registry / @hacksmith/doraval / 0.6.10

@hacksmith/doraval@0.6.10

Make agent context work on every try. Context engineering toolkit for coding agents (skills, plugins, rules) across Claude, Cursor, Codex, Copilot, and Grok.

Static Scan Results

scanned 19h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystem

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 1 file(s), 2.96 KB of source, external domains: bun.sh

Source & flagged code

3 flagged

bin/doraval.cjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * doraval bin stub (plan B1). Plain Node CommonJS — this file is the ONLY

4 * thing that runs before the compiled binary takes over, and it must work

5 * on any Node >= 14.18 with zero dependencies and zero prompts.

6 *

7 * npm installed exactly one @hacksmith/doraval-<os>-<arch> optionalDependency

8 * (filtered by the platform packages' os/cpu fields). Resolve it, exec it,

9 * forward the exit code.

10 */

11"use strict";

13const { spawnSync } = require("node:child_process");

14const { existsSync } = require("node:fs");

High

Child Process

Package source references child process execution.

bin/doraval.cjsView on unpkg · L12

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/doraval.cjsView on unpkg · L8

15const path = require("node:path");

17const SUPPORTED = {

18 "darwin-arm64": true,

19 "darwin-x64": true,

20 "linux-x64": true,

21 "linux-arm64": true,

22 "win32-x64": true,

23};

25function platformPackageName(platform, arch) {

26 const suffix = platform + "-" + arch;

27 if (!SUPPORTED[suffix]) return null;

28 return "@hacksmith/doraval-" + suffix;

29}

31/**

32 * Resolve the compiled binary's absolute path.

Lines 47-87javascript

47 return null;

48 }

49}

51function fail(msg) {

52 process.stderr.write(msg + "\n");

53 process.exit

Source & flagged code

3 flagged · loading source

bin/doraval.cjsView file

12L13: const { spawnSync } = require("node:child_process"); L14: const { existsSync } = require("node:fs");

High

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code