arascan

v0.2.0 suspicious
6.0
Medium Risk

Zero-config, fully local static security analyzer for AI agents

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package exhibits significant risks due to shell execution and obfuscation techniques, indicating potential for misuse. However, it does not pose immediate threat as no credentials are harvested and there are no network calls.

  • High shell risk
  • High obfuscation risk
Per-check LLM notes
  • Network: No network calls detected, which is normal unless the package requires internet access.
  • Shell: Detection of shell execution patterns suggests potential risk, especially if not documented or necessary for package functionality.
  • Obfuscation: The use of eval(), exec(), and os.system() indicates potential for code injection and execution, which are high-risk operations often associated with malicious intent.
  • Credentials: No patterns indicative of credential harvesting were detected.
  • Metadata: The maintainer has a new or inactive account and lacks a proper author name, raising some suspicion but not conclusive evidence of malice.

📦 Package Quality Overall: Medium (5.0/10)

✦ High Test Suite 9.0

Test suite present — 9 test file(s) found

  • Test runner config found: conftest.py
  • Test runner config found: pyproject.toml
  • 9 test file(s) detected (e.g. __init__.py)
◈ Medium Documentation 5.0

Some documentation present

  • Detailed PyPI description (8001 chars)
○ Low Contributing Guide 2.0

No contributing guide or governance files found

  • No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
◈ Medium Type Annotations 7.0

Partial type annotation coverage

  • Classifier: Typing :: Typed
  • Type checker (mypy / pyright / pytype) referenced in project
  • 79 type-annotated function signatures detected in source
○ Low Multiple Contributors 2.0

Single-author or unverifiable project

  • 1 unique contributor(s) across 8 commits in Prnvlol/agent-risk-analyzer
  • Single author with few commits — possibly a personal or throwaway project

🔬 Heuristic Checks

✓ Outbound Network Calls

No suspicious network call patterns found

⚠ Code Obfuscation score 10.0

Found 5 obfuscation pattern(s)

  • de) # dangerous result = eval(code) # also dangerous os.system(f"echo {code}") su
  • 6 AST-based scan for exec(), eval(), compile(), subprocess.*, os.system(), os.popen() — and ch
  • ary Python code execution via eval()", "compile": "Dynamic code compilation — can be used t
  • node.func # exec(), eval(), compile() bare calls if isinstance(func, ast.Name
  • "agent.py": "result = eval(user_input)" }) findings = detector.scan(ctx) as
⚠ Shell / Subprocess Execution score 10.0

Found 6 shell execution pattern(s)

  • l(code) # also dangerous os.system(f"echo {code}") subprocess.run(code, shell=True) ret
  • l(), compile(), subprocess.*, os.system(), os.popen() — and checks for sandbox indicators. """ from
  • tem"): "OS shell command via os.system()", ("os", "popen"): "OS shell pipe via os.popen()",
  • ), subprocess.*, os.system(), os.popen() — and checks for sandbox indicators. """ from __future__
  • popen"): "OS shell pipe via os.popen()", ("os", "execv"): "OS exec family via os.execv()",
  • os.system(f"echo {code}") subprocess.run(code, shell=True) return str(result) # VULN-005: Dange
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

✓ Git Repository History

Repository Prnvlol/agent-risk-analyzer appears legitimate

⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with arascan 
Create a Python-based mini-application named 'AIInspector' that leverages the 'arascan' package to perform static security analysis on AI agent codebases locally, without any configuration setup. This tool will be aimed at developers and security analysts who wish to quickly assess the security posture of their AI projects. The application should have a user-friendly command-line interface (CLI) that allows users to input a directory path containing the AI agent codebase they wish to analyze. Upon receiving the directory path, 'AIInspector' should utilize 'arascan' to scan the codebase for common security vulnerabilities and weaknesses specific to AI applications. After the scan is complete, the application should present a summary report detailing the findings, including potential security risks, suggestions for mitigation, and a risk score indicating the overall security posture of the analyzed codebase. Additionally, include the following features:
- Option to export the detailed analysis report to a file in JSON format.
- An option to specify custom rulesets for more targeted scans.
- Integration with popular version control systems like Git to analyze the latest commit or a specific branch.

To utilize 'arascan', ensure that your application initializes it with the provided codebase directory, invokes the scanning process, and then parses the results to generate the final report. Make sure to handle exceptions gracefully and provide informative error messages if something goes wrong during the analysis process.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!