registry / @mmnto/cli / 1.100.0

@mmnto/cli@1.100.0

Totem: local-first toolkit that keeps AI-agent work queryable, enforceable, and derivable as plain files in your codebase

Static Scan Results

scanned 21h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNativeBindingsNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 297 file(s), 3.97 MB of source, external domains: 127.0.0.1, cli.github.com, cursor.com, example.com, example.invalid, github.com, hooks.example.com, img.shields.io, ollama.com, ollama.internal, robust-api.com, wrong.example

Source & flagged code

7 flagged

dist/commands/doctor.test.jsView file

Lines 126-171javascript

126 expect(result.status).toBe('pass');

127 expect(result.message).toBe('No leaked keys detected');

128 });

129 it('returns fail when a real key pattern is found', async () => {

130 fs.writeFileSync(path.join(tmpDir, 'CLAUDE.md'), 'Use this key: sk-abcdefghijklmnopqrstuvwxyz1234567890');

131 const result = await checkSecretLeaks(tmpDir);

132 expect(result.status).toBe('fail');

133 expect(result.message).toContain('potential leaked key');

134 });

135 it('does NOT flag placeholder strings as leaks', async () => {

136 fs.writeFileSync(path.join(tmpDir, 'CLAUDE.md'), 'Set your key: sk-your-key-here-placeholder');

137 const result = await checkSecretLeaks(tmpDir);

138 expect(result.status).toBe('pass');

139 });

140 it('returns pass when no files to scan exist', async () => {

141 const result = await checkSecretLeaks(tmpDir);

142 expect(result.status).toBe('pass');

143 expect(result.message).toBe('No files to scan');

144 });

145 it('detects GitHub personal access tokens', async () => {

146 fs.writeFileSync(path.join(tmpDir, 'CLAUDE.md'), 'token: ghp_aBcDeFgHiJkLmNoPqRsTuVwXyZ012345678a');

Critical

Critical Secret

Package contains a critical-looking secret pattern.

dist/commands/doctor.test.jsView on unpkg · L146

Critical

Secret Pattern

GitHub personal access token in dist/commands/doctor.test.js

dist/commands/doctor.test.jsView on unpkg · L146

147 const result = await checkSecretLeaks(tmpDir);

148 expect(result.status).toBe('fail');

149 });

150 it('detects Google API keys', async () => {

151 fs.writeFileSync(path.join(tmpDir, 'CLAUDE.md'), 'key: AIzaSyA1234567890abcdefghijklmnopqrstuvw');

High

Secret Pattern

Google API key in dist/commands/doctor.test.js

dist/commands/doctor.test.jsView on unpkg · L151

152 const result = await checkSecretLeaks(tmpDir);

153 expect(result.status).toBe('fail');

154 });

155 it('scans lesson files in .totem/lessons/', async () => {

156 const lessonsDir = path.join(tmpDir, '.totem', 'lessons');

157 fs.mkdirSync(lessonsDir, { recursive: true });

158 fs.writeFileSync(path.join(lessonsDir, 'secret-lesson.md'), 'Do not use: sk-ant-abcdefghijklmnopqrstuvwxyz');

159 const result = await checkSecretLeaks(tmpDir);

160 expect(result.status).toBe('fail');

161 });

162});

163// ─── Embedding config check ─────────────────────────────

164describe('checkEmbeddingConfig', () => {

165 let tmpDir;

166 beforeEach(() => {

167 tmpDir = makeTmpDir();

168 });

169 afterEach(() => {

170 cleanTmpDir(tmpDir);

171 });

dist/commands/compile-templates.jsView file

Lines 286-326javascript

286Output: {"compilable": true, "severity": "warning", "pattern": "(^|\\\\s)\\\\$[a-zA-Z_]+", "message": "Quote shell variables to prevent word-splitting", "badExample": "echo $HOME", "goodExample"

dist/index.jsView file

Lines 1-30javascript

1#!/usr/bin/env node

2import { execSync } from 'node:child_process';

3import { createRequire } from 'node:module';

4import { Command } from 'commander';

5import { z } from

dist/commands/spine-cert-run-corpus.jsView file

Lines 31-71javascript

31const ResolvedPrDiffSchema = z.object({

32 pr: z.number().int().positive(),

33 diff: z.string(),

34 controlKind: z.enum(['corpus',

dist/commands/init.test.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @mmnto/cli@1.95.0 matchedIdentity = npm:QG1tbnRvL2NsaQ:1.95.0 similarity = 0.900 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/commands/init.test.jsView on unpkg

Source & flagged code

7 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code