registry / claude-everything-workflow / 0.1.7

claude-everything-workflow@0.1.7

Claude Code and Codex harness with rules, skills, agents, hooks, and verification gates.

Static Scan Results

scanned 19d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 15 file(s), 105 KB of source, external domains: primeradiant.com, registry.npmjs.org

Source & flagged code

5 flagged

bin/claude-everything-workflow.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2"use strict";

4const path = require("path");

5const { spawnSync } = require("child_process");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/claude-everything-workflow.jsView on unpkg · L3

7const root = path.resolve(__dirname, "..");

9function main() {

10 const [command, ...args] = process.argv.slice(2);

12 if (!command || command === "help" || command === "--help" || command === "-h") {

13 printHelp();

14 process.exit(0);

15 }

17 if (command === "install") {

18 runInstall(args);

19 return;

20 }

22 if (command === "verify") {

23 runNodeScript("scripts/verify-harness.js", args);

scripts/learning/project-utils.jsView file

Lines 1-31javascript

1#!/usr/bin/env node

2/**

3 * Continuous Learning 项目隔离工具

4 */

6'use strict'

8const fs = require('fs')

9const

scripts/install.shView file

•path = scripts/install.sh kind = build_helper sizeBytes = 6738 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/install.shView on unpkg

scripts/verify-harness.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = claude-everything-workflow@0.1.6 matchedIdentity = npm:[redacted]:0.1.6 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

scripts/verify-harness.jsView on unpkg

references/agents/security-reviewer.mdView file

Lines 166-206markdown

166- [ ] CORS 正确配置

167- [ ] URL 中无敏感数据

168- [ ] 正确的 HTTP 方法（GET 安全，POST/PUT/DELETE 幂等）

169

170搜索安全 (Redis + OpenAI)：

171- [ ] Redis 连接使用 TLS

172- [ ] OpenAI API 密钥仅服务器端

173- [ ] 搜索查询清理

174- [ ] 不向 OpenAI 发送 PII

Source & flagged code

5 flagged · loading source

bin/claude-everything-workflow.jsView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code