registry  /  @harness-engineering/cli  /  4.3.2

@harness-engineering/cli@4.3.2

⚠ Under review

CLI for Harness Engineering toolkit

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 50 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 122 file(s), 2.91 MB of source, external domains: 127.0.0.1, api.github.com, api.linear.app, api.miro.com, api.openai.com, api.osv.dev, app.posthog.com, cwe.mitre.org, docs.stripe.com, fetch.spec.whatwg.org, github.com, linear.app, nodejs.org, open-ui.org, owasp.org, perplexity.ai, raw.githubusercontent.com, slack.com, stripe.com, stripe.press, vercel.com, www.designtokens.org, www.notion.so, www.raycast.com, www.refactoringui.com, www.w3.org

Source & flagged code

42 flagged · loading source
dist/agents/skills/claude-code/api-oauth2-flows/SKILL.mdView file
69patternName = github_user_token severity = critical line = 69 matchedText = "access_...4a",
Critical
Critical Secret

Package contains a critical-looking secret pattern.

dist/agents/skills/claude-code/api-oauth2-flows/SKILL.mdView on unpkg · L69
69patternName = github_user_token severity = critical line = 69 matchedText = "access_...4a",
Critical
Secret Pattern

GitHub user-to-server token in dist/agents/skills/claude-code/api-oauth2-flows/SKILL.md

dist/agents/skills/claude-code/api-oauth2-flows/SKILL.mdView on unpkg · L69
dist/chunk-HJYAXAYQ.jsView file
6import * as path from "path"; L7: import { execSync } from "child_process"; L8: var runSecurityScanDefinition = {
High
Child Process

Package source references child process execution.

dist/chunk-HJYAXAYQ.jsView on unpkg · L6
dist/chunk-CRHQYBDA.jsView file
•matchType = previous_version_dangerous_delta matchedPackage = @harness-engineering/cli@4.0.1 matchedIdentity = npm:[redacted]:4.0.1 similarity = 0.908 summary = stored previous version shares package body but lacks this dangerous source file
Critical
Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/chunk-CRHQYBDA.jsView on unpkg
365path: f, L366: ast: { type: "Program", body: null, language: "typescript" }, L367: imports: [], ... L598: scope: "project", L599: rootDir: options?.rootDir ?? process.cwd(), L600: config: options?.config ... L915: const raw = readFileSync(this.baselinesPath, "utf-8"); L916: const data = JSON.parse(raw); L917: const parsed = ArchBaselineSchema.safeParse(data); ... L1314: CriticalPathResolver: () => CriticalPathResolver, L1315: DEFAULT_EXEC_MAX_STDOUT_BYTES: () => DEFAULT_EXEC_MAX_STDOUT_BYTES, L1316: DEFAULT_EXEC_TIMEOUT_MS: () => DEFAULT_EXEC_TIMEOUT_MS,
High
Obfuscated Payload Loader

Source contains an obfuscator-style string-array loader that reconstructs and executes hidden code.

dist/chunk-CRHQYBDA.jsView on unpkg · L365
9037scanner.configureForProject(projectRoot); L9038: const { glob: globFn } = await import("glob"); L9039: const sourceFiles = await globFn("**/*.{ts,tsx,js,jsx,go,py}", {
Medium
Dynamic Require

Package source references dynamic require/import behavior.

dist/chunk-CRHQYBDA.jsView on unpkg · L9037
19185patterns: [/\beval\s*\(/, /new\s+Function\s*\(/], L19186: message: "eval() and Function constructor allow arbitrary code execution", L19187: remediation: "Use JSON.parse() for data, or a sandboxed interpreter for dynamic code",
Low
Eval

Package source references a known benign dynamic code generation pattern.

dist/chunk-CRHQYBDA.jsView on unpkg · L19185
dist/chunk-F3GNBRGL.jsView file
1119const { execFileSync } = await import("child_process"); L1120: const output = execFileSync("npx", ["harness", "add", input.type, input.name], { L1121: cwd: projectPath,
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/chunk-F3GNBRGL.jsView on unpkg · L1119
101CLIError, L102: ExitCode, L103: handleError ... L191: "- Routes in `src/routes/`, middleware in `src/middleware/`", L192: "- Use `express.json()` for body parsing", L193: "- Error handling via centralized error middleware", ... L417: function wrapWithInjectionGuard(toolName, handler, options = {}) { L418: const projectRoot = options.projectRoot ?? process.cwd(); L419: const sessionId = options.sessionId ?? "default"; ... L661: const intelligence = await import("@harness-engineering/intelligence"); L662: const apiKey = process.env.ANTHROPIC_API_KEY; L663: if (!apiKey) return null;
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/chunk-F3GNBRGL.jsView on unpkg · L101
dist/hooks/telemetry-reporter.jsView file
10import { randomUUID } from 'node:crypto'; L11: import { execFileSync } from 'node:child_process'; L12: import process from 'node:process'; ... L14: // PostHog project API key — public, write-only (cannot read data) L15: const POSTHOG_API_KEY = process.env.POSTHOG_API_KEY ?? 'phc_wNTdCMcfJXZPgdNeDociZW6vwoGGo4nb7vqEfWThFfsG'; // harness-ignore SEC-SEC-002: public PostHog write-only ingest key L16: const POSTHOG_BATCH_URL = 'https://app.posthog.com/batch'; L17: const MAX_ATTEMPTS = 3;
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/hooks/telemetry-reporter.jsView on unpkg · L10
dist/hooks/sentinel-post.jsView file
95package = @harness-engineering/cli; repositoryIdentity = harness-engineering; dependency = @harness-engineering/core L95: try { L96: const core = await import('@harness-engineering/core'); L97: findings = core.scanForInjection(toolOutput);
High
Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

dist/hooks/sentinel-post.jsView on unpkg · L95
dist/chunk-YVI7ZV73.jsView file
116Cross-file remote execution chain: dist/chunk-YVI7ZV73.js spawns dist/chunk-CRHQYBDA.js; helper contains network access plus dynamic code execution. L116: CLIError, L117: ExitCode, L118: handleError ... L297: async function runAdd(componentType, name, options) { L298: const cwd = options.cwd ?? process.cwd(); L299: const NAME_PATTERN = /^[a-zA-Z][a-zA-Z0-9_-]*$/; ... L648: import * as path3 from "path"; L649: import * as childProcess from "child_process"; L650: async function runAgentTask(task, options) { ... L676: commitMessage: task, L677: metadata: { task, timeout } L678: },
High
Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/chunk-YVI7ZV73.jsView on unpkg · L116
dist/templates/python-base/src/__init__.pyView file
•path = dist/templates/python-base/src/__init__.py kind = build_helper sizeBytes = 0
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

dist/templates/python-base/src/__init__.pyView on unpkg
dist/agents/skills/claude-code/security-secrets-lifecycle/SKILL.mdView file
143patternName = private_key_rsa severity = critical line = 143 matchedText = (`-----B...test
Critical
Secret Pattern

RSA private key in dist/agents/skills/claude-code/security-secrets-lifecycle/SKILL.md

dist/agents/skills/claude-code/security-secrets-lifecycle/SKILL.mdView on unpkg · L143
dist/agents/skills/claude-code/test-component-react/SKILL.mdView file
61patternName = generic_password severity = medium line = 61 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/claude-code/test-component-react/SKILL.md

dist/agents/skills/claude-code/test-component-react/SKILL.mdView on unpkg · L61
dist/agents/skills/claude-code/mobile-testing-patterns/SKILL.mdView file
46patternName = generic_password severity = medium line = 46 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/claude-code/mobile-testing-patterns/SKILL.md

dist/agents/skills/claude-code/mobile-testing-patterns/SKILL.mdView on unpkg · L46
dist/agents/skills/claude-code/harness-secrets/SKILL.mdView file
21patternName = private_key_rsa severity = critical line = 21 matchedText = - **Priv...---`
Critical
Secret Pattern

RSA private key in dist/agents/skills/claude-code/harness-secrets/SKILL.md

dist/agents/skills/claude-code/harness-secrets/SKILL.mdView on unpkg · L21
21patternName = private_key_ec severity = critical line = 21 matchedText = - **Priv...---`
Critical
Secret Pattern

EC private key in dist/agents/skills/claude-code/harness-secrets/SKILL.md

dist/agents/skills/claude-code/harness-secrets/SKILL.mdView on unpkg · L21
dist/agents/skills/claude-code/nestjs-testing-patterns/SKILL.mdView file
86patternName = generic_password severity = medium line = 86 matchedText = .send({ ...' })
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/claude-code/nestjs-testing-patterns/SKILL.md

dist/agents/skills/claude-code/nestjs-testing-patterns/SKILL.mdView on unpkg · L86
dist/agents/skills/claude-code/owasp-secrets-management/SKILL.mdView file
19patternName = generic_password severity = medium line = 19 matchedText = const db... });
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/claude-code/owasp-secrets-management/SKILL.md

dist/agents/skills/claude-code/owasp-secrets-management/SKILL.mdView on unpkg · L19
124patternName = generic_password severity = medium line = 124 matchedText = logger.i... });
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/claude-code/owasp-secrets-management/SKILL.md

dist/agents/skills/claude-code/owasp-secrets-management/SKILL.mdView on unpkg · L124
dist/agents/skills/cursor/security-secrets-lifecycle/SKILL.mdView file
143patternName = private_key_rsa severity = critical line = 143 matchedText = (`-----B...test
Critical
Secret Pattern

RSA private key in dist/agents/skills/cursor/security-secrets-lifecycle/SKILL.md

dist/agents/skills/cursor/security-secrets-lifecycle/SKILL.mdView on unpkg · L143
dist/agents/skills/cursor/test-component-react/SKILL.mdView file
61patternName = generic_password severity = medium line = 61 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/cursor/test-component-react/SKILL.md

dist/agents/skills/cursor/test-component-react/SKILL.mdView on unpkg · L61
dist/agents/skills/cursor/api-oauth2-flows/SKILL.mdView file
69patternName = github_user_token severity = critical line = 69 matchedText = "access_...4a",
Critical
Secret Pattern

GitHub user-to-server token in dist/agents/skills/cursor/api-oauth2-flows/SKILL.md

dist/agents/skills/cursor/api-oauth2-flows/SKILL.mdView on unpkg · L69
dist/agents/skills/cursor/mobile-testing-patterns/SKILL.mdView file
46patternName = generic_password severity = medium line = 46 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/cursor/mobile-testing-patterns/SKILL.md

dist/agents/skills/cursor/mobile-testing-patterns/SKILL.mdView on unpkg · L46
dist/agents/skills/cursor/harness-secrets/SKILL.mdView file
21patternName = private_key_rsa severity = critical line = 21 matchedText = - **Priv...---`
Critical
Secret Pattern

RSA private key in dist/agents/skills/cursor/harness-secrets/SKILL.md

dist/agents/skills/cursor/harness-secrets/SKILL.mdView on unpkg · L21
21patternName = private_key_ec severity = critical line = 21 matchedText = - **Priv...---`
Critical
Secret Pattern

EC private key in dist/agents/skills/cursor/harness-secrets/SKILL.md

dist/agents/skills/cursor/harness-secrets/SKILL.mdView on unpkg · L21
dist/agents/skills/cursor/nestjs-testing-patterns/SKILL.mdView file
86patternName = generic_password severity = medium line = 86 matchedText = .send({ ...' })
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/cursor/nestjs-testing-patterns/SKILL.md

dist/agents/skills/cursor/nestjs-testing-patterns/SKILL.mdView on unpkg · L86
dist/agents/skills/cursor/owasp-secrets-management/SKILL.mdView file
19patternName = generic_password severity = medium line = 19 matchedText = const db... });
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/cursor/owasp-secrets-management/SKILL.md

dist/agents/skills/cursor/owasp-secrets-management/SKILL.mdView on unpkg · L19
124patternName = generic_password severity = medium line = 124 matchedText = logger.i... });
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/cursor/owasp-secrets-management/SKILL.md

dist/agents/skills/cursor/owasp-secrets-management/SKILL.mdView on unpkg · L124
dist/agents/skills/codex/security-secrets-lifecycle/SKILL.mdView file
143patternName = private_key_rsa severity = critical line = 143 matchedText = (`-----B...test
Critical
Secret Pattern

RSA private key in dist/agents/skills/codex/security-secrets-lifecycle/SKILL.md

dist/agents/skills/codex/security-secrets-lifecycle/SKILL.mdView on unpkg · L143
dist/agents/skills/codex/test-component-react/SKILL.mdView file
61patternName = generic_password severity = medium line = 61 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/codex/test-component-react/SKILL.md

dist/agents/skills/codex/test-component-react/SKILL.mdView on unpkg · L61
dist/agents/skills/codex/api-oauth2-flows/SKILL.mdView file
69patternName = github_user_token severity = critical line = 69 matchedText = "access_...4a",
Critical
Secret Pattern

GitHub user-to-server token in dist/agents/skills/codex/api-oauth2-flows/SKILL.md

dist/agents/skills/codex/api-oauth2-flows/SKILL.mdView on unpkg · L69
dist/agents/skills/codex/mobile-testing-patterns/SKILL.mdView file
46patternName = generic_password severity = medium line = 46 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/codex/mobile-testing-patterns/SKILL.md

dist/agents/skills/codex/mobile-testing-patterns/SKILL.mdView on unpkg · L46
dist/agents/skills/codex/harness-secrets/SKILL.mdView file
21patternName = private_key_rsa severity = critical line = 21 matchedText = - **Priv...---`
Critical
Secret Pattern

RSA private key in dist/agents/skills/codex/harness-secrets/SKILL.md

dist/agents/skills/codex/harness-secrets/SKILL.mdView on unpkg · L21
21patternName = private_key_ec severity = critical line = 21 matchedText = - **Priv...---`
Critical
Secret Pattern

EC private key in dist/agents/skills/codex/harness-secrets/SKILL.md

dist/agents/skills/codex/harness-secrets/SKILL.mdView on unpkg · L21
dist/agents/skills/codex/nestjs-testing-patterns/SKILL.mdView file
86patternName = generic_password severity = medium line = 86 matchedText = .send({ ...' })
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/codex/nestjs-testing-patterns/SKILL.md

dist/agents/skills/codex/nestjs-testing-patterns/SKILL.mdView on unpkg · L86
dist/agents/skills/codex/owasp-secrets-management/SKILL.mdView file
19patternName = generic_password severity = medium line = 19 matchedText = const db... });
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/codex/owasp-secrets-management/SKILL.md

dist/agents/skills/codex/owasp-secrets-management/SKILL.mdView on unpkg · L19
124patternName = generic_password severity = medium line = 124 matchedText = logger.i... });
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/codex/owasp-secrets-management/SKILL.md

dist/agents/skills/codex/owasp-secrets-management/SKILL.mdView on unpkg · L124
dist/agents/skills/gemini-cli/security-secrets-lifecycle/SKILL.mdView file
143patternName = private_key_rsa severity = critical line = 143 matchedText = (`-----B...test
Critical
Secret Pattern

RSA private key in dist/agents/skills/gemini-cli/security-secrets-lifecycle/SKILL.md

dist/agents/skills/gemini-cli/security-secrets-lifecycle/SKILL.mdView on unpkg · L143
dist/agents/skills/gemini-cli/test-component-react/SKILL.mdView file
61patternName = generic_password severity = medium line = 61 matchedText = password...23',
Medium
Secret Pattern

Hardcoded password in dist/agents/skills/gemini-cli/test-component-react/SKILL.md

dist/agents/skills/gemini-cli/test-component-react/SKILL.mdView on unpkg · L61
dist/agents/skills/gemini-cli/api-oauth2-flows/SKILL.mdView file
69patternName = github_user_token severity = critical line = 69 matchedText = "access_...4a",
Critical
Secret Pattern

GitHub user-to-server token in dist/agents/skills/gemini-cli/api-oauth2-flows/SKILL.md

dist/agents/skills/gemini-cli/api-oauth2-flows/SKILL.mdView on unpkg · L69

Findings

16 Critical7 High21 Medium6 Low
CriticalCritical Secretdist/agents/skills/claude-code/api-oauth2-flows/SKILL.md
CriticalPrevious Version Dangerous Deltadist/chunk-CRHQYBDA.js
CriticalSecret Patterndist/agents/skills/claude-code/security-secrets-lifecycle/SKILL.md
CriticalSecret Patterndist/agents/skills/claude-code/api-oauth2-flows/SKILL.md
CriticalSecret Patterndist/agents/skills/claude-code/harness-secrets/SKILL.md
CriticalSecret Patterndist/agents/skills/claude-code/harness-secrets/SKILL.md
CriticalSecret Patterndist/agents/skills/cursor/security-secrets-lifecycle/SKILL.md
CriticalSecret Patterndist/agents/skills/cursor/api-oauth2-flows/SKILL.md
CriticalSecret Patterndist/agents/skills/cursor/harness-secrets/SKILL.md
CriticalSecret Patterndist/agents/skills/cursor/harness-secrets/SKILL.md
CriticalSecret Patterndist/agents/skills/codex/security-secrets-lifecycle/SKILL.md
CriticalSecret Patterndist/agents/skills/codex/api-oauth2-flows/SKILL.md
CriticalSecret Patterndist/agents/skills/codex/harness-secrets/SKILL.md
CriticalSecret Patterndist/agents/skills/codex/harness-secrets/SKILL.md
CriticalSecret Patterndist/agents/skills/gemini-cli/security-secrets-lifecycle/SKILL.md
CriticalSecret Patterndist/agents/skills/gemini-cli/api-oauth2-flows/SKILL.md
HighChild Processdist/chunk-HJYAXAYQ.js
HighShell
HighSame File Env Network Executiondist/hooks/telemetry-reporter.js
HighObfuscated Payload Loaderdist/chunk-CRHQYBDA.js
HighCopied Package Dependency Bridgedist/hooks/sentinel-post.js
HighCross File Remote Execution Contextdist/chunk-YVI7ZV73.js
HighRuntime Package Installdist/chunk-F3GNBRGL.js
MediumDynamic Requiredist/chunk-CRHQYBDA.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperdist/templates/python-base/src/__init__.py
MediumStructural Risk Force Deep Review
MediumSecret Patterndist/agents/skills/claude-code/test-component-react/SKILL.md
MediumSecret Patterndist/agents/skills/claude-code/mobile-testing-patterns/SKILL.md
MediumSecret Patterndist/agents/skills/claude-code/nestjs-testing-patterns/SKILL.md
MediumSecret Patterndist/agents/skills/claude-code/owasp-secrets-management/SKILL.md
MediumSecret Patterndist/agents/skills/claude-code/owasp-secrets-management/SKILL.md
MediumSecret Patterndist/agents/skills/cursor/test-component-react/SKILL.md
MediumSecret Patterndist/agents/skills/cursor/mobile-testing-patterns/SKILL.md
MediumSecret Patterndist/agents/skills/cursor/nestjs-testing-patterns/SKILL.md
MediumSecret Patterndist/agents/skills/cursor/owasp-secrets-management/SKILL.md
MediumSecret Patterndist/agents/skills/cursor/owasp-secrets-management/SKILL.md
MediumSecret Patterndist/agents/skills/codex/test-component-react/SKILL.md
MediumSecret Patterndist/agents/skills/codex/mobile-testing-patterns/SKILL.md
MediumSecret Patterndist/agents/skills/codex/nestjs-testing-patterns/SKILL.md
MediumSecret Patterndist/agents/skills/codex/owasp-secrets-management/SKILL.md
MediumSecret Patterndist/agents/skills/codex/owasp-secrets-management/SKILL.md
MediumSecret Patterndist/agents/skills/gemini-cli/test-component-react/SKILL.md
LowScripts Present
LowEvaldist/chunk-CRHQYBDA.js
LowWeak Cryptodist/chunk-F3GNBRGL.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings