registry / flowcollab / 0.3.30

flowcollab@0.3.30

Multi-Claude coordination layer — shared task board CLI for teams running Claude Code

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 37 file(s), 149 KB of source, external domains: api.github.com, flowcollab.dev, github.com, registry.npmjs.org

Source & flagged code

6 flagged

bin/comment.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/* flow:comment — append a free-form comment to a task's timeline.

4 Usage:

5 flow-comment <task_id> "<body>"

6 flow-comment <task_id> "<body>" --commit=<sha> link a specific commit

7 flow-comment <task_id> "<body>" --commit link the current HEAD

9 When a commit is linked, the comment renders a clickable "View changes" diff

10 in the board timeline (Theme 34). The commit must be pushed to GitHub to be

11 viewable.

12*/

14import { execFileSync } from 'child_process';

15import { flowFetch, resolveTaskId, positional, arg, die } from './_client.mjs';

High

Child Process

Package source references child process execution.

bin/comment.mjsView on unpkg · L13

17function headSha() {

18 try {

19 return execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();

20 } catch {

21 die('--commit with no value needs a git repo (could not run `git rev-parse HEAD`). Pass --commit=<sha> instead.');

22 }

23}

25async function main() {

26 const raw = positional(0);

27 const body = positional(1);

28 if (!raw || !body) die('Usage: flow-comment <task_id> "<body>" [--commit[=<sha>]]');

30 let commit;

31 const hasEq = process.argv.some(a => a.startsWith('--commit='));

32 if (process.argv.includes('--commit') || hasEq) {

33 // arg('commit') resolves BOTH --commit=<sha> and the space form --commit <sha>; '' means bare

bin/_client.mjsView file

Lines 1-39javascript

1/* Flow CLI — shared client.

2 - Resolves API base + token from env vars → ~/.flow/config.json → defaults

3 - Exposes one fetch helper with sensible error reporting

4 - All CLI scripts import from here

5*/

7import { spawnSync } from 'child_process';

8import 'dotenv/config';

9import { homedir } from 'os';

bin/scan.mjsView file

Lines 154-194javascript

154 fetchAllTasksForCoverage(),

155 ]);

156 const trackedPRs = new Set(allTasks.filter(t => t.pr_num).map(t => t.pr_num));

157 const unlinked = ghPRs.filter

bin/flow.mjsView file

Lines 58-84javascript

58 const { version } = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));

59 process.stdout.write(`${version}\n`);

60 } catch {

bin/login.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/* flow-login — authorize the CLI via browser OAuth (device flow).

3 Usage:

4 flow-login [--server=https://flowcollab.dev] [--as="<agent name>"]

6 --as connects this session as a named AGENT under you (e.g. --as="Backend Bot"):

7 a distinct actor on the board with its own name + avatar, so work from multiple

8 Claude sessions you run is attributed to the right one. The agent acts with your

9 permissions but can never approve decisions. Re-running --as with the same name

10 re-uses the same agent (no duplicates).

12 --persona="<text>" (with --as) sets the agent's role text injected into its

Source & flagged code

6 flagged · loading source

bin/comment.mjsView file

13L14: import { execFileSync } from 'child_process'; L15: import { flowFetch, resolveTaskId, positional, arg, die } from './_client.mjs';

High

Child Process

Package source references child process execution.

bin/comment.mjsView on unpkg · L13

bin/_client.mjsView file

19// FLOW_TLS_RESPAWNED guards against an infinite re-spawn loop: if a Node build L20: // ever drops --use-system-ca from execArgv, the execArgv check alone would L21: // re-spawn forever. The env flag survives across the spawn, so we only ever

High

Shell

Package source references shell execution.

bin/_client.mjsView on unpkg · L19

11import { join } from 'path'; L12: import { get as httpsGet } from 'https'; L13: ... L19: // FLOW_TLS_RESPAWNED guards against an infinite re-spawn loop: if a Node build L20: // ever drops --use-system-ca from execArgv, the execArgv check alone would L21: // re-spawn forever. The env flag survives across the spawn, so we only ever ... L24: && !process.execArgv.includes('--use-system-ca') L25: && process.env.FLOW_TLS_RESPAWNED !== '1') { L26: const r = spawnSync(process.execPath, ['--use-system-ca', ...process.argv.slice(1)], {

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

bin/_client.mjsView on unpkg · L11

bin/scan.mjsView file

174{ re: /(?:^|\b)[A-Za-z][A-Za-z0-9_]*(?:SECRET|TOKEN|PASSWORD|PASSWD|API_?KEY|PRIVATE_KEY|ACCESS_KEY)\s*=\s*\S{6,}/i, label: 'Secret in env-style assignment' }, L175: { re: /\beval\s*\(/, label: 'eval() usage (code injection risk)' }, L176: { re: /dangerouslySetInnerHTML/, label: 'dangerouslySetInnerHTML (XSS risk)' },

Low

Eval

Package source references a known benign dynamic code generation pattern.

bin/scan.mjsView on unpkg · L174

bin/flow.mjsView file

78try { L79: await import(new URL(target, import.meta.url)); L80: } catch (e) {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/flow.mjsView on unpkg · L78

bin/login.mjsView file

3Usage: L4: flow-login [--server=https://flowcollab.dev] [--as="<agent name>"] L5: ... L18: import { join } from 'path'; L19: import { execFile, spawnSync } from 'child_process'; L20: ... L24: // router already re-spawned, so FLOW_TLS_RESPAWNED=1 makes this a no-op. L25: if (process.platform === 'win32' L26: && !process.execArgv.includes('--use-system-ca') L27: && process.env.FLOW_TLS_RESPAWNED !== '1') { L28: const r = spawnSync(process.execPath, ['--use-system-ca', ...process.argv.slice(1)], { ... L59: headers: { 'Content-Type': 'application/json' },

High

Sandbox Evasion Gated Capability

Source gates dangerous network, credential, or execution behavior behind CI, host, platform, time, or geo fingerprint checks.

bin/login.mjsView on unpkg · L3

Findings

4 High4 Medium5 Low

HighChild Processbin/comment.mjs

HighShellbin/_client.mjs

HighSame File Env Network Executionbin/_client.mjs

HighSandbox Evasion Gated Capabilitybin/login.mjs

MediumDynamic Requirebin/flow.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowEvalbin/scan.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

bin/comment.mjsView file

Lines 1-33javascript

1#!/usr/bin/env node

2/* flow:comment — append a free-form comment to a task's timeline.

4 Usage:

5 flow-comment <task_id> "<body>"

6 flow-comment <task_id> "<body>" --commit=<sha> link a specific commit

7 flow-comment <task_id> "<body>" --commit link the current HEAD

9 When a commit is linked, the comment renders a clickable "View changes" diff

10 in the board timeline (Theme 34). The commit must be pushed to GitHub to be

11 viewable.

12*/

14import { execFileSync } from 'child_process';

15import { flowFetch, resolveTaskId, positional, arg, die } from './_client.mjs';

High

Child Process

Package source references child process execution.

bin/comment.mjsView on unpkg · L13

17function headSha() {

18 try {

19 return execFileSync('git', ['rev-parse', 'HEAD'], { encoding: 'utf8' }).trim();

20 } catch {

21 die('--commit with no value needs a git repo (could not run `git rev-parse HEAD`). Pass --commit=<sha> instead.');

22 }

23}

25async function main() {

26 const raw = positional(0);

27 const body = positional(1);

28 if (!raw || !body) die('Usage: flow-comment <task_id> "<body>" [--commit[=<sha>]]');

30 let commit;

31 const hasEq = process.argv.some(a => a.startsWith('--commit='));

32 if (process.argv.includes('--commit') || hasEq) {

33 // arg('commit') resolves BOTH --commit=<sha> and the space form --commit <sha>; '' means bare

bin/_client.mjsView file

Lines 1-39javascript

1/* Flow CLI — shared client.

2 - Resolves API base + token from env vars → ~/.flow/config.json → defaults

3 - Exposes one fetch helper with sensible error reporting

4 - All CLI scripts import from here

5*/

7import { spawnSync } from 'child_process';

8import 'dotenv/config';

9import { homedir } from 'os';

bin/scan.mjsView file

Lines 154-194javascript

154 fetchAllTasksForCoverage(),

155 ]);

156 const trackedPRs = new Set(allTasks.filter(t => t.pr_num).map(t => t.pr_num));

157 const unlinked = ghPRs.filter

bin/flow.mjsView file

Lines 58-84javascript

58 const { version } = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8'));

59 process.stdout.write(`${version}\n`);

60 } catch {

bin/login.mjsView file

Lines 1-23javascript

1#!/usr/bin/env node

2/* flow-login — authorize the CLI via browser OAuth (device flow).

3 Usage:

4 flow-login [--server=https://flowcollab.dev] [--as="<agent name>"]

6 --as connects this session as a named AGENT under you (e.g. --as="Backend Bot"):

7 a distinct actor on the board with its own name + avatar, so work from multiple

8 Claude sessions you run is attributed to the right one. The agent acts with your

9 permissions but can never approve decisions. Re-running --as with the same name

10 re-uses the same agent (no duplicates).

12 --persona="<text>" (with --as) sets the agent's role text injected into its