registry / starling-ai / 0.3.1

starling-ai@0.3.1

⚠ Under review

Launch, switch, and organize Claude Code, Codex, and Pi sessions with model profiles, catalogs, project views, and VS Code integration.

Static Scan Results

scanned 20d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 18 file(s), 176 KB of source, external domains: open.bigmodel.cn, pi.dev

Source & flagged code

5 flagged

package.jsonView file

Lines 13-40json

13 "files": [

14 "bin/starling.js",

15 "lib/*.js",

16 "lib/agent-host/",

17 "lib/chat/",

18 "lib/render/",

19 "scripts/install-agent-skills.js",

20 "skills/"

21 ],

22 "dependencies": {

23 "@earendil-works/pi-coding-agent": ">=0.82.0"

24 },

25 "optionalDependencies": {

26 "starling-darwin-arm64": "0.3.1",

27 "starling-darwin-x64": "0.3.1",

28 "starling-linux-arm64": "0.3.1",

29 "starling-linux-x64-musl": "0.3.1",

30 "starling-linux-x64": "0.3.1"

31 },

32 "scripts": {

33 "postinstall": "node scripts/install-agent-skills.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L33

34 },

35 "repository": {

36 "type": "git",

37 "url": "https://github.com/huang-sh/Starling"

38 }

39}

bin/starling.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2// Unified entry point for the Starling CLI.

4import { spawn } from "node:child_process";

5import { existsSync, readFileSync, realpathSync } from "fs";

High

Child Process

Package source references child process execution.

bin/starling.jsView on unpkg · L3

6import

lib/agent-host/sdk-adapter.jsView file

Lines 1-29javascript

1import { spawn } from "node:child_process";

2import { mkdtemp, readFile, rm } from "node:fs/promises";

3import os from "node:os";

4import path from "node:path";

scripts/install-agent-skills.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import {

3 copyFileSync,

4 existsSync,

5 mkdirSync,

6 readFileSync,

7 writeFileSync,

8} from "node:fs";

9import { homedir } from

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/install-agent-skills.js

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code