO user message. Silence is the fail-safe — a parse error, a missing

10 * block, or an entry with an unknown audience/maturity all collapse to "do not

11 * announce" rather than to a malformed or misleading message. The detailed prose

.claude/hooks/free-text-guard.shView file

•path = .claude/hooks/free-text-guard.sh kind = payload_in_excluded_dir sizeBytes = 3888 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/hooks/free-text-guard.shView on unpkg

•path = .claude/hooks/free-text-guard.sh kind = build_helper sizeBytes = 3888 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/hooks/free-text-guard.shView on unpkg

Source & flagged code

12 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/fix-better-sqlite3.cjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

skills/credential-leak-detector/SKILL.mdView file

27patternName = aws_access_key severity = critical line = 27 matchedText = | AWS ac...F` |

Critical

Critical Secret

Package contains a critical-looking secret pattern.

skills/credential-leak-detector/SKILL.mdView on unpkg · L27

27patternName = aws_access_key severity = critical line = 27 matchedText = | AWS ac...F` |

Critical

Secret Pattern

AWS access key ID in skills/credential-leak-detector/SKILL.md

skills/credential-leak-detector/SKILL.mdView on unpkg · L27

28patternName = github_pat severity = critical line = 28 matchedText = | GitHub...x` |

Critical

Secret Pattern

GitHub personal access token in skills/credential-leak-detector/SKILL.md

skills/credential-leak-detector/SKILL.mdView on unpkg · L28

31patternName = private_key_rsa severity = critical line = 31 matchedText = | PEM pr...-` |

Critical

Secret Pattern

RSA private key in skills/credential-leak-detector/SKILL.md

skills/credential-leak-detector/SKILL.mdView on unpkg · L31

dist/threadline/PipeSessionSpawner.jsView file

15*/ L16: import { execSync } from 'node:child_process'; L17: import fs from 'node:fs';

High

Child Process

Package source references child process execution.

dist/threadline/PipeSessionSpawner.jsView on unpkg · L15

281// Spawn tmux session L282: execSync(`tmux new-session -d -s "${sessionName}" -x 200 -y 50 'bash -c "${shellCmd.replace(/"/g, '\\"')}"'`, { timeout: 10_000 }); L283: // Wait for session to be created

High

Shell

Package source references shell execution.

dist/threadline/PipeSessionSpawner.jsView on unpkg · L281

dist/memory/SemanticMemory.jsView file

428// better-sqlite3 loads its native binding at module-load time, so a L429: // NODE_MODULE_VERSION mismatch throws inside `await import(...)`. The L430: // healer rebuilds better-sqlite3 synchronously and retries once. See PROP-399.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/memory/SemanticMemory.jsView on unpkg · L428

skills/spec-converge/scripts/publish-spec-review.mjsView file

20* --spec docs/specs/FOO-SPEC.md \ L21: * --pr https://github.com/JKHeadley/instar/pull/670 \ L22: * --topic 12476 [--send] ... L30: import path from 'node:path'; L31: import { spawnSync } from 'node:child_process'; L32: import { checkEli16Overview } from '../../../scripts/eli16-overview-check.mjs'; L33: L34: export const API_PORT = Number(process.env.INSTAR_PORT) || 4042; L35:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

skills/spec-converge/scripts/publish-spec-review.mjsView on unpkg · L20

dist/core/upgradeAnnouncement.jsView file

19contains invisible/control Unicode U+FEFF (zero width no-break space) const FRONTMATTER_RE = /^<U+FEFF>?---\r?\n([\s\S]*?)\r?\n---\r?\n?([\s\S]*)$/;

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/core/upgradeAnnouncement.jsView on unpkg · L19

.claude/hooks/free-text-guard.shView file

•path = .claude/hooks/free-text-guard.sh kind = payload_in_excluded_dir sizeBytes = 3888 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/hooks/free-text-guard.shView on unpkg

•path = .claude/hooks/free-text-guard.sh kind = build_helper sizeBytes = 3888 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/hooks/free-text-guard.shView on unpkg

Findings

5 Critical5 High5 Medium6 Low

CriticalCritical Secretskills/credential-leak-detector/SKILL.md

CriticalTrojan Source Unicodedist/core/upgradeAnnouncement.js

CriticalSecret Patternskills/credential-leak-detector/SKILL.md

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/threadline/PipeSessionSpawner.js

HighShelldist/threadline/PipeSessionSpawner.js

HighSame File Env Network Executionskills/spec-converge/scripts/publish-spec-review.mjs

HighPayload In Excluded Dir.claude/hooks/free-text-guard.sh

MediumDynamic Requiredist/memory/SemanticMemory.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper.claude/hooks/free-text-guard.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings