registry / @zibby/skills / 0.1.74

@zibby/skills@0.1.74

⚠ Under review

Built-in skill definitions for the Zibby agent-workflow framework

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsMinifiedUrlStrings

Manifest

WildcardDependency

scanned 48 file(s), 1.08 MB of source, external domains: api-prod.zibby.app, api.anthropic.com, api.atlassian.com, api.cursor.com, api.figma.com, api.github.com, api.linear.app, api.linkedin.com, api.notion.com, api.openai.com, api.plane.so, discord.com, docs.dolthub.com, docs.google.com, docs.googleapis.com, drive.google.com, example.com, feishu.cn, github.com, gitlab.com, sentry.io, slack.com, studio.zibby.dev, the-internet.herokuapp.com, www.googleapis.com, www.larksuite.com, www.notion.so

Source & flagged code

6 flagged

dist/git.jsView file

Lines 1-13javascript

1import{spawn as T}from"child_process";import{existsSync as p,mkdirSync as O,readdirSync as $,statSync as j,readFileSync as R}from"fs";import{resolve as v,join as l,basename as C}from"path";var x=".zibby/repos";function w(u,n,r={}){return new Promise((o,i)=>{let e=T(u,{cwd:n,shell:!0,env:{...process.env,GIT_TERMINAL_PROMPT:"0",...r}}),c="",f="";e.stdout.on("data",s=>{c+=s.toString()}),e.stderr.on("data",s=>{f+=s.toString()}),e.on("close",s=>{s!==0?i(new Error(`Exit ${s}: ${f.trim()||c.trim()}`)):o(c.trim())}),e.on("error",s=>i(s))})}var A={id:"git",description:"Clone and manage git repositories ...

2You can clone and explore git repositories locally for codebase analysis:

High

Child Process

Package source references child process execution.

dist/git.jsView on unpkg · L1

3- git_checkout: Clone a repo (or pull if already cloned). Supports GitHub and GitLab with auto-auth.

4- git_list_repos: List locally cloned repos

5- git_explore: Quick overview of a cloned repo's structure (key files, package.json, routes, etc.)

7When a test ticket lacks context, use this workflow:

81. Clone the relevant repo with git_checkout

92. Use git_explore to understand the project structure

103. Use shell commands (grep, cat) to read specific files for deeper understanding

114. Use GitHub/GitLab skills to read related PRs and commits

125. Build well-informed test specs and save them to files before running tests`,resolve(){return null},async handleToolCall(u,n,r){let o=r?.options?.workspace||process.cwd();try{switch(u){case"git_checkout":return await N(n,o);case"git_list_repos":return L(n,o);case"git_explore":return D(n,o);default:return JSON.stringify({error:`Unknown tool: ${u}`})}}catch(i){return JSON.stringify({error:i.message})}},tools:[{name:"git_checkout",description:"Clone a git repository locally (or pull latest if already cloned). Auto-authenticates with GitHub/GitLab tokens if available.",input_schema:{type:"object ...

Long lines were clipped for display.

bin/mcp-skill.mjsView file

Lines 83-123javascript

83 * Convert a JSON-Schema object (a tool's `input_schema`) into a Zod

84 * RAW SHAPE — a plain object of validators — which is what

85 * `McpServer.registerTool`'s `inputSchema` expects (NOT a full schema).

86 * Required keys stay required; everything else becomes `.optional()`.

dist/gitlab.jsView file

Lines 6-30javascript

6- gitlab_clone: Clone a project locally (shallow, auto-authenticated) to read code OUTSIDE the MR diff \u2014 callers, shared types, an existing util, or a cross-repo dependency. After cloning, use Grep/Glob/Read on the returned path. Clone SPARINGLY (only when correctness needs context beyond the diff).

8### Merge requests

9- gitlab_create_mr: OPEN a merge request (POST /

dist/index.jsView file

Lines 1-21javascript

dist/git-write.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = @zibby/skills@0.1.55 matchedIdentity = npm:QHppYmJ5L3NraWxscw:0.1.55 similarity = 0.400 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/git-write.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/git.jsView file

High

Child Process

Package source references child process execution.

dist/git.jsView on unpkg · L1

bin/mcp-skill.mjsView file

103const modulePath = resolvePath(here, moduleArg); L104: const mod = await import(pathToFileURL(modulePath).href); L105: const skill = mod[exportName];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/mcp-skill.mjsView on unpkg · L103

dist/gitlab.jsView file

26- A code-review flow is: gitlab_get_mr (context + diff_refs) \u2192 gitlab_get_mr_changes (the diff) \u2192 gitlab_post_mr_discussion per inline finding \u2192 gitlab_post_mr_note ... L27: - If an inline position is rejected by GitLab (bad line anchor), fall back to gitlab_post_mr_note with the file/line in the text.`,resolve(){let u=v();if(!u)return{command:null,arg... L28: `).slice(0,30).join(`

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/gitlab.jsView on unpkg · L26

dist/index.jsView file

4083. After OAuth completes, ask me to install GitHub again`},slack:{description:"Slack messages, channels, reactions",integrationProvider:"slack",envKeys:[],setupInstructions:`To con... L409: 1. Go to Settings \u2192 Integrations (https://studio.zibby.dev/integrations) L410: 2. Click "Connect Slack" and authorize ... L414: 3. After OAuth completes, ask me to install Sentry again`},runner:{description:"Run zibby test workflows from chat (parallel supported)",envKeys:[],setupInstructions:"Ready to use.... L415: `)}function Oa(){if(process.env.ZIBBY_USER_TOKEN)return process.env.ZIBBY_USER_TOKEN;try{let n=Ia(Sa(),".zibby","config.json");return ka(n)&&JSON.parse(wa(n,"utf-8")).sessionToken|... L416: `)}function Ja(n,e){let t=n.cwd?Ye(n.cwd,e):e;return Yr(n.command,{cwd:t,encoding:"utf-8",timeout:3e4,maxBuffer:Ca,stdio:["pipe","pipe","pipe"]})||"(no output)"}function Ba(n){let{... L417: You have access to the user's Sentry. Use these tools: ... L423: ${e} [${n}] ${t} L424: `;try{process.stderr.write(r)}catch{}}function Tt(){ne.length=0;for(let[,n]of U)if(n.status==="queued"&&(n.status="cancelled"),n.status==="running"&&n._child)try{n._child.kill("SIG... L425: You can run zibby test

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L408

1import{registerSkill as N}from"@zibby/agent-workflow";import{createRequire as Ts}from"module";import{join as As}from"path";var Es=Ts(import.meta.url);function xs(){if(process.env.M... L2: If you DO NOT have access to browser tools \u2192 return {"success": false, "steps": [], "browserClosed": false, "notes": "No browser tools available"}. ... L23: L24: `)}function fe(n){return String(n||"").toLowerCase().replace(/\s+/g,"").replace(/[()\-_:："'`]/g,"")}function ht(n){return fe(n).replace(/[a-z0-9]+/g,"")}function Me(n,e){let t=fe(n... L25: You have direct access to the user's Jira. Use these tools proactively: ... L77: ### Discovery L78: - github_list_repos: Lists ALL accessible repos (personal + orgs, private + public, up to 200 repos). Use to find a RELATED repo worth cloning for cross-repo context. L79: - github_search_repos: Search for a specific repo by name (e.g., "electron", "my-app") ... L116: When user just wants to "look at" or "read" files (not clone): L117: - Use github_get_file to read individual files via API`,resolve(){let n=Qs();if(!n)return{command:null,args:[],env:{},description:this.description};let e={};for(let t of this.envKe... L118: `).slice(0,30).join(`

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

dist/index.jsView on unpkg · L1

dist/git-write.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/git-write.jsView on unpkg

Findings

1 Critical4 High5 Medium4 Low

CriticalPrevious Version Dangerous Deltadist/git-write.js

HighChild Processdist/git.js

HighSame File Env Network Executiondist/gitlab.js

HighCommand Output Exfiltrationdist/index.js

HighSandbox Evasion Gated Capabilitydist/index.js

MediumDynamic Requirebin/mcp-skill.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

dist/git.jsView file

Lines 1-13javascript

2You can clone and explore git repositories locally for codebase analysis:

High

Child Process

Package source references child process execution.

dist/git.jsView on unpkg · L1

3- git_checkout: Clone a repo (or pull if already cloned). Supports GitHub and GitLab with auto-auth.

4- git_list_repos: List locally cloned repos

5- git_explore: Quick overview of a cloned repo's structure (key files, package.json, routes, etc.)

7When a test ticket lacks context, use this workflow:

81. Clone the relevant repo with git_checkout

92. Use git_explore to understand the project structure

103. Use shell commands (grep, cat) to read specific files for deeper understanding

114. Use GitHub/GitLab skills to read related PRs and commits

Long lines were clipped for display.

bin/mcp-skill.mjsView file

Lines 83-123javascript

83 * Convert a JSON-Schema object (a tool's `input_schema`) into a Zod

84 * RAW SHAPE — a plain object of validators — which is what

85 * `McpServer.registerTool`'s `inputSchema` expects (NOT a full schema).

86 * Required keys stay required; everything else becomes `.optional()`.

dist/gitlab.jsView file

Lines 6-30javascript

8### Merge requests

9- gitlab_create_mr: OPEN a merge request (POST /

dist/index.jsView file

Lines 1-21javascript

dist/git-write.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/git-write.jsView on unpkg

Lines 388-428javascript

388- If SLACK_CHANNEL / LARK_RECEIVE_ID is set, that is the default destination \u2014 use it.

389- If NO destination env var is set but your instructions name a channel (e.g. "post to #bla"), post to THAT channel \u2014 pass it as the \`channel\` arg (a "#name" or "C0123" id both work).

390- If neither an env var NOR an instruction gives you a channel, do NOT post \u2014 there is nowhere to send it.`,resolve(n){return process.env.SLACK_CHANNEL&&typeof j.resolve=="function"?j.resolve(n):process.env.LARK_RECEIVE_ID&&typeof K.resolve=="function"?K.resolve(n):process.env.SLACK_BOT_TOKEN&&typeof j.resolve=="function"?j.resolve(n):null},async handleToolCall(n,e,t){return typeof n=="string"&&n.startsWith("slack_")?j.handleToolCall(n,e,t):typeof n=="string"&&n.startsWith("lark_")?K.handleToolCall(n,e,t):JSON.stringify({error:`chat_notify: unknown tool "${n}". Expected slack_* or lark_*. ...

391- Review any test memory/history above. Prefer selectors proven to work.

392- If a previous run failed, avoid the same approach.

393- After setup/login completes, navigate directly to the target page instead of clicking through menus.

394

395DURING execution \u2014 when a selector fails and you switch to a fallback:

396- Call memory_save_insight IMMEDIATELY with category: selector_tip

397- Include: which stableId/selector failed, which fallback worked, and the page URL.

398

399AFTER completing the test, you MUST call memory_save_insight at least once:

400- Save any useful finding: reliable selectors, timing quirks, navigation patterns, workarounds.

402- Be specific \u2014 future runs will read your insights.`,resolve(){let n=ba();if(!n)return console.warn("[memory] @zibby/ui-memory not found \u2014 memory tools disabled for this run"),null;let e=Br(process.cwd(),".zibby","memory");if(!ga(Br(e,".dolt")))return console.warn("[memory] DB/dolt unavailable \u2014 memory tools disabled for this run"),null;try{let t=ya("dolt",["sql","-q","SELECT COUNT(*) AS cnt FROM test_runs","-r","json"],{cwd:e,encoding:"utf-8",timeout:5e3}),r=JSON.parse(t.trim()).rows||[];if(!r[0]||r[0].cnt===0)return console.log("[memory] Database empty \u2014 memory tools act ...

4031. Go to Settings \u2192 Integrations (https://studio.zibby.dev/integrations)

4042. Click "Connect Jira" and authorize via Atlassian OAuth

4053. After OAuth completes, ask me to install Jira again`},github:{description:"GitHub issues, PRs, repository management",integrationProvider:"github",envKeys:[],setupInstructions:`To connect GitHub:

4061. Go to Settings \u2192 Integrations (https://studio.zibby.dev/integrations)

4072. Click "Connect GitHub" and authorize

4083. After OAuth completes, ask me to install GitHub again`},slack:{description:"Slack messages, channels, reactions",integrationProvider:"slack",envKeys:[],setupInstructions:`To connect Slack:

4091. Go to Settings \u2192 Integrations (https://studio.zibby.dev/integrations)

4102. Click "Connect Slack" and authorize

4113. After OAuth completes, ask me to install Slack again`},sentry:{description:"Sentry error tracking \u2014 projects, issues, events",integrationProvider:"sentry",envKeys:[],setupInstructions:`To connect Sentry:

4121. Go to Settings \u2192 Integrations (https://studio.zibby.dev/integrations)

4132. Click "Connect Sentry" and authorize

4143. After OAuth completes, ask me to install Sentry again`},runner:{description:"Run zibby test workflows from chat (parallel supported)",envKeys:[],setupInstructions:"Ready to use. Runs zibby test workflows as background processes \u2014 each with its own browser and session."},browser:{description:"Playwright browser automation (navigate, click, fill, screenshot)",envKeys:[],setupInstructions:"Ready to use. Starts a Playwright browser for web automation."},memory:{description:"Test memory database (Dolt) \u2014 history, selectors, insights",envKeys:[],setupInstructions:"Ready to use. Requires ...

415`)}function Oa(){if(process.env.ZIBBY_USER_TOKEN)return process.env.ZIBBY_USER_TOKEN;try{let n=Ia(Sa(),".zibby","config.json");return ka(n)&&JSON.parse(wa(n,"utf-8")).sessionToken||null}catch{return null}}function Ra(){return(process.env.ZIBBY_API_URL||process.env.ZIBBY_PROD_API_URL||"https://api-prod.zibby.app").replace(/\/$/,"")}function St(){return`${(process.env.ZIBBY_FRONTEND_URL||process.env.ZIBBY_PROD_FRONTEND_URL||"https://studio.zibby.dev").replace(/\/$/,"")}/integrations`}function Ta(n){try{let e=process.platform;return va(e==="darwin"?"open":e==="win32"?"cmd":"xdg-open",e==="win32"? ...

416`)}function Ja(n,e){let t=n.cwd?Ye(n.cwd,e):e;return Yr(n.command,{cwd:t,encoding:"utf-8",timeout:3e4,maxBuffer:Ca,stdio:["pipe","pipe","pipe"]})||"(no output)"}function Ba(n){let{url:e}=n;if(

417You have access to the user's Sentry. Use these tools:

418- sentry_list_projects: List projects in the organization

419- sentry_list_issues: List errors/issues (supports Sentry search query, project filter, sort)

420- sentry_get_issue: Get detailed info about a specific issue (requires issueId)

421- sentry_update_issue: Change an issue's status (resolved / resolvedInNextRelease / ignored / unresolved / muted), assignment, or bookmark (requires issueId; needs write scope)

422- sentry_add_comment: Post a comment/note on an issue (requires issueId + text; needs write scope)`,resolve(){let n=za();if(!n)return null;let e={};for(let t of["PROJECT_API_TOKEN","ZIBBY_USER_TOKEN","ZIBBY_ACCOUNT_API_URL","ZIBBY_ENV","ZIBBY_PROD_ACCOUNT_API_URL","PROGRESS_API_URL","EXECUTION_ID","PROJECT_ID","STAGE","ZIBBY_SELF_HOST","SENTRY_URL","SENTRY_ORG","SENTRY_AUTH_TOKEN"])process.env[t]&&(e[t]=process.env[t]);return{type:"stdio",command:"node",args:[n],env:e,alwaysLoad:!0}},async handleToolCall(n,e={}){try{switch(n){case"sentry_list_projects":{let t=await Ya();return JSON.stringify({ ...

423 ${e} [${n}] ${t}

424`;try{process.stderr.write(r)}catch{}}function Tt(){ne.length=0;for(let[,n]of U)if(n.status==="queued"&&(n.status="cancelled"),n.status==="running"&&n._child)try{n._child.kill("SIGTERM")}catch{}}process.on("exit",Tt);process.

425You can run zibby test workflows directly from chat:

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L408

426

427**CRITICAL: When user asks to test a ticket:**

4281. Load the issue with your tracker tools (whatever is connected)

Long lines were clipped for display.