registry / @windagency/valora / 3.0.3

@windagency/valora@3.0.3

VALORA - AI-assisted development workflow orchestration with agnostic multi-LLM support, session-based state, and Cursor MCP integration

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 425 file(s), 2.62 MB of source, external domains: api.moonshot.ai, api.x.ai, github.com, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

9 flagged

package.jsonView file

Lines 110-150json

110 "eslint-plugin-import": "^2.32.0",

111 "eslint-plugin-perfectionist": "^4.15.1",

112 "eslint-plugin-prettier": "^5.5.4",

113 "eslint-plugin-sort": "^4.0.0",

114 "eslint-plugin-sort-destructure-keys": "^2.0.0",

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/mcp.jsView file

9// Import and run the MCP server L10: import(join(__dirname, '..', 'dist', 'mcp', 'server.js'));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/mcp.jsView on unpkg · L9

dist/plugins/npm-registry-client.jsView file

1import { createHash } from 'node:crypto'; L2: const DEFAULT_REGISTRY_BASE = 'https://registry.npmjs.org'; L3: const TIMEOUT_MS = 15000; ... L19: } L20: const text = await response.text(); L21: try { ... L58: function registryBase() { L59: return (process.env['VALORA_NPM_REGISTRY_URL'] ?? DEFAULT_REGISTRY_BASE).replace(/\/$/, ''); L60: }

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/plugins/npm-registry-client.jsView on unpkg · L1

dist/cli/autocomplete.jsView file

20detectShell() { L21: const shellEnv = process.env['SHELL'] ?? ''; L22: const shells = ['zsh', 'bash', 'fish']; ... L36: const commands = await this.getCommands(); L37: return `#!/bin/bash L38: # VALORA completion script for Bash ... L225: getInstallPath(shell) { L226: const homeDir = os.homedir(); L227: const installPaths = { ... L272: bash: (installPath) => { L273: consoleOut.print(` Add this line to your ~/.bashrc:`); L274: consoleOut.print(` ${color.cyan(`source ${installPath}`)}`);

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/autocomplete.jsView on unpkg · L20

scripts/install-cli-tools.shView file

•path = scripts/install-cli-tools.sh kind = build_helper sizeBytes = 11255 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install-cli-tools.shView on unpkg

data/plugins/valora-defaults/hooks/__tests__/enforce-modern-cli.test.shView file

•path = data/plugins/valora-defaults/hooks/__tests__/enforce-modern-cli.test.sh kind = payload_in_excluded_dir sizeBytes = 3980 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

data/plugins/valora-defaults/hooks/__tests__/enforce-modern-cli.test.shView on unpkg

data/prompts/04_code/implement-tests.mdView file

377patternName = generic_password severity = medium line = 377 matchedText = password...23!'

Medium

Secret Pattern

Hardcoded password in data/prompts/04_code/implement-tests.md

data/prompts/04_code/implement-tests.mdView on unpkg · L377

data/templates/plans/PATTERN_REACT_COMPONENT.mdView file

347patternName = generic_password severity = medium line = 347 matchedText = password...23',

Medium

Secret Pattern

Hardcoded password in data/templates/plans/PATTERN_REACT_COMPONENT.md

data/templates/plans/PATTERN_REACT_COMPONENT.mdView on unpkg · L347

Findings

2 High9 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighPayload In Excluded Dirdata/plugins/valora-defaults/hooks/__tests__/enforce-modern-cli.test.sh

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirebin/mcp.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli/autocomplete.js

MediumShips Build Helperscripts/install-cli-tools.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndata/prompts/04_code/implement-tests.md

MediumSecret Patterndata/templates/plans/PATTERN_REACT_COMPONENT.md

LowScripts Present

LowWeak Cryptodist/plugins/npm-registry-client.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

dist/cli/autocomplete.jsView file

Lines 1-40javascript

1/**

2 * Shell Autocomplete Generator

3 *

4 * Generates completion scripts for bash, zsh, and fish shells

5 */

6import * as fs from 'fs/promises';

7import * as os from 'os';

8import * as path from 'path';

9import { CommandLoader } from '../executor/command-loader.js';

10import { getColorAdapter } from '../output/color-adapter.interface.js';

11import { getConsoleOutput } from '../output/console-output.js';

12export class AutocompleteGenerator {

13 commandLoader;

14 constructor(commandLoader) {

15 this.commandLoader = commandLoader ?? new CommandLoader();

16 }

17 /**

18 * Detect current shell

19 */

20 detectShell() {

21 const shellEnv = process.env['SHELL'] ?? '';

22 const shells = ['zsh', 'bash', 'fish'];

23 return shells.find((shell) => shellEnv.includes(shell)) ?? null;

24 }

25 /**

26 * Get all available commands

27 */

28 async getCommands() {

29 const commandNames = await this.commandLoader.listCommands();

30 return commandNames;

31 }

32 /**

33 * Generate bash completion script

34 */

35 async generateBashCompletion() {

36 const commands = await this.getCommands();

37 return `#!/bin/bash

38# VALORA completion script for Bash

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli/autocomplete.jsView on unpkg · L20

39# Generated automatically - do not edit manually

data/prompts/04_code/implement-tests.mdView file

Lines 357-397markdown

357 await sendVerificationEmail(email);

358

359 // Assert

360 const token = await VerificationToken.findByEmail(email);

361 expect(token).toBeDefined();

362 expect(token.expiresAt).toBeGreaterThan(new Date());

363 });

364});

365```

366

367### Step 4: Write E2E Tests (When Applicable)

368

369Test complete user workflows:

370

371```typescript

372describe('User registration with email verification', () => {

373 it('should complete full registration flow', async () => {

374 // Arrange

375 const userData = {

376 email: 'newuser@example.com',

377 password: 'SecurePass123!'

Medium

Secret Pattern

Hardcoded password in data/prompts/04_code/implement-tests.md

data/prompts/04_code/implement-tests.mdView on unpkg · L377

378 };

379

380 // Act - Register

381 const registerResponse = await request(app).post('/auth/register').send(userData);

382

383 expect(registerResponse.status).toBe(201);

384

385 // Assert - Email sent

386 const emails = await getTestEmails();

387 expect(emails).toHaveLength(1);

388 expect(emails[0].to).toBe(userData.email);

389

390 // Extract verification token from email

391 const token = extractTokenFromEmail(emails[0].body);

392

393 // Act - Verify

394 const verifyResponse = await request(app).post('/auth/verify').send({ token });

395

396 // Assert - Verification successful

397 expect(verifyResponse.status).toBe(200);

data/templates/plans/PATTERN_REACT_COMPONENT.mdView file

Lines 327-367markdown

327import userEvent from '@testing-library/user-event';

328import { axe } from 'vitest-axe';

329import { LoginForm } from './LoginForm';

330

331describe('LoginForm', () => {

332 it('should not have accessibility violations', async () => {

333 const { container } = render(<LoginForm onSubmit={jest.fn()} />);

334 expect(await axe(container)).toHaveNoViolations();

335 });

336

337 it('should submit form with valid credentials', async () => {

338 const onSubmit = jest.fn();

339 render(<LoginForm onSubmit={onSubmit} />);

340

341 await userEvent.type(screen.getByLabelText('Email'), 'test@example.com');

342 await userEvent.type(screen.getByLabelText('Password'), 'password123');

343 await userEvent.click(screen.getByRole('button', { name: 'Login' }));

344

345 expect(onSubmit).toHaveBeenCalledWith({

346 email: 'test@example.com',

347 password: 'password123',

Medium

Secret Pattern

Hardcoded password in data/templates/plans/PATTERN_REACT_COMPONENT.md

data/templates/plans/PATTERN_REACT_COMPONENT.mdView on unpkg · L347

348 });

349 });

350});

351```

352

353**Validation**:

354

355- All tests pass

356- Coverage ≥ 80%

357

358### Step 8: Create Storybook Stories [15 min] (Optional)

359

360**File**: `src/components/[path]/[ComponentName].stories.tsx`

361

362**Actions**:

363

364- Add default story

365- Add variants (loading, error, different states)

366- Add interactive controls

367