registry / @hacksmith/doraval / 0.4.9

@hacksmith/doraval@0.4.9

Scale your AI context for coding agents. Make your next context work (skills, plugins & more) for your team, community, or self. Context engineering toolkit for AI coding agents.

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsObfuscatedTelemetryUrlStrings

Manifest

WildcardDependency

scanned 2 file(s), 1.88 MB of source, external domains: ai-gateway.vercel.sh, ai-sdk.dev, api.anthropic.com, api.github.com, api.groq.com, api.openai.com, api.vercel.com, api.z.ai, bun.sh, example.com, github.com, json-schema.org, openrouter.ai, registry.npmjs.org, vercel.com, your-api.example.com

Source & flagged code

4 flagged

bin/doraval-wrapper.jsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * doraval-wrapper.js

4 *

5 * Runs under Node (≥ 14.18, ESM). Resolves a Bun binary in order:

6 * 1. PATH bun — if version ≥ MIN_BUN_VERSION (preferred; user-managed)

7 * 2. Managed cache — <XDG_CACHE_HOME|~/.cache>/doraval/bun/bin/bun (if ≥ min)

8 * 3. Neither / too old — prompt for consent, install/upgrade cache, then exec.

9 *

10 * Bun.YAML (used for config.yml and frontmatter) requires Bun ≥ 1.3.0.

11 * Older managed caches (e.g. 1.2.0) must not win over a newer PATH install.

12 *

13 * The Bun installer is scoped to the cache dir (BUN_INSTALL env var) so it

14 * never touches ~/.bun or shell rc files.

15 *

16 * Environment knobs:

17 * DORAVAL_AUTO_INSTALL_BUN=1 — skip prompt, always install (CI / automation)

18 * DORAVAL_AUTO_INSTALL_BUN=0 — skip prompt, never install; print guidance + exit 1

19 */

21import { execSync, spawnSync } from 'node:child_process'

22import { fileURLToPath } from 'node:url'

High

Child Process

Package source references child process execution.

bin/doraval-wrapper.jsView on unpkg · L20

23import { join, dirname } from 'node:path'

24import { existsSync, rmSync } from 'node:fs'

25import { homedir } from 'node:os'

26import { createInterface } from 'node:readline'

28// Pinned managed-install version; bump this to update the cached Bun.

29// Must be ≥ MIN_BUN_VERSION (Bun.YAML since 1.3.0).

30const BUN_VERSION = '1.3.14'

31/** Minimum Bun that exposes Bun.YAML — used by config / frontmatter / journal. */

32const MIN_BUN_VERSION = '1.3.0'

34const __dirname = dirname(fileURLToPath(import.meta.url))

36// ── helpers ────────────────────────────────────────────────────────────────

38function getCacheDir() {

39 const base = process.env.XDG_CACHE_HOME || join(homedir(), '.cache')

40 return join(base, 'doraval', 'bun')

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/doraval-wrapper.jsView on unpkg · L20

Lines 86-126javascript

87 return null

88}

90function printGuidance() {

91 if (process.platform === 'darwin') {

92 console.error(

93 'doraval works best via Homebrew on macOS (no runtime required).\n\n

bin/doraval.jsView file

46438if (existingPid) { L46439: const url3 = `http://${host === "0.0.0.0" ? "localhost" : host}:${port}`; L46440: ui.write(` Dashboard running (pid ${existingPid})`); L46441: ui.write(` URL: ${import_picocolors18.default.underline(import_picocolors18.default.cyan(url3))}`); ... L46450: ui.write(` URL: ${import_picocolors18.default.underline(import_picocolors18.default.cyan(url3))}`); L46451: if (shouldOpen && process.stdout.isTTY) { L46452: try { L46453: const opener = process.platform === "darwin" ? "open" : process.platform === "win32" ? "start" : "xdg-open"; L46454: spawn(opener, [url3], { stdio: "ignore", detached: true }).unref(); L46455: } catch {}

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/doraval.jsView on unpkg · L46438

Source & flagged code

4 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code