registry / docks-kit / 0.6.0

docks-kit@0.6.0

Portable AI coding agent config kit — SoT sync engine + typed CLI for Claude Code, Codex, and universal agent skills

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 38 file(s), 269 KB of source, external domains: agentskills.io, api.github.com, bun.sh, chatgpt.com, claude.ai, code.claude.com, developers.openai.com, github.com, json.schemastore.org, nodejs.org, raw.githubusercontent.com

Source & flagged code

4 flagged

cli/src/generated/sotPayload.tsView file

Lines 1-32typescript

1// Generated by cli/scripts/generate-sot-payload.ts. DO NOT EDIT.

2// Edit SoT/, notification.mp3, or package.json, then run: bun cli/scripts/generate-sot-payload.ts

4export const GENERATED_PACKAGE_VERSION = "0.6.0"

6export const GENERATED_PAYLOAD_TEXT = {

Source & flagged code

4 flagged · loading source

cli/src/generated/sotPayload.tsView file

12"SoT/.claude/settings.json": "{\n \"$schema\": \"https://json.schemastore.org/claude-code-settings.json\",\n \"minimumVersion\": \"2.1.170\",\n \"model\": \"fable\",\n \"effort... L13: "SoT/.claude/bin/statusline.mjs": "const ESC = \"\\x1b[\"\nconst PIPE = `${ESC}90m | ${ESC}0m`\nconst DOT = `${ESC}90m • ${ESC}0m`\nconst DIM = `${ESC}2m${ESC}38;2;156;162;175m`\n\... L14: "SoT/.claude/bin/session-start.mjs": "import { readFileSync } from \"node:fs\"\nimport { homedir } from \"node:os\"\n\nfunction isRecord(value) {\n return typeof value === \"objec...

High

Child Process

Package source references child process execution.

cli/src/generated/sotPayload.tsView on unpkg · L12

cli/src/engine-native/bun.tsView file

6import type { Ctx } from "./index" L7: import { encodePowerShellCommand, powerShellLiteral } from "./powershell" L8: import type { EngineServices } from "./services"

High

Shell

Package source references shell execution.

cli/src/engine-native/bun.tsView on unpkg · L6

cli/src/engine-native/claudeSync.tsView file

5*/ L6: import { spawnSync } from "node:child_process" L7: import { ... L46: warn( L47: `claude CLI not found - config deploys, but plugin passes are skipped. Install Claude Code: ${ctx.services.deps.spec("claude").installHint()} | docs: https://code.claude.com/docs/e... L48: ) ... L117: stdio: "inherit", L118: env: { ...process.env, RTK_VERSION: version !== "" ? `v${version}` : "" } L119: }) ... L463: const marker = "# docks-kit: disable claude.ai cloud MCP connectors (set =true to keep them)" L464: const candidates = [".zshrc", ".bashrc", ".bash_profile", ".profile", ".zshenv"].map((f) => p(ctx.home, f)) L465:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/src/engine-native/claudeSync.tsView on unpkg · L5

cli/src/engine-native/skillsSync.tsView file

89L90: const res = spawnSync("npx", ["--yes", skillsCli(ctx), "add", slug, "-g", "-y", "-a", "claude-code", "codex"], { L91: stdio: "ignore"

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/src/engine-native/skillsSync.tsView on unpkg · L89

Findings

3 High3 Medium4 Low

HighChild Processcli/src/generated/sotPayload.ts

HighShellcli/src/engine-native/bun.ts

HighRuntime Package Installcli/src/engine-native/skillsSync.ts

MediumEnvironment Vars

MediumInstall Persistencecli/src/engine-native/claudeSync.ts

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

cli/src/engine-native/bun.tsView file

Lines 1-26typescript

1import { spawnSync } from "node:child_process"

2import { rmSync } from "node:fs"

3import { tmpdir } from "node:os"

5import { p } from "./exec"

6import type { Ctx } from "./index"

7import { encodePowerShellCommand, powerShellLiteral } from "./powershell"

8import type { EngineServices } from "./services"

High

Shell

Package source references shell execution.

cli/src/engine-native/bun.tsView on unpkg · L6

9import { field } from "./toolchain"

11export type BunRuntimeState =

12 | { readonly kind: "ready"; readonly executable: string }

13 | { readonly kind: "deferred"; readonly reason: "missing-curl" | "install-failed" }

15function remember(ctx: Ctx, state: BunRuntimeState): BunRuntimeState {

16 ctx.bunRuntime = state

17 return state

18}

20function predictedExecutable(ctx: Ctx, services: EngineServices): string {

21 const root = process.env["BUN_INSTALL"] !== undefined && process.env["BUN_INSTALL"] !== ""

22 ? process.env["BUN_INSTALL"]!

23 : p(ctx.home, ".bun")

24 return p(root, "bin", services.platform.isWindows() ? "bun.exe" : "bun")

25}

cli/src/engine-native/claudeSync.tsView file

Lines 1-25typescript

1/**

2 * EngineNative `sync claude` pipeline. Step order is load-bearing: rtk BEFORE

3 * the settings merge, modifiers after it, removals before plugins. Message

4 * strings, guard order, JSON semantics, and spawned argv are golden-tested.

5 */

6import { spawnSync } from "node:child_process"

7import {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/src/engine-native/claudeSync.tsView on unpkg · L5

8 appendFileSync,

9 copyFileSync,

10 existsSync,

11 mkdirSync,

12 readFileSync,

13 renameSync,

14 rmdirSync,

15 rmSync,

16 writeFileSync

17} from "node:fs"

18import { tmpdir } from "node:os"

19import { bunBootstrap } from "./bun"

20import {

21 syncClaudeAdvisor,

22 syncClaudeEffort,

23 syncClaudeModel

24} from "./claudeSettingsModifiers"

25import { claudeRuntimePaths, materializeClaudeSettings, type ClaudeRuntimePaths } from "./claudeRuntime"

cli/src/engine-native/skillsSync.tsView file

Lines 69-109typescript

69 let healed = 0

71 for (const slug of normalizeManifest(manifest)) {

72 const base = slug.slice(slug.lastIndexOf("/") + 1)

74 if (ctx.dryRun) {

75 if (isDir(p(skillsDir, base))) {

76 echo(`[dry-run] universal skill present: ${base}`)

77 healClaudeSymlink(ctx, skillsDir, base)

78 } else {

79 echo(`[dry-run] npx ${skillsCli(ctx)} add ${slug} -g -y -a claude-code codex`)

80 }

81 continue

82 }

84 if (isDir(p(skillsDir, base))) {

85 already++

86 if (healClaudeSymlink(ctx, skillsDir, base)) healed++

87 continue

88 }

90 const res = spawnSync("npx", ["--yes", skillsCli(ctx), "add", slug, "-g", "-y", "-a", "claude-code", "codex"], {

91 stdio: "ignore"

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/src/engine-native/skillsSync.tsView on unpkg · L89

92 })

93 if (res.error === undefined && res.status === 0) {

94 added++

95 } else {

96 warn(`Failed to install universal skill: ${slug}`)

97 failed++

98 }

99 }

100

101 if (ctx.dryRun) return

102

103 state.present = added + already

104

105 if (added > 0) {

106 change(`Universal skills synced (+${added} new, ${already} already present)`)

107 ctx.nextStepTriggers.skillsRestart = true

108 } else {

109 verbose(`Universal skills already in sync (${already} present)`)