registry  /  @creatok/cli  /  0.3.2

@creatok/cli@0.3.2

CreatOK CLI — drives CreatOK Open Skills (analyze, generate image/video) for TikTok creators and sellers.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVars
Supply chainNo supply-chain packaging signals triggered.
Manifest
NoLicense
scanned 2 file(s), 3.08 KB of source

Source & flagged code

4 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
run.jsView file
5// optional dependency) and exec it, passing through args, stdio, and exit code. L6: const { spawnSync } = require('child_process'); L7:
High
Child Process

Package source references child process execution.

run.jsView on unpkg · L5
22`The platform may be unsupported, or the optional platform package failed to install.\n` + L23: `Try: npm install -g @creatok/cli --force` L24: ); ... L27: L28: const result = spawnSync(bin, process.argv.slice(2), { stdio: 'inherit' }); L29: if (result.error) {
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

run.jsView on unpkg · L22

Findings

3 High3 Medium2 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processrun.js
HighRuntime Package Installrun.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowNo License