registry / codeassembly / 0.14.0
codeassembly@0.14.0
CLI that installs reusable AI agent guidance (rulebooks, skills, and subagents) into coding-harness directories
Static Scan Results
scanned 2mo ago · by rust-scannerStatic analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Static reason
One or more suspicious static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell
HighEntropyStringsMinifiedPossibleObfuscationUrlStrings
Source & flagged code
5 flaggeddist/esm/derive-session-context/cli.jsView file
1import { execFile } from 'node:child_process';
L2: import { realpathSync } from 'node:fs';
High
Child Process
Package source references child process execution.
dist/esm/derive-session-context/cli.jsView on unpkg · L1bin/codeassembly.jsView file
22try {
L23: await import(entryPoint.href);
L24: } catch (error) {
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/codeassembly.jsView on unpkg · L22dist/esm/kb-curate/apply/canonicalize-tags.jsView file
Findings
4 High4 Medium4 Low
HighChild Processdist/esm/derive-session-context/cli.js
HighShell
HighCross File Remote Execution Contextdist/esm/kb-curate/apply/canonicalize-tags.js
HighSemantic Analysis Limitedpackage.json
MediumDynamic Requirebin/codeassembly.js
MediumEnvironment Vars
MediumShips Build Helperdist/content/scripts/resolve-merge-options.sh
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
Affected versions and remediation
This report applies to codeassembly@0.14.0.
See all versions of codeassembly for other recorded verdicts.
- Review the evidence and your use of codeassembly@0.14.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.