registry / @skalfa/skalfa-app-core / 1.0.7

@skalfa/skalfa-app-core@1.0.7

Core framework engine and foundational utility hook library for the Skalfa Next.js frontend.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. Risky primitives are explicit developer utilities for barrel generation, blueprint generation, and copying a PDF worker.

Static reason

One or more suspicious static signals were detected.

Trigger

User explicitly imports/runs CLI command helpers or calls exported frontend API/auth/cache utilities.

Impact

May modify local project files or run npx barrelsby only when command code is invoked; no install-time or import-time compromise found.

Mechanism

User-invoked project scaffolding and frontend API helpers

Rationale

Static inspection shows suspicious primitives, but they are package-aligned and require explicit user command invocation; the main import path has no lifecycle, shell, persistence, or hardcoded exfiltration behavior. The package should be treated as clean for firewall purposes.

Evidence

package.jsondist/index.jsdist/commands/cli.jsdist/commands/blueprint.jsdist/commands/use-pdf.jsdist/api/api.jsdist/auth/auth.jsdist/encryption/encryption.jsdist/cavity/cavity.jsbarrels.jsonblueprints/*.blueprint.jsonutils/commands/stubs/table-blueprint.stubapp/<route>/page.tsxpublic/pdf.worker.min.mjs

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/commands/cli.js imports child_process and runs `npx barrelsby -c barrels.json` in explicit barrels commands.
dist/commands/blueprint.js writes generated `app/<route>/page.tsx` files from local blueprint JSON and a local stub.
dist/commands/use-pdf.js copies `pdf.worker.min.mjs` from project node_modules to public.

Evidence against

package.json has no install/preinstall/postinstall lifecycle scripts and no bin entry.
dist/index.js exports frontend utilities but does not import or run dist/commands/cli.js.
dist/api/api.js uses axios only for caller/env-provided API host or URL, with no hardcoded exfiltration endpoint.
Environment and cookie usage in dist/auth/auth.js and dist/encryption/encryption.js is app-aligned token storage/encryption, not harvesting.
No native binaries, shell scripts, obfuscated payloads, or AI-agent control-surface writes found.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 31 file(s), 63.6 KB of source

Source & flagged code

2 flagged

dist/commands/cli.jsView file

Lines 1-60javascript

1import { Command } from "commander";

2import { usePdf } from "./use-pdf";

3import { blueprint } from "./blueprint";

4import { logger } from "../logger";

5import fs from "fs";

6import path from "path";

7import { exec, execSync } from "child_process";

8// =====================================>

High

Child Process

Package source references child process execution.

dist/commands/cli.jsView on unpkg · L6

9// ## Command: use-pdf

10// =====================================>

11export const usePdfCommand = new Command("use-pdf")

12 .description("Copy pdf.worker.min.mjs ke folder public/")

13 .action(() => {

14 usePdf();

15});

16// =====================================>

17// ## Command: blueprint

18// =====================================>

19export const blueprintCommand = new Command("blueprint")

20 .description("Generate blueprint")

21 .option("-o, --only <names...>", "Run only specific blueprints")

22 .action(async (opts) => {

23 await blueprint({ only: opts.only });

24 logger.info("Success run all blueprints!");

25 process.exit(0);

26});

27// =====================================>

28// ## Command: barrels (run once)

29// =====================================>

30export const barrelsCommand = new Command("barrels")

31 .description("Generate barrels auto-imports using barrelsby")

32 .action(() => {

33 const rootDir = process.cwd();

34 const configPath = path.join(rootDir, "barrels.json");

35 if (!fs.existsSync(configPath)) {

36 logger.error("barrels.json config file not found at project root");

37 process.exit(1);

38 }

39 logger.info("Generating barrels...");

40 try {

41 execSync("npx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" });

42 logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/cli.jsView on unpkg · L40

43 process.exit(0);

44 }

45 catch (err) {

46 logger.error(`Failed to generate barrels: ${err}`);

47 process.exit(1);

48 }

49});

50// =====================================>

51// ## Command: watch:barrels (file watcher)

52// =====================================>

53export const watchBarrelsCommand = new Command("watch:barrels")

54 .description("Watch directories and update barrels automatically on file changes")

55 .action(async () => {

56 const rootDir = process.cwd();

57 const configPath = path.join(rootDir, "barrels.json");

58 if (!fs.existsSync(configPath)) {

59 logger.error("barrels.json config file not found at project root");

60 process.exit(1);

Source & flagged code

2 flagged · loading source

dist/commands/cli.jsView file

6import path from "path"; L7: import { exec, execSync } from "child_process"; L8: // =====================================>

High

Child Process

Package source references child process execution.

dist/commands/cli.jsView on unpkg · L6

40try { L41: execSync("npx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" }); L42: logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/cli.jsView on unpkg · L40

Findings

3 High2 Medium3 Low

HighChild Processdist/commands/cli.js

HighShell

HighRuntime Package Installdist/commands/cli.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowNo License

Source & flagged code

2 flagged

dist/commands/cli.jsView file

Lines 1-60javascript

1import { Command } from "commander";

2import { usePdf } from "./use-pdf";

3import { blueprint } from "./blueprint";

4import { logger } from "../logger";

5import fs from "fs";

6import path from "path";

7import { exec, execSync } from "child_process";

8// =====================================>

High

Child Process

Package source references child process execution.

dist/commands/cli.jsView on unpkg · L6

9// ## Command: use-pdf

10// =====================================>

11export const usePdfCommand = new Command("use-pdf")

12 .description("Copy pdf.worker.min.mjs ke folder public/")

13 .action(() => {

14 usePdf();

15});

16// =====================================>

17// ## Command: blueprint

18// =====================================>

19export const blueprintCommand = new Command("blueprint")

20 .description("Generate blueprint")

21 .option("-o, --only <names...>", "Run only specific blueprints")

22 .action(async (opts) => {

23 await blueprint({ only: opts.only });

24 logger.info("Success run all blueprints!");

25 process.exit(0);

26});

27// =====================================>

28// ## Command: barrels (run once)

29// =====================================>

30export const barrelsCommand = new Command("barrels")

31 .description("Generate barrels auto-imports using barrelsby")

32 .action(() => {

33 const rootDir = process.cwd();

34 const configPath = path.join(rootDir, "barrels.json");

35 if (!fs.existsSync(configPath)) {

36 logger.error("barrels.json config file not found at project root");

37 process.exit(1);

38 }

39 logger.info("Generating barrels...");

40 try {

41 execSync("npx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" });

42 logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/cli.jsView on unpkg · L40

43 process.exit(0);

44 }

45 catch (err) {

46 logger.error(`Failed to generate barrels: ${err}`);

47 process.exit(1);

48 }

49});

50// =====================================>

51// ## Command: watch:barrels (file watcher)

52// =====================================>

53export const watchBarrelsCommand = new Command("watch:barrels")

54 .description("Watch directories and update barrels automatically on file changes")

55 .action(async () => {

56 const rootDir = process.cwd();

57 const configPath = path.join(rootDir, "barrels.json");

58 if (!fs.existsSync(configPath)) {

59 logger.error("barrels.json config file not found at project root");

60 process.exit(1);