registry / @kairyou/agent-tools / 0.6.0

@kairyou/agent-tools@0.6.0

Reusable Agent Skills and installable integrations (statusline, provider usage, vision) for Codex, Claude Code, and opencode.

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 36 file(s), 1.47 MB of source, external domains: 127.0.0.1, api.anthropic.com, api.openai.com, gateway.example.com, github.com, json-schema.org, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, tools.ietf.org, www.safaribooksonline.com, www.w3.org

Source & flagged code

6 flagged

dist/statusline/claude-statusline.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

3// integrations/statusline/claude-statusline.mjs

4import { execFileSync, spawn } from "node:child_process";

5import fs from "node:fs";

High

Child Process

Package source references child process execution.

dist/statusline/claude-statusline.mjsView on unpkg · L3

6import { basename, dirname, join } from "node:path";

7import { fileURLToPath } from "node:url";

9// node_modules/jsonc-parser/lib/esm/impl/scanner.js

10function createScanner(text, ignoreTrivia = false) {

11 const len = text.length;

12 let pos = 0, value = "", tokenOffset = 0, token = 16, lineNumber = 0, lineStartOffset = 0, tokenLineStartOffset = 0, prevTokenLineStartOffset = 0, scanError

13 function scanHexDigits(count, exact) {

14 let digits = 0;

15 let value2 = 0;

16 while (digits < count || !exact) {

17 let ch = text.charCodeAt(pos);

18 if (ch >= 48 && ch <= 57) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/statusline/claude-statusline.mjsView on unpkg · L3

19 value2 = value2 * 16 + ch - 48;

20 } else if (ch >= 65 && ch <= 70) {

21 value2 = value2 * 16 + ch - 65 + 10;

22 } else if (ch >= 97 && ch <= 102) {

23 value2 = value2 * 16 + ch - 97 + 10;

scripts/release.mjsView file

Lines 9-49javascript

9//

10// Release when scripts/ integrations/ config.default.jsonc or

11// package.json deps change — npx users only get these from the published package.

12// (skills/ ships from GitHub via `npx skills add`; no release needed.)

14import { spawnSync } from "node:child_process";

15import { readFileSync } from "node:fs";

dist/vision/mcp-server.mjsView file

2945sourceCode = this.opts.code.process(sourceCode, sch); L2946: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2947: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/vision/mcp-server.mjsView on unpkg · L2945

dist/usage/core.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

3// integrations/usage/core.mjs

4import { pathToFileURL as pathToFileURL2 } from "node:url";

6// integrations/usage/lib/config.mjs

7import { readFile, writeFile, mkdir } from "node:fs/promises";

Source & flagged code

6 flagged · loading source

dist/statusline/claude-statusline.mjs

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code