registry / @cat-factory/kernel / 0.90.0

@cat-factory/kernel@0.90.0

Shared vocabulary, pure logic, and port interfaces for the Agent Architecture Board.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface is established. The package is a compiled ESM kernel of pure logic, type-like ports, registries, and helper factories with no lifecycle execution.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

Importing package entrypoint or calling exported helpers

Impact

No credential harvesting, exfiltration, persistence, or unconsented agent control mutation found

Mechanism

Barrel exports and caller-invoked pure/domain helper functions

Rationale

Static source inspection shows scanner hits are noisy: the flagged Unicode is an optional BOM matcher in Markdown front-matter parsing, and dangerous primitives are absent or only caller-supplied port abstractions. No install-time/import-time execution, exfiltration, persistence, destructive action, or AI-agent control hijack is present.

Evidence

package.jsondist/index.jsdist/domain/doc-quality-logic.jsdist/domain/models.jsdist/shared/atlassian.logic.jsdist/ports/binary-artifacts.js

Decision evidence

public snapshot

AI called this Clean at 93.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/domain/doc-quality-logic.js contains an embedded U+FEFF only as an optional BOM in a front-matter regex, not bidi control flow.
dist/ports/binary-artifacts.js can store/delete caller-supplied blobs through injected backends, but no filesystem or network backend is included here.

Evidence against

package.json has no preinstall/install/postinstall lifecycle scripts and exposes only dist/index.js.
dist/index.js is a barrel export of domain logic, ports, and shared helpers; no import-time execution beyond exports.
dist/domain/doc-quality-logic.js is pure Markdown structure parsing with no I/O, process, network, eval, or child_process use.
rg found no child_process, eval/Function, npmrc, filesystem reads/writes, or fetch implementations in runtime JS.
Network URLs in dist/domain/models.js are static model provider configuration, not contacted by this package.

Behavioral surface

Source

ChildProcess

Supply chain

HighEntropyStringsUrlStrings

Manifest

NoLicense

scanned 119 file(s), 183 KB of source, external domains: api.deepseek.com, api.moonshot.ai, api.z.ai

Source & flagged code

2 flagged

dist/domain/doc-quality-logic.jsView file

Lines 1-29javascript

1// Pure structural analysis of a drafted Markdown document, shared by the `doc-quality`

2// gate's provider and its unit tests. Lives in kernel (like `gate-logic.ts`) so the check

3// is a deterministic, runtime-neutral reduction over the document text + the required

4// section list — the gate's provider (in `@cat-factory/server`) resolves the section list

5// from the WS1 template (`docTemplateFor`, the single source of truth) and the file bytes

6// via the checkout-free `RepoFiles` port, then calls this to classify. No I/O here.

7/** Strip a leading YAML front-matter block (`--- … ---`) — it is config, not document prose. */

8function stripFrontMatter(content) {

9 const m = content.match(/^?---[ \t]*\r?\n[\s\S]*?\r?\n---[ \t]*(?:\r?\n|$)/);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/domain/doc-quality-logic.jsView on unpkg · L9

10 return m ? content.slice(m[0].length) : content;

11}

12/** Strip fenced code blocks (``` / ~~~) so their contents aren't parsed as headings/placeholders. */

13function stripFencedCode(content) {

14 const lines = content.split(/\r?\n/);

15 const out = [];

16 let fence = null;

17 for (const line of lines) {

18 const open = line.match(/^\s*(`{3,}|~{3,})/);

19 if (fence) {

20 // Inside a fence: a matching (or longer) fence of the same char closes it.

21 if (open && open[1][0] === fence[0] && open[1].length >= fence.length)

22 fence = null;

23 continue;

24 }

25 if (open) {

26 fence = open[1];

27 continue;

28 }

29 out.push(line);

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/domain/doc-quality-logic.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/domain/doc-quality-logic.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/domain/doc-quality-logic.jsView file

9contains invisible/control Unicode U+FEFF (zero width no-break space) const m = content.match(/^<U+FEFF>?---[ \t]*\r?\n[\s\S]*?\r?\n---[ \t]*(?:\r?\n|$)/);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/domain/doc-quality-logic.jsView on unpkg · L9

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/domain/doc-quality-logic.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/domain/doc-quality-logic.jsView on unpkg

Findings

2 Critical1 Medium4 Low

CriticalTrojan Source Unicodedist/domain/doc-quality-logic.js

CriticalTrigger Reachable Dangerous Capabilitydist/domain/doc-quality-logic.js

MediumStructural Risk Force Deep Review

LowScripts Present

LowHigh Entropy Strings

LowUrl Strings

LowNo License

Source & flagged code

2 flagged

dist/domain/doc-quality-logic.jsView file

Lines 1-29javascript

1// Pure structural analysis of a drafted Markdown document, shared by the `doc-quality`

2// gate's provider and its unit tests. Lives in kernel (like `gate-logic.ts`) so the check

3// is a deterministic, runtime-neutral reduction over the document text + the required

4// section list — the gate's provider (in `@cat-factory/server`) resolves the section list

5// from the WS1 template (`docTemplateFor`, the single source of truth) and the file bytes

6// via the checkout-free `RepoFiles` port, then calls this to classify. No I/O here.

7/** Strip a leading YAML front-matter block (`--- … ---`) — it is config, not document prose. */

8function stripFrontMatter(content) {

9 const m = content.match(/^?---[ \t]*\r?\n[\s\S]*?\r?\n---[ \t]*(?:\r?\n|$)/);

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

dist/domain/doc-quality-logic.jsView on unpkg · L9

10 return m ? content.slice(m[0].length) : content;

11}

12/** Strip fenced code blocks (``` / ~~~) so their contents aren't parsed as headings/placeholders. */

13function stripFencedCode(content) {

14 const lines = content.split(/\r?\n/);

15 const out = [];

16 let fence = null;

17 for (const line of lines) {

18 const open = line.match(/^\s*(`{3,}|~{3,})/);

19 if (fence) {

20 // Inside a fence: a matching (or longer) fence of the same char closes it.

21 if (open && open[1][0] === fence[0] && open[1].length >= fence.length)

22 fence = null;

23 continue;

24 }

25 if (open) {

26 fence = open[1];

27 continue;

28 }

29 out.push(line);

•Trigger-reachable chain: manifest.main -> dist/index.js -> dist/domain/doc-quality-logic.js Reachable file contains a blocking source-risk pattern.

Critical

Trigger Reachable Dangerous Capability

A package entrypoint or install-time lifecycle script reaches a source file with blocking dangerous behavior.

dist/domain/doc-quality-logic.jsView on unpkg