agi-cluster

v2026.6.4 suspicious
5.0
Medium Risk

Distributed cluster orchestration layer for AGILAB workers over local and SSH backends

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows moderate risk due to shell execution commands that could manipulate system files, despite legitimate network calls and lack of obfuscation or credential risks. The novelty of the package adds to its suspicious nature.

  • Moderate network risk from legitimate PyPI calls
  • High shell risk due to git commands and file deletions
  • No obfuscation or credential risks detected
  • Novelty of the package raises suspicion
Per-check LLM notes
  • Network: The network call to PyPI is likely legitimate for fetching package metadata.
  • Shell: Git commands and directory deletion via shell execution may indicate package maintenance but could also signify potential risks like unintended file manipulation.
  • Obfuscation: No obfuscation patterns detected, indicating low risk.
  • Credentials: No credential harvesting patterns detected, indicating low risk.
  • Metadata: The package is newly uploaded with no prior versions or maintainer history, which raises some suspicion but does not conclusively indicate malice.

📦 Package Quality Overall: Medium (6.4/10)

◈ Medium Test Suite 6.0

Partial test coverage signals detected

  • Test runner config found: pyproject.toml
◈ Medium Documentation 7.0

Some documentation present

  • Documentation URL: "Documentation" -> https://thalesgroup.github.io/agilab
  • Detailed PyPI description (1337 chars)
○ Low Contributing Guide 4.0

No contributing guide or governance files found

  • Development Status classifier >= Beta
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • 408 type-annotated function signatures detected in source
✦ High Multiple Contributors 10.0

Active multi-contributor project

  • 5 unique contributor(s) across 69 commits in ThalesGroup/agilab
  • Active community — 5 or more distinct contributors

🔬 Heuristic Checks

⚠ Outbound Network Calls score 1.5

Found 1 network call pattern(s)

  • try: with urllib.request.urlopen( f"https://pypi.org/pypi/{pkg}/json"
✓ Code Obfuscation

No obfuscation patterns detected

⚠ Shell / Subprocess Execution score 10.0

Found 6 shell execution pattern(s)

  • try: top_result = subprocess.run( ["git", "-C", str(resolved), "rev-parse", "--sh
  • try: status_result = subprocess.run( [ "git", "-C",
  • try: tree_result = subprocess.run( ["git", "-C", str(git_root), "rev-parse", tree_
  • t(path) ) subprocess.run(["cmd", "/c", "rmdir", "/s", "/q", str(path)], check=False)
  • try: completed = subprocess.run( [ "findmnt", "-
  • _ProcessLike, subprocess.Popen( self._command_argv(cmd), sh
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository ThalesGroup/agilab appears legitimate

⚠ Maintainer History score 6.0

3 maintainer concern(s) found

  • Only one version has ever been released — brand new package
  • Package is very new: uploaded 3 day(s) ago
  • Author "Jean-Pierre Morard" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with agi-cluster 
Your task is to create a distributed task manager application using the 'agi-cluster' Python package. This application will allow users to distribute computational tasks across multiple machines connected via SSH, thereby leveraging their combined processing power. The application should be user-friendly, allowing both command-line and GUI interaction.

### Features:
1. **Task Submission:** Users should be able to submit tasks to the cluster either through a command-line interface or a simple graphical user interface.
2. **Cluster Management:** The application should allow users to manage the cluster nodes, including adding new nodes, removing existing ones, and viewing the status of each node.
3. **Task Scheduling:** Implement a basic scheduler that distributes tasks evenly across available nodes based on their current load.
4. **Results Collection:** Once a task completes, its results should be collected and displayed to the user through the same interface they used to submit the task.
5. **Logging & Monitoring:** Provide real-time logs and performance metrics for each running task, as well as overall cluster health.
6. **Security:** Ensure secure communication between nodes and the master node using SSH keys and other security measures.

### Utilizing 'agi-cluster':
- Use 'agi-cluster' to set up and manage the cluster of worker nodes.
- Leverage 'agi-cluster' for task distribution and result collection functionalities.
- Integrate 'agi-cluster' with your chosen frontend (CLI/GUI) to provide a seamless user experience.

### Deliverables:
- A fully functional application with both CLI and GUI interfaces.
- Documentation detailing setup instructions, usage examples, and API documentation for 'agi-cluster'.
- Sample tasks to demonstrate the application's capabilities.

This project aims to showcase the power of distributed computing while providing a practical tool for users needing to process large datasets or run complex computations efficiently.