registry  /  @mthanh/vespercli  /  1.3.2

@mthanh/vespercli@1.3.2

Vesper Agent Suite — CLI to manage AI agents, prompts, instructions, and skills for GitHub Copilot (VS Code) and Claude Code

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 50 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell
Supply chain
HighEntropyStringsMinifiedUrlStrings
ManifestNo manifest risk signals triggered.
scanned 51 file(s), 285 KB of source, external domains: 127.0.0.1, github.com, raw.githubusercontent.com

Source & flagged code

42 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/cli.min.jsView file
1var Ht=(e,t)=>()=>(e&&(t=e(e=0)),t);import{access as Xt,constants as Qt,stat as Qn}from"node:fs/promises";async function h(e){try{return await Xt(e,Qt.F_OK),!0}catch{return!1}}var ... L2: `)}async function ks(e){let t=ht(e),s=xs(),n=new RegExp(`${Ee}[\\s\\S]*?${Te}`);if(!await h(t))return await q(Pe(t),{recursive:!0}),await T(t,`${s}
High
Child Process

Package source references child process execution.

dist/cli.min.jsView on unpkg · L1
1var Ht=(e,t)=>()=>(e&&(t=e(e=0)),t);import{access as Xt,constants as Qt,stat as Qn}from"node:fs/promises";async function h(e){try{return await Xt(e,Qt.F_OK),!0}catch{return!1}}var ... L2: `)}async function ks(e){let t=ht(e),s=xs(),n=new RegExp(`${Ee}[\\s\\S]*?${Te}`);if(!await h(t))return await q(Pe(t),{recursive:!0}),await T(t,`${s} ... L5: ${a}`;return await T(t,o,"utf-8"),{created:!1,updated:!0}}function As(e){let t=new RegExp(`${Ee}[\\s\\S]*?${Te}\\n*`);return e.replace(t,"")}async function we(e){let t=mt(e);await ... L6: `),n=setInterval(o,80),o()},update(i){a=i},stop(){n&&(clearInterval(n),n=null,process.stdout.write("\r"+" ".repeat(a.length+4)+"\r"))},succeed(i){this.stop(),console.log(`${x.green... L7: `))p.trim()&&r.info(p.replace("[vesper-indexing] ",""))}),o.stdout.on("data",l=>{i+=l.toString()}),o.on("close",l=>{try{let d=JSON.parse(i.trim());d.success?n?n.succeed(`Workspace ...
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cli.min.jsView on unpkg · L1
scripts/postinstall.jsView file
30stdio: 'inherit', L31: shell: true, L32: });
High
Shell

Package source references shell execution.

scripts/postinstall.jsView on unpkg · L30
assets/claude/skills/chrome-devtools/scripts/evaluate.jsView file
31// eslint-disable-next-line no-eval L32: return eval(script); L33: }, args.script);
Low
Eval

Package source references a known benign dynamic code generation pattern.

assets/claude/skills/chrome-devtools/scripts/evaluate.jsView on unpkg · L31
assets/claude/skills/document-skills/xlsx/recalc.pyView file
•path = assets/claude/skills/document-skills/xlsx/recalc.py kind = build_helper sizeBytes = 6408 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/claude/skills/document-skills/xlsx/recalc.pyView on unpkg
assets/claude/skills/databases/scripts/tests/test_db_backup.pyView file
•path = [redacted]test_db_backup.py kind = payload_in_excluded_dir sizeBytes = 10800 magicHex = [redacted]
High
Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

assets/claude/skills/databases/scripts/tests/test_db_backup.pyView on unpkg
assets/claude/agents/nodejs-express-developer.mdView file
556patternName = generic_password severity = medium line = 556 matchedText = .send({ ... });
Medium
Secret Pattern

Hardcoded password in assets/claude/agents/nodejs-express-developer.md

assets/claude/agents/nodejs-express-developer.mdView on unpkg · L556
assets/claude/skills/backend-development/references/backend-testing.mdView file
60patternName = generic_password severity = medium line = 60 matchedText = const us...' };
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/backend-development/references/backend-testing.md

assets/claude/skills/backend-development/references/backend-testing.mdView on unpkg · L60
assets/claude/skills/better-auth/references/database-integration.mdView file
40patternName = generic_password severity = medium line = 40 matchedText = password...rd",
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/database-integration.md

assets/claude/skills/better-auth/references/database-integration.mdView on unpkg · L40
58patternName = generic_password severity = medium line = 58 matchedText = password...rd",
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/database-integration.md

assets/claude/skills/better-auth/references/database-integration.mdView on unpkg · L58
assets/claude/skills/better-auth/references/email-password-auth.mdView file
51patternName = generic_password severity = medium line = 51 matchedText = password...23",
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/email-password-auth.md

assets/claude/skills/better-auth/references/email-password-auth.mdView on unpkg · L51
71patternName = generic_password severity = medium line = 71 matchedText = password...23",
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/email-password-auth.md

assets/claude/skills/better-auth/references/email-password-auth.mdView on unpkg · L71
167patternName = generic_password severity = medium line = 167 matchedText = password...123"
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/email-password-auth.md

assets/claude/skills/better-auth/references/email-password-auth.mdView on unpkg · L167
218patternName = generic_password severity = medium line = 218 matchedText = password...23",
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/email-password-auth.md

assets/claude/skills/better-auth/references/email-password-auth.mdView on unpkg · L218
226patternName = generic_password severity = medium line = 226 matchedText = password...123"
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/email-password-auth.md

assets/claude/skills/better-auth/references/email-password-auth.mdView on unpkg · L226
232patternName = generic_password severity = medium line = 232 matchedText = password...123"
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/email-password-auth.md

assets/claude/skills/better-auth/references/email-password-auth.mdView on unpkg · L232
400patternName = generic_password severity = medium line = 400 matchedText = password...rity
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/email-password-auth.md

assets/claude/skills/better-auth/references/email-password-auth.mdView on unpkg · L400
assets/claude/skills/better-auth/references/advanced-features.mdView file
47patternName = generic_password severity = medium line = 47 matchedText = password...tity
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/advanced-features.md

assets/claude/skills/better-auth/references/advanced-features.mdView on unpkg · L47
68patternName = generic_password severity = medium line = 68 matchedText = password...ord"
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/advanced-features.md

assets/claude/skills/better-auth/references/advanced-features.mdView on unpkg · L68
77patternName = generic_password severity = medium line = 77 matchedText = password...ord"
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/advanced-features.md

assets/claude/skills/better-auth/references/advanced-features.mdView on unpkg · L77
441patternName = generic_password severity = medium line = 441 matchedText = password...23",
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/advanced-features.md

assets/claude/skills/better-auth/references/advanced-features.mdView on unpkg · L441
516patternName = generic_password severity = medium line = 516 matchedText = password...123"
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/references/advanced-features.md

assets/claude/skills/better-auth/references/advanced-features.mdView on unpkg · L516
assets/claude/skills/better-auth/SKILL.mdView file
100patternName = generic_password severity = medium line = 100 matchedText = password...23",
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/SKILL.md

assets/claude/skills/better-auth/SKILL.mdView on unpkg · L100
107patternName = generic_password severity = medium line = 107 matchedText = password...123"
Medium
Secret Pattern

Hardcoded password in assets/claude/skills/better-auth/SKILL.md

assets/claude/skills/better-auth/SKILL.mdView on unpkg · L107
assets/agents/nodejs-express-developer/nodejs-express-developer.agent.mdView file
570patternName = generic_password severity = medium line = 570 matchedText = .send({ ... });
Medium
Secret Pattern

Hardcoded password in assets/agents/nodejs-express-developer/nodejs-express-developer.agent.md

assets/agents/nodejs-express-developer/nodejs-express-developer.agent.mdView on unpkg · L570
assets/skills/backend-development/references/backend-testing.mdView file
60patternName = generic_password severity = medium line = 60 matchedText = const us...' };
Medium
Secret Pattern

Hardcoded password in assets/skills/backend-development/references/backend-testing.md

assets/skills/backend-development/references/backend-testing.mdView on unpkg · L60
assets/skills/better-auth/references/database-integration.mdView file
40patternName = generic_password severity = medium line = 40 matchedText = password...rd",
Medium
Secret Pattern

Hardcoded password in assets/skills/better-auth/references/database-integration.md

assets/skills/better-auth/references/database-integration.mdView on unpkg · L40
58patternName = generic_password severity = medium line = 58 matchedText = password...rd",
Medium
Secret Pattern

Hardcoded password in assets/skills/better-auth/references/database-integration.md

assets/skills/better-auth/references/database-integration.mdView on unpkg · L58
assets/skills/better-auth/references/email-password-auth.mdView file
51patternName = generic_password severity = medium line = 51 matchedText = password...23",
Medium
Secret Pattern

Hardcoded password in assets/skills/better-auth/references/email-password-auth.md

assets/skills/better-auth/references/email-password-auth.mdView on unpkg · L51
71patternName = generic_password severity = medium line = 71 matchedText = password...23",
Medium
Secret Pattern

Hardcoded password in assets/skills/better-auth/references/email-password-auth.md

assets/skills/better-auth/references/email-password-auth.mdView on unpkg · L71
167patternName = generic_password severity = medium line = 167 matchedText = password...123"
Medium
Secret Pattern

Hardcoded password in assets/skills/better-auth/references/email-password-auth.md

assets/skills/better-auth/references/email-password-auth.mdView on unpkg · L167
218patternName = generic_password severity = medium line = 218 matchedText = password...23",
Medium
Secret Pattern

Hardcoded password in assets/skills/better-auth/references/email-password-auth.md

assets/skills/better-auth/references/email-password-auth.mdView on unpkg · L218
226patternName = generic_password severity = medium line = 226 matchedText = password...123"
Medium
Secret Pattern

Hardcoded password in assets/skills/better-auth/references/email-password-auth.md

assets/skills/better-auth/references/email-password-auth.mdView on unpkg · L226
232patternName = generic_password severity = medium line = 232 matchedText = password...123"
Medium
Secret Pattern

Hardcoded password in assets/skills/better-auth/references/email-password-auth.md

assets/skills/better-auth/references/email-password-auth.mdView on unpkg · L232
400patternName = generic_password severity = medium line = 400 matchedText = password...rity
Medium
Secret Pattern

Hardcoded password in assets/skills/better-auth/references/email-password-auth.md

assets/skills/better-auth/references/email-password-auth.mdView on unpkg · L400
assets/skills/better-auth/references/advanced-features.mdView file
47patternName = generic_password severity = medium line = 47 matchedText = password...tity
Medium
Secret Pattern

Hardcoded password in assets/skills/better-auth/references/advanced-features.md

assets/skills/better-auth/references/advanced-features.mdView on unpkg · L47
68patternName = generic_password severity = medium line = 68 matchedText = password...ord"
Medium
Secret Pattern

Hardcoded password in assets/skills/better-auth/references/advanced-features.md

assets/skills/better-auth/references/advanced-features.mdView on unpkg · L68
77patternName = generic_password severity = medium line = 77 matchedText = password...ord"
Medium
Secret Pattern

Hardcoded password in assets/skills/better-auth/references/advanced-features.md

assets/skills/better-auth/references/advanced-features.mdView on unpkg · L77
441patternName = generic_password severity = medium line = 441 matchedText = password...23",
Medium
Secret Pattern

Hardcoded password in assets/skills/better-auth/references/advanced-features.md

assets/skills/better-auth/references/advanced-features.mdView on unpkg · L441
516patternName = generic_password severity = medium line = 516 matchedText = password...123"
Medium
Secret Pattern

Hardcoded password in assets/skills/better-auth/references/advanced-features.md

assets/skills/better-auth/references/advanced-features.mdView on unpkg · L516

Findings

5 High39 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processdist/cli.min.js
HighShellscripts/postinstall.js
HighSame File Env Network Executiondist/cli.min.js
HighPayload In Excluded Dirassets/claude/skills/databases/scripts/tests/test_db_backup.py
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperassets/claude/skills/document-skills/xlsx/recalc.py
MediumStructural Risk Force Deep Review
MediumSecret Patternassets/claude/agents/nodejs-express-developer.md
MediumSecret Patternassets/claude/skills/backend-development/references/backend-testing.md
MediumSecret Patternassets/claude/skills/better-auth/references/database-integration.md
MediumSecret Patternassets/claude/skills/better-auth/references/database-integration.md
MediumSecret Patternassets/claude/skills/better-auth/references/email-password-auth.md
MediumSecret Patternassets/claude/skills/better-auth/references/email-password-auth.md
MediumSecret Patternassets/claude/skills/better-auth/references/email-password-auth.md
MediumSecret Patternassets/claude/skills/better-auth/references/email-password-auth.md
MediumSecret Patternassets/claude/skills/better-auth/references/email-password-auth.md
MediumSecret Patternassets/claude/skills/better-auth/references/email-password-auth.md
MediumSecret Patternassets/claude/skills/better-auth/references/email-password-auth.md
MediumSecret Patternassets/claude/skills/better-auth/references/advanced-features.md
MediumSecret Patternassets/claude/skills/better-auth/references/advanced-features.md
MediumSecret Patternassets/claude/skills/better-auth/references/advanced-features.md
MediumSecret Patternassets/claude/skills/better-auth/references/advanced-features.md
MediumSecret Patternassets/claude/skills/better-auth/references/advanced-features.md
MediumSecret Patternassets/claude/skills/better-auth/SKILL.md
MediumSecret Patternassets/claude/skills/better-auth/SKILL.md
MediumSecret Patternassets/agents/nodejs-express-developer/nodejs-express-developer.agent.md
MediumSecret Patternassets/skills/backend-development/references/backend-testing.md
MediumSecret Patternassets/skills/better-auth/references/database-integration.md
MediumSecret Patternassets/skills/better-auth/references/database-integration.md
MediumSecret Patternassets/skills/better-auth/references/email-password-auth.md
MediumSecret Patternassets/skills/better-auth/references/email-password-auth.md
MediumSecret Patternassets/skills/better-auth/references/email-password-auth.md
MediumSecret Patternassets/skills/better-auth/references/email-password-auth.md
MediumSecret Patternassets/skills/better-auth/references/email-password-auth.md
MediumSecret Patternassets/skills/better-auth/references/email-password-auth.md
MediumSecret Patternassets/skills/better-auth/references/email-password-auth.md
MediumSecret Patternassets/skills/better-auth/references/advanced-features.md
MediumSecret Patternassets/skills/better-auth/references/advanced-features.md
MediumSecret Patternassets/skills/better-auth/references/advanced-features.md
MediumSecret Patternassets/skills/better-auth/references/advanced-features.md
MediumSecret Patternassets/skills/better-auth/references/advanced-features.md
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvalassets/claude/skills/chrome-devtools/scripts/evaluate.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings