registry / @skalfa/skalfa-app-core / 1.0.8

@skalfa/skalfa-app-core@1.0.8

Core framework engine and foundational utility hook library for the Skalfa Next.js frontend.

AI Security Review

scanned 10d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. Risky primitives are explicit project tooling for barrel generation, PDF worker copying, and page generation, not install-time or import-time behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

Explicit user invocation of package CLI helper functions/commands.

Impact

Can modify expected project output files when invoked; no evidence of unauthorized exfiltration, persistence, or hidden execution.

Mechanism

User-invoked filesystem generation and barrelsby execution.

Rationale

Read-only source inspection shows the scanner findings correspond to explicit CLI/dev tooling and app-aligned frontend API/cache/auth utilities. There is no lifecycle hook, import-time execution, credential harvesting, hardcoded exfiltration endpoint, persistence, or destructive action indicating malware.

Evidence

package.jsondist/index.jsdist/commands/cli.jsdist/commands/blueprint.jsdist/commands/use-pdf.jsdist/api/api.jsdist/auth/auth.jsdist/encryption/encryption.jsdist/cavity/cavity.jsbarrels.jsonpublic/pdf.worker.min.mjsblueprints/*.blueprint.jsonutils/commands/stubs/table-blueprint.stubapp/<route>/page.tsx

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/commands/cli.js can run `npx barrelsby -c barrels.json` from the caller cwd when CLI commands are invoked.
dist/commands/blueprint.js writes generated `app/<route>/page.tsx` files from local blueprint config when invoked.

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks and no bin entry.
dist/index.js only re-exports library modules; it does not import the CLI command runner.
dist/api/api.js uses axios against caller-provided url or NEXT_PUBLIC_API_HOST; no hardcoded exfiltration endpoint.
dist/auth/auth.js and dist/encryption/encryption.js use public app env vars for app auth/cookie helpers, not secret harvesting.
dist/cavity/cavity.js uses IndexedDB and an app-registered socket for cache invalidation; no external host is hardcoded.
No persistence, destructive behavior, credential file reads, dynamic eval, native loading, or AI-agent control-surface writes found.

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chainNo supply-chain packaging signals triggered.

Manifest

NoLicense

scanned 31 file(s), 64.1 KB of source

Source & flagged code

2 flagged

dist/commands/cli.jsView file

Lines 1-60javascript

1import { Command } from "commander";

2import { usePdf } from "./use-pdf";

3import { blueprint } from "./blueprint";

4import { logger } from "../logger";

5import fs from "fs";

6import path from "path";

7import { exec, execSync } from "child_process";

8// =====================================>

High

Child Process

Package source references child process execution.

dist/commands/cli.jsView on unpkg · L6

9// ## Command: use-pdf

10// =====================================>

11export const usePdfCommand = new Command("use-pdf")

12 .description("Copy pdf.worker.min.mjs ke folder public/")

13 .action(() => {

14 usePdf();

15});

16// =====================================>

17// ## Command: blueprint

18// =====================================>

19export const blueprintCommand = new Command("blueprint")

20 .description("Generate blueprint")

21 .option("-o, --only <names...>", "Run only specific blueprints")

22 .action(async (opts) => {

23 await blueprint({ only: opts.only });

24 logger.info("Success run all blueprints!");

25 process.exit(0);

26});

27// =====================================>

28// ## Command: barrels (run once)

29// =====================================>

30export const barrelsCommand = new Command("barrels")

31 .description("Generate barrels auto-imports using barrelsby")

32 .action(() => {

33 const rootDir = process.cwd();

34 const configPath = path.join(rootDir, "barrels.json");

35 if (!fs.existsSync(configPath)) {

36 logger.error("barrels.json config file not found at project root");

37 process.exit(1);

38 }

39 logger.info("Generating barrels...");

40 try {

41 execSync("npx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" });

42 logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/cli.jsView on unpkg · L40

43 process.exit(0);

44 }

45 catch (err) {

46 logger.error(`Failed to generate barrels: ${err}`);

47 process.exit(1);

48 }

49});

50// =====================================>

51// ## Command: watch:barrels (file watcher)

52// =====================================>

53export const watchBarrelsCommand = new Command("watch:barrels")

54 .description("Watch directories and update barrels automatically on file changes")

55 .action(async () => {

56 const rootDir = process.cwd();

57 const configPath = path.join(rootDir, "barrels.json");

58 if (!fs.existsSync(configPath)) {

59 logger.error("barrels.json config file not found at project root");

60 process.exit(1);

Source & flagged code

2 flagged · loading source

dist/commands/cli.jsView file

6import path from "path"; L7: import { exec, execSync } from "child_process"; L8: // =====================================>

High

Child Process

Package source references child process execution.

dist/commands/cli.jsView on unpkg · L6

40try { L41: execSync("npx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" }); L42: logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/cli.jsView on unpkg · L40

Findings

3 High2 Medium3 Low

HighChild Processdist/commands/cli.js

HighShell

HighRuntime Package Installdist/commands/cli.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowFilesystem

LowNo License

Source & flagged code

2 flagged

dist/commands/cli.jsView file

Lines 1-60javascript

1import { Command } from "commander";

2import { usePdf } from "./use-pdf";

3import { blueprint } from "./blueprint";

4import { logger } from "../logger";

5import fs from "fs";

6import path from "path";

7import { exec, execSync } from "child_process";

8// =====================================>

High

Child Process

Package source references child process execution.

dist/commands/cli.jsView on unpkg · L6

9// ## Command: use-pdf

10// =====================================>

11export const usePdfCommand = new Command("use-pdf")

12 .description("Copy pdf.worker.min.mjs ke folder public/")

13 .action(() => {

14 usePdf();

15});

16// =====================================>

17// ## Command: blueprint

18// =====================================>

19export const blueprintCommand = new Command("blueprint")

20 .description("Generate blueprint")

21 .option("-o, --only <names...>", "Run only specific blueprints")

22 .action(async (opts) => {

23 await blueprint({ only: opts.only });

24 logger.info("Success run all blueprints!");

25 process.exit(0);

26});

27// =====================================>

28// ## Command: barrels (run once)

29// =====================================>

30export const barrelsCommand = new Command("barrels")

31 .description("Generate barrels auto-imports using barrelsby")

32 .action(() => {

33 const rootDir = process.cwd();

34 const configPath = path.join(rootDir, "barrels.json");

35 if (!fs.existsSync(configPath)) {

36 logger.error("barrels.json config file not found at project root");

37 process.exit(1);

38 }

39 logger.info("Generating barrels...");

40 try {

41 execSync("npx barrelsby -c barrels.json", { cwd: rootDir, stdio: "inherit" });

42 logger.info("Barrels successfully generated!");

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/commands/cli.jsView on unpkg · L40

43 process.exit(0);

44 }

45 catch (err) {

46 logger.error(`Failed to generate barrels: ${err}`);

47 process.exit(1);

48 }

49});

50// =====================================>

51// ## Command: watch:barrels (file watcher)

52// =====================================>

53export const watchBarrelsCommand = new Command("watch:barrels")

54 .description("Watch directories and update barrels automatically on file changes")

55 .action(async () => {

56 const rootDir = process.cwd();

57 const configPath = path.join(rootDir, "barrels.json");

58 if (!fs.existsSync(configPath)) {

59 logger.error("barrels.json config file not found at project root");

60 process.exit(1);