registry  /  @postman-cse/opencode-cse-tools  /  1.0.6

@postman-cse/opencode-cse-tools@1.0.6

Superseded by @postman-cse/opencode-cse-tools@1.0.7; cached installs may still resolve this version.

OpenCode plugin for Postman CSE Tools: injects the local cse MCP server in every directory, syncs the CSE skill set into the global OpenCode skills dir, and provisions the signed cse-toold daemon. Install globally and it just works, no per-project config.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 15 file(s), 171 KB of source, external domains: 127.0.0.1, api.linear.app, auth.openai.com, postman.my.salesforce.com

Source & flagged code

3 flagged · loading source
skills/cse-linear-jsp/scripts/linear-jsp.mjsView file
2// cse-linear-jsp helper — Linear GraphQL CRUD + Salesforce sync for the Top-100 JSP motion. L3: // Auth: LINEAR_API_KEY env, macOS keychain item 'cse-linear-api-key', then a safely parsed ~/.zshrc. SF via authed 'sf' CLI. L4: // CI env overrides: JSP_MAP_FILE (map path). sf-sync flags: --account <name>, --dry-run, --frozen-map. ... L6: L7: import { execFileSync } from "node:child_process"; L8: import { readFileSync, readdirSync, writeFileSync, mkdirSync, existsSync, appendFileSync } from "node:fs"; ... L14: const PREFIX = "JSP — "; L15: const MAP_FILE = process.env.JSP_MAP_FILE || join(homedir(), ".cse-tools", "linear-sf-map.json"); L16: import { managedHeading, upsertSfBlock, stripSfBlock } from "./lib/managed-blocks.mjs"; ... L67: try { L68: r = await fetch("https://api.linear.app/graphql", { L69: method: "POST",
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

skills/cse-linear-jsp/scripts/linear-jsp.mjsView on unpkg · L2
index.jsView file
113package = @postman-cse/opencode-cse-tools; repositoryIdentity = cse-tools; dependency = @postman-cse/cse-toold L113: try { L114: const { resolveCoreBinary } = require("@postman-cse/cse-toold") L115: return resolveCoreBinary()
High
Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

index.jsView on unpkg · L113
agents/shared/skill-bootstrap.shView file
•path = agents/shared/sk[redacted] kind = build_helper sizeBytes = 2319 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agents/shared/skill-bootstrap.shView on unpkg

Findings

1 High5 Medium6 Low
HighCopied Package Dependency Bridgeindex.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistenceskills/cse-linear-jsp/scripts/linear-jsp.mjs
MediumShips Build Helperagents/shared/skill-bootstrap.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License