registry  /  proea-studio  /  0.8.0

proea-studio@0.8.0

ProEA Agent Studio client — license-gated MCP + CLI that lets Claude Code/Codex drive TradeLens, the Pine line, and Evolution Lab. Requires an active Agent Studio subscription (https://proea.app).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedObfuscatedUrlStrings
Manifest
NoLicense
scanned 3 file(s), 2.70 MB of source, external domains: 127.0.0.1, dashboard.internal, github.com, json-schema.org, nodejs.org, proea.app, python.org, raw.githubusercontent.com, react.dev, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.safaribooksonline.com, www.w3.org

Source & flagged code

4 flagged · loading source
dist-bin/proea-studio-mcp.jsView file
31634// [redacted].ts L31635: import { spawn as spawn2 } from "child_process"; L31636: import { statSync, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, rmSync as rmSync2 } from "fs";
High
Child Process

Package source references child process execution.

dist-bin/proea-studio-mcp.jsView on unpkg · L31634
1225Cross-file remote execution chain: dist-bin/proea-studio-mcp.js spawns dist-bin/proea-studio.js; helper contains network access plus dynamic code execution. L1225: // validation function arguments L1226: data: new codegen_1.Name("data"), L1227: // data passed to validation function ... L2252: id = normalizeId2(id); L2253: return resolver.resolve(baseId, id); L2254: } ... L3115: for (i = 0; i < input.length; i++) { L3116: code = input[i].charCodeAt(0); L3117: if (code === 48) { ... L22972: var StdioServerTransport = class { L22973: constructor(_stdin = process3.stdin, _stdout = process3.stdout) { L22974: this._stdin = _stdin;
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist-bin/proea-studio-mcp.jsView on unpkg · L1225
2941sourceCode = this.opts.code.process(sourceCode, sch); L2942: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2943: const validate = makeValidate(this, this.scope.get());
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist-bin/proea-studio-mcp.jsView on unpkg · L2941
dist-bin/proea-studio.jsView file
108if (!/ENOENT|EINVAL/i.test(msg)) throw e; L109: const result = await runner.run(cli, argv.map(quoteForShell), { shell: true }); L110: if (result.code !== 0 && (result.code === CMD_NOT_FOUND_EXIT || NOT_RECOGNIZED.test(result.stderr + result.stdout))) {
High
Shell

Package source references shell execution.

dist-bin/proea-studio.jsView on unpkg · L108

Findings

3 High3 Medium6 Low
HighChild Processdist-bin/proea-studio-mcp.js
HighShelldist-bin/proea-studio.js
HighCross File Remote Execution Contextdist-bin/proea-studio-mcp.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowEvaldist-bin/proea-studio-mcp.js
LowFilesystem
LowObfuscated
LowHigh Entropy Strings
LowUrl Strings
LowNo License