registry / kld-sdd / 2.7.8-7

kld-sdd@2.7.8-7

⚠ Under review

KLD SDD OpenSpec 项目初始化工具 - 一键部署 SDD skills

Static Scan Results

scanned 17d ago · by rust-scanner

Static analysis completed at 97.0% confidence. No malicious behavior was detected; 18 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 89 file(s), 1.40 MB of source, external domains: 10.29.213.80

Source & flagged code

12 flagged

bin/kld-sdd-init.jsView file

Lines 1-39javascript

1#!/usr/bin/env node

3/**

4 * KLD SDD CLI 入口

5 *

6 * 职责边界：

7 * - bin/（本文件）：命令行参数解析、帮助/版本输出、交互式输入（编辑器选择）、子命令路由

8 * - lib/：纯业务逻辑，只接收解析后的选项对象，不读取 process.argv

9 *

10 * 子命令:

11 * (无参数) 运行项目初始化

12 * log SDD Telemetry CLI（记录阶段事件、查询指标）

13 * link-spec 将代码仓关联到本地 spec clone（git config sdd.specPath）

14 * sync-repos 工作目录下发现新增代码仓并轻量接入（不装 skills）

15 * uninstall 卸载 SDD 产物（渐进式：先预览工具范围，最后确认执行）

16 */

18'use strict';

20const path = require('path');

21const { listToolProfileIds, buildToolConfigs } = require('../lib/tool-profiles');

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kld-sdd-init.jsView on unpkg · L19

22const { MODE, OP, modeLabel } = require('../lib/uninstall');

23const specDetect = require('../skywalk-sdd/ontology/spec-detect.cjs');

24const { specSourceLabel } = specDetect;

25// spec 候选单选交互（唯一实现，与 lib/init.js 共用）

26const { selectSpecRoot: selectSpecChoice } = require('../lib/spec-choice');

28const args = cliArgs();

29const command = args[0];

31/** 统一的失败出口：stderr + 非零退出码 */

32function fail(message) {

33 console.error(`❌ ${message}`);

34 process.exit(1);

35}

37// ═══════════════════════════════════════════════════════════════

38// CLI 输入层：参数解析 / 交互输入 / 帮助输出

39// 只做「字符串 → 选项对象」的转换，不落盘、不执行业务。

skywalk-sdd/ontology/id.cjsView file

Lines 1-21javascript

1'use strict';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

skywalk-sdd/ontology/id.cjsView on unpkg · L1

3const crypto = require('crypto');

4const { ID_PREFIX_TYPES, entityTypeForId } =

lib/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. function deployprofileartifacts(selectedtools = object.keys(tool_configs), cwd = process.cwd(), pkgpath = getpackagepath()) { console.log('🧩 正在部署 agent 专属产物...'); for (const toolkey of selectedtools) { const profile = gettoolprofile(toolkey); const config = tool_configs[toolkey]; if (!config) continue; if (profile.requirescommandbridge) { cleanupmanagedkunlunbridges(profile, cwd); const bridgeresult = deploykunluncommandbridges({ profile, projectroot: cwd, pkgpath, skillmetadata: opsx_skill_metadata, }); console.log(` ✓ ${config.name}: 部署 ${bridgeresult.deployed.length} 个 kunlun command bridge`);

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/init.jsView on unpkg

•matchType = previous_version_dangerous_delta matchedPackage = kld-sdd@2.7.8-1 matchedIdentity = npm:a2xkLXNkZA:2.7.8-1 similarity = 0.608 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/init.jsView on unpkg

skywalk-sdd/lib/git-identity.cjsView file

•matchType = normalized_sha256 matchedPackage = kld-sdd@2.7.8-3 matchedPath = skywalk-sdd/lib/git-identity.cjs matchedIdentity = npm:a2xkLXNkZA:2.7.8-3 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High