registry / @hunterzheng/kld-sdd / 2.5.0

@hunterzheng/kld-sdd@2.5.0

KLD SDD OpenSpec 项目初始化工具 - 一键部署 SDD skills

Static Scan Results

scanned 6d ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 239 KB of source

Source & flagged code

2 flagged

skywalk-sdd/apply-worktree-finish.cjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * SDD Apply Worktree Finish — 本地并行加速的收尾工具

4 *

5 * record-base: 记录 Apply 开始时主仓库的集成分支（merge 目标）

6 * finish: merge apply 分支 → integration_base → remove worktree → 删 apply 分支

7 *

8 * 必须在主仓库根目录执行，不要在 .worktrees/ 内。

9 */

11const fs = require('fs');

12const path = require('path');

13const { execFileSync } = require('child_process');

High

Child Process

Package source references child process execution.

skywalk-sdd/apply-worktree-finish.cjsView on unpkg · L12

15const TEMP_DIR_NAMES = ['node_modules', 'dist', '.turbo', '.next', 'coverage', 'build'];

17function parseArgs(argv) {

18 const args = {};

19 for (let i = 2; i < argv.length; i++) {

20 const token = argv[i];

21 if (token === '--') continue;

22 if (token.startsWith('--')) {

23 const eq = token.indexOf('=');

24 if (eq !== -1) {

25 args[token.slice(2, eq)] = token.slice(eq + 1);

26 } else {

27 const key = token.slice(2);

28 const next = argv[i + 1];

29 if (next && !next.startsWith('--')) {

30 args[key] = next;

31 i++;

32 } else {

lib/init.jsView file

Lines 209-249javascript

209}

210

211/**

212 * 获取模版路径

213 */

214function getTemplatePath() {

215 const pkgPath = getPackagePath();

216 return path.join(pkgPath, 'templates', 'openspec');

Source & flagged code

2 flagged · loading source

skywalk-sdd/apply-worktree-finish.cjsView file

12const path = require('path'); L13: const { execFileSync } = require('child_process'); L14:

High

Child Process

Package source references child process execution.

skywalk-sdd/apply-worktree-finish.cjsView on unpkg · L12

lib/init.jsView file

229// 尝试全局安装 L230: console.log(` 正在执行: npm install -g ${openspecPkg}`); L231: execSync(`${npmCmd} install -g ${openspecPkg}`, { L232: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/init.jsView on unpkg · L229

Findings

2 High3 Medium3 Low

HighChild Processskywalk-sdd/apply-worktree-finish.cjs

HighRuntime Package Installlib/init.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

skywalk-sdd/apply-worktree-finish.cjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * SDD Apply Worktree Finish — 本地并行加速的收尾工具

4 *

5 * record-base: 记录 Apply 开始时主仓库的集成分支（merge 目标）

6 * finish: merge apply 分支 → integration_base → remove worktree → 删 apply 分支

7 *

8 * 必须在主仓库根目录执行，不要在 .worktrees/ 内。

9 */

11const fs = require('fs');

12const path = require('path');

13const { execFileSync } = require('child_process');

High

Child Process

Package source references child process execution.

skywalk-sdd/apply-worktree-finish.cjsView on unpkg · L12

15const TEMP_DIR_NAMES = ['node_modules', 'dist', '.turbo', '.next', 'coverage', 'build'];

17function parseArgs(argv) {

18 const args = {};

19 for (let i = 2; i < argv.length; i++) {

20 const token = argv[i];

21 if (token === '--') continue;

22 if (token.startsWith('--')) {

23 const eq = token.indexOf('=');

24 if (eq !== -1) {

25 args[token.slice(2, eq)] = token.slice(eq + 1);

26 } else {

27 const key = token.slice(2);

28 const next = argv[i + 1];

29 if (next && !next.startsWith('--')) {

30 args[key] = next;

31 i++;

32 } else {

lib/init.jsView file

Lines 209-249javascript

209}

210

211/**

212 * 获取模版路径

213 */

214function getTemplatePath() {

215 const pkgPath = getPackagePath();

216 return path.join(pkgPath, 'templates', 'openspec');