registry / gm-skill / 2.0.1750

gm-skill@2.0.1750

⚠ Under review

Canonical universal harness — AI-native software engineering via skill-driven orchestration; bootstraps plugkit for task execution and session isolation. Install in any AI coding agent host.

Static Scan Results

scanned 7h ago · by rust-scanner

Static analysis flagged 17 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 390 KB of source, external domains: 127.0.0.1, github.com, registry.npmjs.org

Source & flagged code

11 flagged

bin/bootstrap.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

4const fs = require('fs');

5const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bootstrap.jsView on unpkg · L3

6const os = require('os');

7const crypto = require('crypto');

8const { spawnSync } = require('child_process');

High

Child Process

Package source references child process execution.

bin/bootstrap.jsView on unpkg · L7

10const NPM_PACKAGE = 'plugkit-wasm';

11const ATTEMPT_TIMEOUT_MS = 10 * 60 * 1000;

12const MAX_ATTEMPTS = 3;

13const BACKOFF_MS = [5000, 15000];

14const LOCK_STALE_MS = 30 * 60 * 1000;

16function log(msg) {

17 try { process.stderr.write(`[plugkit-bootstrap] ${msg}\n`); } catch (_) {}

18}

20function ensureSkillMdCurrent(wrapperDir) {

21 try {

22 const candidates = [

23 path.join(wrapperDir, '..', 'skills', 'gm', 'SKILL.md'),

24 path.join(wrapperDir, '..', '..', 'skills', 'gm', 'SKILL.md'),

25 path.join(wrapperDir, '..', 'SKILL.md'),

26 ];

27 const bundledPath = candidates.find(p => { try { return fs.existsSync(p); } catch (_) { return false; } });

bin/gm-validate.jsView file

Lines 39-79javascript

39 fs.renameSync(tmp, inFile);

40 const t0 = Date.now();

41 while (Date.now() - t0 < timeoutMs) {

42 if (fs.existsSync(outFile)) {

43 const txt = fs.

gm-plugkit/plugkit-wasm-wrapper.jsView file

Lines 1-24javascript

1import fs from 'fs';

2import path from 'path';

3import os from 'os';

4import crypto from 'crypto';

5import https from 'https';

lib/skill-bootstrap.jsView file

Lines 481-521javascript

481 const spoolDir = path.join(projectDir, '.gm', 'exec-spool');

482 fs.mkdirSync(spoolDir, { recursive: true });

483 const logPath = path.join(spoolDir, '.watcher.log');

484 try {

scripts/run-hook.shView file

•path = scripts/run-hook.sh kind = build_helper sizeBytes = 203 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/run-hook.shView on unpkg

Source & flagged code

11 flagged · loading source

bin/bootstrap.jsView file

7const crypto = require('crypto'); L8: const { spawnSync } = require('child_process'); L9:

High

Child Process

Package source references child process execution.

bin/bootstrap.jsView on unpkg · L7

3L4: const fs = require('fs'); L5: const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bootstrap.jsView on unpkg · L3

bin/gm-validate.jsView file

59const child = cp.spawn('bun', ['x', 'gm-plugkit@latest', 'spool'], { L60: cwd: ROOT, detached: true, stdio: ['ignore', 'ignore', 'ignore'], windowsHide: true, shell: true, L61: });

High

Shell

Package source references shell execution.

bin/gm-validate.jsView on unpkg · L59

gm-plugkit/plugkit-wasm-wrapper.jsView file

1032function isPortAliveSync(port) { L1033: const r = spawnSync(process.execPath, ['-e', ` L1034: const net = require('net'); L1035: const s = net.connect({ port: ${port}, host: '127.0.0.1' }); ... L1047: function playwriterHomeFor(cwd, claudeSessionId) { L1048: if (process.env.PLAYWRITER_HOME) return process.env.PLAYWRITER_HOME; L1049: if (!cwd) return path.join(GM_TOOLS_ROOT, `pw-sock-${sessionProfileSlug(claudeSessionId)}`);

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

gm-plugkit/plugkit-wasm-wrapper.jsView on unpkg · L1032

712if (!_aggregateCpuProfileFn) { L713: _aggregateCpuProfileFn = new Function(AGGREGATE_CPU_PROFILE_SRC + '\nreturn aggregateCpuProfile;')(); L714: }

High

Eval

Package source references dynamic code evaluation.

gm-plugkit/plugkit-wasm-wrapper.jsView on unpkg · L712

1009function isPortReachableSync(host, port, timeoutMs) { L1010: const r = spawnSync(process.execPath, ['-e', ` L1011: const net = require('net'); L1012: const s = net.connect({ port: ${port}, host: ${JSON.stringify(host)} }); ... L1024: const srv = net.createServer(); L1025: srv.listen(0, '127.0.0.1', () => { const p = srv.address().port; srv.close(() => { process.stdout.write(String(p)); }); }); L1026: srv.on('error', e => { process.stderr.write(e.message); process.exit(1); });

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

gm-plugkit/plugkit-wasm-wrapper.jsView on unpkg · L1009

1275logEvent('plugkit', 'browser.chromium-installing', {}); L1276: spawnSync(process.platform === 'win32' ? 'npx.cmd' : 'npx', ['--yes', 'playwright', 'install', 'chromium'], { L1277: encoding: 'utf-8',

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

gm-plugkit/plugkit-wasm-wrapper.jsView on unpkg · L1275

4import crypto from 'crypto'; L5: import https from 'https'; L6: import http from 'http'; L7: import { watch } from 'fs'; L8: import * as _childProcess from 'child_process'; L9: import { spawn as _rawSpawn, spawnSync as _rawSpawnSync } from 'child_process'; ... L27: const __filename = fileURLToPath(import.meta.url); L28: const __dirname = path.dirname(__filename); L29: ... L40: L41: const GM_LOG_ROOT = process.env.GM_LOG_DIR || path.join(os.homedir(), '.claude', 'gm-log'); L42: const ORCHESTRATOR_VERBS = new Set(['instruction', 'transition', 'phase-status', 'prd-add', 'prd-resolve', 'prd-list', 'mutable-add', 'mutable-resolve', 'mutable-list', 'memorize-f...

Low

Weak Crypto

Package source references weak cryptographic algorithms.

gm-plugkit/plugkit-wasm-wrapper.jsView on unpkg · L4

lib/skill-bootstrap.jsView file

501package = gm-skill; repositoryIdentity = gm; dependency = gm-plugkit L501: try { L502: const gmPlugkit = require('gm-plugkit'); L503: const base = path.dirname(gmPlugkit.getPath ? gmPlugkit.getPath() : require.resolve('gm-plugkit'));

High

Copied Package Dependency Bridge

Package metadata claims a different repository identity while copied source loads a runtime dependency bridge.

lib/skill-bootstrap.jsView on unpkg · L501

2Cross-file remote execution chain: lib/sk[redacted] spawns gm-plugkit/plugkit-wasm-wrapper.js; helper contains network access plus dynamic code execution. L2: const path = require('path'); L3: const https = require('https'); L4: const { execSync, execFileSync, spawn } = require('child_process'); L5: const crypto = require('crypto'); ... L9: function resolveToolsDir() { L10: const primary = path.join(os.homedir(), '.gm-tools'); L11: const fallback = path.join(os.homedir(), '.claude', 'gm-tools'); ... L71: } L72: const gm = JSON.parse(fs.readFileSync(gmJsonPath, 'utf8')); L73: const version = gm.plugkitVersion; ... L210: function patchPackageJsonJest(cwd) { L211: const pkgPath = path.join(cwd, 'package.json');

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

lib/skill-bootstrap.jsView on unpkg · L2

scripts/run-hook.shView file

•path = scripts/run-hook.sh kind = build_helper sizeBytes = 203 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/run-hook.shView on unpkg

Findings

1 Critical7 High5 Medium4 Low

CriticalSame File Env Network Executiongm-plugkit/plugkit-wasm-wrapper.js

HighChild Processbin/bootstrap.js

HighShellbin/gm-validate.js

HighEvalgm-plugkit/plugkit-wasm-wrapper.js

HighCommand Output Exfiltrationgm-plugkit/plugkit-wasm-wrapper.js

HighCopied Package Dependency Bridgelib/skill-bootstrap.js

HighCross File Remote Execution Contextlib/skill-bootstrap.js

HighRuntime Package Installgm-plugkit/plugkit-wasm-wrapper.js

MediumDynamic Requirebin/bootstrap.js

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/run-hook.sh

MediumStructural Risk Force Deep Review

LowWeak Cryptogm-plugkit/plugkit-wasm-wrapper.js

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

11 flagged

bin/bootstrap.jsView file

Lines 1-27javascript

1#!/usr/bin/env node

2'use strict';

4const fs = require('fs');

5const path = require('path');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/bootstrap.jsView on unpkg · L3

6const os = require('os');

7const crypto = require('crypto');

8const { spawnSync } = require('child_process');

High

Child Process

Package source references child process execution.

bin/bootstrap.jsView on unpkg · L7

10const NPM_PACKAGE = 'plugkit-wasm';

11const ATTEMPT_TIMEOUT_MS = 10 * 60 * 1000;

12const MAX_ATTEMPTS = 3;

13const BACKOFF_MS = [5000, 15000];

14const LOCK_STALE_MS = 30 * 60 * 1000;

16function log(msg) {

17 try { process.stderr.write(`[plugkit-bootstrap] ${msg}\n`); } catch (_) {}

18}

20function ensureSkillMdCurrent(wrapperDir) {

21 try {

22 const candidates = [

23 path.join(wrapperDir, '..', 'skills', 'gm', 'SKILL.md'),

24 path.join(wrapperDir, '..', '..', 'skills', 'gm', 'SKILL.md'),

25 path.join(wrapperDir, '..', 'SKILL.md'),

26 ];

27 const bundledPath = candidates.find(p => { try { return fs.existsSync(p); } catch (_) { return false; } });

bin/gm-validate.jsView file

Lines 39-79javascript

39 fs.renameSync(tmp, inFile);

40 const t0 = Date.now();

41 while (Date.now() - t0 < timeoutMs) {

42 if (fs.existsSync(outFile)) {

43 const txt = fs.

gm-plugkit/plugkit-wasm-wrapper.jsView file

Lines 1-24javascript

1import fs from 'fs';

2import path from 'path';

3import os from 'os';

4import crypto from 'crypto';

5import https from 'https';

lib/skill-bootstrap.jsView file

Lines 481-521javascript

481 const spoolDir = path.join(projectDir, '.gm', 'exec-spool');

482 fs.mkdirSync(spoolDir, { recursive: true });

483 const logPath = path.join(spoolDir, '.watcher.log');

484 try {

scripts/run-hook.shView file

•path = scripts/run-hook.sh kind = build_helper sizeBytes = 203 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/run-hook.shView on unpkg

Lines 989-1052javascript

989

990function resolveWindowsExeLocal(cmd) {

991 if (process.platform !== 'win32') return cmd;

992 try {

993 const out = spawnSync('where', [cmd], {

994 encoding: 'utf-8',

995 stdio: ['ignore', 'pipe', 'ignore'],

996 windowsHide: true,

997 timeout: 800,

998 });

999 if (out.status !== 0) return cmd;

1000 const lines = (out.stdout || '').split(/\r?\n/).map(l => l.trim()).filter(Boolean);

1001 const exe = lines.find(l => /\.exe$/i.test(l));

1002 const shim = lines.find(l => /\.(cmd|bat)$/i.test(l));

1003 return exe || shim || cmd;

1004 } catch {

1005 return cmd;

1006 }

1007}

1008

1009function isPortReachableSync(host, port, timeoutMs) {

1010 const r = spawnSync(process.execPath, ['-e', `

1011 const net = require('net');

1012 const s = net.connect({ port: ${port}, host: ${JSON.stringify(host)} });

1013 let done = false;

1014 s.on('connect', () => { done = true; s.destroy(); process.exit(0); });

1015 s.on('error', () => { if (!done) process.exit(1); });

1016 setTimeout(() => { if (!done) { s.destroy(); process.exit(1); } }, ${timeoutMs || 800});

1017 `], { timeout: (timeoutMs || 800) + 2000, windowsHide: true });

1018 return r.status === 0;

1019}

1020

1021function findFreePortSync() {

1022 const r = spawnSync(process.execPath, ['-e', `

1023 const net = require('net');

1024 const srv = net.createServer();

1025 srv.listen(0, '127.0.0.1', () => { const p = srv.address().port; srv.close(() => { process.stdout.write(String(p)); }); });

1026 srv.on('error', e => { process.stderr.write(e.message); process.exit(1); });

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

gm-plugkit/plugkit-wasm-wrapper.jsView on unpkg · L1009

1027 `], { encoding: 'utf-8', timeout: 5000 });

1028 if (r.status !== 0) throw new Error('could not allocate free port');

1029 return parseInt(r.stdout.trim(), 10);

1030}

1031

1032function isPortAliveSync(port) {

1033 const r = spawnSync(process.execPath, ['-e', `

1034 const net = require('net');

1035 const s = net.connect({ port: ${port}, host: '127.0.0.1' });

1036 s.on('connect', () => { s.destroy(); process.exit(0); });

1037 s.on('error', () => process.exit(1));

1038 setTimeout(() => process.exit(1), 800);

1039 `], { timeout: 2000 });

1040 return r.status === 0;

1041}

1042

1043function sleepSync(ms) {

1044 Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.max(0, ms | 0));

1045}

1046

1047function playwriterHomeFor(cwd, claudeSessionId) {

1048 if (process.env.PLAYWRITER_HOME) return process.env.PLAYWRITER_HOME;

1049 if (!cwd) return path.join(GM_TOOLS_ROOT, `pw-sock-${sessionProfileSlug(claudeSessionId)}`);

Critical

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution with blocking evidence.

gm-plugkit/plugkit-wasm-wrapper.jsView on unpkg · L1032

1050 try { ensureGitignored(cwd, '.gm/pw-sock-*/'); } catch (_) {}

1051 return path.join(cwd, '.gm', `pw-sock-${sessionProfileSlug(claudeSessionId)}`);

1052}