registry / @slope-dev/slope / 1.61.0

@slope-dev/slope@1.61.0

Quantified sprint metrics for AI-assisted development. Scorecards, handicap tracking, and real-time agent guidance for Claude Code, Cursor, Windsurf, Cline, and OpenCode.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 270 file(s), 2.33 MB of source, external domains: api.github.com, cli.github.com, github.com, opencode.ai, raw.githubusercontent.com

Source & flagged code

5 flagged

dist/core/analyzers/git.jsView file

Lines 1-21javascript

1// SLOPE — Git History Analyzer: commits, contributors, cadence, branches, releases

2import { execSync } from 'node:child_process';

3function git(cmd, cwd) {

High

Child Process

Package source references child process execution.

dist/core/analyzers/git.jsView on unpkg · L1

4 try {

5 return execSync(`git ${cmd}`, { cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 10000 }).trim();

6 }

7 catch {

8 return '';

9 }

10}

11function isSprintRangeEndpoint(line, matchStart, matchEnd) {

12 const before = line.slice(0, matchStart);

13 const after = line.slice(matchEnd);

14 return /S\d+\s*[-\u2013\u2014]\s*$/.test(before) || /^\s*[-\u2013\u2014]\s*S\d+\b/.test(after);

15}

16const MAX_SHIPPED_TICKET_SUFFIX = 99;

17const IMPLEMENTATION_COMMIT_TYPES = new Set(['feat', 'fix', 'refactor', 'perf', 'test']);

18const PLANNING_REFERENCE_SCOPES = new Set(['roadmap', 'plan', 'planning']);

20function isCommitType(value) {

21 if (value.length === 0)

dist/cli/store.jsView file

Lines 14-54javascript

14 const parsed = new URL(url);

15 if (parsed.password)

16 parsed.password = '***';

17 sanitizedUrl = parsed.toString();

18 }

19 catch {

dist/mcp/sandbox.jsView file

Lines 15-55javascript

15 if (resolved !== cwd && !resolved.startsWith(cwd + path.sep)) {

16 throw new Error(`Path escape blocked: "${p}" resolves outside project root`);

17 }

18 return resolved;

19}

20/**

dist/cli/template-generator.jsView file

Lines 339-379javascript

339- Push after each ticket and every 30 minutes

340- Format: \`<type>(<ticket>): <summary>\` (feat/fix/refactor/docs/test/chore)

341

342## Codebase Map

343

344SLOPE maintains a codebase map at \`CODEBASE.md\` (~5k tokens). Read it before exploring.

345- Run \`slope map\` to generate/update

346

templates/claude-code/hooks/pre-merge-check.shView file

•path = templates/claude-code/hooks/pre-merge-check.sh kind = build_helper sizeBytes = 1281 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/claude-code/hooks/pre-merge-check.shView on unpkg

Source & flagged code

5 flagged · loading source

dist/core/analyzers/git.jsView file

1// SLOPE — Git History Analyzer: commits, contributors, cadence, branches, releases L2: import { execSync } from 'node:child_process'; L3: function git(cmd, cwd) {

High

Child Process

Package source references child process execution.

dist/core/analyzers/git.jsView on unpkg · L1

dist/cli/store.jsView file

34if (storeType === 'sqlite') { L35: const { createStore } = await import('../store/index.js'); L36: return createStore({ storePath: config.store_path ?? '.slope/slope.db', cwd });

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/cli/store.jsView on unpkg · L34

dist/mcp/sandbox.jsView file

35return { recurring_patterns: [] }; L36: return JSON.parse(fs.readFileSync(filePath, 'utf8')); L37: };

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

dist/mcp/sandbox.jsView on unpkg · L35

dist/cli/template-generator.jsView file

359import { existsSync, readFileSync } from 'node:fs'; L360: import { execSync } from 'node:child_process'; L361: import { join } from 'node:path'; L362: L363: // Resolve slope binary: project node_modules → SLOPE dev dist → global PATH → npx fallback L364: function resolveSlopeBin() {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli/template-generator.jsView on unpkg · L359

templates/claude-code/hooks/pre-merge-check.shView file

•path = templates/claude-code/hooks/pre-merge-check.sh kind = build_helper sizeBytes = 1281 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/claude-code/hooks/pre-merge-check.shView on unpkg

Findings

3 High6 Medium5 Low

HighChild Processdist/core/analyzers/git.js

HighShell

HighRuntime Package Installdist/cli/template-generator.js

MediumDynamic Requiredist/cli/store.js

MediumUnsafe Vm Contextdist/mcp/sandbox.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helpertemplates/claude-code/hooks/pre-merge-check.sh

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

dist/core/analyzers/git.jsView file

Lines 1-21javascript

1// SLOPE — Git History Analyzer: commits, contributors, cadence, branches, releases

2import { execSync } from 'node:child_process';

3function git(cmd, cwd) {

High

Child Process

Package source references child process execution.

dist/core/analyzers/git.jsView on unpkg · L1

4 try {

5 return execSync(`git ${cmd}`, { cwd, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], timeout: 10000 }).trim();

6 }

7 catch {

8 return '';

9 }

10}

11function isSprintRangeEndpoint(line, matchStart, matchEnd) {

12 const before = line.slice(0, matchStart);

13 const after = line.slice(matchEnd);

14 return /S\d+\s*[-\u2013\u2014]\s*$/.test(before) || /^\s*[-\u2013\u2014]\s*S\d+\b/.test(after);

15}

16const MAX_SHIPPED_TICKET_SUFFIX = 99;

17const IMPLEMENTATION_COMMIT_TYPES = new Set(['feat', 'fix', 'refactor', 'perf', 'test']);

18const PLANNING_REFERENCE_SCOPES = new Set(['roadmap', 'plan', 'planning']);

20function isCommitType(value) {

21 if (value.length === 0)

dist/cli/store.jsView file

Lines 14-54javascript

14 const parsed = new URL(url);

15 if (parsed.password)

16 parsed.password = '***';

17 sanitizedUrl = parsed.toString();

18 }

19 catch {

dist/mcp/sandbox.jsView file

Lines 15-55javascript

15 if (resolved !== cwd && !resolved.startsWith(cwd + path.sep)) {

16 throw new Error(`Path escape blocked: "${p}" resolves outside project root`);

17 }

18 return resolved;

19}

20/**

dist/cli/template-generator.jsView file

Lines 339-379javascript

339- Push after each ticket and every 30 minutes

340- Format: \`<type>(<ticket>): <summary>\` (feat/fix/refactor/docs/test/chore)

341

342## Codebase Map

343

344SLOPE maintains a codebase map at \`CODEBASE.md\` (~5k tokens). Read it before exploring.

345- Run \`slope map\` to generate/update

346

templates/claude-code/hooks/pre-merge-check.shView file

•path = templates/claude-code/hooks/pre-merge-check.sh kind = build_helper sizeBytes = 1281 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/claude-code/hooks/pre-merge-check.shView on unpkg