registry / mr-sliy / 2.3.2

mr-sliy@2.3.2

Mr.Sliy - 基于Tree-sitter与RAG的多语言代码优化智能体

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 55 file(s), 504 KB of source, external domains: aip.baidubce.com, api.anthropic.com, api.deepseek.com, api.doubao.com, api.github.com, api.moonshot.cn, api.openai.com, dashscope.aliyuncs.com, generativelanguage.googleapis.com, github.com, open.bigmodel.cn

Source & flagged code

3 flagged

package.jsonView file

Lines 1-40json

2 "name": "mr-sliy",

3 "version": "2.3.2",

4 "description": "Mr.Sliy - 基于Tree-sitter与RAG的多语言代码优化智能体",

5 "main": "src/agent.js",

6 "bin": {

7 "mr-sliy": "src/agent.js",

8 "sliy": "src/agent.js"

9 },

10 "files": [

11 "src/",

12 "database/schema.sql",

13 "database/init.js",

14 "database/seed.js",

15 "scripts/",

16 "data/knowledge-export.json",

17 ".env.example"

18 ],

19 "scripts": {

20 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "start": "node src/agent.js",

22 "agent": "node src/agent.js",

23 "server": "node src/index.js",

24 "dev": "nodemon src/agent.js",

25 "test": "jest",

26 "test:coverage": "jest --coverage",

27 "lint": "eslint src/",

28 "init": "node database/init.js",

29 "seed": "node database/seed.js",

30 "setup": "npm run init && npm run seed",

31 "download-wasm": "node scripts/download-tree-sitter.js"

32 },

33 "keywords": [

34 "ast",

35 "code-analysis",

36 "tree-sitter",

37 "rag",

38 "code-optimization",

39 "ai",

40 "agent",

src/services/vector/knowledgeBase.jsView file

Lines 233-273javascript

233 const conditions = [];

234 const params = [];

235

236 if (type) {

237 conditions.push('content_type = ?');

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

src/services/vector/knowledgeBase.jsView file

253const results = entries.map(entry => { L254: const entryVector = JSON.parse(entry.vector_json || '{}'); L255: const similarity = embedder.cosineSimilarity(queryVector, entryVector); ... L619: const machineId = crypto.createHash('md5') L620: .update(`${os.hostname()}-${os.userInfo().username}-${os.platform()}`) L621: .digest('hex')

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/services/vector/knowledgeBase.js

Findings

1 High4 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/services/vector/knowledgeBase.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings