Skip to content
Open-Source Registry

cargo / montagent-core / 0.3.0

montagent-core 0.3.0

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured 3 detections
processes
417
operations
58K
packages
294
compiler runs
186
connections
3
job time
4m 36s
capture
775 KB
records
107K
bytes / record
7.2

Build behaviourundeclared fetchlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run 5a8e10c7-a18c-42cd-a6f0-8dbcf399faba · built 2026-10-14 · complete

Artifact

file · retained · product · graph v2
1

Checks

11 of 14 clear Network activity Data flow analysis +1 more
Build behavior▲✓✓✓✓▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

3
  • Uncompiled library linked
    libskia-bindings.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskia.a › github.com, release-assets.githubusercontent.com
    high
  • Build script reached github.com +1
    skia-bindings 0.153.2 › github.com:443, release-assets.githubusercontent.com:443
    medium

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/skia/libskia-bindings.awritten by build_script_build-980d8f6ef937e364
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · Montagent

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0260d93e48425b4b39f-x86_64-unknown-linux-gnu-jpegd-jpege-pdf.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0
  3. /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/skia/libskia-bindings.avia /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build_script_build-980d8f6ef937e364, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-980d8f6ef937e364 from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      skia-bindings asked the linker for it: static skia-bindings (target/release/build/skia-bindings-f101f4f5dceb5a2b/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build_script_build-980d8f6ef937e364, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-980d8f6ef937e364 from a pipe without a recorded source compilation
  • skia-bindings asked the linker for it: static skia-bindings (target/release/build/skia-bindings-f101f4f5dceb5a2b/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2471
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2471
  3. build-script-build/home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build-script-build4463

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/skia/libskia.awritten by build_script_build-980d8f6ef937e364
Destination
github.com, release-assets.githubusercontent.com
Jobs
build-test
Rule
object-provenance · Montagent

Witness chain

  1. github.com:443
    source
  2. /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0260d93e48425b4b39f-x86_64-unknown-linux-gnu-jpegd-jpege-pdf.tar.gzvia curl -L -f -sS -C - --create-dirs --output /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0
  3. /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/skia/libskia.avia /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build-script-build
    • Object written under a build script that downloadedfrom github.com · release-assets.githubusercontent.com

      written under the build script at /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build_script_build-980d8f6ef937e364, which downloaded from github.com, release-assets.githubusercontent.com

    • Obfuscated toolchain bypass

      Written by build_script_build-980d8f6ef937e364 from a pipe without a recorded source compilation

    • Asked for by the build's own declaration

      skia-bindings asked the linker for it: static skia (target/release/build/skia-bindings-f101f4f5dceb5a2b/output)

    subject
  4. dependency
    artifact

Evidence

  • written under the build script at /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build_script_build-980d8f6ef937e364, which downloaded from github.com, release-assets.githubusercontent.com
  • Written by build_script_build-980d8f6ef937e364 from a pipe without a recorded source compilation
  • skia-bindings asked the linker for it: static skia (target/release/build/skia-bindings-f101f4f5dceb5a2b/output)

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2471
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2471
  3. build-script-build/home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build-script-build4463

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

mediumwitnessed

Build script reached github.com +1

Unexpected network connection

Subject
skia-bindings 0.153.2
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -L -f -sS -C - --create-dirs --output /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -L -f -sS -C - --create-dirs --output /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0…

  3. What a build script's fetch becamesupport

    1 file came down; nothing the build compiled, linked or ran

  4. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build_script_build-980d8f6ef937e364

  5. Tool commandsupport

    Command: curl -L -f -sS -C - --create-dirs --output /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0…

    by curl -L -f -sS -C - --create-dirs --output /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0…

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -L -f -sS -C - --create-dirs --output /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2471
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2471
  3. build-script-build/home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build-script-build4463
  4. curlcurl -L -f -sS -C - --create-dirs --output /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0…4484

Remediation

The build script connected to the network while compiling. Nothing it downloaded was compiled, linked or run. Build the crate from what the registry ships, or accept the download after reviewing it.

Network

3 peers
  • github.com:443 build code of skia-bindings · curl · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 build code of skia-bindings · curl · Fastly, Inc. · 1 file undeclared
  • static.crates.io:8080 the package manager · cargo (Montagent) via crates.io · 16,145 files · went into an output ecosystem
Dependencies309Build behaviour
adler22.0.1
aho-corasick1.1.5
aligned0.4.3
aligned-vec0.6.4
android_system_properties0.1.6
anyhow1.0.104build script
arbitrary1.4.2
arg_enum_proc_macro0.3.4proc macro
arrayvec0.7.8
as-slice0.2.1
atomic-waker1.1.2
autocfg1.5.1
av-scenechange0.14.1build script
av1-grain0.2.5
avif-serialize0.8.9
base640.22.1
base640.23.1
bindgen0.72.1build script
bit_field0.10.3
bitflags2.13.2
bitstream-io4.10.0
block-buffer0.10.4
built0.8.1
bumpalo3.20.3
bytemuck1.25.2
bytemuck_derive1.12.1proc macro
byteorder-lite0.1.0
bytes1.12.1
cc1.4.6
cexpr0.6.0
cfg-if1.0.5
cfg_aliases0.2.2
chacha200.10.2
chrono0.4.45
clang-sys1.9.1build script
color_quant1.1.0
core-foundation-sys0.8.7
cpufeatures0.2.17
cpufeatures0.3.1
crc32fast1.5.2build script
crossbeam-deque0.8.8build script
crossbeam-epoch0.9.21build script
crossbeam-utils0.8.23build script
crunchy0.2.4build script, not run
crypto-common0.1.7
digest0.10.7
displaydoc0.2.7proc macro
dyn-clone1.0.20
either1.18.0
equator0.4.2
equator-macro0.4.2proc macro
equivalent1.0.2
errno0.3.14
exr1.74.2
fax0.2.7
fdeflate0.3.7
filetime0.2.29
find-msvc-tools0.1.12
flate21.1.10
foldhash0.2.0
font-types0.12.5
fontique0.11.1
form_urlencoded1.2.2
futures-channel0.3.34
futures-core0.3.34
futures-io0.3.34
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
generic-array0.14.7build script
getrandom0.2.17
getrandom0.3.4build script, not run
getrandom0.4.3build script, not run
gif0.14.2
glob0.3.4
half2.7.1
harfrust0.12.0
hashbrown0.17.1
heck0.5.0
http1.5.0
http-body1.1.0
http-body-util0.1.5
httparse1.10.1build script
hyper1.12.0
hyper-rustls0.27.10
hyper-util0.1.21
iana-time-zone0.1.65
iana-time-zone-haiku0.1.2build script, not run
icu_collections2.3.0
icu_locale_core2.3.0
icu_locale_fallback2.3.0
icu_locale_fallback_data2.3.0build script
icu_normalizer2.3.0
icu_normalizer_data2.3.0build script
icu_properties2.3.0
icu_properties_data2.3.0build script
icu_provider2.3.1
icu_segmenter2.3.0
icu_segmenter_data2.3.0build script
idna1.1.0
idna_adapter1.2.2
image0.25.10
image-webp0.2.4
imgref1.12.3
indexmap2.14.2
interpolate_name0.2.4proc macro
ipnet2.12.2
itertools0.13.0
itertools0.14.0
itoa1.0.18
jobserver0.1.35
js-sys0.3.105
ld-linux-x86-64.so.2system library
lebe0.5.3
libc0.2.189build script
libc.so.6system library
libfuzzer-sys0.4.13build script, not run
libgcc_s.so.1system library
libloading0.8.9
libm0.2.16build script
libm.so.6system library
libmvec.so.1system library
linebender_resource_handle0.1.1
linux-raw-sys0.12.1
litemap0.8.3
log0.4.34
loop90.1.5
lru-slab0.1.3
maybe-rayon0.1.1
memchr2.8.3
memmap20.9.11
minimal-lexical0.2.1
miniz_oxide0.8.9
miniz_oxide0.9.1
mio1.2.4
montagent-render0.3.0
montagent-text0.3.0
moxcms0.8.1
new_debug_unreachable1.0.6
no_std_io20.9.4
nom7.1.3
nom8.0.0
noop_proc_macro0.3.0proc macro
num-bigint0.4.8
num-complex0.4.6
num-derive0.4.2proc macro
num-integer0.1.47
num-rational0.4.2
num-traits0.2.19build script
once_cell1.21.4
parlance0.1.0
parley0.11.1
parley_data0.11.1
paste1.0.15build scriptproc macro
pastey0.1.1proc macro
percent-encoding2.3.2
pin-project-lite0.2.17
pkg-config0.3.34
png0.18.1
potential_utf0.1.6
ppv-lite860.2.21
prettyplease0.2.37build script
proc-macro21.0.107build script
profiling1.0.18
profiling-procmacros1.0.18proc macro
pulp0.22.3build script
pulp-wasm-simd-flag0.1.1
pxfm0.1.30
qoi0.4.1
quick-error2.0.1
quinn0.11.12build script, not run
quinn-proto0.11.19
quinn-udp0.5.16build script, not run
quote1.0.47build script
r-efi5.3.0
r-efi6.0.0
rand0.10.3
rand0.9.5
rand_chacha0.9.0
rand_core0.10.1
rand_core0.9.5
rand_pcg0.10.2
rav1e0.8.1build script
ravif0.13.0
raw-cpuid11.6.0
rayon1.12.0
rayon-core1.13.0build script
read-fonts0.41.0
read-fonts0.43.3
reborrow0.5.5
ref-cast1.0.27build script
ref-cast-impl1.0.27proc macro
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
reqwest0.12.28
rgb0.8.53
ring0.17.14build scriptprebuilt objects
rustc-hash2.1.3
rustix1.1.5build script
rustls0.23.45build script
rustls-pki-types1.15.1
rustls-webpki0.103.15
rustversion1.0.23build script, not runproc macro
ryu1.0.23
schemars1.2.2
schemars_derive1.2.2proc macro
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_derive_internals0.30.0
serde_json1.0.151build script
serde_spanned1.1.1
serde_urlencoded0.7.1
sha20.10.9
shlex1.3.0
shlex2.0.1
simd-adler320.3.10
simd_helpers0.1.0proc macro
skia-bindings0.153.2build scriptnetworkruns toolsgithub.com, release-assets.githubusercontent.com, curl, git
skia-safe0.153.2
skrifa0.44.0
skrifa0.46.2
slab0.4.12
smallvec1.16.1
socket20.6.5
stable_deref_trait1.2.1
subtle2.6.1
syn2.0.119
syn3.0.6
sync_wrapper1.0.2
synstructure0.14.0
tar0.4.46
thiserror2.0.20build script
thiserror-impl2.0.20proc macro
tiff0.11.3
tinystr0.8.4
tinyvec1.13.3
tokio1.53.1
tokio-rustls0.26.6
toml1.1.6+spec-1.1.0
toml_datetime1.1.1+spec-1.1.0
toml_parser1.1.3+spec-1.1.0
toml_writer1.1.2+spec-1.1.0
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-core0.1.36
try-lock0.2.5
typenum1.20.1
unicode-ident1.0.26
unicode-normalization0.1.23
unicode-segmentation1.13.3
untrusted0.9.0
url2.5.8
utf8_iter1.0.4
v_frame0.3.9
version_check0.9.5
want0.3.2
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.128build script, not run
wasm-bindgen-futures0.4.78
wasm-bindgen-macro0.2.128proc macro
wasm-bindgen-macro-support0.2.128
wasm-bindgen-shared0.2.128build script, not run
web-sys0.3.105
web-time1.1.0
webpki-roots1.0.9
weezl0.1.12
windows-core0.62.2
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.2.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
winnow1.0.4
wit-bindgen0.57.1build script, not runprebuilt objects
writeable0.6.4
xattr1.6.1
y4m0.8.0
yoke0.8.3
yoke-derive0.8.4proc macro
zerocopy0.8.57build script
zerocopy-derive0.8.57proc macro
zerofrom0.1.8
zerofrom-derive0.1.8proc macro
zeroize1.9.1
zerotrie0.2.5
zerovec0.11.8
zerovec-derive0.11.6proc macro
zlib-rs0.6.8
zmij1.0.23build script
zune-core0.5.3
zune-inflate0.2.54
zune-jpeg0.5.15

Raw data

capture
775 KB
records
107,265
bytes per record
7.2

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-14 · run 5a8e10c7-a18c-42cd-a6f0-8dbcf399faba

analysis 0.1.0 · 2026-10-14 · afb437c · graph v2