axiom-apex

v3.0.1 suspicious
6.0
Medium Risk

Deterministic AI agent runtime — NL to schema-validated plans to reproducible tool execution

🤖 AI Analysis

Final verdict: SUSPICIOUS

The package shows several signs of potentially risky behavior, including high obfuscation risk and suspicious metadata, which together raise concerns about its legitimacy and purpose.

  • High obfuscation risk due to dynamic imports and environment variable manipulation
  • Suspicious metadata with a short maintainer history and quick commit cycles
Per-check LLM notes
  • Network: The network calls may be part of legitimate API interactions but require further investigation to confirm their purpose and destination.
  • Shell: Shell executions involving git and patch commands could be for version control or patch management, but the context is needed to determine if they are used appropriately.
  • Obfuscation: The code uses dynamic imports and environment variable manipulation which may indicate an attempt to evade detection or analysis, suggesting potential malicious intent.
  • Credentials: No direct evidence of credential harvesting is present in the provided code snippets.
  • Metadata: Suspiciously short maintainer history and quick commit cycle suggest potential risk.

📦 Package Quality Overall: Medium (5.0/10)

✦ High Test Suite 9.0

Test suite present — 6 test file(s) found

  • Test runner config found: conftest.py
  • Test runner config found: pyproject.toml
  • 6 test file(s) detected (e.g. test_logistics.py)
◈ Medium Documentation 5.0

Some documentation present

  • Detailed PyPI description (5698 chars)
○ Low Contributing Guide 4.0

No contributing guide or governance files found

  • Development Status classifier >= Beta
◈ Medium Type Annotations 5.0

Partial type annotation coverage

  • 131 type-annotated function signatures detected in source
○ Low Multiple Contributors 2.0

Single-author or unverifiable project

  • 1 unique contributor(s) across 7 commits in axiom-llc/axiom-apex
  • Single author with few commits — possibly a personal or throwaway project

🔬 Heuristic Checks

⚠ Outbound Network Calls score 9.0

Found 6 network call pattern(s)

  • tion}).encode() req = urllib.request.Request( f"{base_url}/query", data=p
  • try: with urllib.request.urlopen(req, timeout=60) as resp: data = jso
  • ncode() req = urllib.request.Request( f"{self._base}/api/generate",
  • ) with urllib.request.urlopen(req, timeout=300) as resp: data
  • pi_key url_req = urllib.request.Request(url, data=data_bytes, headers=headers, method="POST"
  • thod="POST") with urllib.request.urlopen(url_req, timeout=300) as response: r
⚠ Code Obfuscation score 6.0

Found 3 obfuscation pattern(s)

  • if hasattr(_ap, "json") else __import__("json").loads(_Path(sa.tasks).read_text()) apex_bin = sys.a
  • ools_dir)) _mcp_configs = __import__('json').loads(__import__('os').environ.get('APEX_MCP_SERVERS', '[]'
  • gs = __import__('json').loads(__import__('os').environ.get('APEX_MCP_SERVERS', '[]')) if _mcp_configs:
⚠ Shell / Subprocess Execution score 10.0

Found 6 shell execution pattern(s)

  • .CompletedProcess: return subprocess.run( ["git"] + args, cwd=REPO_ROOT, capt
  • ch_path = f.name result = subprocess.run( ["patch", "-p1", "--dry-run", "--fuzz=3", "-i", pat
  • err) return False subprocess.run(["patch", "-p1", "--fuzz=3", "-i", patch_path], cwd=REPO_ROO
  • h_path = f.name dry = subprocess.run( ["patch", "-p1", "--dry-run", "--fuzz=3", "-i",
  • return 0.0 subprocess.run(["patch", "-p1", "--fuzz=3", "-i", patch_path],
  • end("--mock") r = subprocess.run(cmd, capture_output=True, text=True,
✓ Credential Harvesting

No credential harvesting patterns detected

✓ Typosquatting

No typosquatting candidates detected

✓ Registered Email Domain

Email domain looks legitimate: proton.me>

✓ Suspicious Page Links

All external links appear legitimate

⚠ Git Repository History score 2.5

Git history flags: All 7 commits happened within 24 hours

  • All 7 commits happened within 24 hours
⚠ Maintainer History score 4.0

2 maintainer concern(s) found

  • Author name is missing or very short
  • Author "" appears to have only 1 package on PyPI (new or inactive account)
✓ Known CVE Vulnerabilities

No known vulnerabilities found in OSV database.

💡 AI App Starter Prompt

Use this prompt to build a project with axiom-apex 
Create a command-line utility called 'TaskMaster' using the Python package 'axiom-apex'. TaskMaster will allow users to define tasks as natural language instructions which are then converted into validated schemas and executed deterministically. Here's a step-by-step guide on what your application should achieve:

1. **Setup**: Begin by installing 'axiom-apex' and setting up a basic CLI framework using Python's argparse module.
2. **User Input**: Design a feature where users can input their tasks in natural language. These tasks could range from simple file operations like renaming files or copying directories to more complex tasks such as executing scripts under certain conditions.
3. **Schema Validation**: Utilize 'axiom-apex' to convert these natural language instructions into structured schemas. This ensures that the tasks are clear, unambiguous, and executable.
4. **Execution**: Implement a functionality within TaskMaster that takes these validated schemas and executes them in a deterministic manner. This means every time the same task is run, it should produce the exact same outcome.
5. **Logging & Feedback**: Integrate logging capabilities to keep track of all executed tasks and any errors encountered during execution. Provide feedback to the user about the status of each task.
6. **Security Measures**: Ensure that sensitive operations require explicit permission from the user before execution to prevent accidental data loss or security breaches.
7. **Customizability**: Allow users to extend TaskMaster by adding custom task definitions or modifying existing ones, leveraging the flexibility provided by 'axiom-apex'.

Your goal is to create a robust, user-friendly CLI tool that leverages the power of 'axiom-apex' to simplify complex task management and automation.

💬 Discussion Feed

Leave a comment

No discussion yet. Be the first to share your thoughts!