Interactive CLI tool for Bike4Mind with ReAct agents
Drift inferred · capture-to-capture
No drift recorded — single capability capture; advisories appear once its surface changes.
transport stdio · http counts 0 tools · 0 res
· 0 prompts
permission surface via code analysis
No tools enumerated yet for this server.
prompt-surface
shipped agent-instruction files + hidden-content / dangerous-code findings —
quoted from the analyzed source
analyzed v0.18.5 · analyzer v33 · 4w ago
danger signals4
- dynamic code execution new Function() package/dist/ConfigStore-D39UqFnY.mjs :4004
- NEVER use eval(), new Function(), the Function constructor, document.write/writeln, or string-form setTimeout/setInterval (e.g. setTimeout("code", ms)) — directly or via aliases/string-concat. They - dynamic code execution eval() package/dist/ConfigStore-D39UqFnY.mjs :4004
- NEVER use eval(), new Function(), the Function constructor, document.write/writeln, or string-form setTimeout/setInterval (e.g. setTimeout("code", ms)) — directly or via aliases/string-concat. They - dynamic code execution setTimeout(string) package/dist/ConfigStore-D39UqFnY.mjs :4004
tring-form setTimeout/setInterval (e.g. setTimeout("code", ms)) — directly or via aliases/string-concat. They auto-reject the publish. Pass real function references to timers; parse with JSON.parse; b - credential in logs credential in log package/dist/index.mjs :8322
console.log(`Expires: ${new Date(authTokens.expiresAt).toLocaleString()}`);
evidence-backed
findings quoted directly from the published source artifact — not inferred
code files: 38
filesystem 18
- fs package/bin/bike4mind-cli.mjs :23
import { existsSync } from 'fs'; - fs package/dist/BackgroundAgentManager-D-xsWd3C.mjs :8
import { existsSync, promises, readFileSync, readdirSync, rmSync, statSync, unlinkSync, writeFileSync } from "fs"; - fs package/dist/ConfigStore-D39UqFnY.mjs :4
import { existsSync, promises } from "fs"; - fs package/dist/ImageStore-BVmEG1xc.mjs :3
import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "fs"; - fs package/dist/SandboxRuntimeAdapter-ChGlxSGQ.mjs :2
import { accessSync, constants } from "fs"; - fs package/dist/SeatbeltRuntime-Qqt19cAN.mjs :3
import { mkdtempSync, writeFileSync } from "fs"; - fs package/dist/ViolationLogStore-B-plqJfn.mjs :2
import { promises } from "fs"; - fs package/dist/commands/doctorCommand.mjs :6
import { existsSync } from "fs"; - fs package/dist/createFile-DPv180yF-BnWFIxey.mjs :3
import { existsSync, promises } from "fs"; - fs package/dist/deleteFile-BdjUwUQF-B3XOJmg3.mjs :3
import { existsSync, promises, statSync } from "fs"; - fs package/dist/globFiles-DjfDGaUK-CNR8pMRC.mjs :4
import { stat } from "fs/promises"; - fs package/dist/grepSearch-DJs-cubo-Bm0Y8oS3.mjs :4
import { existsSync } from "fs";
show 6 more
- fs package/dist/index.mjs :11
import { existsSync, promises, readFileSync, statSync } from "fs"; - fs package/dist/pathValidation-D8tjkQXE-1HwvsuYT.mjs :2
import { realpathSync } from "fs"; - fs package/dist/ripgrepCheck-BmkyTK2i.mjs :2
import { access, constants } from "fs/promises"; - fs package/dist/terminalSetup-BbJt04ZG.mjs :2
import { existsSync, promises } from "fs"; - fs package/dist/treeSitterEngine-BRbQ9b7I.mjs :2
import { readFileSync } from "fs"; - fs package/dist/updateChecker-C8xsNY2L.mjs :3
import { constants, promises } from "fs";
shell / exec 7
- shell package/dist/BackgroundAgentManager-D-xsWd3C.mjs :6
import { execFile, execFileSync, spawn } from "child_process"; - shell package/dist/bashExecute-B1N1lMOS-TZVDbcQ4.mjs :2
import { spawn } from "child_process"; - shell package/dist/commands/doctorCommand.mjs :5
import { execSync } from "child_process"; - shell package/dist/commands/updateCommand.mjs :5
import { execSync, spawnSync } from "child_process"; - shell package/dist/grepSearch-DJs-cubo-Bm0Y8oS3.mjs :3
import { execFile } from "child_process"; - shell package/dist/index.mjs :9
import { execSync, spawn } from "child_process"; - shell package/dist/updateChecker-C8xsNY2L.mjs :2
import { execSync } from "child_process";
network 4
- net package/dist/BackgroundAgentManager-D-xsWd3C.mjs :24
import axios, { isAxiosError } from "axios"; - net package/dist/ProxyManager-CV94yZUW.mjs :3
import http from "http"; - net package/dist/index.mjs :25
import axios, { isAxiosError } from "axios"; - net package/dist/updateChecker-C8xsNY2L.mjs :6
import axios from "axios";
secrets 1
- secrets package/dist/index.mjs :5745
const token = process.env.JUPYTER_TOKEN;
database 1
- db package/dist/ImageStore-BVmEG1xc.mjs :6
import Database from "better-sqlite3";
install hooks 1
- postinstall (suspicious) package/package.json :148
node -e "try { require('better-sqlite3') } catch(e) { if(e.message.includes('bindings')) { console.log('\n⚠️ Rebuilding better-sqlite3 native bindings...'); require('child_process').execSync('pnpm re
declared dependencies 94
- @modelcontextprotocol/sdk@1.29.0
- @anthropic-ai/sdk@^0.97.1
- @aws-sdk/client-apigatewaymanagementapi@^3.1069.0
- @aws-sdk/client-bedrock-runtime@^3.1069.0
- @aws-sdk/client-cloudwatch@^3.1069.0
- @aws-sdk/client-lambda@^3.1069.0
- @aws-sdk/client-s3@^3.1069.0
- @aws-sdk/client-sqs@^3.1069.0
- @aws-sdk/client-transcribe@^3.1069.0
- @aws-sdk/credential-provider-node@^3.972.56
- @aws-sdk/s3-request-presigner@^3.1069.0
- @casl/ability@^6.8.1
show 28 more
- @google/genai@^1.46.0
- @joplin/turndown-plugin-gfm@^1.0.67
- @mendable/firecrawl-js@^1.29.3
- @octokit/rest@^22.0.1
- @opensearch-project/opensearch@2.11.0
- @smithy/node-http-handler@^4.8.0
- async-mutex@^0.5.0
- axios@1.16.1
- bcryptjs@^3.0.2
- better-sqlite3@^12.10.0
- cheerio@1.2.0
- chess.js@^1.0.0-beta.8
- cli-highlight@^2.1.11
- csv-parse@^6.2.1
- dayjs@^1.11.20
- diff@^9.0.0
- dotenv@^17.4.2
- eventsource-parser@^3.0.8
- exceljs@^4.4.0
- fdir@^6.5.0
- file-type@^22.0.1
- fuse.js@^7.3.0
- fzf@^0.5.2
- glob@^13.0.6
- gray-matter@^4.0.3
- ignore@^7.0.5
- ink@^7.0.3
- ink-select-input@^6.2.0
54 more not shown — this panel samples each group; the count above is the real total.