registry / easy-coding-harness / 0.4.0

easy-coding-harness@0.4.0

CLI scaffold for installing Easy Coding harness files into agent-native directories.

Static Scan Results

scanned 10d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 66.7 KB of source

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 1810-1850javascript

1810 console.log(` current_task: ${session.current_task} (task.json missing)`);

1811 }

1812 } else {

1813 console.log(" no active session");

1814 }

1815 console.log("");

1816 console.log(chalk5.bold("Tasks"));

1817 console.log(` total: ${tasks.length}`);

1818 for (const [taskStatus, count] of Object.entries(taskCounts)) {

1819 console.log(` ${taskStatus}: ${count}`);

1820 }

1821 if (activeTasks.length > 0) {

1822 console.log(" active:");

1823 for (const item of activeTasks) {

1824 const label = item.task.title ? `${item.task.title} (${item.task.status})` : item.task.status;

1825 console.log(` - ${item.id}: ${label}`);

1826 }

1827 }

1828}

1829

1830// src/commands/update.ts

1831import { execFileSync } from "child_process";

1832import { cancel as cancel3, confirm as confirm3, outro as outro4 } from "@clack/prompts";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1830

1833import chalk6 from "chalk";

1834async function update(opts) {

1835 renderBanner();

1836 const tag = opts.tag ?? "latest";

1837 const spec = `${PACKAGE_NAME}@${tag}`;

1838 const plan = ["update runs one step:", ` refresh the global CLI: npm install -g ${spec}`].join(

1839 "\n"

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L1830

1840 );

1841 if (opts.dryRun) {

1842 console.log(plan);

1843 return;

1844 }

1845 if (!opts.yes) {

1846 const confirmed = await confirm3({

1847 message: `Update the global CLI to ${spec}?`,

1848 initialValue: true

1849 });

1850 if (typeof confirmed === "symbol" || !confirmed) {

templates/shared-hooks/inject-workflow-state.pyView file

•path = templates/shared-hooks/inject-workflow-state.py kind = build_helper sizeBytes = 6291 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/shared-hooks/inject-workflow-state.pyView on unpkg

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

1830// src/commands/update.ts L1831: import { execFileSync } from "child_process"; L1832: import { cancel as cancel3, confirm as confirm3, outro as outro4 } from "@clack/prompts";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1830

1830// src/commands/update.ts L1831: import { execFileSync } from "child_process"; L1832: import { cancel as cancel3, confirm as confirm3, outro as outro4 } from "@clack/prompts"; ... L1837: const spec = `${PACKAGE_NAME}@${tag}`; L1838: const plan = ["update runs one step:", ` refresh the global CLI: npm install -g ${spec}`].join( L1839: "\n"

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L1830

templates/shared-hooks/inject-workflow-state.pyView file

•path = templates/shared-hooks/inject-workflow-state.py kind = build_helper sizeBytes = 6291 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/shared-hooks/inject-workflow-state.pyView on unpkg

Findings

3 High3 Medium3 Low

HighChild Processdist/cli.js

HighShell

HighRuntime Package Installdist/cli.js

MediumEnvironment Vars

MediumShips Build Helpertemplates/shared-hooks/inject-workflow-state.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 1810-1850javascript

1810 console.log(` current_task: ${session.current_task} (task.json missing)`);

1811 }

1812 } else {

1813 console.log(" no active session");

1814 }

1815 console.log("");

1816 console.log(chalk5.bold("Tasks"));

1817 console.log(` total: ${tasks.length}`);

1818 for (const [taskStatus, count] of Object.entries(taskCounts)) {

1819 console.log(` ${taskStatus}: ${count}`);

1820 }

1821 if (activeTasks.length > 0) {

1822 console.log(" active:");

1823 for (const item of activeTasks) {

1824 const label = item.task.title ? `${item.task.title} (${item.task.status})` : item.task.status;

1825 console.log(` - ${item.id}: ${label}`);

1826 }

1827 }

1828}

1829

1830// src/commands/update.ts

1831import { execFileSync } from "child_process";

1832import { cancel as cancel3, confirm as confirm3, outro as outro4 } from "@clack/prompts";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L1830

1833import chalk6 from "chalk";

1834async function update(opts) {

1835 renderBanner();

1836 const tag = opts.tag ?? "latest";

1837 const spec = `${PACKAGE_NAME}@${tag}`;

1838 const plan = ["update runs one step:", ` refresh the global CLI: npm install -g ${spec}`].join(

1839 "\n"

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L1830

1840 );

1841 if (opts.dryRun) {

1842 console.log(plan);

1843 return;

1844 }

1845 if (!opts.yes) {

1846 const confirmed = await confirm3({

1847 message: `Update the global CLI to ${spec}?`,

1848 initialValue: true

1849 });

1850 if (typeof confirmed === "symbol" || !confirmed) {

templates/shared-hooks/inject-workflow-state.pyView file

•path = templates/shared-hooks/inject-workflow-state.py kind = build_helper sizeBytes = 6291 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/shared-hooks/inject-workflow-state.pyView on unpkg