🤖 AI Analysis

Final verdict: SAFE

The package appears to be primarily focused on project management and initialization for ACP projects with moderate risks related to shell execution and metadata quality. However, there are no indications of malicious activities such as credential theft or obfuscation.

Moderate shell risk due to use of git commands
Low metadata quality and maintainership activity

Per-check LLM notes

Network: The network call is likely for checking the availability or version of a remote registry, which seems benign.
Shell: Git commands are being used to clone repositories and initialize git within a directory, suggesting the package might be related to git operations but could potentially execute arbitrary code if misused.
Obfuscation: No obfuscation patterns detected, indicating low risk of malicious obfuscation.
Credentials: No credential harvesting patterns detected, indicating low risk of secret or credential theft.
Metadata: Low maintainer activity and poor metadata quality suggest potential risk.

🔬 Heuristic Checks

⚠ Outbound Network Calls score 1.5

Found 1 network call pattern(s)

" try: response = httpx.get(registry_url, timeout=timeout, follow_redirects=True)

✓ Code Obfuscation

No obfuscation patterns detected

⚠ Shell / Subprocess Execution score 10.0

Found 6 shell execution pattern(s)

on PATH.""" try: subprocess.run( ["git", "--version"], check=True,
failure.""" try: subprocess.run( ["git", "clone", "--depth=1", "--branch", branc
# Clone result = subprocess.run( ["git", "clone", "--depth=1", repo_url, str(pkg
t repo so git clone works subprocess.run(["git", "init"], cwd=str(pkg_dir), capture_output=True)
ir), capture_output=True) subprocess.run(["git", "add", "-A"], cwd=str(pkg_dir), capture_output=True)
ir), capture_output=True) subprocess.run( ["git", "-c", "[email protected]", "-c", "us

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: gmail.com>

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 2.5

Git history flags: Repository has zero stars and zero forks

Repository has zero stars and zero forks

⚠ Maintainer History score 6.0

3 maintainer concern(s) found

Author name is missing or very short
Author "" appears to have only 1 package on PyPI (new or inactive account)
Package has no PyPI classifiers (low effort / metadata quality)

✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with agent-context-mcp

Build a simple Python application using the agent-context-mcp package to demonstrate its core features.