registry  /  git-command-generator  /  1.0.6

git-command-generator@1.0.6

Terminal git workflows with OpenRouter AI commit messages (gitgen / gg CLI)

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis flagged 12 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicense
scanned 1 file(s), 39.9 KB of source, external domains: api.openai.com, github.com, openrouter.ai, registry.npmjs.org

Source & flagged code

3 flagged · loading source
dist/cli.jsView file
2// scripts/cli.ts L3: import { execFile as execFile2, spawn } from "child_process"; L4: import { existsSync as existsSync2 } from "fs";
High
Child Process

Package source references child process execution.

dist/cli.jsView on unpkg · L2
821const child = process3.platform === "win32" ? spawn( L822: "powershell", L823: [
High
Shell

Package source references shell execution.

dist/cli.jsView on unpkg · L821
784log(row("bins", c.dim("gitgen \xB7 git-gen \xB7 gg (npm global PATH)"))); L785: log(` ${c.dim("update")} ${c.cyan(`npm install -g ${getPackageName()}`)} ${c.dim("or")} ${c.cyan("gitgen update")}`); L786: } ... L788: if (process3.platform === "win32") { L789: spawn("cmd", ["/c", "start", "", url], { detached: true, stdio: "ignore", windowsHide: true }).unref(); L790: return;
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/cli.jsView on unpkg · L784

Findings

3 High3 Medium6 Low
HighChild Processdist/cli.js
HighShelldist/cli.js
HighRuntime Package Installdist/cli.js
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License