registry / lyra-ai-agent / 0.1.7

lyra-ai-agent@0.1.7

lyra CLI: a Sui-native, policy-bound AI finance agent. Real on-chain work gated by deterministic policy, simulation, and approval

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 67 file(s), 280 KB of source, external domains: api.github.com, api.openai.com, api.telegram.org, example.test, github.com, gitlab.com, lyraai.space, sandbox.example, t.me

Source & flagged code

2 flagged

src/config/load.tsView file

Lines 1-36typescript

1import { existsSync } from 'node:fs'

2import { resolve } from 'node:path'

3import { type LyraConfig, agentPaths } from 'lyra-core'

5/**

6 * Load the user's `lyra.config.ts`.

7 *

8 * Phase 6.6: canonical location is `~/.lyra/config.ts` (returned by

9 * `agentPaths.config`). If that file exists, it wins. Otherwise, fall back

10 * to walking upward from cwd looking for `lyra.config.ts` (legacy v0.5.0

11 * pattern, kept so existing dev setups still work without a migration step).

12 */

13export async function findAndLoadConfig(

14 startDir: string = process.cwd(),

15): Promise<{ config: LyraConfig; path: string } | null> {

16 const canonical = agentPaths.config

17 if (existsSync(canonical)) {

18 const mod = (await import(canonical)) as { default: LyraConfig }

19 if (!mod.default) throw new Error(`lyra config at ${canonical} has no default export`)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/config/load.tsView on unpkg · L17

20 return { config: mod.default, path: canonical }

21 }

23 let dir = resolve(startDir)

24 while (true) {

25 const candidate = resolve(dir, 'lyra.config.ts')

26 if (existsSync(candidate)) {

27 const mod = (await import(candidate)) as { default: LyraConfig }

28 if (!mod.default) throw new Error(`lyra.config.ts at ${candidate} has no default export`)

29 return { config: mod.default, path: candidate }

30 }

31 const parent = resolve(dir, '..')

32 if (parent === dir) return null

33 dir = parent

34 }

35}

src/commands/login.tsView file

Lines 4-44typescript

4 *

5 * Flow (matches the web server contract exactly):

6 * 1. POST {base}/api/cli/login/start → { code, pollToken, verifyUrl, expiresInSec }

7 * 2. Show the user the verify URL + code; best-effort open the browser.

Source & flagged code

2 flagged · loading source

src/config/load.tsView file

17if (existsSync(canonical)) { L18: const mod = (await import(canonical)) as { default: LyraConfig } L19: if (!mod.default) throw new Error(`lyra config at ${canonical} has no default export`)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/config/load.tsView on unpkg · L17

src/commands/login.tsView file

24/** Default web origin; override with LYRA_WEB_URL for local/staging testing. */ L25: const DEFAULT_WEB_URL = 'https://lyraai.space' L26: const POLL_INTERVAL_MS = 2000 ... L62: try { L63: const platform = process.platform L64: const cmd = platform === 'darwin' ? 'open' : platform === 'win32' ? 'start' : 'xdg-open' L65: // Lazy import so the happy path / tests don't pull in child_process. L66: const { spawn } = require('node:child_process') as typeof import('node:child_process') ... L85: headers: { 'content-type': 'application/json' }, L86: body: '{}', L87: }) ... L90: }

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/commands/login.tsView on unpkg · L24

Findings

1 High4 Medium4 Low

HighSandbox Evasion Gated Capabilitysrc/commands/login.ts

MediumDynamic Requiresrc/config/load.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

src/config/load.tsView file

Lines 1-36typescript

1import { existsSync } from 'node:fs'

2import { resolve } from 'node:path'

3import { type LyraConfig, agentPaths } from 'lyra-core'

5/**

6 * Load the user's `lyra.config.ts`.

7 *

8 * Phase 6.6: canonical location is `~/.lyra/config.ts` (returned by

9 * `agentPaths.config`). If that file exists, it wins. Otherwise, fall back

10 * to walking upward from cwd looking for `lyra.config.ts` (legacy v0.5.0

11 * pattern, kept so existing dev setups still work without a migration step).

12 */

13export async function findAndLoadConfig(

14 startDir: string = process.cwd(),

15): Promise<{ config: LyraConfig; path: string } | null> {

16 const canonical = agentPaths.config

17 if (existsSync(canonical)) {

18 const mod = (await import(canonical)) as { default: LyraConfig }

19 if (!mod.default) throw new Error(`lyra config at ${canonical} has no default export`)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/config/load.tsView on unpkg · L17

20 return { config: mod.default, path: canonical }

21 }

23 let dir = resolve(startDir)

24 while (true) {

25 const candidate = resolve(dir, 'lyra.config.ts')

26 if (existsSync(candidate)) {

27 const mod = (await import(candidate)) as { default: LyraConfig }

28 if (!mod.default) throw new Error(`lyra.config.ts at ${candidate} has no default export`)

29 return { config: mod.default, path: candidate }

30 }

31 const parent = resolve(dir, '..')

32 if (parent === dir) return null

33 dir = parent

34 }

35}

src/commands/login.tsView file

Lines 4-44typescript

4 *

5 * Flow (matches the web server contract exactly):

6 * 1. POST {base}/api/cli/login/start → { code, pollToken, verifyUrl, expiresInSec }

7 * 2. Show the user the verify URL + code; best-effort open the browser.