mareasw/ontoskills

Score 0. Found 4 critical, 5 high, 9 medium findings.

Trust score

0/ 100

Score 0. Found 4 critical, 5 high, 9 medium findings.

mareasw/ontoskills · 50 of 240 files read

Critical4

cli/lib/paths.js:103 · shell_exec

Spawns a subprocess.

const result = spawnSync(command, ["--help"], { stdio: "ignore" });

cli/lib/paths.js:108 · shell_exec

Spawns a subprocess.

return spawnSync(command, args, { stdio: "pipe", encoding: "utf-8", ...options });

cli/lib/paths.js:112 · shell_exec

Spawns a subprocess.

const result = spawnSync(command, args, { stdio: "pipe", encoding: "utf-8", ...options });

cli/lib/install.js:468 · shell_exec

Spawns a subprocess.

const result = spawnSync(candidate, ["--version"], { stdio: "ignore" });

High5

cli/lib/registry.js:236 · network_undeclared
Outbound network call but SKILL.md does not declare network use or list domains.
```
const response = await fetch(ref, { headers: { "User-Agent": "ontoskills" } });
```
cli/lib/registry.js:253 · network_undeclared
Outbound network call but SKILL.md does not declare network use or list domains.
```
const response = await fetch(ref, { headers: { "User-Agent": "ontoskills" } });
```
cli/lib/install.js:272 · network_undeclared
Outbound network call but SKILL.md does not declare network use or list domains.
```
const response = await fetch(HF_MODEL_URL, { redirect: "follow" });
```
cli/lib/install.js:405 · network_undeclared
Outbound network call but SKILL.md does not declare network use or list domains.
```
const response = await fetch(`https://api.github.com/repos/${repo}/releases/latest`, {
```
cli/lib/install.js:418 · network_undeclared
Outbound network call but SKILL.md does not declare network use or list domains.
```
const response = await fetch(url, { headers: { "User-Agent": "ontoskills" } });
```

Medium9

cli/lib/paths.js:79 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await fsp.writeFile(filePath, `${JSON.stringify(value, null, 2)}\n`, "utf-8");
```
cli/lib/registry.js:165 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await fsp.writeFile(ENABLED_INDEX_PATH, ttlImports([...enabled].sort()), "utf-8");
```
cli/lib/registry.js:258 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await fsp.writeFile(destination, buffer);
```

cli/lib/install.js:98 · fs_write

Filesystem write to a path that is not obviously a temp directory.

await fsp.writeFile(path.join(installRoot, "package.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf-8");

cli/lib/install.js:233 · fs_write

Filesystem write to a path that is not obviously a temp directory.

await fsp.writeFile(path.join(installRoot, "package.json"), `${JSON.stringify(manifest, null, 2)}\n`, "utf-8");

cli/lib/install.js:276 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await fsp.writeFile(modelDest, buffer);
```
cli/lib/install.js:424 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await fsp.writeFile(destination, buffer);
```
cli/lib/install.js:498 · fs_write
Filesystem write to a path that is not obviously a temp directory.
```
await fsp.writeFile(wrapperPath, script, "utf-8");
```
+ 1 more