bigpowers@2.43.2

70 agent skills for spec-driven, test-first software development by solo developers

Static Scan Results

scanned 4mo ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 128 KB of source

Source & flagged code

8 flagged

package.jsonView file

Lines 1-33json

2 "name": "bigpowers",

3 "version": "2.43.2",

4 "description": "70 agent skills for spec-driven, test-first software development by solo developers",

5 "main": "index.js",

6 "scripts": {

7 "compliance": "bash scripts/audit-compliance.sh specs/verifications/features && bash scripts/validate-doctrine.sh",

8 "doctrine": "bash scripts/validate-doctrine.sh",

9 "sync": "bash scripts/sync-skills.sh",

10 "validate-specs": "bash scripts/validate-specs-yaml.sh",

11 "enrich-epics": "bash scripts/enrich-epics-from-archive.sh",

12 "version": "bash scripts/sync-skills.sh && git add .gemini/extensions/bigpowers/gemini-extension.json specs/SKILL-SEARCH-INDEX_LATEST.md",

13 "install": "bash scripts/install.sh",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L13

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

14 "postinstall": "bash scripts/sync-skills.sh && bash scripts/install.sh",

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L13

15 "release": "semantic-release",

16 "dashboard": "node dashboard/bin/dashboard.js",

17 "dashboard:web": "node dashboard/bin/dashboard.js --web"

18 },

19 "keywords": [

20 "skills",

21 "agents",

22 "claude",

23 "development",

24 "spec-driven",

25 "test-first",

26 "pi-package"

27 ],

28 "pi": {

29 "skills": [

30 "./.pi/skills"

31 ],

32 "prompts": [

33 "./.pi/prompts"

bin/bigpowers.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

3const { execSync } = require('child_process');

4const path = require('path');

High

Child Process

Package source references child process execution.

bin/bigpowers.js

align-grid/scripts/verify_grid.jsView file

Lines 15-55javascript

15 * rect (~0px), i.e. the overlay really is the content grid.

16 * 3. BASELINE — text element tops, modulo the baseline unit, ~0.

17 * 4. OPTICAL INK — display elements

visual-dashboard/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs =

extract-design/scripts/lib/validator.jsView file

Lines 1-12javascript

1import { execSync } from 'node:child_process';

2import { existsSync } from 'node:fs';

3import { log } from './logging.js';

4const BIN =

align-grid/scripts/grid_tokens.pyView file

•path = align-grid/scripts/grid_tokens.py kind = build_helper sizeBytes = 10021 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

align-grid/scripts/grid_tokens.pyView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.install = bash scripts/install.sh

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.install = bash scripts/install.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

•scripts.postinstall = bash scripts/sync-skills.sh && bash scripts/install.sh

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

bin/bigpowers.jsView file

Findings

4 High7 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processbin/bigpowers.js

HighShell

HighRuntime Package Installextract-design/scripts/lib/validator.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirealign-grid/scripts/verify_grid.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperalign-grid/scripts/grid_tokens.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptovisual-dashboard/scripts/server.cjs

Low

Affected versions and remediation

This report applies to bigpowers@2.43.2.

See all versions of bigpowers for other recorded verdicts.

Review the evidence and your use of bigpowers@2.43.2 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-07-02 12:08:30.675Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.