AI Analysis
Final verdict: SUSPICIOUS
The package shows low risks in terms of network, shell execution, obfuscation, and credential handling. However, the metadata risk due to the maintainer having only one package suggests some caution.
- Low risk in most categories
- Metadata risk due to single package from maintainer
Per-check LLM notes
- Network: No network calls detected, which is normal if the package does not require internet access.
- Shell: No shell execution patterns detected, indicating no direct system command execution from the package.
- Obfuscation: No obfuscation patterns detected, indicating low risk of malicious intent.
- Credentials: No credential harvesting patterns detected, suggesting safe handling of secrets.
- Metadata: The maintainer has only one package, which could indicate a new or less active account, raising some suspicion but not conclusive evidence of malice.
Package Quality Overall: Medium (6.2/10)
✦ High
Test Suite
9.0
Test suite present — 15 test file(s) found
Test runner config found: conftest.pyTest runner config found: pyproject.toml15 test file(s) detected (e.g. conftest.py)
◈ Medium
Documentation
7.0
Some documentation present
Documentation URL: "Documentation" -> https://github.com/jenreh/appkit/tree/main/docsDetailed PyPI description (1977 chars)
○ Low
Contributing Guide
2.0
No contributing guide or governance files found
No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
◈ Medium
Type Annotations
5.0
Partial type annotation coverage
225 type-annotated function signatures detected in source
✦ High
Multiple Contributors
8.0
Active multi-contributor project
3 unique contributor(s) across 100 commits in jenreh/appkitSmall but multi-author team (3–4 contributors)
Heuristic Checks
Outbound Network Calls
No suspicious network call patterns found
Code Obfuscation
No obfuscation patterns detected
Shell / Subprocess Execution
No shell execution patterns detected
Credential Harvesting
No credential harvesting patterns detected
Typosquatting
No typosquatting candidates detected
Registered Email Domain
No author email provided
Suspicious Page Links
All external links appear legitimate
Git Repository History
Repository jenreh/appkit appears legitimate
Maintainer History
score 2.0
1 maintainer concern(s) found
Author "Jens Rehpöhler" appears to have only 1 package on PyPI (new or inactive account)
Known CVE Vulnerabilities
No known vulnerabilities found in OSV database.
AI App Starter Prompt
Use this prompt to build a project with appkit-mcp-bpmn
Create a mini-application called 'ProcessVisualizer' that allows users to design, edit, and share Business Process Model and Notation (BPMN) diagrams using the 'appkit-mcp-bpmn' Python package. The application should provide a simple web interface where users can create new BPMN diagrams, import existing ones, and export them in various formats such as PNG, SVG, and PDF. Additionally, users should be able to collaborate on diagrams in real-time, receive notifications when changes are made, and save their work to a cloud storage service like AWS S3. The application should also include a feature to validate BPMN models against BPMN 2.0 specifications to ensure correctness. Use Flask for the backend and React for the frontend. Integrate authentication using JWT tokens for secure user sessions. Finally, document your project setup, including any dependencies and configuration steps, to make it easy for others to replicate.