registry / mr-sliy / 2.4.5

mr-sliy@2.4.5

Mr.Sliy - 基于Tree-sitter与RAG的多语言代码优化智能体

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 59 file(s), 552 KB of source, external domains: aip.baidubce.com, api.anthropic.com, api.deepseek.com, api.doubao.com, api.github.com, api.moonshot.cn, api.openai.com, dashscope.aliyuncs.com, generativelanguage.googleapis.com, github.com, open.bigmodel.cn

Source & flagged code

4 flagged

package.jsonView file

Lines 1-40json

2 "name": "mr-sliy",

3 "version": "2.4.5",

4 "description": "Mr.Sliy - 基于Tree-sitter与RAG的多语言代码优化智能体",

5 "main": "src/agent.js",

6 "bin": {

7 "mr-sliy": "src/agent.js",

8 "sliy": "src/agent.js"

9 },

10 "files": [

11 "src/",

12 "database/schema.sql",

13 "database/init.js",

14 "database/seed.js",

15 "scripts/",

16 "data/knowledge-export.json",

17 ".env.example"

18 ],

19 "scripts": {

20 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L20

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L20

21 "start": "node src/agent.js",

22 "agent": "node src/agent.js",

23 "server": "node src/index.js",

24 "dev": "nodemon src/agent.js",

25 "test": "jest",

26 "test:coverage": "jest --coverage",

27 "lint": "eslint src/",

28 "init": "node database/init.js",

29 "seed": "node database/seed.js",

30 "setup": "npm run init && npm run seed",

31 "download-wasm": "node scripts/download-tree-sitter.js"

32 },

33 "keywords": [

34 "ast",

35 "code-analysis",

36 "tree-sitter",

37 "rag",

38 "code-optimization",

39 "ai",

40 "agent",

database/init.jsView file

Lines 1-25javascript

1/**

2 * 数据库初始化脚本

3 * 创建SQLite数据库和所有表结构

4 */

6const Database = require('better-sqlite3');

7const path = require

src/services/vector/knowledgeBase.jsView file

Lines 233-273javascript

233 const conditions = [];

234 const params = [];

235

236 if (type) {

237 conditions.push('content_type = ?');

Source & flagged code

4 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

database/init.jsView file

5L6: const Database = require('better-sqlite3'); L7: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

database/init.jsView on unpkg · L5

Findings

1 High5 Medium6 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredatabase/init.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/services/vector/knowledgeBase.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings