@ha-bits/cortex
Cortex - Habits Workflow Executor CLI
10
Versions
AGPL-3.0
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
No source commit
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
fadysghatas
Keywords
habitsworkflowexecutorautomationcli
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| phantom-deps | phantom-dep:@activepieces/pieces-framework | AI (phantom-deps): Declared dependency; bundled via esbuild into main.cjs. | ai | |
| phantom-deps | phantom-dep:qs | AI (phantom-deps): Declared in package.json dependencies; likely used transitively or in bundled output. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Explicitly filters for HABITS_ prefix; reads only expected config vars, not exfiltrating all secrets. | ai | |
| phantom-deps | phantom-dep:@activepieces/pieces-common | AI (phantom-deps): Declared dependency; bundled via esbuild into main.cjs. | ai | |
| phantom-deps | phantom-dep:@activepieces/piece-http | AI (phantom-deps): Declared dependency; bundled via esbuild into main.cjs. | ai | |
| phantom-deps | phantom-dep:winston | AI (phantom-deps): Declared in package.json; likely bundled into main.cjs via esbuild. | ai | |
| phantom-deps | phantom-dep:@ha-bits/bindings | AI (phantom-deps): Same-org monorepo workspace dep; not directly imported in this UI package. | ai | |
| phantom-deps | phantom-dep:@ha-bits/cortex-core | AI (phantom-deps): Same-org monorepo workspace dep; not directly imported in this UI package. | ai | |
| phantom-deps | phantom-dep:@ha-bits/core | AI (phantom-deps): Same-org monorepo workspace dep; not directly imported in this UI package. | ai | |
| semgrep | semgrep:base64-decode | AI (semgrep): Base64 decode is Basic Auth credential parsing — standard HTTP auth pattern. | ai | |
| semgrep | semgrep:env-spread | AI (semgrep): env-spread in exec wrapper is standard pattern for passing env to child processes; not exfiltration. | ai | |
| semgrep | semgrep:child-process-import | AI (semgrep): child_process used for command execution in server bundle; expected for automation/workflow tooling. | ai | |
| semgrep | semgrep:new-function-constructor | AI (semgrep): new Function used for expression evaluation in workflow engine; input is sandboxed via safeContext. | ai | |
| phantom-deps | phantom-dep:uuid | AI (phantom-deps): Declared dependency; heuristic false positive for config-referenced imports. | ai | |
| phantom-deps | phantom-dep:typescript | AI (phantom-deps): Declared dependency; heuristic false positive for config-referenced imports. | ai | |
| phantom-deps | phantom-dep:express | AI (phantom-deps): Declared dependency; heuristic false positive for config-referenced imports. | ai | |
| phantom-deps | phantom-dep:dotenv | AI (phantom-deps): Declared dependency; heuristic false positive for config-referenced imports. | ai | |
| phantom-deps | phantom-dep:croner | AI (phantom-deps): Declared dependency; heuristic false positive for config-referenced imports. | ai | |
| phantom-deps | phantom-dep:yargs | AI (phantom-deps): Declared dependency; heuristic false positive for config-referenced imports. | ai | |
| phantom-deps | phantom-dep:jszip | AI (phantom-deps): Declared dependency; heuristic false positive for config-referenced imports. | ai | |
| phantom-deps | phantom-dep:yaml | AI (phantom-deps): Declared dependency; heuristic false positive for config-referenced imports. | ai |