registry / @skill-map/cli / 0.88.0

@skill-map/cli@0.88.0

skill-map reference implementation: kernel + CLI + adapters.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 42 file(s), 5.01 MB of source, external domains: agentskills.io, angular.dev, antigravity.google, browser.sentry-cdn.com, code.claude.com, developers.codex.com, docs.rs, docs.sentry.io, eu.i.posthog.com, example.com, fonts.googleapis.com, github.com, json-schema.org, nodejs.org, o447951.ingest.sentry.io, opencode.ai, registry.npmjs.org, sentry.io, skill-map.ai, spotlightjs.com, sqlitebrowser.org, www.npmjs.com, www.w3.org, yandex.com

Source & flagged code

6 flagged

dist/ui/chunk-WYPNAAQQ.jsView file

Lines 1-30javascript

1import{a as Em,b as Tm,c as ym,d as Im,e as bm,i as Am}from"./chunk-PK2BLIA2.js";import{b as Sm}from"./chunk-OFYH7UPP.js";import"./chunk-EGO2EFC5.js";import{H as Ma,I as Tl,M as yl,N as dm,Q as Il,Sa as _m,Za as gm,_a as hm,a as pm,na as mm,v as Oa}from"./chunk-CDTYA42L.js";import{a as p,b as E,d as zt,f as fm}from"./chunk-ZRJ5ZCFR.js";var A=typeof __SENTRY_DEBUG__>"u"||__SENTRY_DEBUG__;var C=globalThis;var Lt="10.61.0";function lt(){return fr(C),C}function fr(e){let t=e.__SENTRY__=e.__SENTRY__||{};return t.version=t.version||Lt,t[Lt]=t[Lt]||{}}function an(e,t,n=C){let r=n.__SENTRY__=n.__SENTR ...

2`);for(let a=r;a<s.length;a++){let c=s[a];c.length>1024&&(c=c.slice(0,1024));let u=Rm.test(c)?c.replace(Rm,"$1"):c;if(!u.includes("Error: ")){for(let f of t){let l=f(u);if(l){i.push(l);break}}if(i.length>=50+o)break}}return Rl(i.slice(o))}}function Pa(e){return Array.isArray(e)?Qi(...e):e}function Rl(e){if(!e.length)return[];let t=Array.from(e);return/sentryWrapped/.test(La(t).function||"")&&t.pop(),t.reverse(),Nm.test(La(t).function||"")&&(t.pop(),Nm.test(La(t).function||"")&&t.pop()),t.slice(0,50).map(n=>E(p({},n),{filename:n.filename||La(t).filename,function:n.function||"?"}))}function La(e ...

3Type: ${e}

4Name: ${ft(r)}

5Error:`,o)}}var Nl=null;function es(e){let t="error";tt(t,e),nt(t,hI)}function hI(){Nl=C.onerror,C.onerror=function(e,t,n,r,o){return We("error",{column:r,error:o,line:n,msg:e,url:t}),Nl?

6${JSON.stringify(s)}

7`),typeof a=="string"||a instanceof Uint8Array)o(a);else{let c;try{c=JSON.stringify(a)}catch{c=JSON.stringify(Se(a))}o(c)}}return typeof r=="string"?r:KI(r)}function KI(e){let t=e.reduce((o,i)=>o+i.length,0),n=new Uint8Array(t),r=0;for(let o of e)n.set(o,r),r+=o.length;return n}function gc(e){let t=typeof e=="string"?_c(e):e;function n(s){let a=t.subarray(0,s);return t=t.subarray(s+1),a}function r(){let s=t.indexOf(10);return s<0&&(s=t.length),JSON.parse(VI(n(s)))}let o=r(),i=[];for(;t.length;){let s=r(),a=typeof s.length=="number"?s.length:void 0;i.push([s,a?n(a):r()])}return[o,i]}function hc ...

8 ${u.join(`

9 `)}`)}function y_(e){if(!A)return;let{description:t="< unknown name >",op:n="< unknown op >"}=P(e),{spanId:r}=e.spanContext(),i=oe(e)===e,s=`[Tracing] Finishing "${n}" ${i?"root ":""}span "${

10Reason: ${d}`))})}_process(t,n){this._numProcessing++,this._promiseBuffer.add(t).then(r=>(this._numProcessing--,r),r=>(this._numProcessing--,r===oi&&this.recordDroppedEvent("queue_overflow",n),r))}_clearOutcomes(){let t=this._outcomes;return this._outcomes={},Object.entries(t).map(([n,r])=>{let[o,i]=n.split(":");return{reason:o,category:i,quantity:r}})}_flushOutcomes(){A&&g.log("Flushing outcomes...");let t=this._clearOutcomes();if(t.length===0){A&&g.log("No outcomes to send");return}if(!this._dsn){A&&g.log("No dsn provided, will not send outcomes");return}A&&g.log("Sending outcomes:",t);let n ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/ui/chunk-WYPNAAQQ.jsView on unpkg · L10

11Event: ${fn(e)}`),!0}else{if(pA(e,t.ignoreErrors))return A&&g.warn(`Event dropped due to being matched by \`ignoreErrors\` option.

12Event: ${fn(e)}`),!0;if(hA(e))return A&&g.warn(`Event dropped due to not having an error message, error type or stacktrace.

13Event: ${fn(e)}`),!0;if(mA(e,t.denyUrls))return A&&g.warn(`Event dropped due to being matched by \`denyUrls\` option.

14Event: ${fn(e)}.

15Url: ${Oc(e)}`),!0;if(!_A(e,t.allowUrls))return A&&g.warn(`Event dropped due to not being matched by \`allowUrls\` option.

16Event: ${fn(e)}.

17Url: ${Oc(e)}`),!0}return!1}function pA(e,t){return t?.length?wc(e).some(n=>ze(n,t)):!1}function dA(e,t){if(!t?.length)return!1;

18${o.stack}`:"unknown"}})})}}var rv=(e={})=>{let t=e.limit??JA;return{name:XA,processEvent(n,r){return nv(t,e.saveZodIssuesAsAttachment,n,r)}}},Kg=rv;var Xg=e=>({name:"ThirdPartyErrorsFilter",setup(t){t.on("beforeEnvelope",n=>{vt(n,(r,o)=>{if(o==="event"){let i=Array.isArray(r)?r[1]:void 0;i&&(Uc(i),r[1]=i)}})}),t.on("applyFrameMetadata",n=>{if(n.type)return;let r=t.getOptions().stackParser;Pc(r,n)})},preprocessEvent(t){e.ignoreSentryInternalFrames&&(C._sentryWrappedDepth??0)>0&&(t.sdkProcessingMetadata=E(p({},t.sdkProcessingMetadata),{insideSentryWrapped:!0}))},processEvent(t){let n=e.ignoreSe ...

19.widget__actor {

20 position: fixed;

21 z-index: var(--z-index);

22 margin: var(--page-margin);

23 inset: var(--actor-inset);

25 display: flex;

26 align-items: center;

27 gap: 8px;

28 padding: 16px;

30 font-family: inherit;

Long lines were clipped for display.

dist/ui/chunk-MQSU6EFZ.jsView file

Lines 1-6javascript

1import{e as A,g as li}from"./chunk-ZRJ5ZCFR.js";var fn=A((fr,_n)=>{"use strict";function an(e){return e instanceof Map?e.clear=e.delete=e.set=function

dist/cli.jsView file

468type: "string", L469: enum: ["bash", "powershell"], L470: description: "Shell flavor for any embedded shell snippets. Default: `bash`."

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L468

208Cross-file remote execution chain: dist/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution. L208: ...event.jobId !== void 0 ? { jobId: event.jobId } : {}, L209: data: event.data L210: } ... L249: L250: // package.json L251: var package_default = { ... L256: type: "module", L257: homepage: "https://skill-map.ai", L258: repository: { ... L317: "pretest:coverage:html": "tsup", L318: test: "tsc --noEmit && SKILL_MAP_TELEMETRY=0 SM_NO_UPDATE_CHECK=1 node --import tsx --test --test-reporter=./scripts/test-reporter.js --test-reporter-destination=stdout '__tests__/... L319: "test:ci": "FORCE_COLOR=1 SKILL_MAP_TELEMETRY=0 SM_NO_UPDATE_CHECK=1 node --import tsx --test --test-reporter=./scripts/test-reporter.js --test-reporter-destination=stdout '__tests...

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L208

dist/ui/chunk-EU7E3QAW.jsView file

1import{a as ni,b as ii,d as tb,e as nb,f as ib,g as ob,h as rb,i as oi}from"./chunk-VSWHTO7A.js";import{A as _b,B as ks,C as gb,D as vb,E as bb,F as yb,G as ri,L as Cb,M as xb,O as... L2: .p-datatable {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ui/chunk-EU7E3QAW.jsView on unpkg · L1

dist/ui/media/fa-brands-400-AHOAZHCU.woff2View file

•path = dist/ui/media/fa-brands-400-AHOAZHCU.woff2 kind = high_entropy_blob sizeBytes = 110088 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/media/fa-brands-400-AHOAZHCU.woff2View on unpkg

Source & flagged code

6 flagged · loading source

dist/ui/chunk-WYPNAAQQ.jsView file

10patternName = generic_password severity = medium line = 10 matchedText = Reason: ...ion.

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/ui/chunk-WYPNAAQQ.jsView on unpkg · L10

dist/ui/chunk-MQSU6EFZ.jsView file

1import{e as A,g as li}from"./chunk-ZRJ5ZCFR.js";var fn=A((fr,_n)=>{"use strict";function an(e){return e instanceof Map?e.clear=e.delete=e.set=function(){throw new Error("map is rea... L2: https://github.com/highlightjs/highlight.js/issues/2277`),x=l,w=m),p===void 0&&(p=!0);let P={code:w,language:x};K("before:highlight",P);let $=P.result?P.result:f(P.language,P.code,...

High

Child Process

Package source references child process execution.

dist/ui/chunk-MQSU6EFZ.jsView on unpkg · L1

dist/cli.jsView file

468type: "string", L469: enum: ["bash", "powershell"], L470: description: "Shell flavor for any embedded shell snippets. Default: `bash`."

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L468

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L208

dist/ui/chunk-EU7E3QAW.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ui/chunk-EU7E3QAW.jsView on unpkg · L1

dist/ui/media/fa-brands-400-AHOAZHCU.woff2View file

•path = dist/ui/media/fa-brands-400-AHOAZHCU.woff2 kind = high_entropy_blob sizeBytes = 110088 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/media/fa-brands-400-AHOAZHCU.woff2View on unpkg

Findings

4 High5 Medium6 Low

HighChild Processdist/ui/chunk-MQSU6EFZ.js

HighShelldist/cli.js

HighCross File Remote Execution Contextdist/cli.js

HighShips High Entropy Blobdist/ui/media/fa-brands-400-AHOAZHCU.woff2

MediumSecret Patterndist/ui/chunk-WYPNAAQQ.js

MediumDynamic Requiredist/ui/chunk-EU7E3QAW.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

6 flagged

dist/ui/chunk-WYPNAAQQ.jsView file

Lines 1-30javascript

3Type: ${e}

4Name: ${ft(r)}

5Error:`,o)}}var Nl=null;function es(e){let t="error";tt(t,e),nt(t,hI)}function hI(){Nl=C.onerror,C.onerror=function(e,t,n,r,o){return We("error",{column:r,error:o,line:n,msg:e,url:t}),Nl?

6${JSON.stringify(s)}

8 ${u.join(`

9 `)}`)}function y_(e){if(!A)return;let{description:t="< unknown name >",op:n="< unknown op >"}=P(e),{spanId:r}=e.spanContext(),i=oe(e)===e,s=`[Tracing] Finishing "${n}" ${i?"root ":""}span "${

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/ui/chunk-WYPNAAQQ.jsView on unpkg · L10

11Event: ${fn(e)}`),!0}else{if(pA(e,t.ignoreErrors))return A&&g.warn(`Event dropped due to being matched by \`ignoreErrors\` option.

12Event: ${fn(e)}`),!0;if(hA(e))return A&&g.warn(`Event dropped due to not having an error message, error type or stacktrace.

13Event: ${fn(e)}`),!0;if(mA(e,t.denyUrls))return A&&g.warn(`Event dropped due to being matched by \`denyUrls\` option.

14Event: ${fn(e)}.

15Url: ${Oc(e)}`),!0;if(!_A(e,t.allowUrls))return A&&g.warn(`Event dropped due to not being matched by \`allowUrls\` option.

16Event: ${fn(e)}.

17Url: ${Oc(e)}`),!0}return!1}function pA(e,t){return t?.length?wc(e).some(n=>ze(n,t)):!1}function dA(e,t){if(!t?.length)return!1;

19.widget__actor {

20 position: fixed;

21 z-index: var(--z-index);

22 margin: var(--page-margin);

23 inset: var(--actor-inset);

25 display: flex;

26 align-items: center;

27 gap: 8px;

28 padding: 16px;

30 font-family: inherit;

Long lines were clipped for display.

dist/ui/chunk-MQSU6EFZ.jsView file

Lines 1-6javascript

1import{e as A,g as li}from"./chunk-ZRJ5ZCFR.js";var fn=A((fr,_n)=>{"use strict";function an(e){return e instanceof Map?e.clear=e.delete=e.set=function

dist/cli.jsView file

468type: "string", L469: enum: ["bash", "powershell"], L470: description: "Shell flavor for any embedded shell snippets. Default: `bash`."

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L468

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L208

dist/ui/chunk-EU7E3QAW.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ui/chunk-EU7E3QAW.jsView on unpkg · L1

dist/ui/media/fa-brands-400-AHOAZHCU.woff2View file

•path = dist/ui/media/fa-brands-400-AHOAZHCU.woff2 kind = high_entropy_blob sizeBytes = 110088 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/media/fa-brands-400-AHOAZHCU.woff2View on unpkg