registry / @abblor/agent-os / 0.14.0

@abblor/agent-os@0.14.0

⚠ Under review

Skills, workflows, memory, specs, constitution, hooks, and rules for AI coding agents working on abblor_repos projects.

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis completed at 0.0% confidence. No malicious behavior was detected; 16 low-signal pattern(s) were surfaced and cleared.

Static reason

Automated AI review exhausted its retry budget. This package remains unresolved and must not warn or block users.

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystemNetworkShellWebSocket

Supply chain

HighEntropyStringsUrlStrings

ManifestNo manifest risk signals triggered.

scanned 11 file(s), 183 KB of source, external domains: www.designtokens.org

Source & flagged code

9 flagged

package.jsonView file

Lines 1-34json

2 "name": "@abblor/agent-os",

3 "version": "0.14.0",

4 "description": "Skills, workflows, memory, specs, constitution, hooks, and rules for AI coding agents working on abblor_repos projects.",

5 "license": "MIT",

6 "type": "module",

7 "bin": {

8 "agent-os": "bin/cli.js"

9 },

10 "scripts": {

11 "build:web-ui": "node skills/web-ui/scripts/build.mjs",

12 "test:web-ui": "node skills/web-ui/scripts/validate.mjs",

13 "test": "node skills/web-ui/scripts/validate.mjs && node --test",

14 "postinstall": "node bin/cli.js postinstall"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L14

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg · L14

15 },

16 "files": [

17 "bin",

18 "skills",

19 "workflows",

20 "constitution",

21 "rules",

22 "specs",

23 "memory",

24 "hooks",

25 "ci",

26 "README.md",

27 "NOTICE.md",

28 "LICENSE",

29 "CHANGELOG.md"

30 ],

31 "publishConfig": {

32 "access": "public"

33 },

34 "engines": {

skills/web-ui/scripts/validate.mjsView file

Lines 1-29javascript

1import { execFileSync } from 'node:child_process';

2import { createRequire } from 'node:module';

3import { mkdtemp, readFile, readdir, rm, stat } from 'node:fs/promises';

4import { tmpdir } from 'node:os'

skills/brainstorming/scripts/server.cjsView file

Lines 1-21javascript

1const crypto = require('crypto');

2const http = require('http');

3const fs =

bin/cli.jsView file

Lines 1-38javascript

1#!/usr/bin/env node

2// @abblor/agent-os CLI — `link` and `init` subcommands.

3// Pure Node core modules only, no dependencies, so the package stays tiny.

5import fs from 'node:fs';

6import path from 'node:path';

7import readline from

hooks/agent/guard-bash.shView file

•path = hooks/agent/guard-bash.sh kind = build_helper sizeBytes = 5621 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

hooks/agent/guard-bash.shView on unpkg

skills/writing-skills/render-graphs.jsView file

•matchType = normalized_sha256 matchedPackage = @cliphijack/santaclaude@1.0.122 matchedPath = bundled-superpowers/skills/writing-skills/render-graphs.js matchedIdentity = npm:QGNsaXBoaWphY2svc2FudGFjbGF1ZGU:1.0.122 similarity = 1.000 summary = normalized source hash matched finalized malicious source

High

Known Malware Source Similarity

Source file is highly similar to a previously finalized malicious package; route for source-aware review.

skills/writing-skills/render-graphs.jsView on unpkg

Source & flagged code

9 flagged · loading source

package.jsonView file

•scripts.postinstall = node bin/cli.js postinstall

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

•scripts.postinstall = node bin/cli.js postinstall

Medium

Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg

skills/web-ui/scripts/validate.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @abblor/agent-os@0.7.0 matchedIdentity = npm:QGFiYmxvci9hZ2VudC1vcw:0.7.0 similarity = 0.833 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

Findings

1 Critical4 High6 Medium5 Low

CriticalAi Agent Control Hijackbin/cli.js

HighInstall Time Lifecycle Scriptspackage.json

HighKnown Malware Source Similarityskills/writing-skills/render-graphs.js

HighKnown Malware Source Similarityskills/brainstorming/scripts/server.cjs

HighPrevious Version Dangerous Deltaskills/web-ui/scripts/validate.mjs

MediumAmbiguous Install Lifecycle Scriptpackage.json

MediumDynamic Requireskills/web-ui/scripts/validate.mjs

MediumNetwork

MediumEnvironment Vars

MediumShips Build Helperhooks/agent/guard-bash.sh

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to @abblor/agent-os@0.14.0.

See all versions of @abblor/agent-os for other recorded verdicts.

Review the evidence and your use of @abblor/agent-os@0.14.0 before allowing it. Restrict the permissions described in this report.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.

Evidence last updated: 2026-09-19 07:08:34.880Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.