Security audit
Security checks across malware telemetry and agentic risk
The scanner’s main command is a coherent local file scanner, but the package also includes an undocumented helper that can read from an external local “company-brain” resource and inject that context into vetting prompts.
Review this package before installing. The main scanner appears read-only and purpose-aligned, but the undocumented brain_enhance.py helper should be removed or clearly explained before trusting it in sensitive environments. Treat results as first-pass pattern matching, especially because some directories such as .env, .git, virtualenvs, and build output are skipped.
from typing import Dict, List
# Directories and file types to skip (reduces false positives)
SKIP_DIRS = {"node_modules", "__pycache__", ".git", ".venv", ".env", "venv", "dist", "build", ".next"}
SKIP_EXT = {".png", ".jpg", ".jpeg", ".gif", ".ico", ".svg", ".woff", ".woff2", ".ttf", ".eot",
".pyc", ".pyo", ".so", ".o", ".a", ".class", ".jar",
".mp3", ".mp4", ".avi", ".mov", ".wav",VirusTotal findings are pending for this skill version.
No suspicious patterns detected.