registry / @darkrei08/wizard-ai-cli / 0.52.33

@darkrei08/wizard-ai-cli@0.52.33

Installer for the Wizard-AI environment: AI CLI tools and Claude Code skills (graphify, llmlingua, flashrank, markitdown and more). Clones the repo and runs the platform setup script.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 13 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 18 file(s), 152 KB of source, external domains: 127.0.0.1, api.github.com, git-scm.com, github.com, raw.githubusercontent.com, skills.sh, www.apple.com

Source & flagged code

5 flagged

index.jsView file

Lines 1-48javascript

1/**

2 * Wizard-AI Pi Extension

3 * Registers the Wizard-AI ecosystem as a pi-extensible-workflows extension,

4 * exposing reusable functions, variables, and workflow definitions.

5 */

7const path = require('path');

8const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

index.jsView on unpkg · L6

10module.exports = async function (api) {

11 // Register slash commands

12 api.onCommand('wizard', () => {

13 console.log('🪄 Wizard-AI Pi Extension loaded.');

14 console.log('Available workflows: loop-2-develop, shadow-clone-jutsu');

15 });

17 // Load Cockpit Tools Pi Extension

18 try {

19 const cockpitExtension = require(path.join(__dirname, 'pi-cockpit-tools', 'index.js'));

20 cockpitExtension(api);

21 } catch (err) {

22 api.onCommand('cockpit', () => {

23 console.log('🛠️ Cockpit Tools Pi Extension loaded (standalone mode).');

24 });

25 }

27 // Register Wizard-AI as a workflow extension

28 try {

29 const { registerWorkflowExtension } = require('pi-extensible-workflows');

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

index.jsView on unpkg · L28

31 registerWorkflowExtension({

32 name: 'wizard-ai',

33 description: 'Wizard-AI ecosystem: 3-Tier Agent Swarm with 5-Loop Pipeline orchestration, token optimization, and persistent memory.',

35 // Expose reusable variables to all workflows

36 variables: {

37 wizardAiDir: {

38 description: 'Root directory of the Wizard-AI installation',

39 resolve: () => process.env.WIZARD_AI_DIR || path.join(require('os').homedir(), '.wizard-ai'),

40 },

41 projectMemory: {

42 description: 'Current session memory state from MEMORY.md',

43 resolve: (runContext) => {

44 const memPath = path.join(runContext.cwd || process.cwd(), 'MEMORY.md');

45 try {

46 return fs.readFileSync(memPath, 'utf-8').slice(0, 2000); // Truncate for token efficiency

47 } catch {

48 return 'No MEMORY.md found in project root.';

scripts/wz-ai-proxy.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { execSync } = require('child_process');

4const path = require('path');

5const

scripts/install-mattpocock-skills.shView file

•path = scripts/install-mattpocock-skills.sh kind = build_helper sizeBytes = 2656 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-mattpocock-skills.shView on unpkg

Source & flagged code

5 flagged · loading source

index.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code