registry / kitstarter-cli / 0.5.0

kitstarter-cli@0.5.0

Make your AI coding agent ask before it builds, stay lean, and stop looking AI-made. For Claude Code, Codex, and Antigravity.

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis flagged 10 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 22 file(s), 163 KB of source, external domains: kitstarter.dev

Source & flagged code

2 flagged

bin/doctor.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// kitstarter doctor: is the engine actually alive HERE? One green/red line per check,

3// the exact fix for every red. Zero dependencies - runs from the engine copy.

4//

5// node .claude/kitstarter/bin/doctor.mjs check this project

6// node .claude/kitstarter/bin/doctor.mjs --fix rewire node paths + place the rule, then re-check

7// node .claude/kitstarter/bin/doctor.mjs --cascade same checks, staggered ~150ms/line (TTY only)

8//

9// Exit 0 = all green (bench asserts on this). --cascade is a pure presentation affordance: on a

10// non-TTY stdout (or without the flag) it does nothing - output and exit code are byte-identical

11// to plain doctor. It never changes a check, a fix hint, or the exit code.

12import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync, readdirSync } from "node:fs";

13import { join, dirname } from "node:path";

14import { fileURLToPath } from "node:url";

15import { spawnSync } from "node:child_process";

16import { userDir, readJson, loadConfig } from "../hooks/lib/state.mjs";

High

Child Process

Package source references child process execution.

bin/doctor.mjsView on unpkg · L14

17import { hasRule, upsertRule, markerState, migrateUnfenced, looksLikeOldRule } from "../hooks/lib/rule.mjs";

18import { HOOK_EVENTS, wireHooks, isOurStatusLine, statusLineScriptPath, wireStatusLine } from "../hooks/lib/wiring.mjs";

20const ENGINE = join(dirname(fileURLToPath(import.meta.url)), "..");

21const CLAUDE = join(ENGINE, "..");

22const CWD = process.cwd();

23const FIX = process.argv.includes("--fix");

24const CASCADE = process.argv.includes("--cascade") && Boolean(process.stdout.isTTY);

26const GREEN = "\x1b[32m", RED = "\x1b[31m", DIM = "\x1b[2m", RESET = "\x1b[0m";

27const results = []; // { ok, fixable } - fixable = would `kitstarter doctor --fix` actually help?

28// Every report/status line goes through `sink` instead of console.log directly, so cascade mode

29// can capture the lines and replay them staggered without touching the check logic itself.

30let sink = console.log;

31function report(name, ok, fixHint, fixable = false) {

32 results.push({ ok, fixable });

33 sink(` ${ok ? GREEN + "OK " : RED + "RED"}${RESET} ${name}${ok ? "" : DIM + " fix: " + fixHint + RESET}`);

34}

cli.mjsView file

Lines 242-282javascript

242 if (rest.trim()) {

243 writeFileSync(agentsPath, rest);

244 say(pc.green("✓") + " kitstarter section removed from AGENTS.md (the rest of the file is untouched)");

245 } else {

246 rmSync(agentsPath, { force: true });

247 say

Source & flagged code

2 flagged · loading source

bin/doctor.mjsView file

14import { fileURLToPath } from "node:url"; L15: import { spawnSync } from "node:child_process"; L16: import { userDir, readJson, loadConfig } from "../hooks/lib/state.mjs";

High

Child Process

Package source references child process execution.

bin/doctor.mjsView on unpkg · L14

cli.mjsView file

262const { fileURLToPath } = await import("node:url"); L263: const { spawnSync } = await import("node:child_process"); L264: const KIT = dirname(fileURLToPath(import.meta.url)); ... L271: if (!script || script === candidates[2]) { L272: say(pc.yellow("no kitstarter engine installed here - run: npx kitstarter-cli")); L273: process.exit(1);

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

cli.mjsView on unpkg · L262

Findings

3 High3 Medium4 Low

HighChild Processbin/doctor.mjs

HighShell

HighRuntime Package Installcli.mjs

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

bin/doctor.mjsView file

Lines 1-34javascript

1#!/usr/bin/env node

2// kitstarter doctor: is the engine actually alive HERE? One green/red line per check,

3// the exact fix for every red. Zero dependencies - runs from the engine copy.

4//

5// node .claude/kitstarter/bin/doctor.mjs check this project

6// node .claude/kitstarter/bin/doctor.mjs --fix rewire node paths + place the rule, then re-check

7// node .claude/kitstarter/bin/doctor.mjs --cascade same checks, staggered ~150ms/line (TTY only)

8//

9// Exit 0 = all green (bench asserts on this). --cascade is a pure presentation affordance: on a

10// non-TTY stdout (or without the flag) it does nothing - output and exit code are byte-identical

11// to plain doctor. It never changes a check, a fix hint, or the exit code.

12import { readFileSync, writeFileSync, existsSync, mkdirSync, rmSync, readdirSync } from "node:fs";

13import { join, dirname } from "node:path";

14import { fileURLToPath } from "node:url";

15import { spawnSync } from "node:child_process";

16import { userDir, readJson, loadConfig } from "../hooks/lib/state.mjs";

High

Child Process

Package source references child process execution.

bin/doctor.mjsView on unpkg · L14

17import { hasRule, upsertRule, markerState, migrateUnfenced, looksLikeOldRule } from "../hooks/lib/rule.mjs";

18import { HOOK_EVENTS, wireHooks, isOurStatusLine, statusLineScriptPath, wireStatusLine } from "../hooks/lib/wiring.mjs";

20const ENGINE = join(dirname(fileURLToPath(import.meta.url)), "..");

21const CLAUDE = join(ENGINE, "..");

22const CWD = process.cwd();

23const FIX = process.argv.includes("--fix");

24const CASCADE = process.argv.includes("--cascade") && Boolean(process.stdout.isTTY);

26const GREEN = "\x1b[32m", RED = "\x1b[31m", DIM = "\x1b[2m", RESET = "\x1b[0m";

27const results = []; // { ok, fixable } - fixable = would `kitstarter doctor --fix` actually help?

28// Every report/status line goes through `sink` instead of console.log directly, so cascade mode

29// can capture the lines and replay them staggered without touching the check logic itself.

30let sink = console.log;

31function report(name, ok, fixHint, fixable = false) {

32 results.push({ ok, fixable });

33 sink(` ${ok ? GREEN + "OK " : RED + "RED"}${RESET} ${name}${ok ? "" : DIM + " fix: " + fixHint + RESET}`);

34}

cli.mjsView file

Lines 242-282javascript

242 if (rest.trim()) {

243 writeFileSync(agentsPath, rest);

244 say(pc.green("✓") + " kitstarter section removed from AGENTS.md (the rest of the file is untouched)");

245 } else {

246 rmSync(agentsPath, { force: true });

247 say