registry / @solidactions/cli / 3.26.0
@solidactions/cli@3.26.0
⚠ Under reviewSolidActions CLI - Deploy and manage workflow automation
Static Scan Results
scanned 7d ago · by rust-scannerStatic analysis completed at 72.0% confidence. No malicious behavior was detected; 13 low-signal pattern(s) were surfaced and cleared.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsUrlStrings
Source & flagged code
5 flaggeddist/utils/source-provenance.jsView file
20const path_1 = __importDefault(require("path"));
L21: const child_process_1 = require("child_process");
L22: const form_data_1 = __importDefault(require("form-data"));
High
Child Process
Package source references child process execution.
dist/utils/source-provenance.jsView on unpkg · L20dist/commands/skill-run.jsView file
40* quote-stripping); joining those words back together with bare spaces and
L41: * handing them to `sh -c` would let the inner shell reinterpret any
L42: * metacharacters they contain (spaces, quotes, parens, `&&`, ...). Quoting
High
dist/index.jsView file
Findings
4 High4 Medium5 Low
HighChild Processdist/utils/source-provenance.js
HighShelldist/commands/skill-run.js
HighRuntime Package Installdist/commands/dev.js
HighSemantic Analysis Limiteddist/commands/deploy.js#virtual:normalized:round1
MediumDynamic Requiredist/index.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to @solidactions/cli@3.26.0.
See all versions of @solidactions/cli for other recorded verdicts.
- Review the evidence and your use of @solidactions/cli@3.26.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.