registry / milens / 0.7.3

milens@0.7.3

AI-DOS: Code Intelligence Platform — knowledge graphs, security scanning, and closed-loop AI development. 43 MCP tools, 6 sub-agent prompts, 190 security rules, 7 CLI workflows.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 54 file(s), 890 KB of source, external domains: 127.0.0.1, cdn.jsdelivr.net, github.com

Source & flagged code

8 flagged

dist/server/mcp-prompts.jsView file

Lines 415-455javascript

415## STEP 6 — CONFIGURATION AUDIT

416Run \`grep({pattern: "--dangerously-skip-permissions|access-control-allow-origin: \\\\*|secure: false|httpOnly: false|debug: true", scope: "code", isRegex: true})\` → security misconfigurations

417

418## STEP 7 — DEPENDENCY CHECK

419Run \`grep({pattern: "MD5|SHA1\\\\(|Math\\\\.random", scope: "code", isRegex: true})

Source & flagged code

8 flagged · loading source

dist/server/mcp-prompts.jsView file

435patternName = generic_password severity = medium line = 435 matchedText = | 1 | se...RD |

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/server/mcp-prompts.jsView on unpkg · L435

dist/security/rules.jsView file

215severity: 'CRITICAL', L216: name: 'Use of exec() in Python', L217: description: 'Python exec() executes arbitrary code from a string. Avoid using it.',

High

Child Process

Package source references child process execution.

dist/security/rules.jsView on unpkg · L215

198severity: 'CRITICAL', L199: name: 'Use of eval()', L200: description: 'eval() executes arbitrary code from a string and is extremely dangerous. Almost always avoidable.',

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/security/rules.jsView on unpkg · L198

dist/cli.jsView file

9Cross-file remote execution chain: dist/cli.js spawns dist/security/rules.js; helper contains network access plus dynamic code execution. L9: if (nodeMajor < 20) { L10: process.stderr.write(`milens requires Node.js >= 20.0.0 (current: ${process.version})\n`); L11: process.exit(1); ... L14: const __filename = fileURLToPath(import.meta.url); L15: const PKG_VERSION = process.env.MILENS_VERSION ?? JSON.parse(readFileSync(join(dirname(__filename), '..', 'package.json'), 'utf-8')).version; L16: // Files each harness adapter contributes, relative to adapters/<harness>/ (src) and ... L506: if (opts.clearCache !== false) { L507: const npxCache = joinPath(getHomedir(), '.npm', '_npx'); L508: if (fsExists(npxCache)) { ... L672: server.listen(port, '127.0.0.1', () => { L673: const url = `http://127.0.0.1:${port}`; L674: console.log(`\n📊 milens Dashboard → ${url}\n`);

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L9

1259console.log(`\nGenerated install command:`); L1260: console.log(` npx milens init --profile ${opts.profile} ${withFlags} ${harnessFlag}`.trim()); L1261: const confirm = await ask('\nProceed with install? [Y/n]: '); ... L1273: console.log(`Milens init — bootstrapping ${opts.profile} profile for ${root}`); L1274: const { execSync } = await import('node:child_process'); L1275: console.log('Step 1/4: Analyzing codebase...');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L1259

9if (nodeMajor < 20) { L10: process.stderr.write(`milens requires Node.js >= 20.0.0 (current: ${process.version})\n`); L11: process.exit(1); ... L14: const __filename = fileURLToPath(import.meta.url); L15: const PKG_VERSION = process.env.MILENS_VERSION ?? JSON.parse(readFileSync(join(dirname(__filename), '..', 'package.json'), 'utf-8')).version; L16: // Files each harness adapter contributes, relative to adapters/<harness>/ (src) and ... L506: if (opts.clearCache !== false) { L507: const npxCache = joinPath(getHomedir(), '.npm', '_npx'); L508: if (fsExists(npxCache)) { ... L672: server.listen(port, '127.0.0.1', () => { L673: const url = `http://127.0.0.1:${port}`; L674: console.log(`\n📊 milens Dashboard → ${url}\n`);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L9

.agents/skills/milens-security-review/SKILL.mdView file

47patternName = generic_password severity = medium line = 47 matchedText = - **Conf...igh)

Medium

Secret Pattern

Hardcoded password in .agents/skills/milens-security-review/SKILL.md

.agents/skills/milens-security-review/SKILL.mdView on unpkg · L47

209patternName = generic_password severity = medium line = 209 matchedText = 1. **Don...ame.

Medium

Secret Pattern

Hardcoded password in .agents/skills/milens-security-review/SKILL.md

.agents/skills/milens-security-review/SKILL.mdView on unpkg · L209

Findings

4 High7 Medium6 Low

HighChild Processdist/security/rules.js

HighShell

HighCross File Remote Execution Contextdist/cli.js

HighRuntime Package Installdist/cli.js

MediumSecret Patterndist/server/mcp-prompts.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli.js

MediumStructural Risk Force Deep Review

MediumSecret Pattern.agents/skills/milens-security-review/SKILL.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvaldist/security/rules.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/security/rules.jsView file

Lines 178-235javascript

178 severity: 'HIGH',

179 name: 'Sensitive environment variable or AUTH_TOKEN',

180 description: 'AUTH_TOKEN or similar sensitive credential is set to a literal value rather than referencing an external secret.',

181 patterns: [

182 /AUTH_TOKEN\s*=\s*(?!\$\{|\w+\.|\w+\()([^\s'"`\n]{8,}|['"`][^'"`\n]{8,}['"`])/i,

183 /(?:\.env\s*(?:file)?\s*[:=]\s*(?!\$\{)([^\s'"`\n]+|['"`][^'"`]*['"`]))/i,

184 /process\.env\.([A-Z_]+)\s*=\s*(?!\$\{|\w+\.|\w+\()([^\s'"`\n]{8,}|['"`][^'"`\n]{8,}['"`])/,

185 ],

186 excludeGlob: SECRETS_EXCLUDE,

187 fix: 'Never assign secret values to process.env in code. Use external .env files (gitignored) or a secrets manager.',

188 confidence: 0.85,

189 falsePositiveRisk: 'low', enabled: true,

190 },

191 // ═══════════════════════════════════════════════════════════════

192 // SEC-011 – SEC-019 : Injection (A03:2021)

193 // ═══════════════════════════════════════════════════════════════

194 {

195 id: 'SEC-011',

196 category: 'injection',

197 owasp: 'A03:2021',

198 severity: 'CRITICAL',

199 name: 'Use of eval()',

200 description: 'eval() executes arbitrary code from a string and is extremely dangerous. Almost always avoidable.',

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/security/rules.jsView on unpkg · L198

201 patterns: [

202 /\beval\s*$\s*[^)]*\s*$/,

203 /\beval\s*$\s*`[^`]*\$\{[^}]*\}[^`]*`\s*$/,

204 ],

205 fileGlob: '**/*.{js,jsx,ts,tsx,mjs,cjs}',

206 excludeGlob: DEFAULT_EXCLUDE,

207 fix: 'Replace eval() with safer alternatives: JSON.parse() for data, or design a non-eval code path.',

208 confidence: 0.92,

209 falsePositiveRisk: 'low', enabled: true,

210 },

211 {

212 id: 'SEC-012',

213 category: 'injection',

214 owasp: 'A03:2021',

215 severity: 'CRITICAL',

216 name: 'Use of exec() in Python',

217 description: 'Python exec() executes arbitrary code from a string. Avoid using it.',

High

Child Process

Package source references child process execution.

dist/security/rules.jsView on unpkg · L215

218 patterns: [

219 /\bexec\s*$\s*[^)]*\s*$/,

220 /\bexec\s*\(\s*(?:f['"]|['"]\s*%\s*)/,

221 ],

222 fileGlob: '**/*.py',

223 excludeGlob: DEFAULT_EXCLUDE,

224 fix: 'Avoid exec(). Use getattr(), importlib, or restructure logic to not require dynamic execution.',

225 confidence: 0.90,

226 falsePositiveRisk: 'low', enabled: true,

227 },

228 {

229 id: 'SEC-013',

230 category: 'injection',

231 owasp: 'A03:2021',

232 severity: 'HIGH',

233 name: 'child_process.exec with dynamic input',

234 description: 'child_process.exec() spawns a shell — user-controlled input can lead to command injection.',

235 patterns: [

dist/cli.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2import { Command } from 'commander';

3import { resolve, join, dirname, basename } from 'node:path';

4import { mkdirSync, readFileSync, rmSync, existsSync, cpSync } from 'node:fs';

5import { createHash, randomUUID } from 'node:crypto';

6import { fileURLToPath } from 'node:url';

7import { loadAliases } from './analyzer/config.js';

8const nodeMajor = parseInt(process.versions.node.split('.')[0], 10);

9if (nodeMajor < 20) {

10 process.stderr.write(`milens requires Node.js >= 20.0.0 (current: ${process.version})\n`);

11 process.exit(1);

12}

13const program = new Command();

14const __filename = fileURLToPath(import.meta.url);

15const PKG_VERSION = process.env.MILENS_VERSION ?? JSON.parse(readFileSync(join(dirname(__filename), '..', 'package.json'), 'utf-8')).version;

16// Files each harness adapter contributes, relative to adapters/<harness>/ (src) and

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L9

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L9

17// the project root (dest). Copying never overwrites a file that already exists at dest.

18const HARNESS_ADAPTER_FILES = {

19 'claude-code': [

20 { src: '.claude/mcp.json', dest: '.claude/mcp.json' },

21 { src: 'CLAUDE.md', dest: 'CLAUDE.md' },

22 ],

23 'opencode': [

24 { src: '.opencode/config.json', dest: '.opencode/config.json' },

25 { src: 'AGENTS.md', dest: 'AGENTS.md' },

26 ],

27 'codex': [

28 { src: '.codex/config.toml', dest: '.codex/config.toml' },

29 { src: '.codex/codex.md', dest: '.codex/codex.md' },

Lines 1239-1279javascript

1239 }

1240 // CI/CD templates

1241 const ciChoice = await ask('Include CI/CD templates (GitHub Actions)? [Y/n]: ');

1242 if (ciChoice.trim().toLowerCase() !== 'n') {

1243 opts.with += (opts.with ? ',' :

.agents/skills/milens-security-review/SKILL.mdView file

Lines 27-67markdown

27```

28mcp_milens_review_pr({repo: "<workspaceRoot>"})

29```

31Focus on:

32- **New files** — highest risk for secrets or vulnerabilities

33- **Modified config files** — `.env`, `config.*`, settings files

34- **Auth/routing files** — middleware, guards, session handlers

35- **CRITICAL-rated symbols** — these get deep-dived in Step 6

37### Step 2: Secret Detection

39Search for hardcoded secrets and credentials.

41```

42mcp_milens_grep({pattern: "password|secret|api_key|token|private_key|AUTH_TOKEN", scope: "code", repo: "<workspaceRoot>"})

43```

45Key patterns to flag:

46- **Assignments to secrets** — `const apiKey = "sk-..."` (critical)

47- **Config values** — `password: "admin123"` (high)

Medium

Secret Pattern

Hardcoded password in .agents/skills/milens-security-review/SKILL.md

.agents/skills/milens-security-review/SKILL.mdView on unpkg · L47

48- **Variable names only** — `const apiKey = process.env.KEY` (low — already env-var'd)

49- **Test fixtures** — `const testPassword = "..."` (verify it's not a real password)

51### Step 3: Hidden Unicode Detection (Trojan Source)

53Search for invisible and bidirectional Unicode characters used in supply-chain attacks.

55```

56mcp_milens_grep({pattern: "[\\u200B\\u200C\\u200D\\u2060\\uFEFF\\u202A-\\u202E]", scope: "code", isRegex: true, repo: "<workspaceRoot>"})

57```

59These characters can:

60- Make code look like one thing but compile as another

61- Hide backdoors in copy-pasted code

62- Exploit bidirectional text in string literals and comments

64**Any match is a CRITICAL finding** — flag for immediate removal.

66### Step 4: Dangerous Code Patterns

Lines 189-225markdown

189```

190

191**Step 6 — Deep-dive:**

192```

193mcp_milens_review_symbol({name: "authHandler", repo: "/home/user/project"})

194```

195

196**Output:** Core auth entry point, 23 dependents, 0 tests — very high risk.

197

198**Step 7 — Verify scope:**

199```

200mcp_milens_detect_changes({repo: "/home/user/project"})

201```

202

203**Output:** 8 files changed — matches expectations.