registry / @scorehub/creator-outreach / 1.1.7

@scorehub/creator-outreach@1.1.7

ScoreHub AI TikTok达人营销专家 Tiky — Agent 定义 + Skills 配置

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 6 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

UrlStrings

Manifest

NoLicense

scanned 1 file(s), 5.96 KB of source, external domains: app.scorehub.cn

Source & flagged code

1 flagged

install.jsView file

Lines 1-25javascript

1#!/usr/bin/env node

3const fs = require('fs');

4const path = require('path');

5const os = require('os');

6const { execSync } = require('child_process');

8const pkg = require('./package.json');

9const MIN_NODE_MAJOR = 18;

11const MCP_CONFIG = {

12 type: 'stdio',

13 command: 'npx',

14 args: ['-y', '@scorehub/mcp-server@latest'],

15 env: {

16 SCOREHUB_REMOTE_MCP_URL: 'https://app.scorehub.cn/mcp',

17 },

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

install.jsView on unpkg · L5

18};

20function getNodeMajorVersion(nodeVersion = process.versions.node) {

21 return Number.parseInt(nodeVersion.split('.')[0], 10);

22}

24function isSupportedNode(nodeVersion = process.versions.node) {

25 return getNodeMajorVersion(nodeVersion) >= MIN_NODE_MAJOR;

Source & flagged code

1 flagged · loading source

install.jsView file

5const os = require('os'); L6: const { execSync } = require('child_process'); L7: L8: const pkg = require('./package.json'); L9: const MIN_NODE_MAJOR = 18; ... L15: env: { L16: SCOREHUB_REMOTE_MCP_URL: 'https://app.scorehub.cn/mcp', L17: }, ... L45: const versionsDir = path.join(workBuddyDir, 'binaries', 'node', 'versions'); L46: const npxExecutable = process.platform === 'win32' ? 'npx.cmd' : 'npx'; L47: try { ... L79: try {

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code