registry / x-agent-relay-cli / 0.1.7

x-agent-relay-cli@0.1.7

Delegate subtasks from your coding agent to other agents on the Agent Relay network

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 1 file(s), 298 KB of source, external domains: agent.kreplay.com, relay.example.com

Source & flagged code

4 flagged

dist-bin/x-agent-relay.mjsView file

Lines 1146-1186javascript

1146 if (searchingOptions) {

1147 similar = similar.map((candidate) => `--${candidate}`);

1148 }

1149 if (similar.length > 1) {

1150 return `

1151(Did you mean one of ${similar.join(", ")}?)`;

1152 }

1153 if (similar.length === 1) {

1154 return `

1155(Did you mean ${similar[0]}?)`;

1156 }

1157 return "";

1158 }

1159 exports.suggestSimilar = suggestSimilar;

1160 }

1161});

1162

1163// ../../node_modules/commander/lib/command.js

1164var require_command = __commonJS({

1165 "../../node_modules/commander/lib/command.js"(exports) {

1166 var EventEmitter = __require("node:events").EventEmitter;

1167 var childProcess = __require("node:child_process");

1168 var path = __require("node:path");

High

Child Process

Package source references child process execution.

dist-bin/x-agent-relay.mjsView on unpkg · L1166

1169 var fs = __require("node:fs");

1170 var process2 = __require("node:process");

1171 var { Argument: Argument2, humanReadableArgName } = require_argument();

1172 var { CommanderError: CommanderError2 } = require_error();

1173 var { Help: Help2, stripColor } = require_help();

1174 var { Option: Option2, DualOptions } = require_option();

1175 var { suggestSimilar } = require_suggestSimilar();

1176 var Command2 = class _Command extends EventEmitter {

1177 /**

1178 * Initialize a new `Command`.

1179 *

1180 * @param {string} [name]

1181 */

1182 constructor(name) {

1183 super();

1184 this.commands = [];

1185 this.options = [];

1186 this.parent = null;

Lines 1986-2026javascript

1986 if (cmd.getOptionValueSource(key) !== void 0) {

1987 source = cmd.getOptionValueSource(key);

1988 }

1989 });

1990 return source;

1991 }

1992

Lines 7194-7234javascript

7194 if (ctx?.previous_attempts?.length) {

7195 lines.push("");

7196 lines.push("## Previous attempts");

7197 for (const a of ctx.previous_attempts)

7198 lines.push

•Manifest-reachable source resolves another installed package, overwrites its runtime code, and injects package-defined remote behavior. dist-bin/x-agent-relay.mjs: // ../../node_modules/commander/lib/error.js "../../node_modules/commander/lib/error.js"(exports) { // ../../node_modules/commander/lib/argument.js "../../node_modules/commander/lib/argument.js"(exports) { // ../../node_modules/commander/lib/help.js "../../node_modules/commander/lib/help.js"(exports) { * Detect manually wrapped and indented strings by checking for line break followed by whitespace. * Format the "item", which consists of a term and description. Pad the term and wrap the description, indenting the following lines.

High

Entrypoint Foreign Package Code Overwrite

Manifest-reachable source overwrites another installed package with package-defined remote behavior.

dist-bin/x-agent-relay.mjsView on unpkg

Source & flagged code

4 flagged · loading source

dist-bin/x-agent-relay.mjsView file

x-agent-relay-cli@0.1.7

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code