registry / @hunterzheng/kld-sdd / 2.6.6

@hunterzheng/kld-sdd@2.6.6

KLD SDD OpenSpec 项目初始化工具 - 一键部署 SDD skills

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 309 KB of source

Source & flagged code

3 flagged

skywalk-sdd/apply-worktree-finish.cjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * SDD Apply Worktree Finish — 本地并行加速的收尾工具

4 *

5 * record-base: 记录 Apply 开始时主仓库的集成分支（merge 目标）

6 * finish: merge apply 分支 → integration_base → remove worktree → 删 apply 分支

7 *

8 * 必须在主仓库根目录执行，不要在 .worktrees/ 内。

9 */

11const fs = require('fs');

12const path = require('path');

13const { execFileSync } = require('child_process');

High

Child Process

Package source references child process execution.

skywalk-sdd/apply-worktree-finish.cjsView on unpkg · L12

15const TEMP_DIR_NAMES = ['node_modules', 'dist', '.turbo', '.next', 'coverage', 'build'];

17function parseArgs(argv) {

18 const args = {};

19 for (let i = 2; i < argv.length; i++) {

20 const token = argv[i];

21 if (token === '--') continue;

22 if (token.startsWith('--')) {

23 const eq = token.indexOf('=');

24 if (eq !== -1) {

25 args[token.slice(2, eq)] = token.slice(eq + 1);

26 } else {

27 const key = token.slice(2);

28 const next = argv[i + 1];

29 if (next && !next.startsWith('--')) {

30 args[key] = next;

31 i++;

32 } else {

skywalk-sdd/index.cjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * SDD Telemetry CLI

4 *

5 * 本地 CLI 工具，为 SDD 工作流提供精确的流程度量采集。

6 * AI Agent 通过终端命令调用，将事件写入项目本地 skywalk-sdd/ 目录。

7 *

8 * 用法:

9 * node skywalk-sdd/log.cjs start --command=propose --project=/path --change=xxx [--agent=cursor]

10 * node skywalk-sdd/log.cjs end --event-id=evt_xxx --result=success --summary="..."

11 * node skywalk-sdd/log.cjs metrics --project=/path [--change=xxx]

12 */

lib/init.jsView file

Lines 209-249javascript

209}

210

211/**

212 * 获取模版路径

213 */

214function getTemplatePath() {

215 const pkgPath = getPackagePath();

216 return path.join(pkgPath, 'templates', 'openspec');

Source & flagged code

3 flagged · loading source

skywalk-sdd/apply-worktree-finish.cjsView file

12const path = require('path'); L13: const { execFileSync } = require('child_process'); L14:

High

Child Process

Package source references child process execution.

skywalk-sdd/apply-worktree-finish.cjsView on unpkg · L12

skywalk-sdd/index.cjsView file

16const crypto = require('crypto'); L17: const { execFileSync } = require('child_process'); L18: ... L75: function normalizeProjectRoot(projectRoot) { L76: const rawProjectRoot = projectRoot || process.cwd(); L77: if (process.platform === 'win32' && /^[a-zA-Z]:[^\\/]/.test(String(rawProjectRoot))) { L78: fail(`Windows 项目路径格式不安全: ${rawProjectRoot}。请使用 --project=.，或使用正斜杠路径如 D:/project/demo，或给路径加引号。`); ... L86: L87: return process.env.SDD_AGENT_TYPE L88: || process.env.AI_AGENT_TYPE ... L97: : path.resolve(projectRoot || process.cwd(), filePath); L98: return JSON.parse(fs.readFileSync(resolved, 'utf8'));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

skywalk-sdd/index.cjsView on unpkg · L16

lib/init.jsView file

229// 尝试全局安装 L230: console.log(` 正在执行: npm install -g ${openspecPkg}`); L231: execSync(`${npmCmd} install -g ${openspecPkg}`, { L232: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/init.jsView on unpkg · L229

Findings

2 High3 Medium4 Low

HighChild Processskywalk-sdd/apply-worktree-finish.cjs

HighRuntime Package Installlib/init.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptoskywalk-sdd/index.cjs

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

3 flagged

skywalk-sdd/apply-worktree-finish.cjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * SDD Apply Worktree Finish — 本地并行加速的收尾工具

4 *

5 * record-base: 记录 Apply 开始时主仓库的集成分支（merge 目标）

6 * finish: merge apply 分支 → integration_base → remove worktree → 删 apply 分支

7 *

8 * 必须在主仓库根目录执行，不要在 .worktrees/ 内。

9 */

11const fs = require('fs');

12const path = require('path');

13const { execFileSync } = require('child_process');

High

Child Process

Package source references child process execution.

skywalk-sdd/apply-worktree-finish.cjsView on unpkg · L12

15const TEMP_DIR_NAMES = ['node_modules', 'dist', '.turbo', '.next', 'coverage', 'build'];

17function parseArgs(argv) {

18 const args = {};

19 for (let i = 2; i < argv.length; i++) {

20 const token = argv[i];

21 if (token === '--') continue;

22 if (token.startsWith('--')) {

23 const eq = token.indexOf('=');

24 if (eq !== -1) {

25 args[token.slice(2, eq)] = token.slice(eq + 1);

26 } else {

27 const key = token.slice(2);

28 const next = argv[i + 1];

29 if (next && !next.startsWith('--')) {

30 args[key] = next;

31 i++;

32 } else {

skywalk-sdd/index.cjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * SDD Telemetry CLI

4 *

5 * 本地 CLI 工具，为 SDD 工作流提供精确的流程度量采集。

6 * AI Agent 通过终端命令调用，将事件写入项目本地 skywalk-sdd/ 目录。

7 *

8 * 用法:

9 * node skywalk-sdd/log.cjs start --command=propose --project=/path --change=xxx [--agent=cursor]

10 * node skywalk-sdd/log.cjs end --event-id=evt_xxx --result=success --summary="..."

11 * node skywalk-sdd/log.cjs metrics --project=/path [--change=xxx]

12 */

lib/init.jsView file

Lines 209-249javascript

209}

210

211/**

212 * 获取模版路径

213 */

214function getTemplatePath() {

215 const pkgPath = getPackagePath();

216 return path.join(pkgPath, 'templates', 'openspec');