AI Analysis
Final verdict: SAFE
The package is assessed as safe with a low risk score due to no detected network calls, minimal shell execution risk, and appropriate use of getpass for handling credentials.
- No network calls detected
- Appropriate use of getpass for secure credential handling
Per-check LLM notes
- Network: No network calls detected, which is normal if the package does not require internet access.
- Shell: Shell execution might be used for executing commands locally, but further investigation is needed to ensure it's not misused.
- Obfuscation: No obfuscation patterns detected.
- Credentials: The usage of getpass for password input is likely legitimate, as it's a standard method for securely handling user input of sensitive information.
Package Quality Overall: Medium (5.0/10)
○ Low
Test Suite
1.0
No test suite detected
No test files or test-runner configuration detected
◈ Medium
Documentation
7.0
Some documentation present
Documentation URL: "Documentation" -> https://annowork-cli.readthedocs.ioDetailed PyPI description (1908 chars)
○ Low
Contributing Guide
4.0
No contributing guide or governance files found
Development Status classifier >= Beta
◈ Medium
Type Annotations
5.0
Partial type annotation coverage
334 type-annotated function signatures detected in source
✦ High
Multiple Contributors
8.0
Active multi-contributor project
3 unique contributor(s) across 100 commits in kurusugawa-computer/annowork-cliSmall but multi-author team (3–4 contributors)
Heuristic Checks
Outbound Network Calls
No suspicious network call patterns found
Code Obfuscation
No obfuscation patterns detected
Shell / Subprocess Execution
score 2.0
Found 1 shell execution pattern(s)
command: {str_command}") subprocess.run(command, check=True) def main(args: argparse.Namespace) ->
Credential Harvesting
score 5.0
Found 2 credential access pattern(s)
"": login_password = getpass.getpass("Enter Annofab Password: ") return login_password def"": login_password = getpass.getpass("Enter Annowork Password: ") return login_password def
Typosquatting
No typosquatting candidates detected
Registered Email Domain
No author email provided
Suspicious Page Links
All external links appear legitimate
Git Repository History
score 2.5
Git history flags: Repository has zero stars and zero forks
Repository has zero stars and zero forks
Maintainer History
score 2.0
1 maintainer concern(s) found
Author "Kurusugawa Computer Inc." appears to have only 1 package on PyPI (new or inactive account)
Known CVE Vulnerabilities
No known vulnerabilities found in OSV database.
AI App Starter Prompt
Use this prompt to build a project with annoworkcli
Build a simple Python application using the annoworkcli package to demonstrate its core features.
💬 Discussion Feed
No discussion yet. Be the first to share your thoughts!
Report Abuse / Security Issue