registry / @wrongstack/plugins / 0.291.0

@wrongstack/plugins@0.291.0

Official WrongStack plugin collection — 63 focused, single-purpose plugins for code quality, security, observability, planning, and agent coordination

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 65 file(s), 2.07 MB of source, external domains: keepachangelog.com

Source & flagged code

3 flagged

dist/runtime.jsView file

Lines 1-21javascript

1// src/runtime/index.ts

2import { execFile } from "node:child_process";

3import { existsSync, readdirSync, statSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/runtime.jsView on unpkg · L1

4import { basename, extname, isAbsolute, relative, resolve } from "node:path";

6// src/runtime/llm.ts

7function stripOuterMarkdownFence(text) {

8 const trimmed = text.trim();

9 const match = trimmed.match(/^```(?:[a-z0-9_-]+)?\s*\r?\n([\s\S]*?)\r?\n```$/i);

10 return (match?.[1] ?? trimmed).trim();

11}

12function parseLlmJsonObject(text) {

13 const candidate = stripOuterMarkdownFence(text);

14 try {

15 const parsed = JSON.parse(candidate);

16 return parsed !== null && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : null;

17 } catch {

18 return null;

19 }

20}

21async function runOptionalPluginLlm(request) {

dist/spec-linker.jsView file

42Cross-file remote execution chain: dist/spec-linker.js spawns dist/index.js; helper contains network access plus dynamic code execution. L42: for (let i = 0; i < s.length; i++) { L43: h ^= s.charCodeAt(i); L44: h = h * 16777619 >>> 0; ... L99: }; L100: const result = await mailbox.send(sendInput); L101: state.sentCount += 1; ... L303: var AUTO_DOC_API_VERSION = "^0.1.10"; L304: function resolveProjectPath(rawPath, cwd = process.cwd()) { L305: if (typeof rawPath !== "string" || rawPath.length === 0) return null; ... L839: // src/branch-guard/index.ts L840: import { execFile } from "node:child_process"; L841: var API_VERSION2 = "^0.1.10";

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

dist/spec-linker.jsView on unpkg · L42

dist/format-on-save.jsView file

Lines 70-110javascript

70 } catch {

71 }

72 state.patternUnregister = null;

73 }

74}

75function evictExpired(ttlMs) {

76 const

Source & flagged code

3 flagged · loading source

dist/runtime.jsView file

1// src/runtime/index.ts L2: import { execFile } from "node:child_process"; L3: import { existsSync, readdirSync, statSync } from "node:fs";

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code