registry / tokenshield-contextplus / 1.0.0

tokenshield-contextplus@1.0.0

⚠ Under review

AI Coding Token Economizer & Model Fatigue Shield for Cursor, Claude Code, Windsurf & VS Code

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis completed at 72.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 20.9 KB of source, external domains: praveenojha.com

Source & flagged code

3 flagged

bin/cli.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

3/**

4 * TokenShield & Context++ — Developer CLI

5 * ========================================

6 * Universal AI Coding Token Economizer & Model Fatigue Shield

7 */

9const fs = require('fs');

10const path = require('path');

11const os = require('os');

12const { execSync, spawn } = require('child_process');

14const HOME_DIR = os.homedir();

15const CONFIG_DIR = path.join(HOME_DIR, '.tokenshield');

16const VAULT_FILE = path.join(CONFIG_DIR, 'vault.json');

17const LICENSE_SERVER = process.env.TOKENSHIELD_LICENSE_SERVER || 'https://praveenojha.com/api/store/licenses/verify';

19// Ensure config dir exists

20if (!fs.existsSync(CONFIG_DIR)) {

21 fs.mkdirSync(CONFIG_DIR, { recursive: true });

22}

24// Read or init Vault State (50,000 token trial)

25function getVault() {

26 if (fs.existsSync(VAULT_FILE)) {

27 try {

28 return JSON.parse(fs.readFileSync(VAULT_FILE, 'utf8'));

29 } catch (e) {}

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/cli.jsView on unpkg · L11

30 }

31 const defaultVault = {

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. le.log(` unlock at: ${c.cyan}https://praveenojha.com/store/tokenshield${c.reset}\n`); return { allowed: false, islicensed: false }; } return { allowed: true, islicensed: false }; } function findcorescript(scriptname) { const candidates = [ path.join(__dirname, '../core', scriptname), path.join(__dirname, '../../core', scriptname), path.join(__dirname, 'core', scriptname), path.join(__dirname, scriptname) ]; for (const p of candidates) { if (fs.existssync(p)) return p; } return null; } function runcorescript(scriptname, args = []) { const scriptpath = findcorescript(scriptname); if (!scriptpath) { console.error(`${c.red}❌ error:

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

bin/cli.jsView on unpkg

core/agent_session_compactor.pyView file

•path = core/agent_session_compactor.py kind = build_helper sizeBytes = 5264 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/agent_session_compactor.pyView on unpkg

Source & flagged code

3 flagged · loading source

bin/cli.jsView file

11const os = require('os'); L12: const { execSync, spawn } = require('child_process'); L13: L14: const HOME_DIR = os.homedir(); L15: const CONFIG_DIR = path.join(HOME_DIR, '.tokenshield'); L16: const VAULT_FILE = path.join(CONFIG_DIR, 'vault.json'); L17: const LICENSE_SERVER = process.env.TOKENSHIELD_LICENSE_SERVER || 'https://praveenojha.com/api/store/licenses/verify'; L18: ... L27: try { L28: return JSON.parse(fs.readFileSync(VAULT_FILE, 'utf8')); L29: } catch (e) {} ... L42: chatPushCount: 0,

tokenshield-contextplus@1.0.0

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code