registry / @playlist-tech/enterprise-skills / 1.5.14-enterprise.5

@playlist-tech/enterprise-skills@1.5.14-enterprise.5

An enterprise-customizable fork of Vercel Labs' skills CLI for internal skill registries.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 10 file(s), 454 KB of source, external domains: add-skill.vercel.sh, api.github.com, example.com, github.com, gitlab.com, raw.githubusercontent.com, schemas.agentskills.io, skills.sh

Source & flagged code

2 flagged

dist/_chunks/libs/simple-git.mjsView file

Lines 1-24javascript

1import { i as __toESM } from "../rolldown-runtime.mjs";

2import { n as require_src, t as require_dist } from "./@kwsites/file-exists.mjs";

3import { t as require_dist$1 } from "./@kwsites/promise-deferred.mjs";

4import { Buffer as Buffer$1 } from "node:buffer";

5import { spawn } from "child_process";

6import { normalize } from "node:path";

High

Child Process

Package source references child process execution.

dist/_chunks/libs/simple-git.mjsView on unpkg · L4

7import { EventEmitter } from "node:events";

8var import_dist = require_dist();

9var import_src = /* @__PURE__ */ __toESM(require_src(), 1);

10var import_dist$1 = require_dist$1();

11var __defProp = Object.defineProperty;

12var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

13var __getOwnPropNames = Object.getOwnPropertyNames;

14var __hasOwnProp = Object.prototype.hasOwnProperty;

15var __esm = (fn, res) => function __init() {

16 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

17};

18var __commonJS = (cb, mod) => function __require() {

19 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

20};

21var __export = (target, all) => {

22 for (var name in all) __defProp(target, name, {

23 get: all[name],

24 enumerable: true

dist/cli.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import { i as __toESM, n as __exportAll } from "./_chunks/rolldown-runtime.mjs";

3import { l as pD, u as require_picocolors } from "./_chunks/libs/@clack/core.mjs";

4import { a as Y, c as ve, i as Se, l as xe, n as M, o as

Source & flagged code

2 flagged · loading source

dist/_chunks/libs/simple-git.mjsView file

4import { Buffer as Buffer$1 } from "node:buffer"; L5: import { spawn } from "child_process"; L6: import { normalize } from "node:path";

High

Child Process

Package source references child process execution.

dist/_chunks/libs/simple-git.mjsView on unpkg · L4

dist/cli.mjsView file

17Cross-file remote execution chain: dist/cli.mjs spawns dist/_chunks/libs/simple-git.mjs; helper contains network access plus dynamic code execution. L17: import { promisify } from "util"; L18: import { execFile, execSync, spawn, spawnSync } from "child_process"; L19: import { access, cp, lstat, mkdir, mkdtemp, readFile, readdir, readlink, realpath, rm, stat, symlink, writeFile } from "fs/promises"; ... L22: import { createHash as createHash$1 } from "node:crypto"; L23: import { gunzipSync, inflateRawSync } from "node:zlib"; L24: var import_picocolors = /* @__PURE__ */ __toESM(require_picocolors(), 1); ... L41: } L42: if (!parsed.url.startsWith("http://") && !parsed.url.startsWith("https://")) return null; L43: try { ... L61: if (!res.ok) return "unknown"; L62: return (await res.json()).private === true ? "private" : "public"; L63: } catch {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.mjsView on unpkg · L17

Findings

3 High3 Medium5 Low

HighChild Processdist/_chunks/libs/simple-git.mjs

HighShell

HighCross File Remote Execution Contextdist/cli.mjs

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/_chunks/libs/simple-git.mjsView file

Lines 1-24javascript

1import { i as __toESM } from "../rolldown-runtime.mjs";

2import { n as require_src, t as require_dist } from "./@kwsites/file-exists.mjs";

3import { t as require_dist$1 } from "./@kwsites/promise-deferred.mjs";

4import { Buffer as Buffer$1 } from "node:buffer";

5import { spawn } from "child_process";

6import { normalize } from "node:path";

High

Child Process

Package source references child process execution.

dist/_chunks/libs/simple-git.mjsView on unpkg · L4

7import { EventEmitter } from "node:events";

8var import_dist = require_dist();

9var import_src = /* @__PURE__ */ __toESM(require_src(), 1);

10var import_dist$1 = require_dist$1();

11var __defProp = Object.defineProperty;

12var __getOwnPropDesc = Object.getOwnPropertyDescriptor;

13var __getOwnPropNames = Object.getOwnPropertyNames;

14var __hasOwnProp = Object.prototype.hasOwnProperty;

15var __esm = (fn, res) => function __init() {

16 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

17};

18var __commonJS = (cb, mod) => function __require() {

19 return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;

20};

21var __export = (target, all) => {

22 for (var name in all) __defProp(target, name, {

23 get: all[name],

24 enumerable: true

dist/cli.mjsView file

Lines 1-37javascript

1#!/usr/bin/env node

2import { i as __toESM, n as __exportAll } from "./_chunks/rolldown-runtime.mjs";

3import { l as pD, u as require_picocolors } from "./_chunks/libs/@clack/core.mjs";

4import { a as Y, c as ve, i as Se, l as xe, n as M, o as