registry / @optima-chat/dev-skills / 0.16.10

@optima-chat/dev-skills@0.16.10

⚠ Under review

Claude Code Skills for Optima development team - cross-environment collaboration tools

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 31 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 74 file(s), 525 KB of source, external domains: api.optima.chat, api.optima.onl, api.stage.optima.onl, auth.optima.chat, auth.optima.onl, auth.stage.optima.chat, auth.stage.optima.onl, auth.yzsgo.com, billing-api.stage.optima.chat, billing-api.yzsgo.com, codeup.aliyun.com, commerce.stage.optima.chat, commerce.yzsgo.com, docs.aws.amazon.com, flow.aliyun.com, github.com, gw.stage.optima.chat, gw.yzsgo.com, secrets-cn.optima.chat, skills.stage.optima.chat, skills.yzsgo.com, www.postgresql.org

Source & flagged code

23 flagged

package.jsonView file

Lines 5-45json

5 "main": "index.js",

6 "bin": {

7 "optima-dev-skills": "bin/cli.js",

8 "optima-account": "dist/bin/helpers/account.js",

9 "optima-entitlement": "dist/bin/helpers/entitlement.js",

10 "optima-generate-test-token": "dist/bin/helpers/generate-test-token.js",

11 "optima-grant-credits": "dist/bin/helpers/grant-credits.js",

12 "optima-grant-balance": "dist/bin/helpers/grant-credits.js",

13 "optima-grant-subscription": "dist/bin/helpers/grant-subscription.js",

14 "optima-logs": "dist/bin/helpers/logs.js",

15 "optima-plugin": "dist/bin/helpers/plugin.js",

16 "optima-discount": "dist/bin/helpers/discount.js",

17 "optima-product": "dist/bin/helpers/product.js",

18 "optima-query-db": "dist/bin/helpers/query-db.js",

19 "optima-show-env": "dist/bin/helpers/show-env.js",

20 "optima-verify-health": "dist/bin/helpers/verify-health.js",

21 "optima-cn-deploy": "dist/bin/helpers/cn-deploy.js",

22 "optima-gateway-admin": "dist/bin/helpers/gateway-admin.js"

23 },

24 "scripts": {

25 "postinstall": "node scripts/install.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L25

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L25

26 "build": "tsc",

27 "prepare": "npm run build",

28 "pretest": "npm run build",

29 "test": "node --test tests/*.test.js"

30 },

31 "keywords": [

32 "claude-code",

33 "skills",

34 "optima",

35 "devops",

36 "logs",

37 "aws",

38 "cloudwatch"

39 ],

40 "author": "Optima AI Team",

41 "license": "MIT",

42 "repository": {

43 "type": "git",

44 "url": "git+https://github.com/Optima-Chat/optima-dev-skills.git"

45 },

bin/helpers/query-db.tsView file

Lines 1-37typescript

1#!/usr/bin/env node

3import { execSync } from 'child_process';

4import { sanitizeExecError } from './safe-exec';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/helpers/query-db.tsView on unpkg · L2

5import

bin/helpers/cn-deploy.tsView file

Lines 14-54typescript

14 * aliyun API 偶发空返回,带重试守卫。

15 *

16 * 用法:

17 * optima-cn-deploy billing # main 全链(构建→迁移→SAE 发布)

bin/helpers/db-utils.tsView file

Lines 64-104typescript

64export function escapeSQL(value: string): string {

65 return value.replace(/'/g, "''").replace(/\\/

bin/helpers/logs.ts#virtual:normalized:round1View file

119function stripQuoted(q: string): string { L120: return q.replace(/"(?:[^"\\]|\\.)*"/g, ' ');\n}\n\n/**\n * 带分析语句(SQL)的 query 用 `|` 分隔检索与分析两段。SLS 明确规定此时\n * line/offset 失效、要用 SQL 自己的 LIMIT 翻页 —— 这种 query 不能按页累加。\n *\n * 只看有没有 `|`... L121: }

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

bin/helpers/logs.ts#virtual:normalized:round1View on unpkg · L119

•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 2

High

Semantic Analysis Limited

A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.

bin/helpers/logs.ts#virtual:normalized:round1View on unpkg

scripts/install.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3const fs = require('fs');

4const path = require('path');

5const os

dist/bin/helpers/logs.js#virtual:normalized:round1View file

117Trigger-reachable command-output exfiltration chain: manifest.bin -> dist/bin/helpers/logs.js L117: function stripQuoted(q) { L118: return q.replace(/"(?:[^"\\]|\\.)*"/g, ' ');\n}\n/**\n * 带分析语句(SQL)的 query 用 `|` 分隔检索与分析两段。SLS 明确规定此时\n * line/offset 失效、要用 SQL 自己的 LIMIT 翻页 —— 这种 query 不能按页累加。\n *\n * 只看有没有 `|` 会... L119: }

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/bin/helpers/logs.js#virtual:normalized:round1View on unpkg · L117

.claude/skills/yzsgo-e2e/bootstrap.pyView file

•path = .claude/skills/yzsgo-e2e/bootstrap.py kind = payload_in_excluded_dir sizeBytes = 2730 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

.claude/skills/yzsgo-e2e/bootstrap.pyView on unpkg

•path = .claude/skills/yzsgo-e2e/bootstrap.py kind = build_helper sizeBytes = 2730 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

.claude/skills/yzsgo-e2e/bootstrap.pyView on unpkg

bin/helpers/verify-health.tsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.8 matchedPath = bin/helpers/verify-health.ts matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

bin/helpers/verify-health.tsView on unpkg

dist/bin/helpers/discount/generate.jsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.8 matchedPath = [redacted].js matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/helpers/discount/generate.jsView on unpkg

dist/bin/helpers/generate-test-token.jsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.8 matchedPath = dist/bin/helpers/generate-test-token.js matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/helpers/generate-test-token.jsView on unpkg

dist/bin/helpers/verify-health.jsView file

•matchType = normalized_sha256 matchedPackage = @optima-chat/dev-skills@0.16.8 matchedPath = dist/bin/helpers/verify-health.js matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.16.8 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

dist/bin/helpers/verify-health.jsView on unpkg

dist/bin/helpers/db-utils.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @optima-chat/dev-skills@0.14.0 matchedIdentity = npm:QG9wdGltYS1jaGF0L2Rldi1za2lsbHM:0.14.0 similarity = 0.603 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/bin/helpers/db-utils.jsView on unpkg

dist/bin/helpers/query-db.jsView file

45patternName = generic_password severity = medium line = 45

Medium

Secret Pattern

Hardcoded password in dist/bin/helpers/query-db.js

dist/bin/helpers/query-db.jsView on unpkg · L45

50patternName = generic_password severity = medium line = 50

Medium

Secret Pattern

Hardcoded password in dist/bin/helpers/query-db.js

dist/bin/helpers/query-db.jsView on unpkg · L50

55patternName = generic_password severity = medium line = 55

Medium

Secret Pattern

Hardcoded password in dist/bin/helpers/query-db.js

dist/bin/helpers/query-db.jsView on unpkg · L55

Source & flagged code

23 flagged · loading source

@optima-chat/dev-skills@0.16.10

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code