registry / svharness / 0.15.13

svharness@0.15.13

CLI scaffolder for SDD-Driven Agent-Agnostic Coding Framework (harness)

Static Scan Results

scanned 14d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsEvalFilesystemNetworkShell

Supply chain

HighEntropyStringsProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 144 file(s), 785 KB of source, external domains: api.laozhang.ai, bitbucket.org, codeload.github.com, gitee.com, gitlab.com, markitdown.desaysz.site, www.w3.org, yesv-desaysv.feishu.cn

Source & flagged code

6 flagged

package.jsonView file

Lines 15-55json

15 "auto/",

16 "scripts/postinstall.js",

17 "scripts/preuninstall.js",

18 "templates/",

19 "templates/svharness.config.example.yaml",

20 "README.md"

21 ],

22 "engines": {

23 "node": ">=18"

24 },

25 "scripts": {

26 "build": "tsc && node -e \"require('fs').cpSync('src/dashboard/static','dist/dashboard/static',{recursive:true,force:true})\"",

27 "clean": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\"",

28 "rebuild": "npm run clean && npm run build",

29 "test:requirements": "npm run build && node scripts/test-parse-blocks.js",

30 "test:auto": "npm run build && node scripts/test-auto-score.js && node scripts/test-auto-prompt.js && node scripts/test-acp-agent-cli-resolver.js && node scripts/test-auto-pack-req-context.js",

31 "test:cli-declarations": "npm run build && node scripts/test-cli-input-declarations.js",

32 "test:agent-launcher": "npm run build && node scripts/test-agent-launcher.js",

33 "test:acp-agent-cli": "npm run build && node scripts/test-acp-agent-cli-resolver.js",

34 "prepare": "npm run build",

35 "postinstall": "node scripts/postinstall.js",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L35

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L35

36 "preuninstall": "node scripts/preuninstall.js",

37 "prepublishOnly": "npm run build"

38 },

39 "publishConfig": {

40 "access": "public"

41 },

42 "keywords": [

43 "sdd",

44 "harness",

45 "ai-agent",

46 "scaffolder",

47 "spec-driven"

48 ],

49 "author": "uidq3640",

50 "license": "MIT",

51 "dependencies": {

52 "ajv": "^8.17.1",

53 "ajv-formats": "^3.0.1",

54 "commander": "^12.1.0",

55 "ejs": "^3.1.10",

templates/default-claude.envView file

Lines 1-26text

1# ============================================================

2# CodeChat 接口（svharness 内置默认模板 → 仅 ~/.claude/.env）

3# 仅写入用户目录；不会创建或修改项目 <workdir>/.claude/.env

4# 若项目已有 .claude/.env，start-agent 只读并同步到 ~/.claude/.env

5# ============================================================

6ANTHROPIC_AUTH_TOKEN=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VybmFtZSI6InVpZHEzNjQwIiwiZXhwIjoxNzgyMDM2MTkxfQ.GXsNuJ2Wi92VHepau51dTWGswHft6xovvOufVjtuBYk

Critical

Critical Secret

Package contains a critical-looking secret pattern.

templates/default-claude.envView on unpkg · L6

Critical

Secret Pattern

Supabase service role key (JWT) in templates/default-claude.env

templates/default-claude.envView on unpkg · L6

dist/core/repomix-pack.jsView file

Lines 2-42javascript

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

templates/codechat/Start-CodeChat.ps1View file

•path = templates/codechat/Start-CodeChat.ps1 kind = build_helper sizeBytes = 22201 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

templates/codechat/Start-CodeChat.ps1View on unpkg

Source & flagged code

6 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code