registry / skillwiki / 0.9.29

skillwiki@0.9.29

⚠ Under review

Static Scan Results

scanned 3d ago · by rust-scanner

Static analysis flagged 17 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicenseWildcardDependency

scanned 5 file(s), 507 KB of source, external domains: example.com, www.w3.org

Source & flagged code

6 flagged

dist/chunk-T7XG3WFK.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import {

3 CACHE_FILENAME,

4 CHECK_INTERVAL_MS,

5 CLI_DISABLE_FLAG,

6 DIST_TAG,

7 ENV_DISABLE_KEY,

8 normalizeDistTag,

9 semverGt

10} from "./chunk-E6UWZ3S3.js";

12// ../shared/src/exit-codes.ts

13var ExitCode = {

14 OK: 0,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunk-T7XG3WFK.jsView on unpkg · L12

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-T7XG3WFK.jsView on unpkg · L12

15 INTERNAL_ERROR: 1,

16 FILE_NOT_FOUND: 2,

17 MISSING_CLOSING_DELIMITER: 3,

18 SCHEME_REJECTED: 4,

19 HOST_BLOCKED: 5,

20 MALFORMED_URL: 6,

21 INVALID_FRONTMATTER: 7,

22 SCHEMA_NOT_DETECTED: 8,

23 VAULT_PATH_INVALID: 9,

24 WRITE_FAILED: 10,

25 UNRESOLVED_MARKERS: 11,

26 SOURCES_INCONSISTENT: 12,

27 PREFLIGHT_FAILED: 13,

28 ATOMIC_COPY_FAILED: 14,

29 INIT_TARGET_NOT_EMPTY: 15,

30 BROKEN_WIKILINKS: 16,

31 TAG_NOT_IN_TAXONOMY: 17,

32 INDEX_INCOMPLETE: 18,

Lines 2036-2076javascript

2036// src/commands/index-link-format.ts

2037import { readFile as readFile9 } from "fs/promises";

2038import { join as join11 } from "path";

2039var MD_LINK_RE = /\[[^\[\]]+\]$[^)]+\.md$/

dist/auto-update-bg.jsView file

Lines 10-47javascript

10import { writeFileSync, mkdirSync } from "fs";

11import { join, dirname } from "path";

12var home = process.argv[2];

13var currentVersion = process.argv[3];

14var distTag = normalizeDistTag(process.argv[4]);

skills/hooks/run-hook.cmdView file

•path = skills/hooks/run-hook.cmd kind = build_helper sizeBytes = 1274 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/hooks/run-hook.cmdView on unpkg

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = skillwiki@0.9.26 matchedIdentity = npm:c2tpbGx3aWtp:0.9.26 similarity = 0.667 summary = stored previous version shares package body but lacks this dangerous source file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.jsView on unpkg

Source & flagged code

6 flagged · loading source

dist/chunk-T7XG3WFK.jsView file

2056import { createHash as createHash2 } from "crypto"; L2057: import { execFile } from "child_process"; L2058: import { mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2, unlinkSync as unlinkSync2 } from "fs";

High

Child Process

Package source references child process execution.

dist/chunk-T7XG3WFK.jsView on unpkg · L2056

12// ../shared/src/exit-codes.ts L13: var ExitCode = { L14: OK: 0, ... L184: users: z.array(sshUser).optional(), L185: transports: z.array(z.enum(["local", "public-ip", "tailscale", "private-lan"])).min(1) L186: }).strict(); ... L313: function splitFrontmatter(text) { L314: if (!FM_OPEN.test(text)) return ok({ rawFrontmatter: "", body: text, bodyStart: 0 }); L315: const afterOpen = text.replace(FM_OPEN, ""); ... L342: { L343: kind: "private_key", L344: re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunk-T7XG3WFK.jsView on unpkg · L12

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-T7XG3WFK.jsView on unpkg · L12

dist/auto-update-bg.jsView file

30if (semverGt(latest, currentVersion)) { L31: execSync(`npm install -g skillwiki@${distTag}`, { L32: stdio: "ignore",

High

Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/auto-update-bg.jsView on unpkg · L30

skills/hooks/run-hook.cmdView file

•path = skills/hooks/run-hook.cmd kind = build_helper sizeBytes = 1274 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/hooks/run-hook.cmdView on unpkg

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.jsView on unpkg

Findings

1 Critical4 High6 Medium6 Low

CriticalPrevious Version Dangerous Deltadist/cli.js

HighChild Processdist/chunk-T7XG3WFK.js

HighShell

HighCloud Metadata Accessdist/chunk-T7XG3WFK.js

HighRuntime Package Installdist/auto-update-bg.js

MediumNetwork

MediumEnvironment Vars

MediumInstall Persistencedist/chunk-T7XG3WFK.js

MediumShips Build Helperskills/hooks/run-hook.cmd

MediumStructural Risk Force Deep Review

MediumWildcard Dependency

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

6 flagged

dist/chunk-T7XG3WFK.jsView file

Lines 1-32javascript

1#!/usr/bin/env node

2import {

3 CACHE_FILENAME,

4 CHECK_INTERVAL_MS,

5 CLI_DISABLE_FLAG,

6 DIST_TAG,

7 ENV_DISABLE_KEY,

8 normalizeDistTag,

9 semverGt

10} from "./chunk-E6UWZ3S3.js";

12// ../shared/src/exit-codes.ts

13var ExitCode = {

14 OK: 0,

High

Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunk-T7XG3WFK.jsView on unpkg · L12

Medium

Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-T7XG3WFK.jsView on unpkg · L12

15 INTERNAL_ERROR: 1,

16 FILE_NOT_FOUND: 2,

17 MISSING_CLOSING_DELIMITER: 3,

18 SCHEME_REJECTED: 4,

19 HOST_BLOCKED: 5,

20 MALFORMED_URL: 6,

21 INVALID_FRONTMATTER: 7,

22 SCHEMA_NOT_DETECTED: 8,

23 VAULT_PATH_INVALID: 9,

24 WRITE_FAILED: 10,

25 UNRESOLVED_MARKERS: 11,

26 SOURCES_INCONSISTENT: 12,

27 PREFLIGHT_FAILED: 13,

28 ATOMIC_COPY_FAILED: 14,

29 INIT_TARGET_NOT_EMPTY: 15,

30 BROKEN_WIKILINKS: 16,

31 TAG_NOT_IN_TAXONOMY: 17,

32 INDEX_INCOMPLETE: 18,

Lines 2036-2076javascript

2036// src/commands/index-link-format.ts

2037import { readFile as readFile9 } from "fs/promises";

2038import { join as join11 } from "path";

2039var MD_LINK_RE = /\[[^\[\]]+\]$[^)]+\.md$/

dist/auto-update-bg.jsView file

Lines 10-47javascript

10import { writeFileSync, mkdirSync } from "fs";

11import { join, dirname } from "path";

12var home = process.argv[2];

13var currentVersion = process.argv[3];

14var distTag = normalizeDistTag(process.argv[4]);

skills/hooks/run-hook.cmdView file

•path = skills/hooks/run-hook.cmd kind = build_helper sizeBytes = 1274 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/hooks/run-hook.cmdView on unpkg

dist/cli.jsView file

Critical

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version.

dist/cli.jsView on unpkg