registry / @erminhhho/profile / 0.2.0

@erminhhho/profile@0.2.0

Canonical personal AI profile with workspace-native adapters for Codex and Copilot

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 14 file(s), 17.7 KB of source, external domains: nodejs.org, raw.githubusercontent.com

Source & flagged code

2 flagged

src/tools.jsView file

Lines 1-21javascript

1import { execSync } from 'node:child_process'

2import { env } from 'node:process'

High

Child Process

Package source references child process execution.

src/tools.jsView on unpkg · L1

4function run(cmd, label) {

5 try {

6 console.log(` → ${label}...`)

7 execSync(cmd, { encoding: 'utf8', stdio: 'pipe', timeout: 120000 })

8 return true

9 } catch (e) {

10 console.error(` ✗ ${label} failed: ${e.stderr?.slice(0, 200) || e.message}`)

11 return false

12 }

13}

15async function pipInstall(pkg) {

16 const pip = env.PIP_REQUIRE_VIRTUALENV ? 'pip' : 'pip install --break-system-packages'

17 return run(`${pip} install --upgrade ${pkg}`, `Install ${pkg}`)

18}

20export async function setupCaveman() {

21 console.log('\n Caveman — compress replies')

src/commands/init.jsView file

Lines 5-45javascript

5export async function initCommand(flags, context = {}) {

6 console.log(`@erminhhho/profile init — setting up AI coding environment\n`)

8 const env = detectEnv()

10 console.

Source & flagged code

2 flagged · loading source

src/tools.jsView file

1import { execSync } from 'node:child_process' L2: import { env } from 'node:process'

High

Child Process

Package source references child process execution.

src/tools.jsView on unpkg · L1

src/commands/init.jsView file

25console.log(`\n → Installing OpenCode...`) L26: const npm = await import('node:child_process') L27: npm.execSync('npm install -g opencode', { encoding: 'utf8', stdio: 'inherit', timeout: 120000 }) L28: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/init.jsView on unpkg · L25

Findings

3 High3 Medium6 Low

HighChild Processsrc/tools.js

HighShell

HighRuntime Package Installsrc/commands/init.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

src/tools.jsView file

Lines 1-21javascript

1import { execSync } from 'node:child_process'

2import { env } from 'node:process'

High

Child Process

Package source references child process execution.

src/tools.jsView on unpkg · L1

4function run(cmd, label) {

5 try {

6 console.log(` → ${label}...`)

7 execSync(cmd, { encoding: 'utf8', stdio: 'pipe', timeout: 120000 })

8 return true

9 } catch (e) {

10 console.error(` ✗ ${label} failed: ${e.stderr?.slice(0, 200) || e.message}`)

11 return false

12 }

13}

15async function pipInstall(pkg) {

16 const pip = env.PIP_REQUIRE_VIRTUALENV ? 'pip' : 'pip install --break-system-packages'

17 return run(`${pip} install --upgrade ${pkg}`, `Install ${pkg}`)

18}

20export async function setupCaveman() {

21 console.log('\n Caveman — compress replies')

src/commands/init.jsView file

Lines 5-45javascript

5export async function initCommand(flags, context = {}) {

6 console.log(`@erminhhho/profile init — setting up AI coding environment\n`)

8 const env = detectEnv()

10 console.