registry / persnally / 2.7.0

persnally@2.7.0

Your own context engine — local-first, across every AI. So every AI finally knows you.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 158 KB of source, external domains: 127.0.0.1, www.apple.com

Source & flagged code

4 flagged

build/src/importers/git.jsView file

Lines 1-25javascript

1/**

2 * Git history importer — fully deterministic, no LLM, works offline.

3 * Repos become project topics; manifest dependencies become skill signals.

4 * Carries forward the v1 skill_analyzer's framework-detection approach.

5 */

6import { execFileSync } from "node:child_process";

7import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

build/src/importers/git.jsView on unpkg · L5

8import { basename, join } from "node:path";

9import { newEvent, uuidv7 } from "../events.js";

10const FRAMEWORKS = {

11 // js/ts

12 react: "frontend", next: "frontend", vue: "frontend", svelte: "frontend", "solid-js": "frontend",

13 tailwindcss: "frontend", express: "backend", fastify: "backend", hono: "backend", nestjs: "backend",

14 "better-sqlite3": "backend", prisma: "backend", drizzle: "backend", zod: "backend",

15 "@modelcontextprotocol/sdk": "ai_ml", "@anthropic-ai/sdk": "ai_ml", openai: "ai_ml", langchain: "ai_ml",

16 electron: "desktop", "react-native": "mobile", expo: "mobile",

17 // python

18 fastapi: "backend", django: "backend", flask: "backend", sqlalchemy: "backend", pydantic: "backend",

19 torch: "ai_ml", tensorflow: "ai_ml", transformers: "ai_ml", anthropic: "ai_ml", pandas: "data",

20 numpy: "data", "scikit-learn": "data",

21 // other ecosystems (manifest presence)

22 cargo: "systems", "go.mod": "backend",

23};

24/** Pure: manifest filename → content → detected framework names. */

25export function detectFrameworks(manifests) {

build/src/lifecycle.jsView file

Lines 1-66javascript

1/**

2 * Daemon lifecycle — pidfile, detached start/stop, and macOS launchd autostart.

3 * The pidfile is advisory: a stale one (dead pid) is detected and cleaned up.

4 */

5import { execFileSync, spawn } from "node:child_process";

6import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";

7import { homedir } from "node:os";

Source & flagged code

4 flagged · loading source

build/src/importers/git.jsView file

5*/ L6: import { execFileSync } from "node:child_process"; L7: import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

build/src/importers/git.jsView on unpkg · L5

build/src/lifecycle.jsView file

46const log = openSync(LOG_FILE, "a"); L47: const child = spawn(process.execPath, [cliPath, "serve", "--port", String(port)], { L48: detached: true, L49: stdio: ["ignore", log, log], L50: env: process.env, L51: }); ... L56: try { L57: const r = await fetch(`http://127.0.0.1:${port}/health`); L58: if (r.ok)

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

build/src/lifecycle.jsView on unpkg · L46

4*/ L5: import { execFileSync, spawn } from "node:child_process"; L6: import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs"; ... L12: const PLIST_LABEL = "com.persnally.daemon"; L13: const PLIST_PATH = join(homedir(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`); L14: function alive(pid) { ... L49: stdio: ["ignore", log, log], L50: env: process.env, L51: }); ... L56: try { L57: const r = await fetch(`http://127.0.0.1:${port}/health`); L58: if (r.ok)

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

build/src/lifecycle.jsView on unpkg · L4

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

build/src/lifecycle.jsView on unpkg · L4

Findings

4 High4 Medium5 Low

HighChild Processbuild/src/importers/git.js

HighShell

HighSame File Env Network Executionbuild/src/lifecycle.js

HighSandbox Evasion Gated Capabilitybuild/src/lifecycle.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebuild/src/lifecycle.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

build/src/importers/git.jsView file

Lines 1-25javascript

1/**

2 * Git history importer — fully deterministic, no LLM, works offline.

3 * Repos become project topics; manifest dependencies become skill signals.

4 * Carries forward the v1 skill_analyzer's framework-detection approach.

5 */

6import { execFileSync } from "node:child_process";

7import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

build/src/importers/git.jsView on unpkg · L5

8import { basename, join } from "node:path";

9import { newEvent, uuidv7 } from "../events.js";

10const FRAMEWORKS = {

11 // js/ts

12 react: "frontend", next: "frontend", vue: "frontend", svelte: "frontend", "solid-js": "frontend",

13 tailwindcss: "frontend", express: "backend", fastify: "backend", hono: "backend", nestjs: "backend",

14 "better-sqlite3": "backend", prisma: "backend", drizzle: "backend", zod: "backend",

15 "@modelcontextprotocol/sdk": "ai_ml", "@anthropic-ai/sdk": "ai_ml", openai: "ai_ml", langchain: "ai_ml",

16 electron: "desktop", "react-native": "mobile", expo: "mobile",

17 // python

18 fastapi: "backend", django: "backend", flask: "backend", sqlalchemy: "backend", pydantic: "backend",

19 torch: "ai_ml", tensorflow: "ai_ml", transformers: "ai_ml", anthropic: "ai_ml", pandas: "data",

20 numpy: "data", "scikit-learn": "data",

21 // other ecosystems (manifest presence)

22 cargo: "systems", "go.mod": "backend",

23};

24/** Pure: manifest filename → content → detected framework names. */

25export function detectFrameworks(manifests) {

build/src/lifecycle.jsView file

Lines 1-66javascript

1/**

2 * Daemon lifecycle — pidfile, detached start/stop, and macOS launchd autostart.

3 * The pidfile is advisory: a stale one (dead pid) is detected and cleaned up.

4 */

5import { execFileSync, spawn } from "node:child_process";

6import { closeSync, existsSync, mkdirSync, openSync, readFileSync, rmSync, unlinkSync, writeFileSync } from "node:fs";

7import { homedir } from "node:os";