registry / @ericrisco/rsc / 0.1.40

@ericrisco/rsc@0.1.40

Eric Risco's agent-skills catalog as a granular, self-recommending CLI installer.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 35 file(s), 141 KB of source, external domains: mcp.context7.com, registry.npmjs.org, staging.example.com

Source & flagged code

6 flagged

skills/google-workspace/scripts/verify.shView file

Lines 1-37shell

1#!/usr/bin/env bash

3# verify.sh — credential + scope preflight linter for Google Workspace

4# integration code. NO network. Scans a target dir for the dangerous/wrong

5# patterns this skill bans, and exits non-zero on any hit.

7# Read-only. Never writes, edits, or sends anything.

9# Checks:

10# 1. Tracked service-account key files: a *.json containing "private_key"

11# and a service-account marker (client_email / .iam.gserviceaccount.com) —

12# a committed SA key.

13# 2. Over-broad scope where a narrower variant exists:

14# .../auth/drive (use drive.file / drive.readonly)

15# .../auth/gmail [bare] (use gmail.send / gmail.readonly)

16# .../mail.google.com/ (full mailbox incl. delete)

17# 3. Hardcoded private key in source: a literal "-----BEGIN PRIVATE KEY-----".

Critical

Critical Secret

Package contains a critical-looking secret pattern.

skills/google-workspace/scripts/verify.shView on unpkg · L17

Critical

Secret Pattern

RSA private key in skills/google-workspace/scripts/verify.sh

skills/google-workspace/scripts/verify.shView on unpkg · L17

18# 4. Workspace API calls (googleapis / googleapiclient) with no backoff/retry

19# helper anywhere in the file (informational WARN, not a hard fail).

20#

21# Usage:

22# scripts/verify.sh [PATH ...]

23# PATH = a file or directory. With no PATH, scans the current directory.

24#

25# Exit 0 = no banned pattern found (an empty/clean target is a pass).

26# Exit 1 = at least one hard finding (checks 1-3).

27# Exit 2 = a usage / environment problem.

29set -euo pipefail

31# This script intentionally contains the banned patterns as documentation /

32# match literals; never let it flag itself. grep -rn emits a "<path>:<line>:..."

33# prefix whose <path> is relative or absolute depending on how the target was

34# named, so we cannot match the absolute $SELF. Instead, strip any hit whose

35# path component (everything before the first ":") basenames to this script.

36SELF_BASE="$(basename "${BASH_SOURCE[0]}")"

37drop_self() {

Lines 90-129shell

90 emit "committed service-account key JSON (use keyless ADC/WIF or a secret manager)" "$key_hits"

91fi

93# --- check 2: over-broad OAuth scopes -------------------------------------

94broad=""

95b="$( { grep -rnI "${EXCLUDE[@]}" "${

scripts/reviewer-guard.shView file

•path = scripts/reviewer-guard.sh kind = build_helper sizeBytes = 1772 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/reviewer-guard.shView on unpkg

skills/gcp-essentials/SKILL.mdView file

Lines 198-238markdown

198```bash

199gcloud sql instances create acme-db \

200 --database-version=POSTGRES_16 \

201 --edition=ENTERPRISE \

202 --region=europe-west1 \

203 --tier=db-f1-micro

skills/nextjs/references/testing.mdView file

Lines 145-185markdown

145}));

146vi.mock("next/cache", () => ({ revalidateTag: vi.fn() }));

147

148import { signup } from "@/app/signup/actions";

149import { db } from "@/lib/db";

150

151function fd(obj: Record<string, string>) {

152 const f = new FormData();

153 for (const [k, v] of Object.entries(obj)) f.set(k, v);

154 return f;

155}

Source & flagged code

6 flagged · loading source

skills/google-workspace/scripts/verify.shView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code