registry / @comate/zulu / 1.6.4

@comate/zulu@1.6.4

AI Coding Agent

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 696 KB of source, external domains: github.com

Oversized source lightweight scan

comate-engine/server.js9.17 MB file, sampled 256 KB

FilesystemEnvironmentVarsCryptoHighEntropyStringsMinified

dist/bundle/index.js3.97 MB file, sampled 256 KB

FilesystemChildProcessEnvironmentVarsCryptoObfuscatedHighEntropyStrings

Source & flagged code

9 flagged

comate-engine/assets/skills/ku-doc-manage/references/export_sheet.mdView file

Lines 9-49markdown

9```bash

10$SKILL_DIR/bin/ku export-sheet --doc-id <doc-guid>

11# 或

12$SKILL_DIR/bin/ku export-sheet --url <sheet-url>

13```

15## 参数说明

17| 参数 | 必填 | 说明 | 示例 |

18|------|------|------|------|

22## 响应示例

24```json

25{

26 "msg": "OK",

27 "result": {

28 "docGuid": "9a5cbba3a05f42",

29 "downloadUrl": "https://ku-sheet-server.baidu-int.com/uploader/f/AIpYXIibM3pHkPDT.xlsx?accessToken=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhcHBJZCI6ImEwZTkyODg3MGJiZjRmNzRiMTFiYjUyODFhNDdjMzA0IiwiYXVkIjoiYWNjZXNzX3Jlc291cmNlIiwiZXhwIjoxNzc2OTE3MTA2LCJpYXQiOjE3NzY5MTY1MDYsInVzZXJJZCI6IjEwMDAwMDAwMTI4In0.upCTPtxLGIH1NHyhgsAsEmB_54t4H0bcJZr_Y7_z5Bc&download=1",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

comate-engine/assets/skills/ku-doc-manage/references/export_sheet.mdView on unpkg · L29

Critical

Secret Pattern

Supabase service role key (JWT) in comate-engine/assets/skills/ku-doc-manage/references/export_sheet.md

comate-engine/assets/skills/ku-doc-manage/references/export_sheet.mdView on unpkg · L29

30 "finished": true,

31 "progress": 100,

32 "taskId": null

33 },

34 "returnCode": 200,

35 "returnMessage": "OK",

36 "status": 200,

37 "success": true,

38 "traceId": "702368100654014464"

39}

40```

42## 关键字段说明

44| 字段 | 说明 |

45|------|------|

46| `downloadUrl` | **Excel 文件下载链接**（核心字段，Agent 必须使用此链接下载文件） |

48## Agent 处理指引

comate-engine/assets/skills/icode/scripts/common.shView file

•path = comate-[redacted].sh kind = build_helper sizeBytes = 3826 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

comate-engine/assets/skills/icode/scripts/common.shView on unpkg

dist/bundle/index.jsView file

•path = dist/bundle/index.js kind = oversized_source_file sizeBytes = 4164539 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

dist/bundle/index.jsView on unpkg

comate-engine/assets/skills/code-security/references/vul_analysis-sensitive_false_positive.mdView file

Lines 118-187markdown

118

119- 全 `X`、`*`、`?`、`<>`、`{}` 等占位符：`"XXXXXXXXXX"`、`"<your-ak-here>"`、`"{ak}"`、`"your_password"`、`"changeme"`、`"REPLACE_ME"`

comate-engine/assets/skills/code-security/references/vul_repair_sensitive.mdView file

Lines 364-391markdown

364

365using namespace baidu::credentialvault::cppsdk;

366

367int main(int argc, char *argv[]) {

368 // 初始化 keyless-sdk 开始

369 // step1: 设置 credential_id 构建 client，详情可参考 https://ku.baidu-int.com/d/x5s_A3YHll0PvR

370 // 默认版本号为 -1 代表拉取最新版本，可以缺省不填写该参数；线上服务建议指定版本，保证稳定

371 KeylessClient client = KeylessClient("appDemo_prod", 1);

372 // step2: 获取凭证信息并注入到系统环境变量中

373 KeylessStatus load_result = client.load();

Source & flagged code

9 flagged · loading source

comate-engine/assets/skills/ku-doc-manage/references/export_sheet.mdView file

29patternName = supabase_service_key severity = critical line = 29 matchedText = "downloa...=1",

Critical

Critical Secret

Package contains a critical-looking secret pattern.

comate-engine/assets/skills/ku-doc-manage/references/export_sheet.mdView on unpkg · L29

29patternName = supabase_service_key severity = critical line = 29 matchedText = "downloa...=1",

Critical

Secret Pattern

Supabase service role key (JWT) in comate-engine/assets/skills/ku-doc-manage/references/export_sheet.md

comate-engine/assets/skills/ku-doc-manage/references/export_sheet.mdView on unpkg · L29

comate-engine/assets/skills/icode/scripts/common.shView file

Findings

6 Critical1 High5 Medium4 Low

CriticalCritical Secretcomate-engine/assets/skills/ku-doc-manage/references/export_sheet.md

CriticalSecret Patterncomate-engine/assets/skills/ku-doc-manage/references/export_sheet.md

CriticalSecret Patterncomate-engine/assets/skills/code-security/references/vul_analysis-sensitive_false_positive.md

HighOversized Source Filedist/bundle/index.js

MediumNetwork

MediumEnvironment Vars