registry / @szc-ft/mcp-szcd-client / 0.39.0

@szc-ft/mcp-szcd-client@0.39.0

⚠ Under review

MCP client for szcd component library - auto-configures AI coding tools with MCP server, skills, agents and commands

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis flagged 24 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 137 file(s), 1.89 MB of source, external domains: a.com, api.example.com, cdn.jsdelivr.net, default.com, e-kjr1wok.coding.smartcitysz.work, example.com, github.com, httpbin.org, mcp.szcd-mcp.top, npmmirror.com, opencode.ai, platform.aicityos.com, registry.npmmirror.com, stg.com, stg.example.com, test.example.com, www.apple.com, www.google.com, x.com, yapi.smartcitysz.work

Source & flagged code

16 flagged

package.jsonView file

Lines 34-73json

34 "lib/",

35 "scripts/postinstall.js",

36 "scripts/install-dev-shortcuts.js",

37 "scripts/update-mcp-url.js",

38 "scripts/update-coding-config.js",

39 "scripts/update-api-config.js",

40 "scripts/update-auth.js",

41 "scripts/lib/",

42 "standard-skill/",

43 "agents/",

44 "commands/",

45 "qwen-extension/",

46 "opencode-extension/",

47 "AGENTS.md",

48 "README.md"

49 ],

50 "engines": {

51 "node": ">=18"

52 },

53 "scripts": {

54 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L54

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L54

55 "setup": "node scripts/postinstall.js",

56 "setup:quick": "node scripts/postinstall.js --quick",

57 "build:agents": "node agents/build.js",

58 "prepublishOnly": "node agents/build.js"

59 },

60 "dependencies": {

61 "@modelcontextprotocol/sdk": "^1.29.0",

62 "yaml": "^2.9.0"

63 },

64 "repository": {

65 "type": "git",

66 "url": "git+https://github.com/szc-ft/mcp-szcd.git"

67 },

68 "bugs": {

69 "url": "https://github.com/szc-ft/mcp-szcd/issues"

70 },

71 "homepage": "https://github.com/szc-ft/mcp-szcd#readme"

72}

qwen-extension/skills/local-browser-test/tests/integration/pr-03.test.jsView file

Lines 265-305javascript

265 assert.ok(!fs.existsSync(path.join(runsDir, 'run-0')), 'run-0 应删除（最老）');

266 assert.ok(fs.existsSync(path.join(runsDir, 'run-34')), 'run-34 应保留（最新）');

qwen-extension/skills/local-browser-test/lib/cdp-browser-config.jsView file

Lines 11-51javascript

11 * @returns {{ userDataDir: string, remoteDebuggingPort: string, args: string[] }}

12 */

13export function getBrowserConfigFromProcess(browserName = 'msedge') {

qwen-extension/skills/local-browser-test/lib/browser-engine.jsView file

Lines 3212-3252javascript

3212 try {

3213 var curOrigin = new URL(page.url()).origin;

3214 if (curOrigin && curOrigin.indexOf('http')

qwen-extension/skills/local-browser-test/tests/integration/pr-04.test.jsView file

Lines 3-43javascript

3 * 跑法：node --test tests/integration/pr-04.test.js

4 *

5 * 测试范围（不依赖真实浏览器）：

6 * -

scripts/postinstall.jsView file

Lines 2-42javascript

3/**

4 * postinstall.js — 安装后编排器

5 *

6 * 支持两种模式：

7 * --quick 快速模式（默认）：仅显示提示，不执行耗时操作

8 * 默认完整模式：执行所有 IDE 配置

9 *

10 * 具体逻辑按 IDE 兼容方向抽离到 scripts/lib/ 下：

11 * - common.js 通用工具（常量、安全保护、文件操作、配置读取）

12 * - trae.js Trae CLI / Trae CN 兼容逻辑

qwen-extension/skills/local-browser-test/tests/integration/pr-06.test.jsView file

Lines 2-42javascript

2 * PR #6 集成测试（重试 + flaky + 写操作禁重试）

3 * 跑法：node --test tests/integration/pr-06.test.js

qwen-extension/skills/local-browser-test/lib/shared-deps.jsView file

87try { L88: execSync(`npm install ${installFlags} ${pkgList}`.trim(), { L89: cwd: SHARED_DEPS_DIR,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

qwen-extension/skills/local-browser-test/lib/shared-deps.jsView on unpkg · L87

qwen-extension/skills/local-api-tool/scripts/extract_swagger.pyView file

•path = qwen-extension/skills/local-api-tool/scripts/extract_swagger.py kind = build_helper sizeBytes = 23931 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

qwen-extension/skills/local-api-tool/scripts/extract_swagger.pyView on unpkg

qwen-extension/commands/szcd-mcp-api-config.mdView file

28patternName = generic_password severity = medium line = 28 matchedText = npx szcd...ss>"

Medium

Secret Pattern

Hardcoded password in qwen-extension/commands/szcd-mcp-api-config.md

qwen-extension/commands/szcd-mcp-api-config.mdView on unpkg · L28

qwen-extension/skills/local-browser-test/tests/integration/pr-01.test.jsView file

187patternName = generic_password severity = medium line = 187 matchedText = user: { ...' },

Medium

Secret Pattern

Hardcoded password in qwen-extension/skills/local-browser-test/tests/integration/pr-01.test.js

qwen-extension/skills/local-browser-test/tests/integration/pr-01.test.jsView on unpkg · L187

commands/szcd-mcp-api-config.mdView file

28patternName = generic_password severity = medium line = 28 matchedText = npx szcd...ss>"

Medium

Secret Pattern

Hardcoded password in commands/szcd-mcp-api-config.md

commands/szcd-mcp-api-config.mdView on unpkg · L28

opencode-extension/commands/szcd-mcp-api-config.mdView file

28patternName = generic_password severity = medium line = 28 matchedText = npx szcd...ss>"

Medium

Secret Pattern

Hardcoded password in opencode-extension/commands/szcd-mcp-api-config.md

opencode-extension/commands/szcd-mcp-api-config.mdView on unpkg · L28

opencode-extension/skills/local-browser-test/tests/integration/pr-01.test.jsView file

187patternName = generic_password severity = medium line = 187 matchedText = user: { ...' },

Medium

Secret Pattern

Hardcoded password in opencode-extension/skills/local-browser-test/tests/integration/pr-01.test.js

opencode-extension/skills/local-browser-test/tests/integration/pr-01.test.jsView on unpkg · L187

standard-skill/local-browser-test/tests/integration/pr-01.test.jsView file

187patternName = generic_password severity = medium line = 187 matchedText = user: { ...' },

Medium

Secret Pattern

Hardcoded password in standard-skill/local-browser-test/tests/integration/pr-01.test.js

standard-skill/local-browser-test/tests/integration/pr-01.test.jsView on unpkg · L187

Source & flagged code

16 flagged · loading source

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code