registry / @hybridlabor-api/bdb-antigravity-skills / 1.1.9

@hybridlabor-api/bdb-antigravity-skills@1.1.9

Optimized Antigravity skills and MCP pack for BDB DEV

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 491 file(s), 2.61 MB of source, external domains: api.apify.com, console.apify.com, prod.spline.design

Source & flagged code

12 flagged

mcps/unreal_mcp/.env.productionView file

•patternName = blocked_file severity = critical matchedText = mcps/unreal_mcp/.env.production redactedSecretContext = secretLikeLines = 0 notes = no secret-like key/value lines found in sampled text

Critical

Critical Secret

Package contains a critical-looking secret pattern.

mcps/unreal_mcp/.env.productionView on unpkg

mcps/unreal_mcp/tests/test-runner.mjsView file

Lines 751-791javascript

751 const fullPath = path.join(dir, entry.name);

752 if (entry.isDirectory()) {

753 const child = await getLatestMtime(fullPath);

754 if (child > latest) latest = child;

755 } else {

756 try {

757 const stat = await fs.stat(fullPath);

758 const mtime = stat.mtimeMs || 0;

759 if (mtime > latest) latest = mtime;

760 } catch {

761 // Ignore files that disappear while scanning mtimes.

762 }

763 }

764 }

765 } catch {

766 // Ignore missing directories when deciding whether dist is stale.

767 }

768 return latest;

769}

770

771async function runNpmBuild() {

772 const { spawn } = await import('node:child_process');

773 await new Promise((resolve, reject) => {

High

Child Process

Package source references child process execution.

mcps/unreal_mcp/tests/test-runner.mjsView on unpkg · L771

774 const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';

775 const child = process.platform === 'win32'

776 ? spawn(`${npmCmd} run build`, { cwd: repoRoot, stdio: 'inherit', shell: true })

777 : spawn(npmCmd, ['run', 'build'], { cwd: repoRoot, stdio: 'inherit' });

778 child.on('close', (code) => (code === 0 ? resolve() : reject(new Error(`Build failed with code ${code}`))));

779 child.on('error', (err) => reject(err));

780 });

781}

782

783async function resolveServerLaunch() {

784 const distPath = path.join(repoRoot, 'dist', 'cli.js');

785 const srcDir = path.join(repoRoot, 'src');

786 let useDist = false;

787 let distExists = false;

788

789 try {

790 await fs.access(distPath);

791 distExists = true;

mcps/unreal_mcp/src/tools/handlers/pipeline/pipeline-ubt-discovery.tsView file

Lines 1-26typescript

1import { exec } from 'node:child_process';

2import fs from 'node:fs';

3import path from 'node:path';

4import util from 'node:util';

5import { isRecord } from '../../../utils/validation/type-guards.js'

mcps/unreal_mcp/src/utils/commands/command-validator.tsView file

Lines 15-55typescript

15 'assert false', 'check(false)',

16 // View buffer commands that can crash on some hardware

17 'viewmode visualizebuffer basecolor',

18 'viewmode visualizebuffer worldnormal',

19 // Heavy operations that can cause access violations if systems not initialized

20 'buildpaths', 'rebuildnavigation',

mcps/adobe_uxp_mcp/plugins/photoshop/index.jsView file

Lines 1-21javascript

1const { app, core } = require("photoshop");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

mcps/adobe_uxp_mcp/plugins/photoshop/index.jsView on unpkg · L1

3const WS_URL = "ws://localhost:8080";

4let socket =

mcps/unreal_mcp/src/automation/request-tracker.tsView file

Lines 1-36typescript

1import { PendingRequest, AutomationBridgeResponseMessage } from './types.js';

2import { randomUUID, createHash } from 'node:crypto';

3import {

4 PROGRESS_EXTENSION_MS,

5 MAX_PROGRESS_EXTENSIONS,

6 PROGRESS_STALE_THRESHOLD,

7 ABSOLUTE_MAX_TIMEOUT_MS

8} from

installer.jsView file

Lines 247-287javascript

247 if (platform === '1' && fs.existsSync(geminiMdSrc)) {

248 fs.copyFileSync(geminiMdSrc, path.join(geminiDir, 'GEMINI.md'));

249 console.log(` -> Installed GEMINI.md to ${path.join(geminiDir, 'GEMINI.md')}`);

250 }

mcps/unreal_mcp/scripts/package-plugin.batView file

•path = mcps/unreal_mcp/scripts/package-plugin.bat kind = build_helper sizeBytes = 8688 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mcps/unreal_mcp/scripts/package-plugin.batView on unpkg

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = high_entropy_blob sizeBytes = 19967 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

•path = skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

skills/global_config/playwright-skill/lib/helpers.jsView file

Lines 188-228javascript

188

189 await page.screenshot({

190 path: filename,

191 fullPage: options.fullPage !== false,

192 ...options

193 });

194

195 console.log(`Screenshot saved: ${filename

skills/global_legacy/playwright-skill/lib/helpers.jsView file

Lines 188-228javascript

188

189 await page.screenshot({

190 path: filename,

191 fullPage: options.fullPage !== false,

192 ...options

193 });

194

195 console.log(`Screenshot saved: ${filename

Source & flagged code

12 flagged · loading source

mcps/unreal_mcp/.env.productionView file

Critical

Critical Secret

Package contains a critical-looking secret pattern.

mcps/unreal_mcp/.env.productionView on unpkg

mcps/unreal_mcp/tests/test-runner.mjsView file

771async function runNpmBuild() { L772: const { spawn } = await import('node:child_process'); L773: await new Promise((resolve, reject) => {

High

Child Process

Package source references child process execution.

mcps/unreal_mcp/tests/test-runner.mjsView on unpkg · L771

mcps/unreal_mcp/src/tools/handlers/pipeline/pipeline-ubt-discovery.tsView file

6L7: const execAsync = util.promisify(exec); L8:

High

Shell

Package source references shell execution.

mcps/unreal_mcp/src/tools/handlers/pipeline/pipeline-ubt-discovery.tsView on unpkg · L6

mcps/unreal_mcp/src/utils/commands/command-validator.tsView file

35'import os', 'import subprocess', 'subprocess.', 'os.system', L36: 'exec(', 'eval(', '__import__', 'import sys', 'import importlib', L37: 'with open', 'open(', 'write(', 'read('

Low

Eval

Package source references a known benign dynamic code generation pattern.

mcps/unreal_mcp/src/utils/commands/command-validator.tsView on unpkg · L35

mcps/adobe_uxp_mcp/plugins/photoshop/index.jsView file

1const { app, core } = require("photoshop"); L2:

Medium

Dynamic Require

Package source references dynamic require/import behavior.

mcps/adobe_uxp_mcp/plugins/photoshop/index.jsView on unpkg · L1

mcps/unreal_mcp/src/automation/request-tracker.tsView file

16export class RequestTracker { L17: private pendingRequests = new Map<string, PendingRequest>(); L18: private coalescedRequests = new Map<string, Promise<AutomationBridgeResponseMessage>>();

Low

Weak Crypto

Package source references weak cryptographic algorithms.

mcps/unreal_mcp/src/automation/request-tracker.tsView on unpkg · L16

installer.jsView file

267try { L268: execSync('npm install --no-audit --no-fund', { cwd: targetFolder, stdio: 'ignore' }); L269: if (fs.existsSync(path.join(targetFolder, 'tsconfig.json'))) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

installer.jsView on unpkg · L267

mcps/unreal_mcp/scripts/package-plugin.batView file

•path = mcps/unreal_mcp/scripts/package-plugin.bat kind = build_helper sizeBytes = 8688 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mcps/unreal_mcp/scripts/package-plugin.batView on unpkg

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = high_entropy_blob sizeBytes = 19967 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

•path = skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

skills/global_config/playwright-skill/lib/helpers.jsView file

208patternName = generic_password severity = medium line = 208 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in skills/global_config/playwright-skill/lib/helpers.js

skills/global_config/playwright-skill/lib/helpers.jsView on unpkg · L208

skills/global_legacy/playwright-skill/lib/helpers.jsView file

208patternName = generic_password severity = medium line = 208 matchedText = password...rd',

Medium

Secret Pattern

Hardcoded password in skills/global_legacy/playwright-skill/lib/helpers.js

skills/global_legacy/playwright-skill/lib/helpers.jsView on unpkg · L208

Findings

1 Critical4 High8 Medium5 Low

CriticalCritical Secretmcps/unreal_mcp/.env.production

HighChild Processmcps/unreal_mcp/tests/test-runner.mjs

HighShellmcps/unreal_mcp/src/tools/handlers/pipeline/pipeline-ubt-discovery.ts

HighRuntime Package Installinstaller.js

HighShips High Entropy Blobskills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz

MediumDynamic Requiremcps/adobe_uxp_mcp/plugins/photoshop/index.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpermcps/unreal_mcp/scripts/package-plugin.bat

MediumShips Compressed Blobskills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz

MediumStructural Risk Force Deep Review

MediumSecret Patternskills/global_config/playwright-skill/lib/helpers.js

MediumSecret Patternskills/global_legacy/playwright-skill/lib/helpers.js

LowEvalmcps/unreal_mcp/src/utils/commands/command-validator.ts

LowWeak Cryptomcps/unreal_mcp/src/automation/request-tracker.ts

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

12 flagged

mcps/unreal_mcp/.env.productionView file

Critical

Critical Secret

Package contains a critical-looking secret pattern.

mcps/unreal_mcp/.env.productionView on unpkg

mcps/unreal_mcp/tests/test-runner.mjsView file

Lines 751-791javascript

751 const fullPath = path.join(dir, entry.name);

752 if (entry.isDirectory()) {

753 const child = await getLatestMtime(fullPath);

754 if (child > latest) latest = child;

755 } else {

756 try {

757 const stat = await fs.stat(fullPath);

758 const mtime = stat.mtimeMs || 0;

759 if (mtime > latest) latest = mtime;

760 } catch {

761 // Ignore files that disappear while scanning mtimes.

762 }

763 }

764 }

765 } catch {

766 // Ignore missing directories when deciding whether dist is stale.

767 }

768 return latest;

769}

770

771async function runNpmBuild() {

772 const { spawn } = await import('node:child_process');

773 await new Promise((resolve, reject) => {

High

Child Process

Package source references child process execution.

mcps/unreal_mcp/tests/test-runner.mjsView on unpkg · L771

774 const npmCmd = process.platform === 'win32' ? 'npm.cmd' : 'npm';

775 const child = process.platform === 'win32'

776 ? spawn(`${npmCmd} run build`, { cwd: repoRoot, stdio: 'inherit', shell: true })

777 : spawn(npmCmd, ['run', 'build'], { cwd: repoRoot, stdio: 'inherit' });

778 child.on('close', (code) => (code === 0 ? resolve() : reject(new Error(`Build failed with code ${code}`))));

779 child.on('error', (err) => reject(err));

780 });

781}

782

783async function resolveServerLaunch() {

784 const distPath = path.join(repoRoot, 'dist', 'cli.js');

785 const srcDir = path.join(repoRoot, 'src');

786 let useDist = false;

787 let distExists = false;

788

789 try {

790 await fs.access(distPath);

791 distExists = true;

mcps/unreal_mcp/src/tools/handlers/pipeline/pipeline-ubt-discovery.tsView file

Lines 1-26typescript

1import { exec } from 'node:child_process';

2import fs from 'node:fs';

3import path from 'node:path';

4import util from 'node:util';

5import { isRecord } from '../../../utils/validation/type-guards.js'

mcps/unreal_mcp/src/utils/commands/command-validator.tsView file

Lines 15-55typescript

15 'assert false', 'check(false)',

16 // View buffer commands that can crash on some hardware

17 'viewmode visualizebuffer basecolor',

18 'viewmode visualizebuffer worldnormal',

19 // Heavy operations that can cause access violations if systems not initialized

20 'buildpaths', 'rebuildnavigation',

mcps/adobe_uxp_mcp/plugins/photoshop/index.jsView file

Lines 1-21javascript

1const { app, core } = require("photoshop");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

mcps/adobe_uxp_mcp/plugins/photoshop/index.jsView on unpkg · L1

3const WS_URL = "ws://localhost:8080";

4let socket =

mcps/unreal_mcp/src/automation/request-tracker.tsView file

Lines 1-36typescript

1import { PendingRequest, AutomationBridgeResponseMessage } from './types.js';

2import { randomUUID, createHash } from 'node:crypto';

3import {

4 PROGRESS_EXTENSION_MS,

5 MAX_PROGRESS_EXTENSIONS,

6 PROGRESS_STALE_THRESHOLD,

7 ABSOLUTE_MAX_TIMEOUT_MS

8} from

installer.jsView file

Lines 247-287javascript

247 if (platform === '1' && fs.existsSync(geminiMdSrc)) {

248 fs.copyFileSync(geminiMdSrc, path.join(geminiDir, 'GEMINI.md'));

249 console.log(` -> Installed GEMINI.md to ${path.join(geminiDir, 'GEMINI.md')}`);

250 }

mcps/unreal_mcp/scripts/package-plugin.batView file

•path = mcps/unreal_mcp/scripts/package-plugin.bat kind = build_helper sizeBytes = 8688 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

mcps/unreal_mcp/scripts/package-plugin.batView on unpkg

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView file

•path = skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = high_entropy_blob sizeBytes = 19967 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

•path = skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gz kind = compressed_blob sizeBytes = 19967 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/global_config/web-artifacts-builder/scripts/shadcn-components.tar.gzView on unpkg

skills/global_config/playwright-skill/lib/helpers.jsView file

Lines 188-228javascript

188

189 await page.screenshot({

190 path: filename,

191 fullPage: options.fullPage !== false,

192 ...options

193 });

194

195 console.log(`Screenshot saved: ${filename

skills/global_legacy/playwright-skill/lib/helpers.jsView file

Lines 188-228javascript

188

189 await page.screenshot({

190 path: filename,

191 fullPage: options.fullPage !== false,

192 ...options

193 });

194

195 console.log(`Screenshot saved: ${filename