registry / kld-sdd / 2.6.21

kld-sdd@2.6.21

KLD SDD OpenSpec 项目初始化工具 - 一键部署 SDD skills

Static Scan Results

scanned 2mo ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 78 file(s), 1.19 MB of source, external domains: 10.29.213.80

Source & flagged code

4 flagged

bin/kld-sdd-init.jsView file

Lines 1-34javascript

1#!/usr/bin/env node

3/**

4 * KLD SDD 项目初始化工具

5 * 一键配置团队标准化开发环境，内置 openSpec 模版

6 *

7 * 子命令:

8 * (无参数) 运行项目初始化

9 * log SDD Telemetry CLI（记录阶段事件、查询指标）

10 * link-spec 将代码仓关联到本地 spec clone（git config sdd.specPath）

11 * sync-repos 工作目录下发现新增代码仓并轻量接入（不装 skills）

12 * auth 用户账号绑定：login / logout / status

13 */

15const path = require('path');

16const args = process.argv.slice(2);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kld-sdd-init.jsView on unpkg · L14

18if (args[0] === 'log') {

19 // Telemetry CLI 模式

20 require('../skywalk-sdd/index.js').main();

21} else if (args[0] === 'link-spec') {

22 const sddConfig = require('../skywalk-sdd/ontology/sdd-config.cjs');

23 const pathArg = args.find((item) => item.startsWith('--path='));

24 const projectArg = args.find((item) => item.startsWith('--project='));

25 const positional = args.slice(1).find((item) => !item.startsWith('--'));

26 const specPath = pathArg ? pathArg.slice('--path='.length) : positional;

27 const projectRoot = path.resolve(projectArg ? projectArg.slice('--project='.length) : '.');

28 if (!specPath) {

29 console.error('用法: kld-sdd link-spec --path=<spec-clone> [--project=.]');

30 process.exit(1);

31 }

32 const result = sddConfig.setSpecPath(projectRoot, specPath);

33 if (!result.ok) {

34 console.error(`❌ ${result.message}`);

skywalk-sdd/ontology/id.cjsView file

Lines 1-21javascript

1'use strict';

Low

Weak Crypto

Package source references weak cryptographic algorithms.

skywalk-sdd/ontology/id.cjsView on unpkg · L1

3const crypto = require('crypto');

4const { ID_PREFIX_TYPES, entityTypeForId } =

lib/init.jsView file

•Manifest-trigger-reachable source links an external AI-agent control path to a behavior-bearing write operation. outer = path.join(anchor, 'skywalk-sdd'); let st = null; try { st = fs.lstatsync(outer); } catch (err) { if (err && err.code === 'enoent') return { ok: true, removed: false }; throw err; } const hint = path.join(anchor, '.sdd-spec-root'); const hashint = fs.existssync(hint); let hasnestedentity = false; try { for (const name of fs.readdirsync(anchor)) { if (!/-sdd-specs$/i.test(name)) continue; const entity = path.join(anchor, name, 'skywalk-sdd', 'log.cjs'); if (fs.existssync(entity)) { hasnestedentity = true; break; } } } catch { // ignore } if (!hashint && !hasnestedentity) { // 无包裹包迹象

High

Trigger Reachable External Ai Agent Control Surface Mutation

Manifest-trigger-reachable source writes behavior-bearing configuration into a user or project AI-agent control surface.

lib/init.jsView on unpkg

lib/device-auth.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = kld-sdd@2.6.7 matchedIdentity = npm:a2xkLXNkZA:2.6.7 similarity = 0.455 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

lib/device-auth.jsView on unpkg

Source & flagged code

4 flagged · loading source

bin/kld-sdd-init.jsView file

14L15: const path = require('path'); L16: const args = process.argv.slice(2);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

bin/kld-sdd-init.jsView on unpkg · L14

skywalk-sdd/ontology/id.cjsView file

1'use strict'; L2:

Low

Weak Crypto

Package source references weak cryptographic algorithms.

skywalk-sdd/ontology/id.cjsView on unpkg · L1

lib/init.jsView file

Findings

2 High3 Medium5 Low

HighTrigger Reachable External Ai Agent Control Surface Mutationlib/init.js

HighPrevious Version Dangerous Deltalib/device-auth.js

MediumDynamic Requirebin/kld-sdd-init.js

MediumNetwork

MediumEnvironment Vars

LowScripts Present

LowWeak Cryptoskywalk-sdd/ontology/id.cjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Affected versions and remediation

This report applies to kld-sdd@2.6.21.

See version security history for other recorded verdicts.

Review the evidence and your use of kld-sdd@2.6.21 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-08-19 02:58:50.694Z (UTC).