registry / claude-dev-env / 1.93.1

claude-dev-env@1.93.1

Claude Code development standards — rules, hooks, agents, commands, and skills

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEvalFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 41 file(s), 502 KB of source, external domains: github.com

Source & flagged code

7 flagged

hooks/blocking/test_pii_scanner.pyView file

Lines 4-44python

5import sys

6from pathlib import Path

8import pytest

10_HOOK_DIR = Path(__file__).parent

11_HOOKS_DIR = _HOOK_DIR.parent

12if str(_HOOK_DIR) not in sys.path:

13 sys.path.insert(0, str(_HOOK_DIR))

14if str(_HOOKS_DIR) not in sys.path:

15 sys.path.insert(0, str(_HOOKS_DIR))

17from pii_scanner import ( # noqa: E402

18 is_path_exempt_from_pii_scan,

19 scan_text_for_pii,

20)

22SYNTHETIC_GITHUB_TOKEN = "ghp_" + ("A" * 36)

23SYNTHETIC_AWS_KEY = "AKIA" + ("B" * 16)

24SYNTHETIC_PEM_HEADER = "-----BEGIN RSA PRIVATE KEY-----"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

hooks/blocking/test_pii_scanner.pyView on unpkg · L24

Critical

Secret Pattern

RSA private key in hooks/blocking/test_pii_scanner.py

hooks/blocking/test_pii_scanner.pyView on unpkg · L24

25SYNTHETIC_REAL_EMAIL = "person.fixture@company-example.io"

26SYNTHETIC_SAFE_EMAIL = "user@example.com"

27SYNTHETIC_HOME_PATH = r"C:\Users\fixture_real_user\notes.txt"

28SYNTHETIC_PLACEHOLDER_HOME = r"C:\Users\<you>\notes.txt"

29SYNTHETIC_PRIVATE_IP = "192.168.42.17"

30SYNTHETIC_PUBLIC_IP = "8.8.8.8"

31NAS_HOST_ENVIRONMENT_VARIABLE = "CLAUDE_NAS_HOST"

32SYNTHETIC_NAS_PRIVATE_IP = "10.20.30.40"

33SYNTHETIC_NAS_HOSTNAME = "nas.example.local"

34SYNTHETIC_NAS_SSH_COMMAND = f"ssh -p 2200 operator@{SYNTHETIC_NAS_PRIVATE_IP} uptime"

37def test_flags_real_email_and_allows_example_domain() -> None:

38 all_email_hits = scan_text_for_pii(f"contact {SYNTHETIC_REAL_EMAIL}")

39 all_safe_hits = scan_text_for_pii(f"contact {SYNTHETIC_SAFE_EMAIL}")

40 assert any(each.category == "email" for each in all_email_hits)

41 assert all_email_hits[0].matched_text == SYNTHETIC_REAL_EMAIL

42 assert all_safe_hits == []

skills/autoconverge/workflow/converge_multi.run-input.test.mjsView file

Lines 1-37javascript

1import { test } from 'node:test';

2import { strict as assert } from 'node:assert';

3import { readFileSync } from 'node:fs';

4import { fileURLToPath } from 'node:url';

5import { dirname, join } from

agents/test_agent_frontmatter.pyView file

•path = agents/test_agent_frontmatter.py kind = build_helper sizeBytes = 2871 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agents/test_agent_frontmatter.pyView on unpkg

scripts/tests/test_sync_to_cursor.pyView file

•path = scripts/tests/test_sync_to_cursor.py kind = payload_in_excluded_dir sizeBytes = 13986 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

scripts/tests/test_sync_to_cursor.pyView on unpkg

bin/install.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = claude-dev-env@1.92.1 matchedIdentity = npm:Y2xhdWRlLWRldi1lbnY:1.92.1 similarity = 0.846 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/install.mjsView on unpkg

hooks/validators/test_security_checks.pyView file

Lines 8-48python

8 check_hardcoded_secrets,

9 check_sql_injection,

10 check_xss_risk,

11)

12from .validator_base import Violation

15GOOD_NO_SECRETS = '''

16import os

18def get_api_key():

19 return os.environ.get("API_KEY")

20'''

Source & flagged code

7 flagged · loading source

hooks/blocking/test_pii_scanner.pyView file

24patternName = private_key_rsa severity = critical line = 24 matchedText = SYNTHETI...---"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

hooks/blocking/test_pii_scanner.pyView on unpkg · L24

24patternName = private_key_rsa severity = critical line = 24 matchedText = SYNTHETI...---"

Critical

Secret Pattern

RSA private key in hooks/blocking/test_pii_scanner.py

hooks/blocking/test_pii_scanner.pyView on unpkg · L24

skills/autoconverge/workflow/converge_multi.run-input.test.mjsView file

17L18: const productionModule = new Function( L19: `${sourceSliceBetween('function normalizeMultiInput(', '\nconst multiInput =')}\n` +

Low

Eval

Package source references a known benign dynamic code generation pattern.

skills/autoconverge/workflow/converge_multi.run-input.test.mjsView on unpkg · L17

agents/test_agent_frontmatter.pyView file

•path = agents/test_agent_frontmatter.py kind = build_helper sizeBytes = 2871 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agents/test_agent_frontmatter.pyView on unpkg

scripts/tests/test_sync_to_cursor.pyView file

•path = scripts/tests/test_sync_to_cursor.py kind = payload_in_excluded_dir sizeBytes = 13986 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

scripts/tests/test_sync_to_cursor.pyView on unpkg

bin/install.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/install.mjsView on unpkg

hooks/validators/test_security_checks.pyView file

28patternName = generic_password severity = medium line = 28 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in hooks/validators/test_security_checks.py

hooks/validators/test_security_checks.pyView on unpkg · L28

Findings

2 Critical2 High3 Medium5 Low

CriticalCritical Secrethooks/blocking/test_pii_scanner.py

CriticalSecret Patternhooks/blocking/test_pii_scanner.py

HighPayload In Excluded Dirscripts/tests/test_sync_to_cursor.py

HighPrevious Version Dangerous Deltabin/install.mjs

MediumShips Build Helperagents/test_agent_frontmatter.py

MediumStructural Risk Force Deep Review

MediumSecret Patternhooks/validators/test_security_checks.py

LowScripts Present

LowEvalskills/autoconverge/workflow/converge_multi.run-input.test.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

7 flagged

hooks/blocking/test_pii_scanner.pyView file

Lines 4-44python

5import sys

6from pathlib import Path

8import pytest

10_HOOK_DIR = Path(__file__).parent

11_HOOKS_DIR = _HOOK_DIR.parent

12if str(_HOOK_DIR) not in sys.path:

13 sys.path.insert(0, str(_HOOK_DIR))

14if str(_HOOKS_DIR) not in sys.path:

15 sys.path.insert(0, str(_HOOKS_DIR))

17from pii_scanner import ( # noqa: E402

18 is_path_exempt_from_pii_scan,

19 scan_text_for_pii,

20)

22SYNTHETIC_GITHUB_TOKEN = "ghp_" + ("A" * 36)

23SYNTHETIC_AWS_KEY = "AKIA" + ("B" * 16)

24SYNTHETIC_PEM_HEADER = "-----BEGIN RSA PRIVATE KEY-----"

Critical

Critical Secret

Package contains a critical-looking secret pattern.

hooks/blocking/test_pii_scanner.pyView on unpkg · L24

Critical

Secret Pattern

RSA private key in hooks/blocking/test_pii_scanner.py

hooks/blocking/test_pii_scanner.pyView on unpkg · L24

25SYNTHETIC_REAL_EMAIL = "person.fixture@company-example.io"

26SYNTHETIC_SAFE_EMAIL = "user@example.com"

27SYNTHETIC_HOME_PATH = r"C:\Users\fixture_real_user\notes.txt"

28SYNTHETIC_PLACEHOLDER_HOME = r"C:\Users\<you>\notes.txt"

29SYNTHETIC_PRIVATE_IP = "192.168.42.17"

30SYNTHETIC_PUBLIC_IP = "8.8.8.8"

31NAS_HOST_ENVIRONMENT_VARIABLE = "CLAUDE_NAS_HOST"

32SYNTHETIC_NAS_PRIVATE_IP = "10.20.30.40"

33SYNTHETIC_NAS_HOSTNAME = "nas.example.local"

34SYNTHETIC_NAS_SSH_COMMAND = f"ssh -p 2200 operator@{SYNTHETIC_NAS_PRIVATE_IP} uptime"

37def test_flags_real_email_and_allows_example_domain() -> None:

38 all_email_hits = scan_text_for_pii(f"contact {SYNTHETIC_REAL_EMAIL}")

39 all_safe_hits = scan_text_for_pii(f"contact {SYNTHETIC_SAFE_EMAIL}")

40 assert any(each.category == "email" for each in all_email_hits)

41 assert all_email_hits[0].matched_text == SYNTHETIC_REAL_EMAIL

42 assert all_safe_hits == []

skills/autoconverge/workflow/converge_multi.run-input.test.mjsView file

Lines 1-37javascript

1import { test } from 'node:test';

2import { strict as assert } from 'node:assert';

3import { readFileSync } from 'node:fs';

4import { fileURLToPath } from 'node:url';

5import { dirname, join } from

agents/test_agent_frontmatter.pyView file

•path = agents/test_agent_frontmatter.py kind = build_helper sizeBytes = 2871 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

agents/test_agent_frontmatter.pyView on unpkg

scripts/tests/test_sync_to_cursor.pyView file

•path = scripts/tests/test_sync_to_cursor.py kind = payload_in_excluded_dir sizeBytes = 13986 magicHex = [redacted]

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

scripts/tests/test_sync_to_cursor.pyView on unpkg

bin/install.mjsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

bin/install.mjsView on unpkg

hooks/validators/test_security_checks.pyView file

Lines 8-48python

8 check_hardcoded_secrets,

9 check_sql_injection,

10 check_xss_risk,

11)

12from .validator_base import Violation

15GOOD_NO_SECRETS = '''

16import os

18def get_api_key():

19 return os.environ.get("API_KEY")

20'''