🤖 AI Analysis

Final verdict: SUSPICIOUS

The package is flagged as suspicious due to high risks associated with shell execution, obfuscation, and credential handling. While there's no direct evidence of malicious intent, the combination of these factors raises concerns about potential supply-chain attacks.

Detected shell execution patterns
Use of 'eval' and 'exec' functions
Attempts to access sensitive files

Per-check LLM notes

Network: No network calls detected.
Shell: Detected shell execution patterns suggest potential for harmful actions, increasing the risk.
Obfuscation: The presence of 'eval' and 'exec' functions with suspicious arguments suggests potential code injection attacks.
Credentials: Attempts to access sensitive files like '/etc/passwd' indicate potential unauthorized access or credential harvesting.
Metadata: The recent repository creation and low maintainer activity suggest potential risk, but insufficient evidence for high suspicion.

🔬 Heuristic Checks

✓ Outbound Network Calls

No suspicious network call patterns found

⚠ Code Obfuscation score 10.0

Found 6 obfuscation pattern(s)

ts = scan_arguments({"code": "eval('malicious')"}) assert any(h["name"] == "eval" for h
ts = scan_arguments({"code": "eval('x')"}, exclude=["eval"]) assert not any(h["name"] =
"run", "arguments": {"cmd": "eval('danger')"}, "confidence": 0.9}], strategy="thre
open\b")), ("os.exec", re.compile(r"\bos\.exec\w+\b")), # Python code injection ("eval", re.compil
eval\s*\(")), ("exec", re.compile(r"\bexec\s*\(")), ("__import__", re.compile(r"\b__import__\s*\("
ate.metadata["adjusted_at"] = __import__("datetime").datetime.now().isoformat() return candidate

⚠ Shell / Subprocess Execution score 10.0

Found 5 shell execution pattern(s)

its = scan_arguments({"cmd": "os.system('rm -rf /')"}) assert any(h["name"] == "os.system" f
exec", "arguments": {"code": "os.system('rm -rf')"}, "confidence": 0.9}, ],
CompletedProcess: return subprocess.run( [sys.executable, "-m", "cascade.cli", "check"] + l
CompletedProcess: return subprocess.run( [sys.executable, script], capture_output=
its = scan_arguments({"cmd": "subprocess.Popen(['rm'])"}) assert any(h["name"] == "subprocess.Popen

⚠ Credential Harvesting score 5.0

Found 2 credential access pattern(s)

scan_arguments({"path": "../../etc/passwd"}) assert any(h["name"] == "path_traversal" for h i
file", "arguments": {"path": "/etc/passwd"}}, ], rules=[ a

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 2.5

Git history flags: Repository created very recently: 6 day(s) ago (2026-05-31T15:18:42Z)

Repository created very recently: 6 day(s) ago (2026-05-31T15:18:42Z)

⚠ Maintainer History score 4.0

2 maintainer concern(s) found

Author "cascade" appears to have only 1 package on PyPI (new or inactive account)
Package has no PyPI classifiers (low effort / metadata quality)

✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with agent-armour

Create a mini-application named 'SafeGuard' that leverages the 'agent-armour' package to ensure secure and compliant usage of external APIs by a Language Model (LLM). This application will act as a middleware between the LLM and the external services, enforcing rules and maintaining an audit log of all interactions. Here’s a detailed breakdown of the steps and features:

1. **Setup Environment**: Initialize your Python environment and install the necessary packages including 'agent-armour'. Ensure you have access to at least one external API service (e.g., weather API, news API).
2. **Define Rules and Scoring System**: Using 'agent-armour', define a set of rules that govern when and how the LLM can interact with the external API. These rules could include frequency limits, data sensitivity checks, and compliance with legal standards. Implement a scoring system that evaluates each API call against these rules.
3. **Implement Middleware Functionality**: Develop a middleware component that intercepts all requests from the LLM to the external API. Use 'agent-armour' to apply the defined rules and scoring system before allowing the request to proceed. If a request fails the rule check, it should be logged appropriately without being forwarded.
4. **Audit Trail Management**: Utilize 'agent-armour' to maintain a comprehensive audit trail of all API interactions. This includes details such as the timestamp of the request, the specific rule(s) applied, the score outcome, and whether the request was allowed or denied.
5. **User Interface**: Create a simple user interface (UI) where users can view the audit logs and manage the rules. Users should be able to add new rules, modify existing ones, and see real-time status updates on the compliance of API calls.
6. **Testing and Validation**: Thoroughly test your application using different scenarios to ensure that it correctly enforces the rules and accurately logs all activities. Validate the effectiveness of the scoring system and the accuracy of the audit trail.
7. **Documentation and Deployment**: Write clear documentation explaining how to set up and use 'SafeGuard'. Consider deploying your application on a platform like Heroku or AWS to make it accessible online.

By following these steps, you'll create a robust solution that not only enhances the security and compliance of API usage but also provides transparency through detailed logging.