registry / @alelouet/ai-delivery-engine / 0.3.0

@alelouet/ai-delivery-engine@0.3.0

AI Delivery Engine orchestrates AI agents to transform project briefs into actionable delivery backlogs.

AI Security Review

scanned 4h ago · by lpm-firewall-ai

No install- or import-time attack behavior is established. Separately importable GitHub helpers can shell out through gh with insufficient input escaping.

Static reason

No blocking static signals were detected.

Trigger

A consumer directly invokes dist/github helpers with attacker-controlled repository, branch, label, title, or issue values.

Impact

Potential local command injection in an integrating application's user context.

Mechanism

shell-command construction around gh CLI

Rationale

No evidence supports malicious intent, persistence, exfiltration, or install-time mutation. The shipped GitHub integration nevertheless exposes a concrete command-injection risk for direct consumers using untrusted values.

Evidence

package.jsonsrc/cli.jsdist/github/createPR.jsdist/github/postComment.jsdist/github/fetchIssues.jsdist/cli/paths.jsdist/cli/assertSafePath.js

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Critical Vulnerability with low false-positive risk.

Evidence for warning

dist/github/createPR.js builds a shell command for execSync from repo/base/labels inputs.

@alelouet/ai-delivery-engine@0.3.0

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code