registry  /  @pro-vi/designer  /  0.3.21

@pro-vi/designer@0.3.21

MCP + CLI for autonomous iteration of claude.ai/design — drives the design surface via agent-browser, downloads handoff bundles, and exposes a tasting harness for full-viewport variant comparison.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 31 file(s), 264 KB of source, external domains: 127.0.0.1, claude.ai, github.com

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/postinstall.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/postinstall.mjs
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/designer.mjsView file
4// dist/cli.js, falls back to tsx+source for dev/clone-and-run mode. L5: import { spawnSync } from 'node:child_process'; L6: import fs from 'node:fs';
High
Child Process

Package source references child process execution.

bin/designer.mjsView on unpkg · L4
dist/setup.jsView file
3import os from 'node:os'; L4: import { spawn } from 'node:child_process'; L5: import { createHash } from 'node:crypto'; ... L10: const SKILL_SRC = path.join(REPO_ROOT, 'skills', 'designer-loop', 'SKILL.md'); L11: const SKILL_DEST_DIR = path.join(os.homedir(), '.claude', 'skills', 'designer-loop'); L12: const SKILL_DEST = path.join(SKILL_DEST_DIR, 'SKILL.md'); L13: const CHROME_BIN = process.env.CHROME_BIN || defaultChromeBin(); L14: const DEFAULT_PORT = process.env.DESIGNER_CDP || '9222'; ... L24: try { L25: const res = await fetch(`http://127.0.0.1:${port}/json/version`, { signal: AbortSignal.timeout(1500) }); L26: return res.ok; ... L49: return 'unknown';
Low
Weak Crypto

Package source references weak cryptographic algorithms.

dist/setup.jsView on unpkg · L3
dist/cdp-ensure.jsView file
3import path from 'node:path'; L4: import { spawn } from 'node:child_process'; L5: import { defaultChromeBin, isChromeRunning, QUIT_CHROME_HINT } from "./cross-platform.js"; L6: import { isCdpEnabled } from "./cdp-env.js"; L7: const PORT = process.env.DESIGNER_CDP || '9222'; L8: const PROFILE = path.join(os.homedir(), '.chrome-designer-profile'); ... L11: try { L12: const res = await fetch(`http://127.0.0.1:${PORT}/json/version`, { signal: AbortSignal.timeout(1500) }); L13: return res.ok;
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/cdp-ensure.jsView on unpkg · L3
scripts/designer-chrome.shView file
•path = scripts/designer-chrome.sh kind = build_helper sizeBytes = 1672 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/designer-chrome.shView on unpkg

Findings

4 High5 Medium6 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/designer.mjs
HighShell
HighSame File Env Network Executiondist/cdp-ensure.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperscripts/designer-chrome.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowEval
LowWeak Cryptodist/setup.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings