registry / @ai-content-space/loopx / 0.4.3

@ai-content-space/loopx@0.4.3

Skill-first workflow suite for agentic coding assistants

Static Scan Results

scanned 1mo ago · by rust-scanner

Static analysis flagged 12 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 20 file(s), 224 KB of source, external domains: registry.npmjs.org

Source & flagged code

4 flagged

package.jsonView file

Lines 54-78json

54 "skills/plan-reviewer/",

55 "skills/refactor-plan/",

56 "skills/requirement-analyzer/",

57 "skills/review/",

58 "skills/sql-style/",

59 "skills/spec/",

60 "skills/subagent-exec/",

61 "skills/tdd/",

62 "skills/using-git-worktrees/",

63 "skills/verify/",

64 "templates/spec.md",

65 "templates/intake-clarification.md",

66 "templates/intake-requirements.md",

67 "plugins/loopx/",

68 "!plugins/loopx/scripts/plugin-install.test.mjs"

69 ],

70 "publishConfig": {

71 "access": "public"

72 },

73 "scripts": {

74 "postinstall": "node scripts/install-skills.mjs",

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L74

75 "test": "node scripts/verify-skills.mjs && node --test test/*.test.mjs"

76 }

77}

src/install-discovery.mjsView file

Lines 74-114javascript

74].join('\n');

75const TEMPLATE_BASELINE_SCHEMA_VERSION = Number.parseInt('1', 10);

76const LOOPX_GOVERNED_SOURCE_ITEMS = [

skills/debug/find-polluter.shView file

•path = skills/debug/find-polluter.sh kind = build_helper sizeBytes = 1528 magicHex = [redacted]

Medium

Ships Build Helper

Package ships non-JavaScript build or shell helper files.

skills/debug/find-polluter.shView on unpkg

src/cli.mjsView file

•matchType = previous_version_dangerous_delta matchedPackage = @ai-content-space/loopx@0.4.1 matchedIdentity = npm:QGFpLWNvbnRlbnQtc3BhY2UvbG9vcHg:0.4.1 similarity = 0.700 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

src/cli.mjsView on unpkg

Source & flagged code

4 flagged · loading source

package.jsonView file

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code