registry / ai-squad / 0.1.0

ai-squad@0.1.0

Interactive CLI to scaffold AI agent infrastructure for new projects

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 33.0 KB of source

Source & flagged code

2 flagged

dist/index.jsView file

Lines 784-824javascript

784 if (exists) {

785 const existing = await readFile2(absolutePath, "utf-8");

786 if (existing === content) {

787 return "skipped";

788 }

789 if (promptUser) {

790 const overwrite = await promptUser(

791 `File ${pc.yellow(relPath)} already exists. Overwrite?`

792 );

793 if (!overwrite) return "skipped";

794 }

795 await writeFile(absolutePath, content, "utf-8");

796 return "overwritten";

797 }

798 await writeFile(absolutePath, content, "utf-8");

799 return "created";

800}

801

802// src/wizard.ts

803import { resolve as resolve3 } from "path";

804import { mkdir as mkdir2, access as access2 } from "fs/promises";

805import { execSync } from "child_process";

806async function runWizard() {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L804

807 intro(pc2.bold(pc2.cyan("ai-squad init")));

808 const projectName = await text({

809 message: "Project name?",

810 placeholder: "my-awesome-app",

811 validate(value) {

812 if (!value) return "Required.";

813 if (!/^[a-z0-9-]+$/.test(value)) return "Lowercase letters, numbers, and hyphens only.";

814 }

815 });

816 if (isCancel(projectName)) {

817 cancel("Cancelled.");

818 process.exit(0);

819 }

820 const allTech = getTechStacks();

821 const techStack = await multiselect({

822 message: "Tech stack? (space to select, enter to confirm)",

823 options: allTech.map((t) => ({ value: t, label: t.charAt(0).toUpperCase() + t.slice(1) })),

824 required: false

Lines 961-1001javascript

961 clearCache();

962 let created = 0;

963 let skipped = 0;

964 for (const file of files) {

965 const result = await writeFileSafe(projectDir, file.path, file.content, dryRun);

Source & flagged code

2 flagged · loading source

dist/index.jsView file

804import { mkdir as mkdir2, access as access2 } from "fs/promises"; L805: import { execSync } from "child_process"; L806: async function runWizard() {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L804

981try { L982: execSync(cmd, { cwd: projectDir, stdio: "pipe" }); L983: console.log(pc2.green(` \u2713 Installed`)); L984: } catch { L985: console.log(pc2.yellow(` \u26A0 Skipped \u2014 npx skills may not be available`)); L986: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L981

Findings

3 High1 Medium4 Low

HighChild Processdist/index.js

HighShell

HighRuntime Package Installdist/index.js

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

dist/index.jsView file

Lines 784-824javascript

784 if (exists) {

785 const existing = await readFile2(absolutePath, "utf-8");

786 if (existing === content) {

787 return "skipped";

788 }

789 if (promptUser) {

790 const overwrite = await promptUser(

791 `File ${pc.yellow(relPath)} already exists. Overwrite?`

792 );

793 if (!overwrite) return "skipped";

794 }

795 await writeFile(absolutePath, content, "utf-8");

796 return "overwritten";

797 }

798 await writeFile(absolutePath, content, "utf-8");

799 return "created";

800}

801

802// src/wizard.ts

803import { resolve as resolve3 } from "path";

804import { mkdir as mkdir2, access as access2 } from "fs/promises";

805import { execSync } from "child_process";

806async function runWizard() {

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L804

807 intro(pc2.bold(pc2.cyan("ai-squad init")));

808 const projectName = await text({

809 message: "Project name?",

810 placeholder: "my-awesome-app",

811 validate(value) {

812 if (!value) return "Required.";

813 if (!/^[a-z0-9-]+$/.test(value)) return "Lowercase letters, numbers, and hyphens only.";

814 }

815 });

816 if (isCancel(projectName)) {

817 cancel("Cancelled.");

818 process.exit(0);

819 }

820 const allTech = getTechStacks();

821 const techStack = await multiselect({

822 message: "Tech stack? (space to select, enter to confirm)",

823 options: allTech.map((t) => ({ value: t, label: t.charAt(0).toUpperCase() + t.slice(1) })),

824 required: false

Lines 961-1001javascript

961 clearCache();

962 let created = 0;

963 let skipped = 0;

964 for (const file of files) {

965 const result = await writeFileSafe(projectDir, file.path, file.content, dryRun);