registry / @bossmissing/wing / 0.14.1

@bossmissing/wing@0.14.1

Wing CLI - manage AI agent collaboration metadata (AGENTS.md, domain docs, ADRs, frontmatter checks)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 45 file(s), 184 KB of source, external domains: test-ib-mcp.hillinsight.tech

Source & flagged code

2 flagged

dist/core/openspec.jsView file

Lines 1-41javascript

1import { execSync } from "node:child_process";

2import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/core/openspec.jsView on unpkg · L1

3import path from "node:path";

4import { logger } from "./logger.js";

5import { DEFAULT_CONFIG } from "../schemas/config.schema.js";

6/** True when an execSync error means the invoked binary was not found on PATH. */

7function isCommandMissing(e) {

8 const err = e;

9 return err.code === "ENOENT" || err.status === 127;

10}

11/** Run `openspec init` in `root`. Throws on failure (missing CLI or init error). */

12function runOpenspecInit(root) {

13 // Non-interactive: --tools claude wires OpenSpec into the Claude Code setup

14 // (config + slash commands + skills); --force skips legacy-file prompts.

15 execSync("openspec init --tools claude --force", {

16 cwd: root,

17 stdio: ["ignore", "ignore", "ignore"],

18 });

19}

20/** Install the OpenSpec CLI globally via npm. Throws if the install fails. */

21function installOpenspecGlobally() {

22 execSync("npm install -g openspec", {

23 stdio: ["ignore", "ignore", "ignore"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/openspec.jsView on unpkg · L21

24 });

25}

26export function ensureOpenspecInitialized(root, opts = {}) {

27 const init = opts.initFn ?? runOpenspecInit;

28 const install = opts.installFn ?? installOpenspecGlobally;

29 const openspecDir = path.join(root, DEFAULT_CONFIG.paths.openspec);

30 if (fs.existsSync(openspecDir))

31 return "exists";

32 if (opts.dryRun)

33 return "would-init";

34 try {

35 init(root);

36 return "initialized";

37 }

38 catch (e) {

39 // Anything other than a missing CLI means the CLI ran but init failed —

40 // installing won't help, so just warn.

41 if (!isCommandMissing(e))

Source & flagged code

2 flagged · loading source

dist/core/openspec.jsView file

1import { execSync } from "node:child_process"; L2: import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/core/openspec.jsView on unpkg · L1

21function installOpenspecGlobally() { L22: execSync("npm install -g openspec", { L23: stdio: ["ignore", "ignore", "ignore"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/openspec.jsView on unpkg · L21

Findings

3 High1 Medium4 Low

HighChild Processdist/core/openspec.js

HighShell

HighRuntime Package Installdist/core/openspec.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/core/openspec.jsView file

Lines 1-41javascript

1import { execSync } from "node:child_process";

2import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/core/openspec.jsView on unpkg · L1

3import path from "node:path";

4import { logger } from "./logger.js";

5import { DEFAULT_CONFIG } from "../schemas/config.schema.js";

6/** True when an execSync error means the invoked binary was not found on PATH. */

7function isCommandMissing(e) {

8 const err = e;

9 return err.code === "ENOENT" || err.status === 127;

10}

11/** Run `openspec init` in `root`. Throws on failure (missing CLI or init error). */

12function runOpenspecInit(root) {

13 // Non-interactive: --tools claude wires OpenSpec into the Claude Code setup

14 // (config + slash commands + skills); --force skips legacy-file prompts.

15 execSync("openspec init --tools claude --force", {

16 cwd: root,

17 stdio: ["ignore", "ignore", "ignore"],

18 });

19}

20/** Install the OpenSpec CLI globally via npm. Throws if the install fails. */

21function installOpenspecGlobally() {

22 execSync("npm install -g openspec", {

23 stdio: ["ignore", "ignore", "ignore"],

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/core/openspec.jsView on unpkg · L21

24 });

25}

26export function ensureOpenspecInitialized(root, opts = {}) {

27 const init = opts.initFn ?? runOpenspecInit;

28 const install = opts.installFn ?? installOpenspecGlobally;

29 const openspecDir = path.join(root, DEFAULT_CONFIG.paths.openspec);

30 if (fs.existsSync(openspecDir))

31 return "exists";

32 if (opts.dryRun)

33 return "would-init";

34 try {

35 init(root);

36 return "initialized";

37 }

38 catch (e) {

39 // Anything other than a missing CLI means the CLI ran but init failed —

40 // installing won't help, so just warn.

41 if (!isCommandMissing(e))