registry / rolebox / 0.18.0

rolebox@0.18.0

OpenCode plugin — define custom AI agent roles via YAML with per-role prompts, models, skills, and permissions

Static Scan Results

scanned 7d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 11 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

WildcardDependency

scanned 147 file(s), 830 KB of source, external domains: api.github.com, github.com, raw.githubusercontent.com, registry.npmjs.org

Source & flagged code

2 flagged

dist/function/handlers-loader.jsView file

Lines 1-39javascript

1var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {

2 if (typeof path === "string" && /^\.\.?\//.test(path)) {

3 return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {

4 return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");

5 });

6 }

7 return path;

8};

9import { join, dirname, isAbsolute } from "node:path";

10import { createSubLogger } from "../logger.js";

11const log = createSubLogger("function:handlers");

12const cache = new Map();

13export async function loadHandlers(fnFilePath, handlersField) {

14 if (!handlersField)

15 return null;

16 const abs = isAbsolute(handlersField) ? handlersField : join(dirname(fnFilePath), handlersField);

17 if (cache.has(abs))

18 return cache.get(abs);

19 try {

20 const mod = (await import(__rewriteRelativeImportExtension(abs)));

21 cache.set(abs, mod);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/function/handlers-loader.jsView on unpkg · L19

22 return mod;

23 }

24 catch (err) {

25 log.warn("Failed to load Tier-2 handlers", { abs, err });

26 cache.set(abs, null);

27 return null;

28 }

29}

30export async function safeCall(fn) {

31 if (!fn)

32 return undefined;

33 try {

34 return await fn();

35 }

36 catch (err) {

37 log.warn("Tier-2 handler threw", err);

38 return undefined;

39 }

dist/lsp/client-manager.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = rolebox@0.17.0 matchedIdentity = npm:cm9sZWJveA:0.17.0 similarity = 0.983 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lsp/client-manager.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/function/handlers-loader.jsView file

19try { L20: const mod = (await import(__rewriteRelativeImportExtension(abs))); L21: cache.set(abs, mod);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/function/handlers-loader.jsView on unpkg · L19

dist/lsp/client-manager.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lsp/client-manager.jsView on unpkg

Findings

1 High5 Medium5 Low

HighPrevious Version Dangerous Deltadist/lsp/client-manager.js

MediumDynamic Requiredist/function/handlers-loader.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/function/handlers-loader.jsView file

Lines 1-39javascript

1var __rewriteRelativeImportExtension = (this && this.__rewriteRelativeImportExtension) || function (path, preserveJsx) {

2 if (typeof path === "string" && /^\.\.?\//.test(path)) {

3 return path.replace(/\.(tsx)$|((?:\.d)?)((?:\.[^./]+?)?)\.([cm]?)ts$/i, function (m, tsx, d, ext, cm) {

4 return tsx ? preserveJsx ? ".jsx" : ".js" : d && (!ext || !cm) ? m : (d + ext + "." + cm.toLowerCase() + "js");

5 });

6 }

7 return path;

8};

9import { join, dirname, isAbsolute } from "node:path";

10import { createSubLogger } from "../logger.js";

11const log = createSubLogger("function:handlers");

12const cache = new Map();

13export async function loadHandlers(fnFilePath, handlersField) {

14 if (!handlersField)

15 return null;

16 const abs = isAbsolute(handlersField) ? handlersField : join(dirname(fnFilePath), handlersField);

17 if (cache.has(abs))

18 return cache.get(abs);

19 try {

20 const mod = (await import(__rewriteRelativeImportExtension(abs)));

21 cache.set(abs, mod);

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/function/handlers-loader.jsView on unpkg · L19

22 return mod;

23 }

24 catch (err) {

25 log.warn("Failed to load Tier-2 handlers", { abs, err });

26 cache.set(abs, null);

27 return null;

28 }

29}

30export async function safeCall(fn) {

31 if (!fn)

32 return undefined;

33 try {

34 return await fn();

35 }

36 catch (err) {

37 log.warn("Tier-2 handler threw", err);

38 return undefined;

39 }

dist/lsp/client-manager.jsView file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/lsp/client-manager.jsView on unpkg