registry / multi-agents-cli / 1.1.39

multi-agents-cli@1.1.39

Multi-agent workflow orchestration for Claude Code — isolated git worktrees, structured state tracking, autonomous task chaining

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 266 KB of source, external domains: claude.ai, github.com, pypi.org, registry.npmjs.org

Source & flagged code

4 flagged

core/workflow/reset.jsView file

Lines 1-42javascript

1#!/usr/bin/env node

3/**

4 * Multi-Agent Monorepo Template - Reset

5 * Full project wipe with 2-step confirmation.

6 *

7 * Deletes:

8 * - All worktrees

9 * - All agent branches (local + remote)

10 * - Remote GitHub repository

11 * - All project files

12 *

13 * Run with: npm run reset

14 */

16'use strict';

18const fs = require('fs');

19const path = require('path');

20const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

core/workflow/reset.jsView on unpkg · L19

22let prompts = null;

23try { prompts = require('prompts'); } catch { prompts = null; }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

core/workflow/reset.jsView on unpkg · L22

25// ── Self-relocate to repo root ────────────────────────────────────────────────

27const ROOT = path.join(__dirname, '..');

29// ── Colors ────────────────────────────────────────────────────────────────────

31const c = {

32 reset: '\x1b[0m',

33 bold: '\x1b[1m',

34 dim: '\x1b[2m',

35 green: '\x1b[32m',

36 yellow: '\x1b[33m',

37 red: '\x1b[31m',

38 cyan: '\x1b[36m',

39};

41const bold = (s) => `${c.bold}${s}${c.reset}`;

42const dim = (s) => `${c.dim}${s}${c.reset}`;

core/workflow/agent.jsView file

Lines 167-207javascript

167 }

168

169 return name;

170 } catch {

171 return null;

172 }

173};

174

175

176

177// ── Open new OS terminal with Claude Code CLI ───────────────────────────────

178const

Source & flagged code

4 flagged · loading source

core/workflow/reset.jsView file

19const path = require('path'); L20: const { execSync } = require('child_process'); L21:

High

Child Process

Package source references child process execution.

core/workflow/reset.jsView on unpkg · L19

22package = multi-agents-cli; repositoryIdentity = multi-agents; dependency = prompts L22: let prompts = null; L23: try { prompts = require('prompts'); } catch { prompts = null; } L24:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

core/workflow/reset.jsView on unpkg · L22

core/workflow/agent.jsView file

187} else { L188: execSync(termCmd + ' -- bash -c "cd \'' + worktreePath + '\' && ' + claudeCmd + '; exec bash" &', { stdio: 'pipe' }); L189: }

High

Shell

Package source references shell execution.

core/workflow/agent.jsView on unpkg · L187

657try { L658: execSync('npm install -g @anthropic-ai/claude-code', { stdio: 'pipe' }); L659: clearInterval(spin);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/workflow/agent.jsView on unpkg · L657

Findings

4 High3 Medium3 Low

HighChild Processcore/workflow/reset.js

HighShellcore/workflow/agent.js

HighCopied Package Dependency Bridgecore/workflow/reset.js

HighRuntime Package Installcore/workflow/agent.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

core/workflow/reset.jsView file

Lines 1-42javascript

1#!/usr/bin/env node

3/**

4 * Multi-Agent Monorepo Template - Reset

5 * Full project wipe with 2-step confirmation.

6 *

7 * Deletes:

8 * - All worktrees

9 * - All agent branches (local + remote)

10 * - Remote GitHub repository

11 * - All project files

12 *

13 * Run with: npm run reset

14 */

16'use strict';

18const fs = require('fs');

19const path = require('path');

20const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

core/workflow/reset.jsView on unpkg · L19

22let prompts = null;

23try { prompts = require('prompts'); } catch { prompts = null; }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

core/workflow/reset.jsView on unpkg · L22

25// ── Self-relocate to repo root ────────────────────────────────────────────────

27const ROOT = path.join(__dirname, '..');

31const c = {

32 reset: '\x1b[0m',

33 bold: '\x1b[1m',

34 dim: '\x1b[2m',

35 green: '\x1b[32m',

36 yellow: '\x1b[33m',

37 red: '\x1b[31m',

38 cyan: '\x1b[36m',

39};

41const bold = (s) => `${c.bold}${s}${c.reset}`;

42const dim = (s) => `${c.dim}${s}${c.reset}`;

core/workflow/agent.jsView file

Lines 167-207javascript

167 }

168

169 return name;

170 } catch {

171 return null;

172 }

173};

174

175

176

177// ── Open new OS terminal with Claude Code CLI ───────────────────────────────

178const

Lines 637-677javascript

637 console.log('\n');

638 console.log(bold(cyan(' Multi-Agent Monorepo Template')));

639 console.log(dim(` Task Launcher - ${config.projectName}\n`));

640 separator();

641

642 // ── Entry guards ──────────────────────────────────────────────────────────────

643

644 guards.validateConfig(config, ROOT);

645 const tracking = guards.loadTracking(ROOT, config);

646

647 // ── Claude Code CLI gate ───────────────────────────────────────────────────

648

649 const checkClaudeAuth = () => {

650 try { execSync('claude --version', { stdio: 'pipe' }); return true; } catch { return false; }

651 };

652

653 const installClaudeCode = () => {

654 const frames = ['⠋','⠙','⠹','⠸','⠼','⠴','⠦','⠧','⠇','⠏'];

655 let i = 0;

656 const spin = setInterval(() => process.stdout.write(`\r ${frames[i++ % frames.length]} Installing Claude Code CLI...`), 60);

657 try {

658 execSync('npm install -g @anthropic-ai/claude-code', { stdio: 'pipe' });

659 clearInterval(spin);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/workflow/agent.jsView on unpkg · L657

660 process.stdout.write('\r' + ' '.repeat(40) + '\r');

661 console.log(` ${green('✓')} Claude Code CLI installed\n`);

662 return true;

663 } catch {

664 clearInterval(spin);

665 process.stdout.write('\r' + ' '.repeat(40) + '\r');

666 console.log(` ${red('✖')} Installation failed - try manually: ${cyan('npm install -g @anthropic-ai/claude-code')}\n`);

667 return false;

668 }

669 };

670

671 const runClaudeLogin = () => {

672 const { spawnSync } = require('child_process');

673 console.log(`\n ${dim('Running claude login...')}\n`);

674 const result = spawnSync('claude', ['login'], { stdio: 'inherit' });

675 return result.status === 0;

676 };

677