registry / create-obsidian-arrow / 0.5.2

create-obsidian-arrow@0.5.2

Scaffold an Obsidian-styled Arrow.js UI sandbox (pnpm create obsidian-arrow <dir>).

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 8 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 53 file(s), 121 KB of source

Source & flagged code

2 flagged

template/scripts/install-skills.mjsView file

Lines 15-55javascript

15 *

16 * Wiring:

17 * - `postinstall` (auto on `pnpm install`): only acts in an interactive

18 * terminal; in CI/non-TTY it prints how to install and exits 0 (never hangs).

19 * - `pnpm skills:install [--yes]` → picker, or non-interactive install of all.

20 * - `pnpm skills:update` → update installed skills to the latest.

21 *

22 * Flags / env:

23 * --source <ref> | SKILLS_SOURCE=<ref> where to pull skills from (default: the

24 * published repo; a local `skills/` dir is used if present)

25 * --update / -u update installed skills (runs `skills update -y`)

26 * --yes / -y non-interactive install of all skills

27 * --agent <name> | --agent=<name> install for one agent instead of all

28 * --project-dir=<path> install into another project root (e.g. the outer repo

29 * a scaffold is nested in); project-scoped there

30 * --global / -g install at user level (~/.<agent>/…), everywhere

31 * SKILLS_AGENT / SKILLS_PROJECT_DIR / SKILLS_GLOBAL env forms (for the auto

32 * `postinstall` step, which can't take CLI args, and CI)

33 * --dry-run / SKILLS_DRY_RUN=1 print the command instead of running it

34 * SKIP_SKILLS_INSTALL=1 opt out of the postinstall auto-step

35 */

36import { spawnSync } from "node:child_process";

37import fs from "node:fs";

High

Child Process

Package source references child process execution.

template/scripts/install-skills.mjsView on unpkg · L35

38import path from "node:path";

39import process from "node:process";

41const REPO = "kylebrodeur/obsidian-arrow-sandbox";

42const SKILLS =

43 "obsidian-arrow-sandbox, arrow-js-obsidian-templates, arrow-js-obsidian-patterns, arrow-js-obsidian-porting, obsidian-arrow-maintenance";

45const has = (flag) => process.argv.includes(flag);

46// Accepts both `--flag value` and `--flag=value`.

47const flagValue = (flag) => {

48 const eq = process.argv.find((a) => a.startsWith(`${flag}=`));

49 if (eq) {

50 return eq.slice(flag.length + 1);

51 }

52 const i = process.argv.indexOf(flag);

53 return i >= 0 ? process.argv[i + 1] : undefined;

54};

Lines 82-122javascript

82const explicitSource = flagValue("--source") || process.env.SKILLS_SOURCE;

83const hasLocalSkills = fs.existsSync(path.join(process.cwd(), "skills"));

84const baseSource = explicitSource ?? (hasLocalSkills ? "." :

Source & flagged code

2 flagged · loading source

template/scripts/install-skills.mjsView file

35*/ L36: import { spawnSync } from "node:child_process"; L37: import fs from "node:fs";

High

Child Process

Package source references child process execution.

template/scripts/install-skills.mjsView on unpkg · L35

102console.log(`[skills] ${pretty}${where}`); L103: const result = spawnSync("npx", ["--yes", "skills", ...args], { L104: cwd,

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

template/scripts/install-skills.mjsView on unpkg · L102

Findings

3 High2 Medium3 Low

HighChild Processtemplate/scripts/install-skills.mjs

HighShell

HighRuntime Package Installtemplate/scripts/install-skills.mjs

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

template/scripts/install-skills.mjsView file

Lines 15-55javascript

15 *

16 * Wiring:

17 * - `postinstall` (auto on `pnpm install`): only acts in an interactive

18 * terminal; in CI/non-TTY it prints how to install and exits 0 (never hangs).

19 * - `pnpm skills:install [--yes]` → picker, or non-interactive install of all.

20 * - `pnpm skills:update` → update installed skills to the latest.

21 *

22 * Flags / env:

23 * --source <ref> | SKILLS_SOURCE=<ref> where to pull skills from (default: the

24 * published repo; a local `skills/` dir is used if present)

25 * --update / -u update installed skills (runs `skills update -y`)

26 * --yes / -y non-interactive install of all skills

27 * --agent <name> | --agent=<name> install for one agent instead of all

28 * --project-dir=<path> install into another project root (e.g. the outer repo

29 * a scaffold is nested in); project-scoped there

30 * --global / -g install at user level (~/.<agent>/…), everywhere

31 * SKILLS_AGENT / SKILLS_PROJECT_DIR / SKILLS_GLOBAL env forms (for the auto

32 * `postinstall` step, which can't take CLI args, and CI)

33 * --dry-run / SKILLS_DRY_RUN=1 print the command instead of running it

34 * SKIP_SKILLS_INSTALL=1 opt out of the postinstall auto-step

35 */

36import { spawnSync } from "node:child_process";

37import fs from "node:fs";

High

Child Process

Package source references child process execution.

template/scripts/install-skills.mjsView on unpkg · L35

38import path from "node:path";

39import process from "node:process";

41const REPO = "kylebrodeur/obsidian-arrow-sandbox";

42const SKILLS =

43 "obsidian-arrow-sandbox, arrow-js-obsidian-templates, arrow-js-obsidian-patterns, arrow-js-obsidian-porting, obsidian-arrow-maintenance";

45const has = (flag) => process.argv.includes(flag);

46// Accepts both `--flag value` and `--flag=value`.

47const flagValue = (flag) => {

48 const eq = process.argv.find((a) => a.startsWith(`${flag}=`));

49 if (eq) {

50 return eq.slice(flag.length + 1);

51 }

52 const i = process.argv.indexOf(flag);

53 return i >= 0 ? process.argv[i + 1] : undefined;

54};

Lines 82-122javascript

82const explicitSource = flagValue("--source") || process.env.SKILLS_SOURCE;

83const hasLocalSkills = fs.existsSync(path.join(process.cwd(), "skills"));

84const baseSource = explicitSource ?? (hasLocalSkills ? "." :