registry / pi-aftc-toolset / 1.5.1

pi-aftc-toolset@1.5.1

AFTC productivity toolset for pi — footer diagnostics, SQLite model usage reports, cache analysis, input shortcuts, cache-audit skill, theme, and SSH tools backed by a PyQt6 GUI.

Static Scan Results

scanned 4h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 12 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 26 file(s), 372 KB of source, external domains: 127.0.0.85, github.com

Source & flagged code

6 flagged

tests/bulk-read-check/bulk-read-check.mjsView file

Lines 16-56javascript

16import { execFileSync } from "node:child_process";

18const __dirname = dirname(fileURLToPath(import.meta.url));

19const ROOT = resolve(__dirname, "..", "..");

21// ---- Resolve the bundled script source from the SKILL.md ----

22const skillPath = join(ROOT, "skills", "bulk-read", "SKILL.md");

23if (!existsSync(skillPath)) throw new Error("missing skill: " + skillPath);

24const md = readFileSync(skillPath, "utf8");

26const scriptStart = md.lastIndexOf("```javascript\n");

27const scriptEnd = md.lastIndexOf("```");

28if (scriptStart < 0 || scriptEnd <= scriptStart) {

29 throw new Error("could not locate javascript fence in SKILL.md");

30}

31const script = md.slice(scriptStart + "```javascript\n".length, scriptEnd);

33// ---- 1. Syntax check ----

34// Strip shebang for syntax check (shebang is harmless when running via `node`).

35const stripped = script.replace(/^#!.*\n/, "");

36try {

37 new Function(stripped);

38 console.log("OK script syntax valid");

Low

Eval

Package source references a known benign dynamic code generation pattern.

tests/bulk-read-check/bulk-read-check.mjsView on unpkg · L36

39} catch (e) {

40 throw new Error("script syntax error: " + e.message);

41}

43// ---- 2. Write script to a temp location and run it ----

44const tmpDir = join(ROOT, ".pi-aftc-toolset", "data");

45mkdirSync(tmpDir, { recursive: true });

46const scriptPath = join(tmpDir, "_bulk-read-test.js");

47const outFile = join(tmpDir, "_bulk-read-test-output.md");

48writeFileSync(scriptPath, script, "utf8");

50try {

51 // Run on a known subdirectory (extensions/toolset) to keep the test fast.

52 const subdir = "extensions/toolset";

53 const maxKb = "2048";

54 const stdout = execFileSync(process.execPath, [scriptPath, subdir, outFile, maxKb], {

55 cwd: ROOT,

56 encoding: "utf8",

tests/theme-check/theme-check.cjsView file

Lines 1-35javascript

1// Theme-picker shortcut harness. Verifies that `createTheme(pi)` registers

2// a /theme command that:

3// 1. Calls ctx.ui.getAllThemes() to discover themes

4// 2. Uses ctx.ui.custom (NOT ctx.ui.select) to present the picker

5// 3. Pre-selects the currently active theme on open

6// 4. Forwards up/down/enter/escape to the inner SelectList

7// 5. Intercepts PageUp / PageDown to jump by maxVisible

8// 6. Intercepts Ctrl+PageUp / Ctrl+PageDown to jump to first/last

9// 7. Calls ctx.ui.setTheme(name) on Enter

10// 8. Notifies on success

11// 9. Handles no-UI, empty-themes, cancel, and setTheme-failure paths

internal-python-gui/bin/uv.exeView file

•path = internal-python-gui/bin/uv.exe kind = native_binary sizeBytes = 65102336 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

internal-python-gui/bin/uv.exeView on unpkg

internal-python-gui/main.pyView file

•path = internal-python-gui/main.py kind = build_helper sizeBytes = 28810 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

internal-python-gui/main.pyView on unpkg

skills/verify-work.rarView file

•path = skills/verify-work.rar kind = compressed_blob sizeBytes = 2408 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/verify-work.rarView on unpkg

•path = skills/verify-work.rar kind = nested_archive_needs_inspection sizeBytes = 2408 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

skills/verify-work.rarView on unpkg

Source & flagged code

6 flagged · loading source

tests/bulk-read-check/bulk-read-check.mjsView file

36try { L37: new Function(stripped); L38: console.log("OK script syntax valid");

Low

Eval

Package source references a known benign dynamic code generation pattern.

tests/bulk-read-check/bulk-read-check.mjsView on unpkg · L36

tests/theme-check/theme-check.cjsView file

15L16: const { execSync } = require("node:child_process"); L17: const path = require("node:path");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

tests/theme-check/theme-check.cjsView on unpkg · L15

internal-python-gui/bin/uv.exeView file

•path = internal-python-gui/bin/uv.exe kind = native_binary sizeBytes = 65102336 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

internal-python-gui/bin/uv.exeView on unpkg

internal-python-gui/main.pyView file

•path = internal-python-gui/main.py kind = build_helper sizeBytes = 28810 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

internal-python-gui/main.pyView on unpkg

skills/verify-work.rarView file

•path = skills/verify-work.rar kind = compressed_blob sizeBytes = 2408 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/verify-work.rarView on unpkg

•path = skills/verify-work.rar kind = nested_archive_needs_inspection sizeBytes = 2408 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

skills/verify-work.rarView on unpkg

Findings

7 Medium5 Low

MediumDynamic Requiretests/theme-check/theme-check.cjs

MediumNetwork

MediumEnvironment Vars

MediumShips Native Binaryinternal-python-gui/bin/uv.exe

MediumShips Build Helperinternal-python-gui/main.py

MediumShips Compressed Blobskills/verify-work.rar

MediumStructural Risk Force Deep Review

LowEvaltests/bulk-read-check/bulk-read-check.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNested Archive Needs Inspectionskills/verify-work.rar

Source & flagged code

6 flagged

tests/bulk-read-check/bulk-read-check.mjsView file

Lines 16-56javascript

16import { execFileSync } from "node:child_process";

18const __dirname = dirname(fileURLToPath(import.meta.url));

19const ROOT = resolve(__dirname, "..", "..");

21// ---- Resolve the bundled script source from the SKILL.md ----

22const skillPath = join(ROOT, "skills", "bulk-read", "SKILL.md");

23if (!existsSync(skillPath)) throw new Error("missing skill: " + skillPath);

24const md = readFileSync(skillPath, "utf8");

26const scriptStart = md.lastIndexOf("```javascript\n");

27const scriptEnd = md.lastIndexOf("```");

28if (scriptStart < 0 || scriptEnd <= scriptStart) {

29 throw new Error("could not locate javascript fence in SKILL.md");

30}

31const script = md.slice(scriptStart + "```javascript\n".length, scriptEnd);

33// ---- 1. Syntax check ----

34// Strip shebang for syntax check (shebang is harmless when running via `node`).

35const stripped = script.replace(/^#!.*\n/, "");

36try {

37 new Function(stripped);

38 console.log("OK script syntax valid");

Low

Eval

Package source references a known benign dynamic code generation pattern.

tests/bulk-read-check/bulk-read-check.mjsView on unpkg · L36

39} catch (e) {

40 throw new Error("script syntax error: " + e.message);

41}

43// ---- 2. Write script to a temp location and run it ----

44const tmpDir = join(ROOT, ".pi-aftc-toolset", "data");

45mkdirSync(tmpDir, { recursive: true });

46const scriptPath = join(tmpDir, "_bulk-read-test.js");

47const outFile = join(tmpDir, "_bulk-read-test-output.md");

48writeFileSync(scriptPath, script, "utf8");

50try {

51 // Run on a known subdirectory (extensions/toolset) to keep the test fast.

52 const subdir = "extensions/toolset";

53 const maxKb = "2048";

54 const stdout = execFileSync(process.execPath, [scriptPath, subdir, outFile, maxKb], {

55 cwd: ROOT,

56 encoding: "utf8",

tests/theme-check/theme-check.cjsView file

Lines 1-35javascript

1// Theme-picker shortcut harness. Verifies that `createTheme(pi)` registers

2// a /theme command that:

3// 1. Calls ctx.ui.getAllThemes() to discover themes

4// 2. Uses ctx.ui.custom (NOT ctx.ui.select) to present the picker

5// 3. Pre-selects the currently active theme on open

6// 4. Forwards up/down/enter/escape to the inner SelectList

7// 5. Intercepts PageUp / PageDown to jump by maxVisible

8// 6. Intercepts Ctrl+PageUp / Ctrl+PageDown to jump to first/last

9// 7. Calls ctx.ui.setTheme(name) on Enter

10// 8. Notifies on success

11// 9. Handles no-UI, empty-themes, cancel, and setTheme-failure paths

internal-python-gui/bin/uv.exeView file

•path = internal-python-gui/bin/uv.exe kind = native_binary sizeBytes = 65102336 magicHex = [redacted]

Medium

Ships Native Binary

Package ships native binary artifacts.

internal-python-gui/bin/uv.exeView on unpkg

internal-python-gui/main.pyView file

•path = internal-python-gui/main.py kind = build_helper sizeBytes = 28810 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

internal-python-gui/main.pyView on unpkg

skills/verify-work.rarView file

•path = skills/verify-work.rar kind = compressed_blob sizeBytes = 2408 magicHex = [redacted]

Medium

Ships Compressed Blob

Package ships compressed or archive-like blobs.

skills/verify-work.rarView on unpkg

•path = skills/verify-work.rar kind = nested_archive_needs_inspection sizeBytes = 2408 magicHex = [redacted]

Low

Nested Archive Needs Inspection

Package ships a nested archive or MCP bundle that was inventoried but not recursively analyzed.

skills/verify-work.rarView on unpkg