registry / @saulwade/swl-ses / 2.6.0

@saulwade/swl-ses@2.6.0

⚠ Under review

Sistema de ingenieria de software auto-evolutivo multi-runtime polyglot con 61 agentes, 181 habilidades, 48 comandos, 77 reglas y 49 hooks. Soporta 11 lenguajes y 7 runtimes: Claude Code, OpenClaude, OpenCode, Gemini CLI, Cursor, Codex CLI (soporte comple

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 27 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 374 file(s), 3.08 MB of source, external domains: api.github.com, cli.github.com, docs.github.com, evil.example.com, github.com, npm.pkg.github.com, registry.npmjs.org, t.me

Source & flagged code

18 flagged

hooks/escaneo-secretos.jsView file

Lines 45-85javascript

46/**

47 * Cada entrada describe un tipo de secreto con:

48 * - nombre: Etiqueta para el mensaje de error.

49 * - patron: Expresión regular para detectarlo.

50 * - ejemplos: Comentario ilustrativo (no se usa en código).

51 */

52const PATRONES_SECRETOS = [

53 {

Source & flagged code

18 flagged · loading source

hooks/escaneo-secretos.jsView file

65patternName = aws_access_key severity = critical line = 65 matchedText = // AKIAI...X...

Critical

Critical Secret

Package contains a critical-looking secret pattern.

hooks/escaneo-secretos.jsView on unpkg · L65

65patternName = aws_access_key severity = critical line = 65 matchedText = // AKIAI...X...

Critical

Secret Pattern

AWS access key ID in hooks/escaneo-secretos.js

hooks/escaneo-secretos.jsView on unpkg · L65

78patternName = private_key_rsa severity = critical line = 78 matchedText = // -----...----

Critical

Secret Pattern

RSA private key in hooks/escaneo-secretos.js

hooks/escaneo-secretos.jsView on unpkg · L78

78patternName = private_key_openssh severity = critical line = 78 matchedText = // -----...----

Critical

Secret Pattern

OpenSSH private key in hooks/escaneo-secretos.js

hooks/escaneo-secretos.jsView on unpkg · L78

habilidades/changelog-generator/scripts/parse-commits.jsView file

36L37: const { execSync } = require('node:child_process'); L38:

High

Child Process

Package source references child process execution.

habilidades/changelog-generator/scripts/parse-commits.jsView on unpkg · L36

26* Uso programático: L27: * const { parsearCommits, generarChangelog } = require('./parse-commits'); L28: * const { categorias, conformidad } = parsearCommits(commits);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

habilidades/changelog-generator/scripts/parse-commits.jsView on unpkg · L26

hooks/lib/sync-status.jsView file

1'use strict'; L2:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

hooks/lib/sync-status.jsView on unpkg · L1

scripts/lib/autostart-macos.jsView file

8* Solo LaunchAgents (nivel usuario, sin privilegios de sistema). L9: * - NUNCA hardcodea rutas absolutas. Resuelve bin/ con __dirname en runtime. L10: * - NUNCA incluye credenciales en el plist — las credenciales viven en .env. L11: * - Solo opera en process.platform === 'darwin'. Otros OS reciben error explícito. L12: * L13: * Rollback manual (si algo sale mal): L14: * launchctl unload -w ~/Library/LaunchAgents/com.swl.telegram-bot.plist L15: * rm ~/Library/LaunchAgents/com.swl.telegram-bot.plist ... L19: L20: const { execFileSync } = require('node:child_process'); L21: const path = require('node:path'); ... L50: } catch (_) {}

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

scripts/lib/autostart-macos.jsView on unpkg · L8

hooks/calidad-typescript.jsView file

305try { L306: execSync('npx tsc --noEmit 2>&1', { L307: cwd: CWD, encoding: 'utf8', stdio: ['pipe','pipe','pipe'], timeout: 60_000,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

hooks/calidad-typescript.jsView on unpkg · L305

habilidades/validacion-ci-sistema/scripts/validar-sistema.shView file

•path = habilidades/validacion-ci-sistema/scripts/validar-sistema.sh kind = build_helper sizeBytes = 13731 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

habilidades/validacion-ci-sistema/scripts/validar-sistema.shView on unpkg

bin/swl-ses.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @saulwade/swl-ses@2.4.3 matchedIdentity = npm:QHNhdWx3YWRlL3N3bC1zZXM:2.4.3 similarity = 0.442 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/swl-ses.jsView on unpkg

habilidades/nestjs-experto/recursos/testing-nestjs.mdView file

52patternName = generic_password severity = medium line = 52 matchedText = password...34',

Medium

Secret Pattern

Hardcoded password in habilidades/nestjs-experto/recursos/testing-nestjs.md

habilidades/nestjs-experto/recursos/testing-nestjs.mdView on unpkg · L52

72patternName = generic_password severity = medium line = 72 matchedText = service.... }),

Medium

Secret Pattern

Hardcoded password in habilidades/nestjs-experto/recursos/testing-nestjs.md

habilidades/nestjs-experto/recursos/testing-nestjs.mdView on unpkg · L72

131patternName = generic_password severity = medium line = 131 matchedText = const dt...' };

Medium

Secret Pattern

Hardcoded password in habilidades/nestjs-experto/recursos/testing-nestjs.md

habilidades/nestjs-experto/recursos/testing-nestjs.mdView on unpkg · L131

240patternName = generic_password severity = medium line = 240 matchedText = .send({ ...' })

Medium

Secret Pattern

Hardcoded password in habilidades/nestjs-experto/recursos/testing-nestjs.md

habilidades/nestjs-experto/recursos/testing-nestjs.mdView on unpkg · L240

254patternName = generic_password severity = medium line = 254 matchedText = .send({ ...' })

Medium

Secret Pattern

Hardcoded password in habilidades/nestjs-experto/recursos/testing-nestjs.md

habilidades/nestjs-experto/recursos/testing-nestjs.mdView on unpkg · L254

261patternName = generic_password severity = medium line = 261 matchedText = const dt...' };

Medium

Secret Pattern

Hardcoded password in habilidades/nestjs-experto/recursos/testing-nestjs.md

habilidades/nestjs-experto/recursos/testing-nestjs.mdView on unpkg · L261

habilidades/gcp-cloud/SKILL.mdView file

100patternName = generic_password severity = medium line = 100 matchedText = password...ña",

Medium

Secret Pattern

Hardcoded password in habilidades/gcp-cloud/SKILL.md

habilidades/gcp-cloud/SKILL.mdView on unpkg · L100

Findings

5 Critical3 High13 Medium6 Low

CriticalCritical Secrethooks/escaneo-secretos.js

CriticalPrevious Version Dangerous Deltabin/swl-ses.js

CriticalSecret Patternhooks/escaneo-secretos.js

HighChild Processhabilidades/changelog-generator/scripts/parse-commits.js

HighShell

HighRuntime Package Installhooks/calidad-typescript.js

MediumDynamic Requirehabilidades/changelog-generator/scripts/parse-commits.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencescripts/lib/autostart-macos.js

MediumShips Build Helperhabilidades/validacion-ci-sistema/scripts/validar-sistema.sh

MediumStructural Risk Force Deep Review

MediumSecret Patternhabilidades/nestjs-experto/recursos/testing-nestjs.md

MediumSecret Patternhabilidades/gcp-cloud/SKILL.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptohooks/lib/sync-status.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

habilidades/changelog-generator/scripts/parse-commits.jsView file

Lines 6-56javascript

6 *

7 * Lee commits desde `git log` (entre dos refs o desde la última tag) y los

8 * clasifica según el spec de Conventional Commits 1.0.0:

9 * https://www.conventionalcommits.org/en/v1.0.0/

10 *

11 * Categorías generadas (formato Keep a Changelog):

12 * - feat -> "Nuevas funcionalidades"

13 * - fix -> "Correcciones"

14 * - perf -> "Mejoras de rendimiento"

15 * - refactor -> "Cambios internos"

16 * - docs / style / test / ci / build / chore -> "Mantenimiento" (opcional)

17 * - BREAKING CHANGE / ! -> "Breaking changes" (siempre top de cada release)

18 * - Sin prefijo CC válido -> "Otros" (con bandera de baja conformidad)

19 *

20 * Fallback: si la conformidad de commits es <80%, el script retorna

21 * `conformidad: <ratio>` para que el caller decida si abortar o seguir.

22 *

23 * Uso desde CLI:

24 * node parse-commits.js [--from <ref>] [--to <ref>] [--format json|markdown]

25 *

26 * Uso programático:

27 * const { parsearCommits, generarChangelog } = require('./parse-commits');

28 * const { categorias, conformidad } = parsearCommits(commits);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

habilidades/changelog-generator/scripts/parse-commits.jsView on unpkg · L26

29 * const md = generarChangelog(categorias, { version: '1.6.5', fecha: '...' });

30 *

31 * Zero-deps. Cargado por skill `changelog-generator` y por

32 * `/swl:release` paso 7.

33 *

34 * @module habilidades/changelog-generator/scripts/parse-commits

35 */

37const { execSync } = require('node:child_process');

High

Child Process

Package source references child process execution.

habilidades/changelog-generator/scripts/parse-commits.jsView on unpkg · L36

39// -----------------------------------------------------------------------------

40// Spec Conventional Commits

41// -----------------------------------------------------------------------------

43/**

44 * Regex que matchea una línea de commit Conventional Commits.

45 * Grupos: [1]=tipo, [2]=scope?, [3]=!?, [4]=descripcion

46 *

47 * Ejemplos válidos:

48 * feat(auth): agregar validación PKCE

49 * fix: corregir cálculo IEPS

50 * feat!: breaking change inline

51 * refactor(hooks/lib): split evolution-tracker

52 * chore(release): bump version

53 * [T-01] feat(hooks): prefijo de trazabilidad de tarea (ejecutar-fase)

54 * [T-07][T-08] refactor(hooks): varios prefijos consecutivos

55 * [REQ-08] feat(scripts): prefijo de requisito

56 * [F12·T-01] feat(hooks): prefijo namespaceado por fase (DT-IDS-NAMESPACE)

habilidades/nestjs-experto/recursos/testing-nestjs.mdView file

Lines 32-92markdown

32 const module: TestingModule = await Test.createTestingModule({

33 providers: [

34 UsersService,

35 {

36 provide: getRepositoryToken(User),

37 useValue: crearMockRepositorio<User>(),

38 },

39 ],

40 }).compile();

42 service = module.get<UsersService>(UsersService);

43 repo = module.get<MockRepository<User>>(getRepositoryToken(User));

44 });

46 afterEach(() => jest.clearAllMocks());

48 describe('crear', () => {

49 it('crea un usuario cuando el correo no existe', async () => {

50 const dto: CreateUserDto = {

51 email: 'usuario@ejemplo.com',

52 password: 'segura1234',

Medium

Secret Pattern

Hardcoded password in habilidades/nestjs-experto/recursos/testing-nestjs.md

habilidades/nestjs-experto/recursos/testing-nestjs.mdView on unpkg · L52

53 nombre: 'Ana García',

54 };

55 const usuarioGuardado = { id: 'uuid-1', ...dto, password: 'hash' };

57 repo.findOneBy!.mockResolvedValue(null);

58 repo.create!.mockReturnValue(usuarioGuardado);

59 repo.save!.mockResolvedValue(usuarioGuardado);

61 const resultado = await service.crear(dto);

63 expect(repo.findOneBy).toHaveBeenCalledWith({ email: dto.email });

64 expect(resultado.email).toBe(dto.email);

65 expect(resultado.password).not.toBe(dto.password); // debe estar hasheada

66 });

68 it('lanza ConflictException si el correo ya existe', async () => {

69 repo.findOneBy!.mockResolvedValue({ id: 'uuid-1', email: 'ya@existe.com' });

71 await expect(

72 service.crear({ email: 'ya@existe.com', password: 'segura1234' }),

Medium

Secret Pattern

Hardcoded password in habilidades/nestjs-experto/recursos/testing-nestjs.md

habilidades/nestjs-experto/recursos/testing-nestjs.mdView on unpkg · L72

73 ).rejects.toThrow(ConflictException);

74 });

75 });

77 describe('obtenerPorId', () => {

78 it('retorna el usuario cuando existe', async () => {

79 const usuario = { id: 'uuid-1', email: 'usuario@ejemplo.com' };

80 repo.findOneBy!.mockResolvedValue(usuario);

82 const resultado = await service.obtenerPorId('uuid-1');

83 expect(resultado).toEqual(usuario);

84 });

86 it('lanza NotFoundException cuando no existe', async () => {

87 repo.findOneBy!.mockResolvedValue(null);

89 await expect(service.obtenerPorId('uuid-inexistente')).rejects.toThrow(

90 NotFoundException,

91 );

92 });

131patternName = generic_password severity = medium line = 131 matchedText = const dt...' };

Medium

Secret Pattern

Hardcoded password in habilidades/nestjs-experto/recursos/testing-nestjs.md

habilidades/nestjs-experto/recursos/testing-nestjs.mdView on unpkg · L131

240patternName = generic_password severity = medium line = 240 matchedText = .send({ ...' })

Medium

Secret Pattern

Hardcoded password in habilidades/nestjs-experto/recursos/testing-nestjs.md

habilidades/nestjs-experto/recursos/testing-nestjs.mdView on unpkg · L240

254patternName = generic_password severity = medium line = 254 matchedText = .send({ ...' })

Medium

Secret Pattern

Hardcoded password in habilidades/nestjs-experto/recursos/testing-nestjs.md

habilidades/nestjs-experto/recursos/testing-nestjs.mdView on unpkg · L254

261patternName = generic_password severity = medium line = 261 matchedText = const dt...' };

Medium

Secret Pattern

Hardcoded password in habilidades/nestjs-experto/recursos/testing-nestjs.md

habilidades/nestjs-experto/recursos/testing-nestjs.mdView on unpkg · L261