registry / @boyingliu01/xp-gate / 0.14.7

@boyingliu01/xp-gate@0.14.7

⚠ Under review

AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 30 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 85 file(s), 423 KB of source, external domains: api.github.com, docs.npmjs.com, git-scm.com, github.com, raw.githubusercontent.com, registry.npmjs.org, semgrep.dev, www.checkov.io

Source & flagged code

23 flagged

build-integrity/gate-10.tsView file

Lines 1-21typescript

1import { execFile } from 'child_process';

2import { promisify } from 'util';

High

Child Process

Package source references child process execution.

build-integrity/gate-10.tsView on unpkg · L1

3import * as fs from 'fs/promises';

4import * as fsNative from 'fs';

5import path from 'path';

6import { fileURLToPath } from 'url';

7import type {

8 CheckResult,

9 Gate10Options,

10 Gate10Result,

11 Gate10Status,

12 ImportCheckResult,

13 ImportViolation,

14} from './types';

15/**

16 * ═══════════════════════════════════════════════════════════════════════════════

17 * NAMING NOTE: This file is named "gate-10.ts" for historical reasons.

18 *

19 * It implements **pre-commit Gate 9 (Build Integrity)** which verifies:

20 * 1. TypeScript compilation (tsc --noEmit)

21 * 2. Package manifest integrity (npm pack --dry-run)

Lines 153-193typescript

153 * export * from './foo'

154 */

155export function extractImports(content: string): Array<{ path: string; line: number }> {

156 const

bin/xp-gate.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2const { init } = require('../lib/init.js');

3const { installSkill } = require('../lib/install-skill.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/xp-gate.jsView on unpkg · L1

4const { updateSkill } =

lib/detect-deps.jsView file

Lines 1-23javascript

1const fs = require('fs');

2const path = require('path');

3const os = require('os');

4const { execSync } =

gate-7.shView file

•path = gate-7.sh kind = build_helper sizeBytes = 1653 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gate-7.shView on unpkg

plugins/claude-code/skills/test-specification-alignment/references/specification-format.mdView file

Lines 170-210markdown

170 description: "使用 JWT 进行身份认证"

171 rationale: "无状态，支持分布式部署，减少数据库查询"

172 alternatives_considered:

173 - "Session-based auth: 需要分布式 session 存储"

174 - "API Key: 不适合用户登录场景"

175

176 - id: "DD-AUTH-002"

177 description: "密码使用 bcrypt 哈希存储"

178 rationale: "安全性高，计算成本可调，防彩虹表"

179

180 - id: "DD-AUTH-003"

plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView file

190patternName = generic_password severity = medium line = 190 matchedText = password...rs)"

Medium

Secret Pattern

Hardcoded password in plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L190

248patternName = generic_password severity = medium line = 248 matchedText = const us... });

Medium

Secret Pattern

Hardcoded password in plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L248

253patternName = generic_password severity = medium line = 253 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView file

190patternName = generic_password severity = medium line = 190 matchedText = password...rs)"

Medium

Secret Pattern

Hardcoded password in plugins/opencode/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L190

248patternName = generic_password severity = medium line = 248 matchedText = const us... });

Medium

Secret Pattern

Hardcoded password in plugins/opencode/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L248

253patternName = generic_password severity = medium line = 253 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in plugins/opencode/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView file

190patternName = generic_password severity = medium line = 190 matchedText = password...rs)"

Medium

Secret Pattern

Hardcoded password in skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView on unpkg · L190

248patternName = generic_password severity = medium line = 248 matchedText = const us... });

Medium

Secret Pattern

Hardcoded password in skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView on unpkg · L248

253patternName = generic_password severity = medium line = 253 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView on unpkg · L253

Source & flagged code

23 flagged · loading source

build-integrity/gate-10.tsView file

1import { execFile } from 'child_process'; L2: import { promisify } from 'util';

High

Child Process

Package source references child process execution.

build-integrity/gate-10.tsView on unpkg · L1

173L174: let match: RegExpExecArray | null; L175: const staticRe = new RegExp(staticImportExportRe.source, 'g');

High

Shell

Package source references shell execution.

build-integrity/gate-10.tsView on unpkg · L173

bin/xp-gate.jsView file

21try { L22: execSync(`npx -y tsx "${uiReviewPath}"`, { stdio: 'inherit' }); L23: process.exit(0);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/xp-gate.jsView on unpkg · L21

1#!/usr/bin/env node L2: const { init } = require('../lib/init.js'); L3: const { installSkill } = require('../lib/install-skill.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/xp-gate.jsView on unpkg · L1

lib/detect-deps.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @boyingliu01/xp-gate@0.12.0 matchedIdentity = npm:QGJveWluZ2xpdTAxL3hwLWdhdGU:0.12.0 similarity = 0.776 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/detect-deps.jsView on unpkg

3const os = require('os'); L4: const { execSync } = require('child_process'); L5: ... L32: }, L33: docUrl: 'https://github.com/kucherenko/jscpd', L34: }, ... L112: * then falls back to direct `--version` invocation with platform-appropriate L113: * stderr redirection. L114: * ... L119: function checkCliTool(toolName) { L120: const isWindows = process.platform === 'win32'; L121: const shell = isWindows ? 'cmd.exe' : '/bin/sh';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

lib/detect-deps.jsView on unpkg · L3

gate-7.shView file

•path = gate-7.sh kind = build_helper sizeBytes = 1653 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gate-7.shView on unpkg

plugins/claude-code/skills/test-specification-alignment/references/specification-format.mdView file

190patternName = generic_password severity = medium line = 190 matchedText = password...rs)"

Medium

Secret Pattern

Hardcoded password in plugins/claude-code/skills/test-specification-alignment/references/specification-format.md

plugins/claude-code/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L190

248patternName = generic_password severity = medium line = 248 matchedText = const us... });

Medium

Secret Pattern

Hardcoded password in plugins/claude-code/skills/test-specification-alignment/references/specification-format.md

plugins/claude-code/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L248

253patternName = generic_password severity = medium line = 253 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in plugins/claude-code/skills/test-specification-alignment/references/specification-format.md

plugins/claude-code/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L253

281patternName = generic_password severity = medium line = 281 matchedText = user = c...rd')

Medium

Secret Pattern

Hardcoded password in plugins/claude-code/skills/test-specification-alignment/references/specification-format.md

plugins/claude-code/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L281

plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView file

190patternName = generic_password severity = medium line = 190 matchedText = password...rs)"

Medium

Secret Pattern

Hardcoded password in plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L190

248patternName = generic_password severity = medium line = 248 matchedText = const us... });

Medium

Secret Pattern

Hardcoded password in plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L248

253patternName = generic_password severity = medium line = 253 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L253

281patternName = generic_password severity = medium line = 281 matchedText = user = c...rd')

Medium

Secret Pattern

Hardcoded password in plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L281

plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView file

190patternName = generic_password severity = medium line = 190 matchedText = password...rs)"

Medium

Secret Pattern

Hardcoded password in plugins/opencode/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L190

248patternName = generic_password severity = medium line = 248 matchedText = const us... });

Medium

Secret Pattern

Hardcoded password in plugins/opencode/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L248

253patternName = generic_password severity = medium line = 253 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in plugins/opencode/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L253

281patternName = generic_password severity = medium line = 281 matchedText = user = c...rd')

Medium

Secret Pattern

Hardcoded password in plugins/opencode/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L281

skills/test-specification-alignment/references/specification-format.mdView file

190patternName = generic_password severity = medium line = 190 matchedText = password...rs)"

Medium

Secret Pattern

Hardcoded password in skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView on unpkg · L190

248patternName = generic_password severity = medium line = 248 matchedText = const us... });

Medium

Secret Pattern

Hardcoded password in skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView on unpkg · L248

253patternName = generic_password severity = medium line = 253 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView on unpkg · L253

281patternName = generic_password severity = medium line = 281 matchedText = user = c...rd')

Medium

Secret Pattern

Hardcoded password in skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView on unpkg · L281

Findings

1 Critical4 High21 Medium4 Low

CriticalPrevious Version Dangerous Deltalib/detect-deps.js

HighChild Processbuild-integrity/gate-10.ts

HighShellbuild-integrity/gate-10.ts

HighSandbox Evasion Gated Capabilitylib/detect-deps.js

HighRuntime Package Installbin/xp-gate.js

MediumDynamic Requirebin/xp-gate.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpergate-7.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternplugins/claude-code/skills/test-specification-alignment/references/specification-format.md

MediumSecret Patternplugins/qoder/skills/test-specification-alignment/references/specification-format.md

MediumSecret Patternplugins/opencode/skills/test-specification-alignment/references/specification-format.md

MediumSecret Patternskills/test-specification-alignment/references/specification-format.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

23 flagged

build-integrity/gate-10.tsView file

Lines 1-21typescript

1import { execFile } from 'child_process';

2import { promisify } from 'util';

High

Child Process

Package source references child process execution.

build-integrity/gate-10.tsView on unpkg · L1

3import * as fs from 'fs/promises';

4import * as fsNative from 'fs';

5import path from 'path';

6import { fileURLToPath } from 'url';

7import type {

8 CheckResult,

9 Gate10Options,

10 Gate10Result,

11 Gate10Status,

12 ImportCheckResult,

13 ImportViolation,

14} from './types';

15/**

17 * NAMING NOTE: This file is named "gate-10.ts" for historical reasons.

18 *

19 * It implements **pre-commit Gate 9 (Build Integrity)** which verifies:

20 * 1. TypeScript compilation (tsc --noEmit)

21 * 2. Package manifest integrity (npm pack --dry-run)

Lines 153-193typescript

153 * export * from './foo'

154 */

155export function extractImports(content: string): Array<{ path: string; line: number }> {

156 const

bin/xp-gate.jsView file

Lines 1-41javascript

1#!/usr/bin/env node

2const { init } = require('../lib/init.js');

3const { installSkill } = require('../lib/install-skill.js');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/xp-gate.jsView on unpkg · L1

4const { updateSkill } =

lib/detect-deps.jsView file

Lines 1-23javascript

1const fs = require('fs');

2const path = require('path');

3const os = require('os');

4const { execSync } =

gate-7.shView file

•path = gate-7.sh kind = build_helper sizeBytes = 1653 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

gate-7.shView on unpkg

plugins/claude-code/skills/test-specification-alignment/references/specification-format.mdView file

Lines 170-210markdown

170 description: "使用 JWT 进行身份认证"

171 rationale: "无状态，支持分布式部署，减少数据库查询"

172 alternatives_considered:

173 - "Session-based auth: 需要分布式 session 存储"

174 - "API Key: 不适合用户登录场景"

175

176 - id: "DD-AUTH-002"

177 description: "密码使用 bcrypt 哈希存储"

178 rationale: "安全性高，计算成本可调，防彩虹表"

179

180 - id: "DD-AUTH-003"

plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView file

190patternName = generic_password severity = medium line = 190 matchedText = password...rs)"

Medium

Secret Pattern

Hardcoded password in plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L190

248patternName = generic_password severity = medium line = 248 matchedText = const us... });

Medium

Secret Pattern

Hardcoded password in plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L248

253patternName = generic_password severity = medium line = 253 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView file

190patternName = generic_password severity = medium line = 190 matchedText = password...rs)"

Medium

Secret Pattern

Hardcoded password in plugins/opencode/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L190

248patternName = generic_password severity = medium line = 248 matchedText = const us... });

Medium

Secret Pattern

Hardcoded password in plugins/opencode/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L248

253patternName = generic_password severity = medium line = 253 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in plugins/opencode/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView file

190patternName = generic_password severity = medium line = 190 matchedText = password...rs)"

Medium

Secret Pattern

Hardcoded password in skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView on unpkg · L190

248patternName = generic_password severity = medium line = 248 matchedText = const us... });

Medium

Secret Pattern

Hardcoded password in skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView on unpkg · L248

253patternName = generic_password severity = medium line = 253 matchedText = .send({ ... });

Medium

Secret Pattern

Hardcoded password in skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView on unpkg · L253