@devflow-tools/knowledge-engine@0.18.50
Version-aware project knowledge ingestion and retrieval for DevFlow.
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe postinstall hook installs Chromium for the package’s Playwright-backed documentation fetcher. Inspected network and Git operations support documentation retrieval through library APIs, with no concrete attack behavior identified.
Decision evidence
public snapshot- package.json defines postinstall as installing Playwright Chromium, matching the runtime’s Playwright browser support.
- The package entrypoint exports library APIs; its documentation retrieval runs through syncDocs when called and when a source is registered.
- The Context7 fetcher requests documentation topics from the Context7 API; the GitHub fetcher clones documentation repositories into its supplied temporary directory.
- HTML retrieval fetches the URL supplied to the library and converts the response to Markdown.
Source & flagged code
6 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json defines postinstall as installing Playwright Chromium, matching the runtime’s Playwright browser support.
package.jsonView on unpkg · L13Findings
Affected versions and remediation
This report applies to @devflow-tools/knowledge-engine@0.18.50.
See all versions of @devflow-tools/knowledge-engine for other recorded verdicts.
- Review the evidence and your use of @devflow-tools/knowledge-engine@0.18.50 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.