registry / shakers-cli / 0.20.2
shakers-cli@0.20.2
⚠ Under reviewShakers AI usage & skills evaluator: a local-first CLI (`shakers` binary) plus a local MCP server. Commands: ai-usage (scan + classify your AI-tool setup, T0-T7), certify (certify Skills from your code), share (branded LinkedIn card).
Static Scan Results
scanned 7d ago · by rust-scannerStatic analysis completed at 65.0% confidence. No malicious behavior was detected; 10 low-signal pattern(s) were surfaced and cleared.
Static reason
No blocking static signals were detected.
Decision evidence
public snapshotBehavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetwork
HighEntropyStringsPossibleObfuscationUrlStrings
NoLicense
Source & flagged code
3 flaggedbin/alma.jsView file
3L4: const { detectReportLang, getCatalog } = require('../src/i18n');
L5: const { loadAuthSession, sessionStatus } = require('../src/auth-session-store');
Medium
Dynamic Require
Package source references dynamic require/import behavior.
bin/alma.jsView on unpkg · L3src/report-store.jsView file
14function configDir() {
L15: return getConfigDir(process.env);
L16: }
...
L59: try {
L60: parsed = JSON.parse(fs.readFileSync(statePath(env), 'utf8'));
L61: } catch {
...
L70:
L71: function writePrivateFile(p, text) {
L72: fs.mkdirSync(path.dirname(p), { recursive: true, mode: 0o700 });
...
L140: function persistFootprint({ root, report, maturity }) {
L141: const absRoot = path.resolve(root || process.cwd());
L142: const state = loadState();
Low
Weak Crypto
Package source references weak cryptographic algorithms.
src/report-store.jsView on unpkg · L14bin/shakers-cli.js#virtual:normalized:round1View file
Findings
1 High3 Medium6 Low
HighSemantic Analysis Limitedbin/shakers-cli.js#virtual:normalized:round1
MediumDynamic Requirebin/alma.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowWeak Cryptosrc/report-store.js
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License
Affected versions and remediation
This report applies to shakers-cli@0.20.2.
See all versions of shakers-cli for other recorded verdicts.
- Review the evidence and your use of shakers-cli@0.20.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.