registry  /  @g7e6-sdlc/sdlc-cli  /  0.4.0

@g7e6-sdlc/sdlc-cli@0.4.0

⚠ Under review

SDLC 最小集 CLI（sdlc-cli）— 本地即真源的中间产物仓库与工作区装配

Static Scan Results

scanned 2h ago · by rust-scanner

Static analysis flagged 9 finding(s) at 86.0% confidence. This version is warn-only unless an AI or security-team review confirms malicious behavior.

Static reason
High-risk behavior combination matched malicious policy.

Decision evidence

public snapshot
Behavioral surface
Source
ChildProcessEnvironmentVarsFilesystemNetworkShell
Supply chainNo supply-chain packaging signals triggered.
Manifest
NoLicense
scanned 1 file(s), 61.9 KB of source

Source & flagged code

3 flagged · loading source
package.jsonView file
•scripts.postinstall = node ./dist/cli.js install || true
High
Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg
•scripts.postinstall = node ./dist/cli.js install || true
Medium
Ambiguous Install Lifecycle Script

Install-time lifecycle script is not statically allowlisted and needs review.

package.jsonView on unpkg
dist/cli.jsView file
1Install-time AI-agent control hijack evidence: L67: import { L68: cpSync, L69: existsSync, L70: mkdirSync, L71: readdirSync, ... L73: rmSync, L74: writeFileSync L75: } from "fs"; ... L80: function mkdirp(path) { L81: mkdirSync(path, { recursive: true }); L82: } ... L87: function copyDir(src, dest) { Payload evidence from skills/configuring-sdlc/SKILL.md: L1: --- L2: name: configuring-sdlc
Critical
Ai Agent Control Hijack

Install-time source drops package-supplied AI-agent/MCP control files or instructions.

dist/cli.jsView on unpkg · L1

Findings

1 Critical1 High4 Medium3 Low
CriticalAi Agent Control Hijackdist/cli.js
HighInstall Time Lifecycle Scriptspackage.json
MediumAmbiguous Install Lifecycle Scriptpackage.json
MediumNetwork
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowNo License