Skip to content
Open-Source Registry

cargo / montagent-core / 0.2.1

montagent-core 0.2.1

bitbison: flagged, behavior flagged, dependencies notes, posture not checked, pipeline clean, 1 of 1 jobs captured RiskhighVulnsnone
processes
445
operations
58K
packages
294
compiler runs
186
connections
3
job time
4m 23s
capture
783 KB
records
108K
bytes / record
7.3

Build behaviourundeclared fetchlinked a downloaded binaryfetched outside crates.iocompiled C/C++

run de4af561-9093-469e-bb2e-e8c96f4fd78f · built 2026-10-12 · complete View on crates.io

Artifact

file · retained · product · graph v2
1

Checks

10 of 14 clear Network activity Build script activity +2 more
Build behavior▲✓✓✓▲▲✓✓
Supply chain✓▲✓✓✓
Pipeline✓

Detections

4
  • Build code opened a network connection
    skia-bindings 0.153.2 › github.com:443, release-assets.githubusercontent.com:443
    high
  • Uncompiled library linked
    libskia-bindings.a › github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskia.a › github.com, release-assets.githubusercontent.com
    high
  • Build script ran curl
    skia-bindings 0.153.2 › github.com:443
    medium

Detection

highwitnessed

Build code opened a network connection

Unexpected network connection

Subject
skia-bindings 0.153.2
Destination
github.com:443, release-assets.githubusercontent.com:443
Reaches
Jobs
build-test
Rule
egress

Evidence

  1. Connection outside the process’s allowed destinationscause

    connection to github.com:443, opened by curl

    subject github.com:443

    by curl -L -f -sS -C - --create-dirs --output /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0…

  2. Connection outside the process’s allowed destinationscause

    connection to release-assets.githubusercontent.com:443, opened by curl

    subject release-assets.githubusercontent.com:443

    by curl -L -f -sS -C - --create-dirs --output /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0…

  3. Connection opened by a build script or child processsupport

    the opener descends from the build script at /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build_script_build-980d8f6ef937e364

Processes

build-test

cargo›cargo›build-script-build›curl

Ran
curl -L -f -sS -C - --create-dirs --output /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0…
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 4 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2450
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2450
  3. build-script-build/home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build-script-build4433
  4. curlcurl -L -f -sS -C - --create-dirs --output /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0…4440

Remediation

Review the process and its owning build step. Remove unnecessary requests; move required downloads to a declared dependency-fetch step.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/skia/libskia-bindings.awritten by build_script_build-980d8f6ef937e364
Destination
github.com, release-assets.githubusercontent.com
Reaches
Jobs
build-test
Rule
object-provenance · Montagent

Evidence

  1. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build_script_build-980d8f6ef937e364, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/skia/libskia-bindings.a

  2. Written from a pipecause

    Written by build_script_build-980d8f6ef937e364 from a pipe without a recorded source compilation

    subject /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/skia/libskia-bindings.a

    by /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build-script-build

  3. Asked for by the build's own declarationsupport

    skia-bindings asked the linker for it: static skia-bindings (target/release/build/skia-bindings-f101f4f5dceb5a2b/output)

    subject /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/skia/libskia-bindings.a

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2450
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2450
  3. build-script-build/home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build-script-build4433

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

highwitnessed

Uncompiled library linked

Object file origin needs review

Subject
/home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/skia/libskia.awritten by build_script_build-980d8f6ef937e364
Destination
github.com, release-assets.githubusercontent.com
Reaches
Jobs
build-test
Rule
object-provenance · Montagent

Evidence

  1. Object written under a build script that downloadedcause

    written under the build script at /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build_script_build-980d8f6ef937e364, which downloaded from github.com, release-assets.githubusercontent.com

    subject /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/skia/libskia.a

  2. Written from a pipecause

    Written by build_script_build-980d8f6ef937e364 from a pipe without a recorded source compilation

    subject /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/skia/libskia.a

    by /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build-script-build

  3. Asked for by the build's own declarationsupport

    skia-bindings asked the linker for it: static skia (target/release/build/skia-bindings-f101f4f5dceb5a2b/output)

    subject /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/skia/libskia.a

Processes

build-test

cargo›cargo›build-script-build

Ran
/home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build-script-build
Invoked by
cargo build --release --locked --message-format=json-render-diagnostics
Lineage · 3 processes
  1. cargocargo build --release --locked --message-format=json-render-diagnostics2450
  2. cargo/home/runner/.rustup/toolchains/1.99.0-x86_64-unknown-linux-gnu/bin/cargo build --release --locked --message-format=json-render-diagnostics2450
  3. build-script-build/home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build-script-build4433

Remediation

Inspect the writer and input chain. Confirm the object comes from a reviewed build step or declared prebuilt dependency. If its origin cannot be verified, replace it and rebuild.

Detection

mediumwitnessed

Build script ran curl

Unexpected build script activity

Subject
skia-bindings 0.153.2
Destination
github.com:443
Jobs
build-test
Rule
buildscript · Montagent

Evidence

  1. Build script ran a download or version-control toolcause

    Tool invocations: 1. Build script: /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build_script_build-980d8f6ef937e364

    by /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-980d8f6ef937e364/build-script-build

  2. What the tool didcause

    Recorded activity: used a network connection to github.com:443

    target github.com:443

  3. Tool commandsupport

    Command: curl -L -f -sS -C - --create-dirs --output /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0…

    by curl -L -f -sS -C - --create-dirs --output /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-f101f4f5dceb5a2b/out/.cache/skia-binaries-b0…

Remediation

Review the command, its network destinations, and the files it wrote. Remove unexpected activity from the build script.

Network

3 peers
  • github.com:443 build code of skia-bindings · curl · GitHub, Inc. · 1 file undeclared
  • release-assets.githubusercontent.com:443 build code of skia-bindings · curl · Fastly, Inc. · 1 file undeclared
  • static.crates.io:8080 the package manager · cargo (Montagent) via crates.io · 16,144 files · went into an output ecosystem
Dependencies309Build behaviour
adler22.0.1
aho-corasick1.1.5
aligned0.4.3
aligned-vec0.6.4
android_system_properties0.1.6
anyhow1.0.104build script
arbitrary1.4.2
arg_enum_proc_macro0.3.4proc macro
arrayvec0.7.8
as-slice0.2.1
atomic-waker1.1.2
autocfg1.5.1
av-scenechange0.14.1build script
av1-grain0.2.5
avif-serialize0.8.9
base640.22.1
base640.23.1
bindgen0.72.1build script
bit_field0.10.3
bitflags2.13.2
bitstream-io4.10.0
block-buffer0.10.4
built0.8.1
bumpalo3.20.3
bytemuck1.25.2
bytemuck_derive1.12.1proc macro
byteorder-lite0.1.0
bytes1.12.1
cc1.4.6
cexpr0.6.0
cfg-if1.0.5
cfg_aliases0.2.2
chacha200.10.2
chrono0.4.45
clang-sys1.9.1build script
color_quant1.1.0
core-foundation-sys0.8.7
cpufeatures0.2.17
cpufeatures0.3.1
crc32fast1.5.2build script
crossbeam-deque0.8.8build script
crossbeam-epoch0.9.21build script
crossbeam-utils0.8.23build script
crunchy0.2.4build script, not run
crypto-common0.1.7
digest0.10.7
displaydoc0.2.7proc macro
dyn-clone1.0.20
either1.18.0
equator0.4.2
equator-macro0.4.2proc macro
equivalent1.0.2
errno0.3.14
exr1.74.2
fax0.2.7
fdeflate0.3.7
filetime0.2.29
find-msvc-tools0.1.12
flate21.1.10
foldhash0.2.0
font-types0.12.5
fontique0.11.1
form_urlencoded1.2.2
futures-channel0.3.34
futures-core0.3.34
futures-io0.3.34
futures-sink0.3.34
futures-task0.3.34
futures-util0.3.34
generic-array0.14.7build script
getrandom0.2.17
getrandom0.3.4build script, not run
getrandom0.4.3build script, not run
gif0.14.2
glob0.3.4
half2.7.1
harfrust0.12.0
hashbrown0.17.1
heck0.5.0
http1.5.0
http-body1.1.0
http-body-util0.1.5
httparse1.10.1build script
hyper1.12.0
hyper-rustls0.27.10
hyper-util0.1.21
iana-time-zone0.1.65
iana-time-zone-haiku0.1.2build script, not run
icu_collections2.3.0
icu_locale_core2.3.0
icu_locale_fallback2.3.0
icu_locale_fallback_data2.3.0build script
icu_normalizer2.3.0
icu_normalizer_data2.3.0build script
icu_properties2.3.0
icu_properties_data2.3.0build script
icu_provider2.3.1
icu_segmenter2.3.0
icu_segmenter_data2.3.0build script
idna1.1.0
idna_adapter1.2.2
image0.25.10
image-webp0.2.4
imgref1.12.3
indexmap2.14.2
interpolate_name0.2.4proc macro
ipnet2.12.2
itertools0.13.0
itertools0.14.0
itoa1.0.18
jobserver0.1.35
js-sys0.3.105
ld-linux-x86-64.so.2system library
lebe0.5.3
libc0.2.189build script
libc.so.6system library
libfuzzer-sys0.4.13build script, not run
libgcc_s.so.1system library
libloading0.8.9
libm0.2.16build script
libm.so.6system library
libmvec.so.1system library
linebender_resource_handle0.1.1
linux-raw-sys0.12.1
litemap0.8.3
log0.4.34
loop90.1.5
lru-slab0.1.3
maybe-rayon0.1.1
memchr2.8.3
memmap20.9.11
minimal-lexical0.2.1
miniz_oxide0.8.9
miniz_oxide0.9.1
mio1.2.4
montagent-render0.2.1
montagent-text0.2.1
moxcms0.8.1
new_debug_unreachable1.0.6
no_std_io20.9.4
nom7.1.3
nom8.0.0
noop_proc_macro0.3.0proc macro
num-bigint0.4.8
num-complex0.4.6
num-derive0.4.2proc macro
num-integer0.1.47
num-rational0.4.2
num-traits0.2.19build script
once_cell1.21.4
parlance0.1.0
parley0.11.1
parley_data0.11.1
paste1.0.15build scriptproc macro
pastey0.1.1proc macro
percent-encoding2.3.2
pin-project-lite0.2.17
pkg-config0.3.34
png0.18.1
potential_utf0.1.6
ppv-lite860.2.21
prettyplease0.2.37build script
proc-macro21.0.107build script
profiling1.0.18
profiling-procmacros1.0.18proc macro
pulp0.22.3build script
pulp-wasm-simd-flag0.1.1
pxfm0.1.30
qoi0.4.1
quick-error2.0.1
quinn0.11.12build script, not run
quinn-proto0.11.19
quinn-udp0.5.16build script, not run
quote1.0.47build script
r-efi5.3.0
r-efi6.0.0
rand0.10.3
rand0.9.5
rand_chacha0.9.0
rand_core0.10.1
rand_core0.9.5
rand_pcg0.10.2
rav1e0.8.1build script
ravif0.13.0
raw-cpuid11.6.0
rayon1.12.0
rayon-core1.13.0build script
read-fonts0.41.0
read-fonts0.43.3
reborrow0.5.5
ref-cast1.0.27build script
ref-cast-impl1.0.27proc macro
regex1.13.1
regex-automata0.4.18
regex-syntax0.8.11
reqwest0.12.28
rgb0.8.53
ring0.17.14build scriptprebuilt objects
rustc-hash2.1.3
rustix1.1.5build script
rustls0.23.45build script
rustls-pki-types1.15.1
rustls-webpki0.103.15
rustversion1.0.23build script, not runproc macro
ryu1.0.23
schemars1.2.2
schemars_derive1.2.2proc macro
serde1.0.229build script
serde_core1.0.229build script
serde_derive1.0.229proc macro
serde_derive_internals0.30.0
serde_json1.0.151build script
serde_spanned1.1.1
serde_urlencoded0.7.1
sha20.10.9
shlex1.3.0
shlex2.0.1
simd-adler320.3.10
simd_helpers0.1.0proc macro
skia-bindings0.153.2build scriptnetworkruns toolsgithub.com, release-assets.githubusercontent.com, curl, git
skia-safe0.153.2
skrifa0.44.0
skrifa0.46.2
slab0.4.12
smallvec1.16.1
socket20.6.5
stable_deref_trait1.2.1
subtle2.6.1
syn2.0.119
syn3.0.6
sync_wrapper1.0.2
synstructure0.14.0
tar0.4.46
thiserror2.0.20build script
thiserror-impl2.0.20proc macro
tiff0.11.3
tinystr0.8.4
tinyvec1.13.3
tokio1.53.1
tokio-rustls0.26.6
toml1.1.6+spec-1.1.0
toml_datetime1.1.1+spec-1.1.0
toml_parser1.1.3+spec-1.1.0
toml_writer1.1.2+spec-1.1.0
tower0.5.3
tower-http0.6.11
tower-layer0.3.3
tower-service0.3.3
tracing0.1.44
tracing-core0.1.36
try-lock0.2.5
typenum1.20.1
unicode-ident1.0.26
unicode-normalization0.1.23
unicode-segmentation1.13.3
untrusted0.9.0
url2.5.8
utf8_iter1.0.4
v_frame0.3.9
version_check0.9.5
want0.3.2
wasi0.11.1+wasi-snapshot-preview1
wasip21.0.4+wasi-0.2.12
wasm-bindgen0.2.128build script, not run
wasm-bindgen-futures0.4.78
wasm-bindgen-macro0.2.128proc macro
wasm-bindgen-macro-support0.2.128
wasm-bindgen-shared0.2.128build script, not run
web-sys0.3.105
web-time1.1.0
webpki-roots1.0.9
weezl0.1.12
windows-core0.62.2
windows-implement0.60.2proc macro
windows-interface0.59.3proc macro
windows-link0.2.1
windows-result0.4.1
windows-strings0.5.1
windows-sys0.52.0
windows-sys0.61.2
windows-targets0.52.6
windows_aarch64_gnullvm0.52.6build script, not runprebuilt objects
windows_aarch64_msvc0.52.6build script, not runprebuilt objects
windows_i686_gnu0.52.6build script, not runprebuilt objects
windows_i686_gnullvm0.52.6build script, not runprebuilt objects
windows_i686_msvc0.52.6build script, not runprebuilt objects
windows_x86_64_gnu0.52.6build script, not runprebuilt objects
windows_x86_64_gnullvm0.52.6build script, not runprebuilt objects
windows_x86_64_msvc0.52.6build script, not runprebuilt objects
winnow1.0.4
wit-bindgen0.57.1build script, not runprebuilt objects
writeable0.6.4
xattr1.6.1
y4m0.8.0
yoke0.8.3
yoke-derive0.8.4proc macro
zerocopy0.8.57build script
zerocopy-derive0.8.57proc macro
zerofrom0.1.8
zerofrom-derive0.1.8proc macro
zeroize1.9.1
zerotrie0.2.5
zerovec0.11.8
zerovec-derive0.11.6proc macro
zlib-rs0.6.8
zmij1.0.23build script
zune-core0.5.3
zune-inflate0.2.54
zune-jpeg0.5.15
Versions6RiskVulnsPublished
0.3.04d ago
0.2.25d ago
0.2.16d ago
0.2.08d ago
0.1.2not analyzed2026-10-02
0.4.0highnone

Raw data

capture
783 KB
records
107,748
bytes per record
7.3

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

1 of 1 jobs captured: build-test success · Generated 2026-10-12 · run de4af561-9093-469e-bb2e-e8c96f4fd78f

analysis 0.1.0 · 2026-10-11 · d6246d3 · graph v2