registry / lyra-plugin-system / 0.1.10

lyra-plugin-system@0.1.10

OS + workspace tools for lyra: fs, shell, code, web, headless browser, skills — with a multi-tier execution sandbox

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 95.2 KB of source

Source & flagged code

1 flagged

src/web-fetch.tsView file

Lines 1-37typescript

1import type { ToolDef } from 'lyra-core'

2import { z } from 'zod'

4/**

5 * `web.fetch` — GET a URL and return its body as text/markdown/json.

6 *

7 * Mirrors Claude Code's `WebFetch` capability: GET-only, follows redirects

8 * via the platform fetch, decodes content-type into the most useful shape

9 * for the brain to consume. POST/PUT/DELETE are intentionally NOT supported

10 * — those have side effects that should route through `shell.run curl`

11 * with the approval modal in play.

12 *

13 * Permission scope vs `shell.run curl`:

14 * - shell.run hits the approval modal every time + redactEnv strips

15 * wallet/API-key env vars (correct for safety, but blocks legitimate

16 * auth headers if the brain wanted to construct them).

17 * - web.fetch is read-only by construction. Refuses non-GET, refuses

18 * non-http(s), refuses private/loopback/metadata IPs. No subprocess

19 * spawn, no redactEnv. Lower-risk surface, no modal needed.

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/web-fetch.tsView on unpkg · L17

20 *

21 * The HTML→markdown conversion is intentionally minimal (~80 LOC inline,

22 * no new deps). It strips script/style, converts headings/links/lists

23 * to markdown, drops everything else. Good enough for "let me read this

24 * doc page" workflows; not suitable for fully-rendered SPA scraping

25 * (use browser.* tools for that).

26 */

28const FetchSchema = z.object({

29 url: z.string().url().describe('http(s) URL to GET. Private/loopback IPs are blocked.'),

30 timeout_ms: z

31 .number()

32 .int()

33 .positive()

34 .max(30_000)

35 .optional()

36 .describe('Abort the request after N ms. Default 15000.'),

37 max_bytes: z

Source & flagged code

1 flagged · loading source

src/web-fetch.tsView file

17* - web.fetch is read-only by construction. Refuses non-GET, refuses L18: * non-http(s), refuses private/loopback/metadata IPs. No subprocess L19: * spawn, no redactEnv. Lower-risk surface, no modal needed. ... L50: content_type: string | null L51: body: string L52: truncated: boolean ... L141: L142: export function makeWebFetch(): ToolDef<z.infer<typeof FetchSchema>> { L143: return { ... L181: const { bytes, truncated } = await collectUpToBytes(res.body, maxBytes) L182: const text = new TextDecoder('utf-8', { fatal: false }).decode(bytes) L183: const block = detectBlock(text, res.status, res.url)

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/web-fetch.tsView on unpkg · L17

Findings

1 High3 Medium3 Low

HighCloud Metadata Accesssrc/web-fetch.ts

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

1 flagged

src/web-fetch.tsView file

Lines 1-37typescript

1import type { ToolDef } from 'lyra-core'

2import { z } from 'zod'

4/**

5 * `web.fetch` — GET a URL and return its body as text/markdown/json.

6 *

7 * Mirrors Claude Code's `WebFetch` capability: GET-only, follows redirects

8 * via the platform fetch, decodes content-type into the most useful shape

9 * for the brain to consume. POST/PUT/DELETE are intentionally NOT supported

10 * — those have side effects that should route through `shell.run curl`

11 * with the approval modal in play.

12 *

13 * Permission scope vs `shell.run curl`:

14 * - shell.run hits the approval modal every time + redactEnv strips

15 * wallet/API-key env vars (correct for safety, but blocks legitimate

16 * auth headers if the brain wanted to construct them).

17 * - web.fetch is read-only by construction. Refuses non-GET, refuses

18 * non-http(s), refuses private/loopback/metadata IPs. No subprocess

19 * spawn, no redactEnv. Lower-risk surface, no modal needed.

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/web-fetch.tsView on unpkg · L17

20 *

21 * The HTML→markdown conversion is intentionally minimal (~80 LOC inline,

22 * no new deps). It strips script/style, converts headings/links/lists

23 * to markdown, drops everything else. Good enough for "let me read this

24 * doc page" workflows; not suitable for fully-rendered SPA scraping

25 * (use browser.* tools for that).

26 */

28const FetchSchema = z.object({

29 url: z.string().url().describe('http(s) URL to GET. Private/loopback IPs are blocked.'),

30 timeout_ms: z

31 .number()

32 .int()

33 .positive()

34 .max(30_000)

35 .optional()

36 .describe('Abort the request after N ms. Default 15000.'),

37 max_bytes: z