registry / @draht/coding-agent / 2026.7.11

@draht/coding-agent@2026.7.11

Coding agent CLI with read, bash, edit, write tools and session management

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 292 file(s), 2.73 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.github.com, chat.qwen.ai, claude.ai, cli.github.com, cloud.gitlab.com, console.anthropic.com, daily-cloudcode-pa.sandbox.googleapis.com, dashscope.aliyuncs.com, distro.ibiblio.org, git-scm.com, github.com, gitlab.com, mariozechner.at, mistral.ai, pi.dev, www.w3.org

Source & flagged code

8 flagged

bin/draht-tools.cjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * Draht Tools — CLI for the Get Shit Done methodology.

6 * Manages .planning/ directory structure, state tracking, and git integration.

7 */

9const fs = require("node:fs");

10const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/draht-tools.cjsView on unpkg · L8

11const { execSync, execFileSync } = require("node:child_process");

High

Child Process

Package source references child process execution.

bin/draht-tools.cjsView on unpkg · L10

13const PLANNING_DIR = ".planning";

14const BANNER_WIDTH = 55;

16// ============================================================================

17// Helpers

18// ============================================================================

20function banner(stage) {

21 const line = "━".repeat(BANNER_WIDTH);

22 return `${line}\n DRAHT ► ${stage}\n${line}`;

23}

25function planningPath(...segments) {

26 return path.join(process.cwd(), PLANNING_DIR, ...segments);

27}

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/draht-tools.cjsView on unpkg · L10

29function ensureDir(dir) {

30 if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });

dist/utils/notify.jsView file

Lines 1-26javascript

1/**

2 * Terminal notification utility.

3 *

4 * Sends a native notification when the agent finishes its turn.

5 * Detection order:

6 * - cmux: `cmux notify` CLI

7 * - Windows Terminal (WSL): PowerShell toast

8 * - Kitty: OSC 99

High

Shell

Package source references shell execution.

dist/utils/notify.jsView on unpkg · L6

9 * - Fallback: OSC 777 (Ghostty, iTerm2, WezTerm, rxvt-unicode)

10 */

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir

dist/hooks/gsd/draht-quality-gate.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * Draht Quality Gate Hook

6 * Runs after task completion to enforce quality standards.

7 * Called by the build agent after each verify step.

8 *

9 * Usage: node gsd-quality-gate.js [--strict]

10 * Exit 0 = quality OK, Exit 1 = quality issues

11 */

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

Source & flagged code

8 flagged · loading source

bin/draht-tools.cjsView file

10const path = require("node:path"); L11: const { execSync, execFileSync } = require("node:child_process"); L12:

High

Child Process

Package source references child process execution.

bin/draht-tools.cjsView on unpkg · L10

10Manifest entrypoint (manifest.bin) carries capability families absent from dist/build output: sensitive-file+network, execution+network L10: const path = require("node:path"); L11: const { execSync, execFileSync } = require("node:child_process"); L12: ... L25: function planningPath(...segments) { L26: return path.join(process.cwd(), PLANNING_DIR, ...segments); L27: } ... L34: try { L35: return JSON.parse(fs.readFileSync(filePath, "utf-8")); L36: } catch { ... L88: // Whole-repo enforcement (WP6, defect 22): walk up from `startDir` to the nearest `.git`, then L89: // (if none found) the nearest package.json declaring `workspaces` or a pnpm-workspace.yaml. L90: // Falls back to startDir itself so single-package / non-git checkouts still work.

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/draht-tools.cjsView on unpkg · L10

8L9: const fs = require("node:fs"); L10: const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/draht-tools.cjsView on unpkg · L8

dist/utils/notify.jsView file

6* - cmux: `cmux notify` CLI L7: * - Windows Terminal (WSL): PowerShell toast L8: * - Kitty: OSC 99

High

Shell

Package source references shell execution.

dist/utils/notify.jsView on unpkg · L6

examples/extensions/doom-overlay/doom-engine.tsView file

64const nativeRequire = createRequire(doomJsPath); L65: const moduleFunc = new Function("module", "exports", "__dirname", "__filename", "require", doomJsCode); L66: moduleFunc(moduleExports, moduleExports.exports, buildDir, doomJsPath, nativeRequire);

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/extensions/doom-overlay/doom-engine.tsView on unpkg · L64

dist/hooks/gsd/draht-quality-gate.jsView file

12L13: const { execSync } = require("node:child_process"); L14: const fs = require("node:fs"); ... L19: if (fs.existsSync(path.join(cwd, "bun.lockb")) || fs.existsSync(path.join(cwd, "bun.lock"))) { L20: return { pm: "bun", testCmd: "bun test", coverageCmd: "bun test --coverage", lintCmd: "bunx biome check ." }; L21: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/hooks/gsd/draht-quality-gate.jsView on unpkg · L12

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg

Findings

4 High6 Medium6 Low

HighChild Processbin/draht-tools.cjs

HighShelldist/utils/notify.js

HighEntrypoint Build Divergencebin/draht-tools.cjs

HighRuntime Package Installdist/hooks/gsd/draht-quality-gate.js

MediumDynamic Requirebin/draht-tools.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Wasm Moduleexamples/extensions/doom-overlay/doom/build/doom.wasm

MediumShips Build Helperexamples/extensions/doom-overlay/doom/build.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowEvalexamples/extensions/doom-overlay/doom-engine.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

bin/draht-tools.cjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * Draht Tools — CLI for the Get Shit Done methodology.

6 * Manages .planning/ directory structure, state tracking, and git integration.

7 */

9const fs = require("node:fs");

10const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/draht-tools.cjsView on unpkg · L8

11const { execSync, execFileSync } = require("node:child_process");

High

Child Process

Package source references child process execution.

bin/draht-tools.cjsView on unpkg · L10

13const PLANNING_DIR = ".planning";

14const BANNER_WIDTH = 55;

16// ============================================================================

17// Helpers

18// ============================================================================

20function banner(stage) {

21 const line = "━".repeat(BANNER_WIDTH);

22 return `${line}\n DRAHT ► ${stage}\n${line}`;

23}

25function planningPath(...segments) {

26 return path.join(process.cwd(), PLANNING_DIR, ...segments);

27}

High

Entrypoint Build Divergence

Manifest entrypoint contains risky behavior absent from dist/build output.

bin/draht-tools.cjsView on unpkg · L10

29function ensureDir(dir) {

30 if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });

dist/utils/notify.jsView file

Lines 1-26javascript

1/**

2 * Terminal notification utility.

3 *

4 * Sends a native notification when the agent finishes its turn.

5 * Detection order:

6 * - cmux: `cmux notify` CLI

7 * - Windows Terminal (WSL): PowerShell toast

8 * - Kitty: OSC 99

High

Shell

Package source references shell execution.

dist/utils/notify.jsView on unpkg · L6

9 * - Fallback: OSC 777 (Ghostty, iTerm2, WezTerm, rxvt-unicode)

10 */

examples/extensions/doom-overlay/doom-engine.tsView file

Lines 44-84typescript

44 return this._height;

45 }

47 async init(): Promise<void> {

48 // Locate WASM build

49 const __dirname = dirname(fileURLToPath(import.meta.url));

50 const buildDir

dist/hooks/gsd/draht-quality-gate.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * Draht Quality Gate Hook

6 * Runs after task completion to enforce quality standards.

7 * Called by the build agent after each verify step.

8 *

9 * Usage: node gsd-quality-gate.js [--strict]

10 * Exit 0 = quality OK, Exit 1 = quality issues

11 */

examples/extensions/doom-overlay/doom/build/doom.wasmView file

•path = examples/extensions/doom-overlay/doom/build/doom.wasm kind = wasm_module sizeBytes = 380169 magicHex = [redacted]

Medium

Ships Wasm Module

Package ships WebAssembly modules.

examples/extensions/doom-overlay/doom/build/doom.wasmView on unpkg

examples/extensions/doom-overlay/doom/build.shView file

•path = examples/extensions/doom-overlay/doom/build.sh kind = build_helper sizeBytes = 3366 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/extensions/doom-overlay/doom/build.shView on unpkg