registry / claude-dev-env / 1.86.0

claude-dev-env@1.86.0

Claude Code development standards — rules, hooks, agents, commands, and skills

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 39 file(s), 395 KB of source, external domains: github.com

Source & flagged code

4 flagged

hooks/validators/test_security_checks.pyView file

Lines 8-48python

8 check_hardcoded_secrets,

9 check_sql_injection,

10 check_xss_risk,

11)

12from .validator_base import Violation

15GOOD_NO_SECRETS = '''

16import os

18def get_api_key():

19 return os.environ.get("API_KEY")

20'''

22BAD_HARDCODED_API_KEY = '''

23API_KEY = "sk-abc123xyz789"

24'''

26BAD_HARDCODED_PASSWORD = '''

27def connect():

28 password = "super_secret_123"

Medium

Secret Pattern

Package contains a possible secret pattern.

hooks/validators/test_security_checks.pyView on unpkg · L28

29 return password

30'''

32GOOD_PARAMETERIZED_SQL = '''

33def get_user(user_id):

34 cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

35'''

37BAD_FSTRING_SQL = '''

38def get_user(user_id):

39 cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")

40'''

42BAD_FORMAT_SQL = '''

43def get_user(user_id):

44 cursor.execute("SELECT * FROM users WHERE id = {}".format(user_id))

45'''

47GOOD_ESCAPED_HTML = '''

48from django.utils.html import escape

skills/autoconverge/workflow/converge_multi.run-input.test.mjsView file

Lines 1-37javascript

1import { test } from 'node:test';

2import { strict as assert } from 'node:assert';

3import { readFileSync } from 'node:fs';

4import { fileURLToPath } from 'node:url';

5import { dirname, join } from

hooks/git-hooks/pre_commit.pyView file

•path = hooks/git-hooks/pre_commit.py kind = build_helper sizeBytes = 2045 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/git-hooks/pre_commit.pyView on unpkg

scripts/tests/test_sync_to_cursor.pyView file

•path = scripts/tests/test_sync_to_cursor.py kind = payload_in_excluded_dir sizeBytes = 13986 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

scripts/tests/test_sync_to_cursor.pyView on unpkg

Source & flagged code

4 flagged · loading source

hooks/validators/test_security_checks.pyView file

28patternName = generic_password severity = medium line = 28 matchedText = password...123"

Medium

Secret Pattern

Package contains a possible secret pattern.

hooks/validators/test_security_checks.pyView on unpkg · L28

skills/autoconverge/workflow/converge_multi.run-input.test.mjsView file

17L18: const productionModule = new Function( L19: `${sourceSliceBetween('function normalizeMultiInput(', '\nconst multiInput =')}\n` +

Low

Eval

Package source references a known benign dynamic code generation pattern.

skills/autoconverge/workflow/converge_multi.run-input.test.mjsView on unpkg · L17

hooks/git-hooks/pre_commit.pyView file

•path = hooks/git-hooks/pre_commit.py kind = build_helper sizeBytes = 2045 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/git-hooks/pre_commit.pyView on unpkg

scripts/tests/test_sync_to_cursor.pyView file

•path = scripts/tests/test_sync_to_cursor.py kind = payload_in_excluded_dir sizeBytes = 13986 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

scripts/tests/test_sync_to_cursor.pyView on unpkg

Findings

1 High3 Medium5 Low

HighPayload In Excluded Dirscripts/tests/test_sync_to_cursor.py

MediumSecret Patternhooks/validators/test_security_checks.py

MediumShips Build Helperhooks/git-hooks/pre_commit.py

MediumStructural Risk Force Deep Review

LowScripts Present

LowEvalskills/autoconverge/workflow/converge_multi.run-input.test.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

hooks/validators/test_security_checks.pyView file

Lines 8-48python

8 check_hardcoded_secrets,

9 check_sql_injection,

10 check_xss_risk,

11)

12from .validator_base import Violation

15GOOD_NO_SECRETS = '''

16import os

18def get_api_key():

19 return os.environ.get("API_KEY")

20'''

22BAD_HARDCODED_API_KEY = '''

23API_KEY = "sk-abc123xyz789"

24'''

26BAD_HARDCODED_PASSWORD = '''

27def connect():

28 password = "super_secret_123"

Medium

Secret Pattern

Package contains a possible secret pattern.

hooks/validators/test_security_checks.pyView on unpkg · L28

29 return password

30'''

32GOOD_PARAMETERIZED_SQL = '''

33def get_user(user_id):

34 cursor.execute("SELECT * FROM users WHERE id = %s", (user_id,))

35'''

37BAD_FSTRING_SQL = '''

38def get_user(user_id):

39 cursor.execute(f"SELECT * FROM users WHERE id = {user_id}")

40'''

42BAD_FORMAT_SQL = '''

43def get_user(user_id):

44 cursor.execute("SELECT * FROM users WHERE id = {}".format(user_id))

45'''

47GOOD_ESCAPED_HTML = '''

48from django.utils.html import escape

skills/autoconverge/workflow/converge_multi.run-input.test.mjsView file

Lines 1-37javascript

1import { test } from 'node:test';

2import { strict as assert } from 'node:assert';

3import { readFileSync } from 'node:fs';

4import { fileURLToPath } from 'node:url';

5import { dirname, join } from

hooks/git-hooks/pre_commit.pyView file

•path = hooks/git-hooks/pre_commit.py kind = build_helper sizeBytes = 2045 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/git-hooks/pre_commit.pyView on unpkg

scripts/tests/test_sync_to_cursor.pyView file

•path = scripts/tests/test_sync_to_cursor.py kind = payload_in_excluded_dir sizeBytes = 13986 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

scripts/tests/test_sync_to_cursor.pyView on unpkg