registry / tolingclaw / 1.0.33

tolingclaw@1.0.33

跨境电商轻量智能体框架

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 32 file(s), 920 KB of source, external domains: coding.dashscope.aliyuncs.com, github.com, toling.me, vuejs.org, www.w3.org

Oversized source lightweight scan

src/ControlUI/dist/assets/index-p7dLTqIa.js2.57 MB file, sampled 256 KB

NetworkChildProcessHighEntropyStringsMinifiedUrlStringsvuejs.orgwww.w3.org

Source & flagged code

2 flagged

bin/tolingclaw.jsView file

Lines 96-136javascript

96 const { dir: workDir, isDefault } = resolveWorkDir(opts.dir);

97 if (isDefault) {

98 ensureWorkspace(workDir);

99 }

100

101 // 优先使用工作目录的 src/main.js，否则用包自带的

102 let mainPath = findWorkspaceFile(workDir, 'src/main.js');

103 if (!mainPath) {

104 mainPath = path.join(pkgDir, 'src', 'main.js');

105 }

106

107 if (!fs.existsSync(mainPath)) {

108 console.error(chalk.red('❌ 找不到 src/main.js'));

109 console.error(chalk.gray(' 在项目目录下执行 tolingclaw start'));

110 console.error(chalk.gray(' 或执行 tolingclaw init <名称> 创建新项目'));

111 process.exit(1);

112 }

113

114 // 注入工作目录环境变量，让 config.js 等能正确读取

115 process.env.TOLING_WORKSPACE = workDir;

116

117 const { main } = await import(pathToFileURL(mainPath).href);

118 await main();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tolingclaw.jsView on unpkg · L116

119 });

120

121program

122 .command('gateway')

123 .alias('web')

124 .description('启动 Web UI 管理界面')

125 .option('-d, --dir <path>', '项目目录', '.')

126 .option('-p, --port <port>', '端口号', '3000')

127 .action(async (opts) => {

128 const { dir: workDir, isDefault } = resolveWorkDir(opts.dir);

129 if (isDefault) {

130 ensureWorkspace(workDir);

131 }

132

133 process.env.TOLING_WORKSPACE = workDir;

134 process.env.PORT = opts.port;

135

136 const webPath = findFile(workDir, 'src/web.js');

src/ControlUI/dist/assets/index-p7dLTqIa.jsView file

•path = src/ControlUI/dist/assets/index-p7dLTqIa.js kind = oversized_source_file sizeBytes = 2691836 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/ControlUI/dist/assets/index-p7dLTqIa.jsView on unpkg

Source & flagged code

2 flagged · loading source

bin/tolingclaw.jsView file

116L117: const { main } = await import(pathToFileURL(mainPath).href); L118: await main();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tolingclaw.jsView on unpkg · L116

src/ControlUI/dist/assets/index-p7dLTqIa.jsView file

•path = src/ControlUI/dist/assets/index-p7dLTqIa.js kind = oversized_source_file sizeBytes = 2691836 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/ControlUI/dist/assets/index-p7dLTqIa.jsView on unpkg

Findings

1 High4 Medium4 Low

HighOversized Source Filesrc/ControlUI/dist/assets/index-p7dLTqIa.js

MediumDynamic Requirebin/tolingclaw.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

bin/tolingclaw.jsView file

Lines 96-136javascript

96 const { dir: workDir, isDefault } = resolveWorkDir(opts.dir);

97 if (isDefault) {

98 ensureWorkspace(workDir);

99 }

100

101 // 优先使用工作目录的 src/main.js，否则用包自带的

102 let mainPath = findWorkspaceFile(workDir, 'src/main.js');

103 if (!mainPath) {

104 mainPath = path.join(pkgDir, 'src', 'main.js');

105 }

106

107 if (!fs.existsSync(mainPath)) {

108 console.error(chalk.red('❌ 找不到 src/main.js'));

109 console.error(chalk.gray(' 在项目目录下执行 tolingclaw start'));

110 console.error(chalk.gray(' 或执行 tolingclaw init <名称> 创建新项目'));

111 process.exit(1);

112 }

113

114 // 注入工作目录环境变量，让 config.js 等能正确读取

115 process.env.TOLING_WORKSPACE = workDir;

116

117 const { main } = await import(pathToFileURL(mainPath).href);

118 await main();

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/tolingclaw.jsView on unpkg · L116

119 });

120

121program

122 .command('gateway')

123 .alias('web')

124 .description('启动 Web UI 管理界面')

125 .option('-d, --dir <path>', '项目目录', '.')

126 .option('-p, --port <port>', '端口号', '3000')

127 .action(async (opts) => {

128 const { dir: workDir, isDefault } = resolveWorkDir(opts.dir);

129 if (isDefault) {

130 ensureWorkspace(workDir);

131 }

132

133 process.env.TOLING_WORKSPACE = workDir;

134 process.env.PORT = opts.port;

135

136 const webPath = findFile(workDir, 'src/web.js');

src/ControlUI/dist/assets/index-p7dLTqIa.jsView file

•path = src/ControlUI/dist/assets/index-p7dLTqIa.js kind = oversized_source_file sizeBytes = 2691836 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

src/ControlUI/dist/assets/index-p7dLTqIa.jsView on unpkg