registry / @vibekiln/cutline-mcp-cli-staging / 0.5.4
@vibekiln/cutline-mcp-cli-staging@0.5.4
CLI and MCP servers for Cutline, including SlopBurn: a product quality engineering roguelike RPG for vibecoding workflows.
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
HighEntropyStringsTelemetryUrlStrings
Source & flagged code
7 flaggeddist/commands/serve.jsView file
1import { execFileSync, spawn } from 'node:child_process';
L2: import { createServer } from 'node:http';
High
Child Process
Package source references child process execution.
dist/commands/serve.jsView on unpkg · L11Cross-file remote execution chain: dist/commands/serve.js spawns dist/servers/cutline-server.js; helper contains network access plus dynamic code execution.
L1: import { execFileSync, spawn } from 'node:child_process';
L2: import { createServer } from 'node:http';
L3: import { resolve, dirname } from 'node:path';
...
L5: import { existsSync } from 'node:fs';
L6: const __dirname = dirname(fileURLToPath(import.meta.url));
L7: export const SERVER_MAP = {
...
L50: try {
L51: const text = Buffer.concat(chunks).toString('utf8');
L52: resolveBody(text ? JSON.parse(text) : {});
...
L66: });
L67: res.end(payload);
L68: }
High
Cross File Remote Execution Context
Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.
dist/commands/serve.jsView on unpkg · L1dist/servers/slopburn-server.jsView file
Findings
6 High2 Medium7 Low
HighChild Processdist/commands/serve.js
HighShelldist/servers/slopburn-server.js
HighCredential Exfiltrationdist/servers/chunk-RPK2BHE3.js
HighCredential Redirect Persistencedist/commands/init.js
HighCross File Remote Execution Contextdist/commands/serve.js
HighSemantic Analysis Limiteddist/servers/chunk-RPK2BHE3.js#virtual:normalized:round1
MediumNetwork
MediumEnvironment Vars
LowNon Install Lifecycle Scripts
LowScripts Present
LowWeak Cryptodist/servers/slopburn-server.js
LowFilesystem
LowHigh Entropy Strings
LowTelemetry
Affected versions and remediation
This report applies to @vibekiln/cutline-mcp-cli-staging@0.5.4.
See all versions of @vibekiln/cutline-mcp-cli-staging for other recorded verdicts.
- Review the evidence and your use of @vibekiln/cutline-mcp-cli-staging@0.5.4 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.