registry / shortcutxl / 0.3.66

shortcutxl@0.3.66

An AI agent that lives on your computer and has Excel superpowers. Made by the [Shortcut](https://shortcut.ai) team.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 25 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 812 file(s), 5.02 MB of source, external domains: 127.0.0.1, ai-gateway.vercel.sh, analytics-staging.shortcut.ai, analytics.shortcut.ai, api-staging.shortcut.ai, api.anthropic.com, api.cerebras.ai, api.github.com, api.groq.com, api.kimi.com, api.minimax.io, api.minimaxi.com, api.shortcut.ai, api.x.ai, api.z.ai, api2-staging.shortcut.ai, api2.shortcut.ai, app.shortcut.ai, auth-staging.shortcut.ai, auth.shortcut.ai, chat.qwen.ai, claude.ai, cloud.gitlab.com, console.anthropic.com, dashscope.aliyuncs.com, distro.ibiblio.org, dotenvx.com, feross.org, generativelanguage.googleapis.com, git-scm.com, github.com, gitlab.com, jimmy.warting.se, mcp.notion.com, opencode.ai, openrouter.ai, registry.npmjs.org, router.huggingface.co, vestauth.com, www.apache.org, www.googleapis.com

Oversized source lightweight scan

dist/cli.js22.5 MB file, sampled 256 KB

FilesystemNetworkChildProcessEnvironmentVarsShellDynamicRequireHighEntropyStringsUrlStringsdotenvx.comfeross.orggithub.comjimmy.warting.sevestauth.comwww.apache.org

Source & flagged code

16 flagged

xll/python/Lib/site-packages/httpx/_urls.pyView file

Lines 316-356python

316 # a scheme and hostname to which connections should be made.

317 return bool(self._uri_reference.scheme and self._uri_reference.host)

318

319 @property

320 def is_relative_url(self) -> bool:

321 """

322 Return `False` for absolute URLs such as 'http://example.com/path',

323 and `True` for relative URLs such as '/path'.

324 """

325 return not self.is_absolute_url

326

327 def copy_with(self, **kwargs: typing.Any) -> URL:

328 """

329 Copy this URL, returning a new URL with some components altered.

330 Accepts the same set of parameters as the components that are made

331 available via properties on the `URL` class.

332

333 For example:

334

335 url = httpx.URL("https://www.example.com").copy_with(

336 username="jo@gmail.com", password="a secret"

Medium

Secret Pattern

Package contains a possible secret pattern.

xll/python/Lib/site-packages/httpx/_urls.pyView on unpkg · L336

337 )

338 assert url == "https://jo%40email.com:a%20secret@www.example.com"

339 """

340 return URL(self, **kwargs)

341

342 def copy_set_param(self, key: str, value: typing.Any = None) -> URL:

343 return self.copy_with(params=self.params.set(key, value))

344

345 def copy_add_param(self, key: str, value: typing.Any = None) -> URL:

346 return self.copy_with(params=self.params.add(key, value))

347

348 def copy_remove_param(self, key: str) -> URL:

349 return self.copy_with(params=self.params.remove(key))

350

351 def copy_merge_params(self, params: QueryParamTypes) -> URL:

352 return self.copy_with(params=self.params.merge(params))

353

354 def join(self, url: URL | str) -> URL:

355 """

356 Return an absolute URL, using this URL as the base.

agent-docs/examples/extensions/doom-overlay/doom-engine.tsView file

Lines 50-90typescript

50 return this._height;

51 }

53 async init(): Promise<void> {

54 // Locate WASM build

55 const __dirname = dirname(fileURLToPath(import.meta.url));

dist/app/extensions/loader.jsView file

Lines 1-32javascript

1/**

2 * Extension loader - loads TypeScript extension modules using jiti.

3 */

4import { createJiti } from 'jiti';

5import * as fs from 'node:fs';

6import { createRequire } from 'node:module';

7import

dist/app/shared/tools/execute-code/mog.jsView file

Lines 1-21javascript

1/**

2 * MOG execute_code provider — execute TypeScript code against a headless spreadsheet engine.

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/app/shared/tools/execute-code/mog.jsView on unpkg · L1

3 *

4 * Drop-in replacement for the COM execute_code provider. Same tool name,

5 * same schema shape, but runs code in-process against @mog-sdk/sdk's

6 * workbook via a VM sandbox.

7 */

8import { buildSandbox, errorCheck, getDirtyCellSummary, MutationTracker } from '@shortcut/mog-sandbox-runtime'

dist/tui/render-trace.jsView file

Lines 194-234javascript

194 };

195}

196

197export function sanitizeOverlayOptions(options) {

198 if (!options) return undefined;

199 const sanitized = {};

200 for

xll/ShortcutXL.xllView file

•path = xll/ShortcutXL.xll kind = native_binary sizeBytes = 83456 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

xll/ShortcutXL.xllView on unpkg

xll/python/Scripts/pywin32_postinstall.pyView file

•path = xll/python/Scripts/pywin32_postinstall.py kind = build_helper sizeBytes = 25736 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

xll/python/Scripts/pywin32_postinstall.pyView on unpkg

xll/python/python313.zipView file

•path = xll/python/python313.zip kind = compressed_blob sizeBytes = 3803666 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

xll/python/python313.zipView on unpkg

•path = xll/python/python313.zip kind = nested_archive_needs_inspection sizeBytes = 3803666 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

xll/python/python313.zipView on unpkg

user-docs/dist/shortcutxl-docs.pdfView file

•path = user-docs/dist/shortcutxl-docs.pdf kind = high_entropy_blob sizeBytes = 716277 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

user-docs/dist/shortcutxl-docs.pdfView on unpkg

xll/python/Lib/site-packages/win32comext/axscript/test/testHost4Dbg.pyView file

•path = xll/python/Lib/site-[redacted].py kind = payload_in_excluded_dir sizeBytes = 2735 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

xll/python/Lib/site-packages/win32comext/axscript/test/testHost4Dbg.pyView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 23577941 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 23577941 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

dist/app/providers/shortcut-llm-proxy-client.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = shortcutxl@0.3.65 matchedIdentity = npm:c2hvcnRjdXR4bA:0.3.65 similarity = 0.942 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/app/providers/shortcut-llm-proxy-client.jsView on unpkg

xll/python/Lib/site-packages/adodbapi/test/adodbapitestconfig.pyView file

Lines 142-182python

142 "driver": "MySQL ODBC 5.1 Driver",

143 } # or _driver="MySQL ODBC 3.51 Driver

144 c["macro_is64bit"] = [

145 "provider",

146 "Provider=MSDASQL;",

147 ] # turn on the 64 bit ODBC adapter only if needed

148 cs = (

149 "%(provider)sDriver={%(driver)s};Server=%(host)s;Port=3330;"

150 + "Database=%(database)s;user=%(user)s;password=%(password)s;Option=3;"

151 )

152 print(" ...Testing MySql login to {}...".format(c["host"]))

xll/python/Lib/site-packages/adodbapi/test/test_adodbapi_dbapi20.pyView file

Lines 45-85python

45conn_kws["password"] = "Sq1234567"

46# macro definition for keyword "security" using macro "auto_security"

47conn_kws["macro_auto_security"] = "security"

49if host is None:

50 conn_kws["macro_getnode"] = ["host", instance]

51else:

52 conn_kws["host"] = host

54conn_kws["provider"] = (

55 "Provider=MSOLEDBSQL;DataTypeCompatibility=80;MARS Connection=True;"

56)

Source & flagged code

16 flagged · loading source

xll/python/Lib/site-packages/httpx/_urls.pyView file

336patternName = generic_password severity = medium line = 336 matchedText = username...ret"

Medium

Secret Pattern

Package contains a possible secret pattern.

xll/python/Lib/site-packages/httpx/_urls.pyView on unpkg · L336

agent-docs/examples/extensions/doom-overlay/doom-engine.tsView file

70const nativeRequire = createRequire(doomJsPath); L71: const moduleFunc = new Function( L72: 'module',

Low

Eval

Package source references a known benign dynamic code generation pattern.

agent-docs/examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L70

dist/app/extensions/loader.jsView file

12import { createEventBus } from './event-bus.js'; L13: const require = createRequire(import.meta.url); L14: let _aliases = null;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/app/extensions/loader.jsView on unpkg · L12

dist/app/shared/tools/execute-code/mog.jsView file

1/** L2: * MOG execute_code provider — execute TypeScript code against a headless spreadsheet engine.

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/app/shared/tools/execute-code/mog.jsView on unpkg · L1

dist/tui/render-trace.jsView file

214pid: process.pid, L215: cwd: process.cwd(), L216: platform: process.platform, L217: node: process.version,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/tui/render-trace.jsView on unpkg · L214

xll/ShortcutXL.xllView file

•path = xll/ShortcutXL.xll kind = native_binary sizeBytes = 83456 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

xll/ShortcutXL.xllView on unpkg

xll/python/Scripts/pywin32_postinstall.pyView file

•path = xll/python/Scripts/pywin32_postinstall.py kind = build_helper sizeBytes = 25736 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

xll/python/Scripts/pywin32_postinstall.pyView on unpkg

xll/python/python313.zipView file

•path = xll/python/python313.zip kind = compressed_blob sizeBytes = 3803666 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

xll/python/python313.zipView on unpkg

•path = xll/python/python313.zip kind = nested_archive_needs_inspection sizeBytes = 3803666 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

xll/python/python313.zipView on unpkg

user-docs/dist/shortcutxl-docs.pdfView file

•path = user-docs/dist/shortcutxl-docs.pdf kind = high_entropy_blob sizeBytes = 716277 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

user-docs/dist/shortcutxl-docs.pdfView on unpkg

xll/python/Lib/site-packages/win32comext/axscript/test/testHost4Dbg.pyView file

•path = xll/python/Lib/site-[redacted].py kind = payload_in_excluded_dir sizeBytes = 2735 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

xll/python/Lib/site-packages/win32comext/axscript/test/testHost4Dbg.pyView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 23577941 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 23577941 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

dist/app/providers/shortcut-llm-proxy-client.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/app/providers/shortcut-llm-proxy-client.jsView on unpkg

xll/python/Lib/site-packages/adodbapi/test/adodbapitestconfig.pyView file

162patternName = generic_password severity = medium line = 162 matchedText = _passwor...678"

Medium

Secret Pattern

Hardcoded password in xll/python/Lib/site-packages/adodbapi/test/adodbapitestconfig.py

xll/python/Lib/site-packages/adodbapi/test/adodbapitestconfig.pyView on unpkg · L162

xll/python/Lib/site-packages/adodbapi/test/test_adodbapi_dbapi20.pyView file

65patternName = generic_password severity = medium line = 65 matchedText = _passwor...678"

Medium

Secret Pattern

Hardcoded password in xll/python/Lib/site-packages/adodbapi/test/test_adodbapi_dbapi20.py

xll/python/Lib/site-packages/adodbapi/test/test_adodbapi_dbapi20.pyView on unpkg · L65

Findings

4 High12 Medium9 Low

HighShips High Entropy Blobuser-docs/dist/shortcutxl-docs.pdf

HighPayload In Excluded Dirxll/python/Lib/site-packages/win32comext/axscript/test/testHost4Dbg.py

HighOversized Source Filedist/cli.js

HighPrevious Version Dangerous Deltadist/app/providers/shortcut-llm-proxy-client.js

MediumSecret Patternxll/python/Lib/site-packages/httpx/_urls.py

MediumDynamic Requiredist/app/extensions/loader.js

MediumUnsafe Vm Contextdist/app/shared/tools/execute-code/mog.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryxll/ShortcutXL.xll

MediumShips Build Helperxll/python/Scripts/pywin32_postinstall.py

MediumShips Compressed Blobxll/python/python313.zip

MediumOversized Cli Entrypointdist/cli.js

MediumStructural Risk Force Deep Review

MediumSecret Patternxll/python/Lib/site-packages/adodbapi/test/adodbapitestconfig.py

MediumSecret Patternxll/python/Lib/site-packages/adodbapi/test/test_adodbapi_dbapi20.py

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalagent-docs/examples/extensions/doom-overlay/doom-engine.ts

LowWeak Cryptodist/tui/render-trace.js

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionxll/python/python313.zip

Source & flagged code

16 flagged

xll/python/Lib/site-packages/httpx/_urls.pyView file

Lines 316-356python

316 # a scheme and hostname to which connections should be made.

317 return bool(self._uri_reference.scheme and self._uri_reference.host)

318

319 @property

320 def is_relative_url(self) -> bool:

321 """

322 Return `False` for absolute URLs such as 'http://example.com/path',

323 and `True` for relative URLs such as '/path'.

324 """

325 return not self.is_absolute_url

326

327 def copy_with(self, **kwargs: typing.Any) -> URL:

328 """

329 Copy this URL, returning a new URL with some components altered.

330 Accepts the same set of parameters as the components that are made

331 available via properties on the `URL` class.

332

333 For example:

334

335 url = httpx.URL("https://www.example.com").copy_with(

336 username="jo@gmail.com", password="a secret"

Medium

Secret Pattern

Package contains a possible secret pattern.

xll/python/Lib/site-packages/httpx/_urls.pyView on unpkg · L336

337 )

338 assert url == "https://jo%40email.com:a%20secret@www.example.com"

339 """

340 return URL(self, **kwargs)

341

342 def copy_set_param(self, key: str, value: typing.Any = None) -> URL:

343 return self.copy_with(params=self.params.set(key, value))

344

345 def copy_add_param(self, key: str, value: typing.Any = None) -> URL:

346 return self.copy_with(params=self.params.add(key, value))

347

348 def copy_remove_param(self, key: str) -> URL:

349 return self.copy_with(params=self.params.remove(key))

350

351 def copy_merge_params(self, params: QueryParamTypes) -> URL:

352 return self.copy_with(params=self.params.merge(params))

353

354 def join(self, url: URL | str) -> URL:

355 """

356 Return an absolute URL, using this URL as the base.

agent-docs/examples/extensions/doom-overlay/doom-engine.tsView file

Lines 50-90typescript

50 return this._height;

51 }

53 async init(): Promise<void> {

54 // Locate WASM build

55 const __dirname = dirname(fileURLToPath(import.meta.url));

dist/app/extensions/loader.jsView file

Lines 1-32javascript

1/**

2 * Extension loader - loads TypeScript extension modules using jiti.

3 */

4import { createJiti } from 'jiti';

5import * as fs from 'node:fs';

6import { createRequire } from 'node:module';

7import

dist/app/shared/tools/execute-code/mog.jsView file

Lines 1-21javascript

1/**

2 * MOG execute_code provider — execute TypeScript code against a headless spreadsheet engine.

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/app/shared/tools/execute-code/mog.jsView on unpkg · L1

3 *

4 * Drop-in replacement for the COM execute_code provider. Same tool name,

5 * same schema shape, but runs code in-process against @mog-sdk/sdk's

6 * workbook via a VM sandbox.

7 */

8import { buildSandbox, errorCheck, getDirtyCellSummary, MutationTracker } from '@shortcut/mog-sandbox-runtime'

dist/tui/render-trace.jsView file

Lines 194-234javascript

194 };

195}

196

197export function sanitizeOverlayOptions(options) {

198 if (!options) return undefined;

199 const sanitized = {};

200 for

xll/ShortcutXL.xllView file

•path = xll/ShortcutXL.xll kind = native_binary sizeBytes = 83456 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

xll/ShortcutXL.xllView on unpkg

xll/python/Scripts/pywin32_postinstall.pyView file

•path = xll/python/Scripts/pywin32_postinstall.py kind = build_helper sizeBytes = 25736 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

xll/python/Scripts/pywin32_postinstall.pyView on unpkg

xll/python/python313.zipView file

•path = xll/python/python313.zip kind = compressed_blob sizeBytes = 3803666 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

xll/python/python313.zipView on unpkg

•path = xll/python/python313.zip kind = nested_archive_needs_inspection sizeBytes = 3803666 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

xll/python/python313.zipView on unpkg

user-docs/dist/shortcutxl-docs.pdfView file

•path = user-docs/dist/shortcutxl-docs.pdf kind = high_entropy_blob sizeBytes = 716277 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

user-docs/dist/shortcutxl-docs.pdfView on unpkg

xll/python/Lib/site-packages/win32comext/axscript/test/testHost4Dbg.pyView file

•path = xll/python/Lib/site-[redacted].py kind = payload_in_excluded_dir sizeBytes = 2735 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

xll/python/Lib/site-packages/win32comext/axscript/test/testHost4Dbg.pyView on unpkg

dist/cli.jsView file

•path = dist/cli.js kind = oversized_source_file sizeBytes = 23577941 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/cli.jsView on unpkg

•path = dist/cli.js kind = oversized_cli_entrypoint sizeBytes = 23577941 magicHex = [redacted]

Medium

Oversized Cli Entrypoint

Package contains an oversized executable-looking CLI entrypoint.

dist/cli.jsView on unpkg

dist/app/providers/shortcut-llm-proxy-client.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/app/providers/shortcut-llm-proxy-client.jsView on unpkg

xll/python/Lib/site-packages/adodbapi/test/adodbapitestconfig.pyView file

Lines 142-182python

142 "driver": "MySQL ODBC 5.1 Driver",

143 } # or _driver="MySQL ODBC 3.51 Driver

144 c["macro_is64bit"] = [

145 "provider",

146 "Provider=MSDASQL;",

147 ] # turn on the 64 bit ODBC adapter only if needed

148 cs = (

149 "%(provider)sDriver={%(driver)s};Server=%(host)s;Port=3330;"

150 + "Database=%(database)s;user=%(user)s;password=%(password)s;Option=3;"

151 )

152 print(" ...Testing MySql login to {}...".format(c["host"]))

xll/python/Lib/site-packages/adodbapi/test/test_adodbapi_dbapi20.pyView file

Lines 45-85python

45conn_kws["password"] = "Sq1234567"

46# macro definition for keyword "security" using macro "auto_security"

47conn_kws["macro_auto_security"] = "security"

49if host is None:

50 conn_kws["macro_getnode"] = ["host", instance]

51else:

52 conn_kws["host"] = host

54conn_kws["provider"] = (

55 "Provider=MSOLEDBSQL;DataTypeCompatibility=80;MARS Connection=True;"

56)