registry / openrp-toolkit / 1.1.0

openrp-toolkit@1.1.0

Model Context Protocol (MCP) Server and AI Agent Skill Suite for OpenRP.ai

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 8 file(s), 116 KB of source, external domains: github.com, openrp.ai, uixnaquqjhzcctyfoapf.supabase.co

Source & flagged code

2 flagged

bin/validator.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * OpenRP Behavior Graph Static Analyzer & Schema Validator

5 *

6 * Validates Behavior Graph definitions against OpenRP runtime rules:

7 * 1. Single Root Trigger Rule (exactly 1 event node)

8 * 2. ReactFlow Edge Port Handle Naming Standard (xy-edge__...)

9 * 3. Topological Continuity & Dangling Branch Detection

10 * 4. Control Flow Pairing (Split/Sync parity, Repeat Until loop closure)

11 * 5. JEXL Expression Syntax & Illegal Regex Detection

12 * 6. Variable Store Schema Validation ($template key & $expression value)

13 */

15const fs = require('fs');

16const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/validator.jsView on unpkg · L14

18function validateBehaviorGraph(graph) {

19 const issues = { errors: [], warnings: [], info: [] };

21 if (!graph || typeof graph !== 'object') {

22 issues.errors.push('Invalid behavior payload: graph must be an object.');

23 return issues;

24 }

26 const nodes = Array.isArray(graph.nodes) ? graph.nodes : [];

27 const edges = Array.isArray(graph.edges) ? graph.edges : [];

29 // 1. Single Root Trigger Rule

30 const eventNodes = nodes.filter(n => n.type && n.type.startsWith('events/'));

31 if (eventNodes.length === 0) {

32 issues.errors.push('No event trigger node found (e.g. events/chat_message, events/cron). Graph will never trigger.');

33 } else if (eventNodes.length > 1) {

34 issues.errors.push(`Multiple event trigger nodes found (${eventNodes.map(n => n.id).join(', ')}). A behavior must have exactly 1 event trigger.`);

•matchType = previous_version_dangerous_delta matchedPackage = openrp-toolkit@1.0.1 matchedIdentity = npm:b3BlbnJwLXRvb2xraXQ:1.0.1 similarity = 1.000 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/validator.jsView on unpkg

Source & flagged code

2 flagged · loading source

bin/validator.jsView file

openrp-toolkit@1.1.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code