agent-framework-engram

v0.1.1 suspicious
4.0
Medium Risk

Engram (Lumetra) durable memory tools and middleware for the Microsoft Agent Framework.

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits a moderate level of risk due to its network activities and the suspicious nature of its repository metadata.

  • network risk from potential unverified external communications
  • metadata risk due to a throwaway account with minimal activity
Per-check LLM notes
  • Network: The use of AsyncClient suggests the package is making network requests, which could be legitimate, but requires further investigation into the purpose and destinations of these calls.
  • Shell: No shell execution patterns were detected.
  • Obfuscation: No obfuscation patterns detected, indicating low risk.
  • Credentials: No credential harvesting patterns detected, indicating low risk.
  • Metadata: The repository shows signs of being a throwaway account with minimal activity, raising concerns about potential malicious intent.

🔬 Heuristic Checks

⚠ Outbound Network Calls score 7.5

Found 5 network call pattern(s)

  • self._client = http_client or httpx.AsyncClient(timeout=timeout) # -- lifecycle -----------------------
  • "id": "m1"}) async with httpx.AsyncClient(transport=_mock_transport(handler)) as h: c = Engram
  • swer": "ok"}) async with httpx.AsyncClient(transport=_mock_transport(handler)) as h: c = Engram
  • cess": True}) async with httpx.AsyncClient(transport=_mock_transport(handler)) as h: c = Engram
  • xt="bad key") async with httpx.AsyncClient(transport=_mock_transport(handler)) as h: c = Engram
✓ Code Obfuscation

No obfuscation patterns detected

✓ Shell / Subprocess Execution

No shell execution patterns detected

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: lumetra.io>

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 5.0

Git history flags: Repository has zero stars and zero forks

  • Repository has zero stars and zero forks
  • Single contributor with only 3 commit(s) — possibly throwaway account
⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with agent-framework-engram 
Create a real-time collaborative note-taking application called 'CollabNotes' using the Python package 'agent-framework-engram'. This application will allow multiple users to simultaneously edit notes stored in a durable, distributed memory system provided by Engram. Here’s a detailed plan on how to develop it:

1. **Project Setup**: Start by setting up your development environment with Python and install the necessary packages including 'agent-framework-engram'.
2. **User Authentication**: Implement user authentication so that only authorized users can access and modify notes. Use a simple token-based system for now.
3. **Note Creation and Editing**: Allow users to create new notes and edit existing ones in real-time. Each note should have a title and contenteditable body.
4. **Real-Time Collaboration**: Utilize 'agent-framework-engram' to synchronize changes across all connected clients in real-time. Ensure that each user sees updates from other collaborators as they happen.
5. **Version Control**: Implement version control for each note, allowing users to revert to previous versions if needed. Store these versions in the Engram memory system.
6. **Search Functionality**: Provide a search feature that allows users to find specific notes based on keywords or tags.
7. **Notifications**: Add notifications to alert users when another collaborator has made changes to a note they are following.
8. **Testing and Deployment**: Thoroughly test the application for functionality and performance. Once satisfied, deploy it to a cloud service like AWS or Heroku.

**How 'agent-framework-engram' is utilized**:
- For storing and retrieving notes and their versions.
- To facilitate real-time synchronization of note edits among collaborating users.
- As a backend for the version control system, ensuring durability and availability of note history.