registry / @alelouet/ai-delivery-engine / 0.4.0

@alelouet/ai-delivery-engine@0.4.0

AI Delivery Engine orchestrates AI agents to transform project briefs into actionable delivery backlogs.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

No confirmed malicious attack surface. Explicit CLI commands can read project files and create ADE config/context artifacts; optional GitHub helpers invoke the user's gh CLI when directly used.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs an ade command or directly imports a helper.

Impact

Expected project-local output generation; no covert exfiltration or persistence established.

Mechanism

Local project workflow and explicit CLI orchestration.

Rationale

The package is a user-invoked local CLI with no install-time execution or confirmed covert network/credential behavior. Dynamic import is restricted to explicitly discovered project configuration and does not establish malicious execution by the package.

Evidence

package.jsonsrc/cli.jsdist/config/loadConfig.jsdist/cliInit.jsdist/cliFix.jsdist/engine/provider.types.jsade.config.jsonoutputs/context

Decision evidence

public snapshot

AI called this Clean at 96.0% confidence as Benign with low false-positive risk.

Evidence for block

@alelouet/ai-delivery-engine@0.4.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code