registry / @pilotspace/add / 1.16.1

@pilotspace/add@1.16.1

ADD (AI-Driven Development). One skill. Eight steps. Five disciplines. Every feature ships through the loop — a minimal, state-tracked Claude Code skill that ships the AIDD book as its trust layer.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsFilesystem

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 94.0 KB of source

Source & flagged code

6 flagged

personas-teacher/security/security-senior-secops.mdView file

Lines 26-67markdown

26When code is provided — in any language, in any context — you immediately scan it for the following categories of risk. If no code is provided, you state the scan was skipped and why.

28### What you scan for

30#### Category 1 — Hardcoded Secrets (CRITICAL)

31Patterns that indicate a secret value is embedded directly in source code:

33```

34# Passwords / secrets / keys in assignments

35password = "..." db_password = "..." secret = "..."

36API_KEY = "..." PRIVATE_KEY = "..." token = "..."

37JWT_SECRET = "..." CLIENT_SECRET = "..." access_key = "..."

39# Connection strings with credentials embedded

40mongodb://user:password@host

41postgresql://user:password@host

42mysql://user:password@host

43redis://:password@host

45# Private key material

46-----BEGIN RSA PRIVATE KEY-----

Critical

Secret Pattern

RSA private key in personas-teacher/security/security-senior-secops.md

personas-teacher/security/security-senior-secops.mdView on unpkg · L46

47-----BEGIN EC PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

personas-teacher/security/security-senior-secops.mdView on unpkg · L47

Critical

Secret Pattern

EC private key in personas-teacher/security/security-senior-secops.md

personas-teacher/security/security-senior-secops.mdView on unpkg · L47

48-----BEGIN PGP PRIVATE KEY-----

50# Cloud provider credentials

51AKIA[0-9A-Z]{16} # AWS Access Key ID pattern

52AIza[0-9A-Za-z_-]{35} # Google API Key pattern

53```

55#### Category 2 — Insecure Fallbacks (CRITICAL)

56The application should fail if secrets are absent — never fall back to a weak default:

58```javascript

59// CRITICAL — insecure fallbacks

60const secret = process.env.JWT_SECRET || "secret";

61const key = process.env.API_KEY || "changeme";

62const pass = process.env.DB_PASS || "admin";

63```

65```python

66# CRITICAL — insecure fallbacks

67secret = os.getenv("JWT_SECRET", "secret")

bin/cli.jsView file

Lines 1-50javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * @pilotspace/add installer.

6 *

7 * npx @pilotspace/add init [targetDir] [--force] [--stage <stage>] [--name <name>] [--yes|--non-interactive]

8 *

9 * Installs the ADD skill + tooling + book into a target project:

10 * <target>/.claude/skills/add/ (the skill Claude loads)

11 * <target>/.add/tooling/ (add.py scaffolder + state tracker)

12 * <target>/.add/docs/ (the AIDD book — the trust layer)

tooling/add.pyView file

•path = tooling/add.py kind = build_helper sizeBytes = 405616 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tooling/add.pyView on unpkg

Source & flagged code

6 flagged · loading source

personas-teacher/security/security-senior-secops.mdView file

47patternName = private_key_ec severity = critical line = 47 matchedText = -----BEG...----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

personas-teacher/security/security-senior-secops.mdView on unpkg · L47

46patternName = private_key_rsa severity = critical line = 46 matchedText = -----BEG...----

Critical

Secret Pattern

RSA private key in personas-teacher/security/security-senior-secops.md

personas-teacher/security/security-senior-secops.mdView on unpkg · L46

47patternName = private_key_ec severity = critical line = 47 matchedText = -----BEG...----

Critical

Secret Pattern

EC private key in personas-teacher/security/security-senior-secops.md

personas-teacher/security/security-senior-secops.mdView on unpkg · L47

bin/cli.jsView file

18* One lazy, optional dependency (@clack/prompts) powers the interactive flow on a real L19: * terminal; it is dynamic-import()ed ONLY on that path, so a non-interactive / CI run L20: * (and the `--yes` / `--non-interactive` path) never loads it and degrades to plain text

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/cli.jsView on unpkg · L18

30L31: const PKG_ROOT = path.resolve(__dirname, ".."); L32: L33: function log(msg) { process.stdout.write(msg + "\n"); } L34: function warn(msg) { process.stderr.write("warn: " + msg + "\n"); } ... L161: try { L162: const dirs = (process.env.PATH || "").split(path.delimiter).filter(Boolean); L163: const exts = process.platform === "win32" L164: ? (process.env.PATHEXT || ".EXE;.CMD;.BAT").split(";") ... L478: if (!process.stdin.isTTY) return { cancelled: true, target: target }; L479: const chosen = await clack.text({ L480: message: "Install ADD into which directory?",

Low

Weak Crypto

Package source references weak cryptographic algorithms.

bin/cli.jsView on unpkg · L30

tooling/add.pyView file

•path = tooling/add.py kind = build_helper sizeBytes = 405616 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tooling/add.pyView on unpkg

Findings

3 Critical4 Medium5 Low

CriticalCritical Secretpersonas-teacher/security/security-senior-secops.md

CriticalSecret Patternpersonas-teacher/security/security-senior-secops.md

MediumDynamic Requirebin/cli.js

MediumEnvironment Vars

MediumShips Build Helpertooling/add.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptobin/cli.js

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

6 flagged

personas-teacher/security/security-senior-secops.mdView file

Lines 26-67markdown

26When code is provided — in any language, in any context — you immediately scan it for the following categories of risk. If no code is provided, you state the scan was skipped and why.

28### What you scan for

30#### Category 1 — Hardcoded Secrets (CRITICAL)

31Patterns that indicate a secret value is embedded directly in source code:

33```

34# Passwords / secrets / keys in assignments

35password = "..." db_password = "..." secret = "..."

36API_KEY = "..." PRIVATE_KEY = "..." token = "..."

37JWT_SECRET = "..." CLIENT_SECRET = "..." access_key = "..."

39# Connection strings with credentials embedded

40mongodb://user:password@host

41postgresql://user:password@host

42mysql://user:password@host

43redis://:password@host

45# Private key material

46-----BEGIN RSA PRIVATE KEY-----

Critical

Secret Pattern

RSA private key in personas-teacher/security/security-senior-secops.md

personas-teacher/security/security-senior-secops.mdView on unpkg · L46

47-----BEGIN EC PRIVATE KEY-----

Critical

Critical Secret

Package contains a critical-looking secret pattern.

personas-teacher/security/security-senior-secops.mdView on unpkg · L47

Critical

Secret Pattern

EC private key in personas-teacher/security/security-senior-secops.md

personas-teacher/security/security-senior-secops.mdView on unpkg · L47

48-----BEGIN PGP PRIVATE KEY-----

50# Cloud provider credentials

51AKIA[0-9A-Z]{16} # AWS Access Key ID pattern

52AIza[0-9A-Za-z_-]{35} # Google API Key pattern

53```

55#### Category 2 — Insecure Fallbacks (CRITICAL)

56The application should fail if secrets are absent — never fall back to a weak default:

58```javascript

59// CRITICAL — insecure fallbacks

60const secret = process.env.JWT_SECRET || "secret";

61const key = process.env.API_KEY || "changeme";

62const pass = process.env.DB_PASS || "admin";

63```

65```python

66# CRITICAL — insecure fallbacks

67secret = os.getenv("JWT_SECRET", "secret")

bin/cli.jsView file

Lines 1-50javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * @pilotspace/add installer.

6 *

7 * npx @pilotspace/add init [targetDir] [--force] [--stage <stage>] [--name <name>] [--yes|--non-interactive]

8 *

9 * Installs the ADD skill + tooling + book into a target project:

10 * <target>/.claude/skills/add/ (the skill Claude loads)

11 * <target>/.add/tooling/ (add.py scaffolder + state tracker)

12 * <target>/.add/docs/ (the AIDD book — the trust layer)

tooling/add.pyView file

•path = tooling/add.py kind = build_helper sizeBytes = 405616 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tooling/add.pyView on unpkg