🤖 AI Analysis

Final verdict: SAFE

The package appears to have legitimate purposes with low risks associated with network and shell operations. There is no evidence of malicious behavior or supply-chain attacks.

Low network and shell risks
No signs of obfuscation or credential harvesting

Per-check LLM notes

Network: The network calls seem to be intended for GitHub API interactions, which could be legitimate for fetching data or updates.
Shell: Use of subprocess indicates the package may execute external commands, which could pose risks if not properly sanitized or controlled.
Obfuscation: No obfuscation patterns detected, indicating low risk.
Credentials: No credential harvesting patterns detected, indicating low risk.
Metadata: The package shows some signs of low maintenance and effort, but there's no clear indication of malicious intent.

📦 Package Quality Overall: Low (4.4/10)

✦ High Test Suite 9.0

Test suite present — 5 test file(s) found

Test runner config found: pyproject.toml
5 test file(s) detected (e.g. stats_seed.py)

◈ Medium Documentation 5.0

Some documentation present

Detailed PyPI description (11490 chars)

○ Low Contributing Guide 2.0

No contributing guide or governance files found

No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found

◈ Medium Type Annotations 5.0

Partial type annotation coverage

524 type-annotated function signatures detected in source

○ Low Multiple Contributors 1.0

Unable to verify contributor count: no GitHub repository found

No GitHub repository linked — contributor count unavailable

🔬 Heuristic Checks

⚠ Outbound Network Calls score 7.5

Found 5 network call pattern(s)

def _urlopen( request: urllib.request.Request, *, timeout: float = 10, ) -> Any: conte
e=certifi.where()) return urllib.request.urlopen(request, timeout=timeout, context=context) def _ru
def _request_json(request: urllib.request.Request) -> dict[str, Any]: try: with _urlopen(r
lt try: request = urllib.request.Request( "https://api.github.com/copilot_interna
/GetPlanStatus" request = urllib.request.Request( endpoint, data=_encode_devin_plan_s

✓ Code Obfuscation

No obfuscation patterns detected

⚠ Shell / Subprocess Execution score 6.0

Found 3 shell execution pattern(s)

subprocess.DEVNULL proc = subprocess.Popen( args, cwd=str(cwd) if cwd else None,
rocess.Popen[str]: return subprocess.Popen( args, stdin=subprocess.PIPE, stdout
import subprocess return subprocess.run(args, cwd=str(cwd), text=True, capture_output=True, check=Fa

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

No GitHub repository linked

No GitHub repository link found

⚠ Maintainer History score 4.0

2 maintainer concern(s) found

Author "AgentPool contributors" appears to have only 1 package on PyPI (new or inactive account)
Package has no PyPI classifiers (low effort / metadata quality)

✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with agentpool-cli

Create a command-line utility called 'CodeBuddy' that helps developers manage their subscriptions to multiple coding agents efficiently. The utility should allow users to monitor the real-time usage of their coding agents, distribute tasks among available agents based on their current load, and log the execution details for auditing purposes.

### Core Features:
1. **Agent Pool Management:** Users should be able to add, remove, and list coding agents within their pool.
2. **Real-Time Usage Monitoring:** Display the current usage statistics of each agent, such as remaining API calls or processing capacity.
3. **Task Offloading:** Automatically route tasks to agents with the least load to ensure optimal performance and efficient use of resources.
4. **Logging and Reporting:** Maintain logs of all task executions, including start time, end time, and agent used, for future reference and analysis.
5. **Configuration File Support:** Allow users to configure settings such as default agent selection, logging level, etc., via a YAML configuration file.

### How 'agentpool-cli' Package Is Utilized:
- Use the 'agentpool-cli' package to interact with the MCP server, which provides access to real-time usage data and enables offloading tasks to agents dynamically.
- Leverage the CLI functionalities provided by 'agentpool-cli' to integrate seamless management of coding agents into your utility.
- Implement error handling and feedback mechanisms using the package's capabilities to ensure smooth operation and user-friendly interaction.

### Additional Suggestions:
- Include a feature that alerts users when an agent is nearing its usage limit, allowing proactive management of resources.
- Offer a graphical interface as an optional extension for those who prefer visual tools over command-line interfaces.
- Provide comprehensive documentation and examples to help new users quickly understand and utilize 'CodeBuddy'.