registry / claude-loadout / 0.3.61

claude-loadout@0.3.61

Profile your project and gear up your coding agent with the right MCP servers, skills, and hooks. Claude Code, Codex, Cursor, opencode, Gemini CLI & OpenClaw. A recommender + installer, not a list you read.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 84.3 KB of source, external domains: github.com, opencode.ai

Source & flagged code

3 flagged

cli/lib/doctor.mjsView file

Lines 1-23javascript

1import { existsSync, readFileSync } from "node:fs";

2import { resolve } from "node:path";

3import { openclawConfigPath } from "./paths.mjs";

4import { execSync } from "node:child_process";

5import { loadCatalog } from "./catalog.mjs";

High

Child Process

Package source references child process execution.

cli/lib/doctor.mjsView on unpkg · L3

6import { scanProject } from "./scan.mjs";

7import { recommend } from "./recommend.mjs";

8import { applyItems } from "./manifest.mjs";

10const AUTO_APPLY_TYPES = new Set(["mcp", "hook", "setting"]);

12/** Whether a catalog type is auto-writable under --mcp-only / --hooks-only filters. */

13export function isAutoApplyType(type, opts = {}) {

14 if (opts.mcpOnly) return type === "mcp";

15 if (opts.hooksOnly) return type === "hook" || type === "setting";

16 return AUTO_APPLY_TYPES.has(type);

17}

19/** Machine-readable doctor summary for CI (`healthy` / `optionalOnly`). */

20export function summarizeDoctor(findings) {

21 const suggestions = findings.suggestions || [];

22 const optionalOnly =

23 suggestions.length > 0 &&

Lines 73-113javascript

73 settingsDoc = JSON.parse(readFileSync(settingsPath, "utf8"));

74 } catch {

75 findings.fix.push({ msg: ".claude/settings.json is invalid JSON", file: ".claude/settings.json" });

76 }

77 }

79 const mcpLocations = new Map

Lines 427-464javascript

427 if (interesting.length) {

428 findings.ok.push({ msg: `Detected signals: ${interesting.join(", ")}${findings.signals.length > 10 ? "…" : ""}` });

429 }

430 const gaps

Source & flagged code

3 flagged · loading source

cli/lib/doctor.mjsView file

3import { openclawConfigPath } from "./paths.mjs"; L4: import { execSync } from "node:child_process"; L5: import { loadCatalog } from "./catalog.mjs";

High

Child Process

Package source references child process execution.

cli/lib/doctor.mjsView on unpkg · L3

93findings.fix.push({ L94: msg: "POSIX Ruff hook detected — re-run loadout on Windows to apply lint-python-on-edit-win (PowerShell, no jq)", L95: file: ".claude/settings.json",

High

Shell

Package source references shell execution.

cli/lib/doctor.mjsView on unpkg · L93

447msg: hasAuto L448: ? `Loadout would still suggest: ${names} — run npx claude-loadout doctor --fix` L449: : onlyPlugins ... L457: const cmd = process.platform === "win32" ? `where ${name}` : `which ${name}`; L458: execSync(cmd, { stdio: "ignore" }); L459: return true;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/lib/doctor.mjsView on unpkg · L447

Findings

3 High2 Medium5 Low

HighChild Processcli/lib/doctor.mjs

HighShellcli/lib/doctor.mjs

HighRuntime Package Installcli/lib/doctor.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

cli/lib/doctor.mjsView file

Lines 1-23javascript

1import { existsSync, readFileSync } from "node:fs";

2import { resolve } from "node:path";

3import { openclawConfigPath } from "./paths.mjs";

4import { execSync } from "node:child_process";

5import { loadCatalog } from "./catalog.mjs";

High

Child Process

Package source references child process execution.

cli/lib/doctor.mjsView on unpkg · L3

6import { scanProject } from "./scan.mjs";

7import { recommend } from "./recommend.mjs";

8import { applyItems } from "./manifest.mjs";

10const AUTO_APPLY_TYPES = new Set(["mcp", "hook", "setting"]);

12/** Whether a catalog type is auto-writable under --mcp-only / --hooks-only filters. */

13export function isAutoApplyType(type, opts = {}) {

14 if (opts.mcpOnly) return type === "mcp";

15 if (opts.hooksOnly) return type === "hook" || type === "setting";

16 return AUTO_APPLY_TYPES.has(type);

17}

19/** Machine-readable doctor summary for CI (`healthy` / `optionalOnly`). */

20export function summarizeDoctor(findings) {

21 const suggestions = findings.suggestions || [];

22 const optionalOnly =

23 suggestions.length > 0 &&

Lines 73-113javascript

73 settingsDoc = JSON.parse(readFileSync(settingsPath, "utf8"));

74 } catch {

75 findings.fix.push({ msg: ".claude/settings.json is invalid JSON", file: ".claude/settings.json" });

76 }

77 }

79 const mcpLocations = new Map

Lines 427-464javascript

427 if (interesting.length) {

428 findings.ok.push({ msg: `Detected signals: ${interesting.join(", ")}${findings.signals.length > 10 ? "…" : ""}` });

429 }

430 const gaps