registry / flowmind / 1.5.1

flowmind@1.5.1

Memory and workflow automation for MCP, Codex, and Claude Code. Reuse repeatable developer operations through skills and explicit feedback.

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 79 file(s), 376 KB of source, external domains: aip.baidubce.com, api.anthropic.com, api.deepseek.com, api.mimo.ai, api.openai.com, cli.github.com, dashscope.aliyuncs.com, open.bigmodel.cn, yapi.example.com

Source & flagged code

5 flagged

bin/flowmind.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * FlowMind CLI

5 * The AI Agent That Learns How You Work

6 */

8const { program } = require('commander');

9const chalk = require('chalk');

10const ora = require('ora');

11const inquirer = require('inquirer');

12const fs = require('fs-extra');

13const path = require('path');

14const { execSync } = require('child_process');

15const FlowMind = require('../core');

High

Child Process

Package source references child process execution.

bin/flowmind.jsView on unpkg · L13

16const HonorEngine = require('../core/honor-engine');

17const { syncSddAgentToFlowMind } = require('../core/sdd-agent-sync');

18const { detectManagedCliHost, shouldUseAsciiUi, shouldProxyInkStdin, getNestedTuiGuardMessage } = require('../core/utils');

19const { isExitCommand } = require('../tui/ui');

21/**

22 * Restore terminal to sane state (cancel raw mode, show cursor, reset colors)

23 */

24function restoreTerminal() {

25 try {

26 if (process.stdin.isTTY && typeof process.stdin.setRawMode === 'function') {

27 process.stdin.setRawMode(false);

28 }

29 } catch (e) { /* ignore */ }

30 if (process.stdout.isTTY) {

31 // Show cursor, reset colors, clear scroll region

32 process.stdout.write('\x1b[?25h\x1b[0m\x1b[r');

33 }

Lines 1492-1532javascript

1492

1493 console.log(chalk.cyan('└─────────────────────────────────────────────────────┘'));

1494}

1495

1496function formatFileSize(bytes) {

1497 if (bytes === 0) return '0 B';

1498 const k = 1024

Lines 1762-1802javascript

1762 // Compare versions

1763 const parse = (v) => v.split('.').map(Number);

1764 const curr = parse(currentVersion);

1765 const latest = parse(latestVersion);

1766

core/honor-engine.jsView file

Lines 1-25javascript

1/**

2 * FlowMind Honor Engine

3 * Tracks honor points earned through usage and manages dragon totem levels

4 */

6const fs = require('fs-extra');

7const path = require('path');

Medium

Dynamic Require

demo/common.shView file

•path = demo/common.sh kind = build_helper sizeBytes = 579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

demo/common.shView on unpkg

Source & flagged code

5 flagged · loading source

bin/flowmind.jsView file

13const path = require('path'); L14: const { execSync } = require('child_process'); L15: const FlowMind = require('../core');

High

Child Process

Package source references child process execution.

bin/flowmind.jsView on unpkg · L13

1512stdio: 'inherit', L1513: shell: true L1514: });

High

Shell

Package source references shell execution.

bin/flowmind.jsView on unpkg · L1512

1782try { L1783: const globalRoot = execSync('npm root -g', { encoding: 'utf-8' }).trim(); L1784: const localPath = require.resolve('../package.json'); ... L1789: const installCmd = isGlobal L1790: ? `npm install -g flowmind@${latestVersion}` L1791: : `npm install flowmind@${latestVersion}`;

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/flowmind.jsView on unpkg · L1782

core/honor-engine.jsView file

5L6: const fs = require('fs-extra'); L7: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

core/honor-engine.jsView on unpkg · L5

demo/common.shView file

•path = demo/common.sh kind = build_helper sizeBytes = 579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

demo/common.shView on unpkg

Findings

3 High5 Medium4 Low

HighChild Processbin/flowmind.js

HighShellbin/flowmind.js

HighRuntime Package Installbin/flowmind.js

MediumDynamic Requirecore/honor-engine.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperdemo/common.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

5 flagged

bin/flowmind.jsView file

Lines 1-33javascript

1#!/usr/bin/env node

3/**

4 * FlowMind CLI

5 * The AI Agent That Learns How You Work

6 */

8const { program } = require('commander');

9const chalk = require('chalk');

10const ora = require('ora');

11const inquirer = require('inquirer');

12const fs = require('fs-extra');

13const path = require('path');

14const { execSync } = require('child_process');

15const FlowMind = require('../core');

High

Child Process

Package source references child process execution.

bin/flowmind.jsView on unpkg · L13

16const HonorEngine = require('../core/honor-engine');

17const { syncSddAgentToFlowMind } = require('../core/sdd-agent-sync');

18const { detectManagedCliHost, shouldUseAsciiUi, shouldProxyInkStdin, getNestedTuiGuardMessage } = require('../core/utils');

19const { isExitCommand } = require('../tui/ui');

21/**

22 * Restore terminal to sane state (cancel raw mode, show cursor, reset colors)

23 */

24function restoreTerminal() {

25 try {

26 if (process.stdin.isTTY && typeof process.stdin.setRawMode === 'function') {

27 process.stdin.setRawMode(false);

28 }

29 } catch (e) { /* ignore */ }

30 if (process.stdout.isTTY) {

31 // Show cursor, reset colors, clear scroll region

32 process.stdout.write('\x1b[?25h\x1b[0m\x1b[r');

33 }

Lines 1492-1532javascript

1492

1493 console.log(chalk.cyan('└─────────────────────────────────────────────────────┘'));

1494}

1495

1496function formatFileSize(bytes) {

1497 if (bytes === 0) return '0 B';

1498 const k = 1024

Lines 1762-1802javascript

1762 // Compare versions

1763 const parse = (v) => v.split('.').map(Number);

1764 const curr = parse(currentVersion);

1765 const latest = parse(latestVersion);

1766

core/honor-engine.jsView file

Lines 1-25javascript

1/**

2 * FlowMind Honor Engine

3 * Tracks honor points earned through usage and manages dragon totem levels

4 */

6const fs = require('fs-extra');

7const path = require('path');

Medium

Dynamic Require

demo/common.shView file

•path = demo/common.sh kind = build_helper sizeBytes = 579 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

demo/common.shView on unpkg