registry / @knackforge-soft-solutions/forge-sdlc-agent / 2.2.0

@knackforge-soft-solutions/forge-sdlc-agent@2.2.0

CLI control plane for the FORGE SDLC Power — interactive install, state machine v2, continuous memory v2, resume/restart.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 44 file(s), 196 KB of source

Source & flagged code

6 flagged

hooks/__tests__/pre-tool-block-destructive.test.jsView file

Lines 59-107javascript

59 assert.strictEqual(r.status, 2);

60});

62test('blocks Bash with gh pr merge', () => {

63 const r = runHook({ tool_name: 'Bash', tool_input: { command: 'gh pr merge 123' } });

64 assert.strictEqual(r.status, 2);

65});

67test('blocks Write containing sk- secret pattern', () => {

68 const r = runHook({

69 tool_name: 'Write',

70 tool_input: { file_path: 'src/x.ts', content: 'const k = "sk-abcdefghijklmnopqrstuvwxyz1234";' },

71 });

72 assert.strictEqual(r.status, 2);

73 assert.match(r.stderr, /secret-pattern/);

74});

76test('blocks Write containing ghp_ secret pattern', () => {

77 const r = runHook({

78 tool_name: 'Write',

79 tool_input: { file_path: 'src/x.ts', content: 'const k = "ghp_abcdefghijklmnopqrstuvwxyz1234567890";' },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

hooks/__tests__/pre-tool-block-destructive.test.jsView on unpkg · L79

Critical

Secret Pattern

GitHub personal access token in hooks/__tests__/pre-tool-block-destructive.test.js

hooks/__tests__/pre-tool-block-destructive.test.jsView on unpkg · L79

80 });

81 assert.strictEqual(r.status, 2);

82});

84test('blocks Write containing AKIA AWS key pattern', () => {

85 const r = runHook({

86 tool_name: 'Write',

87 tool_input: { file_path: 'src/x.ts', content: 'const k = "AKIAIOSFODNN7EXAMPLE";' },

Critical

Secret Pattern

AWS access key ID in hooks/__tests__/pre-tool-block-destructive.test.js

hooks/__tests__/pre-tool-block-destructive.test.jsView on unpkg · L87

88 });

89 assert.strictEqual(r.status, 2);

90});

92test('allows Write to normal source file', () => {

93 const r = runHook({

94 tool_name: 'Write',

95 tool_input: { file_path: 'src/auth/login.ts', content: 'export const x = 1;' },

96 });

97 assert.strictEqual(r.status, 0, `expected allow, got exit ${r.status}: ${r.stderr}`);

98});

100test('allows Bash with normal git command', () => {

101 const r = runHook({ tool_name: 'Bash', tool_input: { command: 'git status' } });

102 assert.strictEqual(r.status, 0);

103});

104

105test('allows Edit to normal source file', () => {

106 const r = runHook({

107 tool_name: 'Edit',

enterprise/research/research.test.jsView file

Lines 1-24javascript

1'use strict';

3const test = require('node:test');

4const assert = require('node:assert/strict');

5const { spawnSync } = require('node:child_process'

enterprise/preflight/check.jsView file

Lines 50-90javascript

50 }

51}

53function gitRemote() {

54 try {

55 return execSync('git remote get-url origin', { encoding: 'utf8', cwd: ROOT }).trim();

56 } catch {

enterprise/tests/collect.jsView file

Lines 29-69javascript

29const FORGE_DIR = path.join(ROOT, '.forge');

30const PRIOR_FILE = path.join(FORGE_DIR, 'prior-results.json');

31const CURRENT_FILE = path.join(FORGE_DIR, 'test-results.json'

Source & flagged code

6 flagged · loading source

hooks/__tests__/pre-tool-block-destructive.test.jsView file

79patternName = github_pat severity = critical line = 79 matchedText = tool_inp...' },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

hooks/__tests__/pre-tool-block-destructive.test.jsView on unpkg · L79

79patternName = github_pat severity = critical line = 79 matchedText = tool_inp...' },

Critical

Secret Pattern

GitHub personal access token in hooks/__tests__/pre-tool-block-destructive.test.js

hooks/__tests__/pre-tool-block-destructive.test.jsView on unpkg · L79

87patternName = aws_access_key severity = critical line = 87 matchedText = tool_inp...' },

Critical

Secret Pattern

AWS access key ID in hooks/__tests__/pre-tool-block-destructive.test.js

hooks/__tests__/pre-tool-block-destructive.test.jsView on unpkg · L87

enterprise/research/research.test.jsView file

4const assert = require('node:assert/strict'); L5: const { spawnSync } = require('node:child_process'); L6: const fs = require('node:fs');

High

Child Process

Package source references child process execution.

enterprise/research/research.test.jsView on unpkg · L4

enterprise/preflight/check.jsView file

70try { L71: execSync(`command -v ${cmd}`, { stdio: 'ignore', shell: true }); L72: return true;

High

Shell

Package source references shell execution.

enterprise/preflight/check.jsView on unpkg · L70

enterprise/tests/collect.jsView file

49try { L50: const out = execSync('npx jest --json --outputFile=.forge/jest-raw.json 2>/dev/null', { L51: encoding: 'utf8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

enterprise/tests/collect.jsView on unpkg · L49

Findings

3 Critical3 High2 Medium4 Low

CriticalCritical Secrethooks/__tests__/pre-tool-block-destructive.test.js

CriticalSecret Patternhooks/__tests__/pre-tool-block-destructive.test.js

HighChild Processenterprise/research/research.test.js

HighShellenterprise/preflight/check.js

HighRuntime Package Installenterprise/tests/collect.js

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License

Source & flagged code

6 flagged

hooks/__tests__/pre-tool-block-destructive.test.jsView file

Lines 59-107javascript

59 assert.strictEqual(r.status, 2);

60});

62test('blocks Bash with gh pr merge', () => {

63 const r = runHook({ tool_name: 'Bash', tool_input: { command: 'gh pr merge 123' } });

64 assert.strictEqual(r.status, 2);

65});

67test('blocks Write containing sk- secret pattern', () => {

68 const r = runHook({

69 tool_name: 'Write',

70 tool_input: { file_path: 'src/x.ts', content: 'const k = "sk-abcdefghijklmnopqrstuvwxyz1234";' },

71 });

72 assert.strictEqual(r.status, 2);

73 assert.match(r.stderr, /secret-pattern/);

74});

76test('blocks Write containing ghp_ secret pattern', () => {

77 const r = runHook({

78 tool_name: 'Write',

79 tool_input: { file_path: 'src/x.ts', content: 'const k = "ghp_abcdefghijklmnopqrstuvwxyz1234567890";' },

Critical

Critical Secret

Package contains a critical-looking secret pattern.

hooks/__tests__/pre-tool-block-destructive.test.jsView on unpkg · L79

Critical

Secret Pattern

GitHub personal access token in hooks/__tests__/pre-tool-block-destructive.test.js

hooks/__tests__/pre-tool-block-destructive.test.jsView on unpkg · L79

80 });

81 assert.strictEqual(r.status, 2);

82});

84test('blocks Write containing AKIA AWS key pattern', () => {

85 const r = runHook({

86 tool_name: 'Write',

87 tool_input: { file_path: 'src/x.ts', content: 'const k = "AKIAIOSFODNN7EXAMPLE";' },

Critical

Secret Pattern

AWS access key ID in hooks/__tests__/pre-tool-block-destructive.test.js

hooks/__tests__/pre-tool-block-destructive.test.jsView on unpkg · L87

88 });

89 assert.strictEqual(r.status, 2);

90});

92test('allows Write to normal source file', () => {

93 const r = runHook({

94 tool_name: 'Write',

95 tool_input: { file_path: 'src/auth/login.ts', content: 'export const x = 1;' },

96 });

97 assert.strictEqual(r.status, 0, `expected allow, got exit ${r.status}: ${r.stderr}`);

98});

100test('allows Bash with normal git command', () => {

101 const r = runHook({ tool_name: 'Bash', tool_input: { command: 'git status' } });

102 assert.strictEqual(r.status, 0);

103});

104

105test('allows Edit to normal source file', () => {

106 const r = runHook({

107 tool_name: 'Edit',

enterprise/research/research.test.jsView file

Lines 1-24javascript

1'use strict';

3const test = require('node:test');

4const assert = require('node:assert/strict');

5const { spawnSync } = require('node:child_process'

enterprise/preflight/check.jsView file

Lines 50-90javascript

50 }

51}

53function gitRemote() {

54 try {

55 return execSync('git remote get-url origin', { encoding: 'utf8', cwd: ROOT }).trim();

56 } catch {

enterprise/tests/collect.jsView file

Lines 29-69javascript

29const FORGE_DIR = path.join(ROOT, '.forge');

30const PRIOR_FILE = path.join(FORGE_DIR, 'prior-results.json');

31const CURRENT_FILE = path.join(FORGE_DIR, 'test-results.json'