registry  /  @cliphijack/santaclaude  /  1.0.94

@cliphijack/santaclaude@1.0.94

SantaClaude 커넥터 — 클라우드 예약을 내 로컬 Claude(tmux)에 발사

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 7 file(s), 258 KB of source, external domains: api.notion.com, mcp.higgsfield.ai, primeradiant.com, santaclaude.app

Source & flagged code

5 flagged · loading source
bundled-superpowers/skills/brainstorming/scripts/server.cjsView file
536const url = companionUrl(); // must carry the key or the gate 403s it L537: const cp = require('child_process'); L538: // Operator-provided launcher: run as given (this env var is trusted operator input).
High
Child Process

Package source references child process execution.

bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L536
1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L12: function computeAcceptKey(clientKey) { L13: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L14: } ... L84: L85: const PORT_FILE = process.env.BRAINSTORM_PORT_FILE || null; L86: const randomPort = () => 49152 + Math.floor(Math.random() * 16383); ... L195: try { sessionStorage.setItem('brainstorm-session-key', ${jsonKey}); } catch (e) {} L196: location.replace('/'); L197: </script>
Low
Weak Crypto

Package source references weak cryptographic algorithms.

bundled-superpowers/skills/brainstorming/scripts/server.cjsView on unpkg · L1
santaclaude.jsView file
38* [당신 손으로 검증] L39: * - 외부 송신부 전체: 이 파일에서 fetch( 를 검색 → 목적지는 우리 워커(DEFAULT_API)와 L40: * api.notion.com(당신→당신 노션) 둘뿐. 제3자 없음. ... L46: */ L47: const { execFileSync } = require('child_process'); L48: const fs = require('fs'); ... L52: const VER = (() => { try { return require('./package.json').version; } catch (e) { return '0'; } })(); L53: const VIA_NPX = __dirname.includes('_npx') || __dirname.includes('npm-cache') || process.env.SC_AUTOUP === '1'; L54:
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

santaclaude.jsView on unpkg · L38
70const t0 = Date.now(); L71: const r = spawnSync('npx', ['-y', '@cliphijack/santaclaude@' + spec], { stdio: 'inherit', env: { ...process.env, SC_SUP: '1' } }); L72: const lived = Date.now() - t0;
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

santaclaude.jsView on unpkg · L70
bundled-superpowers/skills/systematic-debugging/find-polluter.shView file
•path = bundled-superpowers/skills/systematic-debugging/find-polluter.sh kind = build_helper sizeBytes = 1528 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bundled-superpowers/skills/systematic-debugging/find-polluter.shView on unpkg

Findings

4 High4 Medium4 Low
HighChild Processbundled-superpowers/skills/brainstorming/scripts/server.cjs
HighShell
HighSame File Env Network Executionsantaclaude.js
HighRuntime Package Installsantaclaude.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperbundled-superpowers/skills/systematic-debugging/find-polluter.sh
MediumStructural Risk Force Deep Review
LowWeak Cryptobundled-superpowers/skills/brainstorming/scripts/server.cjs
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings