docks-kit@0.8.2: Suspicious npm security report (Warn)

Loading npm security reports…

docks-kit@0.8.2: Suspicious npm security report (Warn) | LPM Firewall

Source & flagged code

5 flagged

cli/src/generated/sotPayload.tsView file

Lines 1-32typescript

1// Generated by cli/scripts/generate-sot-payload.ts. DO NOT EDIT.

2// Edit SoT/, notification.mp3, or package.json, then run: bun cli/scripts/generate-sot-payload.ts

4export const GENERATED_PACKAGE_VERSION = "0.8.2"

6export const GENERATED_PAYLOAD_TEXT = {

7 "SoT/.agents/skills.txt": "# Universal AI-agent skill manifest intentionally empty.\n# Global skill discovery is opt-in: add one <owner>/<repo> slug per line.\n# EngineNative ignores comments and blank lines.\n",

8 "SoT/models.json": "{\n \"$comment\": \"Kit-verified model catalog — single source for EngineNative validators, the docks-kit CLI (models/model commands, workflow selectors, pickers, bare-flag help), and docs. Entries are research-proofed: update an entry and its tool-level `verified` date when a model ships or retires. Deploy-time model flags remain permissive; workflow selectors are strict.\",\n \"claude\": {\n \"verified\": \"2026-07-08\",\n

9 "SoT/toolchain.json": "{\n \"$comment\": \"Kit toolchain manifest — DATA only (versions, floors, policy); check/install logic lives in cli/src/engine-native/toolchain.ts with per-surface sync callbacks in cli/src/engine-native/. kind: check (doctor visibility only) | managed (kit installs/upgrades it) | pin (no binary probe — a version pin for a tool the kit invokes via npx). policy (managed only): track (upgrade toward latest, gated by `verified`) | present (install when missing, never upgrade). `verified` = last kit-tested version — anything above it prompts before install (--yes auto-acc ...

10 "SoT/.claude/CLAUDE.md": "## Research Before Implementation\n\nBefore writing or modifying code that uses an API, hook, method, or config surface you have not verified in this session, research current documentation first.\n\nResearch workflow:\n1. Prefer official documentation and primary sources for the specific library, framework, or API.\n2. If a local docs or MCP tool is available, use it before broad web search.\n3. Only then proceed to implementation.\n\nResearch when:\n- Installing or configuring a dependency.\n- Using an API, hook, method, or pattern not verified in this session.\n- ...

11 "SoT/.claude/mcp-servers.json": "{\n \"mcpServers\": {}\n}\n",

12 "SoT/.claude/settings.json": "{\n \"$schema\": \"https://json.schemastore.org/claude-code-settings.json\",\n \"minimumVersion\": \"2.1.170\",\n \"model\": \"fable\",\n

13 "SoT/.claude/bin/statusline.mjs": "const ESC = \"\\x1b[\"\nconst PIPE = `${ESC}90m | ${ESC}0m`\nconst DOT = `${ESC}90m • ${ESC}0m`\nconst DIM = `${ESC}2m${ESC}38;2;156;162;175m`\n\nfunction isRecord(value) {\n return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction finitePercentage(value) {\n return typeof value === \"number\" && Number.isFinite(value) && value >= 0 && value <= 100\n ? value

14 "SoT/.claude/bin/session-start.mjs": "import { readFileSync } from \"node:fs\"\nimport { homedir } from \"node:os\"\n\nfunction isRecord(value) {\n return typeof value === \"object\" && value !== null && !Array.isArray(value)\n}\n\nfunction nonEmpty(value, fallback) {\n return typeof value === \"string\" && value !== \"\" ? value : fallback\n}\n\n

15 "SoT/.claude/bin/notify.mjs": "const DEFAULT_SOUND = `${import.meta.dir}/../notification.mp3`\n\nexport function selectPlayer(options = {}) {\n const platform = options.platform ?? process.platform\n const sound = options.sound ?? DEFAULT_SOUND\n const which = options.which ?? ((name) => Bun.which(name))\n if (platform === \"darwin\") {\n const afplay = which(\"afplay\")\n if (typeof afplay === \"string\" && afplay !== \"\") return [afplay, sound]

16 "SoT/.codex/AGENTS.md": "# AGENTS.md\n\n## Research Before Implementation\n\nBefore writing or modifying code that uses an API, hook, method, or config surface you have not verified in this session, research current documentation first.\n\nResearch workflow:\n1. Prefer official documentation and primary sources for the specific library, framework, or API.\n2. If a local docs or MCP tool is available, use it before broad web search.\n3. Only then proceed to implementation.\n\nResearch when:\n- Installing or configuring a dependency.\n- Using an API, hook, method, or pattern not verified in th ...

17 "SoT/.codex/config.toml": "model = \"gpt-5.6-sol\"\nmodel_reasoning_effort = \"high\"\nplan_mode_reasoning_effort = \"high\"\nmodel_reasoning_summary = \"concise\"\nmodel_verbosity = \"low\"\npersonality = \"pragmatic\"\nweb_search = \"live\"\nproject_doc_max_bytes = 131072\napproval_policy =

18 "SoT/.codex/plugins/marketplace.json": "{\n \"name\": \"docks\",\n \"interface\": {\n \"displayName\": \"DocksDocks\"\n },\n \"plugins\": [

19 "SoT/.codex/rules/docks.rules": "prefix_rule(pattern=[\"pwd\"], decision=\"allow\")\nprefix_rule(pattern=[\"ls\"], decision=\"allow\")\nprefix_rule(pattern=[\"cat\"], decision=\"allow\")\nprefix_rule(pattern=[\"

20} as const

22export const GENERATED_PAYLOAD_BASE64 = {

23 "notification.mp3": "//vURAAABOItz4VgwAKYhNmQrTAAVsWZOTnZAALDp6crPPAANqzSUte8yAgxINTDUgDILXorqbv3lKJZynAAAAAAAAAAAAAADAYDJkyZMHCwAEECBAgQIEAsmTJkyZMmTIECBAgQIECBMmTJkyZMmmQIECCEREJ3d3d3aAAAAAAHh4eHhgAAAAAHh4eHhgAAAAAHh4eHhgAAAAAHh4eHhgAAAAAHh4eHhgAAAAAHh4eHhgAAAAgPDw8/8AAAd0PDz5ZjoLjBBzYzTv6z26zx2znxzfrzdLjWLDVKDTIDNFDHCAMERQYgB8G4EwBwAwDgTA+DcDgNAaA0BoIgkCQYE8zEsSxLMzMzXrFixYsWLFixevXr169evXrFixYsWLKUve7b4eHgAAAAAGHh4eHgAAAAAGHh4eHgAAAAAGHh4ePAAAAANh4eHnsAAA7+h4f/wHf/j//////MABCEAEEIJcIAxncc/XYcwhvk3tgYwgnc8iO0xTCcwUIQwzCMhIQxIB4lIYxpCcwUAsoLq2PEsyQLLgOSLhkPsgwbcM6GXT6JeMCcNhco6hZRpY4Xy2LOJ ...

24} as const

26export const GENERATED_PAYLOAD_PATHS = [

27 "SoT/.agents/skills.txt",

28 "SoT/models.json",

29 "SoT/toolchain.json",

30 "SoT/.claude/CLAUDE.md",

31 "SoT/.claude/mcp-servers.json",

32 "SoT/.claude/settings.json",

Long lines were clipped for display.

cli/src/engine-native/bun.tsView file

Lines 1-26typescript

1import { spawnSync } from "node:child_process"

2import { rmSync } from "node:fs"

3import { tmpdir } from "node:os"

5import { p } from "./exec"

6import

cli/src/engine-native/claudeSync.tsView file

Lines 1-25typescript

1/**

2 * EngineNative `sync claude` pipeline. Step order is load-bearing: rtk BEFORE

3 * the settings merge, modifiers after it, removals before plugins. Message

4 * strings, guard order, JSON semantics, and spawned argv are golden-tested.

5 */

6import { spawnSync } from "node:child_process"

7import {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/src/engine-native/claudeSync.ts

cli/src/engine-native/skillsSync.tsView file

Lines 69-109typescript

69 let healed = 0

71 for (const slug of normalizeManifest(manifest)) {

72 const base = slug.

Source & flagged code

5 flagged · loading source

cli/src/generated/sotPayload.tsView file

12"SoT/.claude/settings.json": "{\n \"$schema\": \"https://json.schemastore.org/claude-code-settings.json\",\n \"minimumVersion\": \"2.1.170\",\n \"model\": \"fable\",\n \"effort... L13: "SoT/.claude/bin/statusline.mjs": "const ESC = \"\\x1b[\"\nconst PIPE = `${ESC}90m | ${ESC}0m`\nconst DOT = `${ESC}90m • ${ESC}0m`\nconst DIM = `${ESC}2m${ESC}38;2;156;162;175m`\n\... L14: "SoT/.claude/bin/session-start.mjs": "import { readFileSync } from \"node:fs\"\nimport { homedir } from \"node:os\"\n\nfunction isRecord(value) {\n return typeof value === \"objec...

High

Child Process

Package source references child process execution.

cli/src/generated/sotPayload.tsView on unpkg · L12

cli/src/engine-native/bun.tsView file

6import type { Ctx } from "./index" L7: import { encodePowerShellCommand, powerShellLiteral } from "./powershell" L8: import type { EngineServices } from "./services"

High

Shell

Package source references shell execution.

cli/src/engine-native/bun.tsView on unpkg · L6

cli/src/engine-native/claudeSync.tsView file

•matchType = previous_version_dangerous_delta matchedPackage = docks-kit@0.7.0 matchedIdentity = npm:ZG9ja3Mta2l0:0.7.0 similarity = 0.775 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

cli/src/engine-native/claudeSync.tsView on unpkg

5*/ L6: import { spawnSync } from "node:child_process" L7: import { ... L47: warn( L48: `claude CLI not found - config deploys, but plugin passes are skipped. Install Claude Code: ${ctx.services.deps.spec("claude").installHint()} | docs: https://code.claude.com/docs/e... L49: ) ... L118: stdio: "inherit", L119: env: { ...process.env, RTK_VERSION: version !== "" ? `v${version}` : "" } L120: }) ... L441: const marker = "# docks-kit: disable claude.ai cloud MCP connectors (set =true to keep them)" L442: const candidates = [".zshrc", ".bashrc", ".bash_profile", ".profile", ".zshenv"].map((f) => p(ctx.home, f)) L443:

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/src/engine-native/claudeSync.tsView on unpkg · L5

cli/src/engine-native/skillsSync.tsView file

89L90: const res = spawnSync("npx", ["--yes", skillsCli(ctx), "add", slug, "-g", "-y", "-a", "claude-code", "codex"], { L91: stdio: "ignore"

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli/src/engine-native/skillsSync.tsView on unpkg · L89

Source & flagged code

5 flagged

cli/src/generated/sotPayload.tsView file

Lines 1-32typescript

1// Generated by cli/scripts/generate-sot-payload.ts. DO NOT EDIT.

2// Edit SoT/, notification.mp3, or package.json, then run: bun cli/scripts/generate-sot-payload.ts

4export const GENERATED_PACKAGE_VERSION = "0.8.2"

6export const GENERATED_PAYLOAD_TEXT = {

11 "SoT/.claude/mcp-servers.json": "{\n \"mcpServers\": {}\n}\n",

12 "SoT/.claude/settings.json": "{\n \"$schema\": \"https://json.schemastore.org/claude-code-settings.json\",\n \"minimumVersion\": \"2.1.170\",\n \"model\": \"fable\",\n

18 "SoT/.codex/plugins/marketplace.json": "{\n \"name\": \"docks\",\n \"interface\": {\n \"displayName\": \"DocksDocks\"\n },\n \"plugins\": [

20} as const

22export const GENERATED_PAYLOAD_BASE64 = {

24} as const

26export const GENERATED_PAYLOAD_PATHS = [

27 "SoT/.agents/skills.txt",

28 "SoT/models.json",

29 "SoT/toolchain.json",

30 "SoT/.claude/CLAUDE.md",

31 "SoT/.claude/mcp-servers.json",

32 "SoT/.claude/settings.json",

Long lines were clipped for display.

cli/src/engine-native/bun.tsView file

Lines 1-26typescript

1import { spawnSync } from "node:child_process"

2import { rmSync } from "node:fs"

3import { tmpdir } from "node:os"

5import { p } from "./exec"

6import

cli/src/engine-native/claudeSync.tsView file

Lines 1-25typescript

1/**

2 * EngineNative `sync claude` pipeline. Step order is load-bearing: rtk BEFORE

3 * the settings merge, modifiers after it, removals before plugins. Message

4 * strings, guard order, JSON semantics, and spawned argv are golden-tested.

5 */

6import { spawnSync } from "node:child_process"

7import {

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

cli/src/engine-native/claudeSync.ts

cli/src/engine-native/skillsSync.tsView file

Lines 69-109typescript

69 let healed = 0

71 for (const slug of normalizeManifest(manifest)) {

72 const base = slug.

docks-kit@0.8.2

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code