registry / @trustbaseai/claude-collab-plugin / 0.20.2

@trustbaseai/claude-collab-plugin@0.20.2

Claude Code plugin layer for @trustbaseai/claude-collab (settings.json hooks, doctor, watch, session)

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 158 KB of source, external domains: 127.0.0.1

Source & flagged code

4 flagged

bin/claude-collab-plugin-agent.jsView file

Lines 7-48javascript

7 * capabilities. Use this subcommand to:

8 * - list agents (see who's in the group)

9 * - show one agent (get full bio)

10 * - register yourself (self-intro) or update your bio

11 * - send a unicast message to one specific agent via @<botname>

12 *

13 * Behind the scenes this calls /api/agents on the configured collab-mcp

14 * server. To unicast, it falls back to /api/messages with explicit

15 * to_user=<botname> (no mention parsing needed server-side yet —

16 * that's v0.12.x).

17 *

18 * Usage:

19 * claude-collab-plugin agent list # all agents

20 * claude-collab-plugin agent show <botname> # one agent

21 * claude-collab-plugin agent me --bio '...self-intro'

22 * claude-collab-plugin agent <botname> --bio '...' # update another

23 * claude-collab-plugin agent @<botname> '<msg>' # unicast

24 * claude-collab-plugin agent me [--capabilities 'r,w,e'] [--status active]

25 */

26'use strict';

28const path = require('path');

29const { spawnSync } = require('child_process');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-collab-plugin-agent.jsView on unpkg · L27

30const base = require('@trustbaseai/claude-collab');

High

Child Process

Package source references child process execution.

bin/claude-collab-plugin-agent.jsView on unpkg · L28

31const configStore = base.configStore;

32const isHeartbeat = base.isHeartbeat;

34const args = process.argv.slice(2);

35// When invoked via the main dispatcher, args[0] is the script name

36// (e.g. "claude-collab-plugin-agent"). When invoked directly, args[0]

37// is the sub-subcommand (e.g. "list"). Detect and skip.

38const subcmd = (args[0] || '').endsWith('claude-collab-plugin-agent') || args[0]?.includes('agent')

39 ? args[1] || ''

40 : args[0] || '';

41const rest = subcmd === args[0] ? args.slice(1) : args.slice(2);

43function arg(name, def) {

44 const i = rest.indexOf(name);

45 return i >= 0 ? rest[i + 1] : def;

46}

47function hasFlag(name) { return rest.includes(name); }

bin/claude-collab-plugin.jsView file

Lines 58-98javascript

58 console.log(' claude-collab-plugin install');

59 console.log(' claude-collab-plugin doctor');

60 console.log(' claude-collab-plugin watch --interval 60');

61 console.log(' claude-collab-plugin status');

62 console.

src/plugin-doctor.jsView file

Lines 61-101javascript

61 ok: false,

62 scriptPath: s.scriptPath,

63 error: 'hook script missing on disk',

64 fix: 'reinstall: `npm install -g @trustbaseai/claude-collab-plugin`',

65 };

66 }

Source & flagged code

4 flagged · loading source

bin/claude-collab-plugin-agent.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code