registry / @xpert-ai/plugin-presentation-studio / 0.4.0

@xpert-ai/plugin-presentation-studio@0.4.0

Agentic presentation studio with the DashiAI layout catalog, Yjs collaboration, and HTML/PDF/PPTX export.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 18 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsMinifiedObfuscatedTelemetryUrlStrings

Manifest

CopyleftLicense

scanned 191 file(s), 26.4 MB of source, external domains: 127.0.0.1, assets.unicorn.studio, cdn.jsdelivr.net, example.com, github.com, local.invalid, preview.local, raw.githubusercontent.com, react.dev, reactjs.org, storage.googleapis.com, unicorn.studio, www.w3.org, www.xiaohongshu.com, xpert.local, xpert.test

Oversized source lightweight scan

assets/upstream/dashiai-ppt/project/src/components/themes/generated-metadata.js4.37 MB file, sampled 256 KB

HighEntropyStringsTelemetry

Source & flagged code

7 flagged

dist/index.jsView file

Lines 1-21javascript

1import { execFileSync } from 'node:child_process';

2import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

3import { existsSync, readFileSync, readdirSync } from 'node:fs';

4import { createRequire } from 'node:module';

5import { dirname, join, relative, sep } from 'node:path';

6import { fileURLToPath } from 'node:url';

7import { z } from 'zod';

8import { CollaborationRuntimeCapability, MANAGED_QUEUE_SERVICE_TOKEN, XPERT_RUNTIME_CAPABILITIES_TOKEN } from '@xpert-ai/plugin-sdk';

9import { DASHIAI_LAYOUT_COUNT, PRESENTATION_ASSISTANT_TEMPLATE_KEY, PRESENTATION_COLLABORATION_CAPABILITY, PRESENTATION_EXPORT_CAPABILITY, PRESENTATION_FEATURE, PRESENTATION_GENERATION_CAPABILITY, PRESENTATION_ICON, PRESENTATION_MIDDLEWARE_NAME, PRESENTATION_PLUGIN_NAME, PRESENTATION_PROVIDER_KEY, PRESENTATION_TEMPLATE_CAPABILITY, PRESENTATION_TEMPLATE_PROVIDER_KEY, PRESENTATION_VIEW_KEY, PRESENTATION_WORKBENCH_CAPABILITY } from './lib/constants.js';

10import { PRESENTATION_CONFIG_DEFAULTS } from './lib/presentation-config.service.js';

11import { PresentationStudioPlugin } from './lib/presentation-studio.plugin.js';

12import { presentationStudioTemplates } from './lib/presentation-studio.templates.js';

13const moduleDir = dirname(fileURLToPath(import.meta.url));

14const requireFromPlugin = createRequire(import.meta.url);

15const packageJson = JSON.parse(readFileSync(join(moduleDir, '../package.json'), 'utf8'));

16const ConfigSchema = z.object({

17 chromiumExecutablePath: z.string().min(1).optional(),

18 exportConcurrency: z.number().int().min(1).max(4),

19 maxPageCount: z.number().int().min(3).max(30),

20 maxAssetBytes: z.number().int().positive(),

21 maxDeckMediaBytes: z.number().int().positive(),

dist/lib/presentation-studio.middleware.jsView file

Lines 136-176javascript

136 name: 'presentation_get_deck', description: toolDescription(currentDeckHint, 'Read deck revision, immutable versions, exports, assets, and optionally slide content. Prefer the current deckId from context when the user says current deck or this presentation.'), schema: getDeckSchema, verboseParsingErrors: true

137 }),

138 tool((input) => compact(this.catalog.searchLayouts

assets/upstream/dashiai-ppt/project/scripts/export-pptx.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// Headless PPTX/PDF export for a rendered deck — no manually-started preview

3// server, no browser session, no export-endpoint auth to fight with.

4//

5// The browser-facing export flow (preview UI -> POST /api/export-editable-pptx)

6// requires a same-origin Origin/Referer header (see preview-export-auth.mjs),

7// which a bare `curl`/script call can't produce. This CLI sidesteps that by

8// driving the same export engine (packages/html-deck-to-pptx) directly:

9// it spins up scripts/serve-preview-https.mjs on a random loopback port purely

10// to serve the deck's static files, exports, then tears the server down.

assets/upstream/dashiai-ppt/project/assets/vendor/unicornstudio.umd.jsView file

Lines 1-2javascript

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof

assets/upstream/dashiai-ppt/scripts/render_goal_deck.shView file

•path = assets/upstream/dashiai-ppt/scripts/render_goal_deck.sh kind = build_helper sizeBytes = 1468 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/upstream/dashiai-ppt/scripts/render_goal_deck.shView on unpkg

assets/upstream/dashiai-ppt/project/src/components/themes/generated-metadata.jsView file

•path = assets/upstream/dashiai-[redacted]-metadata.js kind = oversized_source_file sizeBytes = 4579172 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

assets/upstream/dashiai-ppt/project/src/components/themes/generated-metadata.jsView on unpkg

Source & flagged code

7 flagged · loading source

dist/index.jsView file

1import { execFileSync } from 'node:child_process'; L2: import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

dist/lib/presentation-studio.middleware.jsView file

156tool(async (input) => { L157: const files = context.runtime.capabilities?.require(WorkspaceFilesRuntimeCapability); L158: if (!files)

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/lib/presentation-studio.middleware.jsView on unpkg · L156

assets/upstream/dashiai-ppt/project/scripts/export-pptx.mjsView file

18// (e.g. output/<deck>/ppt). Relative paths resolve against the caller's cwd. L19: import { spawn } from 'node:child_process'; L20: import { existsSync, mkdirSync, writeFileSync } from 'node:fs'; L21: import net from 'node:net'; L22: import path from 'node:path'; ... L31: // 相对路径按调用方目录解析:npm run(含 --prefix)会把脚本 cwd 切到项目根,INIT_CWD 才是用户所在目录。 L32: const CALLER_CWD = process.env.INIT_CWD || process.cwd(); L33: const SERVER_READY_TIMEOUT_MS = 20000;

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

assets/upstream/dashiai-ppt/project/scripts/export-pptx.mjsView on unpkg · L18

18Cross-file remote execution chain: assets/upstream/dashiai-ppt/project/scripts/export-pptx.mjs spawns assets/upstream/dashiai-ppt/project/packages/html-deck-to-pptx/src/editable.mjs; helper contains network access plus dynamic code execution. L18: // (e.g. output/<deck>/ppt). Relative paths resolve against the caller's cwd. L19: import { spawn } from 'node:child_process'; L20: import { existsSync, mkdirSync, writeFileSync } from 'node:fs'; L21: import net from 'node:net'; L22: import path from 'node:path'; ... L31: // 相对路径按调用方目录解析:npm run(含 --prefix)会把脚本 cwd 切到项目根,INIT_CWD 才是用户所在目录。 L32: const CALLER_CWD = process.env.INIT_CWD || process.cwd(); L33: const SERVER_READY_TIMEOUT_MS = 20000; ... L135: let settled = false; L136: let stderrBuf = ''; L137: const timer = setTimeout(() => {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

assets/upstream/dashiai-ppt/project/scripts/export-pptx.mjsView on unpkg · L18

assets/upstream/dashiai-ppt/project/assets/vendor/unicornstudio.umd.jsView file

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof globalThis?globa...

High

Base64 Obscured Url

Source decodes a Base64-obscured HTTP endpoint at runtime.

assets/upstream/dashiai-ppt/project/assets/vendor/unicornstudio.umd.jsView on unpkg · L1

assets/upstream/dashiai-ppt/scripts/render_goal_deck.shView file

•path = assets/upstream/dashiai-ppt/scripts/render_goal_deck.sh kind = build_helper sizeBytes = 1468 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/upstream/dashiai-ppt/scripts/render_goal_deck.shView on unpkg

assets/upstream/dashiai-ppt/project/src/components/themes/generated-metadata.jsView file

•path = assets/upstream/dashiai-[redacted]-metadata.js kind = oversized_source_file sizeBytes = 4579172 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

assets/upstream/dashiai-ppt/project/src/components/themes/generated-metadata.jsView on unpkg

Findings

6 High5 Medium7 Low

HighChild Processdist/index.js

HighShell

HighSame File Env Network Executionassets/upstream/dashiai-ppt/project/scripts/export-pptx.mjs

HighCross File Remote Execution Contextassets/upstream/dashiai-ppt/project/scripts/export-pptx.mjs

HighBase64 Obscured Urlassets/upstream/dashiai-ppt/project/assets/vendor/unicornstudio.umd.js

HighOversized Source Fileassets/upstream/dashiai-ppt/project/src/components/themes/generated-metadata.js

MediumDynamic Requiredist/lib/presentation-studio.middleware.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperassets/upstream/dashiai-ppt/scripts/render_goal_deck.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowTelemetry

LowUrl Strings

LowCopyleft License

Source & flagged code

7 flagged

dist/index.jsView file

Lines 1-21javascript

1import { execFileSync } from 'node:child_process';

2import { createHash } from 'node:crypto';

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1

3import { existsSync, readFileSync, readdirSync } from 'node:fs';

4import { createRequire } from 'node:module';

5import { dirname, join, relative, sep } from 'node:path';

6import { fileURLToPath } from 'node:url';

7import { z } from 'zod';

8import { CollaborationRuntimeCapability, MANAGED_QUEUE_SERVICE_TOKEN, XPERT_RUNTIME_CAPABILITIES_TOKEN } from '@xpert-ai/plugin-sdk';

10import { PRESENTATION_CONFIG_DEFAULTS } from './lib/presentation-config.service.js';

11import { PresentationStudioPlugin } from './lib/presentation-studio.plugin.js';

12import { presentationStudioTemplates } from './lib/presentation-studio.templates.js';

13const moduleDir = dirname(fileURLToPath(import.meta.url));

14const requireFromPlugin = createRequire(import.meta.url);

15const packageJson = JSON.parse(readFileSync(join(moduleDir, '../package.json'), 'utf8'));

16const ConfigSchema = z.object({

17 chromiumExecutablePath: z.string().min(1).optional(),

18 exportConcurrency: z.number().int().min(1).max(4),

19 maxPageCount: z.number().int().min(3).max(30),

20 maxAssetBytes: z.number().int().positive(),

21 maxDeckMediaBytes: z.number().int().positive(),

dist/lib/presentation-studio.middleware.jsView file

Lines 136-176javascript

137 }),

138 tool((input) => compact(this.catalog.searchLayouts

assets/upstream/dashiai-ppt/project/scripts/export-pptx.mjsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// Headless PPTX/PDF export for a rendered deck — no manually-started preview

3// server, no browser session, no export-endpoint auth to fight with.

4//

5// The browser-facing export flow (preview UI -> POST /api/export-editable-pptx)

6// requires a same-origin Origin/Referer header (see preview-export-auth.mjs),

7// which a bare `curl`/script call can't produce. This CLI sidesteps that by

8// driving the same export engine (packages/html-deck-to-pptx) directly:

9// it spins up scripts/serve-preview-https.mjs on a random loopback port purely

10// to serve the deck's static files, exports, then tears the server down.

assets/upstream/dashiai-ppt/project/assets/vendor/unicornstudio.umd.jsView file

Lines 1-2javascript

1!function(e,t){"object"==typeof exports&&"undefined"!=typeof module?t(exports):"function"==typeof define&&define.amd?define(["exports"],t):t((e="undefined"!=typeof

assets/upstream/dashiai-ppt/scripts/render_goal_deck.shView file

•path = assets/upstream/dashiai-ppt/scripts/render_goal_deck.sh kind = build_helper sizeBytes = 1468 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/upstream/dashiai-ppt/scripts/render_goal_deck.shView on unpkg

assets/upstream/dashiai-ppt/project/src/components/themes/generated-metadata.jsView file

•path = assets/upstream/dashiai-[redacted]-metadata.js kind = oversized_source_file sizeBytes = 4579172 magicHex = [redacted]

High

Oversized Source File

Package contains source files above the static scanner size ceiling.

assets/upstream/dashiai-ppt/project/src/components/themes/generated-metadata.jsView on unpkg