registry / @gstack-vibehard/installer / 3.100.1

@gstack-vibehard/installer@3.100.1

⚠ Under review

gstack_vibehard — Cross-harness installer & fullstack template kit with deep agent integration (Codex, Claude Code, OpenCode)

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 256 file(s), 1.24 MB of source, external domains: 127.0.0.1, api.anthropic.com, astral.sh, bun.sh, cdn.jsdelivr.net, docs.astral.sh, docs.devin.ai, github.com, go.dev, install.python-poetry.org, mesh.dev-a.team, mesh.dev-b.team, opencode.ai, registry.npmjs.org, rustup.rs, sh.rustup.rs, static.rust-lang.org, www.npmjs.com, www.python.org

Source & flagged code

7 flagged

agents/skills/writing-skills/render-graphs.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

3/**

4 * Render graphviz diagrams from a skill's SKILL.md to SVG files.

5 *

6 * Usage:

7 * ./render-graphs.js <skill-directory> # Render each diagram separately

8 * ./render-graphs.js <skill-directory> --combine # Combine all into one diagram

9 *

10 * Extracts all ```dot blocks from SKILL.md and renders to SVG.

11 * Useful for helping your human partner visualize the process flows.

12 *

13 * Requires: graphviz (dot) installed on system

14 */

16const fs = require('fs');

17const path = require('path');

18const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

agents/skills/writing-skills/render-graphs.jsView on unpkg · L17

20function extractDotBlocks(markdown) {

21 const blocks = [];

22 const regex = /```dot\n([\s\S]*?)```/g;

23 let match;

25 while ((match = regex.exec(markdown)) !== null) {

26 const content = match[1].trim();

28 // Extract digraph name

29 const nameMatch = content.match(/digraph\s+(\w+)/);

30 const name = nameMatch ? nameMatch[1] : `graph_${blocks.length + 1}`;

32 blocks.push({ name, content });

33 }

35 return blocks;

36}

scripts/test-e2e-lifecycle.mjsView file

Lines 7-47javascript

7// guard de integração do fix v3.21.1, agora cross-OS;

8// (2) ISOLAMENTO DE HOME: read-only é read-only; create é project-scoped (não

9// toca o HOME); install --audit-only --save-report grava EXATAMENTE 1 arquivo.

10// GATED por env (CI liga): GSTACK_E2E_LIFECYCLE=1 npm run test:e2e:lifecycle

11import { execFileSync } from "node:child_process"

12import { mkdtempSync, rmSync, mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync } from "node:fs"

13import { tmpdir } from "node:os"

agents/skills/brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs = require('fs');

4const path

scripts/test-templates.mjsView file

Lines 27-66javascript

27 existsSync(join(dir, "README.md")) ? ok(`${name}: README.md`) : bad(`${name}: sem README.md`)

28 existsSync(join(dir, ".env.example")) ? ok(`${name}: .env.example`)

agents/scripts/checklist.pyView file

•path = agents/scripts/checklist.py kind = build_helper sizeBytes = 7563 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agents/scripts/checklist.pyView on unpkg

src/cli/create.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @gstack-vibehard/installer@3.22.0 matchedIdentity = npm:[redacted]:3.22.0 similarity = 0.417 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/create.jsView on unpkg

agents/skills/graphify/SKILL.mdView file

Lines 472-512markdown

472to_cypher(G, 'graphify-out/cypher.txt')

473print('cypher.txt written - import with: cypher-shell < graphify-out/cypher.txt')

474"

475```

476

477**If `--neo4j-push <uri>`** - push directly to a running Neo4j instance. Ask the user for credentials if not provided:

478

479```bash

480python3 -c "

481import sys, json

482from graphify.build import build_from_json

483from graphify.cluster import cluster

Source & flagged code

7 flagged · loading source

agents/skills/writing-skills/render-graphs.jsView file

17const path = require('path'); L18: const { execSync } = require('child_process'); L19:

High

Child Process

Package source references child process execution.

agents/skills/writing-skills/render-graphs.jsView on unpkg · L17

scripts/test-e2e-lifecycle.mjsView file

27L28: // npm via cmd.exe no Windows (.cmd shim dá EINVAL no execFileSync direto). L29: function npm(args, opts = {}) {

High

Shell

Package source references shell execution.

scripts/test-e2e-lifecycle.mjsView on unpkg · L27

agents/skills/brainstorming/scripts/server.cjsView file

1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L11: function computeAcceptKey(clientKey) { L12: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L13: } ... L75: L76: const PORT = process.env.BRAINSTORM_PORT || (49152 + Math.floor(Math.random() * 16383)); L77: const HOST = process.env.BRAINSTORM_HOST || '127.0.0.1'; ... L100: L101: const frameTemplate = fs.readFileSync(path.join(__dirname, 'frame-template.html'), 'utf-8'); L102: const helperScript = fs.readFileSync(path.join(__dirname, 'helper.js'), 'utf-8');

Low

Weak Crypto

Package source references weak cryptographic algorithms.

agents/skills/brainstorming/scripts/server.cjsView on unpkg · L1

scripts/test-templates.mjsView file

47// pnpm (via corepack), não npm, que não linka os workspaces. L48: const { execFileSync } = await import("node:child_process") L49: const isWin = process.platform === "win32" ... L51: : execFileSync("pnpm", a, { cwd: appDir, stdio: "inherit", timeout: 600000 }) L52: try { pnpm(["install", "--no-frozen-lockfile"]); pnpm(["build"]); ok("lite fullstack: pnpm install + build OK") } L53: catch (e) { bad(`pnpm install/build falhou: ${(e.message || "").slice(0, 80)}`) }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/test-templates.mjsView on unpkg · L47

agents/scripts/checklist.pyView file

•path = agents/scripts/checklist.py kind = build_helper sizeBytes = 7563 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agents/scripts/checklist.pyView on unpkg

src/cli/create.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/create.jsView on unpkg

agents/skills/graphify/SKILL.mdView file

492patternName = generic_password severity = medium line = 492 matchedText = result =...ies)

Medium

Secret Pattern

Hardcoded password in agents/skills/graphify/SKILL.md

agents/skills/graphify/SKILL.mdView on unpkg · L492

Findings

1 Critical3 High5 Medium5 Low

CriticalPrevious Version Dangerous Deltasrc/cli/create.js

HighChild Processagents/skills/writing-skills/render-graphs.js

HighShellscripts/test-e2e-lifecycle.mjs

HighRuntime Package Installscripts/test-templates.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperagents/scripts/checklist.py

MediumStructural Risk Force Deep Review

MediumSecret Patternagents/skills/graphify/SKILL.md

LowScripts Present

LowWeak Cryptoagents/skills/brainstorming/scripts/server.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

agents/skills/writing-skills/render-graphs.jsView file

Lines 1-37javascript

1#!/usr/bin/env node

3/**

4 * Render graphviz diagrams from a skill's SKILL.md to SVG files.

5 *

6 * Usage:

7 * ./render-graphs.js <skill-directory> # Render each diagram separately

8 * ./render-graphs.js <skill-directory> --combine # Combine all into one diagram

9 *

10 * Extracts all ```dot blocks from SKILL.md and renders to SVG.

11 * Useful for helping your human partner visualize the process flows.

12 *

13 * Requires: graphviz (dot) installed on system

14 */

16const fs = require('fs');

17const path = require('path');

18const { execSync } = require('child_process');

High

Child Process

Package source references child process execution.

agents/skills/writing-skills/render-graphs.jsView on unpkg · L17

20function extractDotBlocks(markdown) {

21 const blocks = [];

22 const regex = /```dot\n([\s\S]*?)```/g;

23 let match;

25 while ((match = regex.exec(markdown)) !== null) {

26 const content = match[1].trim();

28 // Extract digraph name

29 const nameMatch = content.match(/digraph\s+(\w+)/);

30 const name = nameMatch ? nameMatch[1] : `graph_${blocks.length + 1}`;

32 blocks.push({ name, content });

33 }

35 return blocks;

36}

scripts/test-e2e-lifecycle.mjsView file

Lines 7-47javascript

7// guard de integração do fix v3.21.1, agora cross-OS;

8// (2) ISOLAMENTO DE HOME: read-only é read-only; create é project-scoped (não

9// toca o HOME); install --audit-only --save-report grava EXATAMENTE 1 arquivo.

10// GATED por env (CI liga): GSTACK_E2E_LIFECYCLE=1 npm run test:e2e:lifecycle

11import { execFileSync } from "node:child_process"

12import { mkdtempSync, rmSync, mkdirSync, writeFileSync, existsSync, readFileSync, readdirSync } from "node:fs"

13import { tmpdir } from "node:os"

agents/skills/brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs = require('fs');

4const path

scripts/test-templates.mjsView file

Lines 27-66javascript

27 existsSync(join(dir, "README.md")) ? ok(`${name}: README.md`) : bad(`${name}: sem README.md`)

28 existsSync(join(dir, ".env.example")) ? ok(`${name}: .env.example`)

agents/scripts/checklist.pyView file

•path = agents/scripts/checklist.py kind = build_helper sizeBytes = 7563 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agents/scripts/checklist.pyView on unpkg

src/cli/create.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli/create.jsView on unpkg

agents/skills/graphify/SKILL.mdView file

Lines 472-512markdown

472to_cypher(G, 'graphify-out/cypher.txt')

473print('cypher.txt written - import with: cypher-shell < graphify-out/cypher.txt')

474"

475```

476

477**If `--neo4j-push <uri>`** - push directly to a running Neo4j instance. Ask the user for credentials if not provided:

478

479```bash

480python3 -c "

481import sys, json

482from graphify.build import build_from_json

483from graphify.cluster import cluster