autocode-agent

v1.0.0 suspicious
6.0
Medium Risk

Autonomous AI coding agent CLI — like Claude Code, works with any OpenAI-compatible API

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows significant risks related to shell execution and obfuscation techniques, which may indicate malicious intent or poor coding practices. Despite no clear evidence of credential theft or network abuse, the overall risk profile is elevated due to the potential for code injection and local system manipulation.

  • High shell risk
  • High obfuscation risk
Per-check LLM notes
  • Network: The detected network patterns are likely for legitimate HTTP requests to external services.
  • Shell: The shell execution patterns indicate potential local system interaction, which could be risky if the package is not intended to perform such operations.
  • Obfuscation: The use of eval() and exec() can be a sign of obfuscation or code injection, which is risky unless proven otherwise.
  • Credentials: No patterns indicating credential harvesting were found.
  • Metadata: The repository not being found and the maintainer having a new or inactive account raises concerns.

📦 Package Quality Overall: Low (4.0/10)

○ Low Test Suite 1.0

No test suite detected

  • No test files or test-runner configuration detected
◈ Medium Documentation 7.0

Some documentation present

  • Documentation URL: "Documentation" -> https://github.com/ALLAY-XD-20/autocode-agent#readme
  • Detailed PyPI description (15054 chars)
○ Low Contributing Guide 4.0

No contributing guide or governance files found

  • Development Status classifier >= Beta
◈ Medium Type Annotations 7.0

Partial type annotation coverage

  • Type checker (mypy / pyright / pytype) referenced in project
  • 78 type-annotated function signatures detected in source
○ Low Multiple Contributors 1.0

Could not retrieve contributor data from GitHub

  • GitHub API error: 404

🔬 Heuristic Checks

⚠ Outbound Network Calls score 6.0

Found 4 network call pattern(s)

  • try: with httpx.Client(timeout=self.timeout) as client: resp = clie
  • try: with httpx.Client(timeout=self.timeout) as client: with client
  • /json"} try: with httpx.Client(timeout=15.0) as client: resp = client.get(url,
  • ()] = v.strip() with httpx.Client(timeout=timeout) as client: req_kwargs: dict[str
⚠ Code Obfuscation score 2.0

Found 1 obfuscation pattern(s)

  • (r'eval\s*\(', "Dangerous eval() usage"), (r'exec\s*\(', "Dangerous exec() usage"),
⚠ Shell / Subprocess Execution score 10.0

Found 6 shell execution pattern(s)

  • tr: try: result = subprocess.run( ["grep", "-rn", "--include=*", pattern, directo
  • }") try: result = subprocess.run( command, shell=True, capture_output=True, text=
  • d: str = ".") -> str: r = subprocess.run(["git"] + args, capture_output=True, text=True, cwd=cwd, tim
  • y: str = ".") -> str: r = subprocess.run( ["git", "diff", "--name-only", "--diff-filter=U"],
  • dit = "" try: r = subprocess.run(["pip-audit", "--format=json"], capture_output=True, text=Tr
  • try: r = subprocess.run( ["python3", "-c", f"import yaml; yaml.safe_
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: gmail.com>

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 3.0

Repository not found (deleted or private)

  • Repository not found (deleted or private)
⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Only one version has ever been released — brand new package
  • Author "AutoCode" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with autocode-agent 
Create a fully-functional command-line tool named 'AutoCodeHelper' using the Python package 'autocode-agent'. This tool will serve as an autonomous coding assistant that can generate code snippets based on user prompts, making it easier for developers to write code without manually writing every line. Here are the key steps and features of the project:

1. **Setup**: Install the required packages including 'autocode-agent', and ensure it's configured to work with your preferred OpenAI-compatible API.
2. **Core Functionality**: Implement the ability to generate code snippets from natural language descriptions provided by the user. For example, a user could input 'create a function that sorts an array using bubble sort' and the tool would output the corresponding Python code.
3. **Interactive Mode**: Add an interactive mode where users can ask follow-up questions about the generated code, such as clarifying certain parts or requesting additional functionality.
4. **History Tracking**: Keep a history of previous interactions so that users can review past requests and responses.
5. **Customization**: Allow users to customize the code style and conventions according to their preferences (e.g., naming conventions, indentation).
6. **Error Handling**: Implement robust error handling to manage cases where the AI-generated code might not compile or run correctly.
7. **Documentation**: Provide comprehensive documentation for both end-users and developers who wish to extend the functionality of AutoCodeHelper.

Utilize the 'autocode-agent' package by integrating its core functionalities into each of these steps. Specifically, leverage its ability to interact with AI models through an OpenAI-compatible API to generate code snippets, handle user interactions, and manage the state of the session.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!