w3bs.AccountStart building
PACKAGES / Profullstack

cli-tools

A collection of TypeScript command-line tools for working across many repositories, searching the web, checking domains, handling media and provisioning servers.

ThreatCrush · No malware found
INSTALLw3bs install profullstack.com/cli-tools

No w3bs yet? curl -fsSL https://w3bs.org/install.sh | sh

Get started

What to type once it is installed.

  1. w3bs install profullstack.com/cli-toolsInstall cli-tools and track it for updates
  2. cli-tools config set perplexityStore an API key once (prompted, never echoed) for the commands that need one
  3. gh-prs --orgs <org>List open pull requests across a GitHub org, newest first
  4. ask-web "<question>" --recency monthAnswer a question from a live web search, with numbered sources
  5. vid info <file.mp4>Show a video's duration, streams and size

Every option: cli-tools --help · docs ↗

Malware scan

ThreatCrush found no malware indicators in cli-tools 0.73.0. The other findings below are ordinary code-review notes, not malware.

Scanned
2026-11-03 04:48 UTC · threatcrush 0.13.30
Files
408 (installer + github.com/profullstack/cli-tools@47faec1f10ea)
Findings
15 high · 12 medium · 14 low
41 other findings (not malware)
  • high
    outbound request to a non-constant URLsource/dev2/dev2-site:151py-ssrf-outbound-request · CWE-918
  • high
    outbound request to a non-constant URLsource/dev2/dev2-site:1099py-ssrf-outbound-request · CWE-918
  • high
    outbound request to a non-constant URLsource/dev2/dev2-site:1843py-ssrf-outbound-request · CWE-918
  • high
    network output piped into a shellsource/root-ubuntu.sh:3262sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-ubuntu.sh:3263sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-ubuntu.sh:5168sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-ubuntu.sh:5172sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-w3bs-os.sh:3639sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-w3bs-os.sh:3640sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-w3bs-os.sh:5569sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-w3bs-os.sh:5579sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-w3bs-os.sh:5586sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-w3bs-os.sh:5602sh-remote-script-execution · CWE-494
  • high
    network output piped into a shellsource/root-w3bs-os.sh:5607sh-remote-script-execution · CWE-494
  • high
    download over plain HTTPsource/root-w3bs-os.sh:6289sh-plaintext-download · CWE-319
  • medium
    SQL built from a template literal or f-stringsource/dev2/dev2-site:1326sql-template-interpolation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/dev2/dev2-site:1403sql-template-interpolation · CWE-89
  • medium
    network output piped into a shellsource/root-ubuntu.sh:5376sh-remote-script-execution · CWE-494
  • medium
    regex with nested unbounded quantifierssource/src/domain-free.ts:56redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/src/emoji.ts:167redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/src/icon.ts:166redos-nested-quantifier · CWE-1333
  • medium
    regex with nested unbounded quantifierssource/src/mail.ts:1060redos-nested-quantifier · CWE-1333
  • medium
    SQL built from a template literal or f-stringsource/src/users-dump.ts:487sql-template-interpolation · CWE-89
  • medium
    SQL assembled by concatenation or interpolationsource/src/users-dump.ts:507sql-string-concatenation · CWE-89
  • medium
    SQL built from a template literal or f-stringsource/src/users-dump.ts:540sql-template-interpolation · CWE-89
  • medium
    SQL assembled by concatenation or interpolationsource/src/users-dump.ts:574sql-string-concatenation · CWE-89
  • medium
    regex with nested unbounded quantifierssource/src/wcag.ts:556redos-nested-quantifier · CWE-1333
  • low
    Hardcoded Credentialsource/src/credentials.ts:41secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/credentials.ts:58secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/credentials.ts:61secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/credentials.ts:66secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/user-export.ts:689secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/src/user-export.ts:695secret-generic-credential · CWE-798
  • low
    Generic API Keysource/test/credentials.test.ts:208secret-generic-api-key · CWE-798
  • low
    Hardcoded Credentialsource/test/mail.test.ts:141secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/test/proxy.test.ts:69secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/test/proxy.test.ts:85secret-generic-credential · CWE-798
  • low
    Hardcoded Credentialsource/test/shorten.test.ts:36secret-generic-credential · CWE-798
  • low
    Database URL with credentialssource/test/users-dump.test.ts:108secret-database-url · CWE-798
  • low
    Database URL with credentialssource/test/users-dump.test.ts:119secret-database-url · CWE-798
  • low
    Database URL with credentialssource/test/users-dump.test.ts:120secret-database-url · CWE-798

Badge for your README

ThreatCrush: No malware found

[![ThreatCrush scan](https://w3bs.org/api/packages/profullstack.com/cli-tools/badge.svg)](https://w3bs.org/packages/profullstack.com/cli-tools)