registry  /  skillwiki  /  0.9.56

skillwiki@0.9.56

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 16 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
One or more suspicious static signals were detected.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell
Supply chain
HighEntropyStringsUrlStrings
Manifest
NoLicenseWildcardDependency
scanned 5 file(s), 580 KB of source, external domains: example.com, www.w3.org

Source & flagged code

5 flagged · loading source
dist/chunk-SE5URAJR.jsView file
2178// src/utils/rclone.ts L2179: import { execFile } from "child_process"; L2180: import { promisify } from "util";
High
Child Process

Package source references child process execution.

dist/chunk-SE5URAJR.jsView on unpkg · L2178
7// ../shared/src/exit-codes.ts L8: var ExitCode = { L9: OK: 0, ... L209: users: z.array(sshUser).optional(), L210: transports: z.array(z.enum(["local", "public-ip", "tailscale", "private-lan"])).min(1) L211: }).strict(); ... L338: function splitFrontmatter(text) { L339: if (!FM_OPEN.test(text)) return ok({ rawFrontmatter: "", body: text, bodyStart: 0 }); L340: const afterOpen = text.replace(FM_OPEN, ""); ... L367: { L368: kind: "private_key", L369: re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g
High
Cloud Metadata Access

Source reaches cloud instance metadata or link-local credential endpoints.

dist/chunk-SE5URAJR.jsView on unpkg · L7
7// ../shared/src/exit-codes.ts L8: var ExitCode = { L9: OK: 0, ... L209: users: z.array(sshUser).optional(), L210: transports: z.array(z.enum(["local", "public-ip", "tailscale", "private-lan"])).min(1) L211: }).strict(); ... L338: function splitFrontmatter(text) { L339: if (!FM_OPEN.test(text)) return ok({ rawFrontmatter: "", body: text, bodyStart: 0 }); L340: const afterOpen = text.replace(FM_OPEN, ""); ... L367: { L368: kind: "private_key", L369: re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z0-9 ]*PRIVATE KEY-----/g
Medium
Install Persistence

Source writes installer persistence such as shell profile or service configuration.

dist/chunk-SE5URAJR.jsView on unpkg · L7
dist/auto-update-bg.jsView file
42} L43: execSync(`npm install -g skillwiki@${distTag}`, { L44: stdio: "ignore",
High
Runtime Package Install

Package source invokes a package manager install command at runtime.

dist/auto-update-bg.jsView on unpkg · L42
skills/hooks/run-hook.cmdView file
•path = skills/hooks/run-hook.cmd kind = build_helper sizeBytes = 1274 magicHex = [redacted]
Medium
Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/hooks/run-hook.cmdView on unpkg

Findings

4 High6 Medium6 Low
HighChild Processdist/chunk-SE5URAJR.js
HighShell
HighCloud Metadata Accessdist/chunk-SE5URAJR.js
HighRuntime Package Installdist/auto-update-bg.js
MediumNetwork
MediumEnvironment Vars
MediumInstall Persistencedist/chunk-SE5URAJR.js
MediumShips Build Helperskills/hooks/run-hook.cmd
MediumStructural Risk Force Deep Review
MediumWildcard Dependency
LowNon Install Lifecycle Scripts
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowNo License