registry / @tekyzinc/gsd-t / 4.19.10

@tekyzinc/gsd-t@4.19.10

GSD-T: Contract-Driven Development for Claude Code — 54 slash commands with headless-by-default workflow spawning, unattended supervisor relay with event stream, graph-powered code analysis, real-time agent dashboard, task telemetry, doc-ripple enforcemen

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 132 file(s), 1.80 MB of source, external domains: 127.0.0.1, console.anthropic.com, github.com, mcp.figma.com, mermaid.js.org, pandoc.org, registry.npmjs.org

Source & flagged code

6 flagged

bin/gsd-t-ci-parity.cjsView file

Lines 18-58javascript

18 *

19 * When a Dockerfile is present, runs a real `docker build` — presence is the

20 * sole trigger; no opt-in flag (locked user decision).

21 *

22 * Contract: .gsd-t/contracts/ci-parity-contract.md v1.0.0 STABLE

23 *

24 * Parse limits (no external YAML lib; minimal line/regex scanning):

25 * - cloudbuild.yaml: only reads `args:` array elements under `steps:`.

26 * Multi-line folded/block scalars are not supported. Only simple

27 * `args: [...]` one-liner arrays or `- 'val'` list forms are handled.

28 * - .github/workflows/*.yml: only reads `run:` lines from the FIRST job's

29 * steps. Multi-line pipe/fold blocks (`run: |`) capture only the first

30 * continuation line. `uses:` steps (no `run:`) are skipped.

31 * - Dockerfile: reads `RUN` lines (single-line only; backslash-continuations

32 * are joined into one command).

33 * These limits are intentional trade-offs to keep the module at zero

34 * external runtime deps.

35 */

37const fs = require('fs');

38const path = require('path');

39const child_process = require('child_process');

High

Child Process

Package source references child process execution.

bin/gsd-t-ci-parity.cjsView on unpkg · L38

41const DEFAULT_TIMEOUT_MS = 120_000;

43// ── Detection ─────────────────────────────────────────────────────────────────

45/** Parse cloudbuild.yaml steps[].args → array of command strings. */

46function detectCloudbuild(projectDir) {

47 const f = path.join(projectDir, 'cloudbuild.yaml');

48 if (!fs.existsSync(f)) return null;

49 const lines = fs.readFileSync(f, 'utf8').split('\n');

50 const cmds = [];

51 let inArgs = false;

52 let argParts = [];

54 for (const raw of lines) {

55 const line = raw.trimEnd();

56 // Inline array: ` args: ['node', '-e', '...']`

57 const inlineM = line.match(/^\s+args:\s*\[(.+)\]/);

58 if (inlineM) {

bin/gsd-t-test-data-ledger.cjsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * gsd-t-test-data-ledger — M58 D1

4 *

5 * Append-only JSONL ledger tracking test data inserted during a Verify run,

6 * plus a purge engine that removes those records from the underlying store

7 * after the suite completes.

8 *

9 * Contract: .gsd-t/contracts/test-data-ledger-contract.md

10 */

12const fs

scripts/gsd-t-stream-feed-server.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

2/**

3 * GSD-T Stream Feed Server (M40 D4)

4 *

5 * Ingests stream-json frames from D1 workers via chunked HTTP POST to /ingest,

6 * persists every frame to .gsd-t/stream-feed/YYYY-MM-DD.jsonl (persist-before-broadcast),

7 * rotates daily at UTC midnight, broadcasts over WebSocket at /feed (with ?from=N replay),

8 * enforces 127.0.0.1-only, kicks backpressured clients after 1000-frame buffer.

9 *

10 * Contract: .gsd-t/contracts/stream-json-sink-contract.md v1.x

11 * Zero external deps — node http + crypto + fs + net only. Hand-rolled WS framing.

bin/gsd-t.jsView file

Lines 1-26javascript

1#!/usr/bin/env node

3/**

4 * GSD-T CLI Installer

5 *

6 * Usage:

7 * npx @tekyzinc/gsd-t install — Install commands + global CLAUDE.md

8 * npx @tekyzinc/gsd-t update — Update commands + global CLAUDE.md (preserves customizations)

9 * npx @tekyzinc/gsd-t update-all — Update globally + all registered project CLAUDE.md files

10 * npx @tekyzinc/gsd-t init [name] — Initialize a new project with GSD-T structure (auto-registers)

11 * npx @tekyzinc/gsd-t register — Register current directory as a GSD-T project

scripts/statusline-command.shView file

•path = scripts/statusline-command.sh kind = build_helper sizeBytes = 4459 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/statusline-command.shView on unpkg

templates/stacks/node-api.mdView file

Lines 98-138markdown

986. Rate limiting — see _security.md

997. Route-level validation

1008. Route handlers

1019. 404 handler

10210. Global error handler (last)

103```

104

105---

106

107## 6. Environment Config

108

109```

Source & flagged code

6 flagged · loading source

bin/gsd-t-ci-parity.cjsView file

38const path = require('path'); L39: const child_process = require('child_process'); L40:

High

Child Process

Package source references child process execution.

bin/gsd-t-ci-parity.cjsView on unpkg · L38

bin/gsd-t-test-data-ledger.cjsView file

11L12: const fs = require('node:fs'); L13: const path = require('node:path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/gsd-t-test-data-ledger.cjsView on unpkg · L11

scripts/gsd-t-stream-feed-server.jsView file

6* persists every frame to .gsd-t/stream-feed/YYYY-MM-DD.jsonl (persist-before-broadcast), L7: * rotates daily at UTC midnight, broadcasts over WebSocket at /feed (with ?from=N replay), L8: * enforces 127.0.0.1-only, kicks backpressured clients after 1000-frame buffer. ... L26: function createStreamFeedServer(opts = {}) { L27: const projectDir = opts.projectDir || process.cwd(); L28: const port = Number(opts.port || process.env.GSD_T_STREAM_FEED_PORT || DEFAULT_PORT); L29: const feedDir = path.join(projectDir, '.gsd-t', 'stream-feed'); ... L51: if (d === currentDate) return; L52: try { writeStream.end(); } catch { /* noop */ } L53: currentDate = d; ... L68: } catch (e) { L69: process.stderr.write(`[stream-feed-server] persist failed: ${e.message}\n`);

Low

Weak Crypto

Package source references weak cryptographic algorithms.

scripts/gsd-t-stream-feed-server.jsView on unpkg · L6

bin/gsd-t.jsView file

6* Usage: L7: * npx @tekyzinc/gsd-t install — Install commands + global CLAUDE.md L8: * npx @tekyzinc/gsd-t update — Update commands + global CLAUDE.md (preserves customizations) ... L21: const readline = require("readline"); L22: const { execFileSync, spawn: cpSpawn } = require("child_process"); L23: let debugLedger;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/gsd-t.jsView on unpkg · L6

scripts/statusline-command.shView file

•path = scripts/statusline-command.sh kind = build_helper sizeBytes = 4459 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/statusline-command.shView on unpkg

templates/stacks/node-api.mdView file

118patternName = generic_password severity = medium line = 118 matchedText = **BAD:**... })`

Medium

Secret Pattern

Hardcoded password in templates/stacks/node-api.md

templates/stacks/node-api.mdView on unpkg · L118

Findings

3 High6 Medium6 Low

HighChild Processbin/gsd-t-ci-parity.cjs

HighShell

HighRuntime Package Installbin/gsd-t.js

MediumDynamic Requirebin/gsd-t-test-data-ledger.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/statusline-command.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterntemplates/stacks/node-api.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptoscripts/gsd-t-stream-feed-server.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings