source: `

const cp = require("child_process");

cp.spawn("node", ["server.js"]);

`,

expected: { ruleId: "dangerous-exec", severity: "critical" as const },

},

{

name: "detects child_process namespaced exec usage",

source: `

const cp = require("child_process");

cp.exec("node server.js");

`,

expected: { ruleId: "dangerous-exec", severity: "critical" as const },

},

expect(findings.some((f) => f.ruleId === "dangerous-exec")).toBe(false);

});

it("does not flag RegExp.exec when child_process appears elsewhere", () => {

const source = `

import type { ExecOptions } from "child_process";

const options: ExecOptions = {};

const match = /^keychain:(.+)$/.exec(value);

`;

const findings = scanSource(source, "plugin.ts");

expect(findings.some((f) => f.ruleId === "dangerous-exec")).toBe(false);

});

it("returns empty array for clean plugin code", () => {

const source = `

export function greet(name: string): string {

return `${evidence.slice(0, maxLen)}…`;

}

function isBenignMemberExecMatch(line: string, match: RegExpExecArray): boolean {

const command = match[1];

if (command !== "exec") {

return false;

}

const matchIndex = match.index;

if (matchIndex <= 0 || line[matchIndex - 1] !== ".") {

return false;

}

return !/\b(?:cp|childProcess|child_process)\s*\.\s*exec\s*\(/.test(line);

}

export function scanSource(source: string, filePath: string): SkillScanFinding[] {

const findings: SkillScanFinding[] = [];

const lines = source.split("\n");

continue;

}

if (rule.ruleId === "dangerous-exec" && isBenignMemberExecMatch(line, match)) {

continue;

}

// Special handling for suspicious-network: check port

if (rule.ruleId === "suspicious-network") {

const port = Number.parseInt(match[1], 10);