registry / forgedock / 1.0.22

forgedock@1.0.22

Autonomous dev pipeline for Claude Code. GitHub as institutional memory — every issue, PR, and annotation survives context resets and makes the next agent smarter.

Static Scan Results

scanned 15d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 14 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

CopyleftLicense

scanned 19 file(s), 339 KB of source, external domains: api.anthropic.com, cli.github.com, dev.to, docs.anthropic.com, forgedock.com, gitforwindows.org, github.com, gql.hashnode.com

Source & flagged code

6 flagged

examples/forgedock-demo/src/db.jsView file

Lines 14-54javascript

14 { id: 1, owner: 'alice', title: 'Buy milk', body: 'Whole milk, 2 liters', secret: false },

15 { id: 2, owner: 'alice', title: 'Launch plan', body: 'Ship the demo repo', secret: true },

16 { id: 3, owner: 'bob', title: 'Gym', body: 'Leg day', secret: false },

17];

19let nextId = 4;

21function all() {

22 return notes;

23}

25function findById(id) {

26 return notes.find((n) => n.id === Number(id));

27}

29// Simulated SQL query. `whereClause` is a raw expression like "owner == 'alice'".

30// INTENTIONAL FLAW: the clause is evaluated directly, so a caller can inject

31// arbitrary expressions (e.g. "true || secret"). A real fix would use a

32// parameterized filter instead of evaluating untrusted strings.

33function query(whereClause) {

34 // eslint-disable-next-line no-new-func

35 const predicate = new Function('row', `with (row) { return (${whereClause}); }`);

36 return notes.filter((row) => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/forgedock-demo/src/db.jsView on unpkg · L34

37 try {

38 return predicate(row);

39 } catch {

40 return false;

41 }

42 });

43}

45function insert(note) {

46 const record = { id: nextId++, secret: false, ...note };

47 notes.push(record);

48 return record;

49}

51function remove(id) {

52 const before = notes.length;

53 notes = notes.filter((n) => n.id !== Number(id));

54 return notes.length < before;

bin/hooks/session-start.mjsView file

Lines 56-96javascript

56// forge-utils helpers — populated inside the try block to honour fail-open

57// ---------------------------------------------------------------------------

59// Declared at module scope so they are accessible from context-builder

60// functions called from within the try block. Assigned inside the try/catch

61// so that any import failure (missing file, permissions error, syntax error)

62// is caught and the hook still exits 0.

63let parseForgeYaml;

64let sanitizeContextValue;

66// ---------------------------------------------------------------------------

bin/forgedock.mjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios

3// SPDX-License-Identifier: AGPL-3.0-or-later

5import { fileURLToPath, pathToFileURL } from "url";

6import { basename, dirname, join, relative, resolve } from "path";

7import { mkdir, symlink, readlink, lstat, readdir, stat, unlink } from "fs/promises";

8import {

examples/forgedock-demo/bootstrap.shView file

•path = examples/forgedock-demo/bootstrap.sh kind = build_helper sizeBytes = 4902 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/forgedock-demo/bootstrap.shView on unpkg

docs/CONFIG.mdView file

Lines 404-453markdown

404|-------|------|----------|-------------|

410| `services[].health_url`

Source & flagged code

6 flagged · loading source

examples/forgedock-demo/src/db.jsView file

34// eslint-disable-next-line no-new-func L35: const predicate = new Function('row', `with (row) { return (${whereClause}); }`); L36: return notes.filter((row) => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/forgedock-demo/src/db.jsView on unpkg · L34

bin/hooks/session-start.mjsView file

76// Use pathToFileURL() to convert the OS-native path to a file:// URL before L77: // passing it to dynamic import(). On Windows, join() produces backslash paths L78: // that import() rejects with ERR_UNSUPPORTED_ESM_URL_SCHEME.

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/hooks/session-start.mjsView on unpkg · L76

bin/forgedock.mjsView file

15} from "fs"; L16: import { execSync, execFileSync } from "child_process"; L17: import { homedir } from "os"; ... L38: const __filename = fileURLToPath(import.meta.url); L39: const __dirname = dirname(__filename); L40: const FORGE_HOME = dirname(__dirname); ... L162: * Strip JSONC syntax (single-line comments, block comments, trailing commas) L163: * from a raw JSON string, returning a plain JSON string that JSON.parse() accepts. L164: * ... L353: `#\n` + L354: `# These symlinks are managed by ForgeDock (https://forgedock.com).\n` + L355: `# ForgeDock owns the global ~/.claude/commands/ namespace.\n` +

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

bin/forgedock.mjsView on unpkg · L15

examples/forgedock-demo/bootstrap.shView file

•path = examples/forgedock-demo/bootstrap.sh kind = build_helper sizeBytes = 4902 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/forgedock-demo/bootstrap.shView on unpkg

docs/CONFIG.mdView file

424patternName = generic_password severity = medium line = 424 matchedText = password...ord"

Medium

Secret Pattern

Hardcoded password in docs/CONFIG.md

docs/CONFIG.mdView on unpkg · L424

433patternName = generic_password severity = medium line = 433 matchedText = password...ord"

Medium

Secret Pattern

Hardcoded password in docs/CONFIG.md

docs/CONFIG.mdView on unpkg · L433

Findings

8 Medium6 Low

MediumDynamic Requirebin/hooks/session-start.mjs

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencebin/forgedock.mjs

MediumShips Build Helperexamples/forgedock-demo/bootstrap.sh

MediumStructural Risk Force Deep Review

MediumSecret Patterndocs/CONFIG.md

LowScripts Present

LowEvalexamples/forgedock-demo/src/db.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowCopyleft License

Source & flagged code

6 flagged

examples/forgedock-demo/src/db.jsView file

Lines 14-54javascript

14 { id: 1, owner: 'alice', title: 'Buy milk', body: 'Whole milk, 2 liters', secret: false },

15 { id: 2, owner: 'alice', title: 'Launch plan', body: 'Ship the demo repo', secret: true },

16 { id: 3, owner: 'bob', title: 'Gym', body: 'Leg day', secret: false },

17];

19let nextId = 4;

21function all() {

22 return notes;

23}

25function findById(id) {

26 return notes.find((n) => n.id === Number(id));

27}

29// Simulated SQL query. `whereClause` is a raw expression like "owner == 'alice'".

30// INTENTIONAL FLAW: the clause is evaluated directly, so a caller can inject

31// arbitrary expressions (e.g. "true || secret"). A real fix would use a

32// parameterized filter instead of evaluating untrusted strings.

33function query(whereClause) {

34 // eslint-disable-next-line no-new-func

35 const predicate = new Function('row', `with (row) { return (${whereClause}); }`);

36 return notes.filter((row) => {

Low

Eval

Package source references a known benign dynamic code generation pattern.

examples/forgedock-demo/src/db.jsView on unpkg · L34

37 try {

38 return predicate(row);

39 } catch {

40 return false;

41 }

42 });

43}

45function insert(note) {

46 const record = { id: nextId++, secret: false, ...note };

47 notes.push(record);

48 return record;

49}

51function remove(id) {

52 const before = notes.length;

53 notes = notes.filter((n) => n.id !== Number(id));

54 return notes.length < before;

bin/hooks/session-start.mjsView file

Lines 56-96javascript

56// forge-utils helpers — populated inside the try block to honour fail-open

57// ---------------------------------------------------------------------------

59// Declared at module scope so they are accessible from context-builder

60// functions called from within the try block. Assigned inside the try/catch

61// so that any import failure (missing file, permissions error, syntax error)

62// is caught and the hook still exits 0.

63let parseForgeYaml;

64let sanitizeContextValue;

66// ---------------------------------------------------------------------------

bin/forgedock.mjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2// SPDX-FileCopyrightText: Copyright (c) RapierCraft Studios

3// SPDX-License-Identifier: AGPL-3.0-or-later

5import { fileURLToPath, pathToFileURL } from "url";

6import { basename, dirname, join, relative, resolve } from "path";

7import { mkdir, symlink, readlink, lstat, readdir, stat, unlink } from "fs/promises";

8import {

examples/forgedock-demo/bootstrap.shView file

•path = examples/forgedock-demo/bootstrap.sh kind = build_helper sizeBytes = 4902 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

examples/forgedock-demo/bootstrap.shView on unpkg

docs/CONFIG.mdView file

Lines 404-453markdown

404|-------|------|----------|-------------|

410| `services[].health_url`