registry / @honeydeck/honeydeck / 0.15.0

@honeydeck/honeydeck@0.15.0

MDX and React-based presentation framework for AI-friendly slide decks.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 117 file(s), 476 KB of source, external domains: 127.0.0.1, 192.168.x.x, honeydeck.dev

Source & flagged code

3 flagged

src/cli/init.tsView file

Lines 1-35typescript

1/**

2 * `honeydeck init` — scaffold a new Honeydeck presentation project.

3 *

4 * ### Flow

5 *

6 * 1. Parse CLI flags (`--name`, `--skip-install`, skill options).

7 * 2. intro() — greeting banner.

8 * 3. Prompt for project name (skipped with --name flag).

9 * 4. Create project directory + subdirectories.

10 * 5. Write all template files.

11 * 6. Install dependencies with pnpm (skipped with --skip-install flag).

12 * 7. Optionally install Honeydeck agent skills.

13 * 8. outro() — success message with next steps.

14 */

16import { spawn } from "node:child_process";

17import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

src/cli/init.tsView on unpkg · L15

18import { dirname, join, resolve } from "node:path";

19import * as p from "@clack/prompts";

20import { DEFAULT_DECK_ENTRY } from "../defaults.ts";

21import { hasHelpFlag } from "./args.ts";

22import { openHoneydeckAgentSkillsInstaller } from "./skill.ts";

23import { generateDeckMdx } from "./templates/deck-mdx.ts";

24import { generatePackageJson } from "./templates/package-json.ts";

25import { generateSparkleButton } from "./templates/sparkle-button.ts";

26import { generateStylesCss } from "./templates/styles-css.ts";

28// ---------------------------------------------------------------------------

29// Arg parsing

30// ---------------------------------------------------------------------------

32export type InitOptions = {

33 /** Explicit project name — skips the interactive prompt. */

34 name: string | null;

35 /** Skip running pnpm install. */

Lines 87-127typescript

87 skipInstall = true;

88 } else if (arg === "--install-skill") {

89 installSkill = true;

90 } else if (arg === "--skip-skill") {

91 installSkill = false;

92 }

src/cli/skill.tsView file

Lines 22-62typescript

22 Opens the skills installer via npx skills add for bundled Honeydeck skills.

24 Examples:

25 honeydeck skill

26`);

27}

29function packageRoot(): string {

30 return resolve(dirname(fileURLToPath(import.meta.url)), "../..");

31}

33export type InstallHoneydeckAgentSkillsOptions = {

34 /** Show the normal `

Source & flagged code

3 flagged · loading source

src/cli/init.tsView file

15L16: import { spawn } from "node:child_process"; L17: import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

src/cli/init.tsView on unpkg · L15

107cwd, L108: shell: true, L109: stdio: "ignore",

High

Shell

Package source references shell execution.

src/cli/init.tsView on unpkg · L107

src/cli/skill.tsView file

42): void { L43: execFileSync("npx", ["skills", "add", packageRoot(), "--copy", ...args], { L44: cwd: projectDir,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/cli/skill.tsView on unpkg · L42

Findings

3 High2 Medium4 Low

HighChild Processsrc/cli/init.ts

HighShellsrc/cli/init.ts

HighRuntime Package Installsrc/cli/skill.ts

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

src/cli/init.tsView file

Lines 1-35typescript

1/**

2 * `honeydeck init` — scaffold a new Honeydeck presentation project.

3 *

4 * ### Flow

5 *

6 * 1. Parse CLI flags (`--name`, `--skip-install`, skill options).

7 * 2. intro() — greeting banner.

8 * 3. Prompt for project name (skipped with --name flag).

9 * 4. Create project directory + subdirectories.

10 * 5. Write all template files.

11 * 6. Install dependencies with pnpm (skipped with --skip-install flag).

12 * 7. Optionally install Honeydeck agent skills.

13 * 8. outro() — success message with next steps.

14 */

16import { spawn } from "node:child_process";

17import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs";

High

Child Process

Package source references child process execution.

src/cli/init.tsView on unpkg · L15

18import { dirname, join, resolve } from "node:path";

19import * as p from "@clack/prompts";

20import { DEFAULT_DECK_ENTRY } from "../defaults.ts";

21import { hasHelpFlag } from "./args.ts";

22import { openHoneydeckAgentSkillsInstaller } from "./skill.ts";

23import { generateDeckMdx } from "./templates/deck-mdx.ts";

24import { generatePackageJson } from "./templates/package-json.ts";

25import { generateSparkleButton } from "./templates/sparkle-button.ts";

26import { generateStylesCss } from "./templates/styles-css.ts";

28// ---------------------------------------------------------------------------

29// Arg parsing

30// ---------------------------------------------------------------------------

32export type InitOptions = {

33 /** Explicit project name — skips the interactive prompt. */

34 name: string | null;

35 /** Skip running pnpm install. */

Lines 87-127typescript

87 skipInstall = true;

88 } else if (arg === "--install-skill") {

89 installSkill = true;

90 } else if (arg === "--skip-skill") {

91 installSkill = false;

92 }

src/cli/skill.tsView file

Lines 22-62typescript

22 Opens the skills installer via npx skills add for bundled Honeydeck skills.

24 Examples:

25 honeydeck skill

26`);

27}

29function packageRoot(): string {

30 return resolve(dirname(fileURLToPath(import.meta.url)), "../..");

31}

33export type InstallHoneydeckAgentSkillsOptions = {

34 /** Show the normal `