registry / @monoes/monodesign / 1.2.0

@monoes/monodesign@1.2.0

Frontend design intelligence for AI agents — design tokens, antipattern detection, and the monodesign skill

Static Scan Results

scanned 16h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 78 file(s), 1.80 MB of source, external domains: 127.0.0.1, developers.openai.com, example.com, github.com, www.w3.org

Source & flagged code

5 flagged

skill/scripts/context-signals.mjsView file

Lines 2-42javascript

2/**

3 * Context-signals gatherer for the bare Monodesign invocation

4 * (no-argument) path. Collects cheap, deterministic signals about the current

5 * project and emits them as JSON.

6 *

7 * It does NOT score or rank. The agent reasons over the raw signals using its

8 * knowledge of the command catalog (see SKILL.md routing rule 1). Deliberately

9 * light: no LLM calls, no detector run (`monomind design detect` is heavier and

10 * opt-in), no file writes. Every probe is best-effort and never throws; the

11 * output is always valid JSON.

12 *

13 * Signals:

14 * - setup: PRODUCT.md / DESIGN.md presence, register, whether code exists

15 * - critique: the latest cached critique score (.monodesign/critique)

16 * - git: branch + files changed vs the default branch (a scope hint)

17 * - devServer: whether a local dev server answers on a common port (gates live)

18 */

19import fs from 'node:fs';

20import net from 'node:net';

21import path from 'node:path';

22import { fileURLToPath } from 'node:url';

23import { execFileSync } from 'node:child_process';

24import { loadContext, extractRegister, extractPlatform } from './context.mjs';

High

Child Process

Package source references child process execution.

skill/scripts/context-signals.mjsView on unpkg · L22

25import { getCritiqueDir } from './lib/monodesign-paths.mjs';

26import { readTrend, extractIssueLines, trendDirection } from './critique-storage.mjs';

28/** Is there code here at all, or just context files / an empty repo? */

29function hasCode(cwd) {

30 if (fs.existsSync(path.join(cwd, 'package.json'))) return true;

31 for (const d of ['src', 'app', 'pages', 'site', 'public', 'components', 'lib']) {

32 if (fs.existsSync(path.join(cwd, d))) return true;

33 }

34 return false;

35}

37/**

38 * The most recent critique snapshot across all targets. Filenames are

39 * timestamp-prefixed (`<iso>__<slug>.md`), so a lexical sort is chronological.

40 * Parses the small frontmatter for score + P0/P1 counts, plus two "design

41 * health" extras: the score trend for the same slug (last 3 runs, with a

42 * direction) and the open [P0] issue titles from the snapshot body — enough

skill/scripts/live-copy-edit-agent.mjsView file

Lines 235-275javascript

235 continue;

236 }

237 if (ch === '\\') {

238 escaped = true;

239 continue;

skill/scripts/hook-lib.mjsView file

Lines 1344-1384javascript

1344 try {

1345 let expanded;

1346 if (target.startsWith('~/')) {

1347 expanded = path.join(process.env.HOME || process.env.USERPROFILE

skill/scripts/live/svelte-component.mjsView file

Lines 1-40javascript

1/**

2 * Svelte live-mode component injection helpers.

3 *

4 * Variants are real .svelte components under node_modules/.monodesign-live/<session-id>/.

5 * The browser mounts them via Svelte 5 mount(); accept inlines the chosen

6 * variant back into the route source with props mapped to original bindings.

7 */

9import fs from 'node:fs';

skill/scripts/live-server.mjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2/**

3 * Live variant mode server (self-contained, zero dependencies).

4 *

5 * Serves the browser script (/live.js), the detection overlay (/detect.js),

6 * uses Server-Sent Events (SSE) for server→browser push, and HTTP POST for

7 * browser→server events. Agent communicates via HTTP long-poll (/poll).

8 *

9 * Usage:

10 * node <scripts_path>/live-server.mjs # start

Source & flagged code

5 flagged · loading source

skill/scripts/context-signals.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code