registry / draht-claude / 2026.7.11

draht-claude@2026.7.11

Draht GSD, multi-agent, TDD and DDD workflows as a Claude Code plugin. Install with `npx draht-claude install`.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 10 file(s), 310 KB of source, external domains: anthropic.com, claude.com, draht.dev, www.w3.org

Source & flagged code

4 flagged

bin/draht-tools.cjsView file

Lines 1-30javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * Draht Tools — CLI for the Get Shit Done methodology.

6 * Manages .planning/ directory structure, state tracking, and git integration.

7 */

9const fs = require("node:fs"

Source & flagged code

4 flagged · loading source

bin/draht-tools.cjsView file

10const path = require("node:path"); L11: const { execSync, execFileSync } = require("node:child_process"); L12:

High

Child Process

Package source references child process execution.

bin/draht-tools.cjsView on unpkg · L10

8L9: const fs = require("node:fs"); L10: const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/draht-tools.cjsView on unpkg · L8

cli.mjsView file

20L21: import { execSync, spawnSync } from "node:child_process"; L22: import * as fs from "node:fs"; ... L26: L27: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L28: const PACKAGE_ROOT = __dirname; ... L39: "node_modules", L40: "package.json", L41: "cli.mjs", ... L107: L108: Docs: https://draht.dev L109: `);

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.mjsView on unpkg · L20

scripts/gsd-quality-gate.cjsView file

14L15: const { execSync } = require("node:child_process"); L16: const fs = require("node:fs"); ... L21: if (fs.existsSync(path.join(cwd, "bun.lockb")) || fs.existsSync(path.join(cwd, "bun.lock"))) { L22: return { pm: "bun", testCmd: "bun test", coverageCmd: "bun test --coverage", lintCmd: "bunx biome check ." }; L23: }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/gsd-quality-gate.cjsView on unpkg · L14

Findings

4 High3 Medium5 Low

HighChild Processbin/draht-tools.cjs

HighShell

HighSandbox Evasion Gated Capabilitycli.mjs

HighRuntime Package Installscripts/gsd-quality-gate.cjs

MediumDynamic Requirebin/draht-tools.cjs

MediumNetwork

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

cli.mjsView file

Lines 1-40javascript

1#!/usr/bin/env node

2/**

3 * draht-claude CLI — installs this package as a Claude Code plugin via a local marketplace.

4 *

5 * Architecture:

6 * 1. Copy plugin files into a local marketplace at ~/.draht/claude-marketplace/

7 * 2. Write marketplace.json listing draht-claude as an available plugin

8 * 3. Shell out to `claude plugin marketplace add` and `claude plugin install`

9 * 4. Claude Code tracks the plugin in its own registries and enables it

10 *

11 * The install is reversible via `draht-claude uninstall`.

12 *

13 * Usage:

14 * npx draht-claude install [--path <dir>] [--force]

15 * npx draht-claude uninstall [--path <dir>]

16 * npx draht-claude update [--path <dir>]

17 * npx draht-claude status [--path <dir>]

18 * npx draht-claude --help

19 */

21import { execSync, spawnSync } from "node:child_process";

22import * as fs from "node:fs";

23import * as os from "node:os";

24import * as path from "node:path";

25import { fileURLToPath } from "node:url";

27const __dirname = path.dirname(fileURLToPath(import.meta.url));

28const PACKAGE_ROOT = __dirname;

30// Marketplace and plugin names

31const MARKETPLACE_NAME = "draht";

32const PLUGIN_NAME = "draht";

34// Default location for the local marketplace we generate

35const DEFAULT_MARKETPLACE_DIR = path.join(os.homedir(), ".draht", "claude-marketplace");

37// Files in the npm package that must NOT be copied into the plugin tree

38const IGNORE = new Set([

39 "node_modules",

40 "package.json",

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

cli.mjsView on unpkg · L20

scripts/gsd-quality-gate.cjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2"use strict";

4/**

5 * Draht Quality Gate Hook

6 * Runs after task completion to enforce quality standards.

7 * Called by the build agent after each verify step.

8 *

9 * Usage: node gsd-quality-gate.js [--strict] [--no-tests]

10 * --no-tests skips the test-suite run (used by the Stop hook, where the

11 * post-task hook and /verify-work own test execution).

12 * Exit 0 = quality OK, Exit 1 = quality issues

13 */

15const { execSync } = require("node:child_process");

16const fs = require("node:fs");

17const path = require("node:path");

19// ── Toolchain detection — mirrors src/gsd/hook-utils.ts ──────────────────────

20function detectToolchain(cwd) {

21 if (fs.existsSync(path.join(cwd, "bun.lockb")) || fs.existsSync(path.join(cwd, "bun.lock"))) {

22 return { pm: "bun", testCmd: "bun test", coverageCmd: "bun test --coverage", lintCmd: "bunx biome check ." };

23 }

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

scripts/gsd-quality-gate.cjsView on unpkg · L14

24 if (fs.existsSync(path.join(cwd, "pnpm-lock.yaml"))) {

25 return { pm: "pnpm", testCmd: "pnpm test", coverageCmd: "pnpm run test:coverage", lintCmd: "pnpm run lint" };

26 }

27 if (fs.existsSync(path.join(cwd, "yarn.lock"))) {

28 return { pm: "yarn", testCmd: "yarn test", coverageCmd: "yarn run test:coverage", lintCmd: "yarn run lint" };

29 }

30 return { pm: "npm", testCmd: "npm test", coverageCmd: "npm run test:coverage", lintCmd: "npm run lint" };

31}

33function readHookConfig(cwd) {

34 // Strict by default: failing tests/types/lint fail the gate (exit 1).