registry / pks-nexus-cli / 1.0.16

pks-nexus-cli@1.0.16

Nexus is an advanced AI Command Line Developer Assistant capable of: - Multi-step reasoning loops with self-reflection. - Shell command execution & Web search. - Browser automation (using Playwright) & Desktop automation. - Git and Docker integration. - M

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 56 file(s), 231 KB of source, external domains: api.groq.com, api.ipify.org, api.openai.com, arveon.in, devtoolbox-api.devtoolbox-api.workers.dev, devtoolboxes.uk, example.com, integrate.api.nvidia.com, openrouter.ai, text.pollinations.ai, wttr.in, www.bing.com, www.google.com

Source & flagged code

4 flagged

dist/core/tools/execute-command.tool.jsView file

Lines 1-47javascript

1import { z } from 'zod';

2import { BaseTool } from './tool.interface.js';

3import { exec } from 'child_process';

4import path from 'path';

High

Child Process

Package source references child process execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L2

5const ExecuteCommandSchema = z.object({

6 command: z.string().optional().describe('The shell command line to run on the system.'),

7 cmd: z.union([z.string(), z.array(z.string())]).optional().describe('Alias for command (can be string or array of command parts).'),

8 workingDirectory: z.string().optional().describe('The working directory to run the command in.'),

9});

10export class ExecuteCommandTool extends BaseTool {

11 name = 'execute_command';

12 description = 'Executes a shell command on the host operating system.';

13 inputSchema = ExecuteCommandSchema;

14 async execute(args) {

15 let rawCommand = args.command || '';

16 if (!rawCommand && args.cmd) {

17 if (Array.isArray(args.cmd)) {

18 rawCommand = args.cmd.join(' ');

19 }

20 else {

21 rawCommand = args.cmd;

22 }

23 }

24 let command = rawCommand.trim();

25 if (!command) {

26 return 'Error: Missing required parameter "command" or "cmd".';

27 }

28 // Normalize shell execution prefixes (e.g. bash -lc "cmd", bash -c "cmd", or unquoted bash -lc cmd)

29 if (command.startsWith('bash -lc ') || command.startsWith('bash -c ') || command.startsWith('sh -c ') || command.startsWith('sh -lc ')) {

High

Shell

Package source references shell execution.

dist/core/tools/execute-command.tool.jsView on unpkg · L27

30 let actualCmd = '';

31 if (command.startsWith('bash -lc '))

32 actualCmd = command.slice(9).trim();

33 else if (command.startsWith('sh -lc '))

34 actualCmd = command.slice(7).trim();

35 else

36 actualCmd = command.slice(8).trim(); // bash -c or sh -c (8 chars)

37 if ((actualCmd.startsWith('"') && actualCmd.endsWith('"')) ||

38 (actualCmd.startsWith("'") && actualCmd.endsWith("'"))) {

39 actualCmd = actualCmd.slice(1, -1);

40 }

41 command = actualCmd;

42 }

43 // 1. Basic Safety/Destructive Keyword Check

44 const destructiveKeywords = ['rm -rf /', 'rm -rf *', 'format ', 'del /f /s /q'];

45 const isDestructive = destructiveKeywords.some((kw) => command.includes(kw));

46 if (isDestructive) {

47 return `Error: Command execution rejected. Blocked destructive keyword match in: '${command}'`;

dist/core/plugins/plugin.manager.jsView file

Lines 20-60javascript

20 this.pluginsPath = path.join(homeDir, '.nexus-node', 'plugins');

21 }

22 }

23 /**

24 * Scans plugin directory and dynamically loads all plugins.

25 */

26 async

dist/core/tools/browser.tool.jsView file

Lines 7-47javascript

7 action: z.enum(['navigate', 'click', 'fill', 'screenshot', 'extract_text']).describe('The action to perform in the browser.'),

8 url: z.string().optional().describe

Source & flagged code

4 flagged · loading source

dist/core/tools/execute-command.tool.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code