registry / @neopress/ai-skills / 0.1.2

@neopress/ai-skills@0.1.2

Set up Neopress AI skills for your coding tools

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 25.1 KB of source, external domains: www.lazyweb.com

Source & flagged code

2 flagged

dist/bin/setup.mjsView file

Lines 349-396javascript

349 } catch (err) {

350 const message = err instanceof Error ? err.message : String(err);

351 results.push({ tool, success: false, error: message });

352 }

353 }

354 return results;

355}

356function resolveContentDir() {

357 const candidates = [

358 path9.resolve(__dirname, "..", "content"),

359 path9.resolve(__dirname, "..", "..", "content")

360 ];

361 for (const candidate of candidates) {

362 if (existsSync(candidate)) {

363 return candidate;

364 }

365 }

366 throw new Error("Unable to locate ai-skills content directory");

367}

368

369// src/cli-install.ts

370import { execSync } from "child_process";

371async function ensureCli() {

High

Child Process

Package source references child process execution.

dist/bin/setup.mjsView on unpkg · L369

372 const currentVersion = getInstalledVersion();

373 if (currentVersion) {

374 const latestVersion = getLatestVersion();

375 if (latestVersion && latestVersion !== currentVersion) {

376 try {

377 execSync("npm install -g @neopress/cli@latest", { stdio: "pipe" });

378 const newVersion = getInstalledVersion();

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/setup.mjsView on unpkg · L376

379 return { installed: true, version: newVersion, action: "updated" };

380 } catch {

381 return { installed: true, version: currentVersion, action: "already_installed" };

382 }

383 }

384 return { installed: true, version: currentVersion, action: "already_installed" };

385 }

386 try {

387 execSync("npm install -g @neopress/cli@latest", { stdio: "pipe" });

388 const version = getInstalledVersion();

389 return { installed: true, version, action: "installed" };

390 } catch {

391 return { installed: false, version: null, action: "skipped" };

392 }

393}

394function getInstalledVersion() {

395 try {

396 const output = execSync("neopress --version", { stdio: "pipe", encoding: "utf-8" });

Source & flagged code

2 flagged · loading source

dist/bin/setup.mjsView file

369// src/cli-install.ts L370: import { execSync } from "child_process"; L371: async function ensureCli() {

High

Child Process

Package source references child process execution.

dist/bin/setup.mjsView on unpkg · L369

376try { L377: execSync("npm install -g @neopress/cli@latest", { stdio: "pipe" }); L378: const newVersion = getInstalledVersion();

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/setup.mjsView on unpkg · L376

Findings

3 High2 Medium5 Low

HighChild Processdist/bin/setup.mjs

HighShell

HighRuntime Package Installdist/bin/setup.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/bin/setup.mjsView file

Lines 349-396javascript

349 } catch (err) {

350 const message = err instanceof Error ? err.message : String(err);

351 results.push({ tool, success: false, error: message });

352 }

353 }

354 return results;

355}

356function resolveContentDir() {

357 const candidates = [

358 path9.resolve(__dirname, "..", "content"),

359 path9.resolve(__dirname, "..", "..", "content")

360 ];

361 for (const candidate of candidates) {

362 if (existsSync(candidate)) {

363 return candidate;

364 }

365 }

366 throw new Error("Unable to locate ai-skills content directory");

367}

368

369// src/cli-install.ts

370import { execSync } from "child_process";

371async function ensureCli() {

High

Child Process

Package source references child process execution.

dist/bin/setup.mjsView on unpkg · L369

372 const currentVersion = getInstalledVersion();

373 if (currentVersion) {

374 const latestVersion = getLatestVersion();

375 if (latestVersion && latestVersion !== currentVersion) {

376 try {

377 execSync("npm install -g @neopress/cli@latest", { stdio: "pipe" });

378 const newVersion = getInstalledVersion();

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/setup.mjsView on unpkg · L376

379 return { installed: true, version: newVersion, action: "updated" };

380 } catch {

381 return { installed: true, version: currentVersion, action: "already_installed" };

382 }

383 }

384 return { installed: true, version: currentVersion, action: "already_installed" };

385 }

386 try {

387 execSync("npm install -g @neopress/cli@latest", { stdio: "pipe" });

388 const version = getInstalledVersion();

389 return { installed: true, version, action: "installed" };

390 } catch {

391 return { installed: false, version: null, action: "skipped" };

392 }

393}

394function getInstalledVersion() {

395 try {

396 const output = execSync("neopress --version", { stdio: "pipe", encoding: "utf-8" });