registry / harveyz-skill / 0.22.1

harveyz-skill@0.22.1

Skill manager for Claude Code, Cursor, and Codex

Static Scan Results

scanned 1d ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemShell

Supply chain

HighEntropyStrings

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 105 KB of source

Source & flagged code

8 flagged

bin/cli.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { select, input } from '@inquirer/prompts'

3import chalk from 'chalk'

4import { execSync, spawnSync } from 'child_process'

5import { existsSync, writeFileSync, unlinkSync } from 'fs'

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L3

6import { createRequire } from 'module'

7import os from 'os'

8import path from 'path'

9import { fileURLToPath } from 'url'

10import {

11 getAllSkillItems, getAllToolItems, getAllHookItems, checkHookInstalled,

12 checkInstalled, checkToolInstalled, scopeSummary,

13 resolveSkills, resolveSkillsByName, resolveTools, resolveToolsByName,

14 TOOL_BUNDLE_CHOICES,

15} from '../lib/bundles.js'

16import { buildTargetChoices, resolveTargets, TARGETS, USER_ONLY_TARGETS, SKILL_TARGETS, userSkillDir } from '../lib/targets.js'

17import { installSkills, installTools, installHooks, installHooksForTarget, uninstallHook, uninstallTool, uninstallSkill, migrateRenamedSkills } from '../lib/installer.js'

19const __dirname = path.dirname(fileURLToPath(import.meta.url))

20const require = createRequire(import.meta.url)

21const { version } = require('../package.json')

23const args = process.argv.slice(2)

Lines 130-170javascript

130 {

131 name: 'version',

132 description: 'Print version and exit',

133 },

134 ],

135 }, null, 2))

136 process.exit(0)

137 }

138 printHelp()

139

lib/installer.jsView file

Lines 36-76javascript

36 console.error(chalk.dim(` · Creating directory: ${targetDir}`))

37 await fs.ensureDir(targetDir)

38 }

40 const installed = []

41 const skipped = []

tools/sync-agent/sync_agent/syncthing.pyView file

•path = tools/sync-agent/sync_agent/syncthing.py kind = build_helper sizeBytes = 3130 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/sync-agent/sync_agent/syncthing.pyView on unpkg

skills/writing/forge-doc/tests/fixtures/full-test-rb.docxView file

•path = skills/writing/forge-doc/tests/fixtures/full-test-rb.docx kind = compressed_blob sizeBytes = 131425 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/writing/forge-doc/tests/fixtures/full-test-rb.docxView on unpkg

•path = skills/writing/forge-doc/tests/fixtures/full-test-rb.docx kind = nested_archive_needs_inspection sizeBytes = 131425 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

skills/writing/forge-doc/tests/fixtures/full-test-rb.docxView on unpkg

skills/writing/forge-doc/tests/fixtures/full-test-thesis.pdfView file

•path = skills/writing/forge-doc/tests/fixtures/full-test-thesis.pdf kind = high_entropy_blob sizeBytes = 798172 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/writing/forge-doc/tests/fixtures/full-test-thesis.pdfView on unpkg

tools/sync-agent/tests/__init__.pyView file

•path = tools/sync-agent/tests/__init__.py kind = payload_in_excluded_dir sizeBytes = 0

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tools/sync-agent/tests/__init__.pyView on unpkg

Source & flagged code

8 flagged · loading source

bin/cli.jsView file

3import chalk from 'chalk' L4: import { execSync, spawnSync } from 'child_process' L5: import { existsSync, writeFileSync, unlinkSync } from 'fs'

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L3

150try { L151: execSync('npm install -g harveyz-skill@latest', { stdio: 'inherit' }) L152: console.log(chalk.green(' ✔ hskill updated'))

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

bin/cli.jsView on unpkg · L150

lib/installer.jsView file

56// Version-aware upgrade logic (mirrors skill behavior) L57: const home = os.homedir() L58: const dataDir = path.join(home, '.hskill', 'tools') ... L75: // Outdated: prompt in TTY, skip in non-TTY L76: if (!process.stdout.isTTY) { L77: skipped.push({ name: toolName, reason: 'outdated', installed: installedVersion, available: sourceVersion }) ... L185: L186: const zshrcPath = path.join(os.homedir(), '.zshrc') L187: const marker = `# >>> ${toolName}` ... L336: try { L337: data = JSON.parse(await fs.readFile(hooksJsonPath, 'utf-8')) L338: } catch { /* file doesn't exist yet */ }

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

lib/installer.jsView on unpkg · L56

tools/sync-agent/sync_agent/syncthing.pyView file

•path = tools/sync-agent/sync_agent/syncthing.py kind = build_helper sizeBytes = 3130 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/sync-agent/sync_agent/syncthing.pyView on unpkg

skills/writing/forge-doc/tests/fixtures/full-test-rb.docxView file

•path = skills/writing/forge-doc/tests/fixtures/full-test-rb.docx kind = compressed_blob sizeBytes = 131425 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/writing/forge-doc/tests/fixtures/full-test-rb.docxView on unpkg

•path = skills/writing/forge-doc/tests/fixtures/full-test-rb.docx kind = nested_archive_needs_inspection sizeBytes = 131425 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

skills/writing/forge-doc/tests/fixtures/full-test-rb.docxView on unpkg

skills/writing/forge-doc/tests/fixtures/full-test-thesis.pdfView file

•path = skills/writing/forge-doc/tests/fixtures/full-test-thesis.pdf kind = high_entropy_blob sizeBytes = 798172 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/writing/forge-doc/tests/fixtures/full-test-thesis.pdfView on unpkg

tools/sync-agent/tests/__init__.pyView file

•path = tools/sync-agent/tests/__init__.py kind = payload_in_excluded_dir sizeBytes = 0

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tools/sync-agent/tests/__init__.pyView on unpkg

Findings

5 High5 Medium4 Low

HighChild Processbin/cli.js

HighShell

HighRuntime Package Installbin/cli.js

HighShips High Entropy Blobskills/writing/forge-doc/tests/fixtures/full-test-thesis.pdf

HighPayload In Excluded Dirtools/sync-agent/tests/__init__.py

MediumEnvironment Vars

MediumInstall Persistencelib/installer.js

MediumShips Build Helpertools/sync-agent/sync_agent/syncthing.py

MediumShips Compressed Blobskills/writing/forge-doc/tests/fixtures/full-test-rb.docx

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNested Archive Needs Inspectionskills/writing/forge-doc/tests/fixtures/full-test-rb.docx

Source & flagged code

8 flagged

bin/cli.jsView file

Lines 1-23javascript

1#!/usr/bin/env node

2import { select, input } from '@inquirer/prompts'

3import chalk from 'chalk'

4import { execSync, spawnSync } from 'child_process'

5import { existsSync, writeFileSync, unlinkSync } from 'fs'

High

Child Process

Package source references child process execution.

bin/cli.jsView on unpkg · L3

6import { createRequire } from 'module'

7import os from 'os'

8import path from 'path'

9import { fileURLToPath } from 'url'

10import {

11 getAllSkillItems, getAllToolItems, getAllHookItems, checkHookInstalled,

12 checkInstalled, checkToolInstalled, scopeSummary,

13 resolveSkills, resolveSkillsByName, resolveTools, resolveToolsByName,

14 TOOL_BUNDLE_CHOICES,

15} from '../lib/bundles.js'

16import { buildTargetChoices, resolveTargets, TARGETS, USER_ONLY_TARGETS, SKILL_TARGETS, userSkillDir } from '../lib/targets.js'

17import { installSkills, installTools, installHooks, installHooksForTarget, uninstallHook, uninstallTool, uninstallSkill, migrateRenamedSkills } from '../lib/installer.js'

19const __dirname = path.dirname(fileURLToPath(import.meta.url))

20const require = createRequire(import.meta.url)

21const { version } = require('../package.json')

23const args = process.argv.slice(2)

Lines 130-170javascript

130 {

131 name: 'version',

132 description: 'Print version and exit',

133 },

134 ],

135 }, null, 2))

136 process.exit(0)

137 }

138 printHelp()

139

lib/installer.jsView file

Lines 36-76javascript

36 console.error(chalk.dim(` · Creating directory: ${targetDir}`))

37 await fs.ensureDir(targetDir)

38 }

40 const installed = []

41 const skipped = []

tools/sync-agent/sync_agent/syncthing.pyView file

•path = tools/sync-agent/sync_agent/syncthing.py kind = build_helper sizeBytes = 3130 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

tools/sync-agent/sync_agent/syncthing.pyView on unpkg

skills/writing/forge-doc/tests/fixtures/full-test-rb.docxView file

•path = skills/writing/forge-doc/tests/fixtures/full-test-rb.docx kind = compressed_blob sizeBytes = 131425 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/writing/forge-doc/tests/fixtures/full-test-rb.docxView on unpkg

•path = skills/writing/forge-doc/tests/fixtures/full-test-rb.docx kind = nested_archive_needs_inspection sizeBytes = 131425 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

skills/writing/forge-doc/tests/fixtures/full-test-rb.docxView on unpkg

skills/writing/forge-doc/tests/fixtures/full-test-thesis.pdfView file

•path = skills/writing/forge-doc/tests/fixtures/full-test-thesis.pdf kind = high_entropy_blob sizeBytes = 798172 magicHex = [redacted]

High

Ships High Entropy Blob

Package ships high-entropy non-source blobs.

skills/writing/forge-doc/tests/fixtures/full-test-thesis.pdfView on unpkg

tools/sync-agent/tests/__init__.pyView file

•path = tools/sync-agent/tests/__init__.py kind = payload_in_excluded_dir sizeBytes = 0

High

Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

tools/sync-agent/tests/__init__.pyView on unpkg