brokk-mj-core 2.61.1
medium severity process_spawn in build_script code (78 places): std::process::Command::new
19
low
Automated verdict. Nobody reviewed it. A score is a reason to look closer, not a finding.
Evidence
| Points | Signal | Where | What |
|---|---|---|---|
| 10 | static:process_spawn static · brokk-mj-core | build.rs:74 | medium severity process_spawn in build_script code (78 places): std::process::Command::new |
| 2 | static:credential_access static · brokk-mj-core | src/targets/ssh.rs:565 | medium severity credential_access in library code: ~/.ssh/known_hosts |
| 2 | static:environment_enumeration static · brokk-mj-core | src/login_environment.rs:20 | medium severity environment_enumeration in library code: std::env::vars_os |
| 2 | static:secret_environment_variable static · brokk-mj-core | src/config/harness.rs:2042 | medium severity secret_environment_variable in library code (6 places): OPENAI_API_KEY |
| 2 | static:yara:persistence_locations static · brokk-mj-core | src/login_environment.rs:241 | medium severity yara:persistence_locations in library code: Paths and keys used to persist on a developer machine |
| 1 | static:build_script static · brokk-mj-core | build.rs | low severity build_script in build_script code: build.rs |
Behavior
Profile
static:credential_access static:environment_enumeration static:process_spawn static:secret_environment_variable static:yara:persistence_locations
Static findings
10 groups
medium secret_environment_variable library 6
OPENAI_API_KEYsrc/config/harness.rs:2042 src/config/tests.rs:117GH_TOKENsrc/login_environment.rs:98 src/login_environment.rs:371 src/login_environment.rs:382GITHUB_TOKENsrc/login_environment.rs:98
medium process_spawn build_script 2
std::process::Command::newbuild.rs:74 build.rs:99
medium credential_access library 1
~/.ssh/known_hostssrc/targets/ssh.rs:565
medium environment_enumeration library 1
std::env::vars_ossrc/login_environment.rs:20
medium yara_match persistence_locations library 1
Paths and keys used to persist on a developer machinesrc/login_environment.rs:241
low process_spawn library 76
std::process::Command::newsrc/config/tests.rs:1520 src/config/tests.rs:1543 src/harness_install.rs:1577 src/harness_install.rs:1599 src/harness_install.rs:1630 src/harness_install.rs:1673 src/harness_install.rs:1938 src/harness_install.rs:2217 src/harness_install.rs:2417 src/local_git.rs:210 src/local_git.rs:243 src/local_git.rs:318 src/local_git.rs:326 src/local_git.rs:861 src/local_git.rs:1343 src/local_sockets.rs:153 src/repository.rs:514 src/repository.rs:535 src/repository.rs:555 src/subprocess.rs:78 src/subprocess.rs:810 src/subprocess.rs:828 src/subprocess.rs:842 src/subprocess.rs:863 src/subprocess.rs:931 src/subprocess.rs:956 src/subprocess.rs:983 src/subprocess.rs:1010 src/subprocess.rs:1028 src/subprocess.rs:1067 src/subprocess.rs:1079 src/subprocess.rs:1107 src/targets.rs:1086 src/targets/ssh.rs:2129 src/targets/ssh.rs:2402 src/targets/ssh.rs:2453 src/targets/ssh.rs:2467 src/targets/ssh.rs:2488 src/targets/storage.rs:881 src/targets/storage.rs:910 src/test_hooks.rs:158 src/test_hooks.rs:187 src/worker_build.rs:128 src/worker_build.rs:136 src/worker_build.rs:146 src/worker_build.rs:226 src/worker_build.rs:255tokio::process::Command::newsrc/harness_install.rs:515 src/harness_install.rs:540 src/harness_install.rs:1070 src/harness_install.rs:1105 src/harness_install.rs:1157 src/harness_install.rs:1181 src/subprocess.rs:683 src/subprocess.rs:719 src/subprocess.rs:756 src/subprocess.rs:766 src/subprocess.rs:772 src/subprocess.rs:785tokio::process::Commandsrc/harness_install.rs:1202 src/harness_install.rs:1401 src/subprocess.rs:103 src/subprocess.rs:202std::process::Commandsrc/harness_install.rs:1454 src/harness_install.rs:1459 src/subprocess.rs:304 src/subprocess.rs:389 src/subprocess.rs:537 src/subprocess.rs:584 src/subprocess.rs:599 src/subprocess.rs:611 src/subprocess.rs:623 src/targets.rs:870 src/targets.rs:1085 src/targets.rs:1102libc::forksrc/subprocess.rs:412
low network_access library 6
reqwest::Client::buildersrc/harness_install.rs:752reqwest::Proxy::allsrc/harness_install.rs:760reqwest::NoProxy::from_stringsrc/harness_install.rs:765reqwest::redirect::Policysrc/harness_install.rs:827reqwest::redirect::Policy::customsrc/harness_install.rs:828std::net::TcpListener::bindsrc/targets/ssh.rs:2900
low build_script build_script 1
build.rsbuild.rs
info url_literal library 114
model = "glm-5.3"\u{a}model_provider = "zai"\u{a}[model_providers.zai]\u{a}base_url = "https://api.z.ai/api/v1"\u{a}env_key = "ZAI_API_KEY"\u{a}wire_api = "responses"\u{a}src/codex_provider.rs:502 src/config/tests.rs:88https://api.z.ai/api/v1src/codex_provider.rs:513model_provider = "zai"\u{a}[model_providers.zai]\u{a}base_url = "https://api.z.ai/api/v1"\u{a}experimental_bearer_token = "secret"\u{a}wire_api = "responses"\u{a}src/codex_provider.rs:523model_provider = "zai"\u{a}[model_providers.zai]\u{a}base_url = "https://api.z.ai/api/v1"\u{a}experimental_bearer_token = "super-secret-token"\u{a}wire_api = "responses"\u{a}src/codex_provider.rs:540model_provider = "zai"\u{a}[model_providers.zai]\u{a}base_url = "https://api.z.ai/api/v1"\u{a}env_key = "ZAI_API_KEY"\u{a}wire_api = "chat"\u{a}src/codex_provider.rs:559model_provider = "zai"\u{a}[model_providers.zai]\u{a}base_url = "https://api.z.ai/api/v1"\u{a}wire_api = "responses"\u{a}src/codex_provider.rs:582model_provider = "zai"\u{a}model_catalog_json = "mine.json"\u{a}[model_providers.zai]\u{a}base_url = "https://api.z.ai/api/v1"\u{a}env_key = "ZAI_API_KEY"\u{a}wire_api = "responses"\u{a}src/codex_provider.rs:595https://mjolnir.brokk.ai/configuration/src/config.rs:582https://api.github.comsrc/config/github.rs:55Install it with `npm install -g @brokkai/dsh-acp` (Node.js 22 or newer), or from a release archive at https://github.com/BrokkAi/dsh-acp/releasessrc/config/harness.rs:755https://github.com/src/config/loading.rs:336 src/repository.rs:116ssh://git@github.com/src/config/loading.rs:338https://example.invalid/v1src/config/tests.rs:122model = "deepseek-flash"\u{a}model_provider = "deepseek"\u{a}\u{a}[model_providers.deepseek]\u{a}base_url = "https://api.deepseek.com/v1"\u{a}experimental_bearer_token = "inline-deepseek-key"\u{a}wire…src/config/tests.rs:290version: 1\u{a}records:\u{a} deepseek-account-platform/default:\u{a} kind: grant\u{a} payload:\u{a} version: 1\u{a} token: account-token\u{a} issuer: https://platform.deepseek.co…src/config/tests.rs:474https://gateway.examplesrc/config/tests.rs:563 src/config/tests.rs:580https://example.com/owner/reposrc/config/tests.rs:1303http://127.0.0.1:9411src/config/tests.rs:1404{}: config.toml needs a `version = {CONFIG_VERSION}` line at the top (the current configuration schema); see https://mjolnir.brokk.ai/configuration/src/config/tests.rs:2452model = "deepseek-v4-pro"\u{a}model_provider = "deepseek"\u{a}[model_providers.deepseek]\u{a}base_url = "https://api.deepseek.com/v1"\u{a}env_key = "DEEPSEEK_API_KEY"\u{a}wire_api = "responses"\u{a}src/config/tests.rs:3071model_provider = "ds"\u{a}[model_providers.ds]\u{a}base_url = "https://API.DeepSeek.com/v1/"\u{a}env_key = "DEEPSEEK_API_KEY"\u{a}wire_api = "responses"\u{a}src/config/tests.rs:3088https://auth.x.ai::grant-{index}src/credentials/tests.rs:69model_provider = "zai"\u{a}[model_providers.zai]\u{a}base_url = "https://api.z.ai/api/v1"\u{a}env_key = "ZAI_API_KEY"\u{a}wire_api = "responses"\u{a}src/credentials/tests.rs:603 src/credentials/tests.rs:876https://github.com/brokkai/mjolnir/pull/42src/github_item.rs:283https://nodejs.org/distsrc/harness_install.rs:27https://lookaside.facebook.com/lookaside/muse/download/?channel=muse&version={MUSE_VERSION}&file=muse-{muse_target}src/harness_install.rs:630https://registry.npmjs.org/@opencode/cli-{target}/-/{file}src/harness_install.rs:662https://code.kimi.ai/kimi-code/binaries/{KIMI_VERSION}/{filename}src/harness_install.rs:1284https://storage.googleapis.com/grok-build-public-artifacts/cli/{filename}src/harness_install.rs:1327https://code.kimi.com/kimi-code/binariessrc/harness_install.rs:1368https://x.ai/clisrc/harness_install.rs:1378https://nodejs.org/dist/v{NODE_VERSION}/{file}src/harness_install.rs:1814https://mirror.example/node/src/harness_install.rs:1819https://mirror.example/node/v{NODE_VERSION}/{file}src/harness_install.rs:1823https://nvm.example/nodesrc/harness_install.rs:1829https://mjolnir.example/node/src/harness_install.rs:1833https://mjolnir.example/node/v{NODE_VERSION}/{file}src/harness_install.rs:1838http://mirror.example/nodesrc/harness_install.rs:1842https://user:secret@mirror.example/nodesrc/harness_install.rs:1843https://mirror.example/node?token=secretsrc/harness_install.rs:1844http://{address}src/harness_install.rs:2063the project's Git repository has no remote; SSH and container targets clone the project from a network remote. Add one, for example `git remote add origin https://github.com/owner/repository.git`src/local_git.rs:533the project's Git remote is not a network URL (it is a local path or an unsupported transport); SSH and container targets need an https://, ssh://, git://, or user@host:path remotesrc/local_git.rs:537https://github.com/acme/app.gitsrc/local_git.rs:941https://github.com/me/fork.gitsrc/local_git.rs:943 src/local_git.rs:975 src/local_git.rs:976https://example.com/fetch.gitsrc/local_git.rs:1027 src/local_git.rs:1055 src/local_git.rs:1098 src/local_git.rs:1178 src/local_git.rs:1214 src/local_git.rs:1229 src/local_git.rs:1247ssh://git@example.com/push.gitsrc/local_git.rs:1036 src/local_git.rs:1059https://example.com/publish.gitsrc/local_git.rs:1046 src/local_git.rs:1057 src/local_git.rs:1186 src/local_git.rs:1237 src/local_git.rs:1248https://example.com/changed.gitsrc/local_git.rs:1118https://example.com/first.gitsrc/local_git.rs:1145 src/local_git.rs:1314https://example.com/second.gitsrc/local_git.rs:1150 src/local_git.rs:1318https://example.com/upstream.gitsrc/local_git.rs:1164 src/local_git.rs:1169 src/local_git.rs:1170ssh://git@example.com/one.gitsrc/local_git.rs:1200 src/local_git.rs:1218ssh://git@example.com/two.gitsrc/local_git.rs:1209 src/local_git.rs:1219url.https://example.com/.insteadOfsrc/local_git.rs:1269url.ssh://git@example.com/.pushInsteadOfsrc/local_git.rs:1275https://example.com/org/repo.gitsrc/local_git.rs:1281ssh://git@example.com/org/repo.gitsrc/local_git.rs:1282https://example.invalid/repo.gitsrc/path_completion.rs:236mj://prompt-contextsrc/relay.rs:165credential.https://github.com.helper=!f() { if [ "$1" = get ] && [ -n "${GH_TOKEN:-${GITHUB_TOKEN:-}}" ]; then printf '%s\n' username=x-access-token "password=${GH_TOKEN:-$GITHUB_TOKEN}"; else gh auth…src/remote_git.rs:147://src/remote_git.rs:218 src/remote_git.rs:231 src/remote_git.rs:290 src/remote_git.rs:310 src/remote_git.rs:336 src/repository.rs:121https://github.com/{owner}/{repository}.gitsrc/remote_git.rs:317https://github.com/BrokkAi/hel.gitsrc/remote_git.rs:493 src/remote_git.rs:494 src/remote_git.rs:558 src/state/tests.rs:692https://github.com/acme/widget.gitsrc/remote_git.rs:504ssh://git@github.com/acme/widget.gitsrc/remote_git.rs:505ssh://git@ssh.github.com:443/acme/widget.gitsrc/remote_git.rs:506https://gitlab.com/acme/widget.gitsrc/remote_git.rs:515ssh://git@ssh.github.com/acme/widgetsrc/remote_git.rs:519file:///tmp/reposrc/remote_git.rs:550ssh://git@example.com/repo.gitsrc/remote_git.rs:559git://example.com/repo.gitsrc/remote_git.rs:560https://user:secret@example.com/repo.gitsrc/remote_git.rs:570https://example.com/repo.gitsrc/remote_git.rs:571http://github.com/src/repository.rs:117ssh://github.com/src/repository.rs:120https://example.test/one.gitsrc/repository.rs:531https://example.test/two.gitsrc/repository.rs:532https://user:secret@example.com/Team/App.gitsrc/repository.rs:792git:https://example.com/Team/Appsrc/repository.rs:794https://example.com/team/app.gitsrc/repository.rs:797model_provider = "deepseek"\u{a}[model_providers.deepseek]\u{a}base_url = "https://api.deepseek.com/v1"\u{a}wire_api = "responses"\u{a}env_key = "DEEPSEEK_API_KEY"\u{a}src/review/settings.rs:162https://github.com/BrokkAi/bifrost-dev.gitsrc/state/tests.rs:873
info unsafe_code library 7
2 unsafe blocks, functions or implssrc/config/loading.rs:98 src/login_environment.rs:192 src/targets.rs:2511 src/targets/storage.rs:7081 unsafe blocks, functions or implssrc/harness_install.rs:2420 src/local_sockets.rs:4113 unsafe blocks, functions or implssrc/subprocess.rs:363
Run: check
failed- Ended
- agent reported the end
- Guest
- exit code 101
- Run time
- 355 ms
- VM restore
- 71 ms
- Payload
- 14992 files, 232.9 MiB
- Files opened
- 650
Processes 1
Siblings that ran the same program with the same result and the same processes below are folded into one row, with their number.
| Process | Arguments | Start | Took | Exit |
|---|---|---|---|---|
| cargo /usr/local/bin/cargo | check --locked --offline | 4 ms | 345 ms | 25856 |
Network 0
No network activity.
Files 0
Secrets opened
None.
Written outside the build directories
None.
Scratch disk 0
- Files
- 7
- Directories
- 12
- Size
- 56.6 KiB
- Compiled units
- 0
Nothing outside the build areas.
Output
Standard error
error: rustc 1.98.1 is not supported by the following packages: brokk-mj-core@2.61.1 requires rustc 1.99 brokk-mj-core@2.61.1 requires rustc 1.99 brokk-mj-core@2.61.1 requires rustc 1.99 Either upgrade rustc or select compatible dependency versions with `cargo update <name>@<current-ver> --precise <compatible-ver>` where `<compatible-ver>` is the latest version supporting rustc 1.98.1
Timeline
6
| When | From | To | Event | Worker |
|---|---|---|---|---|
| 2026-10-28 17:23 UTC | Discovered | Fetched | fetched | fetcher-12688 |
| 2026-10-28 17:23 UTC | Fetched | ReadyForSandbox | static_analysis_completed | static-12726 |
| 2026-10-28 17:23 UTC | ReadyForSandbox | Running | sandbox_started | orchestrator-12760-slot2 |
| 2026-10-28 17:23 UTC | Running | DynamicallyAnalyzed | sandbox_completed | orchestrator-12760-slot2 |
| 2026-10-28 17:23 UTC | DynamicallyAnalyzed | Scored | scored | analyzer-12816 |
| 2026-10-28 17:23 UTC | Scored | Done | finalized | analyzer-12816 |