registry / @vkmikc/create-vkm-kit / 4.2.0

@vkmikc/create-vkm-kit@4.2.0

vkm-kit installer: persistent Markdown+git memory for AI agents (MCP) with hybrid search, stealth web fetch/search (obscura + on-demand SearXNG), a cross-domain execution-discipline skill, token-saver hooks, a local usage doctor and a spec-builder — one n

Static Scan Results

scanned 1h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 22 file(s), 232 KB of source, external domains: 127.0.0.1, github.com, ollama.com

Source & flagged code

2 flagged

src/hooks/_transcript-cache.mjsView file

Lines 75-115javascript

75 if (length > 0) fs.readSync(fd, buf, 0, length, start);

76 return crypto.createHash("sha1").update(buf).digest("hex");

77 } catch {

Source & flagged code

2 flagged · loading source

src/hooks/_transcript-cache.mjsView file

95const raw = fs.readFileSync(cacheFp, "utf8"); L96: const cache = JSON.parse(raw); L97: if (

Low

Weak Crypto

Package source references weak cryptographic algorithms.

src/hooks/_transcript-cache.mjsView on unpkg · L95

src/ollama-setup.mjsView file

8// install (never curl|sh on the user's behalf). L9: import { execa } from "execa"; L10: import pc from "picocolors"; ... L18: const res = await execa("ollama", ["--version"], { reject: false }); L19: if (res.failed || res.exitCode !== 0) return null; L20: return res.stdout?.match(/(\d+\.\d+\.\d+)/)?.[1] ?? null; ... L42: dryRun, L43: { enable = true, platform = process.platform } = {} L44: ) { ... L61: ); L62: console.log(pc.dim(" https://ollama.com/download → ollama pull " + OLLAMA_MODEL)); L63: return "manual";

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/ollama-setup.mjsView on unpkg · L8

Findings

1 High3 Medium6 Low

HighSandbox Evasion Gated Capabilitysrc/ollama-setup.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptosrc/hooks/_transcript-cache.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

src/ollama-setup.mjsView file

Lines 1-28javascript

1// Ollama + phi4-mini auto-setup (ADR-0047) for the vkm-spec local drafting layer.

2// Under `--full` the whole stack installs WITHOUT questions (user decision, 4.0.0 plan):

3// on Windows that means `winget install Ollama.Ollama --silent` when the binary is

4// missing, then `ollama pull phi4-mini:3.8b-q4_K_M` (~2.3GB download, logged loudly).

5// Everything here is BEST-EFFORT by contract: vkm-spec's deterministic fallback is a

6// CI-pinned invariant, so a failed/skipped Ollama setup degrades the experience, never

7// breaks it. Non-Windows platforms get the exact command to run instead of a pipe-to-shell

8// install (never curl|sh on the user's behalf).

9import { execa } from "execa";

10import pc from "picocolors";

12export const OLLAMA_MODEL = "phi4-mini:3.8b-q4_K_M";

13/** Structured outputs via `format` need ≥0.5.13 for phi4-mini (model requirement). */

14export const OLLAMA_MIN_VERSION = "0.5.13";

16/** `ollama --version` → semver string or null (missing/unrunnable binary). */

17export async function ollamaVersion() {

18 const res = await execa("ollama", ["--version"], { reject: false });

19 if (res.failed || res.exitCode !== 0) return null;

20 return res.stdout?.match(/(\d+\.\d+\.\d+)/)?.[1] ?? null;

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

src/ollama-setup.mjsView on unpkg · L8

21}

23/** Best-effort numeric compare: is `version` ≥ `min`? */

24export function versionAtLeast(version, min) {

25 const a = String(version).split(".").map(Number);

26 const b = String(min).split(".").map(Number);

27 for (let i = 0; i < 3; i++) {

28 if ((a[i] || 0) > (b[i] || 0)) return true;