registry / @hacksmith/doraval / 0.4.12

@hacksmith/doraval@0.4.12

Scale your AI context for coding agents. Make your next context work (skills, plugins & more) for your team, community, or self. Context engineering toolkit for AI coding agents.

AI Security Review

scanned 19d ago · by lpm-firewall-ai

No confirmed malicious attack surface. The package is a user-invoked AI context/journal CLI with explicit Bun bootstrap, local dashboard, validation, hook management, update checks, and LLM judge features.

Static reason

One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source

Trigger

User runs dora/doraval commands such as ui, journal hook enable, validate, update, or judge.

Impact

Creates ~/.doraval data, optional Claude hook config, scaffolds project files, or contacts configured service endpoints when corresponding commands are run.

Mechanism

Package-aligned CLI operations with user-invoked filesystem writes, subprocesses, and network calls

Rationale

Static inspection found powerful CLI primitives, but they are reachable through explicit user commands and match the package’s documented purpose of managing AI-agent context, journaling, validation, and evaluation. I found no install/import-time execution, hidden exfiltration, or unconsented lifecycle agent-control mutation.

Evidence

package.jsonbin/doraval-wrapper.jsbin/doraval.jsbin/ui-es8sz3m2.jsbin/index-6fd7v8sr.jsbin/index-40dgb25j.jsbin/index-6ppdwg19.jsbin/update-pt4emv04.jsbin/index-xxkb2n22.js~/.cache/doraval/bun~/.doraval/config.yml~/.doraval/journals~/.doraval/pending~/.doraval/evals

@hacksmith/doraval@0.4.12

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code