registry  /  @harness-engineering/cli  /  4.0.1

@harness-engineering/cli@4.0.1

CLI for Harness Engineering toolkit

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 50 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 122 file(s), 2.87 MB of source, external domains: 127.0.0.1, api.github.com, api.linear.app, api.miro.com, api.openai.com, api.osv.dev, app.posthog.com, cwe.mitre.org, docs.stripe.com, fetch.spec.whatwg.org, github.com, linear.app, nodejs.org, open-ui.org, owasp.org, perplexity.ai, raw.githubusercontent.com, slack.com, stripe.com, stripe.press, vercel.com, www.designtokens.org, www.notion.so, www.raycast.com, www.refactoringui.com, www.w3.org

Source & flagged code

42 flagged · loading source
dist/agents/skills/claude-code/api-oauth2-flows/SKILL.mdView file
69patternName = github_user_token severity = critical line = 69 matchedText = "access_...4a",
Critical
Critical Secret

Package contains a critical-looking secret pattern.

dist/agents/skills/claude-code/api-oauth2-flows/SKILL.mdView on unpkg · L69
69patternName = github_user_token severity = critical line = 69 matchedText = "access_...4a",
Critical
Secret Pattern

GitHub user-to-server token in dist/agents/skills/claude-code/api-oauth2-flows/SKILL.md

dist/agents/skills/claude-code/api-oauth2-flows/SKILL.mdView on unpkg · L69
dist/bin/harness.jsView file
125// src/skill/dispatch-session.ts L126: import { execSync } from "child_process"; L127: import fs from "fs";
High
Child Process

Package source references child process execution.

dist/bin/harness.jsView on unpkg · L125
dist/chunk-MMLQPHZ5.jsView file
357path: f, L358: ast: { type: "Program", body: null, language: "typescript" }, L359: imports: [], ... L590: scope: "project", L591: rootDir: options?.rootDir ?? process.cwd(), L592: config: options?.config ... L907: const raw = readFileSync(this.baselinesPath, "utf-8"); L908: const data = JSON.parse(raw); L909: const parsed = ArchBaselineSchema.safeParse(data); ... L1306: CriticalPathResolver: () => CriticalPathResolver, L1307: DEFAULT_EXEC_MAX_STDOUT_BYTES: () => DEFAULT_EXEC_MAX_STDOUT_BYTES, L1308: DEFAULT_EXEC_TIMEOUT_MS: () => DEFAULT_EXEC_TIMEOUT_MS,
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/chunk-MMLQPHZ5.jsView on unpkg · L357
9011scanner.configureForProject(projectRoot); L9012: const { glob: globFn } = await import("glob"); L9013: const sourceFiles = await globFn("**/*.{ts,tsx,js,jsx,go,py}", {
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-MMLQPHZ5.jsView on unpkg · L9011
18795patterns: [/\beval\s*\(/, /new\s+Function\s*\(/], L18796: message: "eval() and Function constructor allow arbitrary code execution", L18797: remediation: "Use JSON.parse() for data, or a sandboxed interpreter for dynamic code",
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-MMLQPHZ5.jsView on unpkg · L18795
dist/chunk-RG3TNIUB.jsView file
1117const { execFileSync } = await import("child_process"); L1118: const output = execFileSync("npx", ["harness", "add", input.type, input.name], { L1119: cwd: projectPath,
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-RG3TNIUB.jsView on unpkg · L1117
101CLIError, L102: ExitCode, L103: handleError ... L191: "- Routes in `src/routes/`, middleware in `src/middleware/`", L192: "- Use `express.json()` for body parsing", L193: "- Error handling via centralized error middleware", ... L415: function wrapWithInjectionGuard(toolName, handler, options = {}) { L416: const projectRoot = options.projectRoot ?? process.cwd(); L417: const sessionId = options.sessionId ?? "default"; ... L659: const intelligence = await import("@harness-engineering/intelligence"); L660: const apiKey = process.env.ANTHROPIC_API_KEY; L661: if (!apiKey) return null;
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-RG3TNIUB.jsView on unpkg · L101
dist/hooks/telemetry-reporter.jsView file
10import { randomUUID } from 'node:crypto'; L11: import { execFileSync } from 'node:child_process'; L12: import process from 'node:process'; ... L14: // PostHog project API key — public, write-only (cannot read data) L15: const POSTHOG_API_KEY = process.env.POSTHOG_API_KEY ?? 'phc_wNTdCMcfJXZPgdNeDociZW6vwoGGo4nb7vqEfWThFfsG'; // harness-ignore SEC-SEC-002: public PostHog write-only ingest key L16: const POSTHOG_BATCH_URL = 'https://app.posthog.com/batch'; L17: const MAX_ATTEMPTS = 3;
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hooks/telemetry-reporter.jsView on unpkg · L10
dist/hooks/sentinel-post.jsView file
95package = @harness-engineering/cli; repositoryIdentity = harness-engineering; dependency = @harness-engineering/core L95: try { L96: const core = await import('@harness-engineering/core'); L97: findings = core.scanForInjection(toolOutput);
High
Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/hooks/sentinel-post.jsView on unpkg · L95
dist/chunk-GHBFNLV2.jsView file
116Cross-file remote execution chain: dist/chunk-GHBFNLV2.js spawns dist/chunk-MMLQPHZ5.js; helper contains network access plus dynamic code execution. L116: CLIError, L117: ExitCode, L118: handleError ... L296: async function runAdd(componentType, name, options) { L297: const cwd = options.cwd ?? process.cwd(); L298: const NAME_PATTERN = /^[a-zA-Z][a-zA-Z0-9_-]*$/; ... L601: import * as path2 from "path"; L602: import * as childProcess from "child_process"; L603: async function runAgentTask(task, options) { ... L629: commitMessage: task, L630: metadata: { task, timeout } L631: },
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-GHBFNLV2.jsView on unpkg · L116
dist/templates/python-base/src/__init__.pyView file
•path = dist/templates/python-base/src/__init__.py kind = build_helper sizeBytes = 0
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/templates/python-base/src/__init__.pyView on unpkg
dist/agents/skills/claude-code/security-secrets-lifecycle/SKILL.mdView file
143patternName = private_key_rsa severity = critical line = 143 matchedText = (`-----B...test
Critical
Secret Pattern

RSA private key in dist/agents/skills/claude-code/security-secrets-lifecycle/SKILL.md

dist/agents/skills/claude-code/security-secrets-lifecycle/SKILL.mdView on unpkg · L143
dist/agents/skills/claude-code/test-component-react/SKILL.mdView file
61patternName = generic_password severity = medium line = 61 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/claude-code/test-component-react/SKILL.md

dist/agents/skills/claude-code/test-component-react/SKILL.mdView on unpkg · L61
dist/agents/skills/claude-code/mobile-testing-patterns/SKILL.mdView file
46patternName = generic_password severity = medium line = 46 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/claude-code/mobile-testing-patterns/SKILL.md

dist/agents/skills/claude-code/mobile-testing-patterns/SKILL.mdView on unpkg · L46
dist/agents/skills/claude-code/harness-secrets/SKILL.mdView file
21patternName = private_key_rsa severity = critical line = 21 matchedText = - **Priv...---`
Critical
Secret Pattern

RSA private key in dist/agents/skills/claude-code/harness-secrets/SKILL.md

dist/agents/skills/claude-code/harness-secrets/SKILL.mdView on unpkg · L21
21patternName = private_key_ec severity = critical line = 21 matchedText = - **Priv...---`
Critical
Secret Pattern

EC private key in dist/agents/skills/claude-code/harness-secrets/SKILL.md

dist/agents/skills/claude-code/harness-secrets/SKILL.mdView on unpkg · L21
dist/agents/skills/claude-code/nestjs-testing-patterns/SKILL.mdView file
86patternName = generic_password severity = medium line = 86 matchedText = .send({ ...' })
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/claude-code/nestjs-testing-patterns/SKILL.md

dist/agents/skills/claude-code/nestjs-testing-patterns/SKILL.mdView on unpkg · L86
dist/agents/skills/claude-code/owasp-secrets-management/SKILL.mdView file
19patternName = generic_password severity = medium line = 19 matchedText = const db... });
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/claude-code/owasp-secrets-management/SKILL.md

dist/agents/skills/claude-code/owasp-secrets-management/SKILL.mdView on unpkg · L19
124patternName = generic_password severity = medium line = 124 matchedText = logger.i... });
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/claude-code/owasp-secrets-management/SKILL.md

dist/agents/skills/claude-code/owasp-secrets-management/SKILL.mdView on unpkg · L124
dist/agents/skills/cursor/security-secrets-lifecycle/SKILL.mdView file
143patternName = private_key_rsa severity = critical line = 143 matchedText = (`-----B...test
Critical
Secret Pattern

RSA private key in dist/agents/skills/cursor/security-secrets-lifecycle/SKILL.md

dist/agents/skills/cursor/security-secrets-lifecycle/SKILL.mdView on unpkg · L143
dist/agents/skills/cursor/test-component-react/SKILL.mdView file
61patternName = generic_password severity = medium line = 61 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/cursor/test-component-react/SKILL.md

dist/agents/skills/cursor/test-component-react/SKILL.mdView on unpkg · L61
dist/agents/skills/cursor/api-oauth2-flows/SKILL.mdView file
69patternName = github_user_token severity = critical line = 69 matchedText = "access_...4a",
Critical
Secret Pattern

GitHub user-to-server token in dist/agents/skills/cursor/api-oauth2-flows/SKILL.md

dist/agents/skills/cursor/api-oauth2-flows/SKILL.mdView on unpkg · L69
dist/agents/skills/cursor/mobile-testing-patterns/SKILL.mdView file
46patternName = generic_password severity = medium line = 46 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/cursor/mobile-testing-patterns/SKILL.md

dist/agents/skills/cursor/mobile-testing-patterns/SKILL.mdView on unpkg · L46
dist/agents/skills/cursor/harness-secrets/SKILL.mdView file
21patternName = private_key_rsa severity = critical line = 21 matchedText = - **Priv...---`
Critical
Secret Pattern

RSA private key in dist/agents/skills/cursor/harness-secrets/SKILL.md

dist/agents/skills/cursor/harness-secrets/SKILL.mdView on unpkg · L21
21patternName = private_key_ec severity = critical line = 21 matchedText = - **Priv...---`
Critical
Secret Pattern

EC private key in dist/agents/skills/cursor/harness-secrets/SKILL.md

dist/agents/skills/cursor/harness-secrets/SKILL.mdView on unpkg · L21
dist/agents/skills/cursor/nestjs-testing-patterns/SKILL.mdView file
86patternName = generic_password severity = medium line = 86 matchedText = .send({ ...' })
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/cursor/nestjs-testing-patterns/SKILL.md

dist/agents/skills/cursor/nestjs-testing-patterns/SKILL.mdView on unpkg · L86
dist/agents/skills/cursor/owasp-secrets-management/SKILL.mdView file
19patternName = generic_password severity = medium line = 19 matchedText = const db... });
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/cursor/owasp-secrets-management/SKILL.md

dist/agents/skills/cursor/owasp-secrets-management/SKILL.mdView on unpkg · L19
124patternName = generic_password severity = medium line = 124 matchedText = logger.i... });
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/cursor/owasp-secrets-management/SKILL.md

dist/agents/skills/cursor/owasp-secrets-management/SKILL.mdView on unpkg · L124
dist/agents/skills/codex/security-secrets-lifecycle/SKILL.mdView file
143patternName = private_key_rsa severity = critical line = 143 matchedText = (`-----B...test
Critical
Secret Pattern

RSA private key in dist/agents/skills/codex/security-secrets-lifecycle/SKILL.md

dist/agents/skills/codex/security-secrets-lifecycle/SKILL.mdView on unpkg · L143
dist/agents/skills/codex/test-component-react/SKILL.mdView file
61patternName = generic_password severity = medium line = 61 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/codex/test-component-react/SKILL.md

dist/agents/skills/codex/test-component-react/SKILL.mdView on unpkg · L61
dist/agents/skills/codex/api-oauth2-flows/SKILL.mdView file
69patternName = github_user_token severity = critical line = 69 matchedText = "access_...4a",
Critical
Secret Pattern

GitHub user-to-server token in dist/agents/skills/codex/api-oauth2-flows/SKILL.md

dist/agents/skills/codex/api-oauth2-flows/SKILL.mdView on unpkg · L69
dist/agents/skills/codex/mobile-testing-patterns/SKILL.mdView file
46patternName = generic_password severity = medium line = 46 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/codex/mobile-testing-patterns/SKILL.md

dist/agents/skills/codex/mobile-testing-patterns/SKILL.mdView on unpkg · L46
dist/agents/skills/codex/harness-secrets/SKILL.mdView file
21patternName = private_key_rsa severity = critical line = 21 matchedText = - **Priv...---`
Critical
Secret Pattern

RSA private key in dist/agents/skills/codex/harness-secrets/SKILL.md

dist/agents/skills/codex/harness-secrets/SKILL.mdView on unpkg · L21
21patternName = private_key_ec severity = critical line = 21 matchedText = - **Priv...---`
Critical
Secret Pattern

EC private key in dist/agents/skills/codex/harness-secrets/SKILL.md

dist/agents/skills/codex/harness-secrets/SKILL.mdView on unpkg · L21
dist/agents/skills/codex/nestjs-testing-patterns/SKILL.mdView file
86patternName = generic_password severity = medium line = 86 matchedText = .send({ ...' })
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/codex/nestjs-testing-patterns/SKILL.md

dist/agents/skills/codex/nestjs-testing-patterns/SKILL.mdView on unpkg · L86
dist/agents/skills/codex/owasp-secrets-management/SKILL.mdView file
19patternName = generic_password severity = medium line = 19 matchedText = const db... });
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/codex/owasp-secrets-management/SKILL.md

dist/agents/skills/codex/owasp-secrets-management/SKILL.mdView on unpkg · L19
124patternName = generic_password severity = medium line = 124 matchedText = logger.i... });
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/codex/owasp-secrets-management/SKILL.md

dist/agents/skills/codex/owasp-secrets-management/SKILL.mdView on unpkg · L124
dist/agents/skills/gemini-cli/security-secrets-lifecycle/SKILL.mdView file
143patternName = private_key_rsa severity = critical line = 143 matchedText = (`-----B...test
Critical
Secret Pattern

RSA private key in dist/agents/skills/gemini-cli/security-secrets-lifecycle/SKILL.md

dist/agents/skills/gemini-cli/security-secrets-lifecycle/SKILL.mdView on unpkg · L143
dist/agents/skills/gemini-cli/test-component-react/SKILL.mdView file
61patternName = generic_password severity = medium line = 61 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/gemini-cli/test-component-react/SKILL.md

dist/agents/skills/gemini-cli/test-component-react/SKILL.mdView on unpkg · L61
dist/agents/skills/gemini-cli/api-oauth2-flows/SKILL.mdView file
69patternName = github_user_token severity = critical line = 69 matchedText = "access_...4a",
Critical
Secret Pattern

GitHub user-to-server token in dist/agents/skills/gemini-cli/api-oauth2-flows/SKILL.md

dist/agents/skills/gemini-cli/api-oauth2-flows/SKILL.mdView on unpkg · L69
dist/agents/skills/gemini-cli/mobile-testing-patterns/SKILL.mdView file
46patternName = generic_password severity = medium line = 46 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/gemini-cli/mobile-testing-patterns/SKILL.md

dist/agents/skills/gemini-cli/mobile-testing-patterns/SKILL.mdView on unpkg · L46

Findings

15 Critical7 High22 Medium6 Low
CriticalCritical Secretdist/agents/skills/claude-code/api-oauth2-flows/SKILL.md
CriticalSecret Patterndist/agents/skills/claude-code/security-secrets-lifecycle/SKILL.md
CriticalSecret Patterndist/agents/skills/claude-code/api-oauth2-flows/SKILL.md
CriticalSecret Patterndist/agents/skills/claude-code/harness-secrets/SKILL.md
CriticalSecret Patterndist/agents/skills/claude-code/harness-secrets/SKILL.md
CriticalSecret Patterndist/agents/skills/cursor/security-secrets-lifecycle/SKILL.md
CriticalSecret Patterndist/agents/skills/cursor/api-oauth2-flows/SKILL.md
CriticalSecret Patterndist/agents/skills/cursor/harness-secrets/SKILL.md
CriticalSecret Patterndist/agents/skills/cursor/harness-secrets/SKILL.md
CriticalSecret Patterndist/agents/skills/codex/security-secrets-lifecycle/SKILL.md
CriticalSecret Patterndist/agents/skills/codex/api-oauth2-flows/SKILL.md
CriticalSecret Patterndist/agents/skills/codex/harness-secrets/SKILL.md
CriticalSecret Patterndist/agents/skills/codex/harness-secrets/SKILL.md
CriticalSecret Patterndist/agents/skills/gemini-cli/security-secrets-lifecycle/SKILL.md
CriticalSecret Patterndist/agents/skills/gemini-cli/api-oauth2-flows/SKILL.md
HighChild Processdist/bin/harness.js
HighShell
HighSame File Env Network Executiondist/hooks/telemetry-reporter.js
HighObfuscated Payload Loaderdist/chunk-MMLQPHZ5.js
HighCopied Package Dependency Bridgedist/hooks/sentinel-post.js
HighCross File Remote Execution Contextdist/chunk-GHBFNLV2.js
HighRuntime Package Installdist/chunk-RG3TNIUB.js
MediumDynamic Requiredist/chunk-MMLQPHZ5.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/templates/python-base/src/__init__.py
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/agents/skills/claude-code/test-component-react/SKILL.md
MediumSecret Patterndist/agents/skills/claude-code/mobile-testing-patterns/SKILL.md
MediumSecret Patterndist/agents/skills/claude-code/nestjs-testing-patterns/SKILL.md
MediumSecret Patterndist/agents/skills/claude-code/owasp-secrets-management/SKILL.md
MediumSecret Patterndist/agents/skills/claude-code/owasp-secrets-management/SKILL.md
MediumSecret Patterndist/agents/skills/cursor/test-component-react/SKILL.md
MediumSecret Patterndist/agents/skills/cursor/mobile-testing-patterns/SKILL.md
MediumSecret Patterndist/agents/skills/cursor/nestjs-testing-patterns/SKILL.md
MediumSecret Patterndist/agents/skills/cursor/owasp-secrets-management/SKILL.md
MediumSecret Patterndist/agents/skills/cursor/owasp-secrets-management/SKILL.md
MediumSecret Patterndist/agents/skills/codex/test-component-react/SKILL.md
MediumSecret Patterndist/agents/skills/codex/mobile-testing-patterns/SKILL.md
MediumSecret Patterndist/agents/skills/codex/nestjs-testing-patterns/SKILL.md
MediumSecret Patterndist/agents/skills/codex/owasp-secrets-management/SKILL.md
MediumSecret Patterndist/agents/skills/codex/owasp-secrets-management/SKILL.md
MediumSecret Patterndist/agents/skills/gemini-cli/test-component-react/SKILL.md
MediumSecret Patterndist/agents/skills/gemini-cli/mobile-testing-patterns/SKILL.md
LowScripts Present
LowEvaldist/chunk-MMLQPHZ5.js
LowWeak Cryptodist/chunk-RG3TNIUB.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings