registry / docs-skills / 1.7.9

docs-skills@1.7.9

⚠ Under review

AI agent skills for documentation analysis, creation, and observability — 35 specialized skills for Claude Code, Cursor, Codex, and other AI coding tools. New in 1.6: docs-create gains a content-enrichment checkpoint that adds competitor comparisons, educ

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 9 file(s), 81.1 KB of source, external domains: example.com, github.com, raw.githubusercontent.com

Source & flagged code

3 flagged

scripts/sync-skills.jsView file

Lines 1-46javascript

1#!/usr/bin/env node

2/**

3 * sync-skills.js — после изменения скиллов:

4 * 1. пересобрать index.json (build-index.js)

5 * 2. обновить README.md в docs-skills (счётчики + категории)

6 * 3. обновить секцию ## Skills catalog в Docsbook/README.md

7 * 4. определить bump (patch/minor/major) по git diff

8 * 5. commit + push в оба репо

9 * 6. npm version <bump> + git push --tags + npm publish (только docs-skills)

10 *

11 * Запуск:

12 * node scripts/sync-skills.js # dry-run, печатает план

13 * node scripts/sync-skills.js --apply # реально делает всё

14 * node scripts/sync-skills.js --apply --no-publish # commit+push без npm publish

15 *

16 * Bump-правила:

17 * - удалён скилл (папка в skills/ исчезла из git) → major

18 * - добавлен новый скилл ИЛИ новая category → minor

19 * - изменения в существующих SKILL.md/scripts/README → patch

20 * - ничего релевантного не изменилось → exit 0, ничего не делает

21 */

23'use strict';

25const fs = require('fs');

26const path = require('path');

27const { execSync, spawnSync } = require('child_process');

High

Child Process

Package source references child process execution.

scripts/sync-skills.jsView on unpkg · L26

29const REPO_ROOT = path.resolve(__dirname, '..');

30const DOCSBOOK_ROOT = '/Users/dan/Documents/startupin24h/Docsbook';

31const SKILLS_DIR = path.join(REPO_ROOT, 'skills');

32const INDEX_JSON = path.join(REPO_ROOT, 'index.json');

33const DOCS_SKILLS_README = path.join(REPO_ROOT, 'README.md');

34const DOCSBOOK_README = path.join(DOCSBOOK_ROOT, 'README.md');

35const PKG_JSON = path.join(REPO_ROOT, 'package.json');

Critical

Npm Publish Worm

Source mutates package metadata and republishes itself to npm.

scripts/sync-skills.jsView on unpkg · L8

37const SKILLS_MARK_START = '';

38const SKILLS_MARK_END = '';

40const APPLY = process.argv.includes('--apply');

41const NO_PUBLISH = process.argv.includes('--no-publish');

43function log(...args) { console.log(...args); }

44function warn(...args) { console.warn('⚠ ', ...args); }

45function die(msg) { console.error('✗', msg); process.exit(1); }

bin/docs-skills.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const path = require('path');

3const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/docs-skills.jsView on unpkg · L1

5const SKILLS_SRC =

Source & flagged code

3 flagged · loading source

scripts/sync-skills.jsView file

8* 5. commit + push в оба репо L9: * 6. npm version <bump> + git push --tags + npm publish (только docs-skills) L10: * ... L26: const path = require('path'); L27: const { execSync, spawnSync } = require('child_process'); L28: L29: const REPO_ROOT = path.resolve(__dirname, '..'); L30: const DOCSBOOK_ROOT = '/[redacted]'; ... L34: const DOCSBOOK_README = path.join(DOCSBOOK_ROOT, 'README.md'); L35: const PKG_JSON = path.join(REPO_ROOT, 'package.json'); L36: ... L66: function readIndex() {

Critical

Npm Publish Worm

Source mutates package metadata and republishes itself to npm.

scripts/sync-skills.jsView on unpkg · L8

26const path = require('path'); L27: const { execSync, spawnSync } = require('child_process'); L28:

High

Child Process

Package source references child process execution.

scripts/sync-skills.jsView on unpkg · L26

bin/docs-skills.jsView file

1#!/usr/bin/env node L2: const path = require('path'); L3: const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/docs-skills.jsView on unpkg · L1

Findings

1 Critical2 High2 Medium4 Low

CriticalNpm Publish Wormscripts/sync-skills.js

HighChild Processscripts/sync-skills.js

HighShell

MediumDynamic Requirebin/docs-skills.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

scripts/sync-skills.jsView file

Lines 1-46javascript

1#!/usr/bin/env node

2/**

3 * sync-skills.js — после изменения скиллов:

4 * 1. пересобрать index.json (build-index.js)

5 * 2. обновить README.md в docs-skills (счётчики + категории)

6 * 3. обновить секцию ## Skills catalog в Docsbook/README.md

7 * 4. определить bump (patch/minor/major) по git diff

8 * 5. commit + push в оба репо

9 * 6. npm version <bump> + git push --tags + npm publish (только docs-skills)

10 *

11 * Запуск:

12 * node scripts/sync-skills.js # dry-run, печатает план

13 * node scripts/sync-skills.js --apply # реально делает всё

14 * node scripts/sync-skills.js --apply --no-publish # commit+push без npm publish

15 *

16 * Bump-правила:

17 * - удалён скилл (папка в skills/ исчезла из git) → major

18 * - добавлен новый скилл ИЛИ новая category → minor

19 * - изменения в существующих SKILL.md/scripts/README → patch

20 * - ничего релевантного не изменилось → exit 0, ничего не делает

21 */

23'use strict';

25const fs = require('fs');

26const path = require('path');

27const { execSync, spawnSync } = require('child_process');

High

Child Process

Package source references child process execution.

scripts/sync-skills.jsView on unpkg · L26

29const REPO_ROOT = path.resolve(__dirname, '..');

30const DOCSBOOK_ROOT = '/Users/dan/Documents/startupin24h/Docsbook';

31const SKILLS_DIR = path.join(REPO_ROOT, 'skills');

32const INDEX_JSON = path.join(REPO_ROOT, 'index.json');

33const DOCS_SKILLS_README = path.join(REPO_ROOT, 'README.md');

34const DOCSBOOK_README = path.join(DOCSBOOK_ROOT, 'README.md');

35const PKG_JSON = path.join(REPO_ROOT, 'package.json');

Critical

Npm Publish Worm

Source mutates package metadata and republishes itself to npm.

scripts/sync-skills.jsView on unpkg · L8

37const SKILLS_MARK_START = '';

38const SKILLS_MARK_END = '';

40const APPLY = process.argv.includes('--apply');

41const NO_PUBLISH = process.argv.includes('--no-publish');

43function log(...args) { console.log(...args); }

44function warn(...args) { console.warn('⚠ ', ...args); }

45function die(msg) { console.error('✗', msg); process.exit(1); }

bin/docs-skills.jsView file

Lines 1-21javascript

1#!/usr/bin/env node

2const path = require('path');

3const fs = require('fs');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/docs-skills.jsView on unpkg · L1

5const SKILLS_SRC =