🤖 AI Analysis

Final verdict: SUSPICIOUS

The package is moderately risky due to potential misuse of shell commands and low maintenance activity. While there is no direct evidence of malicious intent, the combination of these factors raises suspicion.

High shell risk due to execution of potentially unsanitized commands
Low maintenance and poor metadata quality

Per-check LLM notes

Network: The network calls seem to be part of the package's functionality, possibly for interacting with an API.
Shell: Executing shell commands can pose significant risks if not properly sanitized or intended for legitimate use within the application context.
Obfuscation: No obfuscation patterns detected, indicating low risk of malicious obfuscation.
Credentials: No credential harvesting patterns detected, indicating low risk of malicious credential theft.
Metadata: The package shows low maintenance activity and poor metadata quality, raising concerns about its legitimacy and potential risks.

📦 Package Quality Overall: Medium (5.2/10)

✦ High Test Suite 9.0

Test suite present — 4 test file(s) found

Test runner config found: pyproject.toml
4 test file(s) detected (e.g. test_api_client.py)

◈ Medium Documentation 5.0

Some documentation present

Detailed PyPI description (1804 chars)

○ Low Contributing Guide 2.0

No contributing guide or governance files found

No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found

◈ Medium Type Annotations 5.0

Partial type annotation coverage

69 type-annotated function signatures detected in source

◈ Medium Multiple Contributors 5.0

Limited contributor diversity

1 unique contributor(s) across 54 commits in ThiDinh21/archivedive
Single author but highly active (54 commits)

🔬 Heuristic Checks

⚠ Outbound Network Calls score 4.5

Found 3 network call pattern(s)

-> None: self._http = httpx.AsyncClient( base_url=BASE_URL, timeout=10.0,
(GAClient) client._http = httpx.AsyncClient( transport=httpx.MockTransport(handler), bas
t.db") client._http = httpx.AsyncClient( transport=httpx.MockTransport(handler),

✓ Code Obfuscation

No obfuscation patterns detected

⚠ Shell / Subprocess Execution score 4.0

Found 2 shell execution pattern(s)

try: subprocess.run(cmd, input=self.value.encode(),
): try: subprocess.run(cmd, input=text.encode(), check=True, capture_output=True)

✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: gmail.com>

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 2.5

Git history flags: Repository has zero stars and zero forks

Repository has zero stars and zero forks

⚠ Maintainer History score 6.0

3 maintainer concern(s) found

Author name is missing or very short
Author "" appears to have only 1 package on PyPI (new or inactive account)
Package has no PyPI classifiers (low effort / metadata quality)

✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with archivedive

Create a fully-functional mini-application named 'CardDive' using the Python package 'archivedive'. This application should serve as a user-friendly terminal interface (TUI) for browsing cards from the Grand Archive TCG, similar to how Scryfall works for Magic: The Gathering. Your task is to develop a tool that allows users to search, view, and interact with Grand Archive TCG cards directly from their command line interface. Here’s a step-by-step guide on how to approach this project:

1. **Setup Environment**: Start by setting up your Python environment. Ensure you have Python installed along with the 'archivedive' package. If not already installed, you can install it via pip.
2. **Initialize Project Structure**: Create a basic project structure including directories for source code, tests, and any necessary assets.
3. **Main Application File**: Develop the main application file where you will import and utilize functions from the 'archivedive' package. Focus on integrating key functionalities like searching for cards by name, set, or other attributes provided by the package.
4. **User Interface**: Design a simple yet intuitive TUI using Python libraries such as 'curses', 'prompt_toolkit', or 'rich'. This UI should allow users to navigate through different options and card details seamlessly.
5. **Search Functionality**: Implement robust search capabilities allowing users to find specific cards based on various criteria. Utilize the 'archivedive' package's search features to fetch data accurately.
6. **Display Card Details**: Once a card is selected or found, display its full details in a clear, readable format within the TUI.
7. **Additional Features**: Consider adding extra features such as saving favorite cards, filtering cards by rarity, or even a feature to download high-resolution images of the cards if available through the 'archivedive' package.
8. **Testing and Validation**: Write unit tests to ensure each part of your application works as expected. Validate that searches return correct results and that card details are displayed accurately.
9. **Documentation**: Provide clear documentation on how to run the application, what commands are supported, and how to use the various features.
10. **Deployment**: Finally, package your application so it can be easily distributed and run by others. Consider creating a setup.py file for easy installation via pip.

Your goal is to create a useful, efficient, and enjoyable tool for Grand Archive TCG enthusiasts who prefer command-line interfaces over web browsers.