registry / x-agent-relay-cli / 0.1.15

x-agent-relay-cli@0.1.15

Delegate subtasks from your coding agent to other agents on the Agent Relay network

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 2 file(s), 309 KB of source, external domains: agent.kreplay.com, relay.example.com

Source & flagged code

7 flagged

package.jsonView file

Lines 4-43json

4 "description": "Delegate subtasks from your coding agent to other agents on the Agent Relay network",

5 "keywords": ["agent", "ai", "delegation", "mcp", "claude", "opencode", "codex", "trae", "cli"],

6 "license": "MIT",

7 "repository": {

8 "type": "git",

9 "url": "git+https://github.com/wisimer/XAgentRelay.git",

10 "directory": "apps/cli"

11 },

12 "homepage": "https://github.com/wisimer/XAgentRelay#readme",

13 "bugs": "https://github.com/wisimer/XAgentRelay/issues",

14 "type": "module",

15 "bin": {

16 "x-agent-relay": "./dist-bin/x-agent-relay.mjs"

17 },

18 "files": [

19 "dist-bin",

20 "skills",

21 "scripts"

22 ],

23 "scripts": {

24 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L24

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L24

25 "bundle": "esbuild dist/index.js --bundle --platform=node --format=esm --target=node18 --outfile=dist-bin/x-agent-relay.mjs --banner:js=\"import { createRequire as __arCreateRequire } from 'node:module'; const require = __arCreateRequire(import.meta.url);\" --external:bufferutil --external:utf-8-validate && chmod +x dist-bin/x-agent-relay.mjs"

26 },

27 "publishConfig": {

28 "registry": "https://registry.npmjs.org",

29 "access": "public"

30 },

31 "devDependencies": {

32 "@x-agent-relay/agent-runtime": "*",

33 "@x-agent-relay/protocol": "*",

34 "@x-agent-relay/sdk": "*",

35 "@x-agent-relay/shared": "*",

36 "commander": "^13.0.0",

37 "esbuild": "^0.28.2"

38 },

39 "engines": {

40 "node": ">=18"

41 }

42}

scripts/postinstall.mjsView file

Lines 1-23javascript

1// npm postinstall: install the /delegate skill for every detected coding

2// agent (Claude Code, Codex, Trae, Qwen, shared ~/.agents, …) by invoking the

3// bundled CLI. Best-effort only — must never fail the install.

4import { spawnSync } from "node:child_process";

5import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/postinstall.mjsView on unpkg · L3

dist-bin/x-agent-relay.mjsView file

Lines 1986-2026javascript

1986 if (cmd.getOptionValueSource(key) !== void 0) {

1987 source = cmd.getOptionValueSource(key);

1988 }

1989 });

1990 return source;

Source & flagged code

7 flagged · loading source

package.jsonView file

x-agent-relay-cli@0.1.15

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code