registry  /  @optima-chat/scout-cli  /  0.26.0

@optima-chat/scout-cli@0.26.0

AI-powered product research CLI - Amazon, TikTok Shop, Shein, Temu search and 1688 supplier sourcing with real sales data

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 46 file(s), 357 KB of source, external domains: custom.proxy, detail.1688.com, dev.optima.sh, github.com, sc-5.optima.onl, scout-api.optima.onl, scout-api.stage.optima.onl, scout.example.com, scout.yzsgo.com, shop123.1688.com, v16-webapp.tiktok.com, weixin.qq.com, www.douyin.com, www.tiktok.com

Source & flagged code

2 flagged · loading source
dist/commands/project.jsView file
4import { homedir } from 'os'; L5: import { execSync } from 'child_process'; L6: import { setProject, getContext, _resetCache } from '../utils/context.js';
High
Child Process

Package source references child process execution.

dist/commands/project.jsView on unpkg · L4
212const kbDir = join(homedir(), 'kb', 'product-research'); L213: const lintOutput = execSync(`npx kb-skills lint --dir "${kbDir}"`, { L214: encoding: 'utf-8',
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/project.jsView on unpkg · L212

Findings

3 High3 Medium4 Low
HighChild Processdist/commands/project.js
HighShell
HighRuntime Package Installdist/commands/project.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings