registry / @scorehub/creator-outreach / 1.1.11

@scorehub/creator-outreach@1.1.11

ScoreHub AI TikTok达人营销专家 Tiky — Agent 定义 + Skills 配置

Static Scan Results

scanned 5h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 1 file(s), 5.61 KB of source, external domains: app.scorehub.cn, www.workbuddy.cn

Source & flagged code

1 flagged

install.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3const fs = require('fs');

4const path = require('path');

5const os = require('os');

6const { execSync } = require('child_process');

8const pkg = require('./package.json');

9const MIN_NODE_MAJOR = 18;

10const WORKBUDDY_SHARE_URL = 'https://www.workbuddy.cn/work/launch/?sharecode=lNM8H05BRKoV-dw2gac3ZwQ-p01o3C3KVz1gXJ_CwvtX02-mSRqBB3xepE4V0gr7&expertname=Tiky+%C2%B7+TikTok%E8%BE%BE%E4%BA%BA%E8%90%A5%E9%94%80%E4%B8%93%E5%AE%B6&buddy_type=workbuddy';

11const CREATOR_OUTREACH_SELF_BOOTSTRAP_COMMAND = 'npx -y @scorehub/creator-outreach@latest';

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install.jsView on unpkg · L5

13const MCP_CONFIG = {

14 type: 'stdio',

15 command: 'npx',

16 args: ['-y', '@scorehub/mcp-server@latest'],

17 env: {

18 SCOREHUB_REMOTE_MCP_URL: 'https://app.scorehub.cn/mcp',

19 SCOREHUB_CLIENT_HOST: 'workbuddy',

20 SCOREHUB_MANAGED_BY: '@scorehub/creator-outreach',

21 },

22};

24function getNodeMajorVersion(nodeVersion = process.versions.node) {

25 return Number.parseInt(nodeVersion.split('.')[0], 10);

Source & flagged code

1 flagged · loading source

install.jsView file

5const os = require('os'); L6: const { execSync } = require('child_process'); L7: L8: const pkg = require('./package.json'); L9: const MIN_NODE_MAJOR = 18; L10: const WORKBUDDY_SHARE_URL = 'https://www.workbuddy.cn/work/launch/?sharecode=lNM8H05BRKoV-dw2gac3ZwQ-p01o3C3KVz1gXJ_CwvtX02-mSRqBB3xepE4V0gr7&expertname=Tiky+%C2%B7+TikTok%E8%BE%BE... L11: const CREATOR_OUTREACH_SELF_BOOTSTRAP_COMMAND = 'npx -y @scorehub/creator-outreach@latest'; ... L45: const versionsDir = path.join(workBuddyDir, 'binaries', 'node', 'versions'); L46: const npxExecutable = process.platform === 'win32' ? 'npx.cmd' : 'npx'; L47: try { ... L79: try { L80: config = JSON.parse(fs.readFileSync(configPath, 'utf8'));

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code