advisor-agent

v0.8.2 suspicious
6.0
Medium Risk

Opus-led code review-and-fix pipeline for Claude Code (native agent teams, no external API calls).

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows moderate risk due to potential code execution via shell commands and obfuscated code that hides true intentions.

  • High obfuscation risk obscuring true functionality
  • Moderate shell risk due to subprocess usage
Per-check LLM notes
  • Network: The network calls to fetch JSON data are common and likely for legitimate purposes like fetching configuration or updates.
  • Shell: The use of subprocess to run shell commands could be part of the package's functionality, but it raises concern as it can potentially execute arbitrary code.
  • Obfuscation: The code appears to use obfuscation techniques which may hide the actual functionality and intent of the code.
  • Credentials: No direct evidence of credential harvesting is present in the provided snippet.
  • Metadata: Suspicious non-HTTPS link and author details raise concerns but no concrete evidence of malice.

🔬 Heuristic Checks

⚠ Outbound Network Calls score 3.0

Found 2 network call pattern(s)

  • }/json" try: with urllib.request.urlopen(url, timeout=timeout) as resp: data = _j
  • equest try: with urllib.request.urlopen(url, timeout=timeout) as resp: raw = res
⚠ Code Obfuscation score 2.0

Found 1 obfuscation pattern(s)

  • cated is False text = __import__("advisor.audit", fromlist=["format_audit_report"]).format_audit_report( report ) a
⚠ Shell / Subprocess Execution score 10.0

Found 6 shell execution pattern(s)

  • here. try: proc = subprocess.Popen( ["git", *args], cwd=str(cwd),
  • str], cwd: Path) -> None: subprocess.run(cmd, cwd=cwd, check=True, capture_output=True) @pytest.fix
  • ender token. result = subprocess.run( [sys.executable, "-m", "advisor", "plan", str(t
  • t no boost. result2 = subprocess.run( [ sys.executable,
  • th) -> None: result = subprocess.run( [sys.executable, "-m", "advisor", "presets"],
  • th) -> None: result = subprocess.run( [sys.executable, "-m", "advisor", "presets", "-
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: gmail.com>

⚠ Suspicious Page Links score 2.0

Found 1 suspicious link(s) on the package page

  • Non-HTTPS external link: http://127.0.0.1:8765
✓ Git Repository History

Repository vzwjustin/advisor appears legitimate

⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with advisor-agent 
Create a Python-based code review tool called 'CodeSavior' that leverages the 'advisor-agent' package to automate and enhance the process of reviewing and fixing code issues within a team's repository. This tool will serve as a local, self-contained solution for teams working on Claude Code projects, eliminating the need for external API calls. Here’s a step-by-step guide to building 'CodeSavior':

1. **Project Setup**: Start by setting up a new Python environment. Ensure you install the 'advisor-agent' package from the official source or any reliable repository.
2. **Integration of 'advisor-agent'**: Integrate the 'advisor-agent' into your project to handle the automated code review process. Use its core functionalities to analyze the codebase for common issues such as syntax errors, best practices violations, and potential bugs.
3. **User Interface**: Develop a simple command-line interface (CLI) that allows users to input paths to their code files or directories for review. The CLI should also provide options to customize the review criteria based on specific needs.
4. **Review Process**: Implement a feature where 'CodeSavior' automatically runs through the specified code files or directories, applying the 'advisor-agent' for analysis. It should then generate a detailed report highlighting any issues found, along with suggestions for fixes.
5. **Fixing Issues**: Incorporate an interactive mode where users can choose to have 'CodeSavior' attempt to fix identified issues directly within the codebase. This feature should be optional and clearly communicated to avoid unintended changes.
6. **Reporting and Logging**: Ensure that 'CodeSavior' logs all activities and results of each code review session. This log should include timestamps, details of the reviewed files, detected issues, applied fixes, and any errors encountered during the process.
7. **Customization and Extensibility**: Allow for customization of the review criteria by enabling users to define their own rules and exceptions using configuration files. This ensures flexibility and adaptability to different project requirements.
8. **Testing and Validation**: Thoroughly test 'CodeSavior' across various codebases and scenarios to validate its effectiveness. Pay special attention to edge cases and ensure that it handles unexpected inputs gracefully.
9. **Documentation**: Provide comprehensive documentation for both users and developers, explaining how to set up, use, and extend 'CodeSavior'. Include examples and best practices for leveraging the 'advisor-agent' effectively.
10. **Deployment and Distribution**: Prepare 'CodeSavior' for deployment, ensuring it is packaged in a way that makes it easy for others to install and use. Consider publishing it on platforms like GitHub or PyPI for wider accessibility.

By following these steps, you'll create a powerful, user-friendly tool that significantly enhances the efficiency and quality of code reviews within teams working on Claude Code projects.