registry / @hybridlabor-api/bdb-antigravity-skills / 1.0.5

@hybridlabor-api/bdb-antigravity-skills@1.0.5

Optimized Antigravity skills and MCP pack for BDB DEV

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 14 file(s), 110 KB of source, external domains: api.apify.com, console.apify.com, prod.spline.design

Source & flagged code

6 flagged

skills/global_config/playwright-skill/lib/helpers.jsView file

Lines 188-228javascript

188

189 await page.screenshot({

190 path: filename,

191 fullPage: options.fullPage !== false,

192 ...options

193 });

194

195 console.log(`Screenshot saved: ${filename}`);

196 return filename;

197}

198

199/**

200 * Handle authentication

201 * @param {Object} page - Playwright page

202 * @param {Object} credentials - Username and password

203 * @param {Object} selectors - Login form selectors

204 */

205async function authenticate(page, credentials, selectors = {}) {

206 const defaultSelectors = {

207 username: 'input[name="username"], input[name="email"], #username, #email',

208 password: 'input[name="password"], #password',

Medium

Secret Pattern

Package contains a possible secret pattern.

skills/global_config/playwright-skill/lib/helpers.jsView on unpkg · L208

209 submit: 'button[type="submit"], input[type="submit"], button:has-text("Login"), button:has-text("Sign in")'

210 };

211

212 const finalSelectors = { ...defaultSelectors, ...selectors };

213

214 await safeType(page, finalSelectors.username, credentials.username);

215 await safeType(page, finalSelectors.password, credentials.password);

216 await safeClick(page, finalSelectors.submit);

217

218 // Wait for navigation or success indicator

219 await Promise.race([

220 page.waitForNavigation({ waitUntil: 'networkidle' }),

221 page.waitForSelector(selectors.successIndicator || '.dashboard, .user-menu, .logout', { timeout: 10000 })

222 ]).catch(() => {

223 console.log('Login might have completed without navigation');

224 });

225}

226

227/**

228 * Scroll page

skills/global_config/playwright-skill/run.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * Universal Playwright Executor for Claude Code

4 *

5 * Executes Playwright automation code from:

6 * - File path: node run.js script.js

7 * - Inline code: node run.js 'await page.goto("...")'

8 * - Stdin: cat script.js | node run.js

9 *

10 * Ensures proper module resolution by running from skill directory.

11 */

installer.shView file

•path = installer.sh kind = build_helper sizeBytes = 3329 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

installer.shView on unpkg

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = high_entropy_blob sizeBytes = 19967 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

•path = skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

skills/global_legacy/playwright-skill/lib/helpers.jsView file

Lines 188-228javascript

188

189 await page.screenshot({

190 path: filename,

191 fullPage: options.fullPage !== false,

192 ...options

193 });

194

195 console.log(`Screenshot saved: ${filename

Source & flagged code

6 flagged · loading source

skills/global_config/playwright-skill/lib/helpers.jsView file

208patternName = generic_password severity = medium line = 208 matchedText = password...rd',

Medium

Secret Pattern

Package contains a possible secret pattern.

skills/global_config/playwright-skill/lib/helpers.jsView on unpkg · L208

skills/global_config/playwright-skill/run.jsView file

12L13: const fs = require('fs'); L14: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

skills/global_config/playwright-skill/run.jsView on unpkg · L12

installer.shView file

•path = installer.sh kind = build_helper sizeBytes = 3329 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

installer.shView on unpkg

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = high_entropy_blob sizeBytes = 19967 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

•path = skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

skills/global_legacy/playwright-skill/lib/helpers.jsView file

208patternName = generic_password severity = medium line = 208 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in skills/global_legacy/playwright-skill/lib/helpers.js

skills/global_legacy/playwright-skill/lib/helpers.jsView on unpkg · L208

Findings

1 High8 Medium4 Low

HighShips High Entropy Blobskills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz

MediumSecret Patternskills/global_config/playwright-skill/lib/helpers.js

MediumDynamic Requireskills/global_config/playwright-skill/run.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperinstaller.sh

MediumShips Compressed Blobskills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz

MediumStructural Risk Force Deep Review

MediumSecret Patternskills/global_legacy/playwright-skill/lib/helpers.js

LowEval

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

skills/global_config/playwright-skill/lib/helpers.jsView file

Lines 188-228javascript

188

189 await page.screenshot({

190 path: filename,

191 fullPage: options.fullPage !== false,

192 ...options

193 });

194

195 console.log(`Screenshot saved: ${filename}`);

196 return filename;

197}

198

199/**

200 * Handle authentication

201 * @param {Object} page - Playwright page

202 * @param {Object} credentials - Username and password

203 * @param {Object} selectors - Login form selectors

204 */

205async function authenticate(page, credentials, selectors = {}) {

206 const defaultSelectors = {

207 username: 'input[name="username"], input[name="email"], #username, #email',

208 password: 'input[name="password"], #password',

Medium

Secret Pattern

Package contains a possible secret pattern.

skills/global_config/playwright-skill/lib/helpers.jsView on unpkg · L208

209 submit: 'button[type="submit"], input[type="submit"], button:has-text("Login"), button:has-text("Sign in")'

210 };

211

212 const finalSelectors = { ...defaultSelectors, ...selectors };

213

214 await safeType(page, finalSelectors.username, credentials.username);

215 await safeType(page, finalSelectors.password, credentials.password);

216 await safeClick(page, finalSelectors.submit);

217

218 // Wait for navigation or success indicator

219 await Promise.race([

220 page.waitForNavigation({ waitUntil: 'networkidle' }),

221 page.waitForSelector(selectors.successIndicator || '.dashboard, .user-menu, .logout', { timeout: 10000 })

222 ]).catch(() => {

223 console.log('Login might have completed without navigation');

224 });

225}

226

227/**

228 * Scroll page

skills/global_config/playwright-skill/run.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2/**

3 * Universal Playwright Executor for Claude Code

4 *

5 * Executes Playwright automation code from:

6 * - File path: node run.js script.js

7 * - Inline code: node run.js 'await page.goto("...")'

8 * - Stdin: cat script.js | node run.js

9 *

10 * Ensures proper module resolution by running from skill directory.

11 */

installer.shView file

•path = installer.sh kind = build_helper sizeBytes = 3329 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

installer.shView on unpkg

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = high_entropy_blob sizeBytes = 19967 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

•path = skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

skills/global_legacy/playwright-skill/lib/helpers.jsView file

Lines 188-228javascript

188

189 await page.screenshot({

190 path: filename,

191 fullPage: options.fullPage !== false,

192 ...options

193 });

194

195 console.log(`Screenshot saved: ${filename