registry / @adityaaria/spark / 6.0.16

@adityaaria/spark@6.0.16

SPARK skills and runtime bootstrap for coding agents

AI Security Review

scanned 22d ago · by lpm-firewall-ai

No confirmed malicious attack surface was established. The package is an agent skills/plugin installer with explicit CLI installation and runtime helper code aligned to its stated purpose.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs `spark install`, loads the OpenCode plugin, or invokes the brainstorming companion skill.

Impact

Installs or exposes SPARK skills/hooks in agent config and serves a local authenticated companion UI; no source evidence of covert execution, exfiltration, persistence, or destructive behavior.

Mechanism

User-invoked agent plugin/skill bootstrap and local companion server

Rationale

Static inspection found powerful but package-aligned agent installation and local companion functionality gated by user invocation, not install-time or import-time malicious behavior. The OpenCode bootstrap modifies agent context, but it ships as the declared plugin entrypoint and does not show unconsented lifecycle mutation or data theft.

Evidence

package.jsonbin/spark.jssrc/cli/index.jssrc/cli/install.jsbin/spark-install.sh.opencode/plugins/spark.jsskills/brainstorming/scripts/server.cjs.claude.codex.cursor.kimi.opencode.piskills/brainstorming/session content/state under BRAINSTORM_DIR or /tmp/brainstorm

@adityaaria/spark@6.0.16

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code