registry / easy-coding-harness / 0.5.0

easy-coding-harness@0.5.0

CLI scaffold for installing Easy Coding harness files into agent-native directories.

Static Scan Results

scanned 11d ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 93.1 KB of source

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 2495-2535javascript

2495 console.log(` current_task: ${session.current_task} (task.json missing)`);

2496 }

2497 } else {

2498 console.log(" no active session");

2499 }

2500 console.log("");

2501 console.log(chalk5.bold("Tasks"));

2502 console.log(` total: ${tasks.length}`);

2503 for (const [taskStatus, count] of Object.entries(taskCounts)) {

2504 console.log(` ${taskStatus}: ${count}`);

2505 }

2506 if (activeTasks.length > 0) {

2507 console.log(" active:");

2508 for (const item of activeTasks) {

2509 const label = item.task.title ? `${item.task.title} (${item.task.status})` : item.task.status;

2510 console.log(` - ${item.id}: ${label}`);

2511 }

2512 }

2513}

2514

2515// src/commands/update.ts

2516import { execFileSync } from "child_process";

2517import { cancel as cancel4, confirm as confirm3, outro as outro4 } from "@clack/prompts";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L2515

2518import chalk6 from "chalk";

2519async function update(opts) {

2520 renderBanner();

2521 const tag = opts.tag ?? "latest";

2522 const spec = `${PACKAGE_NAME}@${tag}`;

2523 const plan = ["update runs one step:", ` refresh the global CLI: npm install -g ${spec}`].join(

2524 "\n"

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L2515

2525 );

2526 if (opts.dryRun) {

2527 console.log(plan);

2528 return;

2529 }

2530 if (!opts.yes) {

2531 const confirmed = await confirm3({

2532 message: `Update the global CLI to ${spec}?`,

2533 initialValue: true

2534 });

2535 if (typeof confirmed === "symbol" || !confirmed) {

templates/shared-hooks/inject-workflow-state.pyView file

•path = templates/shared-hooks/inject-workflow-state.py kind = build_helper sizeBytes = 6291 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/shared-hooks/inject-workflow-state.pyView on unpkg

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

2515// src/commands/update.ts L2516: import { execFileSync } from "child_process"; L2517: import { cancel as cancel4, confirm as confirm3, outro as outro4 } from "@clack/prompts";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L2515

2515// src/commands/update.ts L2516: import { execFileSync } from "child_process"; L2517: import { cancel as cancel4, confirm as confirm3, outro as outro4 } from "@clack/prompts"; ... L2522: const spec = `${PACKAGE_NAME}@${tag}`; L2523: const plan = ["update runs one step:", ` refresh the global CLI: npm install -g ${spec}`].join( L2524: "\n"

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L2515

templates/shared-hooks/inject-workflow-state.pyView file

•path = templates/shared-hooks/inject-workflow-state.py kind = build_helper sizeBytes = 6291 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/shared-hooks/inject-workflow-state.pyView on unpkg

Findings

3 High3 Medium3 Low

HighChild Processdist/cli.js

HighShell

HighRuntime Package Installdist/cli.js

MediumEnvironment Vars

MediumShips Build Helpertemplates/shared-hooks/inject-workflow-state.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 2495-2535javascript

2495 console.log(` current_task: ${session.current_task} (task.json missing)`);

2496 }

2497 } else {

2498 console.log(" no active session");

2499 }

2500 console.log("");

2501 console.log(chalk5.bold("Tasks"));

2502 console.log(` total: ${tasks.length}`);

2503 for (const [taskStatus, count] of Object.entries(taskCounts)) {

2504 console.log(` ${taskStatus}: ${count}`);

2505 }

2506 if (activeTasks.length > 0) {

2507 console.log(" active:");

2508 for (const item of activeTasks) {

2509 const label = item.task.title ? `${item.task.title} (${item.task.status})` : item.task.status;

2510 console.log(` - ${item.id}: ${label}`);

2511 }

2512 }

2513}

2514

2515// src/commands/update.ts

2516import { execFileSync } from "child_process";

2517import { cancel as cancel4, confirm as confirm3, outro as outro4 } from "@clack/prompts";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L2515

2518import chalk6 from "chalk";

2519async function update(opts) {

2520 renderBanner();

2521 const tag = opts.tag ?? "latest";

2522 const spec = `${PACKAGE_NAME}@${tag}`;

2523 const plan = ["update runs one step:", ` refresh the global CLI: npm install -g ${spec}`].join(

2524 "\n"

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L2515

2525 );

2526 if (opts.dryRun) {

2527 console.log(plan);

2528 return;

2529 }

2530 if (!opts.yes) {

2531 const confirmed = await confirm3({

2532 message: `Update the global CLI to ${spec}?`,

2533 initialValue: true

2534 });

2535 if (typeof confirmed === "symbol" || !confirmed) {

templates/shared-hooks/inject-workflow-state.pyView file

•path = templates/shared-hooks/inject-workflow-state.py kind = build_helper sizeBytes = 6291 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/shared-hooks/inject-workflow-state.pyView on unpkg