registry / @saulwade/swl-ses / 2.5.1

@saulwade/swl-ses@2.5.1

⚠ Under review

Sistema de ingenieria de software auto-evolutivo multi-runtime polyglot con 61 agentes, 181 habilidades, 47 comandos, 77 reglas y 49 hooks. Soporta 11 lenguajes y 7 runtimes: Claude Code, OpenClaude, OpenCode, Gemini CLI, Cursor, Codex CLI (soporte comple

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 28 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 351 file(s), 2.89 MB of source, external domains: api.github.com, cli.github.com, docs.github.com, evil.example.com, github.com, npm.pkg.github.com, registry.npmjs.org, t.me

Source & flagged code

19 flagged

package.jsonView file

Lines 11-51json

11 "files": [

12 "bin",

13 "scripts",

14 "manifiestos",

15 "agentes",

16 "habilidades",

17 "comandos",

18 "reglas",

19 "hooks",

20 "gateway",

21 "plantillas",

22 "contextos",

23 "instintos",

24 "schemas",

25 "_userland",

26 "plugin.json",

27 "CLAUDE.md",

28 "llms.txt"

29 ],

30 "scripts": {

31 "postinstall": "echo '\n swl-software-engineering-system instalado.\n Ejecuta: npx swl-ses init\n'",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L31

32 "test": "node --test tests/lib/*.test.js tests/scripts/*.test.js tests/scripts/lib/*.test.js tests/scripts/tui/*.test.js tests/hooks/*.test.js tests/hooks/lib/*.test.js tests/habilidades/*.test.js tests/gateway/*.test.js tests/bin/*.test.js tests/transformadores/*.test.js tests/mcp-server/*.test.js",

33 "test:validate": "node scripts/validar.js",

34 "test:manifest": "node scripts/validar-manifest.js",

35 "test:docs": "node scripts/verificar-docs-vs-codigo.js",

36 "test:smoke": "node scripts/smoke-test.js",

37 "test:aislamiento": "node scripts/validar-tests-aislamiento.js",

38 "test:all": "npm test && node scripts/validar.js && node scripts/validar-manifest.js && node scripts/verificar-docs-vs-codigo.js && node scripts/derivar-feature-list.js --check && node scripts/generar-comandos.js --check && node scripts/auditar-clases-conocidas.js && node scripts/canario-hooks.js",

39 "test:userland": "node scripts/validar-userland-vacio.js",

40 "test:release": "npm run test:all && npm run test:userland && npm run test:smoke && node scripts/canario-hooks.js --smoke",

41 "doctor": "node scripts/doctor.js",

42 "prepack": "node scripts/limpiar-artefactos-python.js && node scripts/validar-userland-vacio.js",

43 "prepublishOnly": "npm run test:release",

44 "publish:all": "node scripts/publicar.js",

45 "publish:github": "node scripts/publicar.js --solo-github",

46 "publish:npmjs": "node scripts/publicar.js --solo-npmjs",

47 "publish:dry": "node scripts/publicar.js --dry-run",

48 "generate:docs": "node scripts/generar-inventario.js && node scripts/generar-comandos.js",

49 "gen-comandos": "node scripts/generar-comandos.js",

50 "gen-comandos:check": "node scripts/generar-comandos.js --check",

51 "gen-checklists": "node scripts/generar-checklists-consolidados.js",

hooks/escaneo-secretos.jsView file

Lines 45-85javascript

46/**

47 * Cada entrada describe un tipo de secreto con:

48 * - nombre: Etiqueta para el mensaje de error.

49 * - patron: Expresión regular para detectarlo.

50 * - ejemplos: Comentario ilustrativo (no se usa en código).

51 */

52const PATRONES_SECRETOS = [

53 {

54 nombre: 'Anthropic API Key (sk-ant-*)',

habilidades/changelog-generator/scripts/parse-commits.jsView file

Lines 6-56javascript

6 *

7 * Lee commits desde `git log` (entre dos refs o desde la última tag) y los

8 * clasifica según el spec de Conventional Commits 1.0.0:

9 * https://www.conventionalcommits.org/en/v1.0.0/

10 *

11 * Categorías generadas (formato Keep a Changelog):

hooks/lib/sync-status.jsView file

Lines 1-21javascript

1'use strict';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

hooks/lib/sync-status.jsView on unpkg · L1

3/**

4 * Sync Status — Detección de desincronización entre fuente y destino.

5 *

6 * Compara el directorio fuente (habilidades/, agentes/) con los directorios

7 * de instalación (.claude/skills/, .claude/agents/) para detectar:

8 * - Skills/agentes faltantes en destino

9 * - Skills/agentes modificados localmente (divergidos)

scripts/lib/autostart-macos.jsView file

Lines 1-28javascript

1'use strict';

3/**

4 * Generador de LaunchAgent plist para el daemon swl-telegram-bot en macOS.

5 *

6 * SEGURIDAD:

7 * - NUNCA escribe en ~/Library/LaunchDaemons — eso requiere root.

8 * Solo LaunchAgents (nivel usuario, sin privilegios de sistema).

9 * - NUNCA hardcodea rutas absolutas. Resuelve bin/ con __dirname en runtime.

10 * - NUNCA incluye credenciales en el plist — las credenciales viven en .env.

11 * - Solo opera en process.platform === 'darwin'. Otros OS reciben error explícito.

hooks/calidad-typescript.jsView file

Lines 285-325javascript

285 return violaciones;

286}

287

288/**

289 * 5. Ejecuta tsc --noEmit si el proyecto tiene tsconfig.json.

290 * Captura los primeros errores (no bloquea si tsc no está disponible).

291 *

292 * @returns {{ errores: string[], tiempoMs: number }}

293 */

294function ejecutarTsc() {

habilidades/validacion-ci-sistema/scripts/validar-sistema.shView file

•path = habilidades/validacion-ci-sistema/scripts/validar-sistema.sh kind = build_helper sizeBytes = 13731 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

habilidades/validacion-ci-sistema/scripts/validar-sistema.shView on unpkg

bin/swl-ses.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @saulwade/swl-ses@2.4.3 matchedIdentity = npm:QHNhdWx3YWRlL3N3bC1zZXM:2.4.3 similarity = 0.858 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/swl-ses.jsView on unpkg

habilidades/nestjs-experto/recursos/testing-nestjs.mdView file

Lines 32-72markdown

32 const module: TestingModule = await Test.createTestingModule({

33 providers: [

34 UsersService,

35 {

36 provide: getRepositoryToken(User),

37 useValue: crearMockRepositorio<User>(),

38 },

39 ],

40 }).compile();

42 service = module.get<UsersService>(UsersService);

43 repo = module.get<MockRepository<User>>(getRepositoryToken(User));

habilidades/gcp-cloud/SKILL.mdView file

100patternName = generic_password severity = medium line = 100 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in habilidades/gcp-cloud/SKILL.md

habilidades/gcp-cloud/SKILL.mdView on unpkg · L100

Source & flagged code

19 flagged · loading source

package.jsonView file

•scripts.postinstall = echo ' swl-software-engineering-system instalado. Ejecuta: npx swl-ses init '

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

hooks/escaneo-secretos.jsView file

65patternName = aws_access_key severity = critical line = 65 matchedText = // AKIAI...X...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

hooks/escaneo-secretos.jsView on unpkg · L65

65patternName = aws_access_key severity = critical line = 65 matchedText = // AKIAI...X...

Critical

Secret Pattern

AWS access key ID in hooks/escaneo-secretos.js

hooks/escaneo-secretos.jsView on unpkg · L65

78patternName = private_key_rsa severity = critical line = 78 matchedText = // -----...----

Critical

Secret Pattern

RSA private key in hooks/escaneo-secretos.js

hooks/escaneo-secretos.jsView on unpkg · L78

78patternName = private_key_openssh severity = critical line = 78 matchedText = // -----...----

Critical

Secret Pattern

OpenSSH private key in hooks/escaneo-secretos.js

hooks/escaneo-secretos.jsView on unpkg · L78

habilidades/changelog-generator/scripts/parse-commits.jsView file

36L37: const { execSync } = require('node:child_process'); L38:

High

Child Process

Package source references child process execution.

habilidades/changelog-generator/scripts/parse-commits.jsView on unpkg · L36

26* Uso programático: L27: * const { parsearCommits, generarChangelog } = require('./parse-commits'); L28: * const { categorias, conformidad } = parsearCommits(commits);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

habilidades/changelog-generator/scripts/parse-commits.jsView on unpkg · L26

hooks/lib/sync-status.jsView file

1'use strict'; L2:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

hooks/lib/sync-status.jsView on unpkg · L1

scripts/lib/autostart-macos.jsView file

8* Solo LaunchAgents (nivel usuario, sin privilegios de sistema). L9: * - NUNCA hardcodea rutas absolutas. Resuelve bin/ con __dirname en runtime. L10: * - NUNCA incluye credenciales en el plist — las credenciales viven en .env. L11: * - Solo opera en process.platform === 'darwin'. Otros OS reciben error explícito. L12: * L13: * Rollback manual (si algo sale mal): L14: * launchctl unload -w ~/Library/LaunchAgents/com.swl.telegram-bot.plist L15: * rm ~/Library/LaunchAgents/com.swl.telegram-bot.plist ... L19: L20: const { execFileSync } = require('node:child_process'); L21: const path = require('node:path'); ... L50: } catch (_) {}

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/lib/autostart-macos.jsView on unpkg · L8

hooks/calidad-typescript.jsView file

305try { L306: execSync('npx tsc --noEmit 2>&1', { L307: cwd: CWD, encoding: 'utf8', stdio: ['pipe','pipe','pipe'], timeout: 60_000,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

hooks/calidad-typescript.jsView on unpkg · L305

habilidades/validacion-ci-sistema/scripts/validar-sistema.shView file

•path = habilidades/validacion-ci-sistema/scripts/validar-sistema.sh kind = build_helper sizeBytes = 13731 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

habilidades/validacion-ci-sistema/scripts/validar-sistema.shView on unpkg

bin/swl-ses.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/swl-ses.jsView on unpkg

habilidades/nestjs-experto/recursos/testing-nestjs.mdView file

52patternName = generic_password severity = medium line = 52 matchedText = password...34',

Medium

Secret Pattern