registry / waypoint-skills / 1.3.0

waypoint-skills@1.3.0

Multi-platform agentic skills for AI assistants — wp framework, agents, rules, hooks

Static Scan Results

scanned 8d ago · by rust-scanner

Static analysis flagged 15 finding(s) at 72.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedUrlStrings

ManifestNo manifest risk signals triggered.

scanned 69 file(s), 1.66 MB of source, external domains: developers.openai.com, example.com, github.com, impeccable.style, www.w3.org

Source & flagged code

8 flagged

package.jsonView file

Lines 22-45json

22 "url": "https://github.com/quenginedev/waypoint.sk/issues"

23 },

24 "engines": {

25 "node": ">=18"

26 },

27 "type": "module",

28 "bin": {

29 "waypoint-skills": "cli/bin/cli.js",

30 "waypoint": "cli/bin/cli.js"

31 },

32 "files": [

33 "cli/",

34 "packages/",

35 "scripts/",

36 "skills/",

37 "manifest.json",

38 "README.npm.md",

39 "LICENSE"

40 ],

41 "scripts": {

42 "postinstall": "node cli/bin/postinstall.mjs || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 }

44}

cli/bin/cli.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

3/**

4 * Waypoint Skills CLI

5 *

6 * Usage:

7 * npx waypoint-skills install [--platform auto] [--global|--local] [-y]

8 * npx waypoint-skills doctor

9 * npx waypoint-skills detect

10 * npx waypoint-skills bootstrap [--mid ID]

11 * npx waypoint-skills status

12 * npx waypoint-skills uninstall

13 *

packages/skills/impeccable/scripts/live-copy-edit-agent.mjsView file

Lines 235-275javascript

235 continue;

236 }

237 if (ch === '\\') {

238 escaped = true;

239 continue;

240 }

241 if (quote) {

packages/skills/impeccable/scripts/hook-lib.mjsView file

Lines 1243-1283javascript

1243 }

1244 fs.mkdirSync(path.dirname(expanded), { recursive: true });

1245 const line = JSON.stringify({ ts: new Date().toISOString(), ...entry }) + '\n';

packages/skills/impeccable/scripts/live/svelte-component.mjsView file

Lines 1-40javascript

1/**

2 * Svelte live-mode component injection helpers.

3 *

4 * Variants are real .svelte components under node_modules/.impeccable-live/<session-id>/.

5 * The browser mounts them via Svelte 5 mount(); accept inlines the chosen

6 * variant back into the route source with props mapped to original bindings.

7 */

9import fs from 'node:fs';

10import path

packages/skills/impeccable/scripts/live-server.mjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2/**

3 * Live variant mode server (self-contained, zero dependencies).

4 *

5 * Serves the browser script (/live.js), the detection overlay (/detect.js),

6 * uses Server-Sent Events (SSE) for server→browser push, and HTTP POST for

7 * browser→server events. Agent communicates via HTTP long-poll (/poll).

8 *

9 * Usage:

10 * node <scripts_path>/live-server.mjs # start

11 * node <scripts_path>/live-server.mjs stop # stop + remove injected live.js tag

scripts/sync-skills.shView file

•path = scripts/sync-skills.sh kind = build_helper sizeBytes = 577 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/sync-skills.shView on unpkg

Source & flagged code

8 flagged · loading source

package.jsonView file

•scripts.postinstall = node cli/bin/postinstall.mjs || true

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node cli/bin/postinstall.mjs || true

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

cli/bin/cli.jsView file

18import { readFileSync } from 'node:fs'; L19: import { spawnSync } from 'node:child_process'; L20: import { join, dirname } from 'node:path';

High

Child Process

Package source references child process execution.

cli/bin/cli.jsView on unpkg · L18

packages/skills/impeccable/scripts/live-copy-edit-agent.mjsView file

255encoding: 'utf-8', L256: shell: true, L257: timeout: 30_000,

High

Shell

Package source references shell execution.

packages/skills/impeccable/scripts/live-copy-edit-agent.mjsView on unpkg · L255

packages/skills/impeccable/scripts/hook-lib.mjsView file

1263if (!found) return null; L1264: const mod = await import(pathToFileURL(found)); L1265: detectorCache = {

Medium

Dynamic Require

Package source references dynamic require/import behavior.

packages/skills/impeccable/scripts/hook-lib.mjsView on unpkg · L1263

packages/skills/impeccable/scripts/live/svelte-component.mjsView file

20export function [redacted](filePath) { L21: if (/^(0|false|no)$/i.test(process.env.IMPECCABLE_LIVE_SVELTE_COMPONENT || '')) return false; L22: return path.extname(filePath).toLowerCase() === '.svelte'; ... L24: L25: export function componentSessionDir(id, cwd = process.cwd()) { L26: return path.join(cwd, SVELTE_COMPONENT_ROOT, id); ... L255: export function readManifest(manifestPath) { L256: const data = JSON.parse(fs.readFileSync(manifestPath, 'utf-8')); L257: return {

Low

Weak Crypto

Package source references weak cryptographic algorithms.

packages/skills/impeccable/scripts/live/svelte-component.mjsView on unpkg · L20

packages/skills/impeccable/scripts/live-server.mjsView file

15Cross-file remote execution chain: [redacted]-server.mjs spawns [redacted]-screenshot.umd.js; helper contains network access plus dynamic code execution. L15: L16: import http from 'node:http'; L17: import { randomUUID } from 'node:crypto'; L18: import { spawn, execFileSync } from 'node:child_process'; L19: import fs from 'node:fs'; ... L53: L54: const __dirname = path.dirname(fileURLToPath(import.meta.url)); L55: // PRODUCT.md / DESIGN.md live wherever context.mjs resolves. The generated ... L111: const POLL_LEASE_EXPIRY_TIMER_GRACE_MS = 2; L112: const DEBUG_MANUAL_EDIT_EVENTS = /^(1|true|yes)$/i.test(process.env.IMPECCABLE_LIVE_DEBUG_EVENTS || ''); L113: ... L299: function broadcast(msg) {

High

Cross File Remote Execution Context

Source spawns a local helper that also contains network and dynamic execution context; review data flow before blocking.

packages/skills/impeccable/scripts/live-server.mjsView on unpkg · L15

scripts/sync-skills.shView file

•path = scripts/sync-skills.sh kind = build_helper sizeBytes = 577 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/sync-skills.shView on unpkg

Findings

4 High6 Medium5 Low

HighInstall Time Lifecycle Scriptspackage.json

HighChild Processcli/bin/cli.js

HighShellpackages/skills/impeccable/scripts/live-copy-edit-agent.mjs

HighCross File Remote Execution Contextpackages/skills/impeccable/scripts/live-server.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requirepackages/skills/impeccable/scripts/hook-lib.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperscripts/sync-skills.sh

MediumStructural Risk Force Deep Review

LowScripts Present

LowWeak Cryptopackages/skills/impeccable/scripts/live/svelte-component.mjs

LowFilesystem

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

8 flagged

package.jsonView file

Lines 22-45json

22 "url": "https://github.com/quenginedev/waypoint.sk/issues"

23 },

24 "engines": {

25 "node": ">=18"

26 },

27 "type": "module",

28 "bin": {

29 "waypoint-skills": "cli/bin/cli.js",

30 "waypoint": "cli/bin/cli.js"

31 },

32 "files": [

33 "cli/",

34 "packages/",

35 "scripts/",

36 "skills/",

37 "manifest.json",

38 "README.npm.md",

39 "LICENSE"

40 ],

41 "scripts": {

42 "postinstall": "node cli/bin/postinstall.mjs || true"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L42

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L42

43 }

44}

cli/bin/cli.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

3/**

4 * Waypoint Skills CLI

5 *

6 * Usage:

7 * npx waypoint-skills install [--platform auto] [--global|--local] [-y]

8 * npx waypoint-skills doctor

9 * npx waypoint-skills detect

10 * npx waypoint-skills bootstrap [--mid ID]

11 * npx waypoint-skills status

12 * npx waypoint-skills uninstall

13 *

packages/skills/impeccable/scripts/live-copy-edit-agent.mjsView file

Lines 235-275javascript

235 continue;

236 }

237 if (ch === '\\') {

238 escaped = true;

239 continue;

240 }

241 if (quote) {

packages/skills/impeccable/scripts/hook-lib.mjsView file

Lines 1243-1283javascript

1243 }

1244 fs.mkdirSync(path.dirname(expanded), { recursive: true });

1245 const line = JSON.stringify({ ts: new Date().toISOString(), ...entry }) + '\n';

packages/skills/impeccable/scripts/live/svelte-component.mjsView file

Lines 1-40javascript

1/**

2 * Svelte live-mode component injection helpers.

3 *

4 * Variants are real .svelte components under node_modules/.impeccable-live/<session-id>/.

5 * The browser mounts them via Svelte 5 mount(); accept inlines the chosen

6 * variant back into the route source with props mapped to original bindings.

7 */

9import fs from 'node:fs';

10import path

packages/skills/impeccable/scripts/live-server.mjsView file

Lines 1-35javascript

1#!/usr/bin/env node

2/**

3 * Live variant mode server (self-contained, zero dependencies).

4 *

5 * Serves the browser script (/live.js), the detection overlay (/detect.js),

6 * uses Server-Sent Events (SSE) for server→browser push, and HTTP POST for

7 * browser→server events. Agent communicates via HTTP long-poll (/poll).

8 *

9 * Usage:

10 * node <scripts_path>/live-server.mjs # start

11 * node <scripts_path>/live-server.mjs stop # stop + remove injected live.js tag

scripts/sync-skills.shView file

•path = scripts/sync-skills.sh kind = build_helper sizeBytes = 577 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

scripts/sync-skills.shView on unpkg