Summary
rooben v0.1.1 was classified as CRITICAL RISK with a risk score of 1825. Sigil detected 98 findings across 369 files, covering phases including provenance, network exfiltration, obfuscation, credential access, code patterns, install hooks. Review the findings below before installing this package.
Package description: Rooben — Autonomous agent orchestration with verification, budget enforcement, and learning
v0.1.1
25 March 2026, 19:20 UTC
by Sigil Bot
Risk Score
1825
Findings
98
Files Scanned
369
Provenance
Findings by Phase
Phase Ordering
Phases are ordered by criticality, with the most dangerous at the top. Click any phase header to expand or collapse its findings. Critical phases are expanded by default.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
rooben-0.1.1/tests/e2e/helpers.py:11
def bypass_setup(browser: Browser) -> None:
"""Set localStorage to skip SetupWizard. Call after browser.open()."""Why was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
rooben-0.1.1/tests/e2e/helpers.py:17
def clear_setup(browser: Browser) -> None:
"""Clear all localStorage flags so SetupWizard/WelcomeHero show."""Why was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
rooben-0.1.1/tests/e2e/test_branding.py:12
@pytest.fixture(autouse=True)
def _setup(self, browser: Browser):
bypass_setup(browser)Why was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
rooben-0.1.1/tests/e2e/test_hints.py:20
"""Clear all hint dismissed keys so hints are visible."""
bypass_setup(browser)
# Clear all hint_dismissed_* keys from localStorageWhy was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
rooben-0.1.1/tests/e2e/test_p16_lifecycle_ux.py:34
browser.wait(1000)
clear_setup(browser)
browser.open("/")Why was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
rooben-0.1.1/tests/e2e/test_p16_studio.py:18
"""
bypass_setup(browser)
# Intercept the dashboard API call to return a mock response with 1 workflowWhy was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
rooben-0.1.1/tests/e2e/test_p19_p20_p21_verification.py:25
@pytest.fixture(autouse=True)
def _setup(self, browser: Browser):
bypass_setup(browser)Why was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
rooben-0.1.1/tests/e2e/test_setup_flow.py:20
"""Clear setup state before each test."""
clear_setup(browser)
yieldWhy was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
rooben-0.1.1/tests/e2e/test_setup_flow.py:153
def test_setup_persists_across_reload(self, browser: Browser):
bypass_setup(browser)
browser.open("/")Why was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
rooben-0.1.1/tests/e2e/test_sidebar.py:18
@pytest.fixture(autouse=True)
def _setup(self, browser: Browser):
browser.open("/")Why was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
rooben-0.1.1/tests/e2e/test_state_persistence.py:19
def test_setup_state_persists_across_reload(self, browser: Browser):
bypass_setup(browser)
browser.open("/")Why was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
rooben-0.1.1/tests/e2e/test_state_persistence.py:33
def test_persona_persists(self, browser: Browser):
bypass_setup(browser)
browser.eval("localStorage.setItem('rooben_persona', 'builder')")Why was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
rooben-0.1.1/tests/e2e/test_state_persistence.py:42
def test_welcome_dismissed_persists(self, browser: Browser):
bypass_setup(browser)
browser.eval("localStorage.setItem('rooben_welcome_dismissed', 'true')")Why was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
rooben-0.1.1/tests/e2e/test_state_persistence.py:51
def test_clear_setup_resets_all_state(self, browser: Browser):
bypass_setup(browser)
clear_setup(browser)Why was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
install-pip-setup-exec
CRITICALsetup.py executes code at install time
rooben-0.1.1/tests/e2e/test_welcome_onboarding.py:20
"""Reset welcome state so the hero is visible."""
bypass_setup(browser)
browser.eval("localStorage.removeItem('rooben_welcome_dismissed')")Why was this flagged?
This setup.py calls subprocess, os.system, exec, or eval during package installation. Legitimate packages rarely need to execute arbitrary commands at install time. This pattern is commonly used by malicious packages to download and run payloads, exfiltrate environment variables, or establish persistence. Rated CRITICAL because it runs with the installer's full permissions.
Badge
Markdown
[](https://sigilsec.ai/scans/380D0D44-CC1C-4076-9D08-4408D1E5C556)HTML
<a href="https://sigilsec.ai/scans/380D0D44-CC1C-4076-9D08-4408D1E5C556"><img src="https://sigilsec.ai/badge/pypi/rooben" alt="Sigil Scan"></a>Run This Scan Yourself
Scan your own packages
Run Sigil locally to audit any package before it touches your codebase.
Early Access
Get cloud scanning, threat intel, and CI/CD integration.
Join 150+ developers on the waitlist.
Get threat intelligence and product updates
Security research, new threat signatures, and product updates. No spam.
Other pypi scans
Believe this result is incorrect? Request a review or see our Terms of Service and Methodology.