registry / enigma-cli / 1.29.2

enigma-cli@1.29.2

Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 5 file(s), 22.0 KB of source, external domains: github.com

Source & flagged code

3 flagged

package.jsonView file

Lines 2-42json

2 "name": "enigma-cli",

3 "version": "1.29.2",

4 "description": "Everything you need to work with a coding agent: install shared policy skills for Claude Code, OpenAI Codex and opencode, and set up portable git security hooks.",

5 "type": "module",

6 "bin": {

7 "enigma": "bin/enigma.mjs"

8 },

9 "scripts": {

10 "enigma": "tsx src/bin/enigma.ts",

11 "build": "tsup",

12 "build:binaries": "bun scripts/build-binaries.ts",

13 "dev": "node scripts/dev.mjs",

14 "dev:node": "node scripts/dev.mjs --node",

15 "dev:watch": "tsup --watch",

16 "typecheck": "tsc --noEmit",

17 "seal": "tsx src/bin/enigma.ts seal",

18 "check": "tsx src/bin/enigma.ts check",

19 "guard": "tsx src/guard.ts --all",

20 "verify": "npm run typecheck && npm run check && npm run guard",

21 "prepublishOnly": "npm run verify && npm run build",

22 "postinstall": "node bin/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L22

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L22

23 },

24 "files": [

25 "bin",

26 "dist",

27 "assets",

28 "README.md",

29 "LICENSE"

30 ],

31 "engines": {

32 "node": ">=18"

33 },

34 "devDependencies": {

35 "@clack/prompts": "^0.7.0",

36 "@opentui/core": "^0.3.1",

37 "@opentui/react": "^0.3.1",

38 "@types/node": "^22.0.0",

39 "@types/react": "^19.2.0",

40 "react": "^19.2.0",

41 "tsup": "^8.0.0",

42 "tsx": "^4.0.0",

assets/skills/skill-creator/eval-viewer/generate_review.pyView file

•path = assets/skills/skill-creator/eval-viewer/generate_review.py kind = build_helper sizeBytes = 16365 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

assets/skills/skill-creator/eval-viewer/generate_review.pyView on unpkg

Source & flagged code

3 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/postinstall.mjs

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code