🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows some signs of potential misuse due to unclear network and shell risks, despite having no evidence of obfuscation or credential mishandling. The metadata also indicates a new and less engaged repository.

network risk 4/10
shell risk 6/10
metadata risk 5/10

Per-check LLM notes

Network: The network patterns detected may be used for legitimate purposes like checking connectivity or making HTTP requests, but the lack of clear context could indicate potential misuse.
Shell: Executing Docker commands suggests interaction with system resources which could be legitimate if the package is intended to manage Docker containers. However, without proper documentation, it raises suspicion about potential unauthorized access or command execution.
Obfuscation: No obfuscation patterns detected, indicating low risk of malicious intent.
Credentials: No credential harvesting patterns detected, indicating safe handling of secrets and credentials.
Metadata: The repository is new, lacks community engagement, and the maintainer's information is sparse.

📦 Package Quality Overall: Low (3.4/10)

○ Low Test Suite 1.0

No test suite detected

No test files or test-runner configuration detected

◈ Medium Documentation 5.0

Some documentation present

Detailed PyPI description (18356 chars)

○ Low Contributing Guide 4.0

No contributing guide or governance files found

Development Status classifier >= Beta

◈ Medium Type Annotations 5.0

Partial type annotation coverage

229 type-annotated function signatures detected in source

○ Low Multiple Contributors 2.0

Single-author or unverifiable project

1 unique contributor(s) across 11 commits in jaydenaung/agentsentinel-cli
Single author with few commits — possibly a personal or throwaway project

🔬 Heuristic Checks

⚠ Outbound Network Calls score 7.5

Found 5 network call pattern(s)

try: with socket.create_connection((host, port), timeout=timeout): return port
try: with socket.create_connection((host, port), timeout=timeout): return (host
or {} try: with httpx.Client(timeout=timeout) as client: try:
date(extra_headers) with httpx.Client(timeout=timeout) as client: resp = client.post(base,
m: {exc}") from exc with httpx.Client(timeout=timeout) as client: reader = threading.Threa

✓ Code Obfuscation

No obfuscation patterns detected

⚠ Shell / Subprocess Execution score 10.0

Found 5 shell execution pattern(s)

[] try: result = subprocess.run( ["docker", "ps", "--format", "{{json .}}"],
ol: try: result = subprocess.run(["docker", "info"], capture_output=True, timeout=5)
{} try: result = subprocess.run( ["docker", "inspect", "--format",
ne: try: result = subprocess.run(args, capture_output=True, text=True, timeout=timeout)
mand) try: proc = subprocess.Popen( args, stdin=subprocess.PIPE,

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 5.0

Git history flags: Repository created very recently: 4 day(s) ago (2026-06-02T10:06:27Z)

Repository created very recently: 4 day(s) ago (2026-06-02T10:06:27Z)
Repository has zero stars and zero forks

⚠ Maintainer History score 4.0

2 maintainer concern(s) found

Author name is missing or very short
Author "" appears to have only 1 package on PyPI (new or inactive account)

✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with agentsentinel-cli

Build a simple Python application using the agentsentinel-cli package to demonstrate its core features.