registry / jeeves-agent / 1.3.3

jeeves-agent@1.3.3

Jeeves Agent — 多Agent AI 管家。基于 Flue (Pi) + Tavily + Playwright MCP，一条命令部署

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 43.6 KB of source, external domains: api.tavily.com, crontab.guru, platform.deepseek.com, tavily.com

Source & flagged code

5 flagged

src/app.tsView file

Lines 1-43typescript

1/**

2 * Butler 应用入口 — 定时任务 + 多平台消息

3 */

4import { dispatch } from '@flue/runtime';

5import { flue } from '@flue/runtime/routing';

6import { Cron } from 'croner';

7import { Hono } from 'hono';

8import { readFileSync } from 'fs';

9import { spawn } from 'child_process';

10import { join } from 'path';

High

Child Process

Package source references child process execution.

src/app.tsView on unpkg · L8

11import { homedir } from 'os';

12import jeevesAgent from './agents/jeeves';

14const app = new Hono();

15app.route('/', flue());

17// ====== Playwright MCP (浏览器自动化) ======

18// 行业标准: 配置在 .env → 启动时拉起 → 退出时自动清理

19if (process.env.JEEVES_MCP_BROWSER === 'true') {

20 const MCP_PORT = 8931;

21 const mcpProcess = spawn('npx', ['@playwright/mcp@latest', '--port', String(MCP_PORT), '--headless'], {

22 stdio: 'ignore',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/app.tsView on unpkg · L20

23 windowsHide: true,

24 shell: true,

25 });

High

Shell

Package source references shell execution.

src/app.tsView on unpkg · L23

26 console.log(`[MCP] Playwright MCP 已启动 (port ${MCP_PORT})`);

28 const cleanup = () => { try { mcpProcess.kill(); } catch {} };

29 process.on('exit', cleanup);

30 process.on('SIGINT', cleanup);

31 process.on('SIGTERM', cleanup);

32}

34// ====== 定时任务 ======

35const schedulesPath = join(homedir(), '.jeeves', 'schedules.yaml');

36let schedules: any[] = [];

37try {

38 const content = readFileSync(schedulesPath, 'utf-8');

39 let current: any = null;

40 for (const line of content.split('\n')) {

41 const t = line.trim();

42 if (t.startsWith('#') || !t) continue;

43 if (t.startsWith('- name:')) {

src/cli/schedules.mjsView file

Lines 1-33javascript

1/**

2 * 定时任务管理

3 */

4import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';

5import { join } from 'path';

6import { homedir } from 'os';

8const C =

src/cli/server.mjsView file

Lines 1-23javascript

1/**

2 * Flue Dev Server 生命周期管理

3 */

4import { spawn } from 'child_process';

5import { resolve, dirname } from 'path';

6import { fileURLToPath } from 'url';

7import http from 'http';

Source & flagged code

5 flagged · loading source

src/app.tsView file

8import { readFileSync } from 'fs'; L9: import { spawn } from 'child_process'; L10: import { join } from 'path';

High

Child Process

Package source references child process execution.

src/app.tsView on unpkg · L8

23windowsHide: true, L24: shell: true, L25: });

High

Shell

Package source references shell execution.

src/app.tsView on unpkg · L23

20const MCP_PORT = 8931; L21: const mcpProcess = spawn('npx', ['@playwright/mcp@latest', '--port', String(MCP_PORT), '--headless'], { L22: stdio: 'ignore',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/app.tsView on unpkg · L20

src/cli/schedules.mjsView file

13function getSchedulePath() { L14: return join(homedir(), '.jeeves', 'schedules.yaml'); L15: } ... L34: # L35: # 更多: https://crontab.guru/ L36:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

src/cli/schedules.mjsView on unpkg · L13

src/cli/server.mjsView file

3*/ L4: import { spawn } from 'child_process'; L5: import { resolve, dirname } from 'path'; L6: import { fileURLToPath } from 'url'; L7: import http from 'http'; L8: ... L12: let serverProcess = null; L13: let serverPort = parseInt(process.env.JEEVES_PORT || '0'); L14:

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/cli/server.mjsView on unpkg · L3

Findings

4 High4 Medium4 Low

HighChild Processsrc/app.ts

HighShellsrc/app.ts

HighSame File Env Network Executionsrc/cli/server.mjs

HighRuntime Package Installsrc/app.ts

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencesrc/cli/schedules.mjs

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

src/app.tsView file

Lines 1-43typescript

1/**

2 * Butler 应用入口 — 定时任务 + 多平台消息

3 */

4import { dispatch } from '@flue/runtime';

5import { flue } from '@flue/runtime/routing';

6import { Cron } from 'croner';

7import { Hono } from 'hono';

8import { readFileSync } from 'fs';

9import { spawn } from 'child_process';

10import { join } from 'path';

High

Child Process

Package source references child process execution.

src/app.tsView on unpkg · L8

11import { homedir } from 'os';

12import jeevesAgent from './agents/jeeves';

14const app = new Hono();

15app.route('/', flue());

17// ====== Playwright MCP (浏览器自动化) ======

18// 行业标准: 配置在 .env → 启动时拉起 → 退出时自动清理

19if (process.env.JEEVES_MCP_BROWSER === 'true') {

20 const MCP_PORT = 8931;

21 const mcpProcess = spawn('npx', ['@playwright/mcp@latest', '--port', String(MCP_PORT), '--headless'], {

22 stdio: 'ignore',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/app.tsView on unpkg · L20

23 windowsHide: true,

24 shell: true,

25 });

High

Shell

Package source references shell execution.

src/app.tsView on unpkg · L23

26 console.log(`[MCP] Playwright MCP 已启动 (port ${MCP_PORT})`);

28 const cleanup = () => { try { mcpProcess.kill(); } catch {} };

29 process.on('exit', cleanup);

30 process.on('SIGINT', cleanup);

31 process.on('SIGTERM', cleanup);

32}

34// ====== 定时任务 ======

35const schedulesPath = join(homedir(), '.jeeves', 'schedules.yaml');

36let schedules: any[] = [];

37try {

38 const content = readFileSync(schedulesPath, 'utf-8');

39 let current: any = null;

40 for (const line of content.split('\n')) {

41 const t = line.trim();

42 if (t.startsWith('#') || !t) continue;

43 if (t.startsWith('- name:')) {

src/cli/schedules.mjsView file

Lines 1-33javascript

1/**

2 * 定时任务管理

3 */

4import { existsSync, readFileSync, writeFileSync, mkdirSync } from 'fs';

5import { join } from 'path';

6import { homedir } from 'os';

8const C =

src/cli/server.mjsView file

Lines 1-23javascript

1/**

2 * Flue Dev Server 生命周期管理

3 */

4import { spawn } from 'child_process';

5import { resolve, dirname } from 'path';

6import { fileURLToPath } from 'url';

7import http from 'http';