registry  /  bigpowers  /  2.43.4

bigpowers@2.43.4

72 agent skills synthesizing 17 years of software engineering discipline into a prescriptive methodology for solo developers

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket
Supply chain
HighEntropyStrings
ManifestNo manifest risk signals triggered.
scanned 38 file(s), 128 KB of source

Source & flagged code

8 flagged · loading source
package.jsonView file
•scripts.install = bash scripts/install.sh
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.install = bash scripts/install.sh
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
•scripts.postinstall = bash scripts/sync-skills.sh && bash scripts/install.sh
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
bin/bigpowers.jsView file
2L3: const { execSync } = require('child_process'); L4: const path = require('path');
High
Child Process

Package source references child process execution.

bin/bigpowers.jsView on unpkg · L2
align-grid/scripts/verify_grid.jsView file
35*/ L36: const puppeteer = require(process.env.PUP || 'puppeteer-core'); L37: const path = require('path');
Medium
Dynamic Require

Package source references dynamic require/import behavior.

align-grid/scripts/verify_grid.jsView on unpkg · L35
visual-dashboard/scripts/server.cjsView file
1const crypto = require('crypto'); L2: const http = require('http'); L3: const fs = require('fs'); ... L11: function computeAcceptKey(clientKey) { L12: return crypto.createHash('sha1').update(clientKey + WS_MAGIC).digest('base64'); L13: } ... L75: L76: const PORT = process.env.BIGPOWERS_DASHBOARD_PORT || (49152 + Math.floor(Math.random() * 16383)); L77: const HOST = process.env.BIGPOWERS_DASHBOARD_HOST || '127.0.0.1'; ... L100: L101: const frameTemplate = fs.readFileSync(path.join(__dirname, 'frame-template.html'), 'utf-8'); L102: const helperScript = fs.readFileSync(path.join(__dirname, 'helper.js'), 'utf-8');
Low
Weak Crypto

Package source references weak cryptographic algorithms.

visual-dashboard/scripts/server.cjsView on unpkg · L1
extract-design/scripts/lib/validator.jsView file
1import { execSync } from 'node:child_process'; L2: import { existsSync } from 'node:fs'; L3: import { log } from './logging.js'; L4: const BIN = 'npx @google/design.md'; L5:
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

extract-design/scripts/lib/validator.jsView on unpkg · L1
align-grid/scripts/grid_tokens.pyView file
•path = align-grid/scripts/grid_tokens.py kind = build_helper sizeBytes = 10021 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

align-grid/scripts/grid_tokens.pyView on unpkg

Findings

4 High7 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/bigpowers.js
HighShell
HighRuntime Package Installextract-design/scripts/lib/validator.js
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumDynamic Requirealign-grid/scripts/verify_grid.js
MediumNetwork
MediumEnvironment Vars
MediumShips Build Helperalign-grid/scripts/grid_tokens.py
MediumStructural Risk Force Deep Review
LowScripts Present
LowWeak Cryptovisual-dashboard/scripts/server.cjs
LowFilesystem
LowHigh Entropy Strings