registry / arkaos / 4.3.0

arkaos@4.3.0

The Operating System for AI Agent Teams

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 43 file(s), 234 KB of source, external domains: higgsfield.ai, nodejs.org, obsidian.md, ollama.com, python.org, www.apple.com, www.python.org

Source & flagged code

7 flagged

departments/dev/skills/env-secrets/SKILL.mdView file

Lines 11-51markdown

12## What It Does

14Audits environment files for leaked secrets, validates .env/.env.example drift, and provides vault integration guidance for production workloads.

16## Audit Checklist

18| Check | What to Verify | Severity |

19|-------|---------------|----------|

20| .gitignore | `.env` listed and not tracked | CRITICAL |

21| Hardcoded secrets | API keys, passwords, tokens in source code | CRITICAL |

22| .env.example sync | All keys present with placeholder values, no real values | HIGH |

23| Secret patterns | AWS keys, Stripe keys, JWT secrets, DB passwords | CRITICAL |

24| Git history | Secrets ever committed (even if removed) | HIGH |

25| CI/CD variables | Secrets masked and scoped to environments | MEDIUM |

27## Secret Detection Patterns

29| Pattern | Regex | Example Match |

30|---------|-------|--------------|

31| AWS Access Key | `AKIA[0-9A-Z]{16}` | `AKIAIOSFODNN7EXAMPLE` |

Critical

Critical Secret

Package contains a critical-looking secret pattern.

departments/dev/skills/env-secrets/SKILL.mdView on unpkg · L31

Critical

Secret Pattern

AWS access key ID in departments/dev/skills/env-secrets/SKILL.md

departments/dev/skills/env-secrets/SKILL.mdView on unpkg · L31

32| Stripe Key | `sk_(live\|test)_[0-9a-zA-Z]{24,}` | `sk_live_abc123...` |

33| JWT Secret | `(jwt\|JWT).*(secret\|key).*=.+` | `JWT_SECRET=mysecret` |

34| Generic Password | `(password\|passwd\|pwd).*=.{8,}` | `DB_PASSWORD=hunter2` |

37## Automated Scans

39| Tool | Purpose | Command |

40|------|---------|---------|

41| GitLeaks | Scan repo for secrets | `gitleaks detect --source . --report-path gitleaks.json` |

42| detect-secrets | Baseline + audit | `detect-secrets scan > .secrets.baseline` |

43| git log | History check | `git log --all --diff-filter=A -- '*.env' '*secret*'` |

45## Vault Integration Guide

47| Provider | Best For | Integration Pattern |

48|----------|----------|-------------------|

49| HashiCorp Vault | Multi-cloud / hybrid | SDK pull or sidecar injection |

50| AWS Secrets Manager | AWS-native | Lambda/ECS native, auto-rotation |

51| Azure Key Vault | Azure-native | Managed HSM, Azure AD RBAC |

installer/frontend-tooling.jsView file

Lines 1-37javascript

1// Frontend UI/UX tooling setup for `npx arkaos install` and

2// `npx arkaos@latest update`.

3//

4// Wires three operator-mandated tools into the install/update flow:

5// 1. Magic MCP (@21st-dev/magic) — user-scope, API-key gated. The key is

6// prompted interactively when missing and never stored in the repo;

7// it lives only in ~/.arkaos/keys.json (chmod 600) + Claude user config.

8// 2. Motion AI Kit (npx motion-ai) — auto-run on every install/update.

9// 3. (ui-ux-pro-max plugin + marketplace is handled in claude-plugins.js.)

10//

11// Invariants (.claude/rules/node-installer.md):

installer/autostart.jsView file

Lines 1-33javascript

1/**

2 * Cross-OS autostart for the ArkaOS dashboard (v3.72.0, feature #2).

3 *

4 * Opt-in: `npx arkaos autostart enable|disable|status`. Installs a per-OS

5 * boot item that runs `scripts/start-dashboard.sh` (macOS/Linux) or

6 * `scripts/start-dashboard.ps1` (Windows) — the same launcher the

7 * `dashboard` command uses, which already starts the Python API + the

8 * dashboard UI (preferring the production build, falling back to dev).

9 *

10 * ESM, Node + Bun, no interactive prompts. The unit-generation (`unitFor`)

11 * is pure so it can be unit-tested without touching the OS.

core/fusion/__init__.pyView file

•path = core/fusion/__init__.py kind = build_helper sizeBytes = 197 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/fusion/__init__.pyView on unpkg

Source & flagged code

7 flagged · loading source

departments/dev/skills/env-secrets/SKILL.mdView file

31patternName = aws_access_key severity = critical line = 31 matchedText = | AWS Ac...E` |

Critical

Critical Secret

Package contains a critical-looking secret pattern.

departments/dev/skills/env-secrets/SKILL.mdView on unpkg · L31

31patternName = aws_access_key severity = critical line = 31 matchedText = | AWS Ac...E` |

Critical

Secret Pattern

AWS access key ID in departments/dev/skills/env-secrets/SKILL.md

departments/dev/skills/env-secrets/SKILL.mdView on unpkg · L31

installer/frontend-tooling.jsView file

17import { existsSync, readFileSync, writeFileSync, chmodSync } from "node:fs"; L18: import { execSync, spawnSync } from "node:child_process"; L19: import { createInterface } from "node:readline";

High

Child Process

Package source references child process execution.

installer/frontend-tooling.jsView on unpkg · L17

7// it lives only in ~/.arkaos/keys.json (chmod 600) + Claude user config. L8: // 2. Motion AI Kit (npx motion-ai) — auto-run on every install/update. L9: // 3. (ui-ux-pro-max plugin + marketplace is handled in claude-plugins.js.) ... L17: import { existsSync, readFileSync, writeFileSync, chmodSync } from "node:fs"; L18: import { execSync, spawnSync } from "node:child_process"; L19: import { createInterface } from "node:readline";

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

installer/frontend-tooling.jsView on unpkg · L7

installer/autostart.jsView file

103set ARKAOS_NO_BROWSER=1 L104: powershell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File "${ps1}" L105: `;

High

Shell

Package source references shell execution.

installer/autostart.jsView on unpkg · L103

13L14: import { execSync } from "node:child_process"; L15: import { existsSync, mkdirSync, rmSync, writeFileSync } from "node:fs"; ... L42: <array> L43: <string>/bin/bash</string> L44: <string>${startScript}</string> ... L130: export function enable({ repoRoot = defaultRepoRoot() } = {}) { L131: const unit = unitFor(process.platform, { repoRoot, home: homedir() }); L132: mkdirSync(dirname(unit.path), { recursive: true }); ... L135: if (unit.kind === "launchd") { L136: _silent(`launchctl unload "${unit.path}"`); L137: if (!_silent(`launchctl load -w "${unit.path}"`)) {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

installer/autostart.jsView on unpkg · L13

core/fusion/__init__.pyView file

•path = core/fusion/__init__.py kind = build_helper sizeBytes = 197 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/fusion/__init__.pyView on unpkg

Findings

2 Critical3 High5 Medium5 Low

CriticalCritical Secretdepartments/dev/skills/env-secrets/SKILL.md

CriticalSecret Patterndepartments/dev/skills/env-secrets/SKILL.md

HighChild Processinstaller/frontend-tooling.js

HighShellinstaller/autostart.js

HighRuntime Package Installinstaller/frontend-tooling.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistenceinstaller/autostart.js

MediumShips Build Helpercore/fusion/__init__.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

departments/dev/skills/env-secrets/SKILL.mdView file

Lines 11-51markdown

12## What It Does

14Audits environment files for leaked secrets, validates .env/.env.example drift, and provides vault integration guidance for production workloads.

16## Audit Checklist

18| Check | What to Verify | Severity |

19|-------|---------------|----------|

20| .gitignore | `.env` listed and not tracked | CRITICAL |

21| Hardcoded secrets | API keys, passwords, tokens in source code | CRITICAL |

22| .env.example sync | All keys present with placeholder values, no real values | HIGH |

23| Secret patterns | AWS keys, Stripe keys, JWT secrets, DB passwords | CRITICAL |

24| Git history | Secrets ever committed (even if removed) | HIGH |

25| CI/CD variables | Secrets masked and scoped to environments | MEDIUM |

27## Secret Detection Patterns

29| Pattern | Regex | Example Match |

30|---------|-------|--------------|

31| AWS Access Key | `AKIA[0-9A-Z]{16}` | `AKIAIOSFODNN7EXAMPLE` |

Critical

Critical Secret

Package contains a critical-looking secret pattern.

departments/dev/skills/env-secrets/SKILL.mdView on unpkg · L31

Critical

Secret Pattern

AWS access key ID in departments/dev/skills/env-secrets/SKILL.md

departments/dev/skills/env-secrets/SKILL.mdView on unpkg · L31

32| Stripe Key | `sk_(live\|test)_[0-9a-zA-Z]{24,}` | `sk_live_abc123...` |

33| JWT Secret | `(jwt\|JWT).*(secret\|key).*=.+` | `JWT_SECRET=mysecret` |

34| Generic Password | `(password\|passwd\|pwd).*=.{8,}` | `DB_PASSWORD=hunter2` |

37## Automated Scans

39| Tool | Purpose | Command |

40|------|---------|---------|

41| GitLeaks | Scan repo for secrets | `gitleaks detect --source . --report-path gitleaks.json` |

42| detect-secrets | Baseline + audit | `detect-secrets scan > .secrets.baseline` |

43| git log | History check | `git log --all --diff-filter=A -- '*.env' '*secret*'` |

45## Vault Integration Guide

47| Provider | Best For | Integration Pattern |

48|----------|----------|-------------------|

49| HashiCorp Vault | Multi-cloud / hybrid | SDK pull or sidecar injection |

50| AWS Secrets Manager | AWS-native | Lambda/ECS native, auto-rotation |

51| Azure Key Vault | Azure-native | Managed HSM, Azure AD RBAC |

installer/frontend-tooling.jsView file

Lines 1-37javascript

1// Frontend UI/UX tooling setup for `npx arkaos install` and

2// `npx arkaos@latest update`.

3//

4// Wires three operator-mandated tools into the install/update flow:

5// 1. Magic MCP (@21st-dev/magic) — user-scope, API-key gated. The key is

6// prompted interactively when missing and never stored in the repo;

7// it lives only in ~/.arkaos/keys.json (chmod 600) + Claude user config.

8// 2. Motion AI Kit (npx motion-ai) — auto-run on every install/update.

9// 3. (ui-ux-pro-max plugin + marketplace is handled in claude-plugins.js.)

10//

11// Invariants (.claude/rules/node-installer.md):

installer/autostart.jsView file

Lines 1-33javascript

1/**

2 * Cross-OS autostart for the ArkaOS dashboard (v3.72.0, feature #2).

3 *

4 * Opt-in: `npx arkaos autostart enable|disable|status`. Installs a per-OS

5 * boot item that runs `scripts/start-dashboard.sh` (macOS/Linux) or

6 * `scripts/start-dashboard.ps1` (Windows) — the same launcher the

7 * `dashboard` command uses, which already starts the Python API + the

8 * dashboard UI (preferring the production build, falling back to dev).

9 *

10 * ESM, Node + Bun, no interactive prompts. The unit-generation (`unitFor`)

11 * is pure so it can be unit-tested without touching the OS.

core/fusion/__init__.pyView file

•path = core/fusion/__init__.py kind = build_helper sizeBytes = 197 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

core/fusion/__init__.pyView on unpkg