Back to plugin
Pluginv27.2.15
Static analysis security
Gralkor · Deterministic local checks for risky code patterns and metadata mismatches.
Scanner verdict
SuspiciousApr 16, 2026, 11:16 AM
- Summary
- Detected: suspicious.dangerous_exec, suspicious.env_credential_access, suspicious.potential_exfiltration
- Reason codes
- suspicious.dangerous_execsuspicious.env_credential_accesssuspicious.potential_exfiltration
- Engine
- v2.4.0
Evidence
criticaldist/server-manager.js:160
Shell command execution detected (child_process).
proc = spawn(venvPython, ["-m", "uvicorn", "main:app", "--host", "127.0.0.1", "--port", String(opts.port), "--no-access-log"], {criticaldist/server-env.js:4
Environment variable access combined with network send.
// scanner doesn't see `process.env` and `fetch` co-occurring in one source —
warndist/server-manager.js:3
File read combined with network send (possible exfiltration).
import { mkdir, writeFile, readFile, unlink } from "node:fs/promises";