registry  /  mai-content-agents  /  1.0.3

mai-content-agents@1.0.3

CLI to install content-agents and start its services (knowledge-sync-service, agent-proxy)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 7 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessFilesystemNetwork
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 1 file(s), 15.0 KB of source, external domains: github.com, registry.npmjs.org

Source & flagged code

2 flagged · loading source
bin/content-agents.jsView file
3L4: const { spawnSync, spawn } = require("child_process"); L5: const readline = require("readline");
High
Child Process

Package source references child process execution.

bin/content-agents.jsView on unpkg · L3
198: [...extraArgs, "-WorkDir", repoPath]; L199: const line = ["powershell", "-ExecutionPolicy", "Bypass", "-File", scriptPath, ...workDirArgs] L200: .map(quoteWin).join(" "); ... L202: } else { L203: // No .sh equivalent of start_agent_proxy.ps1 exists; use the npx agent runtime directly L204: // (see src/agent_proxy/README.md "1. Start the local agent").
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/content-agents.jsView on unpkg · L198

Findings

2 High2 Medium3 Low
HighChild Processbin/content-agents.js
HighRuntime Package Installbin/content-agents.js
MediumNetwork
MediumStructural Risk Force Deep Review
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings