registry / easy-coding-harness / 0.7.1

easy-coding-harness@0.7.1

CLI scaffold for installing Easy Coding harness files into agent-native directories.

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 1 file(s), 119 KB of source

Source & flagged code

3 flagged

dist/cli.jsView file

Lines 974-1014javascript

974 return resolved;

975}

976async function withProjectInstallPaths(cwd, ctx, projectId) {

977 const resolvedProjectId = projectId ?? await readProjectIdIfExists

Source & flagged code

3 flagged · loading source

dist/cli.jsView file

994function renderHookCommand(_cwd, ctx, scriptName, platform = process.platform, projectId) { L995: const launcher = `import base64;exec(base64.b64decode('${Buffer.from(HOOK_LAUNCHER_PYTHON).toString("base64")}').decode())`; L996: const rootIdArg = projectId ? ` ${shellDoubleQuoteArg(projectId, platform)}` : "";

High

Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L994

3032// src/commands/update.ts L3033: import { execFileSync } from "child_process"; L3034: import { cancel as cancel5, confirm as confirm4, outro as outro5 } from "@clack/prompts"; ... L3039: const spec = `${PACKAGE_NAME}@${tag}`; L3040: const plan = ["update runs one step:", ` refresh the global CLI: npm install -g ${spec}`].join( L3041: "\n"

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L3032

templates/shared-hooks/inject-workflow-state.pyView file

•path = templates/shared-hooks/inject-workflow-state.py kind = build_helper sizeBytes = 2136 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/shared-hooks/inject-workflow-state.pyView on unpkg

Findings

3 High3 Medium4 Low

HighChild Processdist/cli.js

HighShell

HighRuntime Package Installdist/cli.js

MediumEnvironment Vars

MediumShips Build Helpertemplates/shared-hooks/inject-workflow-state.py

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

Lines 3012-3052javascript

3012 console.log(` current_task: ${session.current_task} (task.json missing)`);

3013 }

3014 } else {

3015 console.log(" no active session");

3016 }

3017 console.log("");

3018 console.log(chalk6.bold("Tasks"));

3019 console.log(` total: ${tasks.length}`);

3020 for (const [taskStatus, count] of Object.entries(taskCounts)) {

3021 console.log(` ${taskStatus}: ${count}`);

3022 }

3023 if (activeTasks.length > 0) {

3024 console.log(" active:");

3025 for (const item of activeTasks) {

3026 const label = item.task.title ? `${item.task.title} (${item.task.status})` : item.task.status;

3027 console.log(` - ${item.id}: ${label}`);

3028 }

3029 }

3030}

3031

3032// src/commands/update.ts

3033import { execFileSync } from "child_process";

3034import { cancel as cancel5, confirm as confirm4, outro as outro5 } from "@clack/prompts";

3035import chalk7 from "chalk";

3036async function update(opts) {

3037 renderBanner();

3038 const tag = opts.tag ?? "latest";

3039 const spec = `${PACKAGE_NAME}@${tag}`;

3040 const plan = ["update runs one step:", ` refresh the global CLI: npm install -g ${spec}`].join(

3041 "\n"

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L3032

3042 );

3043 if (opts.dryRun) {

3044 console.log(plan);

3045 return;

3046 }

3047 if (!opts.yes) {

3048 const confirmed = await confirm4({

3049 message: `Update the global CLI to ${spec}?`,

3050 initialValue: true

3051 });

3052 if (typeof confirmed === "symbol" || !confirmed) {