Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/runtime/activation/process-identity.js:5
- Evidence
const defaultExecuteText = (executable, args) => execFileSync(executable, args, {
Security audit
ExperienceEngine
Security checks across malware telemetry and agentic risk
Overview
ExperienceEngine is a disclosed local experience-learning plugin that observes agent runs, stores local task metadata, and can use remote providers only when configured or activated.
VirusTotal
58/58 vendors flagged this plugin as clean.
Static analysis
Detected: suspicious.dangerous_exec, suspicious.dynamic_code_execution, suspicious.exposed_secret_literal
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/runtime/activation/supervisor-launcher.js:10
- Evidence
export const NODE_SUPERVISOR_PROCESS_SPAWNER = (options) => spawn(options.executable, options.args, {
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- dist/runtime/activation/worker-launcher.js:10
- Evidence
export const NODE_WORKER_PROCESS_SPAWNER = (options) => spawn(options.executable, options.args, {
Shell command execution detected (child_process).
Critical
- Code
- suspicious.dangerous_exec
- Location
- node_modules/cross-spawn/index.js:7
- Evidence
function spawn(command, args, options) {
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/ajv/dist/compile/index.js:89
- Evidence
const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode);
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/ajv/dist/compile/jtd/parse.js:50
- Evidence
const makeParse = new Function(`${names_1.default.scope}`, sourceCode);
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/ajv/dist/compile/jtd/serialize.js:50
- Evidence
const makeSerialize = new Function(`${names_1.default.scope}`, sourceCode);
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/ajv/lib/compile/index.ts:171
- Evidence
const makeValidate = new Function(`${N.self}`, `${N.scope}`, sourceCode)
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/ajv/lib/compile/jtd/parse.ts:69
- Evidence
const makeParse = new Function(`${N.scope}`, sourceCode)
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/ajv/lib/compile/jtd/serialize.ts:65
- Evidence
const makeSerialize = new Function(`${N.scope}`, sourceCode)
Dynamic code execution detected.
Critical
- Code
- suspicious.dynamic_code_execution
- Location
- node_modules/depd/index.js:425
- Evidence
var deprecatedfn = new Function('fn', 'log', 'deprecate', 'message', 'site',
File appears to expose a hardcoded API secret or token.
Critical
- Code
- suspicious.exposed_secret_literal
- Location
- dist/distillation/providers/openai-compatible-factory.js:5
- Evidence
const apiKey = [REDACTED]);