Loading npm security reports…
Documentation-First SDLC protocol for Claude Code, Gemini CLI, Google Antigravity and Codex with risk triage, Vision governance, installed support files and optional devPNT integration.
Static analysis flagged 11 finding(s) at 93.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.
Package defines install-time lifecycle scripts.
Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/lib.jsView on unpkg · L12Package ships non-JavaScript build or shell helper files.
skills/agentic-sdlc-skill/scripts/sdlc_check.pyView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
scripts/init.jsView on unpkgThis report applies to @antoneeo/agentic-sdlc-skill@1.28.0.
See version security history for other recorded verdicts.
Evidence last updated: .
Package defines install-time lifecycle scripts.
package.jsonView on unpkg · L24Install-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkg · L24Package ships non-JavaScript build or shell helper files.
skills/agentic-sdlc-skill/scripts/sdlc_check.pyView on unpkgThis package version adds a dangerous source file absent from the previous stored version; route for source-aware review.
scripts/init.jsView on unpkgSource creates an unconsented AI-agent control surface through install-time mutation or a default unauthenticated remote skill channel.
scripts/lib.jsView on unpkg · L12