aidlc-factory-installer

v0.2.3 suspicious
7.0
High Risk

AIDLC Factory — multi-agent software development orchestrator (installer bootstrap)

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits multiple risky behaviors including potential unauthorized shell executions and attempts to access sensitive environment variables, suggesting possible malicious intent.

  • High shell risk due to execution of git operations
  • High credential risk as it accesses sensitive environment variables
Per-check LLM notes
  • Network: The network calls appear to be making requests to external URLs with specific headers, which could potentially be used for updates or telemetry but might also be for less benign purposes without clear documentation.
  • Shell: Executing shell commands like git operations directly from a package can indicate manipulation of the local environment or accessing sensitive information, raising concerns about potential unauthorized actions.
  • Obfuscation: The detected pattern is likely an attempt to log or timestamp something rather than obfuscation.
  • Credentials: The code snippet suggests an attempt to access sensitive environment variables, indicating potential credential harvesting.
  • Metadata: The author has only one package, which could indicate a new or less active user, raising some suspicion but not conclusive evidence of malice.

📦 Package Quality Overall: Medium (7.0/10)

✦ High Test Suite 9.0

Test suite present — 5 test file(s) found

  • Test runner config found: pyproject.toml
  • 5 test file(s) detected (e.g. test_spec.py)
◈ Medium Documentation 5.0

Some documentation present

  • Detailed PyPI description (44415 chars)
○ Low Contributing Guide 4.0

No contributing guide or governance files found

  • Development Status classifier >= Beta
◈ Medium Type Annotations 7.0

Partial type annotation coverage

  • Type checker (mypy / pyright / pytype) referenced in project
  • 483 type-annotated function signatures detected in source
✦ High Multiple Contributors 10.0

Active multi-contributor project

  • 5 unique contributor(s) across 100 commits in Mbg999/aidlc-factory
  • Active community — 5 or more distinct contributors

🔬 Heuristic Checks

⚠ Outbound Network Calls score 6.0

Found 4 network call pattern(s)

  • int = 30) -> bytes: req = urllib.request.Request(url, headers={"User-Agent": "factory_custom_skills/1
  • custom_skills/1.0"}) with urllib.request.urlopen(req, timeout=timeout) as resp: return resp.r
  • None: try: req = urllib.request.Request(url, headers={"Accept": "application/json",
  • ill_drift/1.0"}) with urllib.request.urlopen(req, timeout=timeout) as resp: return js
⚠ Code Obfuscation score 4.0

Found 2 obfuscation pattern(s)

  • f"# Extracted at: {__import__('datetime').datetime.now(__import__('datetime').timezone.utc).isoformat
  • rt__('datetime').datetime.now(__import__('datetime').timezone.utc).isoformat()}", "", "|
⚠ Shell / Subprocess Execution score 10.0

Found 6 shell execution pattern(s)

  • re-created) result = subprocess.run( ["git", "diff", "--name-only", "--diff-filter=A
  • er tracked) result2 = subprocess.run( ["git", "ls-files", "--others", "--exclude-stan
  • try: result = subprocess.run( ["git", "hash-object", str(path)],
  • err).""" try: r = subprocess.run(cmd, capture_output=True, text=True, timeout=timeout)
  • return 1 proc = subprocess.Popen( ["codegraph", "affected", "--stdin", "--quiet"],
  • ion...") result = subprocess.run( [sys.executable, str(prim_gen), "--ds-path"
⚠ Credential Harvesting score 2.5

Found 1 credential access pattern(s)

  • # no entry in the container's /etc/passwd. "-e", "HOME=/tmp", "-e", "UV_CACHE_DIR=/tm
✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository Mbg999/aidlc-factory appears legitimate

⚠ Maintainer History score 2.0

1 maintainer concern(s) found

  • Author "Mbg999" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with aidlc-factory-installer 
Develop a mini-application called 'AgentOrchestrator' that leverages the 'aidlc-factory-installer' package to streamline the installation and management of multi-agent software systems. This application will serve as a user-friendly interface for developers to set up, configure, and manage various agents within their projects.

**Project Scope:**
1. **Installation Automation:** Create a wizard-like interface that guides users through the installation process of different agents provided by the 'aidlc-factory-installer'. The interface should support both command-line and graphical interfaces.
2. **Configuration Management:** Allow users to configure each agent with specific settings via a simple configuration file or directly through the GUI. Ensure that these configurations are saved and can be edited later.
3. **Status Monitoring:** Implement real-time status monitoring for all installed agents. Users should be able to see the current status (running, stopped, error) of each agent at any time.
4. **Agent Interaction:** Enable users to start, stop, and restart individual agents directly from the application interface. Additionally, provide a feature to view logs for troubleshooting.
5. **Documentation and Help:** Include comprehensive documentation and a help section within the application that explains common issues and provides solutions.

**How to Utilize 'aidlc-factory-installer':** 
- Use the package to handle the low-level details of agent installation and configuration. For example, use its API to automate the download, extraction, and setup processes of agents.
- Leverage the package's capabilities for managing dependencies and ensuring that all necessary components are available before starting an agent.
- Integrate the package's logging and monitoring functionalities to provide real-time feedback on the status of agents within your application.

Your task is to design and implement this mini-application using Python, focusing on user experience and efficiency. Make sure to include comments in your code explaining how 'aidlc-factory-installer' is integrated into each part of the application.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!