AI Analysis
The package has low risks associated with network calls, obfuscation, and credential harvesting. However, there is a moderate risk due to shell execution, and high metadata risk due to low activity and potential lack of maintenance.
- Shell risk detected, requires further investigation.
- Repository shows signs of low activity and potential lack of maintenance.
Per-check LLM notes
- Network: No network calls detected, which is normal and does not indicate any risk.
- Shell: Detection of shell execution may be part of the package's functionality for running tests or other scripts, but should be reviewed for its purpose to ensure it is not being used maliciously.
- Obfuscation: No obfuscation patterns detected, indicating low risk of malicious obfuscation.
- Credentials: No credential harvesting patterns detected, indicating low risk of malicious credential theft.
- Metadata: The repository shows signs of low activity and potential lack of maintenance, raising concerns about its legitimacy and intent.
Package Quality Overall: Low (4.6/10)
Test suite present — 4 test file(s) found
Test runner config found: pyproject.toml4 test file(s) detected (e.g. test_errors.py)
Some documentation present
Detailed PyPI description (840 chars)
No contributing guide or governance files found
No CONTRIBUTING, CODE_OF_CONDUCT, or governance files found
Partial type annotation coverage
16 type-annotated function signatures detected in source
Single-author or unverifiable project
1 unique contributor(s) across 1 commits in yurisachan16-creator/astrbot_proactive_coreSingle author with few commits — possibly a personal or throwaway project
Heuristic Checks
No suspicious network call patterns found
No obfuscation patterns detected
Found 1 shell execution pattern(s)
script_passes(): result = subprocess.run( [sys.executable, str(ROOT / "scripts" / "smoke_chec
No credential harvesting patterns detected
No typosquatting candidates detected
No author email provided
All external links appear legitimate
Git history flags: Repository has zero stars and zero forks
Repository has zero stars and zero forksVery few commits: 1 totalSingle contributor with only 1 commit(s) — possibly throwaway account
3 maintainer concern(s) found
Only one version has ever been released — brand new packageAuthor "aitwo" appears to have only 1 package on PyPI (new or inactive account)Package has no PyPI classifiers (low effort / metadata quality)
No known vulnerabilities found in OSV database.
AI App Starter Prompt
Build a simple Python application using the astrbot-proactive-core package to demonstrate its core features.
💬 Discussion Feed
No discussion yet. Be the first to share your thoughts!
Report Abuse / Security Issue