registry  /  @wdtt/skill-mgr  /  0.2.2

@wdtt/skill-mgr@0.2.2

OpenCode skill 链接管理工具 — 从中央仓库浏览、选择、链接 skill

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 3 file(s), 3.86 KB of source, external domains: github.com

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node scripts/install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/skill-mgr.jsView file
3const { join } = require('path'); L4: const { spawn } = require('child_process'); L5:
High
Child Process

Package source references child process execution.

bin/skill-mgr.jsView on unpkg · L3
22if (!binPath) { L23: console.error('❌ skill-mgr 二进制文件未找到。请重新安装: npm install -g skill-mgr'); L24: process.exit(1); ... L26: L27: spawn(binPath, process.argv.slice(2), { stdio: 'inherit' }) L28: .on('exit', (code) => process.exit(code));
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/skill-mgr.jsView on unpkg · L22
1#!/usr/bin/env node L2: const { existsSync } = require('fs'); L3: const { join } = require('path');
Medium
Dynamic Require

Package source references dynamic require/import behavior.

bin/skill-mgr.jsView on unpkg · L1
scripts/install.jsView file
1#!/usr/bin/env node L2: const { execSync } = require('child_process'); L3: const { existsSync, mkdirSync, chmodSync, writeFileSync, createWriteStream } = require('fs'); L4: const { join } = require('path'); L5: const https = require('https'); L6: ... L11: // Only run on install (not on ci, not as dependency of another package) L12: if (process.env.CI || !process.env.npm[redacted]) { L13: // For local development / CI, just use the go-built binary
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

scripts/install.jsView on unpkg · L1

Findings

4 High5 Medium5 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/skill-mgr.js
HighSame File Env Network Executionscripts/install.js
HighRuntime Package Installbin/skill-mgr.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirebin/skill-mgr.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings