registry / squads-cli / 0.9.0

squads-cli@0.9.0

Your AI workforce. Every user gets an AI manager that runs their team — finance, marketing, engineering, operations — for the cost of API calls.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 82 file(s), 1.07 MB of source, external domains: agents-squads.com, api-staging.agents-squads.com, api.agents-squads.com, api.github.com, api.npmjs.org, api.z.ai, cli.github.com, console-staging.agents-squads.com, console.agents-squads.com, github.com, mistral.ai, nodejs.org, python.org, slack.com, us.cloud.langfuse.com, www.docker.com, www.google-analytics.com, x.com

Source & flagged code

7 flagged

dist/progress-5HD7BZ4Y.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2import {

3 RESET,

4 bold,

5 box,

6 colors,

7 gradient,

8 icons,

9 padEnd,

10 truncate,

11 writeLine

12} from "./chunk-M5FXNY6Y.js";

13import "./chunk-K62RGAJ4.js";

14import {

15 findMemoryDir

16} from "./chunk-ZTQ7ISUR.js";

17import "./chunk-7OCVIDC7.js";

19// src/commands/progress.ts

20import { execSync } from "child_process";

21import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/progress-5HD7BZ4Y.jsView on unpkg · L19

22import { join } from "path";

23function getTasksFilePath() {

24 const memoryDir = findMemoryDir();

25 if (!memoryDir) {

26 const cwd = process.cwd();

27 const agentsDir = join(cwd, ".agents");

28 if (!existsSync(agentsDir)) {

29 mkdirSync(agentsDir, { recursive: true });

30 }

31 return join(agentsDir, "tasks.json");

32 }

33 return join(memoryDir, "..", "tasks.json");

34}

35function loadTasks() {

36 const tasksPath = getTasksFilePath();

37 if (existsSync(tasksPath)) {

38 try {

39 return JSON.parse(readFileSync(tasksPath, "utf-8"));

dist/chunk-VXJNY4BC.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import {

3 RESET,

4 colors,

5 writeLine

6} from "./chunk-M5FXNY6Y.js";

8// src/lib/git.ts

9import { execSync, exec } from "child_process";

10import { existsSync } from

dist/chunk-ZTQ7ISUR.jsView file

Lines 77-117javascript

77 if (!gotLock) {

78 return null;

79 }

80 return async () => {

81 releaseFileLock(fileLockPath, lockId);

82 };

83}

84async function

dist/run-63F72OAV.jsView file

Lines 102-142javascript

102var CLOUD_POLL_INTERVAL_MS = 3e3;

103var CLOUD_POLL_TIMEOUT_MS = 30 * 60 * 1e3;

104async function runCloudDispatch(squadName, agentName, options) {

dist/chunk-IDPTY2HK.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2import {

3 findProjectRoot

4} from "./chunk-K62RGAJ4.js";

6// src/version.ts

7import { createRequire } from "module";

8var require2 = createRequire(import.meta.url);

dist/cli.jsView file

Lines 107-147javascript

107 // scaffolding

108 add: "init",

109 "detect-squad": "status",

110 brief: "propose"

111};

112var HIDDEN_PLUMBING = /* @__PURE__ */ new Set(["session"]);

dist/doctor-T53UYU6G.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2import {

3 RESET,

4 colors,

5 gradient,

6 padEnd,

7 writeLine

8} from "./chunk-M5FXNY6Y.js";

9import {

10 findProjectRoot

11} from

Source & flagged code

7 flagged · loading source

dist/progress-5HD7BZ4Y.jsView file

19// src/commands/progress.ts L20: import { execSync } from "child_process"; L21: import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/progress-5HD7BZ4Y.jsView on unpkg · L19

dist/chunk-VXJNY4BC.jsView file

12import { promisify } from "util"; L13: var execAsync = promisify(exec); L14: var FALLBACK_GIT_USER_NAME = "squads";

High

Shell

Package source references shell execution.

dist/chunk-VXJNY4BC.jsView on unpkg · L12

dist/chunk-ZTQ7ISUR.jsView file

97function findMemoryDir() { L98: let dir = process.cwd(); L99: for (let i = 0; i < 5; i++) {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-ZTQ7ISUR.jsView on unpkg · L97

dist/run-63F72OAV.jsView file

122} L123: const apiKey = process.env.SQUADS_PLATFORM_API_TOKEN || process.env.SCHEDULER_API_KEY; L124: if (apiKey) { ... L128: try { L129: const dispatchRes = await fetch(`${apiUrl}/agent-dispatch`, { L130: method: "POST", L131: headers, L132: body: JSON.stringify({ L133: squad: squadName, ... L145: if (!dispatchRes.ok) { L146: const error = await dispatchRes.text(); L147: spinner.fail(`Dispatch failed: ${dispatchRes.status}`);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/run-63F72OAV.jsView on unpkg · L122

dist/chunk-IDPTY2HK.jsView file

8var require2 = createRequire(import.meta.url); L9: var pkg = require2("../package.json"); L10: var version = pkg.version; ... L73: } L74: const cwdCandidate = join(process.cwd(), ".squads", "config.yml"); L75: if (existsSync(cwdCandidate)) return cwdCandidate; ... L102: agent_timeout_minutes: toNumber( L103: process.env.SQUADS_AGENT_TIMEOUT_MINUTES ?? fileValues.agent_timeout_minutes, L104: DEFAULTS.agent_timeout_minutes ... L129: var GA4_API_SECRET = "VYozX83RTUS0Hqe7lsi8cw"; L130: var TELEMETRY_ENDPOINT = process.env.SQUADS_TELEMETRY_ENDPOINT || `https://www.google-analytics.com/mp/collect?measurement_id=${GA4_MEASUREMENT_ID}&api_secret=${GA4_API_SECRET}`; L131: var eventQueue = [];

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/chunk-IDPTY2HK.jsView on unpkg · L8

dist/cli.jsView file

127Cross-file remote execution chain: dist/cli.js spawns dist/run-63F72OAV.js; helper contains network access plus dynamic code execution. L127: if (canonical) { L128: process.stderr.write( L129: ` squads ${name} is deprecated \u2014 the canonical verb is: squads ${canonical} ... L145: }; L146: var CONFIG_PATH = join(homedir(), ".squadsrc"); L147: function loadStackConfig() { ... L173: for (const [key, value] of Object.entries(config2)) { L174: if (value && !process.env[key]) { L175: process.env[key] = value; ... L180: // src/commands/orchestrate.ts L181: import { spawn } from "child_process"; L182: import { existsSync as existsSync3, readFileSync as readFileSync3, readdirSync as readdirSync2 } from "fs";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L127

dist/doctor-T53UYU6G.jsView file

14// src/commands/doctor.ts L15: import { execSync } from "child_process"; L16: import { existsSync } from "fs"; ... L25: purpose: "AI agent execution engine", L26: installHint: "npm install -g @anthropic-ai/claude-code", L27: unlocks: "Agent execution (required)"

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/doctor-T53UYU6G.jsView on unpkg · L14

Findings

5 High4 Medium6 Low

HighChild Processdist/progress-5HD7BZ4Y.js

HighShelldist/chunk-VXJNY4BC.js

HighSandbox Evasion Gated Capabilitydist/chunk-IDPTY2HK.js

HighCross File Remote Execution Contextdist/cli.js

HighRuntime Package Installdist/doctor-T53UYU6G.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/run-63F72OAV.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/chunk-ZTQ7ISUR.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

dist/progress-5HD7BZ4Y.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

2import {

3 RESET,

4 bold,

5 box,

6 colors,

7 gradient,

8 icons,

9 padEnd,

10 truncate,

11 writeLine

12} from "./chunk-M5FXNY6Y.js";

13import "./chunk-K62RGAJ4.js";

14import {

15 findMemoryDir

16} from "./chunk-ZTQ7ISUR.js";

17import "./chunk-7OCVIDC7.js";

19// src/commands/progress.ts

20import { execSync } from "child_process";

21import { existsSync, readFileSync, writeFileSync, mkdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/progress-5HD7BZ4Y.jsView on unpkg · L19

22import { join } from "path";

23function getTasksFilePath() {

24 const memoryDir = findMemoryDir();

25 if (!memoryDir) {

26 const cwd = process.cwd();

27 const agentsDir = join(cwd, ".agents");

28 if (!existsSync(agentsDir)) {

29 mkdirSync(agentsDir, { recursive: true });

30 }

31 return join(agentsDir, "tasks.json");

32 }

33 return join(memoryDir, "..", "tasks.json");

34}

35function loadTasks() {

36 const tasksPath = getTasksFilePath();

37 if (existsSync(tasksPath)) {

38 try {

39 return JSON.parse(readFileSync(tasksPath, "utf-8"));

dist/chunk-VXJNY4BC.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import {

3 RESET,

4 colors,

5 writeLine

6} from "./chunk-M5FXNY6Y.js";

8// src/lib/git.ts

9import { execSync, exec } from "child_process";

10import { existsSync } from

dist/chunk-ZTQ7ISUR.jsView file

Lines 77-117javascript

77 if (!gotLock) {

78 return null;

79 }

80 return async () => {

81 releaseFileLock(fileLockPath, lockId);

82 };

83}

84async function

dist/run-63F72OAV.jsView file

Lines 102-142javascript

102var CLOUD_POLL_INTERVAL_MS = 3e3;

103var CLOUD_POLL_TIMEOUT_MS = 30 * 60 * 1e3;

104async function runCloudDispatch(squadName, agentName, options) {

dist/chunk-IDPTY2HK.jsView file

Lines 1-28javascript

1#!/usr/bin/env node

2import {

3 findProjectRoot

4} from "./chunk-K62RGAJ4.js";

6// src/version.ts

7import { createRequire } from "module";

8var require2 = createRequire(import.meta.url);

dist/cli.jsView file

Lines 107-147javascript

107 // scaffolding

108 add: "init",

109 "detect-squad": "status",

110 brief: "propose"

111};

112var HIDDEN_PLUMBING = /* @__PURE__ */ new Set(["session"]);

dist/doctor-T53UYU6G.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2import {

3 RESET,

4 colors,

5 gradient,

6 padEnd,

7 writeLine

8} from "./chunk-M5FXNY6Y.js";

9import {

10 findProjectRoot

11} from