registry / @postman-cse/opencode-cse-tools / 4.12.7

@postman-cse/opencode-cse-tools@4.12.7

OpenCode plugin for Postman CSE Tools: injects the local cse MCP server in every directory, syncs the CSE skill set into the global OpenCode skills dir, and provisions the signed cse-toold daemon. Install globally and it just works, no per-project config.

Static Scan Results

scanned 14h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 17 file(s), 193 KB of source, external domains: 127.0.0.1, api.linear.app, postman.my.salesforce.com

Source & flagged code

3 flagged

skills/cse-linear-jsp/scripts/linear-jsp.mjsView file

Lines 1-22javascript

1#!/usr/bin/env node

2// cse-linear-jsp helper — Linear GraphQL CRUD + Salesforce sync for the Top-100 JSP motion.

3// Auth: LINEAR_API_KEY env, macOS keychain item 'cse-linear-api-key', then a safely parsed ~/.zshrc. SF via authed 'sf' CLI.

4// CI env overrides: JSP_MAP_FILE (map path), SF_TARGET_ORG. sf-sync requires --target-org (or SF_TARGET_ORG).

5// No deps; Node >= 18.

7import { execFileSync } from "node:child_process";

8import { readFileSync, readdirSync, writeFileSync, mkdirSync, existsSync, appendFileSync } from "node:fs";

9import { join, basename, dirname } from "node:path";

10import { homedir } from "node:os";

12const INITIATIVE_NAME = "Top 100 — Joint Success Plans (FY27)";

13const TEAM_KEY = "POS";

14const PREFIX = "JSP — ";

15const MAP_FILE = process.env.JSP_MAP_FILE || join(homedir(), ".cse-tools", "linear-sf-map.json");

16import { managedHeading, upsertSfBlock } from "./lib/managed-blocks.mjs";

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

skills/cse-linear-jsp/scripts/linear-jsp.mjsView on unpkg · L2

18function die(msg) { console.error(msg); process.exit(1); }

20function zshrcApiKey() {

21 let body;

22 try {

index.jsView file

Lines 349-389javascript

349 return {

350 updated: false,

351 reason: "up to date",

352 local: localVersion,

353 remote,

354 }

355 }

356

357 installLatest(remote)

agents/shared/skill-bootstrap.shView file

•path = agents/shared/sk[redacted] kind = build_helper sizeBytes = 2339 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agents/shared/skill-bootstrap.shView on unpkg

Source & flagged code

3 flagged · loading source

skills/cse-linear-jsp/scripts/linear-jsp.mjsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code