registry / igris-ai / 7.1.0

igris-ai@7.1.0

Igris AI unified CLI — init, refresh, install, update, sync, doctor, register-project for Igris projects.

Static Scan Results

scanned 8h ago · by rust-scanner

Static analysis flagged 14 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 227 file(s), 2.83 MB of source, external domains: api.github.com, brain.example.com, github.com

Source & flagged code

6 flagged

package.jsonView file

Lines 3-43json

3 "version": "7.1.0",

4 "description": "Igris AI unified CLI — init, refresh, install, update, sync, doctor, register-project for Igris projects.",

5 "type": "module",

6 "bin": {

7 "igris": "./dist/index.js"

8 },

9 "main": "dist/index.js",

10 "files": [

11 "dist",

12 "!dist/brain-mcp-server/node_modules",

13 "scripts/postinstall.mjs",

14 "README.md",

15 "CHANGELOG.md"

16 ],

17 "scripts": {

18 "build": "tsc && bash scripts/copy-templates.sh",

19 "prepublishOnly": "npm run build",

20 "dev": "tsc --watch",

21 "test": "vitest run",

22 "test:bats": "bats tests/integration",

23 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 },

25 "author": "fifty.dev",

26 "license": "MIT",

27 "homepage": "https://github.com/fiftynotai/igris-ai#readme",

28 "repository": {

29 "type": "git",

30 "url": "https://github.com/fiftynotai/igris-ai.git",

31 "directory": "cli"

32 },

33 "bugs": {

34 "url": "https://github.com/fiftynotai/igris-ai/issues"

35 },

36 "keywords": [

37 "igris",

38 "cli",

39 "ai",

40 "claude",

41 "engineering"

42 ],

43 "dependencies": {

dist/lib/skills-delegate.jsView file

Lines 17-57javascript

17 * field), NEVER a bare runtime `npx` fetch. `assertLocalSkillsBinary` enforces

18 * this — a resolution that ever produces the literal `npx` (or fails to resolve

19 * a real on-disk file) is a hard error, not a network fetch.

20 *

21 * VERIFIED CLI INTERFACE

dist/lib/github-source.jsView file

Lines 501-541javascript

501 strip: 1,

502 });

503 try {

504 await pipeline(stream, passthrough, gunzip, extractStream);

505 }

506 catch (err) {

507 if (zipSlip !== null) {

508

dist/verbs/import.jsView file

Lines 178-218javascript

178 const t = plan.totals;

179 process.stderr.write(`import: ${bundle} → slug '${targetSlug}'\n` +

180 ` rows: ${t.NEW} new, ${t.UNCHANGED} unchanged, ${t.INCOMING} incoming, ` +

dist/lib/self-update.jsView file

Lines 1-23javascript

1/**

2 * `igris update --self` — global self-upgrade primitive.

3 *

4 * Invokes `npm install -g igris-ai@latest` via `child_process.execFile`, with

5 * stdio inherited so the user sees npm's progress live. Returns the npm exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib/self-update.jsView on unpkg · L3

6 * code so the caller in `verbs/update.ts` can propagate it as the CLI exit

7 * code.

8 *

9 * Design notes:

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node scripts/postinstall.mjs

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node scripts/postinstall.mjs

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

dist/lib/skills-delegate.jsView file

37*/ L38: import { spawnSync } from "node:child_process"; L39: import { existsSync } from "node:fs";

High

Child Process

Package source references child process execution.

dist/lib/skills-delegate.jsView on unpkg · L37

dist/lib/github-source.jsView file

521* True if a binary is on PATH. M1: pass `bin` as an argv element to `command` L522: * via `bash -c 'command -v "$1"' _ <bin>` rather than interpolating it into the L523: * shell string — defense-in-depth even though every caller passes a hardcoded

High

Shell

Package source references shell execution.

dist/lib/github-source.jsView on unpkg · L521

dist/verbs/import.jsView file

198*/ L199: export async function runImport(opts) { L200: const bundle = opts.bundle;

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/verbs/import.jsView on unpkg · L198

dist/lib/self-update.jsView file

3* L4: * Invokes `npm install -g igris-ai@latest` via `child_process.execFile`, with L5: * stdio inherited so the user sees npm's progress live. Returns the npm exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib/self-update.jsView on unpkg · L3

Findings

4 High5 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processdist/lib/skills-delegate.js

HighShelldist/lib/github-source.js

HighRuntime Package Installdist/lib/self-update.js

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requiredist/verbs/import.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

6 flagged

package.jsonView file

Lines 3-43json

3 "version": "7.1.0",

4 "description": "Igris AI unified CLI — init, refresh, install, update, sync, doctor, register-project for Igris projects.",

5 "type": "module",

6 "bin": {

7 "igris": "./dist/index.js"

8 },

9 "main": "dist/index.js",

10 "files": [

11 "dist",

12 "!dist/brain-mcp-server/node_modules",

13 "scripts/postinstall.mjs",

14 "README.md",

15 "CHANGELOG.md"

16 ],

17 "scripts": {

18 "build": "tsc && bash scripts/copy-templates.sh",

19 "prepublishOnly": "npm run build",

20 "dev": "tsc --watch",

21 "test": "vitest run",

22 "test:bats": "bats tests/integration",

23 "postinstall": "node scripts/postinstall.mjs"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L23

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L23

24 },

25 "author": "fifty.dev",

26 "license": "MIT",

27 "homepage": "https://github.com/fiftynotai/igris-ai#readme",

28 "repository": {

29 "type": "git",

30 "url": "https://github.com/fiftynotai/igris-ai.git",

31 "directory": "cli"

32 },

33 "bugs": {

34 "url": "https://github.com/fiftynotai/igris-ai/issues"

35 },

36 "keywords": [

37 "igris",

38 "cli",

39 "ai",

40 "claude",

41 "engineering"

42 ],

43 "dependencies": {

dist/lib/skills-delegate.jsView file

Lines 17-57javascript

17 * field), NEVER a bare runtime `npx` fetch. `assertLocalSkillsBinary` enforces

18 * this — a resolution that ever produces the literal `npx` (or fails to resolve

19 * a real on-disk file) is a hard error, not a network fetch.

20 *

21 * VERIFIED CLI INTERFACE

dist/lib/github-source.jsView file

Lines 501-541javascript

501 strip: 1,

502 });

503 try {

504 await pipeline(stream, passthrough, gunzip, extractStream);

505 }

506 catch (err) {

507 if (zipSlip !== null) {

508

dist/verbs/import.jsView file

Lines 178-218javascript

178 const t = plan.totals;

179 process.stderr.write(`import: ${bundle} → slug '${targetSlug}'\n` +

180 ` rows: ${t.NEW} new, ${t.UNCHANGED} unchanged, ${t.INCOMING} incoming, ` +

dist/lib/self-update.jsView file

Lines 1-23javascript

1/**

2 * `igris update --self` — global self-upgrade primitive.

3 *

4 * Invokes `npm install -g igris-ai@latest` via `child_process.execFile`, with

5 * stdio inherited so the user sees npm's progress live. Returns the npm exit

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/lib/self-update.jsView on unpkg · L3

6 * code so the caller in `verbs/update.ts` can propagate it as the CLI exit

7 * code.

8 *

9 * Design notes: