registry / @youtubebrief/cli / 0.1.0-beta.1

@youtubebrief/cli@0.1.0-beta.1

CLI and local MCP client for turning explicit YouTube URLs into agent-readable Youtubebrief bundles.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 21 file(s), 147 KB of source, external domains: example.com, json-schema.org, www.youtube.com, youtu.be, youtubebrief.com

Source & flagged code

1 flagged

src/batch.mjsView file

Lines 17-57javascript

17 /sk_[A-Za-z0-9_-]{12,}/g,

18 /api[_-]?key[=:]\s*[^\s,&}]+/gi,

19 /access[_-]?token[=:]\s*[^\s,&}]+/gi,

20 /raw[_-]?provider[_-]?secret[^\s,&}]*/gi,

21 /provider[_-]?secret[=:]?\s*[^\s,&}]+/gi,

22 /stack\s*trace/gi,

23];

24const SENSITIVE_JSON_KEY_PATTERN = /api[_-]?key|access[_-]?token|raw[_-]?provider|provider[_-]?secret|stack/i;

25const RETRYABLE_ERROR_CODES = new Set(['provider_error', 'network_error', 'timeout']);

27export const BATCH_EXIT_CODES = Object.freeze({

28 success: 0,

29 fatal: 1,

30 partial: 2,

31 insufficientCredits: 3,

32 auth: 4,

33 providerOrNetwork: 5,

34 manifest: 6,

35});

37export const MANIFEST_JSON_SCHEMA = Object.freeze({

38 $schema: 'https://json-schema.org/draft/2020-12/schema',

39 $id: 'https://youtubebrief.com/schemas/youtubebrief-batch-manifest.schema.json',

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/batch.mjsView on unpkg · L37

40 title: 'Youtubebrief batch manifest',

41 type: 'object',

42 required: ['schema_version', 'batch_id', 'status', 'items'],

43 properties: {

44 schema_version: { type: 'string', const: SCHEMA_VERSION },

45 batch_id: { type: 'string' },

46 status: { enum: ['running', 'succeeded', 'partial_failure', 'failed', 'planned', 'estimated'] },

47 mode: { enum: ['run', 'dry_run', 'estimate_credits', 'resume', 'single'] },

48 out_dir: { type: 'string' },

49 billing_block_minutes: { type: 'number' },

50 outputs: {

51 type: 'object',

52 properties: {

53 combined_markdown: { type: ['string', 'null'] },

54 jsonl: { type: ['string', 'null'] },

55 },

56 additionalProperties: false,

57 },

Source & flagged code

1 flagged · loading source

src/batch.mjsView file

37export const MANIFEST_JSON_SCHEMA = Object.freeze({ L38: $schema: 'https://json-schema.org/draft/2020-12/schema', L39: $id: 'https://youtubebrief.com/schemas/youtubebrief-batch-manifest.schema.json', ... L123: L124: if (isLocalOrPrivateHostname(hostname)) { L125: throw new CliError('Unsafe YouTube URL host. Local, private, and metadata hosts are not allowed.'); ... L289: try { L290: parsed = JSON.parse(await readFile(manifestPath, 'utf8')); L291: } catch (error) { L292: if (error && error.code === 'ENOENT') { L293: throw new CliError(`Cannot resume batch: missing manifest.json in ${path.resolve(outDir)}.`, { exitCode: BATCH_EXIT_CODES.manifest }); L294: }

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/batch.mjsView on unpkg · L37

Findings

1 High2 Medium5 Low

HighCloud Metadata Accesssrc/batch.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

1 flagged

src/batch.mjsView file

Lines 17-57javascript

17 /sk_[A-Za-z0-9_-]{12,}/g,

18 /api[_-]?key[=:]\s*[^\s,&}]+/gi,

19 /access[_-]?token[=:]\s*[^\s,&}]+/gi,

20 /raw[_-]?provider[_-]?secret[^\s,&}]*/gi,

21 /provider[_-]?secret[=:]?\s*[^\s,&}]+/gi,

22 /stack\s*trace/gi,

23];

24const SENSITIVE_JSON_KEY_PATTERN = /api[_-]?key|access[_-]?token|raw[_-]?provider|provider[_-]?secret|stack/i;

25const RETRYABLE_ERROR_CODES = new Set(['provider_error', 'network_error', 'timeout']);

27export const BATCH_EXIT_CODES = Object.freeze({

28 success: 0,

29 fatal: 1,

30 partial: 2,

31 insufficientCredits: 3,

32 auth: 4,

33 providerOrNetwork: 5,

34 manifest: 6,

35});

37export const MANIFEST_JSON_SCHEMA = Object.freeze({

38 $schema: 'https://json-schema.org/draft/2020-12/schema',

39 $id: 'https://youtubebrief.com/schemas/youtubebrief-batch-manifest.schema.json',

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

src/batch.mjsView on unpkg · L37

40 title: 'Youtubebrief batch manifest',

41 type: 'object',

42 required: ['schema_version', 'batch_id', 'status', 'items'],

43 properties: {

44 schema_version: { type: 'string', const: SCHEMA_VERSION },

45 batch_id: { type: 'string' },

46 status: { enum: ['running', 'succeeded', 'partial_failure', 'failed', 'planned', 'estimated'] },

47 mode: { enum: ['run', 'dry_run', 'estimate_credits', 'resume', 'single'] },

48 out_dir: { type: 'string' },

49 billing_block_minutes: { type: 'number' },

50 outputs: {

51 type: 'object',

52 properties: {

53 combined_markdown: { type: ['string', 'null'] },

54 jsonl: { type: ['string', 'null'] },

55 },

56 additionalProperties: false,

57 },