Loading npm security reports…

@shgroup/opencode-serenity-plugin@0.5.28: Suspicious npm security | LPM Firewall

registry / @shgroup/opencode-serenity-plugin / 0.5.28

@shgroup/opencode-serenity-plugin@0.5.28

Serenity — 为 OpenCode Agent 提供认知容器 (CCC) 基础设施。9 个工具 (msm_list/msm_exec/msm_admin/cc-fs/session/cc-ck/eap/neat/cc-git) + 6 个 hook。D1 Init 向导：CLI 交互式创建 CCC + Phase 2 强制访谈。

Static Scan Results

scanned 16d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 52 file(s), 491 KB of source, external domains: 127.0.0.1, github.com, opencode.ai

Source & flagged code

2 flagged

dist/init/init-wizard.jsView file

Lines 1-37javascript

1/**

2 * init-wizard.ts — D1 Init 向导 Phase 1

3 *

4 * CLI 交互式创建认知容器 (CCC) 的目录骨架、git 初始化并复制标准技能模板。

5 *

6 * 设计文档：docs/ccc-init-flow-design.md（home-serenity 仓）

7 *

8 * 流程：

9 * 1. 交互问答 4 题（prefix / description / remote / scope）

10 * 2. git init → add → commit（Phase 1 写骨架前）

11 * 3. 创建目录骨架（.serenity, opencode.json, AGENT_SESSIONS/, docs/）

12 * 4. 复制 3 个标准技能模板到 .opencode/skills/

13 * 5. git remote add → push（如果提供了 remote）

14 * 6. 写入 Phase 2 Agent prompt

15 * 7. 输出完成信息

16 */

17import { existsSync, mkdirSync, writeFileSync } from 'node:fs';

18import { execFileSync } from 'node:child_process';

19import { join, basename } from 'node:path';

High

Child Process

Package source references child process execution.

dist/init/init-wizard.jsView on unpkg · L17

20import { createInterface } from 'node:readline';

21import { stdin, stdout } from 'node:process';

22import { getTemplatesDir, installTemplate, defaultPlaceholders, } from '../skills/template-loader.js';

23import { isValidPrefix, buildCccName } from '../util/init.js';

24// ── 默认值 ──

25/** Phase 1 预装的 3 个标准技能（设计决策 D20） */

26const STANDARD_SKILLS = [

27 'compass',

28 'session',

29 'sqc',

30];

31/** 从目录名推断 prefix（kebab-case，取第一部分） */

32function inferPrefix(dirName) {

33 const cleaned = dirName.replace(/[^a-zA-Z0-9-]/g, '');

34 const first = cleaned.split(/[-_]/)[0];

35 if (!first)

36 return 'my';

37 return first.toLowerCase().slice(0, 8);

dist/util/msm-exec-runtime.jsView file

Lines 25-65javascript

25 * --format=<text|json> 输出格式 (默认 text)

26 * --log <path> JSON Lines 日志

Source & flagged code

2 flagged · loading source

dist/init/init-wizard.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code