registry / @ureck/alexandria / 0.5.1

@ureck/alexandria@0.5.1

Alexandria — bóveda de conocimiento local para agentes de IA (Claude Code, Cursor, OpenCode, Windsurf y más): captura automática, búsqueda semántica offline y grafo de conexiones estilo Obsidian. Ahorra tokens inyectando solo el contexto relevante.

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 16 file(s), 111 KB of source, external domains: 127.0.0.1, nodejs.org, opencode.ai

Source & flagged code

2 flagged

dist/chunk-UTXUGXDB.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2import {

3 VaultIndex

4} from "./chunk-7G3NPKDO.js";

6// src/graph/viewer.ts

7import fs from "fs";

8import http from "http";

9import path from "path";

10import { spawn } from "child_process";

11function buildGraphData(idx) {

High

Child Process

Package source references child process execution.

dist/chunk-UTXUGXDB.jsView on unpkg · L9

12 const deg = /* @__PURE__ */ new Map();

13 for (const l of idx.meta.links) {

14 deg.set(l.from, (deg.get(l.from) ?? 0) + 1);

15 deg.set(l.to, (deg.get(l.to) ?? 0) + 1);

16 }

17 return {

18 nodes: Object.values(idx.meta.notes).filter((n) => !n.rel.split("/").includes("archive")).map((n) => ({

19 id: n.rel,

20 title: n.title,

21 type: n.type,

22 deg: deg.get(n.rel) ?? 0,

23 hits: n.hits ?? 1,

24 tags: n.tags

25 })),

26 edges: idx.meta.links.map((l) => ({ s: l.from, t: l.to, type: l.type, w: l.w })),

27 generated: (/* @__PURE__ */ new Date()).toISOString()

28 };

29}

dist/cli.jsView file

Lines 105-145javascript

105 mentions,

106 reason: `detect\xE9 ${mentions} menciones de ${found.slice(0, 3).join(", ")} en la b\xF3veda`,

107 source: local ? "local" : "skills.sh"

Source & flagged code

2 flagged · loading source

dist/chunk-UTXUGXDB.jsView file

9import path from "path"; L10: import { spawn } from "child_process"; L11: function buildGraphData(idx) {

High

Child Process

Package source references child process execution.

dist/chunk-UTXUGXDB.jsView on unpkg · L9

dist/cli.jsView file

125try { L126: execFileSync("npx", ["--yes", "skills", "add", rec.skill, "--yes"], { L127: stdio: "pipe",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L125

Findings

3 High2 Medium4 Low

HighChild Processdist/chunk-UTXUGXDB.js

HighShell

HighRuntime Package Installdist/cli.js

MediumNetwork

MediumEnvironment Vars

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowUrl Strings

Source & flagged code

2 flagged

dist/chunk-UTXUGXDB.jsView file

Lines 1-29javascript

1#!/usr/bin/env node

2import {

3 VaultIndex

4} from "./chunk-7G3NPKDO.js";

6// src/graph/viewer.ts

7import fs from "fs";

8import http from "http";

9import path from "path";

10import { spawn } from "child_process";

11function buildGraphData(idx) {

High

Child Process

Package source references child process execution.

dist/chunk-UTXUGXDB.jsView on unpkg · L9

12 const deg = /* @__PURE__ */ new Map();

13 for (const l of idx.meta.links) {

14 deg.set(l.from, (deg.get(l.from) ?? 0) + 1);

15 deg.set(l.to, (deg.get(l.to) ?? 0) + 1);

16 }

17 return {

18 nodes: Object.values(idx.meta.notes).filter((n) => !n.rel.split("/").includes("archive")).map((n) => ({

19 id: n.rel,

20 title: n.title,

21 type: n.type,

22 deg: deg.get(n.rel) ?? 0,

23 hits: n.hits ?? 1,

24 tags: n.tags

25 })),

26 edges: idx.meta.links.map((l) => ({ s: l.from, t: l.to, type: l.type, w: l.w })),

27 generated: (/* @__PURE__ */ new Date()).toISOString()

28 };

29}

dist/cli.jsView file

Lines 105-145javascript

105 mentions,

106 reason: `detect\xE9 ${mentions} menciones de ${found.slice(0, 3).join(", ")} en la b\xF3veda`,

107 source: local ? "local" : "skills.sh"