registry / skilltrace / 0.1.2

skilltrace@0.1.2

Local observability for AI agent skill usage

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 11 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 58 file(s), 779 KB of source, external domains: 127.0.0.1, api.github.com, fonts.googleapis.com, fonts.gstatic.com, github.com, openidconnect.googleapis.com, react.dev, reactrouter.com, www.w3.org

Source & flagged code

3 flagged

bin/skilltrace.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import path from 'path'

3import { spawnSync } from 'child_process'

4import { fileURLToPath } from 'url'

High

Child Process

Package source references child process execution.

bin/skilltrace.jsView on unpkg · L2

6let binDir = path.dirname(fileURLToPath(import.meta.url))

7let packageRoot = path.resolve(binDir, '..')

8let cliPath = path.join(packageRoot, 'dist', 'traceskill.js')

10let result = spawnSync(process.execPath, [

11 cliPath,

12 ...process.argv.slice(2),

13], {

14 stdio: 'inherit',

15 env: {

16 ...process.env,

17 SKILLTRACE_TARGET_ROOT: process.env.SKILLTRACE_TARGET_ROOT || process.cwd(),

18 },

19})

21process.exit(result.status ?? 1)

build/client/assets/chunk-KS7C4IRE-DCMaQ_CC.jsView file

Lines 1-24javascript

1var e=Object.create,t=Object.defineProperty,n=Object.getOwnPropertyDescriptor,r=Object.getOwnPropertyNames,i=Object.getPrototypeOf,a=Object.prototype.hasOwnProperty,o=(e,t)=>()=>(t||(e((t={exports:{}}).exports,t),e=null),t.exports),s=

build/server/index.jsView file

Lines 2-42javascript

2import { createReadableStreamFromReadable } from "@react-router/node";

3import { Form, Link, Links, NavLink, Outlet, Scripts, ScrollRestoration, ServerRouter, UNSAFE_withComponentProps, UNSAFE_withErrorBoundaryProps, createContext, createCookieSessionStorage, data, href, isRouteErrorResponse, redirect, useActionData, useFetchers, useLocation, useNavigate, useNavigation, useRevalidator, useRouteError, useRouteLoaderData, useSearchParams } from "react-router";

4import { isbot } from "isbot";

5import { renderToPipeableStream } from "react-dom/server";

6import { Fragment, jsx, jsxs }

Source & flagged code

3 flagged · loading source

bin/skilltrace.jsView file

2import path from 'path' L3: import { spawnSync } from 'child_process' L4: import { fileURLToPath } from 'url'

High

Child Process

Package source references child process execution.

bin/skilltrace.jsView on unpkg · L2

build/client/assets/chunk-KS7C4IRE-DCMaQ_CC.jsView file

4Please change the parent <Route path="${e}"> to <Route path="${e===`/`?`*`:`${e}/*`}">.`)}let u=Q(),f;if(t){let e=typeof t==`string`?N(t):t;D(c===`/`||e.pathname?.startsWith(c),`Wh... L5: `);t=a.pop()||``;for(let e of a)r.enqueue(e)},flush(e){t&&e.enqueue(t)}})}Object.getOwnPropertyNames(Object.prototype).sort().join(`\0`);var wi=typeof window<`u`?window:typeof glob... L6: console.log(

Medium

Dynamic Require

Package source references dynamic require/import behavior.

build/client/assets/chunk-KS7C4IRE-DCMaQ_CC.jsView on unpkg · L4

build/server/index.jsView file

22Cross-file remote execution chain: build/server/index.js spawns build/client/assets/root-DYgjUX_V.js; helper contains network access plus dynamic code execution. L22: import nodemailer from "nodemailer"; L23: import { spawn, spawnSync } from "child_process"; L24: import fs from "fs"; ... L243: var dbName = "local/dev.db"; L244: var dataDir = process.env.SKILLTRACE_DATA_DIR ? path.resolve(process.env.SKILLTRACE_DATA_DIR) : path.join(process.cwd(), "data"); L245: var dbPath = path.join(dataDir, dbName); ... L547: redirect_to ??= new URL(request.url).pathname; L548: return redirect(`/login?${new URLSearchParams([["redirect_to", redirect_to]])}`); L549: } ... L666: rel: "preconnect", L667: href: "https://fonts.googleapis.com" L668: }),

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

build/server/index.jsView on unpkg · L22

Findings

3 High4 Medium4 Low

HighChild Processbin/skilltrace.js

HighShell

HighCross File Remote Execution Contextbuild/server/index.js

MediumDynamic Requirebuild/client/assets/chunk-KS7C4IRE-DCMaQ_CC.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

3 flagged

bin/skilltrace.jsView file

Lines 1-22javascript

1#!/usr/bin/env node

2import path from 'path'

3import { spawnSync } from 'child_process'

4import { fileURLToPath } from 'url'

High

Child Process

Package source references child process execution.

bin/skilltrace.jsView on unpkg · L2

6let binDir = path.dirname(fileURLToPath(import.meta.url))

7let packageRoot = path.resolve(binDir, '..')

8let cliPath = path.join(packageRoot, 'dist', 'traceskill.js')

10let result = spawnSync(process.execPath, [

11 cliPath,

12 ...process.argv.slice(2),

13], {

14 stdio: 'inherit',

15 env: {

16 ...process.env,

17 SKILLTRACE_TARGET_ROOT: process.env.SKILLTRACE_TARGET_ROOT || process.cwd(),

18 },

19})

21process.exit(result.status ?? 1)

build/client/assets/chunk-KS7C4IRE-DCMaQ_CC.jsView file

Lines 1-24javascript

build/server/index.jsView file

Lines 2-42javascript

2import { createReadableStreamFromReadable } from "@react-router/node";

4import { isbot } from "isbot";

5import { renderToPipeableStream } from "react-dom/server";

6import { Fragment, jsx, jsxs }