ariadne-skill

v0.1.3 suspicious
6.0
Medium Risk

Skill-first local delegation workflow for Codex and Claude Code.

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows moderate risk due to its use of obfuscation techniques and potential for shell injection. The lack of a public repository and limited package history add to the suspicion.

  • High shell risk due to 'shell=True'
  • Obfuscated code structure
  • No associated public repository
Per-check LLM notes
  • Network: The network calls appear to be health checks and seem benign.
  • Shell: The shell execution patterns could indicate the package is meant to interact with external tools, but the use of 'shell=True' can pose security risks.
  • Obfuscation: The code uses import statements within functions, which is a common obfuscation technique to hide dependencies and make static analysis harder.
  • Credentials: No clear patterns of credential harvesting were detected.
  • Metadata: The author has only one package and the repository is not found, indicating potential low activity or newness which raises some suspicion.

📦 Package Quality Overall: Low (4.4/10)

✦ High Test Suite 9.0

Test suite present — 39 test file(s) found

  • 39 test file(s) detected (e.g. helpers.py)
◈ Medium Documentation 5.0

Some documentation present

  • Detailed PyPI description (4920 chars)
○ Low Contributing Guide 2.0

No contributing guide or governance files found

  • No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • 88 type-annotated function signatures detected in source
○ Low Multiple Contributors 1.0

Could not retrieve contributor data from GitHub

  • GitHub API error: 404

🔬 Heuristic Checks

⚠ Outbound Network Calls score 3.0

Found 2 network call pattern(s)

  • url + _HEALTH_PATH req = urllib.request.Request( url, data=_probe_payload(),
  • tonic() try: with urllib.request.urlopen(req, timeout=timeout) as resp: resp.read
⚠ Code Obfuscation score 4.0

Found 2 obfuscation pattern(s)

  • server.socket.setsockopt(__import__("socket").SOL_SOCKET, __import__("socket").SO_REUSEADDR, 1) port
  • mport__("socket").SOL_SOCKET, __import__("socket").SO_REUSEADDR, 1) port = server.server_address[1] t
⚠ Shell / Subprocess Execution score 10.0

Found 6 shell execution pattern(s)

  • one try: result = subprocess.run( ["aider", "--version"], capture_out
  • if killed. """ proc = subprocess.Popen( cmd, cwd=cwd, text=True, st
  • out() try: proc = subprocess.run( command, shell=True, cw
  • non-zero exit.""" return subprocess.run( ["git", *args], cwd=repo, check=Fal
  • ATH"] = PYTHONPATH return subprocess.run( [sys.executable, "-m", "ariadne", *args], c
  • tedProcess[str]: result = subprocess.run( ["git", *args], cwd=cwd, check=Fals
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

No author email provided

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 3.0

Repository not found (deleted or private)

  • Repository not found (deleted or private)
⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Author "Albert ZHANG" appears to have only 1 package on PyPI (new or inactive account)
  • Package has no PyPI classifiers (low effort / metadata quality)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with ariadne-skill 
Create a fully-functional mini-application named 'SkillBot' that leverages the 'ariadne-skill' package to manage and delegate tasks efficiently between Codex and Claude Code. The application should serve as a task management system where users can input various tasks, and based on the complexity and nature of the task, it will be delegated to either Codex or Claude Code for execution. Here’s a detailed breakdown of what the application should do and include:

1. **User Interface**: Design a simple yet intuitive command-line interface (CLI) for interacting with 'SkillBot'. This interface should allow users to add new tasks, view existing tasks, and mark tasks as completed.
2. **Task Delegation**: Implement a feature within 'SkillBot' that analyzes each task inputted by the user and decides whether the task should be executed by Codex or Claude Code based on predefined criteria (e.g., complexity level, type of task).
3. **Task Execution**: Once a task is delegated, 'SkillBot' should communicate with either Codex or Claude Code through the 'ariadne-skill' package to execute the task.
4. **Feedback Loop**: After task completion, 'SkillBot' should provide feedback to the user about the status of the task and any results generated by Codex or Claude Code.
5. **Error Handling**: Ensure robust error handling mechanisms are in place to gracefully handle any issues that arise during task analysis, delegation, or execution.
6. **Logging and Reporting**: Include logging capabilities to track all interactions and outcomes, which can be useful for auditing and improving the efficiency of task delegation over time.

**Suggested Features**:
- Task categorization based on predefined types (e.g., data processing, code generation, etc.).
- A scoring system to evaluate task complexity dynamically.
- User authentication to differentiate between users and their respective task delegations.
- Integration with external APIs or services to enhance task execution capabilities.
- Customizable settings for users to tailor the behavior of 'SkillBot' according to their preferences.

**How 'ariadne-skill' Package is Utilized**:
- Use 'ariadne-skill' to define skills and workflows that correspond to different task types and complexities.
- Leverage the local delegation workflow provided by 'ariadne-skill' to efficiently route tasks to Codex or Claude Code based on real-time analysis.
- Integrate 'ariadne-skill' into the task execution phase to ensure seamless communication and execution of tasks by the appropriate service.

Your goal is to create a versatile and efficient task management tool that demonstrates the power and flexibility of the 'ariadne-skill' package in managing complex workflows.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!