registry / @sanity/ailf / 7.27.0

@sanity/ailf@7.27.0

AI Literacy Framework - Evaluation tool for Sanity documentation

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 604 file(s), 3.30 MB of source, external domains: admin.sanity.io, ailf-api.sanity.build, api.anthropic.com, api.github.com, api.openai.com, docs.example.com, drive.google.com, duckduckgo.com, github.com, hooks.slack.com, json-schema.org, llmstxt.org, mcp.sanity.io, r.jina.ai, raw.githubusercontent.com, sanity-io.slack.com, sanity.io, slack.com, www.googleapis.com, www.promptfoo.dev, www.sanity.io, your-mcp-server.example.com

Source & flagged code

6 flagged

bin/ailf.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * ailf — CLI launcher for the AI Literacy Framework.

5 *

6 * Runs in two modes:

7 * 1. **Development** (monorepo) — delegates to TypeScript source via tsx.

8 * Detected by the presence of src/cli.ts.

9 * 2. **Production** (npm install) — imports the compiled dist/cli.js directly.

10 * This is the path when installed via `npx @sanity/ailf-eval` or

11 * `pnpm add @sanity/ailf-eval`.

12 */

14import { existsSync } from "fs"

15import { execFileSync } from "child_process"

16import { dirname, resolve } from "path"

High

Child Process

Package source references child process execution.

bin/ailf.jsView on unpkg · L14

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/ailf.jsView on unpkg · L9

17import { fileURLToPath } from "url"

19const __dirname = dirname(fileURLToPath(import.meta.url))

20const ROOT = resolve(__dirname, "..")

21const tsSrc = resolve(ROOT, "src", "cli.ts")

22const jsDist = resolve(ROOT, "dist", "cli.js")

24// Forward all arguments after the script name

25const args = process.argv.slice(2)

27// Preserve the caller's working directory so commands like `ailf init`

28// operate on the user's cwd, not the eval package root.

29const callerCwd = process.cwd()

31// Test harnesses (and any caller that knows the dist is fresh) can opt out

32// of the tsx dev path with AILF_PREFER_DIST=1. This avoids the npx + tsx

33// cold-start cost (~1–2s per invocation) on every `spawnCli(...)` call.

34const preferDist = process.env.AILF_PREFER_DIST === "1" && existsSync(jsDist)

Lines 57-85javascript

57 NODE_OPTIONS: nodeOptions,

58 },

59 stdio: "inherit",

60 })

61 process.exit(0)

62 } catch (err) {

63 // execFileSync throws on non-zero exit codes — propagate them

64 const code =

65 err !==

dist/pipeline/compiler/mode-handlers/mcp-server/schema-validator.jsView file

Lines 1-33javascript

1/**

2 * Inline JSON-Schema validator for the MCP schema-conformance matchers.

3 *

4 * The schema matchers (`tool-input-schema` / `tool-output-schema`) validate a

5 * recorded tool call's input/output against a supplied JSON Schema. Unlike the

6 * value-equality matchers (`tool-input-matches` / `tool-output-matches`), which

7 * compare exact key/value pairs, these answer a shape/type question ("is

8 * `query` a string?", "is the result a non-empty array?") with a real JSON

9 * Schema validator rather than a homegrown key-comparison loop (D0079).

10 *

dist/adapters/task-sources/repo-schemas.d.tsView file

Lines 285-325typescript

285 env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;

286 headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;

287 startupTimeoutMs: z.ZodOptional<z.ZodNumber>;

288 auth: z.ZodOptional<z.ZodObject

Source & flagged code

6 flagged · loading source

bin/ailf.jsView file

14import { existsSync } from "fs" L15: import { execFileSync } from "child_process" L16: import { dirname, resolve } from "path"

High

Child Process

Package source references child process execution.

bin/ailf.jsView on unpkg · L14

9* 2. **Production** (npm install) — imports the compiled dist/cli.js directly. L10: * This is the path when installed via `npx @sanity/ailf-eval` or L11: * `pnpm add @sanity/ailf-eval`. ... L14: import { existsSync } from "fs" L15: import { execFileSync } from "child_process" L16: import { dirname, resolve } from "path"

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/ailf.jsView on unpkg · L9

77process.env.AILF_CALLER_CWD = callerCwd L78: await import(jsDist) L79: } else {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/ailf.jsView on unpkg · L77

dist/pipeline/compiler/mode-handlers/mcp-server/schema-validator.jsView file

13* Promptfoo runs a multiline `javascript` assertion via L14: * `new Function("output", "context", "process", body)` — a sandbox with no L15: * module scope and no `require` (see the bridge in `./assertions.ts`). So the

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/pipeline/compiler/mode-handlers/mcp-server/schema-validator.jsView on unpkg · L13

dist/adapters/task-sources/repo-schemas.d.tsView file

305patternName = generic_password severity = medium line = 305 matchedText = password...rd";

Medium

Secret Pattern

Hardcoded password in dist/adapters/task-sources/repo-schemas.d.ts

dist/adapters/task-sources/repo-schemas.d.tsView on unpkg · L305

1057patternName = generic_password severity = medium line = 1057 matchedText = password...rd";

Medium

Secret Pattern

Hardcoded password in dist/adapters/task-sources/repo-schemas.d.ts

dist/adapters/task-sources/repo-schemas.d.tsView on unpkg · L1057

Findings

3 High6 Medium5 Low

HighChild Processbin/ailf.js

HighShell

HighRuntime Package Installbin/ailf.js

MediumDynamic Requirebin/ailf.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumSecret Patterndist/adapters/task-sources/repo-schemas.d.ts

LowScripts Present

LowEvaldist/pipeline/compiler/mode-handlers/mcp-server/schema-validator.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

bin/ailf.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * ailf — CLI launcher for the AI Literacy Framework.

5 *

6 * Runs in two modes:

7 * 1. **Development** (monorepo) — delegates to TypeScript source via tsx.

8 * Detected by the presence of src/cli.ts.

9 * 2. **Production** (npm install) — imports the compiled dist/cli.js directly.

10 * This is the path when installed via `npx @sanity/ailf-eval` or

11 * `pnpm add @sanity/ailf-eval`.

12 */

14import { existsSync } from "fs"

15import { execFileSync } from "child_process"

16import { dirname, resolve } from "path"

High

Child Process

Package source references child process execution.

bin/ailf.jsView on unpkg · L14

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/ailf.jsView on unpkg · L9

17import { fileURLToPath } from "url"

19const __dirname = dirname(fileURLToPath(import.meta.url))

20const ROOT = resolve(__dirname, "..")

21const tsSrc = resolve(ROOT, "src", "cli.ts")

22const jsDist = resolve(ROOT, "dist", "cli.js")

24// Forward all arguments after the script name

25const args = process.argv.slice(2)

27// Preserve the caller's working directory so commands like `ailf init`

28// operate on the user's cwd, not the eval package root.

29const callerCwd = process.cwd()

31// Test harnesses (and any caller that knows the dist is fresh) can opt out

32// of the tsx dev path with AILF_PREFER_DIST=1. This avoids the npx + tsx

33// cold-start cost (~1–2s per invocation) on every `spawnCli(...)` call.

34const preferDist = process.env.AILF_PREFER_DIST === "1" && existsSync(jsDist)

Lines 57-85javascript

57 NODE_OPTIONS: nodeOptions,

58 },

59 stdio: "inherit",

60 })

61 process.exit(0)

62 } catch (err) {

63 // execFileSync throws on non-zero exit codes — propagate them

64 const code =

65 err !==

dist/pipeline/compiler/mode-handlers/mcp-server/schema-validator.jsView file

Lines 1-33javascript

1/**

2 * Inline JSON-Schema validator for the MCP schema-conformance matchers.

3 *

4 * The schema matchers (`tool-input-schema` / `tool-output-schema`) validate a

5 * recorded tool call's input/output against a supplied JSON Schema. Unlike the

6 * value-equality matchers (`tool-input-matches` / `tool-output-matches`), which

7 * compare exact key/value pairs, these answer a shape/type question ("is

8 * `query` a string?", "is the result a non-empty array?") with a real JSON

9 * Schema validator rather than a homegrown key-comparison loop (D0079).

10 *

dist/adapters/task-sources/repo-schemas.d.tsView file

Lines 285-325typescript

285 env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;

286 headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;

287 startupTimeoutMs: z.ZodOptional<z.ZodNumber>;

288 auth: z.ZodOptional<z.ZodObject

Lines 1037-1077typescript

1037 env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;

1038 headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;

1039 startupTimeoutMs: z.ZodOptional<z.ZodNumber>;

1040 auth: z.ZodOptional<z.ZodObject<{

1041 type: z.ZodEnum<{

1042 bearer: "bearer";

1043 basic: "basic";

1044 api_key: "api_key";

1045 oauth: "oauth";

1046 }>;

1047 token: z.ZodOptional<z.ZodString>;

1048 username: z.ZodOptional<z.ZodString>;

1049 password: z.ZodOptional<z.ZodString>;

1050 value: z.ZodOptional<z.ZodString>;

1051 keyName: z.ZodOptional<z.ZodString>;

1052 placement: z.ZodOptional<z.ZodEnum<{

1053 query: "query";

1054 header: "header";

1055 }>>;

1056 grantType: z.ZodOptional<z.ZodEnum<{

1057 password: "password";

Medium

Secret Pattern

Hardcoded password in dist/adapters/task-sources/repo-schemas.d.ts

dist/adapters/task-sources/repo-schemas.d.tsView on unpkg · L1057

1058 client_credentials: "client_credentials";

1059 }>>;

1060 tokenUrl: z.ZodOptional<z.ZodString>;

1061 clientId: z.ZodOptional<z.ZodString>;

1062 clientSecret: z.ZodOptional<z.ZodString>;

1063 scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;

1064 }, z.core.$strip>>;

1065 }, z.core.$strip>>;

1066 capabilities: z.ZodOptional<z.ZodArray<z.ZodString>>;

1067 context: z.ZodOptional<z.ZodObject<{

1068 docs: z.ZodOptional<z.ZodArray<z.ZodUnion<readonly [z.ZodObject<{

1069 id: z.ZodString;

1070 reason: z.ZodDefault<z.ZodOptional<z.ZodString>>;

1071 slug: z.ZodOptional<z.ZodString>;

1072 path: z.ZodOptional<z.ZodString>;

1073 }, z.core.$strip>, z.ZodObject<{

1074 slug: z.ZodString;

1075 reason: z.ZodDefault<z.ZodOptional<z.ZodString>>;

1076 }, z.core.$strip>, z.ZodObject<{

1077 path: z.ZodString;