registry / @codewithjuber/forgekit / 0.8.1

@codewithjuber/forgekit@0.8.1

One brain for every AI coding agent — the cognitive substrate every frozen model is missing (proof-carrying memory, impact foresight, enforced guardrails), authored once and delivered as native config to Claude Code, Codex, Cursor, Gemini, Aider, and more

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 62 file(s), 496 KB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, github.com, openrouter.ai, your-gateway.example.com

Source & flagged code

7 flagged

scripts/build-pages.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2// Data sources: local package.json, README.md, CHANGELOG.md, reports/benchmarks.md,

3// and optionally https://api.github.com/repos/CodeWithJuber/forgekit when BUILD_PAGES_LIVE=1.

4import { execFileSync } from "node:child_process";

5import { mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/build-pages.mjsView on unpkg · L3

6import { dirname, join } from "node:path";

7import { fileURLToPath } from "node:url";

9const root = join(dirname(fileURLToPath(import.meta.url)), "..");

10const out = join(root, "public", "index.html");

11const cacheFile = join(root, ".cache", "pages", "github-repo.json");

12const api = "https://api.github.com/repos/CodeWithJuber/forgekit";

14const esc = (s) =>

15 String(s ?? "").replace(

16 /[&<>"]/g,

17 (c) => ({ "&": "&", "<": "<", ">": ">", '"': """ })[c],

18 );

19const read = (p) => readFileSync(join(root, p), "utf8");

20const pkg = JSON.parse(read("package.json"));

21const readme = read("README.md");

22const changelog = read("CHANGELOG.md");

23const benchmarks = read("reports/benchmarks.md");

src/embed.jsView file

Lines 115-170javascript

115 const path = embedCachePath(root);

116 try {

117 mkdirSync(join(root, ".forge"), { recursive: true });

118 appendFileSync(path, `${entries.map((e) => JSON

src/uivisual.jsView file

Lines 35-75javascript

35// ---------------------------------------------------------------------------

37/**

38 * Resolve a playwright runtime: FORGE_PLAYWRIGHT (an explicit module path or bare

39 * name — how tests and scratch installs point at an out-of-tree copy) wins and is

40 * authoritative when set; otherwise try `playwright-core` then `playwright`. Returns

41 * the module (something with `.chromium.launch`) or null — never throws. Browser

42 * binaries follow playwright's own PLAYWRIGHT_BROWSERS_PATH handling.

43 * @returns {Promise<{chromium:{launch:Function}}|null>}

44 */

src/cli.jsView file

Lines 730-770javascript

730 );

731 }

732 console.log("\n install ccusage for precise tracking: npm i -g ccusage");

733 } else {

734 console.log(

735 " ccusage not found. Install for real spend (reads local JSONL, nothing leaves your machine):\n npm i -g ccusage # then: forge cost",

736 );

737 }

bin/learn-consolidate.shView file

•path = bin/learn-consolidate.sh kind = build_helper sizeBytes = 2422 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/learn-consolidate.shView on unpkg

Source & flagged code

7 flagged · loading source

scripts/build-pages.mjsView file

3// and optionally https://api.github.[redacted] when BUILD_PAGES_LIVE=1. L4: import { execFileSync } from "node:child_process"; L5: import { mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/build-pages.mjsView on unpkg · L3

src/embed.jsView file

150? spawnSync(provider.cmd, { L151: shell: true, L152: input,

High

Shell

Package source references shell execution.

src/embed.jsView on unpkg · L150

135// the CHILD's env — the key never appears in argv, logs, or error output. L136: const HTTP_CHILD = `let raw="";process.stdin.on("data",(d)=>{raw+=d;});process.stdin.on("end",async()=>{try{const{url,model,texts}=JSON.parse(raw);const headers={"content-type":"ap... L137: ... L149: provider.kind === "cmd" L150: ? spawnSync(provider.cmd, { L151: shell: true,

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

src/embed.jsView on unpkg · L135

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

src/embed.jsView on unpkg · L135

src/uivisual.jsView file

55entry = pathToFileURL( L56: createRequire(import.meta.url).resolve(isAbsolute(spec) ? spec : resolve(spec)), L57: ).href;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/uivisual.jsView on unpkg · L55

src/cli.jsView file

750// Pinned (verified 2026-07-05) — never @latest for code we execute; re-verify via dev-radar. L751: execFileSync("npx", ["-y", "@fission-ai/openspec@1.5.0", "init"], { L752: stdio: "inherit",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/cli.jsView on unpkg · L750

bin/learn-consolidate.shView file

•path = bin/learn-consolidate.sh kind = build_helper sizeBytes = 2422 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/learn-consolidate.shView on unpkg

Findings

5 High5 Medium4 Low

HighChild Processscripts/build-pages.mjs

HighShellsrc/embed.js

HighSame File Env Network Executionsrc/embed.js

HighCommand Output Exfiltrationsrc/embed.js

HighRuntime Package Installsrc/cli.js

MediumDynamic Requiresrc/uivisual.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperbin/learn-consolidate.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

scripts/build-pages.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2// Data sources: local package.json, README.md, CHANGELOG.md, reports/benchmarks.md,

3// and optionally https://api.github.com/repos/CodeWithJuber/forgekit when BUILD_PAGES_LIVE=1.

4import { execFileSync } from "node:child_process";

5import { mkdirSync, readFileSync, statSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

scripts/build-pages.mjsView on unpkg · L3

6import { dirname, join } from "node:path";

7import { fileURLToPath } from "node:url";

9const root = join(dirname(fileURLToPath(import.meta.url)), "..");

10const out = join(root, "public", "index.html");

11const cacheFile = join(root, ".cache", "pages", "github-repo.json");

12const api = "https://api.github.com/repos/CodeWithJuber/forgekit";

14const esc = (s) =>

15 String(s ?? "").replace(

16 /[&<>"]/g,

17 (c) => ({ "&": "&", "<": "<", ">": ">", '"': """ })[c],

18 );

19const read = (p) => readFileSync(join(root, p), "utf8");

20const pkg = JSON.parse(read("package.json"));

21const readme = read("README.md");

22const changelog = read("CHANGELOG.md");

23const benchmarks = read("reports/benchmarks.md");

src/embed.jsView file

Lines 115-170javascript

115 const path = embedCachePath(root);

116 try {

117 mkdirSync(join(root, ".forge"), { recursive: true });

118 appendFileSync(path, `${entries.map((e) => JSON

src/uivisual.jsView file

Lines 35-75javascript

35// ---------------------------------------------------------------------------

37/**

38 * Resolve a playwright runtime: FORGE_PLAYWRIGHT (an explicit module path or bare

39 * name — how tests and scratch installs point at an out-of-tree copy) wins and is

40 * authoritative when set; otherwise try `playwright-core` then `playwright`. Returns

41 * the module (something with `.chromium.launch`) or null — never throws. Browser

42 * binaries follow playwright's own PLAYWRIGHT_BROWSERS_PATH handling.

43 * @returns {Promise<{chromium:{launch:Function}}|null>}

44 */

src/cli.jsView file

Lines 730-770javascript

730 );

731 }

732 console.log("\n install ccusage for precise tracking: npm i -g ccusage");

733 } else {

734 console.log(

735 " ccusage not found. Install for real spend (reads local JSONL, nothing leaves your machine):\n npm i -g ccusage # then: forge cost",

736 );

737 }

bin/learn-consolidate.shView file

•path = bin/learn-consolidate.sh kind = build_helper sizeBytes = 2422 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

bin/learn-consolidate.shView on unpkg