registry / @vkmikc/create-vkm-kit / 4.2.0

@vkmikc/create-vkm-kit@4.2.0

vkm-kit installer: persistent Markdown+git memory for AI agents (MCP) with hybrid search, stealth web fetch/search (obscura + on-demand SearXNG), a cross-domain execution-discipline skill, token-saver hooks, a local usage doctor and a spec-builder — one n

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 22 file(s), 232 KB of source, external domains: 127.0.0.1, github.com, ollama.com

Source & flagged code

2 flagged

src/hooks/_transcript-cache.mjsView file

Lines 75-115javascript

75 if (length > 0) fs.readSync(fd, buf, 0, length, start);

76 return crypto.createHash("sha1").update(buf).digest("hex");

77 } catch {

78 return null;

79 } finally {

80 if (fd !== undefined) {

81 try {

82 fs.closeSync(fd);

83 } catch {

84 /* ignore */

85 }

86 }

87 }

88}

90/** Load + validate a cache file. Returns `null` (triggering a full rescan) on anything that

91 * doesn't look exactly like a cache we could have written for THIS transcript — missing

92 * file, corrupt JSON, wrong shape, or a `transcriptPath` mismatch. Never throws. */

93function readCache(cacheFp, transcriptPath) {

94 try {

95 const raw = fs.readFileSync(cacheFp, "utf8");

96 const cache = JSON.parse(raw);

97 if (

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/hooks/_transcript-cache.mjsView on unpkg · L95

98 cache &&

99 typeof cache === "object" &&

100 cache.transcriptPath === transcriptPath &&

101 typeof cache.offset === "number" &&

102 typeof cache.size === "number" &&

103 typeof cache.mtimeMs === "number" &&

104 typeof cache.fingerprint === "string" &&

105 cache.state &&

106 typeof cache.state === "object"

107 ) {

108 return cache;

109 }

110 } catch {

111 /* missing/corrupt cache -> full rescan */

112 }

113 return null;

114}

115

src/ollama-setup.mjsView file

Lines 1-28javascript

1// Ollama + phi4-mini auto-setup (ADR-0047) for the vkm-spec local drafting layer.

2// Under `--full` the whole stack installs WITHOUT questions (user decision, 4.0.0 plan):

3// on Windows that means `winget install Ollama.Ollama --silent` when the binary is

4// missing, then `ollama pull phi4-mini:3.8b-q4_K_M` (~2.3GB download, logged loudly).

5// Everything here is BEST-EFFORT by contract: vkm-spec's deterministic fallback is a

6// CI-pinned invariant, so a failed/skipped Ollama setup degrades the experience, never

7// breaks it. Non-Windows platforms get the exact command to run instead of a pipe-to-shell

8// install (never curl|sh on the user's behalf).

9import { execa } from "execa";

Source & flagged code

2 flagged · loading source

src/hooks/_transcript-cache.mjsView file

95const raw = fs.readFileSync(cacheFp, "utf8"); L96: const cache = JSON.parse(raw); L97: if (

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/hooks/_transcript-cache.mjsView on unpkg · L95

src/ollama-setup.mjsView file

8// install (never curl|sh on the user's behalf). L9: import { execa } from "execa"; L10: import pc from "picocolors"; ... L18: const res = await execa("ollama", ["--version"], { reject: false }); L19: if (res.failed || res.exitCode !== 0) return null; L20: return res.stdout?.match(/(\d+\.\d+\.\d+)/)?.[1] ?? null; ... L42: dryRun, L43: { enable = true, platform = process.platform } = {} L44: ) { ... L61: ); L62: console.log(pc.dim(" https://ollama.com/download → ollama pull " + OLLAMA_MODEL)); L63: return "manual";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/ollama-setup.mjsView on unpkg · L8

Findings

1 High3 Medium6 Low

HighSandbox Evasion Gated Capabilitysrc/ollama-setup.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/hooks/_transcript-cache.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

src/hooks/_transcript-cache.mjsView file

Lines 75-115javascript

75 if (length > 0) fs.readSync(fd, buf, 0, length, start);

76 return crypto.createHash("sha1").update(buf).digest("hex");

77 } catch {

78 return null;

79 } finally {

80 if (fd !== undefined) {

81 try {

82 fs.closeSync(fd);

83 } catch {

84 /* ignore */

85 }

86 }

87 }

88}

90/** Load + validate a cache file. Returns `null` (triggering a full rescan) on anything that

91 * doesn't look exactly like a cache we could have written for THIS transcript — missing

92 * file, corrupt JSON, wrong shape, or a `transcriptPath` mismatch. Never throws. */

93function readCache(cacheFp, transcriptPath) {

94 try {

95 const raw = fs.readFileSync(cacheFp, "utf8");

96 const cache = JSON.parse(raw);

97 if (

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/hooks/_transcript-cache.mjsView on unpkg · L95

98 cache &&

99 typeof cache === "object" &&

100 cache.transcriptPath === transcriptPath &&

101 typeof cache.offset === "number" &&

102 typeof cache.size === "number" &&

103 typeof cache.mtimeMs === "number" &&

104 typeof cache.fingerprint === "string" &&

105 cache.state &&

106 typeof cache.state === "object"

107 ) {

108 return cache;

109 }

110 } catch {

111 /* missing/corrupt cache -> full rescan */

112 }

113 return null;

114}

115

src/ollama-setup.mjsView file

Lines 1-28javascript

1// Ollama + phi4-mini auto-setup (ADR-0047) for the vkm-spec local drafting layer.

2// Under `--full` the whole stack installs WITHOUT questions (user decision, 4.0.0 plan):

3// on Windows that means `winget install Ollama.Ollama --silent` when the binary is

4// missing, then `ollama pull phi4-mini:3.8b-q4_K_M` (~2.3GB download, logged loudly).

5// Everything here is BEST-EFFORT by contract: vkm-spec's deterministic fallback is a

6// CI-pinned invariant, so a failed/skipped Ollama setup degrades the experience, never

7// breaks it. Non-Windows platforms get the exact command to run instead of a pipe-to-shell

8// install (never curl|sh on the user's behalf).

9import { execa } from "execa";