registry / kalamu / 0.3.0

kalamu@0.3.0

Repo-local outliner for turning developer thoughts into agent-ready tasks

Static Scan Results

scanned 3h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 2 file(s), 534 KB of source, external domains: 127.0.0.1, developer.mozilla.org, developers.cloudflare.com, hono.dev, svelte.dev, www.w3.org

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1187-1227javascript

1187 similar = similar.map((candidate) => `--${candidate}`);

1188 }

1189 if (similar.length > 1) {

1190 return `

1191(Did you mean one of ${similar.join(", ")}?)`;

1192 }

1193 if (similar.length === 1) {

1194 return `

1195(Did you mean ${similar[0]}?)`;

1196 }

1197 return "";

1198 }

1199 exports.suggestSimilar = suggestSimilar;

1200 }

1201});

1202

1203// ../../node_modules/.pnpm/commander@14.0.3/node_modules/commander/lib/command.js

1204var require_command = __commonJS({

1205 "../../node_modules/.pnpm/commander@14.0.3/node_modules/commander/lib/command.js"(exports) {

1206 "use strict";

1207 var EventEmitter = __require("events").EventEmitter;

1208 var childProcess = __require("child_process");

1209 var path = __require("path");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1207

1210 var fs = __require("fs");

1211 var process2 = __require("process");

1212 var { Argument: Argument2, humanReadableArgName } = require_argument();

1213 var { CommanderError: CommanderError2 } = require_error();

1214 var { Help: Help2, stripColor } = require_help();

1215 var { Option: Option2, DualOptions } = require_option();

1216 var { suggestSimilar } = require_suggestSimilar();

1217 var Command2 = class _Command extends EventEmitter {

1218 /**

1219 * Initialize a new `Command`.

1220 *

1221 * @param {string} [name]

1222 */

1223 constructor(name) {

1224 super();

1225 this.commands = [];

1226 this.options = [];

1227 this.parent = null;

Lines 2040-2080javascript

2040 if (cmd.getOptionValueSource(key) !== void 0) {

2041 source = cmd.getOptionValueSource(key);

2042 }

2043 });

2044 return source;

2045 }

2046 /**

2047 * Get user arguments from implied or explicit arguments.

2048 * Side-effects: set _scriptPath if args included script. Used for default program name, and subcommand searches.

Lines 11710-11750javascript

11710 console.log(`Kalamu serving ${paths.outline}`);

11711 console.log(` ${url}`);

11712 const shutdown = () => {

11713 close();

11714 server.close();

11715 process.exit(0

Source & flagged code

3 flagged · loading source

dist/index.jsView file

1207var EventEmitter = __require("events").EventEmitter; L1208: var childProcess = __require("child_process"); L1209: var path = __require("path");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1207

2060} L2061: const execArgv = process2.execArgv ?? []; L2062: if (execArgv.includes("-e") || execArgv.includes("--eval") || execArgv.includes("-p") || execArgv.includes("--print")) {

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L2060

11730console.log(`Handing off to skills.sh (npx skills add ${SKILL_REPO}) \u2014 it will ask which agents to install for.`); L11731: const result = spawnSync("npx", ["skills", "add", SKILL_REPO], { stdio: "inherit" }); L11732: if (result.error) {

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/index.jsView on unpkg · L11730

Findings

3 High2 Medium4 Low

HighChild Processdist/index.js

HighShelldist/index.js

HighRuntime Package Installdist/index.js

MediumNetwork

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

dist/index.jsView file

Lines 1187-1227javascript

1187 similar = similar.map((candidate) => `--${candidate}`);

1188 }

1189 if (similar.length > 1) {

1190 return `

1191(Did you mean one of ${similar.join(", ")}?)`;

1192 }

1193 if (similar.length === 1) {

1194 return `

1195(Did you mean ${similar[0]}?)`;

1196 }

1197 return "";

1198 }

1199 exports.suggestSimilar = suggestSimilar;

1200 }

1201});

1202

1203// ../../node_modules/.pnpm/commander@14.0.3/node_modules/commander/lib/command.js

1204var require_command = __commonJS({

1205 "../../node_modules/.pnpm/commander@14.0.3/node_modules/commander/lib/command.js"(exports) {

1206 "use strict";

1207 var EventEmitter = __require("events").EventEmitter;

1208 var childProcess = __require("child_process");

1209 var path = __require("path");

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L1207

1210 var fs = __require("fs");

1211 var process2 = __require("process");

1212 var { Argument: Argument2, humanReadableArgName } = require_argument();

1213 var { CommanderError: CommanderError2 } = require_error();

1214 var { Help: Help2, stripColor } = require_help();

1215 var { Option: Option2, DualOptions } = require_option();

1216 var { suggestSimilar } = require_suggestSimilar();

1217 var Command2 = class _Command extends EventEmitter {

1218 /**

1219 * Initialize a new `Command`.

1220 *

1221 * @param {string} [name]

1222 */

1223 constructor(name) {

1224 super();

1225 this.commands = [];

1226 this.options = [];

1227 this.parent = null;

Lines 2040-2080javascript

2040 if (cmd.getOptionValueSource(key) !== void 0) {

2041 source = cmd.getOptionValueSource(key);

2042 }

2043 });

2044 return source;

2045 }

2046 /**

2047 * Get user arguments from implied or explicit arguments.

2048 * Side-effects: set _scriptPath if args included script. Used for default program name, and subcommand searches.

Lines 11710-11750javascript

11710 console.log(`Kalamu serving ${paths.outline}`);

11711 console.log(` ${url}`);

11712 const shutdown = () => {

11713 close();

11714 server.close();

11715 process.exit(0