registry / @optima-chat/scout-cli / 0.22.0

@optima-chat/scout-cli@0.22.0

AI-powered product research CLI - Amazon, TikTok Shop, Shein, Temu search and 1688 supplier sourcing with real sales data

Static Scan Results

scanned 13d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 46 file(s), 309 KB of source, external domains: custom.proxy, detail.1688.com, dev.optima.sh, github.com, sc-5.optima.onl, scout-api.optima.onl, scout-api.stage.optima.onl, scout.example.com, scout.yzsgo.com, shop123.1688.com, v16-webapp.tiktok.com, weixin.qq.com, www.douyin.com, www.tiktok.com

Source & flagged code

2 flagged

dist/commands/project.jsView file

Lines 1-24javascript

1import { Command } from 'commander';

2import { existsSync, readdirSync, renameSync, mkdirSync } from 'fs';

3import { join } from 'path';

4import { homedir } from 'os';

5import { execSync } from 'child_process';

6import { setProject, getContext, _resetCache } from '../utils/context.js';

High

Child Process

Package source references child process execution.

dist/commands/project.jsView on unpkg · L4

7import { checkProjectPipeline, checkProjectRegistration, checkKbBasics } from '../utils/health-check.js';

8export const projectCommand = new Command('project')

9 .description('Manage scout projects and cache directories');

10projectCommand

11 .command('use <name>')

12 .description('Set the current project')

13 .action((name) => {

14 setProject(name);

15 const cacheDir = join(homedir(), '.scout', 'cache', name);

16 mkdirSync(cacheDir, { recursive: true });

17 console.log(`✅ 当前项目: ${name}`);

18 console.log(` 缓存目录: ~/.scout/cache/${name}/`);

19 // Check for quick sessions that could be migrated

20 const quickDir = join(homedir(), '.scout', 'cache', '_quick');

21 if (existsSync(quickDir)) {

22 const sessions = readdirSync(quickDir, { withFileTypes: true })

23 .filter((d) => d.isDirectory())

24 .map((d) => {

Lines 192-232javascript

192 for (const f of cacheFiles) {

193 allRawFiles.delete(f);

194 }

195 }

196 }

197 if (allRawFiles.size === 0) {

198 console.log(' ✅ 无孤立 raw 文件');

199 }

Source & flagged code

2 flagged · loading source

dist/commands/project.jsView file

4import { homedir } from 'os'; L5: import { execSync } from 'child_process'; L6: import { setProject, getContext, _resetCache } from '../utils/context.js';

High

Child Process

Package source references child process execution.

dist/commands/project.jsView on unpkg · L4

212const kbDir = join(homedir(), 'kb', 'product-research'); L213: const lintOutput = execSync(`npx kb-skills lint --dir "${kbDir}"`, { L214: encoding: 'utf-8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/project.jsView on unpkg · L212

Findings

3 High3 Medium4 Low

HighChild Processdist/commands/project.js

HighShell

HighRuntime Package Installdist/commands/project.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/commands/project.jsView file

Lines 1-24javascript

1import { Command } from 'commander';

2import { existsSync, readdirSync, renameSync, mkdirSync } from 'fs';

3import { join } from 'path';

4import { homedir } from 'os';

5import { execSync } from 'child_process';

6import { setProject, getContext, _resetCache } from '../utils/context.js';

High

Child Process

Package source references child process execution.

dist/commands/project.jsView on unpkg · L4

7import { checkProjectPipeline, checkProjectRegistration, checkKbBasics } from '../utils/health-check.js';

8export const projectCommand = new Command('project')

9 .description('Manage scout projects and cache directories');

10projectCommand

11 .command('use <name>')

12 .description('Set the current project')

13 .action((name) => {

14 setProject(name);

15 const cacheDir = join(homedir(), '.scout', 'cache', name);

16 mkdirSync(cacheDir, { recursive: true });

17 console.log(`✅ 当前项目: ${name}`);

18 console.log(` 缓存目录: ~/.scout/cache/${name}/`);

19 // Check for quick sessions that could be migrated

20 const quickDir = join(homedir(), '.scout', 'cache', '_quick');

21 if (existsSync(quickDir)) {

22 const sessions = readdirSync(quickDir, { withFileTypes: true })

23 .filter((d) => d.isDirectory())

24 .map((d) => {

Lines 192-232javascript

192 for (const f of cacheFiles) {

193 allRawFiles.delete(f);

194 }

195 }

196 }

197 if (allRawFiles.size === 0) {

198 console.log(' ✅ 无孤立 raw 文件');

199 }