registry / draht-claude / 2026.7.11

draht-claude@2026.7.11

Draht GSD, multi-agent, TDD and DDD workflows as a Claude Code plugin. Install with `npx draht-claude install`.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 310 KB of source, external domains: anthropic.com, claude.com, draht.dev, www.w3.org

Source & flagged code

4 flagged

bin/draht-tools.cjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * Draht Tools — CLI for the Get Shit Done methodology.

6 * Manages .planning/ directory structure, state tracking, and git integration.

7 */

9const fs = require("node:fs");

10const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/draht-tools.cjsView on unpkg · L8

11const { execSync, execFileSync } = require("node:child_process");

High

Child Process

Package source references child process execution.

bin/draht-tools.cjsView on unpkg · L10

13const PLANNING_DIR = ".planning";

14const BANNER_WIDTH = 55;

16// ============================================================================

17// Helpers

18// ============================================================================

20function banner(stage) {

21 const line = "━".repeat(BANNER_WIDTH);

22 return `${line}\n DRAHT ► ${stage}\n${line}`;

23}

25function planningPath(...segments) {

26 return path.join(process.cwd(), PLANNING_DIR, ...segments);

27}

29function ensureDir(dir) {

30 if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });

cli.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * draht-claude CLI — installs this package as a Claude Code plugin via a local marketplace.

4 *

5 * Architecture:

6 * 1. Copy plugin files into a local marketplace at ~/.draht/claude-marketplace/

7 * 2. Write marketplace.json listing draht-claude as an available plugin

8 * 3. Shell out to `claude plugin marketplace add` and `claude plugin install`

9 * 4. Claude Code tracks the plugin in its own registries and enables it

10 *

11 * The install is reversible via `draht-claude uninstall`.

scripts/gsd-quality-gate.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * Draht Quality Gate Hook

6 * Runs after task completion to enforce quality standards.

7 * Called by the build agent after each verify step.

8 *

9 * Usage: node gsd-quality-gate.js [--strict] [--no-tests]

10 * --no-tests skips the test-suite run (used by the Stop hook, where the

11 * post-task hook and /verify-work own test execution).

12 * Exit 0 = quality OK, Exit 1 = quality issues

Source & flagged code

4 flagged · loading source

bin/draht-tools.cjsView file

10const path = require("node:path"); L11: const { execSync, execFileSync } = require("node:child_process"); L12:

High

Child Process

Package source references child process execution.

bin/draht-tools.cjsView on unpkg · L10

8L9: const fs = require("node:fs"); L10: const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/draht-tools.cjsView on unpkg · L8

cli.mjsView file

20L21: import { execSync, spawnSync } from "node:child_process"; L22: import * as fs from "node:fs"; ... L26: L27: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L28: const PACKAGE_ROOT = __dirname; ... L39: "node_modules", L40: "package.json", L41: "cli.mjs", ... L107: L108: Docs: https://draht.dev L109: `);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.mjsView on unpkg · L20

scripts/gsd-quality-gate.cjsView file

14L15: const { execSync } = require("node:child_process"); L16: const fs = require("node:fs"); ... L21: if (fs.existsSync(path.join(cwd, "bun.lockb")) || fs.existsSync(path.join(cwd, "bun.lock"))) { L22: return { pm: "bun", testCmd: "bun test", coverageCmd: "bun test --coverage", lintCmd: "bunx biome check ." }; L23: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/gsd-quality-gate.cjsView on unpkg · L14

Findings

4 High3 Medium5 Low

HighChild Processbin/draht-tools.cjs

HighShell

HighSandbox Evasion Gated Capabilitycli.mjs

HighRuntime Package Installscripts/gsd-quality-gate.cjs

MediumDynamic Requirebin/draht-tools.cjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

4 flagged

bin/draht-tools.cjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * Draht Tools — CLI for the Get Shit Done methodology.

6 * Manages .planning/ directory structure, state tracking, and git integration.

7 */

9const fs = require("node:fs");

10const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/draht-tools.cjsView on unpkg · L8

11const { execSync, execFileSync } = require("node:child_process");

High

Child Process

Package source references child process execution.

bin/draht-tools.cjsView on unpkg · L10

13const PLANNING_DIR = ".planning";

14const BANNER_WIDTH = 55;

16// ============================================================================

17// Helpers

18// ============================================================================

20function banner(stage) {

21 const line = "━".repeat(BANNER_WIDTH);

22 return `${line}\n DRAHT ► ${stage}\n${line}`;

23}

25function planningPath(...segments) {

26 return path.join(process.cwd(), PLANNING_DIR, ...segments);

27}

29function ensureDir(dir) {

30 if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });

cli.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * draht-claude CLI — installs this package as a Claude Code plugin via a local marketplace.

4 *

5 * Architecture:

6 * 1. Copy plugin files into a local marketplace at ~/.draht/claude-marketplace/

7 * 2. Write marketplace.json listing draht-claude as an available plugin

8 * 3. Shell out to `claude plugin marketplace add` and `claude plugin install`

9 * 4. Claude Code tracks the plugin in its own registries and enables it

10 *

11 * The install is reversible via `draht-claude uninstall`.

scripts/gsd-quality-gate.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * Draht Quality Gate Hook

6 * Runs after task completion to enforce quality standards.

7 * Called by the build agent after each verify step.

8 *

9 * Usage: node gsd-quality-gate.js [--strict] [--no-tests]

10 * --no-tests skips the test-suite run (used by the Stop hook, where the

11 * post-task hook and /verify-work own test execution).

12 * Exit 0 = quality OK, Exit 1 = quality issues