registry / @darkrei08/wizard-ai-cli / 0.50.52

@darkrei08/wizard-ai-cli@0.50.52

Installer for the Wizard-AI environment: AI CLI tools and Claude Code skills (graphify, llmlingua, flashrank, markitdown and more). Clones the repo and runs the platform setup script.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 9 file(s), 81.1 KB of source, external domains: 127.0.0.1, api.github.com, git-scm.com, github.com, skills.sh, www.apple.com

Source & flagged code

4 flagged

index.jsView file

Lines 1-26javascript

1/**

2 * Wizard-AI Pi Extension

3 * Registers the Wizard-AI ecosystem as a pi-extensible-workflows extension,

4 * exposing reusable functions, variables, and workflow definitions.

5 */

7const path = require('path');

8const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L6

10module.exports = async function (api) {

11 // Register slash commands

12 api.onCommand('wizard', () => {

13 console.log('🪄 Wizard-AI Pi Extension loaded.');

14 console.log('Available workflows: loop-2-develop, shadow-clone-jutsu');

15 });

17 api.onCommand('cockpit', () => {

18 console.log('🛠️ Cockpit Tools Pi Extension loaded.');

19 });

21 // Register Wizard-AI as a workflow extension

22 try {

23 const { registerWorkflowExtension } = require('pi-extensible-workflows');

25 registerWorkflowExtension({

26 name: 'wizard-ai',

scripts/wz-ai-proxy.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { execSync } = require('child_process');

4const path = require('path');

5const

scripts/install-mattpocock-skills.shView file

•path = scripts/install-mattpocock-skills.sh kind = build_helper sizeBytes = 2656 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-mattpocock-skills.shView on unpkg

cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @darkrei08/wizard-ai-cli@0.50.46 matchedIdentity = npm:[redacted]:0.50.46 similarity = 0.778 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli.jsView on unpkg

Source & flagged code

4 flagged · loading source

index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code