registry / @dawipong/opcflow / 0.6.0

@dawipong/opcflow@0.6.0

Spec-anchored, drift-enforced execution layer for AI coding agents — artifact DAG, trust gates, multi-role pipeline; generates agents/MCP/hooks for Claude Code, Codex, OpenCode & Cursor.

AI Security Review

scanned 3h ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a CLI/workbench that can explicitly generate project agent configs, MCP registration, hooks, docs, and a local database as its advertised function.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs opcflow init, gen-agents, install-hooks, serve, mcp, or related CLI commands.

Impact

Project files may be created or updated for opcflow workflow integration; no unconsented install-time mutation or exfiltration found.

Mechanism

Explicit user-command project scaffolding and workflow automation

Rationale

Source inspection shows potentially sensitive primitives are user-invoked and aligned with the package's documented AI-workflow scaffolding purpose. There is no install-time execution, credential harvesting, remote code loading, or unconsented broad AI-agent control-surface mutation.

Evidence

package.jsondist/cli.mjsREADME.en.mdweb/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsworkbench.config.jsondocs/.workbench/.mcp.json.claude/settings.json.codex/config.tomlopencode.json.opencode/plugins/opcflow.ts.cursor/mcp.json.cursor/hooks.json.git/hooks/post-commit.git/hooks/prepare-commit-msg

Network endpoints2

models.dev/api.json127.0.0.1:5620

Decision evidence

public snapshot

AI called this Clean at 90.0% confidence as Benign with low false-positive risk.

Evidence for block

dist/cli.mjs can write AI-agent MCP/hook config for Claude, Codex, OpenCode, and Cursor during explicit init/gen commands.
dist/cli.mjs installs git hooks only via init when .git exists or explicit install-hooks command.
dist/cli.mjs fetches https://models.dev/api.json during interactive init model selection.

Evidence against

package.json has no preinstall/install/postinstall; only prepublishOnly build for publisher workflow.
Agent/MCP/hook writes are documented package purpose in README.en.md and are activated by user CLI commands, not install/import.
dist/cli.mjs child_process usage is package-aligned git/gh operations or generated local hook forwarding, not remote payload execution.
No credential harvesting or exfiltration endpoint found; network is models.dev metadata and local serve/SSE.
Scanner Unicode hit in web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.js appears bundled parser/whitespace handling, not Trojan Source control flow.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 96 file(s), 4.68 MB of source, external domains: 127.0.0.1, cdn.jsdelivr.net, chevrotain.io, en.wikipedia.org, github.com, langium.org, opencode.ai, reactflow.dev, reactjs.org, www.w3.org

Source & flagged code

2 flagged

dist/cli.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res, err) => function __init() {

5 if (err) throw err[0];

6 try {

7 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

8 } catch (e) {

9 throw err = [e], e;

10 }

11};

12var __export = (target, all) => {

13 for (var name in all)

14 __defProp(target, name, { get: all[name], enumerable: true });

15};

17// core/config.ts

18import { existsSync, readFileSync } from "node:fs";

19import { dirname, join, resolve } from "node:path";

20function findProjectRoot(from = process.cwd()) {

21 let dir = resolve(from);

22 while (true) {

23 if (existsSync(join(dir, CONFIG_FILENAME))) return dir;

24 const parent = dirname(dir);

25 if (parent === dir) return resolve(from);

26 dir = parent;

27 }

28}

29function loadConfig(root) {

30 const file = join(root, CONFIG_FILENAME);

31 if (!existsSync(file)) return { ...DEFAULTS };

32 const raw = JSON.parse(

33 readFileSync(file, "utf-8")

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L19

34 );

35 return {

36 ...DEFAULTS,

37 ...raw,

38 docs: { ...DEFAULTS.docs, ...raw.docs },

39 gates: { ...DEFAULTS.gates, ...raw.gates },

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView file

46contains invisible/control Unicode U+FEFF (zero width no-break space) \r \v \xA0  \u2028\u2029  　<U+FEFF>`.split(``);function Da(e){let t=typeof e==`string`?new RegExp(e):e;return Ea.some(e=>t.test(e))}o(Da,`isWhitespace`);function Oa(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}o(Oa,`escapeReg

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView on unpkg · L46

Source & flagged code

2 flagged · loading source

dist/cli.mjsView file

19import { dirname, join, resolve } from "node:path"; L20: function findProjectRoot(from = process.cwd()) { L21: let dir = resolve(from); ... L31: if (!existsSync(file)) return { ...DEFAULTS }; L32: const raw = JSON.parse( L33: readFileSync(file, "utf-8") ... L348: IGNORE_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".workbench"]); L349: IGNORE_FILES = /* @__PURE__ */ new Set(["pnpm-lock.yaml", "package-lock.json", "yarn.lock", ".DS_Store", "Thumbs.db"]); L350: } ... L514: }), L515: respondBlocked: (msg) => ({ exitCode: 2, stderr: msg }), L516: formatModel: (_providerId, modelId) => modelId,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L19

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView on unpkg · L46

Findings

1 Critical4 Medium7 Low

CriticalTrojan Source Unicodeweb/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/cli.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/cli.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res, err) => function __init() {

5 if (err) throw err[0];

6 try {

7 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

8 } catch (e) {

9 throw err = [e], e;

10 }

11};

12var __export = (target, all) => {

13 for (var name in all)

14 __defProp(target, name, { get: all[name], enumerable: true });

15};

17// core/config.ts

18import { existsSync, readFileSync } from "node:fs";

19import { dirname, join, resolve } from "node:path";

20function findProjectRoot(from = process.cwd()) {

21 let dir = resolve(from);

22 while (true) {

23 if (existsSync(join(dir, CONFIG_FILENAME))) return dir;

24 const parent = dirname(dir);

25 if (parent === dir) return resolve(from);

26 dir = parent;

27 }

28}

29function loadConfig(root) {

30 const file = join(root, CONFIG_FILENAME);

31 if (!existsSync(file)) return { ...DEFAULTS };

32 const raw = JSON.parse(

33 readFileSync(file, "utf-8")

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L19

34 );

35 return {

36 ...DEFAULTS,

37 ...raw,

38 docs: { ...DEFAULTS.docs, ...raw.docs },

39 gates: { ...DEFAULTS.gates, ...raw.gates },

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView on unpkg · L46