registry  /  @boyingliu01/xp-gate  /  0.11.4

@boyingliu01/xp-gate@0.11.4

AI-driven development workflow: 6 quality gates + Delphi review + Sprint Flow

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 28 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 85 file(s), 413 KB of source, external domains: api.github.com, docs.npmjs.com, git-scm.com, github.com, raw.githubusercontent.com, registry.npmjs.org, semgrep.dev, www.checkov.io

Source & flagged code

21 flagged · loading source
build-integrity/gate-10.tsView file
1import { execFile } from 'child_process'; L2: import { promisify } from 'util';
High
Child Process

Package source references child process execution.

build-integrity/gate-10.tsView on unpkg · L1
173L174: let match: RegExpExecArray | null; L175: const staticRe = new RegExp(staticImportExportRe.source, 'g');
High
Shell

Package source references shell execution.

build-integrity/gate-10.tsView on unpkg · L173
bin/xp-gate.jsView file
20try { L21: execSync(`npx -y tsx "${uiReviewPath}"`, { stdio: 'inherit' }); L22: process.exit(0);
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/xp-gate.jsView on unpkg · L20
1#!/usr/bin/env node L2: const { init } = require('../lib/init.js'); L3: const { installSkill } = require('../lib/install-skill.js');
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/xp-gate.jsView on unpkg · L1
plugins/claude-code/bin/xp-gate-version-check.shView file
•path = plugins/claude-code/bin/xp-gate-version-check.sh kind = build_helper sizeBytes = 1865 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugins/claude-code/bin/xp-gate-version-check.shView on unpkg
plugins/claude-code/skills/test-specification-alignment/references/specification-format.mdView file
190patternName = generic_password severity = medium line = 190 matchedText = password...rs)"
Medium
Secret Pattern

Hardcoded password in plugins/claude-code/skills/test-specification-alignment/references/specification-format.md

plugins/claude-code/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L190
248patternName = generic_password severity = medium line = 248 matchedText = const us... });
Medium
Secret Pattern

Hardcoded password in plugins/claude-code/skills/test-specification-alignment/references/specification-format.md

plugins/claude-code/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L248
253patternName = generic_password severity = medium line = 253 matchedText = .send({ ... });
Medium
Secret Pattern

Hardcoded password in plugins/claude-code/skills/test-specification-alignment/references/specification-format.md

plugins/claude-code/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L253
281patternName = generic_password severity = medium line = 281 matchedText = user = c...rd')
Medium
Secret Pattern

Hardcoded password in plugins/claude-code/skills/test-specification-alignment/references/specification-format.md

plugins/claude-code/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L281
plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView file
190patternName = generic_password severity = medium line = 190 matchedText = password...rs)"
Medium
Secret Pattern

Hardcoded password in plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L190
248patternName = generic_password severity = medium line = 248 matchedText = const us... });
Medium
Secret Pattern

Hardcoded password in plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L248
253patternName = generic_password severity = medium line = 253 matchedText = .send({ ... });
Medium
Secret Pattern

Hardcoded password in plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L253
281patternName = generic_password severity = medium line = 281 matchedText = user = c...rd')
Medium
Secret Pattern

Hardcoded password in plugins/qoder/skills/test-specification-alignment/references/specification-format.md

plugins/qoder/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L281
plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView file
190patternName = generic_password severity = medium line = 190 matchedText = password...rs)"
Medium
Secret Pattern

Hardcoded password in plugins/opencode/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L190
248patternName = generic_password severity = medium line = 248 matchedText = const us... });
Medium
Secret Pattern

Hardcoded password in plugins/opencode/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L248
253patternName = generic_password severity = medium line = 253 matchedText = .send({ ... });
Medium
Secret Pattern

Hardcoded password in plugins/opencode/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L253
281patternName = generic_password severity = medium line = 281 matchedText = user = c...rd')
Medium
Secret Pattern

Hardcoded password in plugins/opencode/skills/test-specification-alignment/references/specification-format.md

plugins/opencode/skills/test-specification-alignment/references/specification-format.mdView on unpkg · L281
skills/test-specification-alignment/references/specification-format.mdView file
190patternName = generic_password severity = medium line = 190 matchedText = password...rs)"
Medium
Secret Pattern

Hardcoded password in skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView on unpkg · L190
248patternName = generic_password severity = medium line = 248 matchedText = const us... });
Medium
Secret Pattern

Hardcoded password in skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView on unpkg · L248
253patternName = generic_password severity = medium line = 253 matchedText = .send({ ... });
Medium
Secret Pattern

Hardcoded password in skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView on unpkg · L253
281patternName = generic_password severity = medium line = 281 matchedText = user = c...rd')
Medium
Secret Pattern

Hardcoded password in skills/test-specification-alignment/references/specification-format.md

skills/test-specification-alignment/references/specification-format.mdView on unpkg · L281

Findings

3 High21 Medium4 Low
HighChild Processbuild-integrity/gate-10.ts
HighShellbuild-integrity/gate-10.ts
HighRuntime Package Installbin/xp-gate.js
MediumDynamic Requirebin/xp-gate.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperplugins/claude-code/bin/xp-gate-version-check.sh
MediumStructural Risk Force Deep Review
MediumSecret Patternplugins/claude-code/skills/test-specification-alignment/references/specification-format.md
MediumSecret Patternplugins/claude-code/skills/test-specification-alignment/references/specification-format.md
MediumSecret Patternplugins/claude-code/skills/test-specification-alignment/references/specification-format.md
MediumSecret Patternplugins/claude-code/skills/test-specification-alignment/references/specification-format.md
MediumSecret Patternplugins/qoder/skills/test-specification-alignment/references/specification-format.md
MediumSecret Patternplugins/qoder/skills/test-specification-alignment/references/specification-format.md
MediumSecret Patternplugins/qoder/skills/test-specification-alignment/references/specification-format.md
MediumSecret Patternplugins/qoder/skills/test-specification-alignment/references/specification-format.md
MediumSecret Patternplugins/opencode/skills/test-specification-alignment/references/specification-format.md
MediumSecret Patternplugins/opencode/skills/test-specification-alignment/references/specification-format.md
MediumSecret Patternplugins/opencode/skills/test-specification-alignment/references/specification-format.md
MediumSecret Patternplugins/opencode/skills/test-specification-alignment/references/specification-format.md
MediumSecret Patternskills/test-specification-alignment/references/specification-format.md
MediumSecret Patternskills/test-specification-alignment/references/specification-format.md
MediumSecret Patternskills/test-specification-alignment/references/specification-format.md
MediumSecret Patternskills/test-specification-alignment/references/specification-format.md
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings