Maestro AI Agent by RunMaestro

Findings (103)

• highHigh. Something risky that needs a close look before you install.
  dropper issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dropper issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  code-execution issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  exfiltration issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  exfiltration issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  exfiltration issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  exfiltration issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  exfiltration issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  exfiltration issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  exfiltration issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  exfiltration issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  credential-access issue

  Details are available to the maintainer after claiming this listing.
• highHigh. Something risky that needs a close look before you install.
  dependencies issue

  Details are available to the maintainer after claiming this listing.
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  scripts/set-version.mjs:59
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  scripts/showcase/capture.js:409
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  scripts/showcase/launch.js:27
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Runs shell commands. Fine for some tools, but it means the agent can run anything your user can.

  src/main/ipc/handlers/notifications.ts:231
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  electron@41.10.7: 8 known vulnerabilities

  GHSA-2p8c-gr87-2676, GHSA-3qxv-5xgr-q7w9, GHSA-98mx-cjp9-gchm, GHSA-997q-gvvc-jwmx, GHSA-fw47-9c62-h3vw +3 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@6.28.1: 5 known vulnerabilities

  GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-9fm3-97px-rjf6, GHSA-qrxm-fqhp-jwvm, GHSA-xjj6-f33q-929c

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  undici@7.29.1: 8 known vulnerabilities

  GHSA-2m5v-pch6-74hx, GHSA-4qv8-2p9j-2685, GHSA-4w7w-5xrc-9h26, GHSA-55wc-3pg8-jfw6, GHSA-9fm3-97px-rjf6 +3 more

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  zod@4.4.3: 1 known vulnerability

  GHSA-mrhx-c7xc-m3w5

  package-lock.json
• mediumMedium. Worth checking, often a vulnerable dependency or a setup problem.
  Install contacted hosts other than package registries

  artifacts.electronjs.org, www.electronjs.org
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/cli/commands/list-ssh-remotes.test.ts:33
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/cli/commands/update-ssh-remote.test.ts:38
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/integration/provider-integration.test.ts:67
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/integration/provider-integration.test.ts:74
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/integration/provider-integration.test.ts:2279
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/claude-session-storage.test.ts:1335
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/claude-session-storage.test.ts:1386
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/claude-session-storage.test.ts:1421
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/claude-session-storage.test.ts:1470
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Contacts a hard-coded IP address instead of a domain name.

  src/__tests__/main/ipc/handlers/filesystem.test.ts:1489
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/ipc/handlers/process.test.ts:2185
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/ipc/handlers/process.test.ts:2444
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/ipc/handlers/process.test.ts:2621
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/ipc/handlers/process.test.ts:3540
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/ipc/handlers/ssh-remote.test.ts:51
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/parsers/error-patterns.test.ts:807
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/__tests__/main/process-manager-coworking-injection.test.ts:228
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/process-manager/spawners/PtySpawner.test.ts:171
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/shared-history-manager.test.ts:232
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/ssh-remote-manager.test.ts:34
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/ssh-remote-manager.test.ts:167
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/ssh-remote-manager.test.ts:263
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/storage/claude-session-storage.test.ts:369
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/storage/copilot-session-storage.test.ts:50
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/storage/grok-session-storage.test.ts:61
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/context-groomer.test.ts:89
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/remote-fs.test.ts:32
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/remote-fs.test.ts:44
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/remote-git.test.ts:62
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-command-builder.test.ts:41
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-command-builder.test.ts:185
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-command-builder.test.ts:338
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-command-builder.test.ts:339
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-command-builder.test.ts:486
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-command-builder.test.ts:997
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-config-parser.test.ts:25
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-config-parser.test.ts:35
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-config-parser.test.ts:203
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-config-parser.test.ts:211
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-config-parser.test.ts:324
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-remote-resolver.test.ts:25
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-remote-resolver.test.ts:35
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-remote-resolver.test.ts:45
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-remote-resolver.test.ts:192
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/main/utils/ssh-remote-resolver.test.ts:230
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/__tests__/plugins/agent-flow-panel.test.ts:45
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Executes dynamically built code (eval / new Function / vm).

  src/__tests__/renderer/components/MainPanel/BrowserTabView.test.tsx:524
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/renderer/hooks/useSshRemotes.test.ts:12
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/shared/pathUtils.test.ts:48
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/shared/pathUtils.test.ts:48
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Downloads a script and pipes it straight into a shell (often an installer command shown to users; check where it runs).

  src/__tests__/shared/pianola/pianola-classifier.test.ts:281
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/shared/sshConnection.test.ts:45
• lowLow. Minor, or common in normal tools. Shown for information.
  In tests/examples/docs: Touches a sensitive credential location (SSH keys, cloud credentials, browser data or wallets). Expected for some tools, such as browser automation; check why.

  src/__tests__/shared/sshConnection.test.ts:48
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  3 matches in this file

  docs/maestro-cue-karpathy-loop.md:96
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/__tests__/main/debug-package/collectors.test.ts:203
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/__tests__/main/cue/cue-yaml-loader.test.ts:474
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/__tests__/main/wakatime-manager.test.ts:356
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  2 matches in this file

  src/__tests__/main/debug-package/sanitization.test.ts:339
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: private-key

  src/__tests__/main/debug-package/sanitization.test.ts:509
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/__tests__/shared/cli-server-discovery.test.ts:62
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  3 matches in this file

  src/__tests__/shared/agent-run/redact.test.ts:19
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: private-key

  src/__tests__/shared/dotEnv.test.ts:164
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  src/__tests__/renderer/hooks/useSettings.test.ts:1792
• lowLow. Minor, or common in normal tools. Shown for information.
  Possible example credential in docs/tests: generic-api-key

  5 matches in this file

  src/prompts/_maestro-cue.md:168
• lowLow. Minor, or common in normal tools. Shown for information.
  @vitest/mocker@4.1.11: 2 known vulnerabilities

  GHSA-qxg6-89mg-rqv8, GHSA-xp26-3454-mjgp

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  fast-uri@3.1.8: 4 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  fast-uri@4.2.1: 4 known vulnerabilities

  GHSA-333x-w4r6-6crp, GHSA-w74x-v6f9-j3xg, GHSA-wjr9-j795-jxcr, GHSA-xhq7-xmqj-769h

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  fastify@5.12.5: 1 known vulnerability

  GHSA-389g-gv7q-r4x8

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  glob@10.5.0: 1 known vulnerability

  GHSA-3g3m-2fjr-6pw4

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  glob@13.0.6: 1 known vulnerability

  GHSA-3g3m-2fjr-6pw4

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  ip-address@10.7.3: 1 known vulnerability

  GHSA-rxp7-6hxx-x8q5

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@10.2.5: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  minimatch@9.0.9: 1 known vulnerability

  GHSA-g3hv-75wg-m249

  package-lock.json
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a preinstall script

  node scripts/check-python.mjs

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a postinstall script

  patch-package && node scripts/ensure-electron.mjs && electron-rebuild -f -w node-pty,better-sqlite3

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  package.json has a prepare script

  node scripts/setup-git-hooks.mjs

  package.json
• lowLow. Minor, or common in normal tools. Shown for information.
  No manifest declaring network access and environment variables (agent.json)

Network activity