registry / @neopress/ai-skills / 0.1.5

@neopress/ai-skills@0.1.5

Set up Neopress AI skills for your coding tools

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 29.1 KB of source, external domains: www.lazyweb.com

Source & flagged code

2 flagged

dist/bin/setup.mjsView file

Lines 451-498javascript

451 } catch (err) {

452 const message = err instanceof Error ? err.message : String(err);

453 results.push({ tool, success: false, error: message });

454 }

455 }

456 return results;

457}

458function resolveContentDir() {

459 const candidates = [

460 path9.resolve(__dirname, "..", "content"),

461 path9.resolve(__dirname, "..", "..", "content")

462 ];

463 for (const candidate of candidates) {

464 if (existsSync(candidate)) {

465 return candidate;

466 }

467 }

468 throw new Error("Unable to locate ai-skills content directory");

469}

470

471// src/cli-install.ts

472import { execSync } from "child_process";

473async function ensureCli() {

High

Child Process

Package source references child process execution.

dist/bin/setup.mjsView on unpkg · L471

474 const currentVersion = getInstalledVersion();

475 if (currentVersion) {

476 const latestVersion = getLatestVersion();

477 if (latestVersion && latestVersion !== currentVersion) {

478 try {

479 execSync("npm install -g @neopress/cli@latest", { stdio: "pipe" });

480 const newVersion = getInstalledVersion();

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/setup.mjsView on unpkg · L478

481 return { installed: true, version: newVersion, action: "updated" };

482 } catch {

483 return { installed: true, version: currentVersion, action: "already_installed" };

484 }

485 }

486 return { installed: true, version: currentVersion, action: "already_installed" };

487 }

488 try {

489 execSync("npm install -g @neopress/cli@latest", { stdio: "pipe" });

490 const version = getInstalledVersion();

491 return { installed: true, version, action: "installed" };

492 } catch {

493 return { installed: false, version: null, action: "skipped" };

494 }

495}

496function getInstalledVersion() {

497 try {

498 const output = execSync("neopress --version", { stdio: "pipe", encoding: "utf-8" });

Source & flagged code

2 flagged · loading source

dist/bin/setup.mjsView file

471// src/cli-install.ts L472: import { execSync } from "child_process"; L473: async function ensureCli() {

High

Child Process

Package source references child process execution.

dist/bin/setup.mjsView on unpkg · L471

478try { L479: execSync("npm install -g @neopress/cli@latest", { stdio: "pipe" }); L480: const newVersion = getInstalledVersion();

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/setup.mjsView on unpkg · L478

Findings

3 High2 Medium5 Low

HighChild Processdist/bin/setup.mjs

HighShell

HighRuntime Package Installdist/bin/setup.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/bin/setup.mjsView file

Lines 451-498javascript

451 } catch (err) {

452 const message = err instanceof Error ? err.message : String(err);

453 results.push({ tool, success: false, error: message });

454 }

455 }

456 return results;

457}

458function resolveContentDir() {

459 const candidates = [

460 path9.resolve(__dirname, "..", "content"),

461 path9.resolve(__dirname, "..", "..", "content")

462 ];

463 for (const candidate of candidates) {

464 if (existsSync(candidate)) {

465 return candidate;

466 }

467 }

468 throw new Error("Unable to locate ai-skills content directory");

469}

470

471// src/cli-install.ts

472import { execSync } from "child_process";

473async function ensureCli() {

High

Child Process

Package source references child process execution.

dist/bin/setup.mjsView on unpkg · L471

474 const currentVersion = getInstalledVersion();

475 if (currentVersion) {

476 const latestVersion = getLatestVersion();

477 if (latestVersion && latestVersion !== currentVersion) {

478 try {

479 execSync("npm install -g @neopress/cli@latest", { stdio: "pipe" });

480 const newVersion = getInstalledVersion();

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/bin/setup.mjsView on unpkg · L478

481 return { installed: true, version: newVersion, action: "updated" };

482 } catch {

483 return { installed: true, version: currentVersion, action: "already_installed" };

484 }

485 }

486 return { installed: true, version: currentVersion, action: "already_installed" };

487 }

488 try {

489 execSync("npm install -g @neopress/cli@latest", { stdio: "pipe" });

490 const version = getInstalledVersion();

491 return { installed: true, version, action: "installed" };

492 } catch {

493 return { installed: false, version: null, action: "skipped" };

494 }

495}

496function getInstalledVersion() {

497 try {

498 const output = execSync("neopress --version", { stdio: "pipe", encoding: "utf-8" });