← Home

@vibe-agent-toolkit/resources

npm Repository Homepage
39
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures gitHead linked

Maintainers

jeffrdutton

Keywords

markdownvalidationlinksresourcesagent-toolkit

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
semgrep semgrep:etc-passwd-access AI (semgrep): Matches inside a comment describing fallback logic, not actual /etc/passwd access. ai
phantom-deps phantom-dep:semver AI (phantom-deps): Used in config/type context, heuristic false positive. ai
dependencies unvetted-dep:markdown-link-check AI (dependencies): Legitimate, well-known markdown link checking library; appropriate for this package's stated purpose. ai
dependencies unvetted-dep:@vibe-agent-toolkit/utils AI (dependencies): Sibling package in the same monorepo/toolkit; expected internal dependency. ai
dependencies unvetted-dep:@vibe-agent-toolkit/agent-schema AI (dependencies): Sibling package in the same monorepo/toolkit; expected internal dependency. ai

Versions (showing 39 of 39)

Version Deps Published
0.1.40 16 / 7
0.1.39 16 / 7
0.1.38 15 / 7
0.1.37 14 / 8
0.1.36 14 / 8
0.1.35 14 / 8
0.1.34 13 / 7
0.1.33 13 / 7
0.1.32 13 / 7
0.1.31 13 / 7
0.1.30 13 / 7
0.1.29 13 / 7
0.1.28 13 / 7
0.1.27 13 / 7
0.1.26 13 / 7
0.1.25 13 / 7
0.1.24 13 / 7
0.1.23 13 / 7
0.1.22 13 / 7
0.1.21 13 / 7
0.1.20 13 / 7
0.1.19 13 / 7
0.1.18 13 / 7
0.1.15 12 / 7
0.1.14 11 / 7
0.1.13 11 / 7
0.1.12 11 / 7
0.1.11 10 / 7
0.1.10 10 / 7
0.1.9 10 / 7
0.1.8 10 / 7
0.1.7 10 / 7
0.1.6 10 / 7
0.1.5 10 / 7
0.1.4 10 / 7
0.1.3 10 / 7
0.1.2 8 / 6
0.1.1 8 / 6
0.1.0 8 / 6

v0.1.40

1 finding
INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.

v0.1.39

3 findings
HIGH etc-passwd-access: src/external-link-validator.ts:19 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux (matched inside a comment — likely documentation, not executed code) Source: https://github.com/jdutton/vibe-agent-toolkit/blob/f70d4720b5c7f53e6d83c83688fab59a1d8cd86b/src/external-link-validator.ts#L19 17 | /** 18 | * Resolve the OS user for cache scoping. Falls back through several layers > 19 | * because `os.userInfo()` throws when the running user has no /etc/passwd 20 | * entry (common in container environments) — that's recoverable, not fatal. 21 | */

HIGH etc-passwd-access: src/external-link-validator.ts:27 semgrep

Accessing /etc/passwd or /etc/shadow — credential harvesting on Linux (matched inside a comment — likely documentation, not executed code) Source: https://github.com/jdutton/vibe-agent-toolkit/blob/f70d4720b5c7f53e6d83c83688fab59a1d8cd86b/src/external-link-validator.ts#L27 25 | if (u !== '') return u; 26 | } catch { > 27 | // userInfo() throws when the running user has no /etc/passwd entry — 28 | // recover via env vars below. 29 | }

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.