registry / gentle-pi / 0.13.0

gentle-pi@0.13.0

Turn Pi into el Gentleman: a senior-architect development harness with SDD/OpenSpec, subagents, strict TDD evidence, review guardrails, and skill discovery.

Static Scan Results

scanned 5d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

Manifest

WildcardDependency

scanned 36 file(s), 481 KB of source

Source & flagged code

2 flagged

tests/fixtures/measure-orchestrator-prompt.mjsView file

Lines 1-23javascript

1// Standalone entry point spawned as a fresh Node process by

2// tests/orchestrator-budget.test.ts's realistic-path-length budget test.

3//

4// extensions/gentle-ai.ts memoizes getOrchestratorPrompt()'s production return

5// value in a module-level cache (first-read-wins for the process lifetime).

6// Measuring a fixture render at a second, longer assets path therefore uses the

7// test-only render helper in a genuinely separate process rather than relying

8// on ambient environment variables or a second dynamic import of the same

9// module specifier in an already-imported test process.

10//

11// Reads the fixture assets path from argv[2], imports extensions/gentle-ai.ts

12// fresh, and prints the rendered prompt's UTF-8 byte length to stdout.

14import { join } from "node:path";

16const { __testing } = await import(join(import.meta.dirname, "..", "..", "extensions", "gentle-ai.ts"));

17const assetsDir = process.argv[2];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/fixtures/measure-orchestrator-prompt.mjsView on unpkg · L15

18if (!assetsDir) {

19 throw new Error("usage: measure-orchestrator-prompt.mjs <assets-dir>");

20}

21const rendered = __testing.renderOrchestratorPrompt(assetsDir);

22process.stdout.write(String(Buffer.byteLength(rendered, "utf8")));

extensions/skill-registry.tsView file

Lines 34-74typescript

34interface SkillRegistryExtensionGlobal {

35 [SKILL_REGISTRY_EXTENSION_SOURCE_KEY]?: string;

36}

38async function pathExists(path: string): Promise<boolean> {

Source & flagged code

2 flagged · loading source

tests/fixtures/measure-orchestrator-prompt.mjsView file

15L16: const { __testing } = await import(join(import.meta.dirname, "..", "..", "extensions", "gentle-ai.ts")); L17: const assetsDir = process.argv[2];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/fixtures/measure-orchestrator-prompt.mjsView on unpkg · L15

extensions/skill-registry.tsView file

54function userSkillDirs(): string[] { L55: const home = homedir(); L56: return [ ... L127: L128: function parseFrontmatter(source: string): { name?: string; description?: string; body: string } { L129: const normalized = source.replace(/\r\n?/g, "\n"); ... L384: try { L385: const parsed: unknown = JSON.parse(await readFile(cachePath, "utf8")); L386: cached = isCacheFile(parsed) ? parsed.fingerprint : undefined; ... L427: argv = process.argv.slice(2), L428: env = process.env, L429: ): boolean {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

extensions/skill-registry.tsView on unpkg · L54

Findings

3 Medium4 Low

MediumDynamic Requiretests/fixtures/measure-orchestrator-prompt.mjs

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowWeak Cryptoextensions/skill-registry.ts

LowFilesystem

LowHigh Entropy Strings

Source & flagged code

2 flagged

tests/fixtures/measure-orchestrator-prompt.mjsView file

Lines 1-23javascript

1// Standalone entry point spawned as a fresh Node process by

2// tests/orchestrator-budget.test.ts's realistic-path-length budget test.

3//

4// extensions/gentle-ai.ts memoizes getOrchestratorPrompt()'s production return

5// value in a module-level cache (first-read-wins for the process lifetime).

6// Measuring a fixture render at a second, longer assets path therefore uses the

7// test-only render helper in a genuinely separate process rather than relying

8// on ambient environment variables or a second dynamic import of the same

9// module specifier in an already-imported test process.

10//

11// Reads the fixture assets path from argv[2], imports extensions/gentle-ai.ts

12// fresh, and prints the rendered prompt's UTF-8 byte length to stdout.

14import { join } from "node:path";

16const { __testing } = await import(join(import.meta.dirname, "..", "..", "extensions", "gentle-ai.ts"));

17const assetsDir = process.argv[2];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/fixtures/measure-orchestrator-prompt.mjsView on unpkg · L15

18if (!assetsDir) {

19 throw new Error("usage: measure-orchestrator-prompt.mjs <assets-dir>");

20}

21const rendered = __testing.renderOrchestratorPrompt(assetsDir);

22process.stdout.write(String(Buffer.byteLength(rendered, "utf8")));

extensions/skill-registry.tsView file

Lines 34-74typescript

34interface SkillRegistryExtensionGlobal {

35 [SKILL_REGISTRY_EXTENSION_SOURCE_KEY]?: string;

36}

38async function pathExists(path: string): Promise<boolean> {