registry / @specdrive/core / 0.1.4

@specdrive/core@0.1.4

SpecDrive core domain model, spec engine, and knowledge base

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 8 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

DynamicRequireEnvironmentVarsEvalFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 27 file(s), 121 KB of source, external domains: 127.0.0.1, aistudio.google.com, api.anthropic.com, api.groq.com, api.openai.com, generativelanguage.googleapis.com, github.com, www.figma.com

Source & flagged code

2 flagged

dist/integrations/design2code-service.jsView file

Lines 1-29javascript

1import { mkdir, readFile, writeFile } from 'node:fs/promises';

2import { existsSync } from 'node:fs';

3import { homedir } from 'node:os';

4import { join } from 'node:path';

5import { defaultProjectPaths, featureSpecPaths } from '../domain/paths.js';

6import { fileExists } from '../infrastructure/files.js';

7import { ensureProfileEnvHydrated } from '../infrastructure/shell-profile-env.js';

8import { SpecDriveError } from '../services/project-service.js';

9import { getSpecStatus } from '../services/spec-service.js';

10const dynamicImport = new Function('specifier', 'return import(specifier)');

11let generatorsRegistered = false;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/integrations/design2code-service.jsView on unpkg · L9

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/integrations/design2code-service.jsView on unpkg · L9

12export function stackToFramework(stack) {

13 return stack === 'react-native' ? 'react-native' : stack;

14}

15export function extractFigmaFileKey(input) {

16 const match = input.match(/figma\.com\/(?:file|design)\/([a-zA-Z0-9]+)/);

17 return match?.[1] ?? input.trim();

18}

19export async function resolveFigmaToken(explicit) {

20 if (explicit)

21 return explicit;

22 await ensureProfileEnvHydrated();

23 const fromEnv = process.env.FIGMA_TOKEN ?? process.env.FIGMA_ACCESS_TOKEN;

24 if (fromEnv)

25 return fromEnv;

26 const config = await loadDesign2CodeConfig();

27 return config.figmaToken ?? null;

28}

29export async function requireFigmaToken(explicit) {

Source & flagged code

2 flagged · loading source

dist/integrations/design2code-service.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code