registry / codex-starterkit / 0.1.10

codex-starterkit@0.1.10

Global baseline (Codex plugins) + thin project overlay installer for the OpenAI Codex Agent.

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 69 file(s), 1.44 MB of source, external domains: api.github.com, example.com, example.invalid, github.com, grep.app, json-schema.org, json.schemastore.org, mcp.context7.com, prompts.chat, raw.githubusercontent.com, spec.openapis.org, stackoverflow.com, token.v-claw.org, tools.ietf.org, www.safaribooksonline.com, www.w3.org

Source & flagged code

7 flagged

baseline/hooks-plugin/hooks/rtk.mjsView file

Lines 2-42javascript

2// rtk hook — ported from opencode-starterkit baseline/plugin/rtk.ts.

3// Codex hook event: PreToolUse (rewrite bash/shell command for token savings).

4//

5// Requires: rtk >= 0.23.0 in PATH. If rtk is missing, the hook is a no-op.

6// Reads JSON stdin, emits JSON stdout with hookSpecificOutput.updatedInput

7// (Codex v3.3+ PreToolUse protocol) when rtk rewrites.

8// Plain JS (no TypeScript) so Node runs it directly.

9//

10// Implementation note (v1.7.4): rtk rewrite exits with status 3 when the

11// rewrite is successful but the original output is partial/incomplete

12// (e.g. rewriting `rg`/`grep` — the proxy itself doesn't fully parse the

13// output before returning). We use spawnSync (not execSync) and accept

14// status 0 OR 3 as "rewrite happened" so rg/grep compressions are not lost.

15//

16// Local expansions (beyond bare rtk rewrite):

17// - npm/pnpm test → npm/pnpm run test (forms rtk rewrite understands)

18// - node --test / yarn test / bun test → rtk test -- <cmd> fallback

20import fs from 'node:fs'

21import path from 'node:path'

22import { fileURLToPath, pathToFileURL } from 'node:url'

23import { spawnSync } from 'node:child_process'

High

Child Process

Package source references child process execution.

baseline/hooks-plugin/hooks/rtk.mjsView on unpkg · L22

25// Statuses the rtk proxy returns when a rewrite is applied. Exit 0 is the

26// normal happy path; exit 3 means the proxy emitted a partial rewrite

27// (common for grep/rg compression). Any other status is treated as no-op.

28const REWRITE_STATUSES = new Set([0, 3])

30// Idempotency guard: if the command already routes through rtk, skip.

31// Same regex as the opencode donor (handles env-var prefixes too).

32const IDEMPOTENT_RE = /^\s*(?:RTK_[A-Z_]+=\S+\s+)*rtk\b/

33const RTK_COMMAND_TOKEN_RE = /(^|&&|\|\||;|\n)(\s*(?:[A-Za-z_][A-Za-z0-9_]*=\S+\s+)*)rtk\b/g

35// Match shell/exec tools. Codex hook protocol usually reports Bash-like tools

36// with a `command` field, while Codex Desktop's exec command tool uses `cmd`.

37const SHELL_TOOLS = new Set([

38 'bash',

39 'shell',

40 'execute_bash',

41 'run_command',

42 'terminal',

baseline/mcp-tools/dist/mcp/server.jsView file

7287parsed.args = ["/d", "/s", "/c", `"${shellCommand}"`]; L7288: parsed.command = process.env.comspec || "cmd.exe"; L7289: parsed.options.windowsVerbatimArguments = true;

High

Shell

Package source references shell execution.

baseline/mcp-tools/dist/mcp/server.jsView on unpkg · L7287

21969const json = serializeMessage(message); L21970: if (this._stdout.write(json)) { L21971: resolve(); ... L21979: // src/tools/grepsearch.ts L21980: import { spawnSync } from "node:child_process"; L21981: var GREP_APP_API = "https://grep.app/api/search"; L21982: var grepsearchTool = {

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

baseline/mcp-tools/dist/mcp/server.jsView on unpkg · L21969

2949sourceCode = this.opts.code.process(sourceCode, sch); L2950: const makeValidate = new Function(`${names_1.default.self}`, `${names_1.default.scope}`, sourceCode); L2951: const validate = makeValidate(this, this.scope.get());

Low

Eval

Package source references a known benign dynamic code generation pattern.

baseline/mcp-tools/dist/mcp/server.jsView on unpkg · L2949

src/rtk.mjsView file

Lines 1-33javascript

1// rtk installer/detector/state — ported from opencode-starterkit src/rtk.mjs.

2// Auto-installs the rtk binary if missing, detects it across PATH +

3// common global bin dirs, records integration state in the shared

4// starterkit-state.json, and exposes a resolveRtkSetup pipeline that

5// mirrors resolveCodebaseMemorySetup / resolveWebclawSetup.

6//

7// All platforms (win32, linux, darwin) auto-download the correct

8// release binary from GitHub. The old Unix-only install.sh path is

9// kept as a fallback for edge cases.

baseline/hooks-plugin/hooks/guard.cmdView file

•path = baseline/hooks-plugin/hooks/guard.cmd kind = build_helper sizeBytes = 207 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

baseline/hooks-plugin/hooks/guard.cmdView on unpkg

baseline/skills/security-and-hardening/SKILL.mdView file

Lines 84-124markdown

84import bcrypt from "bcrypt";

85const hash = await bcrypt.hash(password, 12); // cost factor 12

86const valid = await bcrypt.compare(input, hash);

88// ✅ Session management

89const session = {

90 httpOnly: true, // No JS access

91 secure: true, // HTTPS only

92 sameSite: "lax", // CSRF protection

93 maxAge: 3600, // 1 hour expiry

94};

Source & flagged code

7 flagged · loading source

baseline/hooks-plugin/hooks/rtk.mjs

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code