scanned 13 file(s), 11.2 MB of source, external domains: 127.0.0.1, access.redhat.com, ai.google.dev, api.example.com, api.momentic.ai, api.openai.com, api.workos.com, app.circleci.com, app.example.com, app.momentic.ai, app.posthog.com, atelierbram.github.io, avatars.githubusercontent.com, bit.ly, cdn.jsdelivr.net, cdn.playwright.dev, chriskempson.com, cloudflare-ipfs.com, clrs.cc, commonmark.org, console.cloud.google.com, cscorley.github.io, developer.mozilla.org, docs.cloud.google.com, docs.mongodb.com, docs.sentry.io, en.wikipedia.org, err.47ng.com, ethanschoonover.com, example.com, fakerjs.dev, fb.me, generativelanguage.googleapis.com, github.com, google.aip.dev, google.com, hart-dev.com, hosted-run-viewer-files.s3.us-east-2.amazonaws.com, i.ytimg.com, ipinfo.io, json-schema.org, loremflickr.com, momentic.ai, nodejs.org, openrouter.ai, p.momentic.ai, picsum.photos, playwright.dev, posthog.com, radix-ui.com
13import GQ from 'truncate-json';
L14: import bc, { supportsColorStderr, supportsColor, Chalk } from 'chalk';
L15: import D1e from 'safe-stable-stringify';
...
L30: import Dz, { randomUUID as randomUUID$1, createHash, createHmac, timingSafeEqual } from 'crypto';
L31: import * as Uwt from 'child_process';
L32: import { execFile, execSync, exec, spawnSync, spawn as spawn$1 } from 'child_process';
...
L37: import { registerInstrumentations } from '@opentelemetry/instrumentation';
L38: import { UndiciInstrumentation } from '@opentelemetry/instrumentation-undici';
L39: import { resourceFromAttributes } from '@opentelemetry/resources';
...
L42: import { [redacted], AggregationType, InstrumentType, PeriodicExportingMetricReader, MeterProvider } from '@opentelemetry/sdk-metrics';
L43: import {
13Trigger-reachable chain: manifest.bin -> bin/cli.js
L13: import GQ from 'truncate-json';
L14: import bc, { supportsColorStderr, supportsColor, Chalk } from 'chalk';
L15: import D1e from 'safe-stable-stringify';
...
L30: import Dz, { randomUUID as randomUUID$1, createHash, createHmac, timingSafeEqual } from 'crypto';
L31: import * as Uwt from 'child_process';
L32: import { execFile, execSync, exec, spawnSync, spawn as spawn$1 } from 'child_process';
...
L37: import { registerInstrumentations } from '@opentelemetry/instrumentation';
L38: import { UndiciInstrumentation } from '@opentelemetry/instrumentation-undici';
L39: import { resourceFromAttributes } from '@opentelemetry/resources';
...
L42: import { [redacted], AggregationType, InstrumentType, PeriodicExportingMetricReader, MeterProvider
CriticalTrigger Reachable Dangerous Capability
A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.
bin/cli.jsView on unpkg · L13 178L179: What the agent did: ${n}`:t}var cw=$s.extend({type:z.literal("AI_ACTION_DYNAMIC"),text:z.string(),effort:zt.optional(),retries:z.number().optional(),version:lw.optional(),cache:cj....
L180: `).map((n,r)=>r>0?`${o}${n}`:n).join(`
...
L186: `)}`;}o.required===false&&(r=r.nullable(),i+=`
L187: Use null when unknown or not applicable.`),t[o.name]=r.describe(i);}return z.strictObject(t)}function W1e(e){let t=[e.testCases??[],e.bugReproductions??[]].map(o=>z.toJSONSchema(V1...
L188: `)){let[n,r]=o.trim().split(/\s+/,2);if(!n||!r)continue;let i=Number.parseInt(r,10);Number.isFinite(i)&&(t[n]=i);}return t}function eYe(e,t){let o,n,r;for(let i of t.split(`
L189: `)){let a=i.indexOf(":");if(a===-1)continue;let s=i.slice(0,a),l=i.slice(a+1).trim();if(s==="Name"&&(o=l),s==="PPid"&&(n=Numb
HighSame File Env Network Execution
A single source file combines environment access, network access, and code or shell execution; review context before blocking.
bin/cli.jsView on unpkg · L178 •Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration.
bin/cli.js:
import Ln__default, { statSync, readFileSync, existsSync, readdir, readdirSync, createReadStream, mkdirSync, writeFileSync, appendFileSync, rmSync, unlinkSync, renameSync } from 'f...
import SY__default, { mkdirSync as mkdirSync$1, writeFileSync as writeFileSync$1, promises } from 'node:fs';
import $q, { writeFile, cp as cp$1, rm as rm$1, readFile as readFile$1, mkdir, readdir as readdir$1, mkdtemp, stat, unlink } from 'fs/promises';
What the agent did: ${n}`:t}var cw=$s.extend({type:z.literal("AI_ACTION_DYNAMIC"),text:z.string(),effort:zt.optional(),retries:z.number().optional(),version:lw.optional(),cache:cj....
Use null
HighCredential Redirect Persistence
Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.
bin/cli.jsView on unpkg 176Original error: ${o}
L177: `}async function vX({dryRun:e,operation:t}){try{return await t()}catch(o){throw new Error(aze({err:o,dryRun:e}),{cause:o})}}var GE=(i=>(i.LOCATOR="locator",i.ASSERTION="assertion",...
L178:
...
L180: `).map((n,r)=>r>0?`${o}${n}`:n).join(`
L181: `)}logWithLevelHelper(t,o,...n){if(t<this.minLogLevel)return;let r=this.forcedStream??(t>=40?"stderr":"stdout"),i=(...u)=>{let d=e.redactedValues.length===0?u:u.map(m=>typeof m=="s...
L182: `).map((m,p)=>p>0?` ${m}`:m).join(`
...
L186: `)}`;}o.required===false&&(r=r.nullable(),i+=`
L187: Use null when unknown or not applicable.`),t[o.name]=r.describe(i);}return z.strictObject(t)}function W1e(e){let t=[e.testCases??[],e.bugReproductions??[]].map(o=>z.toJSONSchema(V1...
L188: `)){let[n,r]=o.trim().split(/\s+/,2);if(!
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
bin/cli.jsView on unpkg · L176 13import GQ from 'truncate-json';
L14: import bc, { supportsColorStderr, supportsColor, Chalk } from 'chalk';
L15: import D1e from 'safe-stable-stringify';
...
L30: import Dz, { randomUUID as randomUUID$1, createHash, createHmac, timingSafeEqual } from 'crypto';
L31: import * as Uwt from 'child_process';
L32: import { execFile, execSync, exec, spawnSync, spawn as spawn$1 } from 'child_process';
...
L37: import { registerInstrumentations } from '@opentelemetry/instrumentation';
L38: import { UndiciInstrumentation } from '@opentelemetry/instrumentation-undici';
L39: import { resourceFromAttributes } from '@opentelemetry/resources';
...
L42: import { [redacted], AggregationType, InstrumentType, PeriodicExportingMetricReader, MeterProvider } from '@opentelemetry/sdk-metrics';
L43: import {
HighCloud Metadata Access
Source reaches cloud instance metadata or link-local credential endpoints.
bin/cli.jsView on unpkg · L13 30import Dz, { randomUUID as randomUUID$1, createHash, createHmac, timingSafeEqual } from 'crypto';
L31: import * as Uwt from 'child_process';
L32: import { execFile, execSync, exec, spawnSync, spawn as spawn$1 } from 'child_process';
...
L168: `,detailedDescription:Zt`
L169: Use this only after the available tools cannot establish a defensible root cause. Do not use OTHER while targeted current-run step results, container screenshots, or required past-...
L170: `,action:"fail"}],DUe="warn",FUe="pull-request",gS=(n=>(n.COMMIT_TO_SOURCE="commit-to-source",n.ROUTE_TO_OWNER="route-to-owner",n.ALREADY_FIXED="already-fixed",n))(gS||{}),BUe=["co...
...
L178:
L179: What the agent did: ${n}`:t}var cw=$s.extend({type:z.literal("AI_ACTION_DYNAMIC"),text:z.string(),effort:zt.optional(),retries:z.
HighRemote Agent Bridge
Source exposes local file and command tools to a remote model endpoint.
bin/cli.jsView on unpkg · L30 13Trigger-reachable credential exfiltration chain: manifest.bin -> bin/cli.js
L13: import GQ from 'truncate-json';
L14: import bc, { supportsColorStderr, supportsColor, Chalk } from 'chalk';
L15: import D1e from 'safe-stable-stringify';
...
L30: import Dz, { randomUUID as randomUUID$1, createHash, createHmac, timingSafeEqual } from 'crypto';
L31: import * as Uwt from 'child_process';
L32: import { execFile, execSync, exec, spawnSync, spawn as spawn$1 } from 'child_process';
...
L37: import { registerInstrumentations } from '@opentelemetry/instrumentation';
L38: import { UndiciInstrumentation } from '@opentelemetry/instrumentation-undici';
L39: import { resourceFromAttributes } from '@opentelemetry/resources';
...
L42: import { [redacted], AggregationType, InstrumentType, PeriodicExportingMet
HighTrigger Reachable Credential Exfiltration
A manifest entrypoint or package-local install chain reaches credential exfiltration behavior.
bin/cli.jsView on unpkg · L13 176Trigger-reachable command-output exfiltration chain: manifest.bin -> bin/cli.js
L176: Original error: ${o}
L177: `}async function vX({dryRun:e,operation:t}){try{return await t()}catch(o){throw new Error(aze({err:o,dryRun:e}),{cause:o})}}var GE=(i=>(i.LOCATOR="locator",i.ASSERTION="assertion",...
L178:
...
L180: `).map((n,r)=>r>0?`${o}${n}`:n).join(`
L181: `)}logWithLevelHelper(t,o,...n){if(t<this.minLogLevel)return;let r=this.forcedStream??(t>=40?"stderr":"stdout"),i=(...u)=>{let d=e.redactedValues.length===0?u:u.map(m=>typeof m=="s...
L182: `).map((m,p)=>p>0?` ${m}`:m).join(`
...
L186: `)}`;}o.required===false&&(r=r.nullable(),i+=`
L187: Use null when unknown or not applicable.`),t[o.name]=r.describe(i);}return z.strictObject(t)}function W1e(e){let t=[e.testCases??[],e.bugReproductions?
HighTrigger Reachable Command Output Exfiltration
A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.
bin/cli.jsView on unpkg · L176 •Trigger-reachable fixed external POST callback chain: manifest.bin -> bin/cli.js
import { PostHog } from 'posthog-node';
import { OTLPTraceExporter } from '@opentelemetry/exporter-trace-otlp-http';
import { OTLPMetricExporter, [redacted] } from '@opentelemetry/exporter-metrics-otlp-http';
import pDt, { validateHeaderValue, createServer as createServer$1 } from 'http';
import { createServer, request } from 'node:http';
import { request as request$1 } from 'node:https';
import { StreamableHTTPServerTransport } from '@[redacted].js';
`,action:"fail"}],DUe="warn",FUe="pull-request",gS=(n=>(n.COMMIT_TO_SOURCE="commit-to-source",n.ROUTE_TO_OWNER="route-to-owner",n.ALREADY_FIXED="already-fixed",n))(gS||{}),BUe=["co...
HighTrigger Reachable External Post Callback
A manifest entrypoint or package-local install chain reaches a fixed external POST callback.
bin/cli.jsView on unpkg 178L179: What the agent did: ${n}`:t}var cw=$s.extend({type:z.literal("AI_ACTION_DYNAMIC"),text:z.string(),effort:zt.optional(),retries:z.number().optional(),version:lw.optional(),cache:cj....
L180: `).map((n,r)=>r>0?`${o}${n}`:n).join(`
...
L189: `)){let a=i.indexOf(":");if(a===-1)continue;let s=i.slice(0,a),l=i.slice(a+1).trim();if(s==="Name"&&(o=l),s==="PPid"&&(n=Number.parseInt(l,10)),s==="VmRSS"){let c=Number.parseInt(l...
L190: `).find(n=>n.startsWith("cpu "));if(!t)return;let o=t.trim().split(/\s+/).slice(1).slice(0,8).map(n=>Number.parseInt(n,10));if(!(o.length===0||o.some(n=>!Number.isFinite(n))))retur...
L191: `);for(;o.length>0&&o[0]==="";)o.shift();for(;o.length>0&&o[o.length-1]==="";)o.pop();return o}function Z$(e,t,o){if(o<=e.length+1)return "";let n=o-e.length;return t.l
HighRuntime Package Install
Package source invokes a package manager install command at runtime.
bin/cli.jsView on unpkg · L178 286`,n),a=-1;if(r!==-1&&i!==-1?a=Math.min(r,i):r!==-1?a=r:i!==-1&&(a=i),a===-1){o=e.slice(n);break}else {let s=e.slice(n,a);t.push(s),n=a+1,e[n-1]==="\r"&&e[n]===`
L287: `&&n++;}}return [t,o]}var tm=class extends TransformStream{constructor({onError:t,onRetry:o,onComment:n}={}){let r;super({start(i){r=bde({onEvent:a=>{i.enqueue(a);},onError(a){t===...
L288: ]))`;continue}else if(r[c]==="$"){i+=`($|(?=[\r
MediumDynamic Require
Package source references dynamic require/import behavior.
bin/cli.jsView on unpkg · L286