npm analyzed 1.4.0

ecc-agentshield

v1.4.0

npm

Security auditor for AI agent configurations. Scans Claude Code setups for vulnerabilities, misconfigs, and injection risks.

Drift inferred · capture-to-capture

capabilities0 tools

transport stdio · http counts 0 tools · 0 res · 0 prompts permission surface via code analysis

no tools enumerated yet for this server.

skills & danger signalsnpm-tarball

prompt-surface shipped agent-instruction files + hidden-content / dangerous-code findings — quoted from the analyzed source

analyzed v1.4.0 · analyzer v17 · 1d ago

committed secretOpenAI keypackage/dist/index.js:10369sk-pro…(38 chars, redacted)
committed secretGitHub tokenpackage/dist/index.js:10384ghp_re…(40 chars, redacted)

code evidencev1.4.0 · npm-tarball

evidence-backed findings quoted directly from the published source artifact — not inferred

fs package/dist/action.js :26 import { readFileSync as readFileSync2, writeFileSync, existsSync as existsSync2 } from "fs";
fs package/dist/index.js :46 import { readFileSync, existsSync, readdirSync, statSync } from "fs";
fs package/dist/miniclaw/index.js :41 import { mkdir, rm, stat, realpath, access } from "fs/promises";

shell package/dist/index.js :9452 import { spawn } from "child_process";
shell package/dist/miniclaw/index.js :197 pattern: /exec\s*\(|child_process|spawn\s*\(|system\s*\(/i,

net package/dist/index.js :9641 detail: "JavaScript fetch() call to external URL",
net package/dist/miniclaw/index.js :592 import { createServer } from "http";