registry / aiworkspace / 0.3.0

aiworkspace@0.3.0

Set up and manage AI agent skills and configs for Cursor, Claude Code, Codex and more across multi-repo workspaces

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 49.8 KB of source, external domains: github.com

Source & flagged code

5 flagged

package.jsonView file

Lines 21-61json

21 "scripts/",

22 "root-config/",

23 ".agents/README.md",

24 ".gitignore",

25 "LICENSE",

26 "README.md",

27 "AGENTS.md",

28 "setup.md"

29 ],

30 "scripts": {

31 "lint": "eslint .",

32 "test": "node --test test/*.test.mjs",

33 "skills:setup": "node scripts/skills/setup-skills.mjs",

34 "skills:add": "node scripts/skills/add-skill.mjs",

35 "skills:remove": "node scripts/skills/remove-skill.mjs",

36 "skills:list": "cd root-config && skills list",

37 "skills:find": "skills find",

38 "skills:update": "skills update && cd root-config && skills update && cd .. && node scripts/skills/setup-skills.mjs",

39 "skills:create": "node scripts/skills/create-skill.mjs",

40 "skills:check": "echo workspace: && skills check && echo root-config: && cd root-config && skills check",

41 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 "upgrade": "node scripts/upgrade.mjs"

43 },

44 "dependencies": {

45 "skills": "^1.5.11"

46 },

47 "devDependencies": {

48 "@eslint/js": "^10.0.1",

49 "eslint": "^10.1.0"

50 },

51 "engines": {

52 "node": ">=18"

53 },

54 "keywords": [

55 "ai",

56 "workspace",

57 "cursor",

58 "claude",

59 "codex",

60 "antigravity",

61 "copilot",

bin/aiworkspace.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * aiworkspace CLI — scaffolds a new AI workspace directory.

5 *

6 * Usage:

7 * npx aiworkspace init [name]

8 * npx aiworkspace init --name foo

9 */

11import { existsSync, mkdirSync, cpSync, writeFileSync, readFileSync } from "node:fs";

12import

scripts/lib.mjsView file

Lines 330-358javascript

330 return true;

331}

332

333/**

334 * Run setup-skills.mjs. Exits on failure.

335 */

336export function runSetup() {

337 const script = join(REPO_DIR,

scripts/postinstall.mjsView file

Lines 4-44javascript

4 * postinstall.mjs — Cross-platform postinstall hook.

5 *

6 * Restores skills from lock files, syncs configs, and installs git hooks.

7 * Replaces inline shell script to work on Windows (cmd.exe) and Unix.

8 */

10import { join, sep } from "node:path";

11import

Source & flagged code

5 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/aiworkspace.mjsView file

13import { fileURLToPath } from "node:url"; L14: import { execFileSync } from "node:child_process"; L15:

High

Child Process

Package source references child process execution.

bin/aiworkspace.mjsView on unpkg · L13

scripts/lib.mjsView file

350stdio: "inherit", L351: ...(process.platform === "win32" ? { shell: true } : {}), L352: });

High

Shell

Package source references shell execution.

scripts/lib.mjsView on unpkg · L350

scripts/postinstall.mjsView file

24try { L25: spawnSync("npx", ["skills", "experimental_install"], { L26: cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/postinstall.mjsView on unpkg · L24

Findings

4 High2 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/aiworkspace.mjs

HighShellscripts/lib.mjs

HighRuntime Package Installscripts/postinstall.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

package.jsonView file

Lines 21-61json

21 "scripts/",

22 "root-config/",

23 ".agents/README.md",

24 ".gitignore",

25 "LICENSE",

26 "README.md",

27 "AGENTS.md",

28 "setup.md"

29 ],

30 "scripts": {

31 "lint": "eslint .",

32 "test": "node --test test/*.test.mjs",

33 "skills:setup": "node scripts/skills/setup-skills.mjs",

34 "skills:add": "node scripts/skills/add-skill.mjs",

35 "skills:remove": "node scripts/skills/remove-skill.mjs",

36 "skills:list": "cd root-config && skills list",

37 "skills:find": "skills find",

38 "skills:update": "skills update && cd root-config && skills update && cd .. && node scripts/skills/setup-skills.mjs",

39 "skills:create": "node scripts/skills/create-skill.mjs",

40 "skills:check": "echo workspace: && skills check && echo root-config: && cd root-config && skills check",

41 "postinstall": "node scripts/postinstall.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L41

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L41

42 "upgrade": "node scripts/upgrade.mjs"

43 },

44 "dependencies": {

45 "skills": "^1.5.11"

46 },

47 "devDependencies": {

48 "@eslint/js": "^10.0.1",

49 "eslint": "^10.1.0"

50 },

51 "engines": {

52 "node": ">=18"

53 },

54 "keywords": [

55 "ai",

56 "workspace",

57 "cursor",

58 "claude",

59 "codex",

60 "antigravity",

61 "copilot",

bin/aiworkspace.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * aiworkspace CLI — scaffolds a new AI workspace directory.

5 *

6 * Usage:

7 * npx aiworkspace init [name]

8 * npx aiworkspace init --name foo

9 */

11import { existsSync, mkdirSync, cpSync, writeFileSync, readFileSync } from "node:fs";

12import

scripts/lib.mjsView file

Lines 330-358javascript

330 return true;

331}

332

333/**

334 * Run setup-skills.mjs. Exits on failure.

335 */

336export function runSetup() {

337 const script = join(REPO_DIR,

scripts/postinstall.mjsView file

Lines 4-44javascript

4 * postinstall.mjs — Cross-platform postinstall hook.

5 *

6 * Restores skills from lock files, syncs configs, and installs git hooks.

7 * Replaces inline shell script to work on Windows (cmd.exe) and Unix.

8 */

10import { join, sep } from "node:path";

11import