Flyto Core
io.github.flytohub/flyto-core
Execution engine for AI agents. 412 modules: browser, file, Docker, data, crypto.
unverified activityno licencehigh
9.0
/ 100 activity
rank #55,394
How this score was reached
Every point is accounted for below. The weights are published on the methodology page and come from the same code that computes them.
recency
0 / 35
No GitHub repository data available, so push recency could not be verified.
responsiveness
0 / 20
No GitHub repository data available, so issue activity could not be assessed.
cadence
0 / 15
Registry entry updated 262 days ago, past the 90-day window, so this signal is reduced.
community
0 / 15
No GitHub repository data available, so community size could not be measured.
metadata
9 / 15
Publisher metadata has no detected licence, a substantive description, a declared repository link.
Risk flags
Static observations from published metadata. Nothing is installed or executed, and these are deliberately kept out of the score above.
high
Known vulnerability GHSA-2956-977x-2w3r
flyto-core@2.12.6: Flyto2 Core: Arbitrary file write via image.download (and other file-writing modules)
Matched by package version against public advisory data. Verify whether your configuration is actually affected.
high
Known vulnerability GHSA-794r-5rp2-fpg8
flyto-core@2.12.6: flyto-core has SSRF guard bypass via IPv6 transition addresses (IPv4-mapped / 6to4 / NAT64) in validate_url_ssrf
Matched by package version against public advisory data. Verify whether your configuration is actually affected.
high
Known vulnerability GHSA-c9hr-64h3-gxpc
flyto-core@2.12.6: Flyto2 Core: Guarded HTTP modules follow redirects into internal space without per-hop SSRF revalidation
Matched by package version against public advisory data. Verify whether your configuration is actually affected.
high
Known vulnerability GHSA-hr7p-wg7r-hg9m
flyto-core@2.12.6: Flyto2 Core: ${env.VAR} interpolation reads any env secret despite env.get being denylisted
Matched by package version against public advisory data. Verify whether your configuration is actually affected.
high
Known vulnerability GHSA-pgwh-4jj4-qm8v
flyto-core@2.12.6: Flyto2 Core: Multiple HTTP-family modules fetch client-controlled URLs without the SSRF guard their siblings apply (SSRF to internal/metadata)
Matched by package version against public advisory data. Verify whether your configuration is actually affected.
Score over time
12 readings, oldest first. Latest 9.0.
Registry record
- Repository
- https://github.com/flytohub/flyto-core
- Version
- 2.12.6
- Licence
- none detected
- Activity data
- Not available — the repository is not on GitHub, or could not be read. Activity signals score zero rather than being guessed at.
- Packages
- pypi: flyto-core@2.12.6
- Registry updated
- First indexed
Something wrong here? This index reads public registry and GitHub data; if a record is stale or misattributed, email contact@klars.ai.