registry / @shirayner/ace / 1.1.1

@shirayner/ace@1.1.1

AI Coding Environment - One command to set up your Claude Code harness

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 83.8 KB of source, external domains: registry.npmjs.org

Source & flagged code

7 flagged

src/core/team-installer.jsView file

Lines 1-23javascript

1import fs from 'fs-extra';

2import path from 'path';

3import os from 'os';

4import { execSync } from 'child_process';

High

Child Process

Package source references child process execution.

src/core/team-installer.jsView on unpkg · L3

6export class TeamInstaller {

7 constructor(options = {}) {

8 this.targetDir = options.targetDir || process.cwd();

9 this.repoUrl = options.repoUrl;

10 this.force = options.force || false;

11 this.dryRun = options.dryRun || false;

12 this.results = { installed: [], skipped: [], errors: [] };

13 }

15 get teamDir() {

16 return path.join(this.targetDir, '.claude', 'rules', 'team');

17 }

19 async run() {

20 if (!this.repoUrl) return this.results;

22 const tempDir = path.join(os.tmpdir(), `ace-team-${Date.now()}`);

src/commands/upgrade.jsView file

Lines 1-58javascript

1import { spawnSync } from 'child_process';

2import chalk from 'chalk';

3import inquirer from 'inquirer';

4import ora from 'ora';

6const PACKAGE_NAME = '@shirayner/ace'

plugin/skills/text-to-image/scripts/text_to_image.pyView file

•path = plugin/skills/text-to-image/scripts/text_to_image.py kind = build_helper sizeBytes = 8733 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugin/skills/text-to-image/scripts/text_to_image.pyView on unpkg

plugin/skills/spechub-coding.zipView file

•path = plugin/skills/spechub-coding.zip kind = high_entropy_blob sizeBytes = 44799 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

plugin/skills/spechub-coding.zipView on unpkg

•path = plugin/skills/spechub-coding.zip kind = compressed_blob sizeBytes = 44799 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

plugin/skills/spechub-coding.zipView on unpkg

•path = plugin/skills/spechub-coding.zip kind = nested_archive_needs_inspection sizeBytes = 44799 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

plugin/skills/spechub-coding.zipView on unpkg

Source & flagged code

7 flagged · loading source

src/core/team-installer.jsView file

3import os from 'os'; L4: import { execSync } from 'child_process'; L5:

High

Child Process

Package source references child process execution.

src/core/team-installer.jsView on unpkg · L3

src/commands/upgrade.jsView file

11encoding: 'utf-8', L12: shell: true, L13: windowsHide: true,

High

Shell

Package source references shell execution.

src/commands/upgrade.jsView on unpkg · L11

38function fetchLatestVersion(registry) { L39: const result = spawnSync( L40: `npm view ${PACKAGE_NAME} version --registry ${registry}`, ... L53: const result = spawnSync( L54: `npm install -g ${PACKAGE_NAME} --registry ${registry}`, L55: { stdio: 'inherit', shell: true, windowsHide: true },

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

src/commands/upgrade.jsView on unpkg · L38

plugin/skills/text-to-image/scripts/text_to_image.pyView file

•path = plugin/skills/text-to-image/scripts/text_to_image.py kind = build_helper sizeBytes = 8733 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugin/skills/text-to-image/scripts/text_to_image.pyView on unpkg

plugin/skills/spechub-coding.zipView file

•path = plugin/skills/spechub-coding.zip kind = high_entropy_blob sizeBytes = 44799 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

plugin/skills/spechub-coding.zipView on unpkg

•path = plugin/skills/spechub-coding.zip kind = compressed_blob sizeBytes = 44799 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

plugin/skills/spechub-coding.zipView on unpkg

•path = plugin/skills/spechub-coding.zip kind = nested_archive_needs_inspection sizeBytes = 44799 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

plugin/skills/spechub-coding.zipView on unpkg

Findings

4 High4 Medium4 Low

HighChild Processsrc/core/team-installer.js

HighShellsrc/commands/upgrade.js

HighRuntime Package Installsrc/commands/upgrade.js

HighShips High Entropy Blobplugin/skills/spechub-coding.zip

MediumEnvironment Vars

MediumShips Build Helperplugin/skills/text-to-image/scripts/text_to_image.py

MediumShips Compressed Blobplugin/skills/spechub-coding.zip

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowUrl Strings

LowNested Archive Needs Inspectionplugin/skills/spechub-coding.zip

Source & flagged code

7 flagged

src/core/team-installer.jsView file

Lines 1-23javascript

1import fs from 'fs-extra';

2import path from 'path';

3import os from 'os';

4import { execSync } from 'child_process';

High

Child Process

Package source references child process execution.

src/core/team-installer.jsView on unpkg · L3

6export class TeamInstaller {

7 constructor(options = {}) {

8 this.targetDir = options.targetDir || process.cwd();

9 this.repoUrl = options.repoUrl;

10 this.force = options.force || false;

11 this.dryRun = options.dryRun || false;

12 this.results = { installed: [], skipped: [], errors: [] };

13 }

15 get teamDir() {

16 return path.join(this.targetDir, '.claude', 'rules', 'team');

17 }

19 async run() {

20 if (!this.repoUrl) return this.results;

22 const tempDir = path.join(os.tmpdir(), `ace-team-${Date.now()}`);

src/commands/upgrade.jsView file

Lines 1-58javascript

1import { spawnSync } from 'child_process';

2import chalk from 'chalk';

3import inquirer from 'inquirer';

4import ora from 'ora';

6const PACKAGE_NAME = '@shirayner/ace'

plugin/skills/text-to-image/scripts/text_to_image.pyView file

•path = plugin/skills/text-to-image/scripts/text_to_image.py kind = build_helper sizeBytes = 8733 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

plugin/skills/text-to-image/scripts/text_to_image.pyView on unpkg

plugin/skills/spechub-coding.zipView file

•path = plugin/skills/spechub-coding.zip kind = high_entropy_blob sizeBytes = 44799 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

plugin/skills/spechub-coding.zipView on unpkg

•path = plugin/skills/spechub-coding.zip kind = compressed_blob sizeBytes = 44799 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

plugin/skills/spechub-coding.zipView on unpkg

•path = plugin/skills/spechub-coding.zip kind = nested_archive_needs_inspection sizeBytes = 44799 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

plugin/skills/spechub-coding.zipView on unpkg