registry / @7n/rules / 1.1.0

@7n/rules@1.1.0

CLI еталонних правил і skills (префікс n-): синк у репозиторій, дельта-lint, конформність

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 248 file(s), 1.91 MB of source, external domains: api.github.com, blueoakcouncil.org, brew.sh, bun.com, datreeio.github.io, git.io, github.com, json.schemastore.org, kubernetes.io, pypi.org, raw.githubusercontent.com, registry.npmjs.org, scoop.sh, unpkg.com

Source & flagged code

6 flagged

bin/n-rules.jsView file

Lines 42-82javascript

42 *

43 * Composite GitHub Action `.github/actions/setup-bun-deps/action.yml` копіюється з каталогу

44 * `github-actions/` пакету при кожному успішному синку (workflows з правил ga / js-lint / text).

45 *

46 * Skills копіюються з npm/

Source & flagged code

6 flagged · loading source

bin/n-rules.jsView file

62L63: import { spawnSync } from 'node:child_process' L64: import { existsSync } from 'node:fs'

High

Child Process

Package source references child process execution.

bin/n-rules.jsView on unpkg · L62

scripts/skills-cli.mjsView file

44function isBinaryInPath(name) { L45: const probe = spawnSync('command', ['-v', name], { shell: true, encoding: 'utf8' }) L46: return probe.status === 0

High

Shell

Package source references shell execution.

scripts/skills-cli.mjsView on unpkg · L44

scripts/smoke-check-imports.mjsView file

49// eslint-disable-next-line no-unsanitized/method L50: await import(pathToFileURL(abs).href) L51: } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/smoke-check-imports.mjsView on unpkg · L49

rules/image-compress/check/main.mjsView file

29L30: const r = spawnSync('npx', ['@nitra/minify-image', '--src=.', '--json'], { L31: cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

rules/image-compress/check/main.mjsView on unpkg · L29

.claude-template/hooks/normalize-decisions.shView file

•path = .claude-template/hooks/normalize-decisions.sh kind = payload_in_excluded_dir sizeBytes = 24519 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude-template/hooks/normalize-decisions.shView on unpkg

•path = .claude-template/hooks/normalize-decisions.sh kind = build_helper sizeBytes = 24519 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude-template/hooks/normalize-decisions.shView on unpkg

Findings

4 High5 Medium4 Low

HighChild Processbin/n-rules.js

HighShellscripts/skills-cli.mjs

HighRuntime Package Installrules/image-compress/check/main.mjs

HighPayload In Excluded Dir.claude-template/hooks/normalize-decisions.sh

MediumDynamic Requirescripts/smoke-check-imports.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helper.claude-template/hooks/normalize-decisions.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

scripts/skills-cli.mjsView file

Lines 24-64javascript

24import { readSkillMetaRaw, skillTier } from './lib/skill-meta.mjs'

26/** Виконавці скіла. `pi` — вбудований (рекомендований); `cursor`/`claude` — deprecated зовнішні CLI. */

27const RUNNERS = new Set(['pi', 'cursor', 'claude'])

29const USAGE_LINES = [

30 'Usage:',

31 ' npx @7n/rules skill list',

32 ' npx @7n/rules skill <skill-id> ["task"]',

33 ' npx @7n/rules skill pi <skill-id> ["task"] # вбудований pi-агент (рекомендовано)',

34 ' npx @7n/rules skill cursor <skill-id> ["task"] # deprecated',

35 ' npx @7n/rules skill claude <skill-id> ["task"] # deprecated',

36 '',

37 'Skill id: каталог у пакеті (lint, taze, …) або з префіксом n- (n-lint → lint).'

38]

40/**

41 * @param {string} name ім'я бінарника

42 * @returns {boolean} чи знайдено бінарник у PATH

43 */

44function isBinaryInPath(name) {

45 const probe = spawnSync('command', ['-v', name], { shell: true, encoding: 'utf8' })

46 return probe.status === 0

High

Shell

Package source references shell execution.

scripts/skills-cli.mjsView on unpkg · L44

47}

49/**

50 * @param {string} name ім'я скілу з CLI або каталогу `.cursor/skills/n-*`

51 * @returns {string} id каталогу в `npm/skills/<id>/`

52 */

53export function normalizeSkillId(name) {

54 if (!name || typeof name !== 'string') {

55 return ''

56 }

57 return name.startsWith('n-') ? name.slice(2) : name

58}

60/**

61 * @param {string} skillsRoot абсолютний шлях до `skills/` пакета

62 * @returns {string[]} відсортовані id скілів, що мають `SKILL.md`

63 */

64export function listSkillIds(skillsRoot) {

scripts/smoke-check-imports.mjsView file

Lines 29-67javascript

29 if (!absPath.endsWith('.mjs')) return true

30 if (SKIP_SEGMENTS.some(seg => absPath.includes(seg))) return true

31 const rel = relative(PACKAGE_ROOT, absPath)

32 if (INCLUDE_ROOTS.every(root => !rel.startsWith(root))) return true

33 return rel.endsWith('.test.mjs')

34}

36/** @type {string[]} */

37const files = []

38await walkDir(PACKAGE_ROOT, fp => {

39 if (!shouldSkip(fp)) files.push(fp)

40})

41files.sort()

43/** @type {Array<{ file: string, error: Error }>} */

44const failures = []

46for (const abs of files) {

47 try {

48 // file:// URL зі списку файлів репо (перевірених walkDir), не user input

49 // eslint-disable-next-line no-unsanitized/method

50 await import(pathToFileURL(abs).href)

51 } catch (error) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/smoke-check-imports.mjsView on unpkg · L49

52 failures.push({ file: relative(PACKAGE_ROOT, abs), error: /** @type {Error} */ (error) })

53 }

54}

56console.log(`smoke-check-imports: ${files.length - failures.length}/${files.length} модулів імпортовано чисто`)

58if (failures.length > 0) {

59 console.error(`\n❌ ${failures.length} модул(ів) не імпортувались (можлива hoisting-регресія залежностей):\n`)

60 for (const { file, error } of failures) {

61 console.error(` ${file}\n ${error.message.split('\n', 1)[0]}\n`)

62 }

63 process.exitCode = 1

64} else {

65 console.log('✅ smoke-check-imports: усі модулі імпортуються чисто')

66}

rules/image-compress/check/main.mjsView file

Lines 9-49javascript

10const JSON_MAX_BUFFER = 20 * 1024 * 1024

12/**

13 * @param {string} stdout stdout

14 * @returns {{ summary?: { needsCompression?: unknown, total?: unknown } }} розпарсений JSON `--json`

15 */

16function parseMinifyJson(stdout) {

17 return JSON.parse(stdout)

18}

20/**

21 * Detector image-compress/check: \@nitra/minify-image --json (read-only).

22 * @param {import('../../../scripts/lib/lint-surface/types.mjs').LintContext} ctx контекст lint-прогону

23 * @returns {import('../../../scripts/lib/lint-surface/types.mjs').LintResult} результат detector-а

24 */

25export function lint(ctx) {

26 const reporter = createViolationReporter(ctx)

27 const { fail } = reporter

28 const cwd = ctx.cwd

30 const r = spawnSync('npx', ['@nitra/minify-image', '--src=.', '--json'], {

31 cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

rules/image-compress/check/main.mjsView on unpkg · L29

32 encoding: 'utf8',

33 env: process.env,

34 maxBuffer: JSON_MAX_BUFFER

35 })

36 if (r.error) {

37 fail(`image-compress: не вдалося запустити npx @nitra/minify-image --json: ${r.error.message}`, 'tool-error')

38 return reporter.result()

39 }

40 if (r.status !== 0) {

41 const detail = [r.stdout, r.stderr].filter(Boolean).join('\n').trim()

42 const detailSuffix = detail ? `:\n${detail}` : ''

43 fail(`image-compress: @nitra/minify-image --json завершився з кодом ${r.status}${detailSuffix}`, 'tool-error')