Skip to content
Open-Source Registry

cargo / montagent-render

montagent-render 0.2.0

bitbison: flagged, behavior flagged, dependencies clean, posture not checked, pipeline clean, 1 of 1 jobs captured 4 detections
processes
465
operations
15K
packages
65
compiler runs
55
connections
3
job time
36s
capture
199 KB
records
28K
bytes / record
7.2

Montagent's rasterizer and encode path: frames in, video out.

Build behaviourundeclared fetchlinked a downloaded binaryfetched outside crates.io

15 downloads · MIT · source · home page · cargo rasterizerskiavideo-encoding

Artifact

file · retained · product · graph v1
1
ChecksDetections
Build behavior
▲ Network activity—
✓ Sensitive data access and transfer—
✓ Cross-process access—
✓ Build file changes—
▲ Build script activity—
▲ Data flow analysis—
✓ Filesystem writes—
✓ Context collection—
Supply chain
✓ Known vulnerabilities—
✓ Build-time dependency advisories—
✓ Dependency advisories—
✓ Declared and observed dependencies—
✓ Dependency and toolchain versions—
Pipeline
✓ Pipeline coverage—

Detections

4
  • Build code opened a network connection
    skia-bindings 0.153.2 › github.com:443, release-assets.githubusercontent.com:443
    connection to github.com:443, opened by curl
    high
  • Uncompiled library linked
    libskia-bindings.a › github.com, release-assets.githubusercontent.com
    written under the build script at /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-23bd5dbd2e829a9d/build_script_build-23bd5dbd2e829a9d, which downloaded from github.com, release-assets.githubusercontent.com
    high
  • Uncompiled library linked
    libskia.a › github.com, release-assets.githubusercontent.com
    written under the build script at /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-23bd5dbd2e829a9d/build_script_build-23bd5dbd2e829a9d, which downloaded from github.com, release-assets.githubusercontent.com
    high
  • Build script ran curl
    skia-bindings 0.153.2 › github.com:443
    Tool invocations: 1. Build script: /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-23bd5dbd2e829a9d/build_script_build-23bd5dbd2e829a9d
    medium

Detection

high

Build code opened a network connection

subject skia-bindings 0.153.2 · destination github.com:443, release-assets.githubusercontent.com:443

connection to github.com:443, opened by curl

connection to release-assets.githubusercontent.com:443, opened by curl

the opener descends from the build script at /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-23bd5dbd2e829a9d/build_script_build-23bd5dbd2e829a9d

  1. rustup2450
  2. cargo2450
  3. build_script_build-23bd5dbd2e829a9d3208
  4. curl3213at 14:29:50

witnessed · rule egress

Detection

high

Uncompiled library linked

subject /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-99513b95aca5fb25/out/skia/libskia-bindings.a · destination github.com, release-assets.githubusercontent.com

written under the build script at /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-23bd5dbd2e829a9d/build_script_build-23bd5dbd2e829a9d, which downloaded from github.com, release-assets.githubusercontent.com

Written by build_script_build-23bd5dbd2e829a9d from a pipe without a recorded source compilation

skia-bindings asked the linker for it: static skia-bindings (target/release/build/skia-bindings-99513b95aca5fb25/output)

  1. rustup2450
  2. cargo2450
  3. build_script_build-23bd5dbd2e829a9d3208at 14:29:51

witnessed · Montagent · rule object-provenance

Detection

high

Uncompiled library linked

subject /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-99513b95aca5fb25/out/skia/libskia.a · destination github.com, release-assets.githubusercontent.com

written under the build script at /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-23bd5dbd2e829a9d/build_script_build-23bd5dbd2e829a9d, which downloaded from github.com, release-assets.githubusercontent.com

Written by build_script_build-23bd5dbd2e829a9d from a pipe without a recorded source compilation

skia-bindings asked the linker for it: static skia (target/release/build/skia-bindings-99513b95aca5fb25/output)

  1. rustup2450
  2. cargo2450
  3. build_script_build-23bd5dbd2e829a9d3208at 14:29:51

witnessed · Montagent · rule object-provenance

Detection

medium

Build script ran curl

subject skia-bindings 0.153.2 · destination github.com:443

Tool invocations: 1. Build script: /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-23bd5dbd2e829a9d/build_script_build-23bd5dbd2e829a9d

Command: curl -L -f -sS -C - --create-dirs --output /home/runner/work/Montagent/Montagent/target/release/build/skia-bindings-99513b95aca5fb25/out/.cache/skia-binaries-b0…

Recorded activity: used a network connection to github.com:443

witnessed · Montagent · rule buildscript

Network

2 fetches
  • github.com
    build code of skia-bindings · curl · 1 file
    undeclared
  • release-assets.githubusercontent.com
    build code of skia-bindings · curl · 1 file
    undeclared
cargo fetched 4,251 files from static.crates.io

Raw data

capture
199 KB
records
27,662
bytes per record
7.2

Loading a sample of the capture

Want to see more? E-mail us at hello@bitbison.io about your use case.

Dependencies

70 packages, 12 with a build script that ran, 1 doing more than compiling
PackageVersionUsageBuild behaviour
skia-bindings0.153.2observedbuild scriptnetworkruns tools github.com, release-assets.githubusercontent.com, curl, git
bindgen0.72.1observedbuild script
clang-sys1.9.1observedbuild script
crc32fast1.5.2observedbuild script
ld-linux-x86-64.so.2linkedsystem library
libc0.2.189observedbuild script
libc.so.6linkedsystem library
libgcc_s.so.1linkedsystem library
libm.so.6linkedsystem library
libmvec.so.1linkedsystem library
prettyplease0.2.37observedbuild script
proc-macro21.0.107observedbuild script
quote1.0.47observedbuild script
rustix1.1.5observedbuild script
serde1.0.229observedbuild script, not run
serde_core1.0.229observedbuild script
serde_derive1.0.229observedproc macro
serde_json1.0.151observedbuild script
zmij1.0.23observedbuild script
adler22.0.1observed
aho-corasick1.1.5observed
bitflags2.13.2observed
cc1.4.6observed
cexpr0.6.0observed
cfg-if1.0.5observed
either1.18.0observed
equivalent1.0.2observed
errno0.3.14observed
filetime0.2.29observed
find-msvc-tools0.1.12observed
flate21.1.10observed
glob0.3.4observed
hashbrown0.17.1observed
heck0.5.0observed
indexmap2.14.2observed
itertools0.13.0observed
itoa1.0.18observed
libloading0.8.9observed
linux-raw-sys0.12.1observed
log0.4.34observed
memchr2.8.3observed
minimal-lexical0.2.1observed
miniz_oxide0.9.1observed
nom7.1.3observed
pkg-config0.3.34observed
regex1.13.1observed
regex-automata0.4.18observed
regex-syntax0.8.11observed
rustc-hash2.1.3observed
serde_spanned1.1.1observed
shlex1.3.0observed
shlex2.0.1observed
simd-adler320.3.10observed
skia-safe direct0.153.2observed
syn2.0.119observed
syn3.0.6observed
tar0.4.46observed
toml0.9.12+spec-1.1.0observed
toml1.1.6+spec-1.1.0observed
toml_datetime0.7.5+spec-1.1.0observed
toml_datetime1.1.1+spec-1.1.0observed
toml_parser1.1.3+spec-1.1.0observed
toml_writer1.1.2+spec-1.1.0observed
unicode-ident1.0.26observed
windows-link0.2.1observed
windows-sys0.61.2observed
winnow0.7.15observed
winnow1.0.4observed
xattr1.6.1observed
zlib-rs0.6.8observed

1 of 1 jobs captured: build-test success · Generated 2026-10-10 · run e652d491-4a45-4ac6-9149-ee227d399417

analysis 0.1.0 · 2026-10-09 · 814b5de · graph v1