registry  /  burnlist  /  0.0.2

burnlist@0.0.2

An agent skill and local dashboard for Burnlist planning, execution, and progress tracking.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
ManifestNo manifest risk signals triggered.
scanned 30 file(s), 872 KB of source, external domains: 127.0.0.1, react.dev, www.w3.org

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node scripts/register-skills.mjs
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
bin/burnlist.mjsView file
1#!/usr/bin/env node L2: import { spawnSync } from "node:child_process"; L3: import { readFileSync } from "node:fs";
High
Child Process

Package source references child process execution.

bin/burnlist.mjsView on unpkg · L1
skills/burnlist/scripts/repo-map.test.mjsView file
66const port = await availablePort(); L67: child = spawn(process.execPath, [ L68: serverPath, ... L74: cwd: repoRoot, L75: env: process.env, L76: stdio: ["ignore", "pipe", "pipe"], L77: }); L78: await waitForServer(child, `http://127.0.0.1:${port}/`); L79:
High
Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

skills/burnlist/scripts/repo-map.test.mjsView on unpkg · L66

Findings

4 High3 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processbin/burnlist.mjs
HighShell
HighSame File Env Network Executionskills/burnlist/scripts/repo-map.test.mjs
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings