registry / skillwiki / 0.9.26

skillwiki@0.9.26

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 3 file(s), 469 KB of source, external domains: example.com

Source & flagged code

5 flagged

dist/auto-update-bg.jsView file

Lines 1-47javascript

1#!/usr/bin/env node

2#!/usr/bin/env node

3import {

4 normalizeDistTag,

5 semverGt

6} from "./chunk-E6UWZ3S3.js";

8// src/auto-update-bg.ts

9import { execSync } from "child_process";

10import { writeFileSync, mkdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/auto-update-bg.jsView on unpkg · L8

11import { join, dirname } from "path";

12var home = process.argv[2];

13var currentVersion = process.argv[3];

14var distTag = normalizeDistTag(process.argv[4]);

15if (!home || !currentVersion) process.exit(0);

16var cacheFile = join(home, ".skillwiki", ".update-cache.json");

17setTimeout(() => process.exit(0), 3e4);

18try {

19 const latest = execSync(`npm view skillwiki@${distTag} version`, {

20 encoding: "utf8",

21 timeout: 15e3

22 }).trim();

23 mkdirSync(dirname(cacheFile), { recursive: true });

24 const cache = {

25 lastCheck: Date.now(),

26 latestVersion: latest,

27 currentVersion,

28 distTag

29 };

30 if (semverGt(latest, currentVersion)) {

31 execSync(`npm install -g skillwiki@${distTag}`, {

32 stdio: "ignore",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/auto-update-bg.jsView on unpkg · L30

33 timeout: 6e4

34 });

35 writeFileSync(cacheFile, JSON.stringify({ ...cache, updateAppliedAt: Date.now() }, null, 2));

36 } else {

37 writeFileSync(cacheFile, JSON.stringify(cache, null, 2));

38 }

39} catch {

40 try {

41 mkdirSync(dirname(cacheFile), { recursive: true });

42 writeFileSync(cacheFile, JSON.stringify({ lastCheck: Date.now(), latestVersion: "", currentVersion, distTag }, null, 2));

43 } catch {

44 }

45}

46process.exit(0);

dist/cli.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2import {

3 CACHE_FILENAME,

4 CHECK_INTERVAL_MS,

5 CLI_DISABLE_FLAG,

6 DIST_TAG,

7 ENV_DISABLE_KEY,

8 normalizeDistTag,

9 semverGt

10} from "./chunk-E6UWZ3S3.js";

12// src/cli.ts

skills/hooks/run-hook.cmdView file

•path = skills/hooks/run-hook.cmd kind = build_helper sizeBytes = 1274 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/hooks/run-hook.cmdView on unpkg

Source & flagged code

5 flagged · loading source

dist/auto-update-bg.jsView file

8// src/auto-update-bg.ts L9: import { execSync } from "child_process"; L10: import { writeFileSync, mkdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/auto-update-bg.jsView on unpkg · L8

30if (semverGt(latest, currentVersion)) { L31: execSync(`npm install -g skillwiki@${distTag}`, { L32: stdio: "ignore",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/auto-update-bg.jsView on unpkg · L30

dist/cli.jsView file

16// ../shared/src/exit-codes.ts L17: var ExitCode = { L18: OK: 0, ... L188: users: z.array(sshUser).optional(), L189: transports: z.array(z.enum(["local", "public-ip", "tailscale", "private-lan"])).min(1) L190: }).strict(); ... L311: function printJson(r) { L312: process.stdout.write(JSON.stringify(r) + "\n"); L313: } ... L341: const raw = readFileSync(manifestPath, "utf8"); L342: const manifest = JSON.parse(raw); L343: if (!manifest.skills) return [];

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/cli.jsView on unpkg · L16

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/cli.jsView on unpkg · L16

skills/hooks/run-hook.cmdView file

•path = skills/hooks/run-hook.cmd kind = build_helper sizeBytes = 1274 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/hooks/run-hook.cmdView on unpkg

Findings

4 High6 Medium6 Low

HighChild Processdist/auto-update-bg.js

HighShell

HighCloud Metadata Accessdist/cli.js

HighRuntime Package Installdist/auto-update-bg.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/cli.js

MediumShips Build Helperskills/hooks/run-hook.cmd

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

5 flagged

dist/auto-update-bg.jsView file

Lines 1-47javascript

1#!/usr/bin/env node

2#!/usr/bin/env node

3import {

4 normalizeDistTag,

5 semverGt

6} from "./chunk-E6UWZ3S3.js";

8// src/auto-update-bg.ts

9import { execSync } from "child_process";

10import { writeFileSync, mkdirSync } from "fs";

High

Child Process

Package source references child process execution.

dist/auto-update-bg.jsView on unpkg · L8

11import { join, dirname } from "path";

12var home = process.argv[2];

13var currentVersion = process.argv[3];

14var distTag = normalizeDistTag(process.argv[4]);

15if (!home || !currentVersion) process.exit(0);

16var cacheFile = join(home, ".skillwiki", ".update-cache.json");

17setTimeout(() => process.exit(0), 3e4);

18try {

19 const latest = execSync(`npm view skillwiki@${distTag} version`, {

20 encoding: "utf8",

21 timeout: 15e3

22 }).trim();

23 mkdirSync(dirname(cacheFile), { recursive: true });

24 const cache = {

25 lastCheck: Date.now(),

26 latestVersion: latest,

27 currentVersion,

28 distTag

29 };

30 if (semverGt(latest, currentVersion)) {

31 execSync(`npm install -g skillwiki@${distTag}`, {

32 stdio: "ignore",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/auto-update-bg.jsView on unpkg · L30

33 timeout: 6e4

34 });

35 writeFileSync(cacheFile, JSON.stringify({ ...cache, updateAppliedAt: Date.now() }, null, 2));

36 } else {

37 writeFileSync(cacheFile, JSON.stringify(cache, null, 2));

38 }

39} catch {

40 try {

41 mkdirSync(dirname(cacheFile), { recursive: true });

42 writeFileSync(cacheFile, JSON.stringify({ lastCheck: Date.now(), latestVersion: "", currentVersion, distTag }, null, 2));

43 } catch {

44 }

45}

46process.exit(0);

dist/cli.jsView file

Lines 1-36javascript

1#!/usr/bin/env node

2import {

3 CACHE_FILENAME,

4 CHECK_INTERVAL_MS,

5 CLI_DISABLE_FLAG,

6 DIST_TAG,

7 ENV_DISABLE_KEY,

8 normalizeDistTag,

9 semverGt

10} from "./chunk-E6UWZ3S3.js";

12// src/cli.ts

skills/hooks/run-hook.cmdView file

•path = skills/hooks/run-hook.cmd kind = build_helper sizeBytes = 1274 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/hooks/run-hook.cmdView on unpkg