@devflow-tools/knowledge-engine@0.18.51
Version-aware project knowledge ingestion and retrieval for DevFlow.
AI Security Review
scanned 22d ago · by lpm-firewall-aiThe install hook is consistent with Playwright browser setup, and inspected network behavior supports documentation ingestion through callable library APIs. The scanner’s lifecycle and network signals do not establish malicious behavior.
Decision evidence
public snapshot- package.json declares a postinstall command that installs Chromium through the declared Playwright dependency.
- The runtime entrypoint exports a library API; source fetching is performed inside the explicitly callable syncDocs method.
- syncDocs fetches from configured documentation sources using Context7 and GitHub helpers.
- Built-in sources point to public documentation projects, and the Context7 helper uses context7.com.
- The HTML fetcher requests the URL passed to it; the GitHub helper invokes git with separate arguments for clone and sparse checkout.
Source & flagged code
6 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgpackage.json declares a postinstall command that installs Chromium through the declared Playwright dependency.
package.jsonView on unpkg · L18Findings
Affected versions and remediation
This report applies to @devflow-tools/knowledge-engine@0.18.51.
See all versions of @devflow-tools/knowledge-engine for other recorded verdicts.
- Review the evidence and your use of @devflow-tools/knowledge-engine@0.18.51 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.