registry  /  resuggestor  /  1.0.0

resuggestor@1.0.0

Cursor skill for frontend performance optimization — install with npm and use /resuggestor in chat

Static Scan Results

scanned 2d ago · by rust-scanner

Static analysis flagged 13 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemShell
Supply chain
UrlStrings
ManifestNo manifest risk signals triggered.
scanned 7 file(s), 17.5 KB of source, external domains: gitlab.com, registry.npmjs.org

Source & flagged code

6 flagged · loading source
package.jsonView file
•scripts.postinstall = node install.js
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node install.js
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
lib/mcp.mjsView file
2import path from 'node:path'; L3: import { execSync } from 'node:child_process'; L4: import { globalMcpPath } from './paths.mjs';
High
Child Process

Package source references child process execution.

lib/mcp.mjsView on unpkg · L2
2import path from 'node:path'; L3: import { execSync } from 'node:child_process'; L4: import { globalMcpPath } from './paths.mjs'; ... L6: const SERVER_KEY = 'chrome-devtools'; L7: const NPM_INSTALL_CMD = 'npm install -g chrome-devtools-mcp --registry=https://registry.npmjs.org/'; L8:
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

lib/mcp.mjsView on unpkg · L2
templates/.cursor/hooks/resuggestor-post-canvas-write.shView file
•path = templates/.cursor/hooks/resuggestor-post-canvas-write.sh kind = payload_in_excluded_dir sizeBytes = 862 magicHex = [redacted]
High
Payload In Excluded Dir

Package hides binary, compressed, or executable-looking payloads in test/fixture/hidden paths.

templates/.cursor/hooks/resuggestor-post-canvas-write.shView on unpkg
•path = templates/.cursor/hooks/resuggestor-post-canvas-write.sh kind = build_helper sizeBytes = 862 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/.cursor/hooks/resuggestor-post-canvas-write.shView on unpkg

Findings

5 High4 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighChild Processlib/mcp.mjs
HighShell
HighRuntime Package Installlib/mcp.mjs
HighPayload In Excluded Dirtemplates/.cursor/hooks/resuggestor-post-canvas-write.sh
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumEnvironment Vars
MediumShips Build Helpertemplates/.cursor/hooks/resuggestor-post-canvas-write.sh
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowUrl Strings