registry / @vue-skuilder/cli / 0.2.12

@vue-skuilder/cli@0.2.12

CLI scaffolding tool for vue-skuilder projects

AI Security Review

scanned 8d ago · by lpm-firewall-ai

No confirmed malicious attack surface. Sensitive-looking behavior is aligned with a course scaffolding/editing CLI and is activated by explicit CLI commands, not install or import.

Static reason

One or more suspicious static signals were detected.

Trigger

User invokes skuilder init, pack, unpack, studio, or bundled mcp-server.

Impact

Creates/overwrites project/course files and local .mcp.json during requested workflows; no stealth persistence, credential harvesting, or exfiltration observed.

Mechanism

User-driven scaffolding, local service startup, CouchDB course import/export, and MCP course-editing integration

Rationale

Static inspection found no install-time execution, hidden exfiltration, persistence, or unconsented AI-agent control-surface mutation. The scanner hits are explained by documented CLI functionality: local CouchDB/network access, project file generation, browser opening, npm builds, and user-invoked MCP course editing.

Evidence

package.jsondist/cli.jsdist/commands/init.jsdist/commands/pack.jsdist/commands/unpack.jsdist/commands/studio.jsdist/mcp-server.jsdist/utils/template.jsdist/utils/questions-hash.jsdist/utils/NodeFileSystemAdapter.jsCLAUDE.mdREADME.md

Network endpoints8

localhost:5984localhost:5985localhost:3000localhost:3001localhost:7174localhost:5173fonts.googleapis.com/css?family=Roboto:300,400,500,700|Material+Iconsgithub.com/NiloCK/vue-skuilder

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

Evidence against

package.json has no install/preinstall/postinstall lifecycle hooks.
dist/cli.js only reads package.json version and registers commander subcommands.
dist/commands/init.js writes scaffolded project files only after user runs skuilder init; destructive rmSync requires --dangerously-clobber.
dist/commands/pack.js and dist/commands/unpack.js connect to user-supplied/default CouchDB and read/write course data for declared pack/unpack behavior.
dist/commands/studio.js starts local CouchDB/API/UI, may spawn browser/npm builds, and writes .mcp.json only during user-invoked studio mode.
dist/mcp-server.js exposes course-editing MCP tools over stdio for the selected course; no credential harvesting or exfiltration found.

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 50 file(s), 352 KB of source, external domains: github.com, parceljs.org

Source & flagged code

5 flagged

dist/commands/studio.jsView file

Lines 359-429javascript

359 }

360 // Find available port starting from 7174

361 let port = 7174;

362 while (port < 7200) {

363 try {

364 await new Promise((resolve, reject) => {

365 const server = http.createServer((req, res) => {

366 try {

367 console.log(chalk.gray(` [Studio HTTP] ${req.method} ${req.url} from ${req.socket.remoteAddress}`));

368 const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost:7174'}`);

369 // Inject config for index.html

370 if (url.pathname === '/' || url.pathname === '/index.html') {

371 const indexPath = path.join(studioSourcePath, 'index.html');

372 let html = fs.readFileSync(indexPath, 'utf8');

373 const connectionScript = `

374 <script>

375 window.STUDIO_CONFIG = {

376 couchdb: {

377 url: '${connectionDetails.url}',

378 username: '${connectionDetails.username}',

379 password: '${connectionDetails.password}'

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/studio.jsView on unpkg · L379

380 },

381 database: {

382 name: '${unpackResult.databaseName}',

383 courseId: '${unpackResult.courseId}',

384 originalCourseId: '${unpackResult.courseId}'

385 },

386 express: {

387 url: '${expressApiUrl || 'http://localhost:3000'}'

388 }

389 };

390 </script>

391 `;

392 html = html.replace('</head>', connectionScript + '</head>');

393 res.setHeader('Content-Type', 'text/html');

394 res.end(html);

395 return;

396 }

397 // Fallback to serve-static for all other assets

398 serve(req, res, () => {

399 // If serve-static doesn't find the file, it calls next().

400 // We can treat this as a 404, but for SPAs, we should serve index.html.

401 const indexPath = path.join(studioSourcePath, 'index.html');

402 let html = fs.readFileSync(indexPath, 'utf8');

403 const connectionScript = `

404 <script>

405 window.STUDIO_CONFIG = {

406 couchdb: {

407 url: '${connectionDetails.url}',

408 username: '${connectionDetails.username}',

409 password: '${connectionDetails.password}'

Medium

Secret Pattern

Hardcoded password in dist/commands/studio.js

dist/commands/studio.jsView on unpkg · L409

410 },

411 database: {

412 name: '${unpackResult.databaseName}',

413 courseId: '${unpackResult.courseId}',

414 originalCourseId: '${unpackResult.courseId}'

415 },

416 express: {

417 url: '${expressApiUrl || 'http://localhost:3000'}'

418 }

419 };

420 </script>

421 `;

422 html = html.replace('</head>', connectionScript + '</head>');

423 res.setHeader('Content-Type', 'text/html');

424 res.end(html);

425 });

426 }

427 catch (error) {

428 console.error(chalk.red(` [Studio HTTP] Error handling request: ${error}`));

429 res.statusCode = 500;

dist/studio-ui-src/main.tsView file

Lines 83-123typescript

83 const configResponse = await fetch('/custom-questions-config.json');

84 customQuestionsStatus.configFetched = true;

85 customQuestionsStatus.configStatus = configResponse.status;

87 console.log(` 🔍 Config fetch response status: ${configResponse.status}`);

src/commands/studio.tsView file

Lines 478-549typescript

478 await new Promise<void>((resolve, reject) => {

479 const server = http.createServer((req, res) => {

480 try {

481 console.

Source & flagged code

5 flagged · loading source

dist/commands/studio.jsView file

379patternName = generic_password severity = medium line = 379 matchedText = password...rd}'

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/studio.jsView on unpkg · L379

409patternName = generic_password severity = medium line = 409 matchedText = password...rd}'

Medium

Secret Pattern

Hardcoded password in dist/commands/studio.js

dist/commands/studio.jsView on unpkg · L409

dist/studio-ui-src/main.tsView file

103customQuestionsStatus.importAttempted = true; L104: const customModule = await import(/* @vite-ignore */ customConfig.importPath); L105: customQuestionsStatus.importSucceeded = true;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/studio-ui-src/main.tsView on unpkg · L103

src/commands/studio.tsView file

498patternName = generic_password severity = medium line = 498 matchedText = password...rd}'

Medium

Secret Pattern

Hardcoded password in src/commands/studio.ts

src/commands/studio.tsView on unpkg · L498

529patternName = generic_password severity = medium line = 529 matchedText = password...rd}'

Medium

Secret Pattern

Hardcoded password in src/commands/studio.ts

src/commands/studio.tsView on unpkg · L529

Findings

7 Medium5 Low

MediumSecret Patterndist/commands/studio.js

MediumDynamic Requiredist/studio-ui-src/main.ts

MediumNetwork

MediumEnvironment Vars

MediumSecret Patterndist/commands/studio.js

MediumSecret Patternsrc/commands/studio.ts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/commands/studio.jsView file

Lines 359-429javascript

359 }

360 // Find available port starting from 7174

361 let port = 7174;

362 while (port < 7200) {

363 try {

364 await new Promise((resolve, reject) => {

365 const server = http.createServer((req, res) => {

366 try {

367 console.log(chalk.gray(` [Studio HTTP] ${req.method} ${req.url} from ${req.socket.remoteAddress}`));

368 const url = new URL(req.url || '/', `http://${req.headers.host || 'localhost:7174'}`);

369 // Inject config for index.html

370 if (url.pathname === '/' || url.pathname === '/index.html') {

371 const indexPath = path.join(studioSourcePath, 'index.html');

372 let html = fs.readFileSync(indexPath, 'utf8');

373 const connectionScript = `

374 <script>

375 window.STUDIO_CONFIG = {

376 couchdb: {

377 url: '${connectionDetails.url}',

378 username: '${connectionDetails.username}',

379 password: '${connectionDetails.password}'

Medium

Secret Pattern

Package contains a possible secret pattern.

dist/commands/studio.jsView on unpkg · L379

380 },

381 database: {

382 name: '${unpackResult.databaseName}',

383 courseId: '${unpackResult.courseId}',

384 originalCourseId: '${unpackResult.courseId}'

385 },

386 express: {

387 url: '${expressApiUrl || 'http://localhost:3000'}'

388 }

389 };

390 </script>

391 `;

392 html = html.replace('</head>', connectionScript + '</head>');

393 res.setHeader('Content-Type', 'text/html');

394 res.end(html);

395 return;

396 }

397 // Fallback to serve-static for all other assets

398 serve(req, res, () => {

399 // If serve-static doesn't find the file, it calls next().

400 // We can treat this as a 404, but for SPAs, we should serve index.html.

401 const indexPath = path.join(studioSourcePath, 'index.html');

402 let html = fs.readFileSync(indexPath, 'utf8');

403 const connectionScript = `

404 <script>

405 window.STUDIO_CONFIG = {

406 couchdb: {

407 url: '${connectionDetails.url}',

408 username: '${connectionDetails.username}',

409 password: '${connectionDetails.password}'

Medium

Secret Pattern

Hardcoded password in dist/commands/studio.js

dist/commands/studio.jsView on unpkg · L409

410 },

411 database: {

412 name: '${unpackResult.databaseName}',

413 courseId: '${unpackResult.courseId}',

414 originalCourseId: '${unpackResult.courseId}'

415 },

416 express: {

417 url: '${expressApiUrl || 'http://localhost:3000'}'

418 }

419 };

420 </script>

421 `;

422 html = html.replace('</head>', connectionScript + '</head>');

423 res.setHeader('Content-Type', 'text/html');

424 res.end(html);

425 });

426 }

427 catch (error) {

428 console.error(chalk.red(` [Studio HTTP] Error handling request: ${error}`));

429 res.statusCode = 500;

dist/studio-ui-src/main.tsView file

Lines 83-123typescript

83 const configResponse = await fetch('/custom-questions-config.json');

84 customQuestionsStatus.configFetched = true;

85 customQuestionsStatus.configStatus = configResponse.status;

87 console.log(` 🔍 Config fetch response status: ${configResponse.status}`);

src/commands/studio.tsView file

Lines 478-549typescript

478 await new Promise<void>((resolve, reject) => {

479 const server = http.createServer((req, res) => {

480 try {

481 console.