registry / mdflow / 3.0.0

mdflow@3.0.0

```bash review.md # v3: runs on your default engine (pi) review.claude.md # Pin an engine in the filename git diff | explain.md # Pipe through any command ```

Static Scan Results

scanned 4d ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 9 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 141 file(s), 1.22 MB of source, external domains: 10.0.0.1, 10.255.255.1, 127.0.0.1, 192.168.1.1, a.b.c.example.com, a.com, api.example.com, api.github.com, api.trusted.com, b.com, definitely-not-trusted-domain-12345.example.com, docs.com, docs.example.com, evil.example.com, example.com, gist.github.com, gist.githubusercontent.com, github.com, gitlab.com, jsonplaceholder.typicode.com, nonexistent.example.com, nonexistent.invalid, raw.githubusercontent.com, registry.npmjs.org, tofu-test-unique-domain-98765.example.com, track.me, unmocked.com, url.com, www.example.com, x.com

Source & flagged code

1 flagged

src/output.tsView file

Lines 103-143typescript

103 throw new Error("Unable to extract unified diff from command output.");

104 }

105 return patch;

106 }

107

108 return stdout;

109}

110

111/**

112 * Resolve schema ref (`./schema.ts#MySchema`) and validate a value with Zod.

113 * Returns structured success/failure without throwing validation errors.

114 */

115export async function validateOutput(

116 schemaRef: string,

117 value: unknown,

118 options: ValidateOptions = {}

119): Promise<ValidateOutputResult> {

120 try {

121 const { modulePath, exportName } = parseSchemaRef(schemaRef);

122 const resolvedModulePath = resolveSchemaPath(modulePath, options.baseDir);

123 const moduleUrl = pathToFileURL(resolvedModulePath).href;

124 const loadedModule = await import(moduleUrl);

125 const schema = loadedModule[exportName];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/output.tsView on unpkg · L123

126

127 if (!isZodLikeSchema(schema)) {

128 return {

129 success: false,

130 error: `Schema export "${exportName}" from "${modulePath}" is not a Zod schema (missing parse).`,

131 };

132 }

133

134 const data = schema.parse(value);

135 return { success: true, data };

136 } catch (error) {

137 return {

138 success: false,

139 error: `Schema validation failed for "${schemaRef}". ${formatErrorMessage(error)}`,

140 };

141 }

142}

143

Source & flagged code

1 flagged · loading source

src/output.tsView file

123const moduleUrl = pathToFileURL(resolvedModulePath).href; L124: const loadedModule = await import(moduleUrl); L125: const schema = loadedModule[exportName];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/output.tsView on unpkg · L123

Findings

4 Medium5 Low

MediumDynamic Requiresrc/output.ts

MediumNetwork

MediumEnvironment Vars

MediumWildcard Dependency

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

1 flagged

src/output.tsView file

Lines 103-143typescript

103 throw new Error("Unable to extract unified diff from command output.");

104 }

105 return patch;

106 }

107

108 return stdout;

109}

110

111/**

112 * Resolve schema ref (`./schema.ts#MySchema`) and validate a value with Zod.

113 * Returns structured success/failure without throwing validation errors.

114 */

115export async function validateOutput(

116 schemaRef: string,

117 value: unknown,

118 options: ValidateOptions = {}

119): Promise<ValidateOutputResult> {

120 try {

121 const { modulePath, exportName } = parseSchemaRef(schemaRef);

122 const resolvedModulePath = resolveSchemaPath(modulePath, options.baseDir);

123 const moduleUrl = pathToFileURL(resolvedModulePath).href;

124 const loadedModule = await import(moduleUrl);

125 const schema = loadedModule[exportName];

Medium

Dynamic Require

Package source references dynamic require/import behavior.

src/output.tsView on unpkg · L123

126

127 if (!isZodLikeSchema(schema)) {

128 return {

129 success: false,

130 error: `Schema export "${exportName}" from "${modulePath}" is not a Zod schema (missing parse).`,

131 };

132 }

133

134 const data = schema.parse(value);

135 return { success: true, data };

136 } catch (error) {

137 return {

138 success: false,

139 error: `Schema validation failed for "${schemaRef}". ${formatErrorMessage(error)}`,

140 };

141 }

142}

143