registry / @powerkraut/devkit / 0.8.1

@powerkraut/devkit@0.8.1

Claude Code devkit plugin — agents, skills en guidelines voor AI-assisted development

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 29 file(s), 117 KB of source, external domains: api.bitbucket.org, bitbucket.org, gitlab.com, id.atlassian.com, registry.npmjs.org

Source & flagged code

4 flagged

dist/clients/gitlab/mr.jsView file

Lines 1-21javascript

1import { execSync } from 'node:child_process';

2import { die, gitUserName } from '../bitbucket/utils.js';

High

Child Process

Package source references child process execution.

dist/clients/gitlab/mr.jsView on unpkg · L1

3import { requireFlag, requirePositional } from '../bitbucket/args.js';

4function glabExec(glabArgs) {

5 try {

6 execSync(`glab ${glabArgs.map(a => `'${a.replace(/'/g, "'\\''")}'`).join(' ')}`, { stdio: 'inherit' });

7 }

8 catch {

9 process.exit(1);

10 }

11}

12function repoFullPath() {

13 try {

14 const remote = execSync('git remote get-url origin', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();

15 const match = remote.match(/[:/]([^/]+\/[^/]+?)(?:\.git)?$/);

16 if (match)

17 return match[1];

18 }

19 catch { /* fall through */ }

20 return die('could not determine GitLab project path from git remote');

21}

dist/build/runner.jsView file

Lines 1-30javascript

1import { spawnSync } from 'node:child_process';

2const PHASE_ORDER = ['format', 'lint', 'build', 'test'];

3// Defaults used when phase key is absent from config (undefined)

4// Empty array in config = explicitly skip

5const DEFAULTS = {

6 format: [],

dist/setup/validate.jsView file

Lines 115-155javascript

115 ? `comment #${commentId} · geplaatst als "${displayName}"`

116 : `HTTP ${res.status}`,

117 });

118 }

119 else {

120 emit({ name: 'PR comment toevoegen (als agent)', ok: false

dist/setup/setup.jsView file

Lines 31-71javascript

31 process.stdout.write('── Projects map ─────────────────────────\n');

32 const settings = readSettings();

33 const defaultRoot = settings.projectsRoot ?? join(homedir(), 'projects');

34 const

Source & flagged code

4 flagged · loading source

dist/clients/gitlab/mr.jsView file

1import { execSync } from 'node:child_process'; L2: import { die, gitUserName } from '../bitbucket/utils.js';

High

Child Process

Package source references child process execution.

dist/clients/gitlab/mr.jsView on unpkg · L1

dist/build/runner.jsView file

19process.stdout.write(` $ ${cmd}\n`); L20: const result = spawnSync(cmd, { shell: true, stdio: 'inherit' }); L21: if (result.status !== 0) {

High

Shell

Package source references shell execution.

dist/build/runner.jsView on unpkg · L19

dist/setup/validate.jsView file

135{ L136: const { existsSync, readFileSync } = await import('node:fs'); L137: const { join } = await import('node:path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/setup/validate.jsView on unpkg · L135

dist/setup/setup.jsView file

51process.stdout.write(' npm install -g @powerkraut/devkit ...\n'); L52: execSync('npm install -g @powerkraut/devkit', { stdio: 'inherit' }); L53: process.stdout.write('✅ Plugin geïnstalleerd\n');

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/setup/setup.jsView on unpkg · L51

Findings

3 High4 Medium5 Low

HighChild Processdist/clients/gitlab/mr.js

HighShelldist/build/runner.js

HighRuntime Package Installdist/setup/setup.js

MediumDynamic Requiredist/setup/validate.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

4 flagged

dist/clients/gitlab/mr.jsView file

Lines 1-21javascript

1import { execSync } from 'node:child_process';

2import { die, gitUserName } from '../bitbucket/utils.js';

High

Child Process

Package source references child process execution.

dist/clients/gitlab/mr.jsView on unpkg · L1

3import { requireFlag, requirePositional } from '../bitbucket/args.js';

4function glabExec(glabArgs) {

5 try {

6 execSync(`glab ${glabArgs.map(a => `'${a.replace(/'/g, "'\\''")}'`).join(' ')}`, { stdio: 'inherit' });

7 }

8 catch {

9 process.exit(1);

10 }

11}

12function repoFullPath() {

13 try {

14 const remote = execSync('git remote get-url origin', { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();

15 const match = remote.match(/[:/]([^/]+\/[^/]+?)(?:\.git)?$/);

16 if (match)

17 return match[1];

18 }

19 catch { /* fall through */ }

20 return die('could not determine GitLab project path from git remote');

21}

dist/build/runner.jsView file

Lines 1-30javascript

1import { spawnSync } from 'node:child_process';

2const PHASE_ORDER = ['format', 'lint', 'build', 'test'];

3// Defaults used when phase key is absent from config (undefined)

4// Empty array in config = explicitly skip

5const DEFAULTS = {

6 format: [],

dist/setup/validate.jsView file

Lines 115-155javascript

115 ? `comment #${commentId} · geplaatst als "${displayName}"`

116 : `HTTP ${res.status}`,

117 });

118 }

119 else {

120 emit({ name: 'PR comment toevoegen (als agent)', ok: false

dist/setup/setup.jsView file

Lines 31-71javascript

31 process.stdout.write('── Projects map ─────────────────────────\n');

32 const settings = readSettings();

33 const defaultRoot = settings.projectsRoot ?? join(homedir(), 'projects');

34 const