@capabletooling/cli
CapableCore CLI — unified multi-vertical command line (mding, acing, fding)
Supply chain provenance
Status for the latest visible version.
Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.
Maintainers
Keywords
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decode used for hex editor binary data handling — legitimate use case, not payload obfuscation. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): CLI tool spawning subprocesses with inherited env is standard; not a secret-leaking pattern here. | ai | |
| semgrep | semgrep:shady-links-raw-ip | AI (semgrep): IP is 127.0.0.1 (localhost); used for local server proxy communication, not exfiltration. | ai | |
| typosquat | typosquat.levenshtein:joi | AI (typosquat): Scoped CLI package with distinct identity; Levenshtein match to 'joi' is coincidental and not a real typosquat risk. | ai |
Versions (showing 6 of 6)
| Version | Deps | Published |
|---|---|---|
| 0.5.0 | 12 / 3 | |
| 0.4.0 | 12 / 3 | |
| 0.3.1 | 12 / 3 | |
| 0.3.0 | 12 / 3 | |
| 0.2.7 | 10 / 3 | |
| 0.2.6 | 10 / 3 |
v0.5.0
5 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/00a53fd6b64271ad22ecce1e636ebea79ebb5ee1/src/core/agents/adapters/claude_code.js#L116 114 | const child = runSpawn(bin, args, { 115 | cwd, > 116 | env: { ...process.env, ...(env ?? {}) }, 117 | stdio: ['pipe', 'pipe', 'pipe'], 118 | });
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/00a53fd6b64271ad22ecce1e636ebea79ebb5ee1/src/core/agents/adapters/codex.js#L109 107 | const child = runSpawn(bin, args, { 108 | cwd, > 109 | env: { ...process.env, ...(env ?? {}) }, 110 | stdio: ['pipe', 'pipe', 'pipe'], 111 | });
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/00a53fd6b64271ad22ecce1e636ebea79ebb5ee1/src/core/agents/adapters/gemini.js#L124 122 | 123 | async spawn({ conversationId, cwd, env }) { > 124 | const childEnv = { ...process.env, ...(env ?? {}) }; 125 | let args; 126 | if (conversationId) {
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/00a53fd6b64271ad22ecce1e636ebea79ebb5ee1/src/core/agents/adapters/opencode.js#L65 63 | ['serve', '--port', String(port), '--hostname', '127.0.0.1'], 64 | { > 65 | env: { ...process.env, OPENCODE_SERVER_PASSWORD: password }, 66 | stdio: ['ignore', 'pipe', 'pipe'], 67 | },
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.4.0
5 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/c33252d2fd1e2fe6381870fb53fa39bc07d64266/src/core/agents/adapters/claude_code.js#L116 114 | const child = runSpawn(bin, args, { 115 | cwd, > 116 | env: { ...process.env, ...(env ?? {}) }, 117 | stdio: ['pipe', 'pipe', 'pipe'], 118 | });
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/c33252d2fd1e2fe6381870fb53fa39bc07d64266/src/core/agents/adapters/codex.js#L109 107 | const child = runSpawn(bin, args, { 108 | cwd, > 109 | env: { ...process.env, ...(env ?? {}) }, 110 | stdio: ['pipe', 'pipe', 'pipe'], 111 | });
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/c33252d2fd1e2fe6381870fb53fa39bc07d64266/src/core/agents/adapters/gemini.js#L124 122 | 123 | async spawn({ conversationId, cwd, env }) { > 124 | const childEnv = { ...process.env, ...(env ?? {}) }; 125 | let args; 126 | if (conversationId) {
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/c33252d2fd1e2fe6381870fb53fa39bc07d64266/src/core/agents/adapters/opencode.js#L65 63 | ['serve', '--port', String(port), '--hostname', '127.0.0.1'], 64 | { > 65 | env: { ...process.env, OPENCODE_SERVER_PASSWORD: password }, 66 | stdio: ['ignore', 'pipe', 'pipe'], 67 | },
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.1
5 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/a90f1c0d975c7784277f15f97c4f0e28d858cdbf/src/core/agents/adapters/claude_code.js#L116 114 | const child = runSpawn(bin, args, { 115 | cwd, > 116 | env: { ...process.env, ...(env ?? {}) }, 117 | stdio: ['pipe', 'pipe', 'pipe'], 118 | });
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/a90f1c0d975c7784277f15f97c4f0e28d858cdbf/src/core/agents/adapters/codex.js#L109 107 | const child = runSpawn(bin, args, { 108 | cwd, > 109 | env: { ...process.env, ...(env ?? {}) }, 110 | stdio: ['pipe', 'pipe', 'pipe'], 111 | });
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/a90f1c0d975c7784277f15f97c4f0e28d858cdbf/src/core/agents/adapters/gemini.js#L124 122 | 123 | async spawn({ conversationId, cwd, env }) { > 124 | const childEnv = { ...process.env, ...(env ?? {}) }; 125 | let args; 126 | if (conversationId) {
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/a90f1c0d975c7784277f15f97c4f0e28d858cdbf/src/core/agents/adapters/opencode.js#L65 63 | ['serve', '--port', String(port), '--hostname', '127.0.0.1'], 64 | { > 65 | env: { ...process.env, OPENCODE_SERVER_PASSWORD: password }, 66 | stdio: ['ignore', 'pipe', 'pipe'], 67 | },
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.3.0
5 findingsSpreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/1406aef08bbb6e32dfc11ef285a8c0030ebc4b7e/src/core/agents/adapters/claude_code.js#L116 114 | const child = runSpawn(bin, args, { 115 | cwd, > 116 | env: { ...process.env, ...(env ?? {}) }, 117 | stdio: ['pipe', 'pipe', 'pipe'], 118 | });
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/1406aef08bbb6e32dfc11ef285a8c0030ebc4b7e/src/core/agents/adapters/codex.js#L109 107 | const child = runSpawn(bin, args, { 108 | cwd, > 109 | env: { ...process.env, ...(env ?? {}) }, 110 | stdio: ['pipe', 'pipe', 'pipe'], 111 | });
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/1406aef08bbb6e32dfc11ef285a8c0030ebc4b7e/src/core/agents/adapters/gemini.js#L124 122 | 123 | async spawn({ conversationId, cwd, env }) { > 124 | const childEnv = { ...process.env, ...(env ?? {}) }; 125 | let args; 126 | if (conversationId) {
Spreading entire process.env into an object — may capture all secrets Source: https://github.com/junoddev/markdown.ing/blob/1406aef08bbb6e32dfc11ef285a8c0030ebc4b7e/src/core/agents/adapters/opencode.js#L65 63 | ['serve', '--port', String(port), '--hostname', '127.0.0.1'], 64 | { > 65 | env: { ...process.env, OPENCODE_SERVER_PASSWORD: password }, 66 | stdio: ['ignore', 'pipe', 'pipe'], 67 | },
Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.
v0.2.7
1 findingPackage was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.