registry / @dawipong/opcflow / 0.8.0

@dawipong/opcflow@0.8.0

Spec-anchored, drift-enforced execution layer for AI coding agents — artifact DAG, trust gates, multi-role pipeline; generates agents/MCP/hooks for Claude Code, Codex, OpenCode & Cursor.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Review flagged AI-agent configuration or capability changes. This remains warn-only unless evidence shows foreign-agent hijack through preinstall/install/postinstall, hidden persistence, exfiltration, remote code execution, or other concrete malicious behavior.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

User runs opcflow init, gen-agents, install-hooks, mcp, serve, or hook commands.

Impact

Project agent behavior and git hooks can be modified as part of the tool workflow; no stealth install-time execution or exfiltration was found.

Mechanism

Explicit CLI writes agent configs, MCP entries, hooks, project DB, and scaffold files.

Rationale

The package has sensitive AI-agent lifecycle capabilities, but they are explicit user-command setup behavior and match the documented purpose. Because there is no unconsented install-time mutation or concrete malicious chain, it should not be publish-blocked.

Evidence

package.jsondist/cli.mjsREADME.mdREADME.en.mdtemplates/agents/en/developer.mdpreset/package.jsonworkbench.config.json.mcp.json.claude/settings.json.claude/agents/*.codex/config.toml.codex/agents/*.cursor/mcp.json.cursor/hooks.json.cursor/agents/*.opencode/plugins/opcflow.ts.opencode/agents/*.git/hooks/post-commit.git/hooks/prepare-commit-msg.workbench/workbench.dbdocs/*

Network endpoints1

models.dev/api.json

Decision evidence

public snapshot

AI called this Suspicious at 86.0% confidence as Dangerous Capability with medium false-positive risk.

Evidence for warning

dist/cli.mjs user-invoked init writes AI agent/MCP/hook configs under .claude, .codex, .cursor, and .opencode.
dist/cli.mjs install-hooks command can write .git/hooks/post-commit and prepare-commit-msg.
dist/cli.mjs hook commands read agent hook stdin and project env vars to enforce/observe write gates.
dist/cli.mjs promptInit fetches https://models.dev/api.json to populate model choices.

Evidence against

package.json has no preinstall/install/postinstall; only prepublishOnly build, so no npm install-time mutation.
dist/cli.mjs AI-agent config writes occur through explicit CLI commands such as init/gen-agents/install-hooks, not import-time.
dist/cli.mjs network use is limited to models.dev model metadata during interactive init; no credential upload seen.
dist/cli.mjs shell execution is package-aligned: git/gh commands and configured machine checks, not remote payload execution.
Trojan-source hint not confirmed in inspected files; bidi/invisible character scan returned no matches for the flagged asset or CLI.

Behavioral surface

Source

ChildProcessCryptoEnvironmentVarsFilesystemNetworkShell

Supply chain

HighEntropyStringsMinifiedObfuscatedProtestwareUrlStrings

ManifestNo manifest risk signals triggered.

scanned 96 file(s), 4.69 MB of source, external domains: 127.0.0.1, cdn.jsdelivr.net, chevrotain.io, en.wikipedia.org, github.com, langium.org, opencode.ai, reactflow.dev, reactjs.org, www.w3.org

Source & flagged code

2 flagged

dist/cli.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res, err) => function __init() {

5 if (err) throw err[0];

6 try {

7 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

8 } catch (e) {

9 throw err = [e], e;

10 }

11};

12var __export = (target, all) => {

13 for (var name in all)

14 __defProp(target, name, { get: all[name], enumerable: true });

15};

17// core/config.ts

18import { existsSync, readFileSync } from "node:fs";

19import { dirname, join, resolve } from "node:path";

20function findProjectRoot(from = process.cwd()) {

21 let dir = resolve(from);

22 while (true) {

23 if (existsSync(join(dir, CONFIG_FILENAME))) return dir;

24 const parent = dirname(dir);

25 if (parent === dir) return resolve(from);

26 dir = parent;

27 }

28}

29function loadConfig(root) {

30 const file = join(root, CONFIG_FILENAME);

31 if (!existsSync(file)) return { ...DEFAULTS };

32 const raw = JSON.parse(

33 readFileSync(file, "utf-8")

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L19

34 );

35 return {

36 ...DEFAULTS,

37 ...raw,

38 docs: { ...DEFAULTS.docs, ...raw.docs },

39 gates: { ...DEFAULTS.gates, ...raw.gates },

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView file

46contains invisible/control Unicode U+FEFF (zero width no-break space) \r \v \xA0  \u2028\u2029  　<U+FEFF>`.split(``);function Da(e){let t=typeof e==`string`?new RegExp(e):e;return Ea.some(e=>t.test(e))}o(Da,`isWhitespace`);function Oa(e){return e.replace(/[.*+?^${}()|[\]\\]/g,`\\$&`)}o(Oa,`escapeReg

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView on unpkg · L46

Source & flagged code

2 flagged · loading source

dist/cli.mjsView file

19import { dirname, join, resolve } from "node:path"; L20: function findProjectRoot(from = process.cwd()) { L21: let dir = resolve(from); ... L31: if (!existsSync(file)) return { ...DEFAULTS }; L32: const raw = JSON.parse( L33: readFileSync(file, "utf-8") ... L348: IGNORE_DIRS = /* @__PURE__ */ new Set(["node_modules", ".git", "dist", "build", ".workbench"]); L349: IGNORE_FILES = /* @__PURE__ */ new Set(["pnpm-lock.yaml", "package-lock.json", "yarn.lock", ".DS_Store", "Thumbs.db"]); L350: } ... L514: }), L515: respondBlocked: (msg) => ({ exitCode: 2, stderr: msg }), L516: formatModel: (_providerId, modelId) => modelId,

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L19

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView on unpkg · L46

Findings

1 Critical4 Medium7 Low

CriticalTrojan Source Unicodeweb/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.js

MediumNetwork

MediumEnvironment Vars

MediumProtestware

MediumStructural Risk Force Deep Review

LowNon Install Lifecycle Scripts

LowScripts Present

LowWeak Cryptodist/cli.mjs

LowFilesystem

LowObfuscated

LowHigh Entropy Strings

LowUrl Strings

Source & flagged code

2 flagged

dist/cli.mjsView file

Lines 1-39javascript

1#!/usr/bin/env node

2var __defProp = Object.defineProperty;

3var __getOwnPropNames = Object.getOwnPropertyNames;

4var __esm = (fn, res, err) => function __init() {

5 if (err) throw err[0];

6 try {

7 return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;

8 } catch (e) {

9 throw err = [e], e;

10 }

11};

12var __export = (target, all) => {

13 for (var name in all)

14 __defProp(target, name, { get: all[name], enumerable: true });

15};

17// core/config.ts

18import { existsSync, readFileSync } from "node:fs";

19import { dirname, join, resolve } from "node:path";

20function findProjectRoot(from = process.cwd()) {

21 let dir = resolve(from);

22 while (true) {

23 if (existsSync(join(dir, CONFIG_FILENAME))) return dir;

24 const parent = dirname(dir);

25 if (parent === dir) return resolve(from);

26 dir = parent;

27 }

28}

29function loadConfig(root) {

30 const file = join(root, CONFIG_FILENAME);

31 if (!existsSync(file)) return { ...DEFAULTS };

32 const raw = JSON.parse(

33 readFileSync(file, "utf-8")

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/cli.mjsView on unpkg · L19

34 );

35 return {

36 ...DEFAULTS,

37 ...raw,

38 docs: { ...DEFAULTS.docs, ...raw.docs },

39 gates: { ...DEFAULTS.gates, ...raw.gates },

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView file

Critical

Trojan Source Unicode

Source contains bidi control or invisible Unicode characters associated with Trojan Source attacks.

web/dist/assets/chunk-KEIR6QF5-BfrZ3jm6.jsView on unpkg · L46