registry / @tech-leads-club/skills-catalog / 0.15.1

@tech-leads-club/skills-catalog@0.15.1

Skills catalog registry for agent-skills CLI (CDN distribution)

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 57.4 KB of source, external domains: cdn.jsdelivr.net, unpkg.com

Source & flagged code

8 flagged

skills/(web-automation)/playwright-skill/lib/helpers.jsView file

Lines 188-228javascript

188

189 await page.screenshot({

190 path: filename,

191 fullPage: options.fullPage !== false,

192 ...options

193 });

194

195 console.log(`Screenshot saved: ${filename}`);

196 return filename;

197}

198

199/**

200 * Handle authentication

201 * @param {Object} page - Playwright page

202 * @param {Object} credentials - Username and password

203 * @param {Object} selectors - Login form selectors

204 */

205async function authenticate(page, credentials, selectors = {}) {

206 const defaultSelectors = {

207 username: 'input[name="username"], input[name="email"], #username, #email',

208 password: 'input[name="password"], #password',

Medium

Secret Pattern

Package contains a possible secret pattern.

skills/(web-automation)/playwright-skill/lib/helpers.jsView on unpkg · L208

209 submit: 'button[type="submit"], input[type="submit"], button:has-text("Login"), button:has-text("Sign in")'

210 };

211

212 const finalSelectors = { ...defaultSelectors, ...selectors };

213

214 await safeType(page, finalSelectors.username, credentials.username);

215 await safeType(page, finalSelectors.password, credentials.password);

216 await safeClick(page, finalSelectors.submit);

217

218 // Wait for navigation or success indicator

219 await Promise.race([

220 page.waitForNavigation({ waitUntil: 'networkidle' }),

221 page.waitForSelector(selectors.successIndicator || '.dashboard, .user-menu, .logout', { timeout: 10000 })

222 ]).catch(() => {

223 console.log('Login might have completed without navigation');

224 });

225}

226

227/**

228 * Scroll page

skills/(web-automation)/playwright-skill/run.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

2/**

3 * Universal Playwright Executor for Claude Code

4 *

5 * Executes Playwright automation code from:

6 * - File path: node run.js script.js

7 * - Inline code: node run.js 'await page.goto("...")'

8 * - Stdin: cat script.js | node run.js

9 *

10 * Ensures proper module resolution by running from skill directory.

skills/(tooling)/mermaid-studio/scripts/render.mjsView file

Lines 136-176javascript

136

137function shellQuote(p) {

138 // Wrap path in single quotes and escape any internal single quotes

139 return `'${p.replace(/'/g, "'\\''")}' `

skills/(cloud)/aws-advisor/scripts/cost_considerations.pyView file

•path = skills/(cloud)/aws-advisor/scripts/cost_considerations.py kind = build_helper sizeBytes = 15420 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/(cloud)/aws-advisor/scripts/cost_considerations.pyView on unpkg

skills/(development)/rails-dev/references/auth.mdView file

Lines 210-250markdown

210

211In a multi-tenant app, authentication has a second step after identifying the user: resolving and scoping the active tenant. The load-bearing rule is that the tenant comes from the user's **membership**, never from a request parameter alone, so a user can only act inside tenants they belong to.

212

213```ruby

214def set_current_tenant

215 # params/subdomain proposes a tenant; membership authorizes it

216 Current.account

skills/(development)/rails-dev/references/test.mdView file

Lines 95-135markdown

96Time-dependent logic uses `travel_to` / `freeze_time`, never real time or `sleep`:

98```ruby

99test "a grant expires after 30 days" do

100 travel_to 31.days.from_now

skills/(development)/nestjs-modular-monolith/references/testing-patterns.mdView file

Lines 258-298markdown

258import * as request from 'supertest'

259import { AppModule } from '../src/app.module'

260import { ValidationPipe } from '@nestjs/common'

261

262describe('Billing (e2e)', () => {

263 let app: INestApplication

264 let authToken: string

265

266 beforeAll(async () => {

267 const module = await Test.createTestingModule({

268

Source & flagged code

8 flagged · loading source

skills/(web-automation)/playwright-skill/lib/helpers.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code