@mandujs/cli

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

[Accepted risk] Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: oddeye.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 116 | 117 | it("rejects relative URLs (no scheme)", () => { > 118 | const rendered = `${ESC}]8;;../etc/passwd${OSC_ST}path${ESC}]8;;${OSC_ST}`; 119 | const out = sanitizeOsc8(rendered); 120 | expect(out).not.toContain("../etc/passwd");

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 118 | const rendered = `${ESC}]8;;../etc/passwd${OSC_ST}path${ESC}]8;;${OSC_ST}`; 119 | const out = sanitizeOsc8(rendered); > 120 | expect(out).not.toContain("../etc/passwd"); 121 | expect(out).toContain("path"); 122 | });

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 52 | * the default allow-list to `http`/`https` only because the same renderer 53 | * is used for AI chat output where attacker-influenced markdown could > 54 | * smuggle `file:///etc/passwd` links. Callers that legitimately display 55 | * local documentation links (e.g. `mandu docs`) must opt in explicitly. 56 | * Default: `false`.

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 123 | * local-documentation links, but the same renderer also outputs AI chat 124 | * responses where attacker-influenced markdown could smuggle a clickable > 125 | * `file:///etc/passwd` link. Callers that legitimately render local docs 126 | * must pass `{ allowFileScheme: true }` explicitly. 127 | */

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 286 | }; 287 | // /preset expects alphanumeric — "../etc" is rejected inside loadPreset > 288 | const result = await handleSlashCommand("/preset ../etc/shadow", state); 289 | // Should surface as an error OR a soft continue with a failure message, 290 | // never a successful load.

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 361 | it("/save rejects absolute paths with AI_PATH_ESCAPE", async () => { 362 | const state = makeState(tmpDir); > 363 | const evilPath = path.isAbsolute("/etc/passwd") 364 | ? "/etc/passwd" 365 | : "/tmp/evil.json";

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 362 | const state = makeState(tmpDir); 363 | const evilPath = path.isAbsolute("/etc/passwd") > 364 | ? "/etc/passwd" 365 | : "/tmp/evil.json"; 366 | const result = await handleSlashCommand(`/save ${evilPath}`, state);

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 382 | it("/save rejects '..' traversal with AI_PATH_ESCAPE", async () => { 383 | const state = makeState(tmpDir); > 384 | const result = await handleSlashCommand("/save ../../../etc/passwd", state); 385 | expect(result.kind).toBe("error"); 386 | if (result.kind === "error") {

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 391 | it("/load rejects absolute paths with AI_PATH_ESCAPE", async () => { 392 | const state = makeState(tmpDir); > 393 | const result = await handleSlashCommand("/load /etc/shadow", state); 394 | expect(result.kind).toBe("error"); 395 | if (result.kind === "error") {

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 409 | it("/system rejects absolute paths with AI_PATH_ESCAPE", async () => { 410 | const state = makeState(tmpDir); > 411 | const result = await handleSlashCommand("/system /etc/passwd", state); 412 | expect(result.kind).toBe("error"); 413 | if (result.kind === "error") {

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 418 | it("/system rejects '..' traversal with AI_PATH_ESCAPE", async () => { 419 | const state = makeState(tmpDir); > 420 | const result = await handleSlashCommand("/system ../../../etc/passwd", state); 421 | expect(result.kind).toBe("error"); 422 | if (result.kind === "error") {

Spreading entire process.env into an object — may capture all secrets 185 | cwd: dir, 186 | stdio: ["ignore", "pipe", "pipe"], > 187 | env: { ...process.env, MANDU_DEBUG_BOOT: "1" }, 188 | }); 189 | try {

Spreading entire process.env into an object — may capture all secrets 241 | cwd: dir, 242 | stdio: ["ignore", "pipe", "pipe"], > 243 | env: { ...process.env, MANDU_DEBUG_BOOT: "1" }, 244 | }); 245 | try {

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux 152 | expect(resolveSkillPayload("mandu-nonexistent-skill")).toBeNull(); 153 | expect(resolveSkillPayload("")).toBeNull(); > 154 | expect(resolveSkillPayload("../etc/passwd")).toBeNull(); 155 | }); 156 |

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: oddeye.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.