registry / @brunosps00/dev-workflow / 1.6.0

@brunosps00/dev-workflow@1.6.0

AI-driven development workflow commands for any project. Scaffolds a complete PRD-to-PR pipeline with multi-platform AI assistant support.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 19 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 40 file(s), 252 KB of source, external domains: astral.sh, aws-mcp.eu-central-1.api.aws, aws-mcp.us-east-1.api.aws, docs.aws.amazon.com, docs.docker.com, git-scm.com, github.com, learn.microsoft.com, raw.githubusercontent.com

Source & flagged code

12 flagged

scaffold/skills/security-review/references/secrets.mdView file

Lines 15-47markdown

15gitleaks protect --staged --redact --report-format json --report-path .dw/secure-audit/gitleaks.json

17# Commits on this branch vs base (PR style):

18gitleaks detect --redact --log-opts "$(git merge-base HEAD origin/main)..HEAD" \

19 --report-format json --report-path .dw/secure-audit/gitleaks.json

20```

22`--redact` keeps the actual secret value out of the report/logs. A full-tree scan

23(`gitleaks detect` with no `--log-opts`) is the periodic deep pass.

25## Verdict

27- **≥1 finding → REJECTED.** No exception, no ADR. A leaked credential is rotated, not justified.

28- Write `.dw/secure-audit/secret-findings.md`: rule id, `file:line`, commit, and the redacted match.

29 The remediation is always: remove from code + history, rotate the credential, move to a secret store.

31## Allowlisting (test fixtures / examples only)

33Legitimate non-secrets (obvious placeholders, test fixtures) are allowlisted in a committed

34`.gitleaks.toml` (regexes/paths), reviewed like code — not by skipping the scan. A real-looking

35secret in a fixture should still be a fake (e.g., `AKIAIOSFODNN7EXAMPLE`), never a live one.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

scaffold/skills/security-review/references/secrets.mdView on unpkg · L35

Critical

Secret Pattern

AWS access key ID in scaffold/skills/security-review/references/secrets.md

scaffold/skills/security-review/references/secrets.mdView on unpkg · L35

37## Relationship to Trivy

39Trivy's secret scan stays (defense in depth, covers files gitleaks' git-history mode may miss).

40gitleaks is authoritative for the diff. Dedupe by `file:line` in the report so one leak isn't

41double-counted across tools.

43## Tool absent

45If `gitleaks` is not installed, the gate falls back to Trivy secrets only and records "dedicated

46secret scan: skipped (gitleaks not installed)" in the summary, pointing to `install-deps`.

lib/install-deps.jsView file

Lines 1-21javascript

1const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

lib/install-deps.jsView on unpkg · L1

3function run() {

4 console.log('\n dev-workflow install-deps');

5 console.log(` ${'='

scaffold/scripts/lib/resolve-browser.mjsView file

Lines 4-44javascript

4// (dw-qa, dw-functional-doc, dw-redesign-ui), with WSL resilience.

5//

6// Resolution order: Playwright Chromium primary -> optional CDP fallback from env

7// BROWSER_TEST or .dw/config.json (browserTest).

8//

9// Returns one of:

10// { mode: "launch", launchOptions, source, fallback?, openFallback? } // let Playwright launch first

11// { mode: "cdp", endpoint, source, cleanup } // resolved fallback descriptor

12//

13// DEFAULT: full Playwright Chromium in headless via channel:"chromium", which uses the

14// new headless mode (desktop-faithful rendering, not the lighter headless-shell) and

bin/dev-workflow.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { run } = require('../lib/init');

4const installDeps = require('../lib/install-deps');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/dev-workflow.jsView on unpkg · L2

5const installAzureSkills

scaffold/scripts/cdp-relay/bin/cdp-relay.exeView file

•path = scaffold/scripts/cdp-relay/bin/cdp-relay.exe kind = native_binary sizeBytes = 278016 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

scaffold/scripts/cdp-relay/bin/cdp-relay.exeView on unpkg

scaffold/skills/security-review/references/supply-chain.mdView file

Lines 129-169markdown

129```

130

131### Common Typosquatting Patterns

132

133- Character omission: `requests` → `reqests`

134- Character swap: `django` → `djagno`

135- Character doubling: `numpy` → `numppy`

136- Homoglyphs: `requests` → `rеquests` (Cyrillic е)

137- Adding suffixes: `requests-dev`, `requests-py`

138

139---

140

141

scaffold/skills/security-review/references/misconfiguration.mdView file

148patternName = generic_password severity = medium line = 148 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in scaffold/skills/security-review/references/misconfiguration.md

scaffold/skills/security-review/references/misconfiguration.mdView on unpkg · L148

150patternName = generic_password severity = medium line = 150 matchedText = password...eme'

Medium

Secret Pattern

Hardcoded password in scaffold/skills/security-review/references/misconfiguration.md

scaffold/skills/security-review/references/misconfiguration.mdView on unpkg · L150

scaffold/skills/security-review/SKILL.mdView file

231patternName = generic_password severity = medium line = 231 matchedText = password...ded"

Medium

Secret Pattern

Hardcoded password in scaffold/skills/security-review/SKILL.md

scaffold/skills/security-review/SKILL.mdView on unpkg · L231

Source & flagged code

12 flagged · loading source

scaffold/skills/security-review/references/secrets.mdView file

35patternName = aws_access_key severity = critical line = 35 matchedText = secret i...one.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

scaffold/skills/security-review/references/secrets.mdView on unpkg · L35

35patternName = aws_access_key severity = critical line = 35 matchedText = secret i...one.

Critical

Secret Pattern

AWS access key ID in scaffold/skills/security-review/references/secrets.md

scaffold/skills/security-review/references/secrets.mdView on unpkg · L35

lib/install-deps.jsView file

1const { execSync } = require('child_process'); L2:

High

Child Process

Package source references child process execution.

lib/install-deps.jsView on unpkg · L1

1const { execSync } = require('child_process'); L2: ... L9: name: 'Playwright browsers (Chromium + deps)', L10: check: 'npx playwright --version', L11: install: 'npx playwright install --with-deps chromium',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/install-deps.jsView on unpkg · L1

scaffold/scripts/lib/resolve-browser.mjsView file

231try { L232: winTemp = spawnSync("cmd.exe", ["/c", "echo %TEMP%"], { encoding: "utf8" }).stdout?.split(/\r?\n/)[0]?.trim() || null; L233: } catch {

High

Shell

Package source references shell execution.

scaffold/scripts/lib/resolve-browser.mjsView on unpkg · L231

24import fs from "node:fs"; L25: import net from "node:net"; L26: import http from "node:http"; L27: import path from "node:path"; L28: import { spawn, spawnSync } from "node:child_process"; L29: ... L38: export function detectWsl() { L39: if (process.env.WSL_DISTRO_NAME) { L40: return true;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scaffold/scripts/lib/resolve-browser.mjsView on unpkg · L24

bin/dev-workflow.jsView file

2L3: const { run } = require('../lib/init'); L4: const installDeps = require('../lib/install-deps');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/dev-workflow.jsView on unpkg · L2

scaffold/scripts/cdp-relay/bin/cdp-relay.exeView file

•path = scaffold/scripts/cdp-relay/bin/cdp-relay.exe kind = native_binary sizeBytes = 278016 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

scaffold/scripts/cdp-relay/bin/cdp-relay.exeView on unpkg

scaffold/skills/security-review/references/supply-chain.mdView file

149patternName = aws_access_key severity = critical line = 149 matchedText = AWS_SECR...MPLE

Critical

Secret Pattern

AWS access key ID in scaffold/skills/security-review/references/supply-chain.md

scaffold/skills/security-review/references/supply-chain.mdView on unpkg · L149

scaffold/skills/security-review/references/misconfiguration.mdView file

148patternName = generic_password severity = medium line = 148 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in scaffold/skills/security-review/references/misconfiguration.md

scaffold/skills/security-review/references/misconfiguration.mdView on unpkg · L148

150patternName = generic_password severity = medium line = 150 matchedText = password...eme'

Medium

Secret Pattern

Hardcoded password in scaffold/skills/security-review/references/misconfiguration.md

scaffold/skills/security-review/references/misconfiguration.mdView on unpkg · L150

scaffold/skills/security-review/SKILL.mdView file

231patternName = generic_password severity = medium line = 231 matchedText = password...ded"

Medium

Secret Pattern

Hardcoded password in scaffold/skills/security-review/SKILL.md

scaffold/skills/security-review/SKILL.mdView on unpkg · L231

Findings

3 Critical4 High8 Medium4 Low

CriticalCritical Secretscaffold/skills/security-review/references/secrets.md

CriticalSecret Patternscaffold/skills/security-review/references/secrets.md

CriticalSecret Patternscaffold/skills/security-review/references/supply-chain.md

HighChild Processlib/install-deps.js

HighShellscaffold/scripts/lib/resolve-browser.mjs

HighSame File Env Network Executionscaffold/scripts/lib/resolve-browser.mjs

HighRuntime Package Installlib/install-deps.js

MediumDynamic Requirebin/dev-workflow.js

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryscaffold/scripts/cdp-relay/bin/cdp-relay.exe

MediumStructural Risk Force Deep Review

MediumSecret Patternscaffold/skills/security-review/references/misconfiguration.md

MediumSecret Patternscaffold/skills/security-review/SKILL.md

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

12 flagged

scaffold/skills/security-review/references/secrets.mdView file

Lines 15-47markdown

15gitleaks protect --staged --redact --report-format json --report-path .dw/secure-audit/gitleaks.json

17# Commits on this branch vs base (PR style):

18gitleaks detect --redact --log-opts "$(git merge-base HEAD origin/main)..HEAD" \

19 --report-format json --report-path .dw/secure-audit/gitleaks.json

20```

22`--redact` keeps the actual secret value out of the report/logs. A full-tree scan

23(`gitleaks detect` with no `--log-opts`) is the periodic deep pass.

25## Verdict

27- **≥1 finding → REJECTED.** No exception, no ADR. A leaked credential is rotated, not justified.

28- Write `.dw/secure-audit/secret-findings.md`: rule id, `file:line`, commit, and the redacted match.

29 The remediation is always: remove from code + history, rotate the credential, move to a secret store.

31## Allowlisting (test fixtures / examples only)

33Legitimate non-secrets (obvious placeholders, test fixtures) are allowlisted in a committed

34`.gitleaks.toml` (regexes/paths), reviewed like code — not by skipping the scan. A real-looking

35secret in a fixture should still be a fake (e.g., `AKIAIOSFODNN7EXAMPLE`), never a live one.

Critical

Critical Secret

Package contains a critical-looking secret pattern.

scaffold/skills/security-review/references/secrets.mdView on unpkg · L35

Critical

Secret Pattern

AWS access key ID in scaffold/skills/security-review/references/secrets.md

scaffold/skills/security-review/references/secrets.mdView on unpkg · L35

37## Relationship to Trivy

39Trivy's secret scan stays (defense in depth, covers files gitleaks' git-history mode may miss).

40gitleaks is authoritative for the diff. Dedupe by `file:line` in the report so one leak isn't

41double-counted across tools.

43## Tool absent

45If `gitleaks` is not installed, the gate falls back to Trivy secrets only and records "dedicated

46secret scan: skipped (gitleaks not installed)" in the summary, pointing to `install-deps`.

lib/install-deps.jsView file

Lines 1-21javascript

1const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

lib/install-deps.jsView on unpkg · L1

3function run() {

4 console.log('\n dev-workflow install-deps');

5 console.log(` ${'='

scaffold/scripts/lib/resolve-browser.mjsView file

Lines 4-44javascript

4// (dw-qa, dw-functional-doc, dw-redesign-ui), with WSL resilience.

5//

6// Resolution order: Playwright Chromium primary -> optional CDP fallback from env

7// BROWSER_TEST or .dw/config.json (browserTest).

8//

9// Returns one of:

10// { mode: "launch", launchOptions, source, fallback?, openFallback? } // let Playwright launch first

11// { mode: "cdp", endpoint, source, cleanup } // resolved fallback descriptor

12//

13// DEFAULT: full Playwright Chromium in headless via channel:"chromium", which uses the

14// new headless mode (desktop-faithful rendering, not the lighter headless-shell) and

bin/dev-workflow.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { run } = require('../lib/init');

4const installDeps = require('../lib/install-deps');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/dev-workflow.jsView on unpkg · L2

5const installAzureSkills

scaffold/scripts/cdp-relay/bin/cdp-relay.exeView file

•path = scaffold/scripts/cdp-relay/bin/cdp-relay.exe kind = native_binary sizeBytes = 278016 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

scaffold/scripts/cdp-relay/bin/cdp-relay.exeView on unpkg

scaffold/skills/security-review/references/supply-chain.mdView file

Lines 129-169markdown

129```

130

131### Common Typosquatting Patterns

132

133- Character omission: `requests` → `reqests`

134- Character swap: `django` → `djagno`

135- Character doubling: `numpy` → `numppy`

136- Homoglyphs: `requests` → `rеquests` (Cyrillic е)

137- Adding suffixes: `requests-dev`, `requests-py`

138

139---

140

141

scaffold/skills/security-review/references/misconfiguration.mdView file

148patternName = generic_password severity = medium line = 148 matchedText = password...ord'

Medium

Secret Pattern

Hardcoded password in scaffold/skills/security-review/references/misconfiguration.md

scaffold/skills/security-review/references/misconfiguration.mdView on unpkg · L148

150patternName = generic_password severity = medium line = 150 matchedText = password...eme'

Medium

Secret Pattern

Hardcoded password in scaffold/skills/security-review/references/misconfiguration.md

scaffold/skills/security-review/references/misconfiguration.mdView on unpkg · L150

scaffold/skills/security-review/SKILL.mdView file

231patternName = generic_password severity = medium line = 231 matchedText = password...ded"

Medium

Secret Pattern

Hardcoded password in scaffold/skills/security-review/SKILL.md

scaffold/skills/security-review/SKILL.mdView on unpkg · L231