registry / @skill-map/cli / 0.74.0

@skill-map/cli@0.74.0

⚠ Under review

skill-map reference implementation — kernel + CLI + adapters.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 44 file(s), 4.75 MB of source, external domains: agentskills.io, angular.dev, antigravity.google, browser.sentry-cdn.com, code.claude.com, developers.codex.com, docs.rs, docs.sentry.io, eu.i.posthog.com, example.com, fonts.googleapis.com, github.com, json-schema.org, nodejs.org, o447951.ingest.sentry.io, opencode.ai, registry.npmjs.org, sentry.io, skill-map.ai, spotlightjs.com, sqlitebrowser.org, www.npmjs.com, www.w3.org, yandex.com

Source & flagged code

7 flagged

dist/ui/chunk-3ANNEMV4.jsView file

Lines 1-30javascript

1import{a as Em,b as Tm,c as ym,d as Im,e as bm,i as Am}from"./chunk-KHDWXSGR.js";import{c as Sm}from"./chunk-Z7SOKILO.js";import"./chunk-7WMT2LX4.js";import{$a as hm,F as Ma,G as Tl,K as yl,L as dm,O as Il,Sa as _m,_a as gm,a as pm,ma as mm,u as Oa}from"./chunk-EJVWTBMV.js";import{a as p,b as E,d as zt,f as fm}from"./chunk-ZRJ5ZCFR.js";var A=typeof __SENTRY_DEBUG__>"u"||__SENTRY_DEBUG__;var C=globalThis;var Lt="10.61.0";function lt(){return fr(C),C}function fr(e){let t=e.__SENTRY__=e.__SENTRY__||{};return t.version=t.version||Lt,t[Lt]=t[Lt]||{}}function an(e,t,n=C){let r=n.__SENTRY__=n.__SENTR ...

2`);for(let a=r;a<s.length;a++){let c=s[a];c.length>1024&&(c=c.slice(0,1024));let u=Rm.test(c)?c.replace(Rm,"$1"):c;if(!u.includes("Error: ")){for(let f of t){let l=f(u);if(l){i.push(l);break}}if(i.length>=50+o)break}}return Rl(i.slice(o))}}function Pa(e){return Array.isArray(e)?Qi(...e):e}function Rl(e){if(!e.length)return[];let t=Array.from(e);return/sentryWrapped/.test(La(t).function||"")&&t.pop(),t.reverse(),Nm.test(La(t).function||"")&&(t.pop(),Nm.test(La(t).function||"")&&t.pop()),t.slice(0,50).map(n=>E(p({},n),{filename:n.filename||La(t).filename,function:n.function||"?"}))}function La(e ...

3Type: ${e}

4Name: ${ft(r)}

5Error:`,o)}}var Nl=null;function es(e){let t="error";tt(t,e),nt(t,hI)}function hI(){Nl=C.onerror,C.onerror=function(e,t,n,r,o){return We("error",{column:r,error:o,line:n,msg:e,url:t}),Nl?

6${JSON.stringify(s)}

7`),typeof a=="string"||a instanceof Uint8Array)o(a);else{let c;try{c=JSON.stringify(a)}catch{c=JSON.stringify(Se(a))}o(c)}}return typeof r=="string"?r:KI(r)}function KI(e){let t=e.reduce((o,i)=>o+i.length,0),n=new Uint8Array(t),r=0;for(let o of e)n.set(o,r),r+=o.length;return n}function gc(e){let t=typeof e=="string"?_c(e):e;function n(s){let a=t.subarray(0,s);return t=t.subarray(s+1),a}function r(){let s=t.indexOf(10);return s<0&&(s=t.length),JSON.parse(VI(n(s)))}let o=r(),i=[];for(;t.length;){let s=r(),a=typeof s.length=="number"?s.length:void 0;i.push([s,a?n(a):r()])}return[o,i]}function hc ...

8 ${u.join(`

9 `)}`)}function y_(e){if(!A)return;let{description:t="< unknown name >",op:n="< unknown op >"}=P(e),{spanId:r}=e.spanContext(),i=oe(e)===e,s=`[Tracing] Finishing "${n}" ${i?"root ":""}span "${

10Reason: ${d}`))})}_process(t,n){this._numProcessing++,this._promiseBuffer.add(t).then(r=>(this._numProcessing--,r),r=>(this._numProcessing--,r===oi&&this.recordDroppedEvent("queue_overflow",n),r))}_clearOutcomes(){let t=this._outcomes;return this._outcomes={},Object.entries(t).map(([n,r])=>{let[o,i]=n.split(":");return{reason:o,category:i,quantity:r}})}_flushOutcomes(){A&&g.log("Flushing outcomes...");let t=this._clearOutcomes();if(t.length===0){A&&g.log("No outcomes to send");return}if(!this._dsn){A&&g.log("No dsn provided, will not send outcomes");return}A&&g.log("Sending outcomes:",t);let n ...

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/ui/chunk-3ANNEMV4.jsView on unpkg · L10

11Event: ${fn(e)}`),!0}else{if(pA(e,t.ignoreErrors))return A&&g.warn(`Event dropped due to being matched by \`ignoreErrors\` option.

12Event: ${fn(e)}`),!0;if(hA(e))return A&&g.warn(`Event dropped due to not having an error message, error type or stacktrace.

13Event: ${fn(e)}`),!0;if(mA(e,t.denyUrls))return A&&g.warn(`Event dropped due to being matched by \`denyUrls\` option.

14Event: ${fn(e)}.

15Url: ${Oc(e)}`),!0;if(!_A(e,t.allowUrls))return A&&g.warn(`Event dropped due to not being matched by \`allowUrls\` option.

16Event: ${fn(e)}.

17Url: ${Oc(e)}`),!0}return!1}function pA(e,t){return t?.length?wc(e).some(n=>ze(n,t)):!1}function dA(e,t){if(!t?.length)return!1;

18${o.stack}`:"unknown"}})})}}var rv=(e={})=>{let t=e.limit??JA;return{name:XA,processEvent(n,r){return nv(t,e.saveZodIssuesAsAttachment,n,r)}}},Kg=rv;var Xg=e=>({name:"ThirdPartyErrorsFilter",setup(t){t.on("beforeEnvelope",n=>{vt(n,(r,o)=>{if(o==="event"){let i=Array.isArray(r)?r[1]:void 0;i&&(Uc(i),r[1]=i)}})}),t.on("applyFrameMetadata",n=>{if(n.type)return;let r=t.getOptions().stackParser;Pc(r,n)})},preprocessEvent(t){e.ignoreSentryInternalFrames&&(C._sentryWrappedDepth??0)>0&&(t.sdkProcessingMetadata=E(p({},t.sdkProcessingMetadata),{insideSentryWrapped:!0}))},processEvent(t){let n=e.ignoreSe ...

19.widget__actor {

20 position: fixed;

21 z-index: var(--z-index);

22 margin: var(--page-margin);

23 inset: var(--actor-inset);

25 display: flex;

26 align-items: center;

27 gap: 8px;

28 padding: 16px;

30 font-family: inherit;

Long lines were clipped for display.

dist/ui/chunk-6FGV5O5J.jsView file

Lines 1-2javascript

1import{a as S,b as z,e as vt,f as Fe,h as Y,i as me,j as ne}from"./chunk-5RNLC6V4.js";import{H as E,K as Tt}from"./chunk-EJVWTBMV.js";import{a as fe,d as Et}from"./chunk-ZRJ5ZCFR.js";function bt

dist/ui/chunk-EVNCL7FV.jsView file

1import{a as Yn,b as Xn,d as Bv,e as Vv,f as zv,g as Gv,h as jv,i as ho}from"./chunk-3U4QZKU2.js";import{A as tb,B as nb,C as ib,D as ob,E as Zn,J as rb,L as ab,M as sb,N as Uh,O as... L2: .p-datatable {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ui/chunk-EVNCL7FV.jsView on unpkg · L1

dist/index.jsView file

Lines 2766-2806javascript

2766 analyzerId: "frontmatter-invalid",

2767 severity: strict ? "error" : "warn",

2768 nodeIds: [path],

2769 message: tx(ORCHESTRATOR_TEXTS.frontmatterInvalid, { path, kind, errors: result.errors }),

2770 data: { kind, errors: result.errors }

dist/cli.jsView file

208Cross-file remote execution chain: dist/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution. L208: ...event.jobId !== void 0 ? { jobId: event.jobId } : {}, L209: data: event.data L210: } ... L249: L250: // package.json L251: var package_default = { ... L256: type: "module", L257: homepage: "https://skill-map.ai", L258: repository: { ... L317: "pretest:coverage:html": "tsup", L318: test: "tsc --noEmit && SKILL_MAP_TELEMETRY=0 SM_NO_UPDATE_CHECK=1 node --import tsx --test --test-reporter=./scripts/test-reporter.js --test-reporter-destination=stdout '__tests__/... L319: "test:ci": "FORCE_COLOR=1 SKILL_MAP_TELEMETRY=0 SM_NO_UPDATE_CHECK=1 node --import tsx --test --test-reporter=./scripts/test-reporter.js --test-reporter-destination=stdout '__tests...

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L208

dist/ui/media/fa-brands-400-AHOAZHCU.woff2View file

•path = dist/ui/media/fa-brands-400-AHOAZHCU.woff2 kind = high_entropy_blob sizeBytes = 110088 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/media/fa-brands-400-AHOAZHCU.woff2View on unpkg

Source & flagged code

7 flagged · loading source

dist/ui/chunk-3ANNEMV4.jsView file

10patternName = generic_password severity = medium line = 10 matchedText = Reason: ...ion.

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/ui/chunk-3ANNEMV4.jsView on unpkg · L10

dist/ui/chunk-6FGV5O5J.jsView file

1import{a as S,b as z,e as vt,f as Fe,h as Y,i as me,j as ne}from"./chunk-5RNLC6V4.js";import{H as E,K as Tt}from"./chunk-EJVWTBMV.js";import{a as fe,d as Et}from"./chunk-ZRJ5ZCFR.j...

High

Child Process

Package source references child process execution.

dist/ui/chunk-6FGV5O5J.jsView on unpkg · L1

dist/ui/chunk-EVNCL7FV.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ui/chunk-EVNCL7FV.jsView on unpkg · L1

dist/index.jsView file

2786contains invisible/control Unicode U+FEFF (zero width no-break space) if (/^<U+FEFF>---\r?\n[\s\S]*?[A-Za-z0-9_-]+\s*:/.test(body)) {

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/index.jsView on unpkg · L2786

•Trigger-reachable chain: manifest.exports -> dist/index.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/index.jsView on unpkg

dist/cli.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L208

dist/ui/media/fa-brands-400-AHOAZHCU.woff2View file

•path = dist/ui/media/fa-brands-400-AHOAZHCU.woff2 kind = high_entropy_blob sizeBytes = 110088 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/media/fa-brands-400-AHOAZHCU.woff2View on unpkg

Findings

2 Critical4 High5 Medium6 Low

CriticalTrojan Source Unicodedist/index.js

CriticalTrigger Reachable Dangerous Capabilitydist/index.js

HighChild Processdist/ui/chunk-6FGV5O5J.js

HighShell

HighCross File Remote Execution Contextdist/cli.js

HighShips High Entropy Blobdist/ui/media/fa-brands-400-AHOAZHCU.woff2

MediumSecret Patterndist/ui/chunk-3ANNEMV4.js

MediumDynamic Requiredist/ui/chunk-EVNCL7FV.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

Source & flagged code

7 flagged

dist/ui/chunk-3ANNEMV4.jsView file

Lines 1-30javascript

3Type: ${e}

4Name: ${ft(r)}

5Error:`,o)}}var Nl=null;function es(e){let t="error";tt(t,e),nt(t,hI)}function hI(){Nl=C.onerror,C.onerror=function(e,t,n,r,o){return We("error",{column:r,error:o,line:n,msg:e,url:t}),Nl?

6${JSON.stringify(s)}

8 ${u.join(`

9 `)}`)}function y_(e){if(!A)return;let{description:t="< unknown name >",op:n="< unknown op >"}=P(e),{spanId:r}=e.spanContext(),i=oe(e)===e,s=`[Tracing] Finishing "${n}" ${i?"root ":""}span "${

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/ui/chunk-3ANNEMV4.jsView on unpkg · L10

11Event: ${fn(e)}`),!0}else{if(pA(e,t.ignoreErrors))return A&&g.warn(`Event dropped due to being matched by \`ignoreErrors\` option.

12Event: ${fn(e)}`),!0;if(hA(e))return A&&g.warn(`Event dropped due to not having an error message, error type or stacktrace.

13Event: ${fn(e)}`),!0;if(mA(e,t.denyUrls))return A&&g.warn(`Event dropped due to being matched by \`denyUrls\` option.

14Event: ${fn(e)}.

15Url: ${Oc(e)}`),!0;if(!_A(e,t.allowUrls))return A&&g.warn(`Event dropped due to not being matched by \`allowUrls\` option.

16Event: ${fn(e)}.

17Url: ${Oc(e)}`),!0}return!1}function pA(e,t){return t?.length?wc(e).some(n=>ze(n,t)):!1}function dA(e,t){if(!t?.length)return!1;

19.widget__actor {

20 position: fixed;

21 z-index: var(--z-index);

22 margin: var(--page-margin);

23 inset: var(--actor-inset);

25 display: flex;

26 align-items: center;

27 gap: 8px;

28 padding: 16px;

30 font-family: inherit;

Long lines were clipped for display.

dist/ui/chunk-6FGV5O5J.jsView file

Lines 1-2javascript

1import{a as S,b as z,e as vt,f as Fe,h as Y,i as me,j as ne}from"./chunk-5RNLC6V4.js";import{H as E,K as Tt}from"./chunk-EJVWTBMV.js";import{a as fe,d as Et}from"./chunk-ZRJ5ZCFR.js";function bt

dist/ui/chunk-EVNCL7FV.jsView file

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ui/chunk-EVNCL7FV.jsView on unpkg · L1

dist/index.jsView file

Lines 2766-2806javascript

2766 analyzerId: "frontmatter-invalid",

2767 severity: strict ? "error" : "warn",

2768 nodeIds: [path],

2769 message: tx(ORCHESTRATOR_TEXTS.frontmatterInvalid, { path, kind, errors: result.errors }),

2770 data: { kind, errors: result.errors }

dist/cli.jsView file

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L208

dist/ui/media/fa-brands-400-AHOAZHCU.woff2View file

•path = dist/ui/media/fa-brands-400-AHOAZHCU.woff2 kind = high_entropy_blob sizeBytes = 110088 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/media/fa-brands-400-AHOAZHCU.woff2View on unpkg