registry / multi-agents-cli / 1.1.71

multi-agents-cli@1.1.71

Multi-agent workflow orchestration for Claude Code — isolated git worktrees, structured state tracking, autonomous task chaining

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 292 KB of source, external domains: claude.ai, github.com, pypi.org, registry.npmjs.org

Source & flagged code

4 flagged

core/workflow/reset.jsView file

Lines 1-42javascript

1#!/usr/bin/env node

3/**

4 * Multi-Agent Monorepo Template - Reset

5 * Full project wipe with 2-step confirmation.

6 *

7 * Deletes:

8 * - All worktrees

9 * - All agent branches (local + remote)

10 * - Remote GitHub repository

11 * - All project files

12 *

13 * Run with: npm run reset

14 */

16'use strict';

18const fs = require('fs');

19const path = require('path');

20const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

core/workflow/reset.jsView on unpkg · L19

22let prompts = null;

23try { prompts = require('prompts'); } catch { prompts = null; }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

core/workflow/reset.jsView on unpkg · L22

25// ── Self-relocate to repo root ────────────────────────────────────────────────

27const ROOT = (() => {

28 try {

29 const common = execSync('git rev-parse --git-common-dir', { stdio: 'pipe' }).toString().trim();

30 return common.endsWith('/.git') ? common.slice(0, -5) : require('path').resolve(common, '..');

31 } catch {

32 console.error(' Not inside a git repository.\n');

33 process.exit(1);

34 }

35})();

37// ── Colors ────────────────────────────────────────────────────────────────────

39const c = {

40 reset: '\x1b[0m',

41 bold: '\x1b[1m',

42 dim: '\x1b[2m',

core/workflow/agent.jsView file

Lines 176-216javascript

176

177 return name;

178 } catch {

179 return null;

180 }

181};

182

183

184

185// ── Open new OS terminal with Claude Code CLI ───────────────────────────────

186const openTerminal

Source & flagged code

4 flagged · loading source

core/workflow/reset.jsView file

19const path = require('path'); L20: const { execSync } = require('child_process'); L21:

High

Child Process

Package source references child process execution.

core/workflow/reset.jsView on unpkg · L19

22package = multi-agents-cli; repositoryIdentity = multi-agents; dependency = prompts L22: let prompts = null; L23: try { prompts = require('prompts'); } catch { prompts = null; } L24:

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

core/workflow/reset.jsView on unpkg · L22

core/workflow/agent.jsView file

196} else { L197: execSync(termCmd + ' -- bash -c "cd \'' + worktreePath + '\' && ' + claudeCmd + '; exec bash" &', { stdio: 'pipe' }); L198: }

High

Shell

Package source references shell execution.

core/workflow/agent.jsView on unpkg · L196

667try { L668: execSync('npm install -g @anthropic-ai/claude-code', { stdio: 'pipe' }); L669: clearInterval(spin);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/workflow/agent.jsView on unpkg · L667

Findings

4 High3 Medium3 Low

HighChild Processcore/workflow/reset.js

HighShellcore/workflow/agent.js

HighCopied Package Dependency Bridgecore/workflow/reset.js

HighRuntime Package Installcore/workflow/agent.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

core/workflow/reset.jsView file

Lines 1-42javascript

1#!/usr/bin/env node

3/**

4 * Multi-Agent Monorepo Template - Reset

5 * Full project wipe with 2-step confirmation.

6 *

7 * Deletes:

8 * - All worktrees

9 * - All agent branches (local + remote)

10 * - Remote GitHub repository

11 * - All project files

12 *

13 * Run with: npm run reset

14 */

16'use strict';

18const fs = require('fs');

19const path = require('path');

20const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

core/workflow/reset.jsView on unpkg · L19

22let prompts = null;

23try { prompts = require('prompts'); } catch { prompts = null; }

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

core/workflow/reset.jsView on unpkg · L22

25// ── Self-relocate to repo root ────────────────────────────────────────────────

27const ROOT = (() => {

28 try {

29 const common = execSync('git rev-parse --git-common-dir', { stdio: 'pipe' }).toString().trim();

30 return common.endsWith('/.git') ? common.slice(0, -5) : require('path').resolve(common, '..');

31 } catch {

32 console.error(' Not inside a git repository.\n');

33 process.exit(1);

34 }

35})();

39const c = {

40 reset: '\x1b[0m',

41 bold: '\x1b[1m',

42 dim: '\x1b[2m',

core/workflow/agent.jsView file

Lines 176-216javascript

176

177 return name;

178 } catch {

179 return null;

180 }

181};

182

183

184

185// ── Open new OS terminal with Claude Code CLI ───────────────────────────────

186const openTerminal

Lines 647-687javascript

647 console.log('\n');

648 console.log(bold(cyan(' Multi-Agent Monorepo Template')));

649 console.log(dim(` Task Launcher - ${config.projectName}\n`));

650 separator();

651

652 // ── Entry guards ──────────────────────────────────────────────────────────────

653

654 guards.validateConfig(config, ROOT);

655 const tracking = guards.loadTracking(ROOT, config);

656

657 // ── Claude Code CLI gate ───────────────────────────────────────────────────

658

659 const checkClaudeAuth = () => {

660 try { execSync('claude --version', { stdio: 'pipe' }); return true; } catch { return false; }

661 };

662

663 const installClaudeCode = () => {

664 const frames = ['⠋','⠙','⠹','⠸','⠼','⠴','⠦','⠧','⠇','⠏'];

665 let i = 0;

666 const spin = setInterval(() => process.stdout.write(`\r ${frames[i++ % frames.length]} Installing Claude Code CLI...`), 60);

667 try {

668 execSync('npm install -g @anthropic-ai/claude-code', { stdio: 'pipe' });

669 clearInterval(spin);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

core/workflow/agent.jsView on unpkg · L667

670 process.stdout.write('\r' + ' '.repeat(40) + '\r');

671 console.log(` ${green('✓')} Claude Code CLI installed\n`);

672 return true;

673 } catch {

674 clearInterval(spin);

675 process.stdout.write('\r' + ' '.repeat(40) + '\r');

676 console.log(` ${red('✖')} Installation failed - try manually: ${cyan('npm install -g @anthropic-ai/claude-code')}\n`);

677 return false;

678 }

679 };

680

681 const runClaudeLogin = () => {

682 const { spawnSync } = require('child_process');

683 console.log(`\n ${dim('Running claude login...')}\n`);

684 const result = spawnSync('claude', ['login'], { stdio: 'inherit' });

685 return result.status === 0;

686 };

687