@devflow-tools/knowledge-engine@0.19.3
Version-aware project knowledge ingestion and retrieval for DevFlow.
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe postinstall hook installs Playwright’s Chromium asset, while the package’s network operations serve its knowledge-ingestion features and are exposed through callable functions. Inspected telemetry code writes project-local logs and filters sensitive fields; no malicious behavior was identified.
Decision evidence
public snapshot- The postinstall hook runs `playwright install chromium`, installing the browser asset used by this package’s Playwright fetcher.
- The package entry point only re-exports modules; its network and browser operations are exposed as functions.
- HTTP fetching and GitHub cloning are implemented inside explicit fetch functions for knowledge sources.
- The telemetry dependency writes project-scoped logs and checks event data for sensitive fields before logging.
- The postinstall hook downloads Chromium, but this is a browser asset needed by the package’s headless-fetching feature.
- Runtime fetching can contact the supplied URL, Context7, or GitHub, consistent with documentation ingestion.
Source & flagged code
6 flaggedPackage defines install-time lifecycle scripts.
package.jsonView on unpkgInstall-time lifecycle script is not statically allowlisted and needs review.
package.jsonView on unpkgThe postinstall hook runs `playwright install chromium`, installing the browser asset used by this package’s Playwright fetcher.
package.jsonView on unpkg · L18Findings
Affected versions and remediation
This report applies to @devflow-tools/knowledge-engine@0.19.3.
See all versions of @devflow-tools/knowledge-engine for other recorded verdicts.
- Review the evidence and your use of @devflow-tools/knowledge-engine@0.19.3 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.