Is @mastra/core safe?
- Node.js shell/command execution
- Node.js filesystem read
- Node.js filesystem write/delete
@mastra/core is an AI npm_package analyzed by SkillTotal's deterministic static scanner. The scan found no malicious indicators, though 4 risky constructs are reported for review. It can: filesystem read, filesystem write, network egress and shell execution — capabilities are what the code can do, not a verdict on intent. Risk score 0/100 (low).
@mastra/core 1.60.0
Automated static-analysis result. It can contain false positives and false negatives, and is not a claim about the intent of @mastra/core's authors. Report a false positive.
Behavioral traits
How this component maps to the CSA agentic threat model. Descriptive — it never affects the risk score.
Findings (4)
The component can run operating-system commands or spawn processes.
const templateMatch = PATH_PLACEHOLDER.exec(rawPath.trim());
while ((match = pattern.exec(content)) !== null) detections.push({while ((m = regex.exec(text)) !== null) {const isolated = compilePattern(rule).exec(matched);
* const result = await exec('npm test');const templateMatch = PATH_PLACEHOLDER.exec(rawPath.trim());
while ((match = pattern.exec(content)) !== null) detections.push({while ((m = regex.exec(text)) !== null) {const isolated = compilePattern(rule).exec(matched);
* const result = await exec('npm test');* const result = await exec('npm test');const match = /^o(\d+)(?:-|$)/.exec(modelId);
const match = /^gpt-(\d+)(?:\.(\d+))?(?:-(.+))?$/.exec(modelId);
const match = dataUrlRegex.exec(value);
const match = /^o(\d+)(?:-|$)/.exec(modelId);
const match = /^gpt-(\d+)(?:\.(\d+))?(?:-(.+))?$/.exec(modelId);
const match = dataUrlRegex.exec(value);
import { execFile } from "child_process";const root = (await this.exec(dir, ["rev-parse", "--show-toplevel"])).trim();
const raw = await this.exec(dir, [
const raw = await this.exec(dir, ["show", `${commitHash}:${relPath}`]);exec(cwd, args) {let child_process = require("child_process");const root = (await this.exec(dir, ["rev-parse", "--show-toplevel"])).trim();
const raw = await this.exec(dir, [
Why it matters: Powerful and often legitimate — confirm the commands aren't built from untrusted input.
Fix: Confirm the command and its arguments are fully controlled and not derived from untrusted input; prefer execFile with an argument array.
The component reads files from disk.
const globalJsonContent = fs.readFileSync(GLOBAL_PROVIDER_REGISTRY_JSON(), "utf-8");
if (fs.existsSync(localJsonPath)) shouldCopyJson = globalJsonContent !== fs.readFileSync(localJsonPath, "utf-8");
const globalDtsContent = fs.readFileSync(GLOBAL_PROVIDER_TYPES_DTS(), "utf-8");
if (fs.existsSync(localDtsPath)) shouldCopyDts = globalDtsContent !== fs.readFileSync(localDtsPath, "utf-8");
const timestamp = fs.readFileSync(CACHE_FILE(), "utf-8").trim();
const content = fs.readFileSync(jsonPath, "utf-8");
const content = fs.readFileSync(filePath, "utf-8");
return r.fs.readFile(r.fsPath, options);
const content = await srcR.fs.readFile(srcR.fsPath);
content = await fs.readFile(filePath, "utf-8");
const content = await fs.readFile(filePath, { encoding: "utf-8" });return r.fs.readFile(r.fsPath, options);
const content = await srcR.fs.readFile(srcR.fsPath);
content = await fs.readFile(filePath, "utf-8");
const content = await fs.readFile(filePath, { encoding: "utf-8" });Why it matters: Usually legitimate, but worth confirming it can't be steered into reading sensitive files.
Fix: Confirm which files are read and that paths cannot be influenced by untrusted input to reach sensitive locations.
The component writes or deletes files on disk.
fs.writeFileSync(tempPath, content, encoding);
fs.unlinkSync(tempPath);
fs.unlinkSync(GLOBAL_PROVIDER_REGISTRY_JSON());
fs.unlinkSync(GLOBAL_PROVIDER_TYPES_DTS());
fs.writeFileSync(CACHE_FILE(), date.getTime().toString(), "utf-8");
fs.unlinkSync(jsonPath);
await fs.writeFile(tempPath, content, encoding);
await fs.unlink(tempPath);
await fs.rm(capDir, {* await fs.unlink(inputData.filepath);
* await fs.unlink(inputData.filepath);
* await fs.unlink(inputData.filepath);
return r.fs.writeFile(r.fsPath, content, options);
return r.fs.appendFile(r.fsPath, content);
await destR.fs.writeFile(destR.fsPath, content, { overwrite: options?.overwrite });return r.fs.writeFile(r.fsPath, content, options);
return r.fs.appendFile(r.fsPath, content);
await destR.fs.writeFile(destR.fsPath, content, { overwrite: options?.overwrite });Why it matters: Usually legitimate, but worth confirming the paths can't be controlled by untrusted input.
Fix: Confirm which files are written/deleted and that paths cannot be influenced by untrusted input.
The component makes outbound network requests.
* `fetch().arrayBuffer()` has ~2x peak memory overhead (undici buffers the
* `fetch().arrayBuffer()` has ~2x peak memory overhead (undici buffers the
import { ServerResponse as ServerResponse_2 } from 'node:http';import { ServerResponse } from 'node:http';* `fetch().arrayBuffer()` has ~2x peak memory overhead (undici buffers the
import { ServerResponse } from 'node:http';* `fetch().arrayBuffer()` has ~2x peak memory overhead (undici buffers the
import { ServerResponse } from 'node:http';* `fetch().arrayBuffer()` has ~2x peak memory overhead (undici buffers the
* `fetch().arrayBuffer()` has ~2x peak memory overhead (undici buffers the
import { ServerResponse } from 'node:http';* `fetch().arrayBuffer()` has ~2x peak memory overhead (undici buffers the
* `.fetch()` will be entry point of your app.
* return fetch('http://backend-service.com', clonedReq)const response = await this.#fetch(url, {const response = await this.#fetch(url, {const res = await fetch(url, {* the runtime hands `app.fetch(req, env, ctx)` the third arg).
const res = await fetch(url, {* the runtime hands `app.fetch(req, env, ctx)` the third arg).
const response = await fetch(versionUrl, { signal: controller.signal });const response = await fetch(versionUrl, { signal: controller.signal });* Maximum number of recent platform messages to fetch (default: 10).
* the runtime hands `app.fetch(req, env, ctx)` the third arg).
response = await fetch(url, options);
Why it matters: Usually legitimate, but confirm the destinations are expected and no sensitive data leaves.
Fix: Confirm the destination hosts are expected and that no sensitive data is sent off-host.
Check your own component
Run the same evidence-backed scan on any MCP server, agent skill, or package.
Scan your own componentHow we determine this: deterministic static analysis (regex + AST), evidence-anchored, no code execution. Methodology →