registry / @doist/comms-cli / 1.9.1

@doist/comms-cli@1.9.1

TypeScript CLI for Comms

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 120 file(s), 415 KB of source, external domains: api.comms.todoist.com, comms.local.todoist.com, comms.staging.todoist.com, comms.todoist.com, github.com, local.todoist.com, raw.githubusercontent.com, staging.todoist.com, todoist.com, twist.com, www.w3.org

Source & flagged code

3 flagged

package.jsonView file

Lines 1-37json

2 "name": "@doist/comms-cli",

3 "version": "1.9.1",

4 "description": "TypeScript CLI for Comms",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "tdc": "dist/index.js"

9 },

10 "scripts": {

11 "build": "tsc -p tsconfig.build.json && chmod +x dist/index.js",

12 "dev": "tsc -p tsconfig.build.json --watch",

13 "start": "node dist/index.js",

14 "type-check": "tsc --noEmit",

15 "lint": "oxlint . --fix && oxfmt",

16 "lint:check": "oxlint . && oxfmt --check",

17 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "check:skill-sync": "node scripts/check-skill-sync.js",

19 "sync:skill": "npm run build && node scripts/sync-skill.js",

20 "test": "vitest run",

21 "test:watch": "vitest",

22 "prepublishOnly": "npm run build && npm test"

23 },

24 "keywords": [

25 "comms",

26 "cli",

27 "messaging",

28 "doist"

29 ],

30 "author": "Doist developers",

31 "license": "MIT",

32 "engines": {

33 "node": "^20.19.0 || >=22.12.0"

34 },

35 "repository": {

36 "type": "git",

37 "url": "https://github.com/Doist/comms-cli.git"

scripts/check-skill-sync.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

3/**

4 * Verifies that skills/comms-cli/SKILL.md is in sync with the generated

5 * skill content from src/lib/skills/content.ts.

6 *

7 * Requires `npm run build` to have been run first.

8 */

10import { readFile } from 'node:fs/promises'

11import { dirname, join } from

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.js

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

scripts/check-skill-sync.jsView file

17const modulePath = pathToFileURL(join(root, 'dist/lib/skills/content.js')).href L18: const { SKILL_FILE_CONTENT } = await import(modulePath) L19: const expected = SKILL_FILE_CONTENT

Medium

Dynamic Require

Package source references dynamic require/import behavior.

scripts/check-skill-sync.jsView on unpkg · L17

Findings

1 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirescripts/check-skill-sync.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

package.jsonView file

Lines 1-37json

2 "name": "@doist/comms-cli",

3 "version": "1.9.1",

4 "description": "TypeScript CLI for Comms",

5 "type": "module",

6 "main": "dist/index.js",

7 "bin": {

8 "tdc": "dist/index.js"

9 },

10 "scripts": {

11 "build": "tsc -p tsconfig.build.json && chmod +x dist/index.js",

12 "dev": "tsc -p tsconfig.build.json --watch",

13 "start": "node dist/index.js",

14 "type-check": "tsc --noEmit",

15 "lint": "oxlint . --fix && oxfmt",

16 "lint:check": "oxlint . && oxfmt --check",

17 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L17

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L17

18 "check:skill-sync": "node scripts/check-skill-sync.js",

19 "sync:skill": "npm run build && node scripts/sync-skill.js",

20 "test": "vitest run",

21 "test:watch": "vitest",

22 "prepublishOnly": "npm run build && npm test"

23 },

24 "keywords": [

25 "comms",

26 "cli",

27 "messaging",

28 "doist"

29 ],

30 "author": "Doist developers",

31 "license": "MIT",

32 "engines": {

33 "node": "^20.19.0 || >=22.12.0"

34 },

35 "repository": {

36 "type": "git",

37 "url": "https://github.com/Doist/comms-cli.git"

scripts/check-skill-sync.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

3/**

4 * Verifies that skills/comms-cli/SKILL.md is in sync with the generated

5 * skill content from src/lib/skills/content.ts.

6 *

7 * Requires `npm run build` to have been run first.

8 */

10import { readFile } from 'node:fs/promises'

11import { dirname, join } from