registry / @skill-map/cli / 0.88.0

@skill-map/cli@0.88.0

skill-map reference implementation: kernel + CLI + adapters.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

ManifestNo manifest risk signals triggered.

scanned 42 file(s), 5.01 MB of source, external domains: agentskills.io, angular.dev, antigravity.google, browser.sentry-cdn.com, code.claude.com, developers.codex.com, docs.rs, docs.sentry.io, eu.i.posthog.com, example.com, fonts.googleapis.com, github.com, json-schema.org, nodejs.org, o447951.ingest.sentry.io, opencode.ai, registry.npmjs.org, sentry.io, skill-map.ai, spotlightjs.com, sqlitebrowser.org, www.npmjs.com, www.w3.org, yandex.com

Source & flagged code

6 flagged

dist/ui/chunk-WYPNAAQQ.jsView file

Lines 1-30javascript

1import{a as Em,b as Tm,c as ym,d as Im,e as bm,i as Am}from"./chunk-PK2BLIA2.js";import{b as Sm}from"./chunk-OFYH7UPP.js";import"./chunk-EGO2EFC5.js";import{H as Ma,I as Tl,M as yl,N

Source & flagged code

6 flagged · loading source

dist/ui/chunk-WYPNAAQQ.jsView file

10patternName = generic_password severity = medium line = 10 matchedText = Reason: ...ion.

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/ui/chunk-WYPNAAQQ.jsView on unpkg · L10

dist/ui/chunk-MQSU6EFZ.jsView file

1import{e as A,g as li}from"./chunk-ZRJ5ZCFR.js";var fn=A((fr,_n)=>{"use strict";function an(e){return e instanceof Map?e.clear=e.delete=e.set=function(){throw new Error("map is rea... L2: https://github.com/highlightjs/highlight.js/issues/2277`),x=l,w=m),p===void 0&&(p=!0);let P={code:w,language:x};K("before:highlight",P);let $=P.result?P.result:f(P.language,P.code,...

High

Child Process

Package source references child process execution.

dist/ui/chunk-MQSU6EFZ.jsView on unpkg · L1

dist/cli.jsView file

468type: "string", L469: enum: ["bash", "powershell"], L470: description: "Shell flavor for any embedded shell snippets. Default: `bash`."

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L468

208Cross-file remote execution chain: dist/cli.js spawns dist/index.js; helper contains network access plus dynamic code execution. L208: ...event.jobId !== void 0 ? { jobId: event.jobId } : {}, L209: data: event.data L210: } ... L249: L250: // package.json L251: var package_default = { ... L256: type: "module", L257: homepage: "https://skill-map.ai", L258: repository: { ... L317: "pretest:coverage:html": "tsup", L318: test: "tsc --noEmit && SKILL_MAP_TELEMETRY=0 SM_NO_UPDATE_CHECK=1 node --import tsx --test --test-reporter=./scripts/test-reporter.js --test-reporter-destination=stdout '__tests__/... L319: "test:ci": "FORCE_COLOR=1 SKILL_MAP_TELEMETRY=0 SM_NO_UPDATE_CHECK=1 node --import tsx --test --test-reporter=./scripts/test-reporter.js --test-reporter-destination=stdout '__tests...

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L208

dist/ui/chunk-EU7E3QAW.jsView file

1import{a as ni,b as ii,d as tb,e as nb,f as ib,g as ob,h as rb,i as oi}from"./chunk-VSWHTO7A.js";import{A as _b,B as ks,C as gb,D as vb,E as bb,F as yb,G as ri,L as Cb,M as xb,O as... L2: .p-datatable {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/ui/chunk-EU7E3QAW.jsView on unpkg · L1

dist/ui/media/fa-brands-400-AHOAZHCU.woff2View file

•path = dist/ui/media/fa-brands-400-AHOAZHCU.woff2 kind = high_entropy_blob sizeBytes = 110088 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

dist/ui/media/fa-brands-400-AHOAZHCU.woff2View on unpkg

Findings

4 High5 Medium6 Low

HighChild Processdist/ui/chunk-MQSU6EFZ.js

HighShelldist/cli.js

HighCross File Remote Execution Contextdist/cli.js

HighShips High Entropy Blobdist/ui/media/fa-brands-400-AHOAZHCU.woff2

MediumSecret Patterndist/ui/chunk-WYPNAAQQ.js

MediumDynamic Requiredist/ui/chunk-EU7E3QAW.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

dist/ui/chunk-MQSU6EFZ.jsView file

Lines 1-6javascript

1import{e as A,g as li}from"./chunk-ZRJ5ZCFR.js";var fn=A((fr,_n)=>{"use strict";function an(e){return e instanceof Map?e.clear=e.delete=e.set=function(){throw new Error("map is read-only")}:e instanceof Set&&(e.add=e.clear=e.delete=function(){throw new Error("set is read-only")}),Object.freeze(e),Object.getOwnPropertyNames(e).forEach(n=>{let t=e[n],i=typeof t;(i==="object"||i==="function")&&!Object.isFrozen(t)&&an(t)}),e}var we=class{constructor(n){n.data===void 0&&(n.data={}),this.data=n.data,this.isMatchIgnored=!1}ignoreMatch(){this.isMatchIgnored=!0}};function rn(e){return e.replace(/&/g,"& ...

2https://github.com/highlightjs/highlight.js/issues/2277`),x=l,w=m),p===void 0&&(p=!0);let P={code:w,language:x};K("before:highlight",P);let $=P.result?P.result:f(P.language,P.code,p);return $.code=P.code,K("after:highlight",$),$}function f(l,m,p,w){let x=Object.create(null);function P(g,E){return g.keywords[E]}function $(){if(!y.keywords){q.addText(F);return}let g=0;y.keywordPatternRe.lastIndex=0;let E=y.keywordPatternRe.exec(F),O="";for(;E;){O+=F.substring(g,E.index);let D=j.case_insensitive?E[0].toLowerCase():E[0],W=P(y,D);if(W){let[ie,si]=W;if(q.addText(O),O="",x[D]=(x[D]||0)+1,x[D]<=Ji&&(T ...

High

Child Process

Package source references child process execution.

dist/ui/chunk-MQSU6EFZ.jsView on unpkg · L1

3`,1;if(Pe>1e5&&Pe>E.index*3)throw new Error("potential infinite loop, way more iterations than matches");return F+=O,O.length}let j=L(l);if(!j)throw se(u.replace("{}",l)),new Error('Unknown language: "'+l+'"');let B=Xi(j),ae="",y=w||B,ye={},q=new a.__emitter(a);Ue();let F="",Te=0,oe=0,Pe=0,Fe=!1;try{if(j.__emitTokens)j.__emitTokens(m,q);else{for(y.matcher.considerAll();;){Pe++,Fe?Fe=!1:y.matcher.considerAll(),y.matcher.lastIndex=oe;let g=y.matcher.exec(m);if(!g)break;let E=m.substring(oe,g.index),O=Ne(E,g);oe=g.index+O}Ne(m.substring(oe))}return q.finalize(),ae=q.toHTML(),{language:l,value:ae, ...

4`},c]}}et.exports=Aa});var rt=A((Lr,at)=>{"use strict";var Ra=e=>({IMPORTANT:{scope:"meta",begin:"!important"},BLOCK_COMMENT:e.C_BLOCK_COMMENT_MODE,HEXCOLOR:{scope:"number",begin:/#(([0-9a-fA-F]{3,4})|(([0-9a-fA-F]{2}){3,4}))\b/},FUNCTION_DISPATCH:{className:"built_in",begin:/[\w-]

5]`,S={scope:"string",variants:[d,c,f,b]},h={scope:"number",variants:[{begin:"\\b0[bB][01]+(?:_[01]+)*\\b"},{begin:"\\b0[oO][0-7]+(?:_[0-7]+)*\\b"},{begin:"\\b0[xX][\\da-fA-F]+(?:_[\\da-fA-F]+)*\\b"},{begin:"(?:\\b\\d+(?:_\\d+)*(\\.(?:\\d+(?:_\\d+)*))?|\\B\\.\\d+)(?:[eE][+-]?\\d+)?"}],relevance:0},N=["false","null","true"],T=["__CLASS__","__DIR__","__FILE__","__FUNCTION__","__COMPILER_HALT_OFFSET__","__LINE__","__METHOD__","__NAMESPACE__","__TRAIT__","die","echo","exit","include","include_once","print","require","require_once","array","abstract","and","as","binary","bool","boolean","break","cal ...

Long lines were clipped for display.

dist/cli.jsView file

468type: "string", L469: enum: ["bash", "powershell"], L470: description: "Shell flavor for any embedded shell snippets. Default: `bash`."

High

Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L468

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/cli.jsView on unpkg · L208