registry / @postman-cse/opencode-cse-tools / 1.10.0

@postman-cse/opencode-cse-tools@1.10.0

OpenCode plugin for Postman CSE Tools: injects the local cse MCP server in every directory, syncs the CSE skill set into the global OpenCode skills dir, and provisions the signed cse-toold daemon. Install globally and it just works, no per-project config.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 15 file(s), 183 KB of source, external domains: 127.0.0.1, api.linear.app, auth.openai.com, postman.my.salesforce.com

Source & flagged code

3 flagged

skills/cse-linear-jsp/scripts/linear-jsp.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2// cse-linear-jsp helper — Linear GraphQL CRUD + Salesforce sync for the Top-100 JSP motion.

3// Auth: LINEAR_API_KEY env, macOS keychain item 'cse-linear-api-key', then a safely parsed ~/.zshrc. SF via authed 'sf' CLI.

4// CI env overrides: JSP_MAP_FILE (map path). sf-sync flags: --account <name>, --dry-run, --frozen-map.

5// No deps; Node >= 18.

7import { execFileSync } from "node:child_process";

8import { readFileSync, readdirSync, writeFileSync, mkdirSync, existsSync, appendFileSync } from "node:fs";

9import { join, basename, dirname } from "node:path";

10import { homedir } from "node:os";

12const INITIATIVE_NAME = "Top 100 — Joint Success Plans (FY27)";

13const TEAM_KEY = "POS";

14const PREFIX = "JSP — ";

15const MAP_FILE = process.env.JSP_MAP_FILE || join(homedir(), ".cse-tools", "linear-sf-map.json");

16import { managedHeading, upsertSfBlock, stripSfBlock } from "./lib/managed-blocks.mjs";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

skills/cse-linear-jsp/scripts/linear-jsp.mjsView on unpkg · L2

18function die(msg) { console.error(msg); process.exit(1); }

20function zshrcApiKey() {

21 let body;

22 try {

index.jsView file

Lines 93-133javascript

93 } catch {

94 /* fall through and recopy */

95 }

97 for (const name of fs.readdirSync(bundled)) {

98 const src

agents/shared/skill-bootstrap.shView file

•path = agents/shared/sk[redacted] kind = build_helper sizeBytes = 2319 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agents/shared/skill-bootstrap.shView on unpkg

Source & flagged code

3 flagged · loading source

skills/cse-linear-jsp/scripts/linear-jsp.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code