registry / @hunterzheng/kld-sdd / 2.8.4

@hunterzheng/kld-sdd@2.8.4

KLD SDD OpenSpec 项目初始化工具 - 一键部署 SDD skills

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 88.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; source closely matched a different package identity

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 28 file(s), 371 KB of source

Source & flagged code

4 flagged

skywalk-sdd/apply-worktree-finish.cjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * SDD Apply Worktree Finish — 本地并行加速的收尾工具

4 *

5 * record-base: 记录 Apply 开始时主仓库的集成分支（merge 目标）

6 * finish: merge apply 分支 → integration_base → remove worktree → 删 apply 分支

7 *

8 * 必须在主仓库根目录执行，不要在 .worktrees/ 内。

9 */

11const fs = require('fs');

12const path = require('path');

13const { execFileSync } = require('child_process');

High

Child Process

Package source references child process execution.

skywalk-sdd/apply-worktree-finish.cjsView on unpkg · L12

15const TEMP_DIR_NAMES = ['node_modules', 'dist', '.turbo', '.next', 'coverage', 'build'];

17function parseArgs(argv) {

18 const args = {};

19 for (let i = 2; i < argv.length; i++) {

20 const token = argv[i];

21 if (token === '--') continue;

22 if (token.startsWith('--')) {

23 const eq = token.indexOf('=');

24 if (eq !== -1) {

25 args[token.slice(2, eq)] = token.slice(eq + 1);

26 } else {

27 const key = token.slice(2);

28 const next = argv[i + 1];

29 if (next && !next.startsWith('--')) {

30 args[key] = next;

31 i++;

32 } else {

skywalk-sdd/index.cjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * SDD Telemetry CLI

4 *

5 * 本地 CLI 工具，为 SDD 工作流提供精确的流程度量采集。

6 * AI Agent 通过终端命令调用，将事件写入项目本地 skywalk-sdd/ 目录。

7 *

8 * 用法:

9 * node skywalk-sdd/log.cjs start --command=propose --project=/path --change=xxx [--agent=cursor]

10 * node skywalk-sdd/log.cjs end --event-id=evt_xxx --result=success --summary="..."

11 * node skywalk-sdd/log.cjs metrics --project=/path [--change=xxx]

12 */

lib/init.jsView file

Lines 151-191javascript

151}

152

153/**

154 * 获取模版路径

155 */

156function getTemplatePath() {

157 const pkgPath = getPackagePath();

158 return path.join(pkgPath, 'templates', 'openspec');

Source & flagged code

4 flagged · loading source

skywalk-sdd/apply-worktree-finish.cjsView file

12const path = require('path'); L13: const { execFileSync } = require('child_process'); L14:

High

Child Process

Package source references child process execution.

skywalk-sdd/apply-worktree-finish.cjsView on unpkg · L12

skywalk-sdd/index.cjsView file

16const crypto = require('crypto'); L17: const { execFileSync } = require('child_process'); L18: ... L75: function normalizeProjectRoot(projectRoot) { L76: const rawProjectRoot = projectRoot || process.cwd(); L77: if (process.platform === 'win32' && /^[a-zA-Z]:[^\\/]/.test(String(rawProjectRoot))) { L78: fail(`Windows 项目路径格式不安全: ${rawProjectRoot}。请使用 --project=.，或使用正斜杠路径如 D:/project/demo，或给路径加引号。`); ... L86: L87: return process.env.SDD_AGENT_TYPE L88: || process.env.AI_AGENT_TYPE ... L97: : path.resolve(projectRoot || process.cwd(), filePath); L98: return JSON.parse(fs.readFileSync(resolved, 'utf8'));

Low

Weak Crypto

Package source references weak cryptographic algorithms.

skywalk-sdd/index.cjsView on unpkg · L16

lib/init.jsView file

171// 尝试全局安装 L172: console.log(` 正在执行: npm install -g ${openspecPkg}`); L173: execSync(`${npmCmd} install -g ${openspecPkg}`, { L174: stdio: 'inherit',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/init.jsView on unpkg · L171

•matchType = package_source_clone_identity_mismatch matchedPackage = kld-sdd@2.5.1 matchedPath = bin/kld-sdd-init.js matchedIdentity = npm:a2xkLXNkZA:2.5.1 similarity = 1.000 shingleOverlap = 28 summary = source files closely matched a different published package identity

High

Package Source Clone Identity Mismatch

Package source closely matches a different published package identity; review for dependency-confusion or copied-code abuse.

lib/init.jsView on unpkg

Findings

3 High3 Medium4 Low

HighChild Processskywalk-sdd/apply-worktree-finish.cjs

HighRuntime Package Installlib/init.js

HighPackage Source Clone Identity Mismatchlib/init.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptoskywalk-sdd/index.cjs

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

4 flagged

skywalk-sdd/apply-worktree-finish.cjsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * SDD Apply Worktree Finish — 本地并行加速的收尾工具

4 *

5 * record-base: 记录 Apply 开始时主仓库的集成分支（merge 目标）

6 * finish: merge apply 分支 → integration_base → remove worktree → 删 apply 分支

7 *

8 * 必须在主仓库根目录执行，不要在 .worktrees/ 内。

9 */

11const fs = require('fs');

12const path = require('path');

13const { execFileSync } = require('child_process');

High

Child Process

Package source references child process execution.

skywalk-sdd/apply-worktree-finish.cjsView on unpkg · L12

15const TEMP_DIR_NAMES = ['node_modules', 'dist', '.turbo', '.next', 'coverage', 'build'];

17function parseArgs(argv) {

18 const args = {};

19 for (let i = 2; i < argv.length; i++) {

20 const token = argv[i];

21 if (token === '--') continue;

22 if (token.startsWith('--')) {

23 const eq = token.indexOf('=');

24 if (eq !== -1) {

25 args[token.slice(2, eq)] = token.slice(eq + 1);

26 } else {

27 const key = token.slice(2);

28 const next = argv[i + 1];

29 if (next && !next.startsWith('--')) {

30 args[key] = next;

31 i++;

32 } else {

skywalk-sdd/index.cjsView file

Lines 1-36javascript

1#!/usr/bin/env node

2/**

3 * SDD Telemetry CLI

4 *

5 * 本地 CLI 工具，为 SDD 工作流提供精确的流程度量采集。

6 * AI Agent 通过终端命令调用，将事件写入项目本地 skywalk-sdd/ 目录。

7 *

8 * 用法:

9 * node skywalk-sdd/log.cjs start --command=propose --project=/path --change=xxx [--agent=cursor]

10 * node skywalk-sdd/log.cjs end --event-id=evt_xxx --result=success --summary="..."

11 * node skywalk-sdd/log.cjs metrics --project=/path [--change=xxx]

12 */

lib/init.jsView file

Lines 151-191javascript

151}

152

153/**

154 * 获取模版路径

155 */

156function getTemplatePath() {

157 const pkgPath = getPackagePath();

158 return path.join(pkgPath, 'templates', 'openspec');