registry / swe-workflow-skills / 0.5.2

swe-workflow-skills@0.5.2

A curated library of Claude Code Agent Skills covering the full software lifecycle, with orchestrator-routed activation that scales past the skill-listing budget.

Static Scan Results

scanned 15h ago · by rust-scanner

Static analysis completed at 65.0% confidence. No malicious behavior was detected; 6 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystemShell

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 6 file(s), 54.0 KB of source

Source & flagged code

2 flagged

hooks/session-start.mjsView file

Lines 57-97javascript

58Skip ONLY for genuinely trivial, conversational, or information-lookup replies,

59or when the user tells you not to use a skill or to "just do X" — the user's

60explicit instructions always take precedence.`;

62// Active role, if one was set (by install --role or the /role command).

63let role = "";

64const activeRoleFile = join(SKILLS_DIR, ".active-role");

Source & flagged code

2 flagged · loading source

hooks/session-start.mjsView file

77for (const p of [join(SCRIPT_DIR, "resolve.mjs"), join(SCRIPT_DIR, "..", "scripts", "resolve.mjs")]) { L78: if (existsSync(p)) return import(pathToFileURL(p).href); L79: }

Medium

Dynamic Require

Package source references dynamic require/import behavior.

hooks/session-start.mjsView on unpkg · L77

skills/infrastructure-as-code/references/iac-patterns.mdView file

146patternName = generic_password severity = medium line = 146 matchedText = password...123"

Medium

Secret Pattern

Hardcoded password in skills/infrastructure-as-code/references/iac-patterns.md

skills/infrastructure-as-code/references/iac-patterns.mdView on unpkg · L146

Findings

3 Medium3 Low

MediumDynamic Requirehooks/session-start.mjs

MediumEnvironment Vars

MediumSecret Patternskills/infrastructure-as-code/references/iac-patterns.md

LowNon Install Lifecycle Scripts

LowScripts Present

LowFilesystem

skills/infrastructure-as-code/references/iac-patterns.mdView file

Lines 126-166markdown

126```hcl

127resource "aws_db_instance" "main" {

128 storage_encrypted = true # Always

129 # ...

130}

131

132resource "aws_s3_bucket_server_side_encryption_configuration" "main" {

133 bucket = aws_s3_bucket.main.id

134 rule {

135 apply_server_side_encryption_by_default {

136 sse_algorithm = "aws:kms"

137 }

138 }

139}

140```

141

142### No hardcoded secrets

143```hcl

144# BAD

145resource "aws_db_instance" "main" {

146 password = "supersecret123"

Medium

Secret Pattern

Hardcoded password in skills/infrastructure-as-code/references/iac-patterns.md

skills/infrastructure-as-code/references/iac-patterns.mdView on unpkg · L146

147}

148

149# GOOD: Use a secrets manager or variable with sensitive flag

150variable "db_password" {

151 type = string

152 sensitive = true

153}

154

155# BETTER: Generate and store in secrets manager

156resource "random_password" "db" {

157 length = 32

158 special = true

159}

160

161resource "aws_secretsmanager_secret_version" "db" {

162 secret_id = aws_secretsmanager_secret.db.id

163 secret_string = random_password.db.result

164}

165```

166